joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10009bb9
Capabilities:
Accept command line arguments

Disassembly:
push 8
push 0x10042958
call fcn.1000aecb
mov eax, dword [ebp + 0xc]
cmp eax, 1
jne 0x10009c47
call fcn.1000ae99
test eax, eax
jne 0x10009bdd
xor eax, eax
jmp 0x10009d13
call fcn.1000a293
test eax, eax
jne 0x10009bed
call fcn.1000aeb7
jmp 0x10009bd6
call fcn.1000ae4d
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x10049d38], eax
call fcn.1003d908
mov dword [0x10048aa4], eax
call fcn.1003d908
test eax, eax
jns 0x10009c17
call fcn.10009f6a
jmp 0x10009be6
call fcn.1003d908
test eax, eax
js 0x10009c40
call fcn.1000aa85
test eax, eax
js 0x10009c40
push 0
call fcn.1003d908
pop ecx
test eax, eax
jne 0x10009c40
inc dword [0x10048aa0]
jmp 0x10009d10
call fcn.1000aa32
jmp 0x10009c10
xor edi, edi
cmp eax, edi
jne 0x10009ca6
cmp dword [0x10048aa0], edi
jle 0x10009bd6
dec dword [0x10048aa0]
mov dword [ebp - 4], edi
cmp dword [0x10048ad8], edi
jne 0x10009c6b
call fcn.1000a7c0
cmp dword [ebp + 0x10], edi
jne 0x10009c7f
call fcn.1000aa32
call fcn.10009f6a
call fcn.1000aeb7
mov dword [ebp - 4], 0xfffffffe
call fcn.10009c92
jmp 0x10009d10
cmp eax, 2
jne 0x10009d04
call fcn.10009f36
push 0x214
push 1
call fcn.1003d908
pop ecx
pop ecx
mov esi, eax
cmp esi, edi
je 0x10009bd6
push esi
push dword [0x10046048]
push dword [0x10048ab8]
call dword [sym.imp.kernel32.dll_DecodePointer]
call eax
test eax, eax
je 0x10009cf8
push edi
push esi
call fcn.10009fad
pop ecx
pop ecx
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
mov dword [esi], eax
or dword [esi + 4], 0xffffffff
jmp 0x10009d10
push esi
call fcn.1003d908
pop ecx
jmp 0x10009bd6
cmp eax, 3
jne 0x10009d10
push edi
call fcn.1003d908
pop ecx
xor eax, eax
inc eax
call fcn.1000af10
ret 0xc

Function at 0x10009f00
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10046040]
jne 0x1000b4a0
repz ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x10048cf8], eax
mov dword [0x10048cf4], ecx
mov dword [0x10048cf0], edx
mov dword [0x10048cec], ebx
mov dword [0x10048ce8], esi
mov dword [0x10048ce4], edi
mov word [0x10048d10], ss
mov word [0x10048d04], cs
mov word [0x10048ce0], ds
mov word [0x10048cdc], es
mov word [0x10048cd8], fs
mov word [0x10048cd4], gs
pushfd
pop dword [0x10048d08]
mov eax, dword [ebp]
mov dword [0x10048cfc], eax
mov eax, dword [ebp + 4]
mov dword [0x10048d00], eax
lea eax, [ebp + 8]
mov dword [0x10048d0c], eax
mov eax, dword [ebp - 0x320]
mov dword [0x10048c48], 0x10001
mov eax, dword [0x10048d00]
mov dword [0x10048bfc], eax
mov dword [0x10048bf0], 0xc0000409
mov dword [0x10048bf4], 1
mov eax, dword [0x10046040]
mov dword [ebp - 0x328], eax
mov eax, dword [0x10046044]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x10048c40], eax
push 1
call fcn.1000ce11
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x10001564
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x10048c40], 0
jne 0x1000b58c
push 1
call fcn.1000ce11
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret
Function at 0x1001100d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x100418d8
call fcn.10037358
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x41c], edx
mov dword [ebp - 0x430], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], ebx
mov dword [ebp - 0x418], ebx
push 2
push ebx
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x1001106e
call fcn.1000e3e2
mov esi, eax
jmp 0x10011146
push dword [ebp - 0x41c]
push esi
push edi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x1001108c
call fcn.1000e3e2
jmp 0x1001113d
push esi
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x420], eax
test eax, eax
je 0x10011082
push esi
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
mov dword [ebp - 0x41c], esi
cmp eax, esi
jae 0x100110bf
mov esi, 0x8007000e
jmp 0x1001113f
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.1003d908
mov dword [ebp - 4], 1
jmp 0x100110f3
cmp dword [ebp - 0x418], 0
je 0x100110b5
push esi
push dword [ebp - 0x418]
push esi
push dword [ebp - 0x420]
push ebx
push 3
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x10011082
mov eax, dword [ebp - 0x418]
push dword [ebp + 0x14]
xor edx, edx
mov word [eax + ecx*2], dx
push dword [ebp - 0x418]
lea ecx, [ebp - 0x42c]
call fcn.1003d908
mov esi, eax
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x1001115f
lea ecx, [ebp - 0x418]
call fcn.10011269
mov eax, esi
call fcn.100373b1
ret 0x10
Function at 0x1003d908
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x1003d917
pop dword [ebp - 0x1c]
mov eax, 0x9b123747
add eax, 0x74f1a1d0
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x2d962687
sub dword [ebp - 0x2c], 0xdf43e13c
mov dword [ebp - 0x28], 0x2bb98da2
sub dword [ebp - 0x28], 0xf986415d
mov dword [ebp - 0x24], 0x585f8abc
sub dword [ebp - 0x24], 0xc13468e
mov dword [ebp - 0x20], 0xe45913f9
sub dword [ebp - 0x20], 0xe45913f9
lea eax, [ebp - 0x2c]
push eax
mov eax, 0xee5dbdcc
add eax, 0x21a253b8
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x33e5aa14
add dword [ebp - 0x2c], 0x408cbf42
mov dword [ebp - 0x28], 0xe21e649d
add dword [ebp - 0x28], 0x5f4dfcd8
mov dword [ebp - 0x24], 0x563869e5
add dword [ebp - 0x24], 0xd370287
mov dword [ebp - 0x20], 0xeca34b9
sub dword [ebp - 0x20], 0xeca34b9
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0xed2e22ca
add eax, 0x22d1ed36
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x41b87
push 0
call eax
mov ecx, 0xb8085675
sub ecx, 0xb8081798
xor edi, edi
add edi, eax
mov edx, 0x10051800
add edx, dword [ebp - 0x1c]
mov esi, 0x9ec2cbcc
sub dword [ebp - 0x10], ecx
mov ebx, dword [edx]
xor dword [ebp - 0xc], edi
sub ebx, esi
add dword [ebp - 0x14], edx
mov dword [edi], ebx
add dword [ebp - 0x10], ecx
add edi, 4
add edx, 0x65a3959e
add edx, 0x9a5c6a66
loop 0x1003da2f
add eax, 0x4490b32b
add eax, 0xbb703b1c
mov ebx, eax
add eax, 0x823565e4
sub eax, 0x823565df
mov ecx, 0x69e43ef
add ecx, 0x961bc11
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x4189c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x417015
lea edi, [esi - 0x6015]
push edi
jmp 0x4189da
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4189e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4189d0
mov eax, 1
add ebx, ebx
jne 0x4189f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4189e8
jne 0x418a04
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4189e8
xor ecx, ecx
sub eax, 3
jb 0x418a18
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x418a8a
mov ebp, eax
add ebx, ebx
jne 0x418a23
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x418a30
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x418a54
inc ecx
add ebx, ebx
jne 0x418a40
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x418a35
jne 0x418a51
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x418a35
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x418a74
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x418a65
jmp 0x4189d6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x418a74
add edi, ecx
jmp 0x4189d6
pop esi
mov edi, esi
mov ecx, 0x1a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x418a92
cmp byte [edi], 0
jne 0x418a92
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x418a97
lea edi, [esi + 0x6000]
mov eax, dword [edi]
or eax, eax
je 0x418b06
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x9144]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x91b0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x418ac4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x91b8]
or eax, eax
je 0x418b00
mov dword [ebx], eax
add ebx, 4
jmp 0x418ae1
call dword [esi + 0x91b4]
mov ebp, dword [esi + 0x91bc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x418b3a
sub esp, 0xffffff80
jmp 0x411ab0

Function at 0x42c005
Capabilities:
Packed with generic packer

Disassembly:
jmp fcn.0042a8d0
jmp section.42vab535
Function at 0x453603
Capabilities:
Encode data using xor

Disassembly:
push edx
fcom dword [edx - 0x4a]
retf
lodsb al, byte [esi]
mov dword [0x4621ce24], eax
shl byte [eax + 0x57fb3413], 0xe0
outsd dx, dword [esi]
mov al, byte [0x57fb3413]
loopne 0x45361f
inc ebx
pop edi
or al, 0x8f
pushal
mov esi, 0x23f78132
xchg edx, eax
jae 0x4535c4
adc al, 0x48
pop ds
cmp eax, 0xe0fe83f7
rcl byte [ebx - 0xfc913d3], cl
push ds
loopne 0x453598
xchg ebx, eax
sub eax, 0x1ef036ec
in al, dx
invalid
xor byte [esi], 0xbd
clc
pop esp
adc esi, ecx
xor eax, 0x79d7d314
daa
jb 0x4535c8
push edx
movsb byte es:[edi], byte ss:[esi]
xor ebx, dword [ebx]
jecxz 0x453615
xchg edx, eax
cmpsb byte [esi], byte es:[edi]
das
invalid
out 0xb5, al
dec byte [eax - 0x2e]
xor eax, 0xffbe985b
leave
loope 0x4535a2
out dx, eax
jno 0x453657
push ss
mov byte [0xdd56927e], al
int1
mov bl, 0x31
add byte [0xf81204e3], 0x91
jle 0x4535a9
push esi
invalid
xor dword [edx + 0x1204e305], eax
add al, 0x12
clc
xchg ecx, eax
pop es
jle 0x453624
mov esi, 0xa18b5911
push ss
invalid
dec ebp
js 0x45361b
and eax, 0x540d5614
jge 0x453630
xchg byte [esi], dh
mov ah, 0x26
retf 0xf087
add eax, 0x6ee336cb
outsb dx, byte [esi]
add ebx, dword [edx + 0x7a]
mov esi, esp
neg dword [ecx]
stc
mov dh, 0xa8
mov ebx, 0xfd4b6d39
sub ebx, 0xffffffd4
mov ecx, 0x549a0b4
cdq
jae 0x4536ca
mov byte cs:[ebx + 0x4197139a], 0xb1
jnp 0x453666
das
out 0x42, eax
mov esp, dword [ebp + edi*8 - 0x1e]
jo 0x45369d
mov esi, 0x21d12d07
and eax, 0x1733e2
jno 0x4536a8
adc edx, dword [ebx + 0x37]
push ebx
aaa
pop ebx
inc esp
fistp word [ebx - 0x1c]
add esp, dword [ebp + 0x39cbbe0]
mov word [edi + 0x22], es
inc ecx
jno 0x453633
movsd dword es:[edi], dword [esi]
loopne 0x45365b
pushfd
add ecx, dword [edi + eax*2 - 0x748ebede]
xchg esi, eax
xchg edi, eax
daa
inc ecx
mov dl, 0x5f
xlatb
invalid
and byte [edx], 0x73
xchg edi, eax
salc
add ecx, edi
jle 0x4536d7
xor bl, byte [ebx]
in eax, dx
push esi
scasb al, byte es:[edi]
call 0x675540d0
xchg ecx, eax
jp 0x45375c
dec eax
jae 0x4536f0
nop
xor ecx, esi
cmc
push eax
mov al, byte [0xaae27e5d]
cmpsd dword [esi], dword es:[edi]
add eax, dword [eax]
pop eax
mov al, 0x1b
mov edx, 0x4b363156
and al, byte [edx - 0x1c]
cwde
jae 0x453694
add dword [edi + 0x47], ebp
mov bl, 0x1f
jo 0x453719
fidivr word [esi]
ret
or ebx, esi
mov dh, 0xe1
cmp byte [ebp - 0x7c2c01f8], al
jmp 0xe36c9973
jecxz 0x4537d6
pushfd
pop edi
push esp
invalid
and byte [eax - 0x31], al
out 0x1a, al
jmp 0x9bdc49b6
Function at 0x463919
Capabilities:
Check for software breakpoints

Disassembly:
fcom qword [ebx - 0x35]
fnsave dword [ecx - 0x2e]
or dword [ecx - 0x70], ebp
sub ecx, 0
add al, 0xf3
mov ebp, 0xb670583d
lds esp, [esp + ecx*4]
aad 0xef
dec esi
cmp eax, 0x7eea9734
inc eax
pop ebx
invalid
jmp 0x463865
xor edx, dword [edx]
lahf
je 0x463938
bound edx, qword [ecx]
arpl word [ecx - 0x314c894d], ax
xchg esi, eax
enter 0x7fd3, 0xffffffffffffffdf
inc ebx
int1
mov al, byte [ebx + 0x53]
lodsd eax, dword [esi]
mov esp, 0x4fe7a97
aas
mov dword [edx], edx
xchg edx, eax
mov dword [edi], edx
outsd dx, dword [esi]
loop 0x4638dc
adc dl, byte [edx - 0x1d90e877]
popfd
leave
daa
push edi
cmp ah, dh
adc bl, cl
and dh, byte [edx]
out 0xd2, al
xchg ebp, eax
lodsb al, byte [esi]
loop 0x463965
add dh, cl
xchg edx, eax
insb byte es:[edi], dx
adc esp, dword [esi + 0x30]
stosb byte es:[edi], al
and eax, dword [eax + 0x5e]
aaa
in al, dx
leave
cmp dword [bp + di + 0x37], esi
out 0x77, eax
cmp byte [eax - 0x7d], 0xcc
push es
jp 0x4639d5
int3
sal dword [ebx], 0x97
out dx, eax
jb 0x4639cd
xlatb
add eax, 0x6b2e33c6
push esi
test al, 0x7e
inc edi
xor esi, dword [ebx + 0x32]
xchg dword fs:[edx + 0x66ae72ed], edx
into
push edi
loop 0x463940
inc edx
and byte [edi], al
xchg ecx, eax
push edi
jmp 0x463993
jp 0x4639fb
xor edi, dword [edi]
mov esp, 0x4f77d3f
or byte [ebx + 0x18804ae6], ch
mov bh, 0xd6
inc edx
fcompi st(4)
imul edx, ebx, 0xffffffc7
mov bl, 0xa
wait
add dh, al
sub ch, 0x9c
int1
popal
ret 0xef95
inc ecx
loope 0x4639ec
and eax, 0x31687860
inc esi
ja 0x463a3b
or dword [ecx + 0x4c], 0x6970e466
cmpsd dword [esi], dword es:[edi]
mov cl, 0x1e
xchg edi, esi
jnp 0x4639dc
in al, 0x70
imul esp, dword [edi - 0x878e14f], 0x219f67b
sbb dword [edx], eax
mov ebx, 0x1deacc32
cmp byte [ebx + 0x1c], 0x30
sbb eax, 0x301c7b80
jmp 0x463a4d
cmp dword [esi + 0x3b], ecx
std
aad 0x86
ret 0xc307
push ss
invalid
inc esp
xchg ebx, eax
popfd
or byte [edx + 0x57169986], dh
mov ah, 0xa6
add esp, esi
dec ebx
push es
push 0x18532e28
inc ebp
adc dh, ah
fisttp qword ds:[ebx - 0x1b]
ror al, cl
invalid

Function at 0x46c559
Capabilities:
Encode data using xor

Disassembly:
push ecx
ja 0x46c560
add eax, 0xeef28c73
and al, 0x86
mov eax, dword [0x6bf17e17]
shr dword [ecx - 0x5c95785f], 0x18
add eax, 0x740ca079
arpl word [edx + 0x6482b67], dx
pop eax
or ebx, dword [edx]
sub ecx, dword [ecx - 0x69f0e7b1]
cmp esp, edi
sbb bl, byte [eax + 0x6a]
add eax, 0xfb81612f
add al, 0x13
mov ebx, 0x32b18507
insd dword es:[edi], dx
dec ebx
dec ecx
invalid
invalid
Function at 0x496d89
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.004ca279
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x496eac
push ecx
lea ecx, [esi + 0x18]
call fcn.004b65a9
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x496ec3
push ecx
lea ecx, [esi + 0x24]
call fcn.004b64b9
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x49cbf8
Capabilities:
Encode data using xor

Disassembly:
jmp 0x49cc26
in al, 0xad
xchg dword [edx - 0x63], ecx
pop ss
outsd dx, dword [esi]
mov edx, dword [ebx - 0x1b]
inc esp
or dword [eax + 0x77], ebp
invalid
Function at 0x4e01e9
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call int.005136d9
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x4e030c
push ecx
lea ecx, [esi + 0x18]
call fcn.004ffa09
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x4e0323
push ecx
lea ecx, [esi + 0x24]
call fcn.004ff919
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4ee909
Capabilities:
Encode data using xor

Disassembly:
and al, 0x6e
movsb byte es:[edi], byte [esi]
cld
ja 0x4ee970
mov dh, 0x59
lahf
xchg byte [eax], cl
js 0x4ee92f
mov dword [edi + 0x211a1fdf], ebp
scasd eax, dword es:[edi]
fistp word [edi]
sbb ah, byte [ecx]
iretd
mov byte [edi], cl
sahf
cmp eax, 0xc411a72
cmc
adc byte [esi + 0x1ef94c71], dh
aad 0x91
xor bl, ch
mov ecx, 0xe937b352
mov ch, 0xec
out 0xa4, al
invalid
mov bh, 0x10
adc edi, edx
jle 0x4ee917
pop edi
jp 0x4ee9e2
fist word [edx - 0x6a]
sub eax, 0xfef59cc7
invalid
mov esp, 0x3f6a9812
out dx, eax
invalid
Function at 0x529499
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47262f
mov eax, dword fs:[0]
push eax
sub esp, 0x138
mov eax, dword [0x4a2008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x13c], edx
mov eax, ecx
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x134], eax
mov esi, dword [ebp + 8]
mov edi, esi
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x140], 0
cmp dword [esi + 0x14], 0x10
mov ecx, dword [esi + 0x10]
mov dword [ebp - 0x138], ecx
jb 0x529500
mov edi, dword [esi]
cmp dword [edx + 0x14], 0x10
mov ecx, dword [edx + 0x10]
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x130], edx
jb 0x52951d
mov ecx, dword [edx]
mov dword [ebp - 0x130], ecx
cmp dword [edx + 0x10], 0
jbe 0x529586
push 0x100
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.00572469
mov ecx, dword [ebp - 0x138]
add esp, 0xc
add ecx, edi
cmp edi, ecx
je 0x529559
nop dword [eax]
movzx eax, byte [edi]
inc edi
mov byte [ebp + eax - 0x128], 1
cmp edi, ecx
jne 0x529549
mov edx, dword [ebp - 0x130]
mov edi, edx
mov ecx, dword [ebp - 0x134]
add ecx, edx
cmp edx, ecx
jae 0x529580
movzx eax, byte [edi]
mov al, byte [ebp + eax - 0x128]
test al, al
je 0x5295da
inc edi
cmp edi, ecx
jb 0x52956d
mov eax, dword [ebp - 0x12c]
xorps xmm0, xmm0
mov ecx, eax
push 0
movups xmmword [eax], xmm0
push 0x491667
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
call fcn.0055ce09
mov dword [ebp - 4], 0
mov dword [ebp - 0x140], 1
mov eax, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00570ce5
mov esp, ebp
pop ebp
ret
sub edi, edx
cmp edi, 0xffffffff
je 0x529580
cmp dword [esi + 0x14], 0x10
jb 0x5295e9
mov esi, dword [esi]
mov ecx, dword [ebp - 0x13c]
mov dword [ebp - 0x130], ecx
cmp dword [ecx + 0x14], 0x10
jb 0x529603
mov eax, dword [ecx]
mov dword [ebp - 0x130], eax
push 0x100
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.00572469
mov ecx, dword [ebp - 0x138]
add esp, 0xc
add ecx, esi
cmp esi, ecx
je 0x529639
nop dword [eax]
movzx eax, byte [esi]
inc esi
mov byte [ebp + eax - 0x128], 1
cmp esi, ecx
jne 0x529629
mov eax, dword [ebp - 0x134]
or ecx, 0xffffffff
mov edx, dword [ebp - 0x130]
dec eax
cmp eax, ecx
cmovb ecx, eax
movzx eax, byte [ecx + edx]
add ecx, edx
mov al, byte [ebp + eax - 0x128]
test al, al
je 0x529677
cmp ecx, edx
je 0x5296ee
movzx eax, byte [ecx - 1]
dec ecx
mov al, byte [ebp + eax - 0x128]
test al, al
jne 0x52965f
sub ecx, edx
sub ecx, edi
lea eax, [ebp - 0x28]
inc ecx
push ecx
mov ecx, dword [ebp - 0x13c]
push edi
push eax
call fcn.005483d9
mov dword [ebp - 4], 1
xorps xmm0, xmm0
mov esi, dword [ebp - 0x12c]
mov dword [ebp - 0x140], 1
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
movups xmm0, xmmword [ebp - 0x28]
mov dword [esi + 0x14], 0
mov byte [ebp - 0x28], 0
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x18]
movq qword [esi + 0x10], xmm0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.0055cf39
mov eax, esi
jmp 0x5295bf
or ecx, 0xffffffff
jmp 0x529679
Function at 0x529919
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.0055ce09
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x529a3c
push ecx
lea ecx, [esi + 0x18]
call int.00549139
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x529a53
push ecx
lea ecx, [esi + 0x24]
call fcn.00549049
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret