joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44da12
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call int.00480f02
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x44db35
push ecx
lea ecx, [esi + 0x18]
call fcn.0046d232
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x44db4c
push ecx
lea ecx, [esi + 0x24]
call fcn.0046d142
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x46c342
Capabilities:
Encode data using xor

Disassembly:
cmp esp, dword [edi]
dec eax
test byte [ecx], cl
xchg byte [edx], bl
adc ah, bh
add al, 0x30
pop es
xor byte [edi], al
mov cl, 0x14
je 0x46c34c
ret 0xa94
Function at 0x496da2
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.004ca292
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x496ec5
push ecx
lea ecx, [esi + 0x18]
call fcn.004b65c2
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x496edc
push ecx
lea ecx, [esi + 0x24]
call fcn.004b64d2
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4b8942
Capabilities:
Encode data using xor

Disassembly:
dec edx
push ebx
push 0xffffffffffffffea
sar dword [edi + 0x5ccc25dd], cl
xor dword [eax + 0x73fccc84], eax
insb byte es:[edi], dx
and byte [ecx], ch
out 0xb3, al
xor byte [ecx + 0x2f], cl
mov ss, word [eax + 0x1f]
test byte [esi - 0x4a], 0xec
in al, dx
in al, dx
in eax, dx
push edi
push ds
jl 0x4b8924
pop esp
test byte [eax + esi*8 + 0x1b], bh
xor al, 0xae
pop ss
stc
sub al, 0x52
invalid
Function at 0x4e0202
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.005136f2
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x4e0325
push ecx
lea ecx, [esi + 0x18]
call fcn.004ffa22
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x4e033c
push ecx
lea ecx, [esi + 0x24]
call fcn.004ff932
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5130d2
Capabilities:
Encode data using xor

Disassembly:
dec ebp
invalid
adc byte [esi - 0x74], ah
adc cl, ah
test al, 0x82
jp 0x513088
and eax, 0x89237764
wait
xor byte [eax*4 + 0x557d92cc], 0x4a
retf

Function at 0x529932
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.0055ce22
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x529a55
push ecx
lea ecx, [esi + 0x18]
call fcn.00549152
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x529a6c
push ecx
lea ecx, [esi + 0x24]
call fcn.00549062
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x52efa6
Capabilities:
Encode data using xor

Disassembly:
and esi, edi
add dword [esp + eax*2 + 0x2f], ebx
invalid
or edx, dword [ebx]
sub eax, 0xa19e5d08
movsb byte es:[edi], byte [esi]
add eax, 0x425ed949
mov word [edi + 0x2b], es
imul edi, dword [ebp - 0x11], 0xffffffff
out dx, al
fbstp tbyte [eax]
sub ebx, edx
sub al, byte [ecx + 0x26]
mov ch, 0x7e
sub eax, 0xc64333a0
xor byte [ecx*4 - 0x3c2ae1d], 0x87
xor al, 0x5a
xor esi, dword [ebx + 0x61]
jae 0x52f038
jp 0x52eff7
dec esp
inc eax
bound edx, qword [eax]
salc
adc dh, dl
jg 0x52ef98
popfd
dec ebp
sub byte [esi + 0x1d], ch
sub cl, dh
pop ss
aas
or eax, 0xcf1471e8
lodsb al, byte [esi]
cmpsd dword [esi], dword es:[edi]
adc bl, byte [edi + 0x47]
loopne 0x52efd5
dec edi
add byte [ebp + 0x30], 0xc7
inc ebp
xor bh, al
xchg ebp, eax
or byte [ecx], dl
daa
sahf
loop 0x52f022
jno 0x52efdc
invalid
and ebp, esi
push esp
movsd dword es:[edi], dword [esi]
sub bh, byte [edx - 0x715e9f40]
jne 0x52f034
push eax
jge 0x52f029
sbb byte cs:[edx - 0x4a8eae22], dl
add al, 0x31
test al, 0x21
salc
jecxz 0x52f00a
std
jmp 0x52f065
cmp edx, dword [edx + 0x66e23f83]
mov edx, 0x1a831be2
pop esi
lodsd eax, dword [esi]
push 0xce8e60fc
pushal
mov cs, esi
and dword [edi + edx*2], esp
and dword [ecx + 0x5eb02474], ebx
aas
add esp, ebx
inc esi
mov esi, 0x5bc532e5
and eax, 0xc757f6b0
cwde
pop esi
shr byte [edx + 0x53], 1
cmp al, 0xd9
jp 0x52f06d
fdivr dword [ebx - 0x2d6332c2]
xor al, cl
salc
popal
sub al, 0xf2
iretd
pop esi
fiadd dword [edx + 0x61]
ficomp word [esi - 0x66]
sti
ficomp word [ebx + 0x7d]
inc edx
aam 1
push ds
sub byte [eax], bl
or dword [esi - 0x40], edi
adc byte [eax + eax*8 - 0x3811755b], bh
lahf
insb byte es:[edi], dx
add dl, byte [ecx - 0x66b45050]
je 0x52f074
invalid
adc cl, byte [ecx + 0x72]
loopne 0x52f0c1
dec dword [eax + 0x76]
lds ecx, [ebx + 0x31]
sub edi, dword [eax + edx*4]
salc
or dword [ecx + 0x3cbe381e], ebx
jnp 0x52f087
int3
lodsd eax, dword [esi]
mov eax, 0xac9ee7a0
invalid

Function at 0x553a62
Capabilities:
Encode data using xor

Disassembly:
fisubr word [esi]
sti
mov dh, 0x6c
fistp qword [edi - 0x71c4d873]
arpl word [ecx - 0x64d08d60], bp
pop edx
ficom word [0xfa5f7b22]
jnp 0x553ad8
cli
out 0xed, al
mov al, byte [edi]
push ecx
mov ah, 0xdf
mov bh, 0xc4
xor esi, ebp
rcl dword [ecx], cl
repne cmpsb byte [esi], byte es:[edi]
add byte [ecx - 0x2586280b], bl
push esi
fistp word [ebp + ecx*4 + 0x4e]
outsb dx, byte [esi]
call 0x9770431a
add al, 0x2b
lea eax, [esi - 0x2e40abaa]
pop edi
loop 0x553a77
and eax, 0x9c8e9408
rcr esi, 1
mov dh, 0xa1
fadd qword [ecx - 0x58]
inc eax
ljmp 0x76d4
adc dword [eax + eax], edi
wait
nop
lodsb al, byte [esi]
clc
sub esp, esi
add al, 0xee
invalid
Function at 0x55c6a2
Capabilities:
Encode data using xor

Disassembly:
sbb byte [esi], cl
add byte [edx], bl
jno 0x55c713
wait
mov dword [edi + 4], ebp
outsb dx, byte [esi]
lcall 0xd939, 0xfe575fb3
sbb dword [edx], edx
xor dl, byte [esi]
push edx
sahf
adc eax, 0x7feec064
dec esp
popal
pushal
invalid
cld
jg 0x55c77c
aas
or ah, byte [ebp + 0x25]
fist word [ecx]
dec ecx
push edi
sahf
rcr bh, 1
enter 0x1d98, 0xfffffffffffffffb
aas
and al, 0x8e
pop edx
adc dword [esi - 0x59], ecx
int3
and cl, byte [esi - 0x1e]
scasd eax, dword es:[edi]
inc esi
int3

Function at 0x5bcc62
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.005f0152
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x5bcd85
push ecx
lea ecx, [esi + 0x18]
call fcn.005dc482
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x5bcd9c
push ecx
lea ecx, [esi + 0x24]
call fcn.005dc392
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5f0152
Capabilities:
Encode data using xor

Disassembly:
std
and ah, 0x92
clc
sub edi, dword [ebp + 0x4a09fc0d]
aas
push 0xffffffffffffffda
imul ebx, dword [ecx], 0xadd809bf
popal
sbb byte [ecx + 0x59], bl
dec eax
or byte [edx], dl
sub edi, eax
or byte [edx], ch
shr byte [esi - 0x31f2453c], cl
mov dword [ecx + ebp*8 - 0x7fd31b5f], ecx
xlatb
push ds
or bh, byte [eax + ebp + 9]
cmp ch, byte [eax + 3]
pushfd
fimul word [ebx]
fmul st(2), st(0)
je 0x5f0197
les edi, [edx - 0x737631f3]
jmp 0x808be5d1
xchg esp, eax
dec dword [edx]
mov eax, 0x2671f8ad
sbb eax, 0x7ce7c491
mov ch, 0x38
sub al, dl
pop edi
and al, 5
cdq
test al, 0xcc
push es
pop esp
mov bl, byte [esi + 0x63]
insd dword es:[edi], dx
jl 0x5f01d5
fldenv [eax + ecx - 0xdb666ad]
jo 0x5f0101
int 0x58
loope 0x5f0125
rol dword [ecx + 0x4c635831], 1
fmul qword [eax - 0x439cc60]
pushal
adc ch, byte [eax - 0x20]
insb byte es:[edi], dx
push edx
xor al, 0x90
or al, 0x59
cld
enter 0xffffffffffff8803, 0xffffffffffffff95
xor dword [edi + 0x1d790477], ebx
jns 0x5f01aa
std
sub al, 0x9b
mov esp, ecx
pcmpgtw mm7, mm4
imul edx, dword [ecx], 0xffffffd7
xlatb
lea ecx, [eax + 0x4f]
clc
xchg edi, eax
cdq
and byte [ebx + 0x4322cc7d], 0xa3
invalid
cwde
int3
adc byte [edi + edx*8], ch
pop esp
mov dword [ecx - 0x32], 0xef939c6e
mov edi, 0x9457d94d
adc ah, byte [ecx]
cmp byte ds:[eax + 0x58f2734c], al
outsd dx, dword [esi]
or dword [ebp + ebp - 0x73], ecx
mov eax, 0x978c6bc5
pop ebp
or byte [ebx + 0x67281757], ah
pop esi
pop ss
sub byte [edi + 0x5e], ah
add al, 8
dec ebp
test eax, 0xe5b0bbb6
mov al, 0xe5
jo 0x5f018b
pop ecx
shr cl, 0xaf
dec esp
jmp 0x5f025d
invalid
js 0x5f01fc
jp 0x5f01f9
sbb byte [eax - 0x36756f5], ch
cld
jbe 0x5f0206
in al, 0x9c
jnp 0x5f0221
in al, dx
cmp al, 0x1c
sbb byte [eax], bl
pop esp
insb byte es:[edi], dx
ja 0x5f02d0
push 0x60
sbb eax, 0xaa664868
aaa
sbb al, 0x73
fstp qword [ebp - 0x3024778]
popfd
mov byte [eax + 0x5d46fcfd], bh
fstp qword [ebp - 0xcc798e6]
or byte [eax], ch
Function at 0x6062f2
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.006397e2
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x606415
push ecx
lea ecx, [esi + 0x18]
call 0x625b12
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x60642c
push ecx
lea ecx, [esi + 0x24]
call fcn.00625a22
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x625c02
Capabilities:
Encode data using xor

Disassembly:
xor ebp, dword [edx]
adc dword [edi], esi
call 0xfed536b5
jb fcn.00625c02
jb fcn.00625c02
xor edi, edi
outsb dx, byte [esi]
and byte [esi + 0x3e], 0x72
cmpsd dword [esi], dword es:[edi]
inc edx
dec ecx
jae 0x625bfb
mov ecx, 0xc1c5e2f5
dec edx
aaa
fild word [ebx - 0x3aff594b]
cwde
pop ebx
xor dword [ebp - 0x673aff5a], 0x5b
pop esi
sub al, byte [0xd439483]
mov dword [0x45b5630a], eax
xor dword [eax], ebp
sbb esi, eax
jge 0x625c18
int3
Function at 0x64d5ed
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x655338
cmp edx, dword [eax]
je 0x64d60f
add eax, 8
inc ecx
cmp eax, 0x6553c8
jl 0x64d600
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x655338]
jne 0x64d73d
mov eax, dword [0xa58c90]
cmp eax, 1
je 0x64d717
test eax, eax
jne 0x64d640
cmp dword [0x655264], 1
je 0x64d717
cmp edx, 0xfc
je 0x64d73d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x64d677
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0064dfd0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0064e460
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x64d6ba
lea eax, [ebp - 0x1a4]
push eax
call fcn.0064e460
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x6528ac
push edi
call fcn.00650330
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0064dfd0
lea eax, [ebp - 0xa0]
test dword [eax - 1], esp
invalid
call dword [edi + 0x50]
call fcn.0064dfe0
lea eax, [ebp - 0xa0]
pushal
invalid
invalid
jmp [eax - 0x74]
sub byte [ebp], ah
push eax
call fcn.0064dfe0
push dword [esi + 0x65533c]
lea eax, [ebp - 0xa0]
push eax
call fcn.0064dfe0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.006502a4
add esp, 0x2c
pop edi
jmp 0x64d73d
lea eax, [ebp + 8]
lea esi, [esi + 0x65533c]
push 0
push eax
push dword [esi]
call fcn.0064e460
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x100077a0
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
push 0x2d
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
cwde
shr eax, 0x10
test eax, eax
je 0x100077ea
cmp byte [0x1005dc00], 0
je 0x100077dc
cmp dword [0x1005dc04], 0
je 0x100077f1
call edi
cmp dword [0x1005dc04], eax
ja 0x100077f1
mov byte [0x1005dc00], 1
mov eax, 1
jmp 0x100077f3
mov byte [0x1005dc00], 0
xor eax, eax
test al, 1
je 0x10007808
xor ecx, ecx
cmp dword [0x10059f34], ecx
sete cl
mov dword [0x10059f34], ecx
cmp dword [0x1005d8fc], 0
je 0x10007851
push 0xa2
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x10007851
lea edx, [ebp - 8]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
add edx, 2
mov dword [0x10059f40], ecx
mov dword [0x10059f44], edx
cmp dword [0x10059f34], 0
je 0x100079cf
push 0x26
call esi
cwde
shr eax, 0x10
test eax, eax
je 0x10007894
cmp byte [0x1005dbc8], 0
je 0x10007886
cmp dword [0x1005dbcc], 0
je 0x1000789b
call edi
cmp dword [0x1005dbcc], eax
ja 0x1000789b
mov byte [0x1005dbc8], 1
mov eax, 1
jmp 0x1000789d
mov byte [0x1005dbc8], 0
xor eax, eax
test al, 1
je 0x100078d4
mov ecx, dword [0x1005e5fc]
mov eax, dword [0x1005e600]
mov edx, 2
dec eax
jns 0x100078b7
lea eax, [ecx - 1]
lea esi, [eax*8]
sub esi, eax
cmp dword [esi*4 + 0x1005c9f0], edx
je 0x100078b1
pop edi
mov dword [0x1005e600], eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 0x28
call fcn.10001060
test al, 1
mov eax, dword [0x1005e600]
je 0x10007916
mov ecx, dword [0x1005e5fc]
mov edx, 2
inc eax
cmp eax, ecx
jne 0x100078f9
xor eax, eax
lea esi, [eax*8]
sub esi, eax
cmp dword [esi*4 + 0x1005c9f0], edx
je 0x100078f2
pop edi
mov dword [0x1005e600], eax
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [eax*8]
sub ecx, eax
cmp dword [ecx*4 + 0x1005c9e8], 0
je 0x100079cf
xor esi, esi
lea eax, [esi + 0x25]
call fcn.10001060
test al, 1
je 0x10007957
mov eax, dword [0x1005e600]
lea edx, [eax*8]
sub edx, eax
mov eax, dword [edx*4 + 0x1005c9e8]
cmp dword [eax], esi
jle 0x10007957
or esi, 0xffffffff
mov eax, 0x27
call fcn.10001060
mov ecx, dword [0x1005e600]
test al, 1
je 0x10007991
lea eax, [ecx*8]
sub eax, ecx
add eax, eax
mov edx, dword [eax + eax + 0x1005c9ec]
add eax, eax
mov eax, dword [eax + 0x1005c9e8]
dec edx
cmp dword [eax], edx
jge 0x10007991
mov esi, 1
jmp 0x10007995
test esi, esi
je 0x100079cf
lea eax, [ecx*8]
sub eax, ecx
add eax, eax
mov ecx, dword [eax + eax + 0x1005c9e8]
add dword [ecx], esi
add eax, eax
mov eax, dword [eax + 0x1005c9f0]
cmp eax, 1
jne 0x100079c0
mov dword [0x1005e5fc], 0
cmp eax, 4
jne 0x100079cf
mov dword [0x1005e5fc], 0
pop edi
pop esi
mov esp, ebp
pop ebp
ret