joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6e481a75
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x10c]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._GetModuleFileNameA_12
sub esp, 0xc
mov dword [esp], 0x1388
call sym._Sleep_4
sub esp, 4
lea eax, [ebp - 0x10c]
mov dword [esp], eax
call sym._DeleteFileA_4
sub esp, 4
nop
leave
ret

Function at 0x6e481e00
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x6e48603c
call sym._EnterCriticalSection_4
mov ebx, dword [0x6e486034]
sub esp, 4
test ebx, ebx
je 0x6e481e4b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x6e481e44
test esi, esi
je 0x6e481e44
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x6e481e20
mov dword [esp], 0x6e48603c
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x6e482030
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], 0x6e484178
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x6e482080
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x6e482158
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x6e4820be
cmp eax, 4
jne 0x6e4820e0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x6e4820ce
cmp edx, 4
je 0x6e4820ce
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.6e482030
Function at 0x412d49
Capabilities:
Encode data using xor

Disassembly:
rcl byte [eax + ebx*2 - 0x52d5fc01], 0xc5
sbb dl, bh
xchg ecx, eax
aad 0x49
test cl, bh
xor eax, 0x7b1c45dc
invalid

Function at 0x496dc9
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.004ca2b9
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x496eec
push ecx
lea ecx, [esi + 0x18]
call fcn.004b65e9
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x496f03
push ecx
lea ecx, [esi + 0x24]
call fcn.004b64f9
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4b71e9
Capabilities:
Encode data using xor

Disassembly:
cmp byte [edx], 0x4f
push 0x1b
jbe 0x4b721b
cwde
invalid
sbb al, 0xef
mov dword [0xbb1125fc], eax
jne 0x4b723c
cmp ecx, dword [eax]
iretd
or al, byte [ecx - 0x76]
stc
mov eax, 0xcee0fb56
clc
std
cmpsb byte [esi], byte es:[edi]
mov dword [0x839039af], eax
outsd dx, dword [esi]
xchg ecx, eax
mov esp, 0xf89eef74
fisubr dword [eax + 0x25]
or dword [edx - 0x43482a0d], 0xffffffec
outsd dx, dword [esi]
mov dh, 0xdf
cmp bl, bl
salc
sbb dword [eax - 0x6ea7d597], ebp
cmp edi, dword [ecx]
push 0xffffffffffffff95
or byte [edx], ch
mov ecx, 0xbf5997e1
fnsave dword [eax]
sbb dword [ebp + 0x67], 0x4a142e33
xor ebp, dword [esi]
adc al, 0x4a
cli
fcmovbe st(0), st(4)
loope 0x4b727a
jle 0x4b72d5
sbb bl, dh
cmp dword [ebp + 0x583872ee], edi
in al, 0xb4
invalid
mov ecx, dword [edi + 0x1d9839f6]
pop ss
mov byte [0x1a56567b], al
invalid
Function at 0x4e0229
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00513719
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x4e034c
push ecx
lea ecx, [esi + 0x18]
call fcn.004ffa49
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x4e0363
push ecx
lea ecx, [esi + 0x24]
call fcn.004ff959
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x548139
Capabilities:
Encode data using xor

Disassembly:
cmpsd dword [esi], dword es:[edi]
dec edi
jns 0x548187
dec edi
call dword [ebp + 0x54]
inc esi
sub dword [esi + 0x3a1876fb], 0x71
xchg dh, dh
adc dword [ebx + 0x140df399], edx
retf 0xe6fe
mov ah, 0x21
mov edi, 0xc613eb74
push cs
or byte [ecx - 0x5d53d9de], dl
in al, dx
pop es
or al, 0xcb
xchg edx, eax
sti
bound esi, qword [eax + 0x71]
loop 0x548193
mov dl, 0x3c
out 0x60, eax
inc edx
fcom qword [eax - 0x2a]
in eax, dx
pop eax
push edi
or eax, 0x76ff1203
imul byte [ecx + esi*4 - 0x1a227228]
fucom st(5)
loope 0x5481c2
xrelease xchg byte [ebx], cl
push ebx
not dword [edi]
pop ebx
xchg byte [esi - 0x39], bl
rcl dword [ecx + 0x59]
stosd dword es:[edi], eax
sub bh, 0xe5
adc byte [edi + 0x36], ah
and dword [edi + 0x2a269037], edi
out 0xd, eax
pop edi
mov byte [0x10a3eed8], al
cli
add bh, 0x4d
enter 0x34af, 0x5f
xor al, 0x5f
pop edi
aam 0x43
mov ah, 0xe4
salc
in al, 0xd6
xchg byte [edi - 0xd540efa], bh
xlatb
je 0x5481c7
std
add dword [edx], esp
and cl, byte [edi]
neg dword [ebx + 0x6e]
out 0x95, al
jo 0x548164
movsb byte es:[edi], byte [esi]
mov bh, 0x44
mov byte [0x67c153e0], al
bound edi, qword [esi - 0x26]
jle 0x5481c3
xor dword [edx + 0x4f], 0xd7003a66
pop ds
rcl ecx, 0xfe
jl 0x5481e7
push ecx
ljmp 0x5708
Function at 0x5484b9
Capabilities:
Encode data using xor

Disassembly:
hlt
sub dh, byte [0x63a9c566]
adc al, 0xfc
jo 0x548501
xor ebp, ecx
xor al, 0x64
shl edx, 1
xchg dword [esi], edi
int3
inc esp
mov cl, 0xa5
div eax
mov al, 0xc5
mov esp, 0x94875399
dec esi
sal cl, 1
sahf
and edi, esp
push ebx
jle 0x5484c8
sbb al, 0x74
movsd dword es:[edi], dword [esi]
jno 0x5484c5
xchg cl, ah
and ebp, dword [eax]
out 0x78, eax
inc esi
mov al, byte [eax - 0x6c]
xlatb
or bh, al
clc
lodsd eax, dword [esi]
std
pushal
pop esi
jno 0x5484f4
mov dword [0xbc36f637], eax
js 0x548457
div dword [ebx + eax*4 - 0x4f]
ja 0x5484eb
jecxz 0x548483
mov ah, 0x66
aam 0xed
lcall 0x1cbf, 0x19acae7b
jecxz 0x548522
or bl, dl
add esi, ebx
sub eax, 0xafe524fa
sub eax, 0xafe524fa
jp 0x548534
aad 0xaa
stosb byte es:[edi], al
sahf
in al, 0x6b
mov al, byte [edx - 0x185798bf]
jno 0x548577
push 0x997cf7f7
div edi
jl 0x54849e
and dword ss:[ebp - 4], esi
inc edx
inc edi
sbb dl, byte [esi]
movsb byte es:[edi], byte [esi]
invalid
sbb edi, edi
clc
push ebp
jo 0x54850e
aas
loopne 0x5484c8
bound edx, qword [edx + ebp*8]
stc
sub dword [esi + ebx], ebp
push ss
into
movsd dword es:[edi], dword [esi]
xlatb
mov ebx, dword [ebx]
mov ah, 0x85
pop ebx
hlt
xor dword [ebx], edi
and bh, ah
in al, 0xdc
dec ebx
fimul dword [ecx - 0x6a]
fmul qword [ebx - 0x26]
dec ecx
xchg esi, eax
pushfd
sub dword [edi + 0x7f56b1ea], ebp
cmpsd dword [esi], dword es:[edi]
mov eax, dword [edi - 0x7f]
cmpsb byte cs:[esi], byte es:[edi]
push ss
sub al, 0x8e
push ecx
add al, 0xf7
jae 0x548571
iretd

Function at 0x55c999
Capabilities:
Encode data using xor

Disassembly:
test byte [edi + 0x66967101], dl
cmpsb byte [esi], byte es:[edi]
arpl sp, dx
invalid
test dword [ebx - 0xb], ebp
sub al, 0x82
rcr dword [edi - 0x3f], 1
push edx
pop ss
xchg ebx, eax
daa
xor ebp, 0x59
dec ecx
inc esi
js 0x55c980
sbb dh, 0x2c
xlatb
sahf
push esp
xchg ebp, eax
and byte [ebx + 0x68b48437], ah
inc ebp
dec ebp
push ebp
cmpsd dword [esi], dword es:[edi]
shl dword [esi - 0x70], 1
ja 0x55c9bc
or dl, dl
cmp dword [edx + 0x600a505f], 0x88e3a607
jae 0x55ca39
lea ecx, [eax - 0x3f38f645]
mov bl, 0x84
sub dword [eax], edx
sal byte [esi], cl
mov al, byte [0x525d8fe9]
xor dword [esi - 0x63685369], 0x3c1be5a0
push ebx
int3
add dword [edi - 0x2a88fbbb], esp
and dword [edx + 0x63], ecx
leave
or bh, dh
les ecx, es:[esi + 0x76]
invalid
adc al, 0xed
xchg esi, eax
mov al, 0xa9
mov eax, dword gs:[0x56c832c8]
xchg esp, eax
idiv dword [edi - 0x3a]
mov ch, 0xf9
adc byte [esi + ebp*2], dl
das
in eax, 0x92
xchg edx, eax
shl byte [esi + ebx*4 - 0x29], 0xed
cmc
out 0x5e, al
out 0xc, eax
mov eax, 0x7674fb24
xchg edi, eax
adc al, byte [ebp + edx*2 + 0x22577014]
mov esi, 0x8dc7c313
mov byte [0xa57917b2], al
enter 0x7043, 0xffffffffffffffbb
add dword [ebp + 0x30], edx
xchg esi, eax
popal
rol edi, 1
xlatb
test dh, ah
lcall 0xab54, 0x61a7f426
push edi
jge 0x55ca21
xchg ebp, eax
adc al, 0xd6
invalid
Function at 0x55cb79
Capabilities:
Encode data using xor

Disassembly:
inc esi
fld dword [eax - 0x2e]
js 0x55cb90
cmc
xchg dword [edi], edx
jno 0x55cbdb
cmpsb byte [esi], byte es:[edi]
cmp bh, dl
adc al, 0x97
mov dword [0xe4dd553c], eax
add dl, byte [esi + ebx + 0x1ed3d592]
xchg edi, eax
pop ss
add bh, dl
movsb byte es:[edi], byte [esi]
fcom qword [ebp + 0x8c5260b]
lds ecx, [eax]
pop esp
sbb al, 0x80
ret 0x84f6
int 0x52
add edx, ebp
pop ss
jns 0x55cb97
movsd dword es:[edi], dword [esi]
test al, 0x97
movsd dword es:[edi], dword [esi]
aaa
aam 0x57
loopne 0x55cb72
dec edx
invalid
xor eax, 0x74a65d11
inc esi
adc dword [ebp - 0x5a], ebx
je 0x55cc26
mov ch, 0xbb
add dword [esi], edi
adc eax, dword [ebp - 0x7c]
sbb cl, byte [esi + 0x50]
cmp ebx, eax
add eax, 0xea35253a
pushal
add dword [edi + 0x1d], edx
lodsd eax, dword [esi]
and dword [ebx + edi*4 + 0x12eee485], 0x31
js 0x55cbda
dec ecx
inc ebx
mov dl, 0x3e
insb byte es:[edi], dx
cmc
not byte [edi - 0x4a]
adc dword [ebx], ecx
jne 0x55cc32
jl 0x55cbbf
popal
lodsb al, byte [esi]
loopne 0x55cc1b
xlatb
push ss
mov dh, 0x67
les edx, [eax + 0x26]
invalid
invalid
push ds
push esp
xchg ebp, eax
and al, 0xc7
movaps xmm0, xmmword [ebx]
mov edi, 0xa3d6c959
fisub word [edx + esi*2 + 0x71e41242]
xor al, 0x12
cmc
mov dword [0x4272a4de], eax
adc ah, ah
jno 0x55cc6f
adc dh, ch
retf 0x8656
adc ebp, edi
ret 0xf115
je 0x55ccab
out dx, al
sahf
cmc
pushal
shr dword [ecx - 0x5d5ae81f], 0xb5
daa
lea esp, [edx]
cmp dword [edx - 0x20], esp
loope 0x55cc52
movsd dword es:[edi], dword [esi]
push 0xffffffffffffffc8
in eax, dx
add al, 0x1d
in al, dx
or ebx, esi
mov fs, esi
pop es
sbb edi, dword [ecx - 0x2a]
wait
add al, 0x22
mov dl, 0xe7
xchg ebp, eax
test dword [edi - 0x4b], ecx
xor al, 0xd
adc eax, 0xea92a3d2
cmp eax, dword [edx - 0x6b587457]
invalid
mov bh, 0xf6
daa
cli
or dh, byte [edx]
invalid

Function at 0x57b529
Capabilities:
Encode data using xor

Disassembly:
ror dword fs:[esi], 0xc
pop ebx
or al, 0x5b
aam 0xeb
and eax, esp
sar byte [edx + edx*8 - 0x57], 0x67
xchg dword [eax - 0x79317381], ebx
mov byte [0xcec63f8a], al
xor edx, dword [esi - 0x876bec4]
push 0xffffffffffffffa7
jbe 0x57b4f0
std
cmp dword [ebx - 0x4c05f001], ebx
and eax, 0xd006ea2a
lea ecx, [esi + esi + 0x14063fb0]
cld
wait
dec dword [edi]
cli
mov bl, 0x25
sub ch, dl
push es
ror byte [ebp + 0x3fb0368c], 1
push es
adc al, 0xfc
xor dword ss:[ebx + 0x5f], ebx
dec ebx
test dh, dh
aas
daa
loop 0x57b4ce
or eax, 0xa697e62e
shl byte [esi - 0x1d], 0x10
in eax, 0xf8
mov edx, 0x563709fa
mov cl, 0x59
imul esi, dword [edi + 0x2f6369ac], 0x3f
in al, dx
cmp esi, dword [ebx + edi*2 - 0x61]
jnp 0x57b4ca
jnp 0x57b4ca
fnsave dword [edx]
push 0x88e70f7e
daa
pop ebp
push 0xa99306eb
aaa
sub cl, byte [edi]
sbb eax, 0x53fc00a0
jg 0x57b583
imul edx, dword [eax], 0x68
cmp byte [ebp + 0x30], dl
push edx
into
cmpsd dword [esi], dword es:[edi]
invalid
push 0x5b
xchg ebp, eax
invalid
Function at 0x5bcc89
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.005f0179
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x5bcdac
push ecx
lea ecx, [esi + 0x18]
call fcn.005dc4a9
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x5bcdc3
push ecx
lea ecx, [esi + 0x24]
call fcn.005dc3b9
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x606319
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00639809
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x60643c
push ecx
lea ecx, [esi + 0x18]
call fcn.00625b39
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x606453
push ecx
lea ecx, [esi + 0x24]
call fcn.00625a49
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x60bca3
Capabilities:
Encode data using xor

Disassembly:
lodsb al, byte [esi]
jmp 0xa18ad0c6
sub dword [eax + 0x4d], esp
push edx
dec eax
push ds
rcr byte [eax], 1
popal
xchg dword [0x135c8428], edx
fsubrp st(3)
sub byte [edi + 0x10d12ea6], ah
cmpsd dword [esi], dword es:[edi]
cmpsb byte [esi], byte es:[edi]
rcl dword cs:[eax]
jo 0x60bb78
popfd
xor word [eax], dx
aam 6
pop ebp
pop edi
aam 0xfd
call dword [esi - 0x54]
mov eax, 0x4251d3d3
and byte [edi - 0x3a], ch
sahf
sbb byte [ebx - 0x6d3520bf], al
ja 0x60bb47
push ebx
mov ecx, 0xd6593f8b
jmp [esi]
and byte [ecx], al
push ebp
jb 0x60bc1b
je 0x60bb8b
add eax, 0x211d5567
xchg ebp, eax
loope 0x60bc0e
mov dword gs:[0xecc14c6], eax
insb byte es:[edi], dx
leave
sal dword [ebp - 0x40bc99a], 1
cmp al, 0xda
adc eax, 0x3f44b5d1
add esp, dword [ebx]
push ds
hlt
mov ah, cl
rcl dword [ebx]
jp 0x60bc1b
loop 0x60bbc1
cmp edi, esi
mov fs, word [edx - 0x40]
add eax, 0x40995554
retf
pushal
pop esi
inc edx
push es
push ecx
rcr ebx, 0xb4
aaa
inc ecx
xor dword [edx + 0x30], ebp
loope 0x60bc14
xor cl, ah
leave
jecxz 0x60bc48
xlatb
std
mov dl, 0x3c
sbb ch, byte [ebx]
xchg edi, eax
mov ah, 0x66
mov byte [0x70aadc8d], al
xlatb
dec edx
cmpsb byte [esi], byte es:[edi]
int1
inc esi
invalid
mov al, 0x96
xchg esi, eax
loop 0x60bcfd
sbb cl, byte [ecx + 0x1c]
jae 0x60bc3c
xchg ebp, eax
scasd eax, dword es:[edi]
popfd
je 0x60bc9d
inc ebp
dec ecx
xlatb
or eax, 0xac873f63
xor eax, 0xeb9170e4
in eax, 0x23
jge 0x60bcad
adc esi, dword [eax + 0x22]
mov bl, 0x67
pop ebp
mov cl, 0x84
jbe 0x60bd04
add byte [edi - 0x1155be6f], 0xfe
dec ebp
outsb dx, byte [esi]
test bl, bl
mov dh, 0x2d
push ebx
cmp dword [eax - 0x41454f7d], ebp
mov esp, 0xc708ab3f
inc ebp
jne 0x60bcf1
push edi
add al, 0x45
push eax
shl byte [0x4825589d], 0xb6
and dword [0x82c1a30f], edx
rcl dword [esi], cl
adc bl, 0x16
inc esp
jb 0x60bc9c
adc al, 0x7c
cmpsd dword [esi], dword es:[edi]
loop 0x60bd46
pushal
cmpsd dword [esi], dword es:[edi]
or byte [edi - 0x60], 0x87
and al, byte [edi + 0x43]
inc ebx
sub si, si
jo 0x60bd11
in al, 0xe1
mov bh, 0x87
pop esi
xchg dword [eax + 0x77b2d0a0], edx
inc esi
mov al, byte [0x4677b2d0]
mov al, 0xa7
fcomp qword [edi + 1]
inc edx
fldenv [ebx - 0x26]
mov al, 0x17
hlt
add dh, byte [ecx + 0xbdce753]
daa
cmpsd dword [esi], dword es:[edi]
pushal
iretd
nop
test byte [edi], 0x97
leave
stc
and byte [ebp - 0x525151aa], 0x25
mov dh, 0x64
lodsd eax, dword [esi]
xchg ebp, eax
adc ebx, dword [edi]
jo 0x60bdc4
adc eax, 0x215524c7
mov dl, 0xa5
cmp al, 0x5f
xchg dword [ecx], esi
mov eax, 0xa0b60687
xlatb
jg 0x60bd22
fcmove st(0), st(7)
cmpsd dword [esi], dword es:[edi]
and eax, 0xe78a0664
shl dword [ebp + 0x62792950], 1
fstp dword [eax + 0x22]
aaa
pop edx
wait
int3
lodsd eax, dword [esi]
mov esp, 0x25785f22
adc al, 0xc0
inc edx
fnstenv [eax]
std
iretd
Function at 0x630b59
Capabilities:
Encode data using xor

Disassembly:
mov al, 0x93
loope 0x630b90
adc edi, dword [ebx + 0x3e947e02]
adc byte [edx + 0x2520b73d], 0xa0
pop ss
and edx, edi
mov word [ebp + 0x3af0452d], cs
push ds
cmp byte [esi], bl
sar byte [ecx + 0x42fc4935], 1
sar byte [ecx + 0x42fc4935], 1
aaa
mov ebx, 0x452c7d33
popal
cmp al, 0xc0
daa
enter 0x7797, 0x3e
xchg ecx, eax
sub dword [eax - 0x1a], edx
mov ebx, cs
nop
cdq
sbb ebx, dword [ebx]
sbb esp, dword [esi + 0x6e]
jo 0x630b3c
inc eax
out 0x56, eax
mov edi, 0xae0502e1
sbb dl, 0x2c
mov al, byte [0xb249039]
xor eax, 0xd71056a7
cmpsd dword [esi], dword es:[edi]
push esi
adc bh, dl
xor byte [esi], 0x54
add eax, 0xefbfeaa0
out 0x60, al
stc
jno 0x630b8e
pop ss
sub ah, byte [esp - 0x16c536fb]
nop
mov ch, 0x2e
cmp al, 0xeb
rcl byte [eax], cl
scasb al, byte es:[edi]
push edi
into
cwde
out 0xb3, eax
pushal
imul esi, dword [esi - 0x51], 0xffffffb8
xor eax, 0x52b819ff
push edi
out dx, al
hlt

Function at 0x64d5ed
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x655338
cmp edx, dword [eax]
je 0x64d60f
add eax, 8
inc ecx
cmp eax, 0x6553c8
jl 0x64d600
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x655338]
jne 0x64d73d
mov eax, dword [0xa58c90]
cmp eax, 1
je 0x64d717
test eax, eax
jne 0x64d640
cmp dword [0x655264], 1
lea eax, [ebp + 8]
lea esi, [esi + 0x65533c]
push 0
push eax
push dword [esi]
call fcn.0064e460
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]