joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001460e
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x100307e8]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0xc
mov eax, 0x1001eac9
call fcn.1001bb3b
mov esi, dword [ebp + 0x214]
xor ebx, ebx
lea eax, [ebp]
push eax
push ebx
push ebx
push 0x1a
push ebx
mov byte [esi], bl
mov dword [ebp - 4], ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, eax
cmp edi, ebx
jge 0x10014668
push edi
push str.Error:_08x_in_SHGetFolderPathW_NULL__CSIDL_APPDATA__NULL__0__szPath_
call fcn.100178de
pop ecx
pop ecx
push ebx
push edi
call fcn.1000df81
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x14]
call fcn.10006d43
mov ecx, dword [eax]
mov byte [ebp - 4], 1
cmp ecx, ebx
je 0x10014685
call fcn.100060e0
jmp 0x10014687
xor eax, eax
push 0x104
push eax
push dword [ebp + 0x218]
push esi
call dword [sym.imp.msvcr100.dll__mbsnbcpy_s]
mov ecx, dword [ebp - 0x14]
add esp, 0x10
cmp ecx, ebx
je 0x100146d3
call fcn.10007f79
jmp 0x100146d3
xor eax, eax
cmp edi, ebx
setge al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.1001ba56
add ebp, 0x20c
leave
ret

Function at 0x100146fd
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x100307e8]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0xc
mov eax, 0x1001eaf9
call fcn.1001bb3b
mov esi, dword [ebp + 0x214]
xor ebx, ebx
lea eax, [ebp]
push eax
push ebx
push ebx
push 0x23
push ebx
mov byte [esi], bl
mov dword [ebp - 4], ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, eax
cmp edi, ebx
jge 0x10014757
push edi
push str.Error:_08x_in_::SHGetFolderPathW_0__CSIDL_COMMON_APPDATA__NULL__SHGFP_TYPE_CURRENT__szPath_
call fcn.100178de
pop ecx
pop ecx
push ebx
push edi
call fcn.1000df81
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x14]
call fcn.10006d43
mov ecx, dword [eax]
mov byte [ebp - 4], 1
cmp ecx, ebx
je 0x10014774
call fcn.100060e0
jmp 0x10014776
xor eax, eax
push 0x104
push eax
push dword [ebp + 0x218]
push esi
call dword [sym.imp.msvcr100.dll__mbsnbcpy_s]
mov ecx, dword [ebp - 0x14]
add esp, 0x10
cmp ecx, ebx
je 0x100147c2
call fcn.10007f79
jmp 0x100147c2
xor eax, eax
cmp edi, ebx
setge al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.1001ba56
add ebp, 0x20c
leave
ret
Function at 0x10014eb7
Capabilities:
Get common file path

Disassembly:
push 0x14
mov eax, 0x1001eb59
call fcn.1001bb3b
mov esi, dword [ebp + 8]
xor eax, eax
xor edi, edi
xor ebx, ebx
mov word [esi], ax
mov dword [ebp - 4], edi
call fcn.1000df81
test eax, eax
je 0x10014ee2
call fcn.10014ea8
mov ebx, eax
push 0x104
push esi
push ebx
push edi
push 0x1002051c
call dword [sym.imp.SHELL32.dll_SHGetFolderPathEx]
mov esi, eax
cmp esi, edi
jge 0x10014f3d
push esi
push str.Error:_08x_in_SHGetFolderPathEx_FOLDERID_LocalAppDataLow__0__hToken__pPath__MAX_PATH_
call fcn.100178de
pop ecx
pop ecx
push edi
push esi
call fcn.1000df81
mov ecx, dword [ebp - 0x18]
mov esi, dword [ecx + 4]
mov dword [ebp - 0x14], esi
call fcn.10006f58
push eax
push esi
push 0x10023e3c
call fcn.100178de
or dword [ebp - 4], 0xffffffff
add esp, 0xc
mov eax, 0x10014f36
ret
cmp ebx, edi
je 0x10014f48
push ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
or dword [ebp - 4], 0xffffffff
cmp esi, edi
jge 0x10014ff9
push dword [ebp + 8]
mov dword [ebp - 4], 2
push edi
push edi
push 0x1a
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
cmp esi, edi
jge 0x10014fa5
push esi
push str.Error:_08x_in_SHGetFolderPathW_NULL__CSIDL_APPDATA__NULL__0__pPath_
jmp 0x10014f01
or dword [ebp - 4], 0xffffffff
cmp esi, edi
jge 0x10014ff9
push 1
push 0x1a
push dword [ebp + 8]
mov dword [ebp - 4], 4
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov esi, eax
cmp esi, edi
jge 0x10014ff9
push esi
push str.Error:_08x_in_SHGetSpecialFolderPathW_NULL__pPath__CSIDL_APPDATA__TRUE_
jmp 0x10014f01
mov eax, esi
call fcn.1001bbe0
ret
Function at 0x10001d40
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100127d0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1001b008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 1
lea eax, [ebp + 0x20]
cmp dword [ebp + 0x34], 0x10
mov ecx, 0x1001b938
push dword [ebp + 0x30]
cmovae eax, dword [ebp + 0x20]
push eax
call fcn.10005420
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
mov ecx, 0x1001b920
push eax
call fcn.10005420
mov esi, dword [0x1001b948]
xor ebx, ebx
mov edi, dword [0x1001b94c]
nop word [eax + eax]
cmp edi, 0x10
mov byte [ebx + 0x1001c608], bl
mov eax, ebx
mov ecx, 0x1001b938
cmovae ecx, dword [0x1001b938]
cdq
idiv esi
mov al, byte [edx + ecx]
mov byte [ebx + 0x1001c508], al
inc ebx
cmp ebx, 0x100
jl 0x10001dc0
xor edi, edi
xor esi, esi
mov dl, byte [esi + 0x1001c608]
movzx eax, byte [esi + 0x1001c508]
add edi, eax
movzx ecx, dl
add edi, ecx
and edi, 0x800000ff
jns 0x10001e14
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [edi + 0x1001c608]
mov byte [esi + 0x1001c608], al
inc esi
mov byte [edi + 0x1001c608], dl
cmp esi, 0x100
jl 0x10001df0
mov esi, dword [ebp - 0x10]
mov ecx, esi
call fcn.10001b30
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x10001e69
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10001e5f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10001ebf
push edx
push ecx
call fcn.10005e32
add esp, 8
mov edx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp edx, 0x10
jb 0x10001eab
mov ecx, dword [ebp + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10001ea1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10001ebf
push edx
push ecx
call fcn.10005e32
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.10009730
int3
Function at 0x10002b10
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100129a8
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x1001b008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, 0x10018d81
mov dword [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.100056e0
test al, al
jne 0x10002bcd
mov eax, dword [ebp + 0x18]
inc eax
push eax
call fcn.100063a8
add esp, 4
lea ecx, [ebp + 8]
cmp dword [ebp + 0x1c], 0x10
mov ebx, eax
mov edx, ebx
cmovae ecx, dword [ebp + 8]
sub edx, ecx
nop
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x10002b70
mov esi, ebx
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x10002b82
sub esi, ecx
inc esi
push esi
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push esi
mov edi, eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
call fcn.10009000
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
call dword [sym.imp.USER32.dll_EmptyClipboard]
push edi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x10002bfd
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10002bf3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002c0f
push edx
push ecx
call fcn.10005e32
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.10009730
int3
Function at 0x44a210
Capabilities:
Accept command line arguments
Log keystrokes via polling

Disassembly:
push ecx
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, dword [esp + 0x14]
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
mov edi, eax
mov dword [esi], 0
call ebx
test ax, ax
jge 0x44a23b
or dword [esi], 0x2000000
lea eax, [esp + 0xc]
push eax
push edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push 0x11
mov edi, eax
call ebx
test ax, ax
jge 0x44a258
or dword [esi], 0x4000000
test edi, edi
je 0x44a26e
mov ecx, dword [0x657a4c]
push 0x657768
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
push 0x12
call ebx
test ax, ax
jge 0x44a27d
or dword [esi], 0x8000000
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x44da23
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00480f13
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x44db46
push ecx
lea ecx, [esi + 0x18]
call fcn.0046d243
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x44db5d
push ecx
lea ecx, [esi + 0x24]
call int.0046d153
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x496db3
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.004ca2a3
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x496ed6
push ecx
lea ecx, [esi + 0x18]
call fcn.004b65d3
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x496eed
push ecx
lea ecx, [esi + 0x24]
call fcn.004b64e3
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4b64e3
Capabilities:
Encode data using xor

Disassembly:
pop es
add al, 0xaf
mov al, byte [0x1c381fdd]
wait
adc ch, byte [eax - 0x7ba78cf0]
call 0x19204f5e
or dword [ebx + 0x2a], ebx
push edx
stc
or dh, byte [esp + ebp*4]
xor ah, byte [edx + 0x6e]
mov eax, 0xadb0c8ca
and ebx, ebp
loope 0x4b6442
jb 0x4b6503
or eax, 0xeba53d95
insd dword es:[edi], dx
mov cl, 0x5b
loopne 0x4b646d
and ebx, dword [edi + ecx*8 + 0x91d0484]
jb 0x4b64ed
adc eax, 0xcf7ae034
mov edx, 0x51d53cd6
and al, 0xa7
xor dword [edx], eax
in eax, 0x1d
jle 0x4b64a9
inc esi
jmp 0x69692296
mov dword [0x8ffffde6], eax
adc edi, ebp
sbb al, 0xe0
mov dl, 0xf8
clc
mov ecx, 0xf63d451b
js 0x4b6494
cmc
cmp dword [eax - 0x3e77f761], edi
jl 0x4b657b
inc edi
sbb al, 0xb7
sti
sti
sti
or ebp, ecx
insb byte es:[edi], dx
mov esp, 0xf7032d7c
sbb ah, byte [ebp - 0x10a384a]
adc byte [ecx], al
push ebx
or eax, 0xa3a8b908
jle 0x4b6573
adc al, 0x5e
daa
nop
sbb esp, 0x9c08d113
sub al, 0xa0
bswap ebp
dec edi
daa
jp 0x4b6541
pop ds
int 0xcf
and ebp, dword [ebx - 0x6ccb4817]
or eax, 0xfac76dfc
loope 0x4b6543
lds esp, [eax - 0x23]
adc ch, byte [esi + edi]
sub eax, 0x57e73c06
sub eax, 0x57e73c06
sbb eax, 0x35815dd6
mov ebx, dword [esi + 0xac97d19]
lds edi, [ebp + 0xe70f2e8]
popfd
pop ss
js 0x4b656b
lds edx, [ebx - 0x742193a4]
pop esp
mov byte [edi + esi*4 + 0x679ad59], bh
push es
test al, 0x8d
push ecx
invalid
mov esp, 0x6fa1468c
push si
cmpsb byte [esi], byte es:[edi]
mov ebx, 0x8abd810
invalid
Function at 0x4e0213
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00513703
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x4e0336
push ecx
lea ecx, [esi + 0x18]
call fcn.004ffa33
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x4e034d
push ecx
lea ecx, [esi + 0x24]
call fcn.004ff943
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4f4b83
Capabilities:
Check for vm using instruction vpcext

Disassembly:
xlatb
inc ecx
mul dword [edi + edx*4 + 0x42]
push cs
pushfd
mov bh, 0xd1
pop esi
dec edx
pop ds
pop es
inc ecx
jnp 0x4f4b85
mov esi, 0x4a166367
test dword [eax - 0x49f130af], 0x9dfb1838
push ss
jl 0x4f4b9a
cmp eax, 0x17561a48
and eax, 0xa2c8b3ce
pop ecx
dec esi
sub dword [0x983ba0c9], ebp
adc eax, 0xa0aa2aae
xchg edi, eax
scasd eax, dword es:[edi]
mov ah, 0x8d
mov cl, 0x75
stosd dword es:[edi], eax
and al, 0x52
jno 0x4f4b32
add edi, eax
mov ebx, 0xd0179d5c
fmul dword [esi + 0x653da948]
invalid
cmp edi, edx
jecxz 0x4f4b24
push edx
cwde
and bh, ah
cmovnp edi, esi
stc
mov edi, 0x5a4ec839
jp 0x4f4c0d
pushal
sub byte [eax], bh
fld qword [esi]
cmp ch, bl
push es
popfd
aaa
clc
jb 0x4f4b98
clc
jmp 0xf23febf3
cmp eax, 0xaa5c1b38
jnp 0x4f4beb
mov esp, 0x8feee670
add al, 0xee
adc al, 0xf4
mov esi, 0xe5a292f
inc ecx
mov ss, word [edi - 0x2e]
inc ebx
scasd eax, dword es:[edi]
cmp edi, ebp
lea ecx, [eax - 0x22eea451]
aam 0xa6
sahf
mov eax, 0xb6847937
mov dh, 0xe1
xor ch, cl
popfd
jmp 0xf14661a0
jmp 0x15fe358d
pop eax
dec esi
mov eax, 0x5ef32122
cmp bl, dl
fisubr word fs:[esi]
fadd dword [edi - 0x2f]
and esp, ebx
out dx, eax
clc
xchg esi, eax
dec edx
jne 0x4f4bda
xchg ebp, eax
js 0x4f4bbd
jl 0x4f4c20
js 0x4f4be3
dec eax
xchg ebx, eax
sub esp, dword es:[edx]
test ch, 0x77
or byte [edx + ebp*2 + 0x64], ah
adc dword [eax], eax
fisub dword [ebx + 0x63dd2628]
invalid
Function at 0x4fc553
Capabilities:
Encode data using xor

Disassembly:
or byte [ebp + 0x7684c0be], dh
call 0x6460c27
jno 0x4fc588
sbb ebx, ecx
mov al, byte [0xb38c5719]
invalid
sub esp, esi
xchg dword [eax], ecx
xchg edi, eax
loope 0x4fc51f
scasb al, byte es:[edi]
nop
fst qword [eax + 0x3b]
inc edi
sahf
dec esp
salc
int3
xor ecx, dword [ecx]
call 0xc8843578
sbb dword [ebp - 0x64], ebx
pop ss
insb byte es:[edi], dx
add bl, byte [eax - 0x2f]
dec ecx
pop es
sbb al, bh
xchg edi, eax
invalid

Function at 0x529943
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.0055ce33
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x529a66
push ecx
lea ecx, [esi + 0x18]
call int.00549163
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x529a7d
push ecx
lea ecx, [esi + 0x24]
call fcn.00549073
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x572f53
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call int.005a6443
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x573076
push ecx
lea ecx, [esi + 0x18]
call fcn.00592773
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x57308d
push ecx
lea ecx, [esi + 0x24]
call fcn.00592683
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x591533
Capabilities:
Encode data using xor

Disassembly:
pushfd
movsb byte es:[edi], byte [esi]
call [edi + 0x78]
mov ecx, 0xd0bb40af
xchg edx, eax
push cs
dec ebp
push 0xaabc1cb1
push edi
adc ch, al
and byte [edi], ch
dec edi
cwde
xchg edi, eax
invalid
Function at 0x5bc8b3
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.005efda3
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x5bc9d6
push ecx
lea ecx, [esi + 0x18]
call 0x5dc0d3
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x5bc9ed
push ecx
lea ecx, [esi + 0x24]
call fcn.005dbfe3
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x5cafd3
Capabilities:
Encode data using xor

Disassembly:
xchg esi, eax
or al, 0xec
sete byte [edx]
out dx, eax
sbb byte [edx - 0x36842b5b], bh
sub dword [ebx], 0x4bf33f03
arpl word [edi + 0x23], bx
setp dh
xchg edx, eax
xor byte [esi + 0xb5afb83], ch
ficomp dword [esi]
invalid
mov es, word [esi + 0x3adcbeb6]
loop 0x5cafdf
and eax, 0x3894fa53
cmp bl, byte [edx]
fld dword [ecx + 0x76d0e142]
and al, 0xe1
clc
jae 0x5cafa0
aas
sal byte [0x7d01cbd9], cl
jae 0x5cafc4
dec esp
sbb ah, byte [ebp - 0xf2b3c56]
int 0xd
xor cl, byte ss:[esp + edx*8]
mov bl, 0xbe
shr byte es:[edx - 0x2f], 0xcb
out dx, eax
push ebp
aam 0xcf
add dword [eax + 0x57], 0x7f
fisubr word [edx - 0x4d57f4a]
jmp dword ss:[edx]