joyce8/EMBER2024-capa huggingface dataset:
Function at 0x496ae2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47262f
mov eax, dword fs:[0]
push eax
sub esp, 0x138
mov eax, dword [0x4a2008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x13c], edx
mov eax, ecx
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x134], eax
mov esi, dword [ebp + 8]
mov edi, esi
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x140], 0
cmp dword [esi + 0x14], 0x10
mov ecx, dword [esi + 0x10]
mov dword [ebp - 0x138], ecx
jb 0x496b49
mov edi, dword [esi]
cmp dword [edx + 0x14], 0x10
mov ecx, dword [edx + 0x10]
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x130], edx
jb 0x496b66
mov ecx, dword [edx]
mov dword [ebp - 0x130], ecx
cmp dword [edx + 0x10], 0
jbe 0x496bcf
push 0x100
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.004dfab2
mov ecx, dword [ebp - 0x138]
add esp, 0xc
add ecx, edi
cmp edi, ecx
je 0x496ba2
nop dword [eax]
movzx eax, byte [edi]
inc edi
mov byte [ebp + eax - 0x128], 1
cmp edi, ecx
jne 0x496b92
mov edx, dword [ebp - 0x130]
mov edi, edx
mov ecx, dword [ebp - 0x134]
add ecx, edx
cmp edx, ecx
jae 0x496bc9
movzx eax, byte [edi]
mov al, byte [ebp + eax - 0x128]
test al, al
je 0x496c23
inc edi
cmp edi, ecx
jb 0x496bb6
mov eax, dword [ebp - 0x12c]
xorps xmm0, xmm0
mov ecx, eax
push 0
movups xmmword [eax], xmm0
push 0x491667
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
call fcn.004ca452
mov dword [ebp - 4], 0
mov dword [ebp - 0x140], 1
mov eax, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004de32e
mov esp, ebp
pop ebp
ret
sub edi, edx
cmp edi, 0xffffffff
je 0x496bc9
cmp dword [esi + 0x14], 0x10
jb 0x496c32
mov esi, dword [esi]
mov ecx, dword [ebp - 0x13c]
mov dword [ebp - 0x130], ecx
cmp dword [ecx + 0x14], 0x10
jb 0x496c4c
mov eax, dword [ecx]
mov dword [ebp - 0x130], eax
push 0x100
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.004dfab2
mov ecx, dword [ebp - 0x138]
add esp, 0xc
add ecx, esi
cmp esi, ecx
je 0x496c82
nop dword [eax]
movzx eax, byte [esi]
inc esi
mov byte [ebp + eax - 0x128], 1
cmp esi, ecx
jne 0x496c72
mov eax, dword [ebp - 0x134]
or ecx, 0xffffffff
mov edx, dword [ebp - 0x130]
dec eax
cmp eax, ecx
cmovb ecx, eax
movzx eax, byte [ecx + edx]
add ecx, edx
mov al, byte [ebp + eax - 0x128]
test al, al
je 0x496cc0
cmp ecx, edx
je 0x496d37
movzx eax, byte [ecx - 1]
dec ecx
mov al, byte [ebp + eax - 0x128]
test al, al
jne 0x496ca8
sub ecx, edx
sub ecx, edi
lea eax, [ebp - 0x28]
inc ecx
push ecx
mov ecx, dword [ebp - 0x13c]
push edi
push eax
call fcn.004b5a22
mov dword [ebp - 4], 1
xorps xmm0, xmm0
mov esi, dword [ebp - 0x12c]
mov dword [ebp - 0x140], 1
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
movups xmm0, xmmword [ebp - 0x28]
mov dword [esi + 0x14], 0
mov byte [ebp - 0x28], 0
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x18]
movq qword [esi + 0x10], xmm0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.004ca582
mov eax, esi
jmp 0x496c08
or ecx, 0xffffffff
jmp 0x496cc2
Function at 0x496f62
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.004ca452
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x497085
push ecx
lea ecx, [esi + 0x18]
call fcn.004b6782
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x49709c
push ecx
lea ecx, [esi + 0x24]
call fcn.004b6692
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x499dd2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x4a2008]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov edx, eax
push ebx
push esi
push edi
mov edi, ecx
shr edx, 0x10
mov ecx, eax
and ecx, 0xf0
cmp ecx, 0x90
je 0x499e0d
cmp ecx, 0x80
jne 0x499f35
jmp 0x499e15
test dl, dl
jne 0x499edd
shr eax, 8
movzx eax, al
push eax
push dword [edi + 0x39c]
push dword [edi + 0x398]
call fcn.004feb52
mov edx, dword [edi + 0x39c]
cmp eax, edx
je 0x499f35
lea ecx, [eax + 4]
sub edx, ecx
push edx
push ecx
push eax
call fcn.004df532
add dword [edi + 0x39c], 0xfffffffc
add esp, 0xc
mov eax, dword [edi + 0x398]
cmp eax, dword [edi + 0x39c]
jne 0x499f35
movups xmm0, xmmword [edi + 0x3b0]
lea edx, [edi + 0x3c0]
lea ecx, [ebp - 0x2c]
movups xmmword [ebp - 0x30], xmm0
call fcn.00499432
mov eax, dword [edi + 0x3c0]
add dword [ebp - 0x2c], eax
movups xmm0, xmmword [ebp - 0x30]
movups xmmword [edi + 0x388], xmm0
adc dword [edi + 0x388], eax
nop
mov esi, dword [edi + 0x23c]
mov edx, 4
mov eax, dword [edi + 0x238]
mov ebx, dword [edi + 0x388]
cmp eax, esi
je 0x499ec0
nop dword [eax + eax]
pop ds
inc esp
add byte [eax], al
cmp dword [eax], ebx
ja 0x499eb9
mov edx, dword [eax + 4]
add eax, 8
cmp eax, esi
jne 0x499eb2
mov eax, dword [edi + 0x38c]
mov eax, dword [edi + 0x38c]
cmp edx, eax
jg 0x499f35
sub eax, edx
mov dword [edi - 0x482efc74], eax
jno 0x499e8b
sbb eax, 0xae17632d
xlatb
stosd dword es:[edi], eax
out 0xcd, eax
dec eax
stosd dword es:[edi], eax
xlatb
adc byte [edi - 0x74], dl
inc eax
or eax, 0xee43d347
xchg esp, eax
sub al, 0xec
in al, dx
cmp al, 0x5b
sub dword [edi + 0x4b8d46fe], esi
les esp, [ebx - 0x20]
leave
test ecx, edx
mov edx, 0xc72799e6
popal
js 0x499eae
cmc
jp 0x499f1d
and al, 0xd
cmpsd dword [esi], dword es:[edi]
add al, 0x44
sbb bh, ah
pop ds
out dx, al
inc edi
xor al, 0xdc
retf
rcl dword [edx + 0x6c]
xor byte es:[esi - 0x5a], dl
movsd dword es:[edi], dword [esi]
or byte [edx - 0x5d], dh
pop ds
dec edi
jbe 0x499f67
push ss
push es
jecxz 0x499ebf
cmpsd dword [esi], dword es:[edi]
mov word [eax], es
cmp eax, dword [eax - 0x964585c]
mov ch, byte [eax + 0x53fec66b]
or al, 0x76
psrlq mm2, qword [edx + 0x4a96fa33]
xor eax, 0x753c7356
cmp esp, dword [esi + 0x5f]
xchg ebx, eax
cmp eax, dword [ebx - 0x4cec4998]
jns 0x499eeb
and byte [edi - 0x57750965], 0x6b
invalid
add ebx, dword [esi + 0x658f0ac2]
inc ebp
jo 0x499f74
jne 0x499fa9
inc esi
mov edx, dword [edx - 0x567cdda5]
xchg ecx, eax
jns 0x499f09
mov ecx, 0x6c45fc9a
cld
inc ebp
insb byte es:[edi], dx
add ebp, dword [esi - 0xa]
xor ecx, esp
scasb al, byte es:[edi]
invalid
inc ebp
mov dword [0x7a436af6], eax
pop es
invalid
Function at 0x4c0c72
Capabilities:
Encode data using xor

Disassembly:
aas
sal dword [edi + 0x2d35ae8], cl
js 0x4c0bdb
cmp dword [edx + 0x38], ecx
cmp byte [esi + 0x77], dl
inc edx
push es
popal
shl byte [ecx - 0x2c4d3a16], 1
jmp 0x8bd9916
in al, dx
pop ss
push es
out dx, eax
out 0x33, al
inc ecx
dec esp
mov ah, 0xad
inc eax
mov al, 0x2e
int1
lodsb al, byte [esi]
push ss
fiadd word [edi - 0x34]
jecxz 0x4c0c07
sal byte [ecx - 0x69], 1
scasb al, byte es:[edi]
sub bl, byte cs:[esi + 0x1e]
sub bl, byte cs:[esi + 0x1e]
daa
invalid
insb byte es:[edi], dx
sal dword [eax - 0x7ab52941], 0x1c
jmp 0x4c0c4f
push esi
aaa
mov edi, 0xfe537547
push ss
out dx, al
salc
jmp 0x4c0c22
jp 0x4c0bdc
pop eax
xchg ebx, eax
invalid
jne 0x4c0c09
fucomp st(4)
add esi, dword [edx + 0x5d]
jns 0x4c0c29
rcl byte [ebx]
dec ecx
mov bh, 0x59
lcall 0xa1, 0xb297ea5f
fidivr dword [eax - 0x19]
outsb dx, byte [esi]
pop ebx
or dword [edx], 0x78c0a209
xor dl, al
cmp esi, ebp
adc dword cs:[ebx - 0x34], edx
push ds
lodsd eax, dword [esi]
xchg byte [edi + 0x53], dl
pop ebp
in al, dx
mov ecx, 0xb7e296d8
pop edx
pop ss
stosb byte es:[edi], al
ror byte [edx], 0x1d
add ah, byte [ebx + 0x6b1fc9e8]
test dword [edi + 0x4e], edi
xlatb
jne 0x4c0c83
jle 0x4c0c69
jle 0x4c0c3b
les esi, [ebx + 0x4c]
xchg dword [edx], edx
and eax, 0x1ff2ebcb
in al, dx
arpl word [ecx - 0x56], dx
or byte [ecx], cl
invalid

Function at 0x4c9e72
Capabilities:
Encode data using xor

Disassembly:
sahf
arpl bx, cx
xchg edx, eax
sal byte [edi - 0x40412b08], 0xde
adc eax, 0xc4248cfe
ja 0x4c9e9c
invalid
out dx, al
push edx
inc ebp
xchg ebp, eax
adc esp, 0x7c
push cs
push cs
js 0x4c9eb1
add byte [0xd6234b7b], bl
xchg ebp, eax
dec esp
mov eax, 0x308d9b8d
wait
lea esi, [eax]
cmpsb byte [esi], byte es:[edi]
dec edx
mov esp, 0x3dfc7b89
je 0x4c9f02
sal dword [ebx], 0xef
jecxz 0x4c9f24
imul esp, dword [edx], 0x7b
outsb dx, byte [esi]
add byte [edi], bl
rcl dword [esi], 0x9e
and edi, eax
push es
cli
mov eax, 0xd8cedb88
jl 0x4c9ea4
pop esi
sti
je 0x4c9f20
mov edi, 0xff7519c7
fsubr dword [esi]
cmpsd dword [esi], dword es:[edi]
mov esp, 0x5d548204
cwde
daa
cwde
cmpsb byte [esi], byte es:[edi]
push edi
aas
dec eax
jle 0x4c9f43
and ch, cl
scasd eax, dword es:[edi]
mov edi, 0x9eae32f
wait
inc ebx
sub eax, 0x7eddc825
lds ebx, [ebx + 0x37572253]
and dl, byte [edi + 0x37]
xor byte [edi - 0x3c], cl
sti
pop ds
inc esi
fdivr dword [esi]
mov eax, dword [0x96cd959d]
inc edx
mov bh, byte [esi - 0x72]
sub al, 0xc9
jge 0x4c9ef9
invalid
jmp dword [edx]
adc byte [edi + ecx], 0x97
into
dec esi
imul esi, dword [edx - 0x7fb6f39e], 0xf
add eax, 0x17491515
Function at 0x4e03c2
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.005138b2
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x4e04e5
push ecx
lea ecx, [esi + 0x18]
call fcn.004ffbe2
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x4e04fc
push ecx
lea ecx, [esi + 0x24]
call 0x4ffaf2
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x529af2
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call int.0055cfe2
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x529c15
push ecx
lea ecx, [esi + 0x18]
call fcn.00549312
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x529c2c
push ecx
lea ecx, [esi + 0x24]
call fcn.00549222
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x55cd12
Capabilities:
Encode data using xor

Disassembly:
shl byte [ebx], 0xbb
adc ebx, dword [esi + 0x5f]
jmp 0x55cd94
imul ecx, dword [ebx + 0x2f30eab5], 0xc1516c90
lahf
push edi
ret 0x8bb1
pop ebx
push eax
fiadd word [edi + 0x39]
dec eax
cmp cl, al
lcall 0xb4d5, 0x1fca2615
js 0x55cd3f
mov ch, 0xab
sub bh, byte [edx]
outsd dx, dword [esi]
xor dword cs:[ecx + 0x2d], eax
xor dword [ecx + 0x2d], eax
jl 0x55cd92
pop edx
jecxz 0x55cdea
inc esp
movsb byte es:[edi], byte [esi]
push eax
popal
out 0, al
pop esi
arpl word [esi + 0x9c66d92], bx
sub bh, cl
jmp 0x55cd7c
mov ch, 0xe2
cdq
pop eax
mov ebp, ds
imul esi, dword [eax + 0x3e], 0xfffffff0
pop ds
mov bl, 0x1d
sbb bh, byte [ebp + 8]
mov dword es:[0x726150ab], eax
lahf
inc ecx
sub eax, 0x1e7110ec
push ds
xor edi, dword [ebx + 0x38]
mov ebx, dword [ecx + 0x71]
xchg dword [edi - 0x24c61928], ebx
scasd eax, dword es:[edi]
jg 0x55ce71
pop ds
sbb byte [ebx], bh
enter 0xfffffffffffff435, 0x28
inc ecx
mov eax, dword [eax - 0x1c]
mov bl, 0x59
test dword [esi - 0x3fe0373], 0xf1b88ad1
add bh, byte [ecx + ebp*2 + 0x2a9710c6]
sbb al, 0x5a
ror dword [edx - 0x43fd0e48], 1
imul eax, esi, 0x262a9710
sbb al, 0x5a
inc eax
jp 0x55ce6a
jns 0x55ce06
inc ecx
jl 0x55ce5d
ljmp 0xd04a:0xb4feb4ac
xchg edx, eax
dec ebp
mov eax, dword [0xaafea444]
mov al, byte [ebx - 0x4fb03f0d]
cli
das
push esi
das
insd dword es:[edi], dx
xor dword [esi], esp
mov cl, byte [edi + ebx]
pop esi
pop esp
sub eax, 0x7263dd44
push ecx
dec edx
add byte [eax*4 - 0x23395b45], ch
lahf
sub al, 0x85
mov ebx, 0x9fdcc6a4
shr esp, 0x9c
ja 0x55ce80
mov es, word [0x2080ca]
inc edx
and ebx, dword [edi - 0x23dfe0dc]
pop eax
or dword [ecx], esi
pop edx
inc esp
push ds
push esp
out dx, al
out 0xbd, al
loopne 0x55ce29
rol byte [0xfa71e35d], 1
dec ecx
sub eax, 0x3569f87b
jge 0x55cec8
push es
push eax
pop ds
adc al, 0x9a
xor dh, bh
popal
mov edi, 0xba585e0a
mov ebx, 0xd00fd9aa
xchg esp, eax
mov esp, 0xd1b0e3c4
mov esp, 0xd1b0e3c4
ret
Function at 0x572c82
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47262f
mov eax, dword fs:[0]
push eax
sub esp, 0x138
mov eax, dword [0x4a2008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x13c], edx
mov eax, ecx
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x134], eax
mov esi, dword [ebp + 8]
mov edi, esi
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x140], 0
cmp dword [esi + 0x14], 0x10
mov ecx, dword [esi + 0x10]
mov dword [ebp - 0x138], ecx
jb 0x572ce9
mov edi, dword [esi]
cmp dword [edx + 0x14], 0x10
mov ecx, dword [edx + 0x10]
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x130], edx
jb 0x572d06
mov ecx, dword [edx]
mov dword [ebp - 0x130], ecx
cmp dword [edx + 0x10], 0
jbe 0x572d6f
push 0x100
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.005bbc52
mov ecx, dword [ebp - 0x138]
add esp, 0xc
add ecx, edi
cmp edi, ecx
je 0x572d42
nop dword [eax]
movzx eax, byte [edi]
inc edi
mov byte [ebp + eax - 0x128], 1
cmp edi, ecx
jne 0x572d32
mov edx, dword [ebp - 0x130]
mov edi, edx
mov ecx, dword [ebp - 0x134]
add ecx, edx
cmp edx, ecx
jae 0x572d69
movzx eax, byte [edi]
mov al, byte [ebp + eax - 0x128]
test al, al
je 0x572dc3
inc edi
cmp edi, ecx
jb 0x572d56
mov eax, dword [ebp - 0x12c]
xorps xmm0, xmm0
mov ecx, eax
push 0
movups xmmword [eax], xmm0
push 0x491667
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
call fcn.005a65f2
mov dword [ebp - 4], 0
mov dword [ebp - 0x140], 1
mov eax, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005ba4ce
mov esp, ebp
pop ebp
ret
sub edi, edx
cmp edi, 0xffffffff
je 0x572d69
cmp dword [esi + 0x14], 0x10
jb 0x572dd2
mov esi, dword [esi]
mov ecx, dword [ebp - 0x13c]
mov dword [ebp - 0x130], ecx
cmp dword [ecx + 0x14], 0x10
jb 0x572dec
mov eax, dword [ecx]
mov dword [ebp - 0x130], eax
push 0x100
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.005bbc52
mov ecx, dword [ebp - 0x138]
add esp, 0xc
add ecx, esi
cmp esi, ecx
je 0x572e22
nop dword [eax]
movzx eax, byte [esi]
inc esi
mov byte [ebp + eax - 0x128], 1
cmp esi, ecx
jne 0x572e12
mov eax, dword [ebp - 0x134]
or ecx, 0xffffffff
mov edx, dword [ebp - 0x130]
dec eax
cmp eax, ecx
cmovb ecx, eax
movzx eax, byte [ecx + edx]
add ecx, edx
mov al, byte [ebp + eax - 0x128]
test al, al
je 0x572e60
cmp ecx, edx
je 0x572ed7
movzx eax, byte [ecx - 1]
dec ecx
mov al, byte [ebp + eax - 0x128]
test al, al
jne 0x572e48
sub ecx, edx
sub ecx, edi
lea eax, [ebp - 0x28]
inc ecx
push ecx
mov ecx, dword [ebp - 0x13c]
push edi
push eax
call fcn.00591bc2
mov dword [ebp - 4], 1
xorps xmm0, xmm0
mov esi, dword [ebp - 0x12c]
mov dword [ebp - 0x140], 1
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
movups xmm0, xmmword [ebp - 0x28]
mov dword [esi + 0x14], 0
mov byte [ebp - 0x28], 0
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x18]
movq qword [esi + 0x10], xmm0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.005a6722
mov eax, esi
jmp 0x572da8
or ecx, 0xffffffff
jmp 0x572e62
Function at 0x573102
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.005a65f2
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x573225
push ecx
lea ecx, [esi + 0x18]
call fcn.00592922
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x57323c
push ecx
lea ecx, [esi + 0x24]
call 0x592832
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x5a65f2
Capabilities:
Authenticate hmac

Disassembly:
nop
int1
dec edi
int1
inc ebp
shr dword [esi + 0x7cf59485], 0x2f
call esi
test dword [ebp + esi*8 - 0x2900d084], edx
mov dword [0xef615fee], eax
jno 0x5a65d7
loopne 0x5a65eb
aam 0x4c
jne 0x5a65f8
jge 0x5a6653
xor dword [edi], ebp
or eax, 0xef8ee11f
mov gs, edi
mov gs, edi
mov esi, 0xf64fa15
mov eax, dword [0x16daacce]
pop fs
into
lodsb al, byte [esi]
ficom dword [esi]
add dword [ebp + 0x314bdf5a], 0x57a41ff
mov ah, 0x36
or al, 0x32
adc dword ds:[edx], ebp
adc edx, ecx
mov ch, 0xda
jg 0x5a65d0
mov ebx, 0xc4462250
push eax
and al, byte [esi - 0x3c]
or esi, 0xba91b77e
lds ebx, [edi]
xor eax, 0xd43f640e
scasd eax, dword es:[edi]
jle 0x5a65d4
xchg ecx, eax
mov edx, 0xe351fc5
aas
aam 0xaf
push ecx
pop esi
sbb ch, byte ds:[0xc1231bc9]
sahf
jnp 0x5a661b
xchg ebp, eax
out dx, eax
test dword [ecx - 0x2a9c4e32], ebx
js 0x5a6614
dec edx
inc esp
pop edx
rcl esp, 0x5c
pop esp
mov dh, 6
mov ebx, 0xe7310f75
push ebp
cmp al, byte [ebp - 0x2e]
or dword [ecx - 0x2c], ebp
xchg ebp, eax
aam 0xf3
xchg ebp, eax
scasb al, byte es:[edi]
cld
fnstenv [esi - 0x7e404be9]
jbe 0x5a6645
jle 0x5a66c2
invalid
aam 0x9e
test dword [edi + 0x7a], esi
ret 0x79ce
mov eax, 0x807b81d0
cmp ebp, 0xd
push 0x3d143c3d
inc dx
sub edi, dword [eax - 0x53e61376]
push esp
jno 0x5a669b
jns 0x5a66d8
dec edx
xchg edi, eax
enter 0xffffffffffff8f71, 0xffffffffffffff92
xor al, 0x86
inc esi
pop ds
dec esp
invalid
Function at 0x5bd302
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.005f07f2
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x5bd425
push ecx
lea ecx, [esi + 0x18]
call fcn.005dcb22
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x5bd43c
push ecx
lea ecx, [esi + 0x24]
call fcn.005dca32
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret