joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4049a2
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00437e92
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x404ac5
push ecx
lea ecx, [esi + 0x18]
call fcn.004241c2
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x404adc
push ecx
lea ecx, [esi + 0x24]
call fcn.004240d2
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x42e6b2
Capabilities:
Encode data using xor

Disassembly:
arpl word [edi + 0x1a], sp
stc
dec esp
mov ah, ch
xchg byte [ebp - 0x19195c3a], dl
or al, 0x6b
cmp byte [edx], dh
in eax, 0x86
xchg ebp, eax
invalid
out 0xc, al
imul edi, dword [eax], 0x32
pop esp
xor eax, 0x34d80b21
dec eax
mov cl, 0x6e
add al, 0x97
mov byte [0x6060db0e], al
das
jne 0x42e665
push ebp
mov ah, 0x94
out 0x14, eax
jecxz 0x42e65f
retf 0xdbe5
mov dh, 0x57
adc ebx, dword [edx]
push es
add al, 0xa7
je 0x42e66b
pop esp
push edi
mov word [esi - 0x17], fs
cli
ret 0xfc78
Function at 0x437712
Capabilities:
Encode data using xor

Disassembly:
cmpsb byte [esi], byte es:[edi]
pop ebp
push ebp
xor al, 0x20
js 0x4376e6
or cl, bh
push es
jge 0x43768e
invalid
aam 0x35
cmc
inc ecx
daa
adc dword [esi - 0x11], eax
imul esi, dword [esi - 0x59], 0x450052e5
sti
inc ebp
dec ecx
lodsb al, byte [esi]
mov bh, 0x43
pop esp
nop
mov al, byte [0x65ee4f34]
loope 0x43770b
dec esp
outsd dx, dword [esi]
xor dword [eax], edi
das
xor ecx, dword [ebp - 0x62388404]
mov ebp, 0x7b72491a
cmp dword [ebx + 0x6a], edx
adc dword [edi - 0x6d5245f2], ebx
xchg esi, edx
shl byte [ebp + 0x46], cl
je 0x43772e
aad 0xb6
sbb dword [esp + 0x14f67c9d], esi
add al, 0x30
jbe 0x43776a
cmp al, 0x24
dec ebp
inc eax
jbe 0x437693
invalid
test al, bl
aam 0x6a
sar byte [edi + 0x2d], cl
push 0xffffffffffffffd2
jg 0x43773f
sar byte [eax - 0x7f], 1
sub dl, byte [esi]
dec ebp
jne 0x43770e
je 0x437730
adc dword [ecx - 0x72], edi
jns 0x4376af
mov fs, word [edx + esi - 0x4bbb5f9b]
shr ebx, 1
hlt
movsb byte es:[edi], byte [esi]
xor ah, byte [ebp - 0x60]
inc esp
mov ah, 0xd1
jmp 0x43771e
loop 0x4377aa
out 0xfa, eax
in al, dx
or eax, 0x93b35728
dec esi
inc esi
loopne 0x437720
pop eax
test dword [edi + 0x502f265b], edx
pop ebx
das
push eax
fist word [ebx + 0x3dc7c8e6]
test eax, 0x394ee3f6
add eax, 0x26160fa9
imul edx, dword [ecx], 0xb112d646
in al, 0x68
fnstenv [ebp + 0x75]
xlatb
imul esi, dword [edi - 0x6e535491], 0x6684a6f9
movsb byte es:[edi], byte [esi]
pop ss
in al, 0xe7
pop eax
xchg ebp, eax
shl byte [edi], 1
out dx, al
inc edx
mov dl, 0x37
mov dh, 0x66
bound eax, qword [esi + 0xe6e6161]
mov byte [edx], dh
dec ebp
cmp byte [eax - 0x4379932a], 0x93
out 0x1d, eax
in al, 0x77
push es
aam 0x93
aad 0xb4
movsb byte es:[edi], byte [esi]
out dx, eax
and dword ss:[edi], eax
pop ds
and eax, 0x68128c35
cli
ret
loope 0x43776e
idiv dword [edi + 0x1e]
mov dx, word [esi]
xor ah, byte [ebp + 0x4b]
jne 0x437773
or eax, 0xf467d72a
push ss
mov esi, 0x81a9634e
jnp 0x4377de
mov ecx, 0xba8aa294
mov byte [0x66d904f6], al
cli
xor eax, dword [eax]
add byte [edx + ecx*8], dh
xor al, 0xca
and edx, dword [edx]
mov cl, 0x37
push ebx
mov byte [eax], bh
outsb dx, byte [esi]
adc al, byte gs:[esi]
adc al, 0x88
jecxz 0x4377d0
cmp byte [ebp - 0xc], bh
mov dword [0xeae6e6dc], eax
aaa
mov eax, 0xb4afb13b
test ch, al
ja fcn.00437872
aaa
dec ebp
cmp al, 0x13
loopne 0x4377d1
xchg ecx, eax
imul eax, dword es:[edx - 0x71f100e9], 0xffffff82
shr byte [edx + eax*2 + 0x5f754fb0], cl
les esi, [esi]
invalid
Function at 0x4378b2
Capabilities:
Encode data using xor

Disassembly:
neg byte [ecx]
sub al, 0x16
adc eax, edx
jle 0x43792e
fcom dword [ebp + eax + 0x57]
adc eax, 0xb6a2b7a7
mov byte [esi], al
invalid
test dword [eax + 0xb], esp
les ebp, [edx + 0x6bf133a4]
ja 0x437946
inc ecx
out 0x66, al
or al, 0x56
outsd dx, dword [esi]
mov esi, 0xb256df16
add eax, 0x35d65bab
xchg dh, ah
movsd dword es:[edi], dword [esi]
sub byte [ecx + ecx*2], 0xce
loope 0x437923
cld
xor al, 0x53
in al, dx
or eax, 0x89062246
cli
pop ecx
jno 0x437920
ret
push esi
mov al, 0xb4
les ebx, [ecx]
aad 0x9e
invalid
shl byte [ebp - 0x2b3a44d9], 1
or al, 0x10
and al, 0xb7
jns 0x4378e8
inc esp
pop ss
popfd
xor ah, dl
xchg ebp, eax
mov dword [0x2ee66c51], eax
jmp 0x43794b
lds esp, [eax - 0x34620f32]
push ds
cmp eax, ebx
or al, 0x32
xor byte [eax - 0x15f362d0], ah
jbe 0x437999
mov dword [edi - 0x30728215], esp
pop es
stc
movsb byte es:[edi], byte [esi]
in al, dx
mov dh, 0x34
div byte [edx + 0x6a]
sar dword [eax - 0x2cc4d93b], cl
rol dword [eax], cl
push es
cmpsd dword [esi], dword es:[edi]
jmp 0x4379df
xor eax, 0x4b780c01
push dword [ebx + eax*2 - 0xb]
mov ch, 0x9a
mov byte [0x86a429a1], al
outsb dx, byte [esi]
cmpsd dword [esi], dword es:[edi]
jbe 0x43795f
pop edx
or eax, 0xa7e8b626
salc
leave
pushfd
out 0xa6, eax
dec esp
push ds
mov ch, 9
adc eax, 0x3a67fa7c
push ebp
rol byte [ecx - 0x67], 0x54
jl 0x437995
cmp dl, byte [di - 0x40]
inc ecx
cdq
push esp
mov ecx, 0x20d7622a
movsd dword es:[edi], dword [esi]
not dl
xchg dword [edx], ebx
sbb ebx, dword [edi - 0x3a]
pop ebx
pop ebx
inc ebp
jno 0x4379bc
invalid
jo 0x4379f2
xor dh, byte [esi]
invalid
sub al, 0x36
jbe 0x437a1d
invalid
sbb byte [ebp - 0x52aa8c9d], 0xb1
out 0x96, eax
xchg esp, eax
push 0x24
sbb ah, byte [eax + 0x2a]
and al, 0x1a
pushal
sub dh, dh
push esp
sub eax, 0x2478d504
mul byte [esp + edx*2 + 0x2d]
add al, 0xd5
js 0x437a1e
jle 0x4379ee
sbb byte [esi - 0x7418b4a5], cl
sub ecx, ebx
mov ebp, 0xdaa80cbb
out dx, al
cmpsb byte [esi], byte es:[edi]
cmc
jno 0x4379b1
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
sub al, 0x56
cmc
mov ah, 0xf
add al, 0xf7
in al, 0x98
invalid
dec esp
adc byte [ecx + 0x57a720e4], cl
and eax, 0x2cb9633c
aaa
enter 0x235a, 0xffffffffffffffd2
out 0x7b, eax
rol byte [eax - 0x44], 1
mul byte [edx]
invalid
Function at 0x44dc92
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00481182
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x44ddb5
push ecx
lea ecx, [esi + 0x18]
call fcn.0046d4b2
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x44ddcc
push ecx
lea ecx, [esi + 0x24]
call fcn.0046d3c2
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x478632
Capabilities:
Encode data using xor

Disassembly:
cwde
pop es
xor byte [ebx - 0x6e], dh
or al, 0xfb
xchg ebx, eax
shl dword [eax - 0x4cb18f40], cl
mov al, byte [0xb34e70c0]
js fcn.00478632
mov ah, 0xdf
and ebp, ebp
je 0x47863b
dec esi
aaa
invalid
Function at 0x497012
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.004ca502
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x497135
push ecx
lea ecx, [esi + 0x18]
call fcn.004b6832
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x49714c
push ecx
lea ecx, [esi + 0x24]
call fcn.004b6742
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4b8402
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0xda0351c2
outsd dx, dword [esi]
inc eax
sub al, 0xb5
pop ebp
movsd dword es:[edi], dword [esi]
dec eax
mov word [edx - 3], ds
ret
mov eax, dword [0x5b35412]
mov esp, 0x67dadf4c
cmp dword [edx], eax
adc dword [ebp + esi - 0x79e719b1], eax
push 0x66
jae 0x4b83a4
inc ebx
les edx, [edx + 0x202a8386]
inc eax
pop ecx
scasb al, byte es:[edi]
pop edx
mov eax, dword [0x6a265a1c]
mov ch, 0x46
sbb bl, dh
fidiv dword [ebx]
push ss
mov cs, word [ecx]
add eax, dword [ecx + eax*2 - 0x6f]
stc
pop edx
sal ebx, cl
or byte [ecx + 0x70], dh
xchg esp, eax
add edi, dword [ecx - 0xa3c5391]
rol dword [ecx - 0x64ef6f19], 1
mov ecx, 0x12921970
nop
stosd dword es:[edi], eax
pop ebx
jnp 0x4b8496
xchg edx, eax
push edx
xlatb
push ebx
out 0x33, al
jp 0x4b8493
test dword [esi - 0x7371cfcf], eax
xor dl, byte [edi + 0x1d61e283]
sal bl, 0x61
mov esp, 0xb377a107
pop es
mov bl, 0x92
push edx
cmp byte [ebx], ah
salc
popfd
pop eax
or al, 0xa6
nop
clc
mov bl, 0x61
das
jae 0x4b84f5
wait
ficomp word [ebp - 0x40]
and edx, ebp
shl dword [edi + 0x2d], cl
popfd
sub edi, dword cs:[eax - 0x2da31e69]
ror byte [edx], cl
retf
or cl, bl
jl 0x4b8492
sti
mov fs, word [ecx - 0x5dddc0e5]
mov dword [0xdb50e0e4], eax
jo 0x4b8486
invalid
shl byte [eax - 0xd], cl
loope 0x4b84b9
wait
and esi, dword [edi]
push ss
insb byte es:[edi], dx
xor eax, 0xa11d0e99
iretd
add esi, dword [ecx + 0x13a45622]
or eax, 0x2cf64268
inc ebp
cmpsb byte [esi], byte es:[edi]
mov cl, 0x3a
loopne 0x4b84a1
xor dword [ebx + 0x26], edx
aaa
adc edx, eax
sub eax, 0x6915c143
jno 0x4b8543
push ebx
movsb byte es:[edi], byte [esi]
xor byte [edx - 0x7e827bb8], ah
cmp ecx, dword [ecx]
rcl ebp, cl
push ebp
mov dword [ebx - 0x19], eax
fbld tbyte [ecx]
inc edi
and bh, byte [ecx + 0x19]
shl byte [edx - 0x1ed871c6], 0x42
adc dword [ebx + 1], edi
jnp 0x4b84f8
mov dword [0x8129af71], eax
pushal
ror byte [ebx + edx*4 - 0x448e01c8], 1
jno 0x4b84a9
sub dword [ecx - 0x6c732fa0], eax
cmp dh, bh
jno 0x4b84bf
lodsb al, byte [esi]
mov ss, word [ecx - 0x51]
clc
pop ss
or al, 0xb1
add eax, 0x7598949e
invalid
dec esi
mov ah, 0xb5
push ebx
sub eax, 0xf33a908
movsb byte es:[edi], byte [esi]
mov esi, 0xf1d37897
pop edx
lds esp, [ebx - 0x6a]
scasb al, byte es:[edi]
add eax, 0xe101c671
sub dh, byte [ecx + 0x55cfd962]
invalid
Function at 0x4e32e2
Capabilities:
Encode data using xor

Disassembly:
inc ebp
fsubr qword [edx + 8]
push eax
mov dword [ebp - 0x24], 0
call fcn.0052784c
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
inc ebp
fadd qword [eax]
add byte [eax], al
add al, ch
test byte [ebp + 4], al
add byte [ebx + 0x4d8b08c4], al
hlt
add byte [eax], al
add byte [ecx + 0x5e], bl
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push ebp
mov ebp, esp
in al, dx
sub esp, 0x30
mov eax, dword [0x4a2008]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov edx, eax
push ebx
push esi
push edi
mov edi, ecx
shr edx, 0x10
mov edi, dword [edx]
popal
jae 0x4e32e4
inc esp
dec edi
jb 0x4e331f
dec esi
pop ebp
js 0x4e32b7
push es
mul bl
sal bl, 0x76
arpl word [0x889cb632], cx
add byte [esi], dl
inc esi
invalid
jbe 0x4e3397
jb 0x4e3389
mov bl, 0xf6
dec esp
cmpsb byte [esi], byte es:[edi]
mov ch, 0x78
add bl, al
loope 0x4e32bd
out dx, al
jg 0x4e3343
adc dword [ecx], 0xc39ebbb2
pushal
jge 0x4e32d2
xchg esi, eax
add ch, byte [eax - 0x4e]
mov dword cs:[ecx + 0x733627d8], ebx
dec edi
jae 0x4e3394
ret 0x1767
xor dl, byte [esi - 0x4e]
ret 0xc777
cmc
in eax, 7
invalid

Function at 0x513342
Capabilities:
Encode data using xor

Disassembly:
outsd dx, dword ds:[esi]
cmp esi, dword [ebx]
add edx, dword [edx + 0x68]
xor byte [eax], ch
and dword [0xd49226e2], eax
push 0xffffffffffffff94
idiv dword [esi - 0x7f]
pop es
adc bl, dh
push es
rcr dword [edi - 0x77cae46], 0x7f

Function at 0x52f153
Capabilities:
Encode data using xor

Disassembly:
sub ah, bl
fnsave dword [ebx + 0x2fd3465c]
sbb eax, 0xc5da09d1
inc eax
and eax, 0xf2ccf7
add ch, byte [eax + 8]
invalid
cmp ebx, dword [eax + 0x24c62559]
jg 0x52f0c2
invalid
push ebp
adc ch, al
in al, 0xc3
in eax, 5
rcr byte [ebx + 0x6a], 1
sal dword [edi], 0x22
lodsd eax, dword [esi]
xor byte [eax + ebx*2 - 0x6aa49d94], 0x62
jge 0x52f0ff
pop eax
insb byte es:[edi], dx
bound ebx, qword [ebx - 0x6b]
bound edi, qword [ebp - 8]
std
cmp byte [0xb9158e01], ch
sub cl, byte [ebx - 0x3cc7822b]
imul byte [ebp - 0x698a4f3e]
add bl, byte [ecx]
cmpsd dword [esi], dword es:[edi]
or eax, 0x72dacfb9
dec eax
insd dword es:[edi], dx
mov edi, 0xc496f913
jae 0x52f0ea
dec edi
add esp, dword [eax + 0x4ddecc88]
push esp
fimul word [ebp + 0x54]
test byte [0xbe9df6ec], 0xda
lodsb al, byte [esi]
dec ebp
js 0x52f131
add dword [esi - 0x12b5f207], edx
mov esp, 0xeff724c9
or dword [ebx - 0x4d], edi
add ch, bh
fistp qword [edi - 0x13fa47cc]
add eax, 0x7cfb94ec
pushfd
add eax, 0x7cfb94ec
pushfd
js 0x52f0e6
lodsb al, byte [esi]
mov ah, 0xd0
lodsb al, byte [esi]
mov ebx, dword [ebx]
jg 0x52f10f
inc esp
fild word [edi]
outsd dx, dword [esi]
movsd dword es:[edi], dword [esi]
xchg esi, eax
push ebx
out 0x4c, eax
xor dword [ecx - 0x13], ebx
rol ch, 1
mov es, word [0xd7c17268]
aad 0xfe
mov bh, 0x63
jl 0x52f0ff
cmp al, 0xfd
or dword [0x6c49497c], 0x857f9d64
and eax, 0xf97b74c3
into
cmpsb byte [esi], byte es:[edi]
in eax, dx
imul ecx, dword [ecx], 0xa03a8e87
retf 0xb9d9
Function at 0x55cdc2
Capabilities:
Encode data using xor

Disassembly:
lea ebx, [ebx]
sub dword [esi + 0x7d], ecx
xchg edi, eax
and bh, dl
pushfd
add al, byte [ebx - 6]
fucomp st(6)
dec edi
xchg byte [edi - 0x41e6aba5], ch
mov ch, 0x5d
lock add byte [ecx + 0x71], al
dec ecx
invalid
push esi
sub byte [esi + 0x5c], ah
jge 0x55cd88
xchg ecx, eax
or eax, 0xb4beaf0f
test byte [ecx], ah
mov al, 0x77
inc esp
mov esi, 0xb02184b4
ja 0x55ce17
xor al, 0xb8
jecxz 0x55cdcc
rcr byte [ebp + 0x1a3a389], 0x89
in eax, 0x91
dec ebp
push eax
dec ebp
mov ah, 0x6d
movsd dword es:[edi], dword [esi]
sub al, 8
push edx
aam 0x9d
inc esi
loope 0x55ce5f
push ds
adc eax, 0x5f17a338
and eax, 0xfc098c69
mov cl, byte [ebp - 0x3b360b4f]
adc ch, bh
popfd
dec ebp
xor eax, 0x51d59ce7
sub ebp, esi
jo 0x55cde2
xor eax, 0xfbf2c5f8
xchg ebx, eax
dec ebp
inc esp
hlt
pop ds
inc ebp
mov esp, 0xd5b9c42b
test eax, 0x6d3747c4
and al, 0x67
dec ecx
mov esp, 0x9e71a750
adc byte [esi + 0x1aaf3b2c], ch
mov eax, dword [0x54d5f9ec]
imul ebx, dword [ecx - 0x65ff360], 0xffffff99
enter 0x39c4, 0xffffffffffffffe4
push ds
sub eax, 0x4508c64
je 0x55cde1
lds esp, [ecx]
push esp
adc eax, 0x26b45d3d
cmc
scasb al, byte es:[edi]
into
mov al, 0x8b
pop eax
mov ah, 0x99
cdq
aam 0xb4
pushfd
mov word [eax + 0x1d], fs
outsd dx, dword [esi]
dec ecx
adc al, 0x2c
pushal
invalid

Function at 0x5731b2
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call int.005a66a2
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x5732d5
push ecx
lea ecx, [esi + 0x18]
call fcn.005929d2
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x5732ec
push ecx
lea ecx, [esi + 0x24]
call fcn.005928e2
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5c21cc
Capabilities:
Encode data using xor

Disassembly:
pushal
push ecx
mov ebp, 0xcccee4cb
jo 0x5c2151
adc ebp, dword [edx]
fmul dword fs:[ebp + ebp + 0x21]
or dl, byte [ebp - 0x73f24a8e]
sbb al, 0x4d
adc edx, dword [ecx + 0x298981c0]
add eax, 0xb5d2b302
test byte [esi + 0x540e61e], cl
sbb ecx, dword [eax + 2]
sub al, 0x37
add ch, byte [edi + esi]
xor edi, dword [ebp - 0x24]
inc eax
or dl, byte [edx + 0x2aff1332]
mov byte [0x847e6480], al
push es
pop esi
xchg edi, eax
leave
loope 0x5c20ff
mov dl, 0xbc
popal
nop
mov dword [esi - 0x1b30cd14], eax
cdq
mov esp, 0x7cc5d3c1
xor ah, cl
jp 0x5c21c5
jl 0x5c2183
int3
int1
sahf
xchg edx, eax
and dword [ebx], ebx
xor byte [ebx + 0x19], ch
jo 0x5c21b0
push esp
xchg dword [ecx + 0x27], eax
call 0x339c8295
and byte [ebx + 0x4f], al
mov dl, 0xdd
add al, 0x6c
les esi, [0xb1bf4741]
sbb al, 0xa1
cmpsd dword [esi], dword es:[edi]
xchg esp, eax
jno 0x5c21ce
shl dword [ecx + 0x51bc27b0], cl
lodsb al, byte [esi]
insb byte es:[edi], dx
sahf
or ebx, dword [eax + 0x426008bc]
mov byte [0x859a3706], ch
or eax, 0x8efe2c54
js 0x5c212a
xchg ecx, eax
inc eax
dec ecx
jge 0x5c2209
invalid
push 0xf031ee2d
int1
xor al, 0xa8
cmpsd dword [esi], dword es:[edi]
test al, 0xa7
xchg ebx, eax
jno 0x5c2198
mov esi, 0xb2906227
push ebx
inc ecx
test byte [eax + esi*4 + 0xc], 0x91
xchg ecx, eax
sahf
jno 0x5c21b2
in al, dx
mov ch, byte [ecx + edi*2 - 0xb]
iretd
or esp, ebp
popal
fcomp qword [ebx - 0x3e1e16c4]
cld
bound ecx, qword [edx + esi*4]
mov eax, dword [edi - 0x76a2e5fe]
sbb dword [esi - 0x61], esi
arpl word [edx], di
and byte [esi - 0x131c07d5], bh
inc eax
out dx, eax
lodsb al, byte [esi]
fild qword [ebx - 0x36]
pop eax
call 0x747a19d4
adc bl, dh
aas
push es
jne 0x5c21aa
or al, 0xef
sti
nop
mov esi, 0xec8f7626
in al, dx
jne 0x5c2284
or edi, dword [esp + edi*8 + 0x6dc826b]
mov esp, 0xdc826bfc
push es
aad 0xb4
cmp al, 0x3f
or eax, 0xfde1b26f
call dword [edi + 0x2c6fc8a5]
jg 0x5c2268
adc dh, ah
leave
movsb byte es:[edi], byte [esi]
ja 0x5c21c2
ja 0x5c228d
rcr esp, 1
das
fsubr qword [edi]
in eax, dx
sub bl, ch
scasb al, byte es:[edi]
adc dword [edx - 0x42fc5127], esp
push 0x70
mov edi, 0x3e9ab877
adc esp, dword [ebx + 0x5072520c]
dec ebx
mov ecx, 0x7118e99c
salc
xor eax, 0x20fd12c8
leave
cmc
push es
pop ds
xor eax, 0xade11ad5
loope 0x5c2205
mov dl, al
push edi
jnp 0x5c2229
push eax
out 0x6b, eax
push ecx
sub al, 0x93
fxch st(1)
dec ebp
sbb eax, edi
adc dword [esi], esi
jp 0x5c2256
cmp edx, ecx
lodsb al, byte [esi]
rol byte [ebx], 0xbf
imul ebp, ebx, 0x37
outsb dx, byte [esi]
aam 0
invalid
clc
mov ecx, 0xed934ecf
dec edi
xchg edi, eax
fdiv dword [eax + esi*8]
xor al, 0xf0
int1
ret
Function at 0x5dc0d2
Capabilities:
Check for vm using instruction vpcext

Disassembly:
les ebx, [0x391531c2]
daa
cmp dword [edi], esp
je 0x5dc0c2
pop ebp
sbb ecx, dword [0x32ecd7fc]
mov dword [0xc638f748], ebp
invalid
mov al, byte [0x985a1f0]
jp 0x5dc143
das
invalid
cdq
inc eax
loopne 0x5dc0f2
or eax, 0x1a611348
dec eax
adc esp, dword [ecx + 0x1a]
shr dword [eax - 0x70], 1
js 0x5dc0bd
mov ah, 0xb8
fyl2xp1
push ds
sub ebp, dword [eax - 0x43bc7921]
xchg byte [ecx - 0x71d0d12], cl
and eax, 0x9214e0c9
clc
sbb dword ds:[edi + edx - 0x16], ebp
sbb edi, dword [ebx - 0x5a9e34ca]
inc ebx
scasb al, byte es:[edi]
fidiv dword [ebx]
lahf
pop edi
invalid
retf
sub dword [esi + 0x43], edi
movsd dword es:[edi], dword [esi]
pushal
iretd
jno 0x5dc135
je 0x5dc11a
jmp 0xb2c35852
mov ds, esi
mov dl, 0xa3
inc edi
insb byte es:[edi], dx
jne 0x5dc0ed
jae 0x5dc15a
rcl dword [ebp + 0x2a47cc88]
mov ecx, 0x7fe120ed
pop esp
push ebx
xor byte [edx + 0x35cc88c8], 0x3c
push ecx
outsd dx, dword [esi]
mov bl, 0x70
xor al, 0x84
sub byte [ecx + 0x6dcc3cd8], cl
fnsave dword [esi + esi*2 + 0x1e]
invalid

Function at 0x6060d2
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.006395c2
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x6061f5
push ecx
lea ecx, [esi + 0x18]
call fcn.006258f2
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x60620c
push ecx
lea ecx, [esi + 0x24]
call fcn.00625802
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret