joyce8/EMBER2024-capa huggingface dataset:
Function at 0x438cf5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [ebp + 8], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov esi, ecx
mov edi, str.C:projectsAmmyy_sourcesmain_soundAudioIn.cpp
je 0x438d23
movzx eax, word [esi + 4]
movzx ecx, word [esi + 6]
shr eax, 3
imul eax, ecx
imul eax, dword [esi + 0x70]
cmp ebx, eax
jbe 0x438d38
push 0x1b2
push edi
lea ecx, [ebp - 8]
call fcn.00410522
mov ecx, eax
call fcn.0041062e
mov ax, word [esi + 4]
cmp ax, 0x10
jne 0x438d7f
test bl, 1
je 0x438d5c
push 0x1b6
push edi
lea ecx, [ebp - 8]
call fcn.00410522
mov ecx, eax
call fcn.0041062e
shr ebx, 1
xor eax, eax
test ebx, ebx
jle 0x438dc1
mov ecx, dword [ebp + 8]
movsx edx, word [ecx]
mov dword [ebp + 8], edx
mov edx, dword [esi + 0x74]
fild dword [ebp + 8]
fstp dword [edx + eax*4]
inc eax
inc ecx
inc ecx
cmp eax, ebx
jl 0x438d67
jmp 0x438dc1
cmp ax, 8
je 0x438d9a
push 0x1be
push edi
lea ecx, [ebp - 8]
call fcn.00410522
mov ecx, eax
call fcn.0041062e
xor eax, eax
test ebx, ebx
jbe 0x438dc1
mov ecx, dword [ebp + 8]
movsx ecx, byte [eax + ecx]
xor ecx, 0x80
shl ecx, 8
mov dword [ebp + 0xc], ecx
mov ecx, dword [esi + 0x74]
fild dword [ebp + 0xc]
fstp dword [ecx + eax*4]
inc eax
cmp eax, ebx
jb 0x438da0
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x438fd0
Capabilities:
Create thread

Disassembly:
mov eax, 0x4606e4
call fcn.0045d320
sub esp, 0x1c
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], edi
cmp dword [esi + 0xb4], edi
je 0x439013
lea eax, [ebp - 0x20]
push str.CAudioOut::StartSound___Sound_Playback_thread_is_already_active
push eax
call fcn.004109c8
pop ecx
lea eax, [ebp - 0x20]
pop ecx
push 0x465b58
push eax
call sub.MSVCRT.dll__CxxThrowException
mov eax, dword [ebp + 8]
push 2
push dword [esi + 4]
mov ecx, esi
mov dword [esi + 8], eax
call fcn.00439304
push 1
push edi
mov ecx, esi
call fcn.00439525
lea ebx, [esi + 0x7c]
mov ecx, ebx
call fcn.00412465
cmp eax, edi
jne 0x439046
push edi
push edi
mov ecx, ebx
call fcn.0041083e
mov dword [esi + 0xb8], edi
push edi
push edi
push esi
push 0x439631
push edi
push edi
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 0xb4], eax
cmp dword [esi + 0xb4], edi
jne 0x439094
call dword [sym.imp.MSVCRT.dll__errno]
push dword [eax]
lea eax, [ebp - 0x28]
push str.Failed_to_start_Sound_Playback_thread__errno___d_
push eax
call fcn.004109c8
add esp, 0xc
lea eax, [ebp - 0x28]
push 0x465b58
push eax
call sub.MSVCRT.dll__CxxThrowException
push 1
pop eax
jmp 0x4390bd
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4
Function at 0x43a520
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x43a550
push esi
call fcn.0043e370
mov al, byte [esi + 0x40]
add esp, 4
test al, al
je 0x43a549
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x43a5d3
mov eax, dword [esi + 0x190]
mov cl, byte [eax + 0x10]
test cl, cl
je 0x43a5bf
mov eax, dword [esi + 8]
test eax, eax
je 0x43a574
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x190]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x43a5bb
cmp eax, 2
je 0x43a5bf
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x43a567
cmp eax, 3
je 0x43a59a
cmp eax, 1
jne 0x43a567
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x43a567
mov edx, dword [esi + 0x11c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x43a567
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
push esi
mov dword [esi + 0x84], eax
call fcn.0043a600
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x43a5f3
mov ecx, dword [esi]
push esi
mov dword [ecx + 0x14], 0x14
mov edx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [edx + 0x18], eax
mov ecx, dword [esi]
call dword [ecx]
add esp, 4
push esi
call fcn.0043a600
add esp, 4
pop esi
ret
Function at 0x43d400
Capabilities:
Query environment variable

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
xor ebx, ebx
push edi
mov dword [edi + 4], ebx
call fcn.0043f260
push 0x54
push edi
mov dword [esp + 0x18], eax
call fcn.0043f210
mov esi, eax
add esp, 0xc
cmp esi, ebx
jne 0x43d444
push edi
call fcn.0043f270
mov eax, dword [edi]
push edi
mov dword [eax + 0x14], 0x36
mov ecx, dword [edi]
mov dword [ecx + 0x18], ebx
mov edx, dword [edi]
call dword [edx]
add esp, 8
mov dword [esi], fcn.0043d540
mov dword [esi + 4], fcn.0043d690
mov dword [esi + 8], fcn.0043d740
mov dword [esi + 0xc], fcn.0043d7f0
mov dword [esi + 0x10], 0x43d8a0
mov dword [esi + 0x14], 0x43d910
mov dword [esi + 0x18], 0x43d980
mov dword [esi + 0x1c], 0x43db00
mov dword [esi + 0x20], 0x43dcf0
mov dword [esi + 0x24], fcn.0043dee0
mov dword [esi + 0x28], 0x43dfe0
mov dword [esi + 0x30], 0x3b9aca00
mov eax, dword [esp + 0xc]
mov ecx, 2
mov dword [esi + 0x2c], eax
lea eax, [esi + 0x40]
mov dword [eax - 8], ebx
mov dword [eax], ebx
sub eax, 4
dec ecx
jne 0x43d4a6
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], 0x54
push str.JPEGMEM
mov dword [edi + 4], esi
call sub.MSVCRT.dll_getenv
add esp, 4
cmp eax, ebx
je 0x43d536
lea ecx, [esp + 0x14]
lea edx, [esp + 0xc]
push ecx
push edx
push str._ld_c
push eax
mov byte [esp + 0x24], 0x78
call sub.MSVCRT.dll_sscanf
add esp, 0x10
test eax, eax
jle 0x43d536
mov al, byte [esp + 0x14]
cmp al, 0x6d
je 0x43d4ff
cmp al, 0x4d
jne 0x43d523
mov eax, dword [esp + 0xc]
pop edi
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
mov dword [esi + 0x2c], eax
pop esi
pop ebx
pop ecx
ret
mov eax, dword [esp + 0xc]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
mov dword [esi + 0x2c], eax
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x45d906
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x45d95c
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x465794
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x45d94f
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x45d95e
xor eax, eax
pop esi
leave
ret 4
Function at 0x61941323
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
push edi
sub esp, 0x444
lea eax, [ebp - 0x418]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], str.BuildingBlock.exe
mov dword [ebp - 0x14], str.SoftwareMicrosoftWindowsCurrentVersionRun
mov dword [ebp - 0x18], str.BuildingBlock
mov dword [esp + 8], 0x400
lea eax, [ebp - 0x418]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._GetModuleFileNameA_12
sub esp, 0xc
jmp 0x61941372
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test al, al
jne 0x6194136e
jmp 0x61941382
sub dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
cmp al, 0x5c
jne 0x6194137e
mov eax, dword [ebp - 0xc]
mov byte [eax], 0
lea eax, [ebp - 0x418]
mov ecx, 0xffffffff
mov edx, eax
mov eax, 0
mov edi, edx
repne scasb al, byte es:[edi]
mov eax, ecx
not eax
lea edx, [eax - 1]
lea eax, [ebp - 0x418]
add eax, edx
mov word [eax], 0x5c
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
lea eax, [ebp - 0x418]
mov dword [esp], eax
call sym._strcat
mov dword [ebp - 0x41c], 0
lea eax, [ebp - 0x41c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
mov dword [esp], 0x80000001
call sym._RegOpenKeyA_12
sub esp, 0xc
lea eax, [ebp - 0x418]
mov dword [esp], eax
call sym._strlen
lea edx, [eax + 1]
mov eax, dword [ebp - 0x41c]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x418]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 7
mov edx, dword [ebp - 0x18]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._RegSetValueExA_24
sub esp, 0x18
mov eax, dword [ebp - 0x41c]
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
nop
mov edi, dword [ebp - 4]
leave
ret

Function at 0x619414c7
Capabilities:
Create thread
Inject thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x1f0fff
call sym._OpenProcess_12
sub esp, 0xc
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0x1000
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._VirtualAllocEx_20
sub esp, 0x14
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._WriteProcessMemory_20
sub esp, 0x14
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], sym._LoadLibraryA_4
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CreateRemoteThread_28
sub esp, 0x1c
mov dword [ebp - 0x14], eax
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._WaitForSingleObject_8
sub esp, 8
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
nop
leave
ret
Function at 0x61941c10
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x6194603c
call sym._EnterCriticalSection_4
mov ebx, dword [0x61946034]
sub esp, 4
test ebx, ebx
je 0x61941c5b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x61941c54
test esi, esi
je 0x61941c54
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x61941c30
mov dword [esp], 0x6194603c
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x61941e40
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], 0x619441a4
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x61941e90
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x61941f68
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x61941ece
cmp eax, 4
jne 0x61941ef0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x61941ede
cmp edx, 4
je 0x61941ede
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.61941e40
Function at 0x405d9a
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42c574], 0
push esi
jne 0x405dd1
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405dab
mov dword [ecx*4 + 0x42c570], eax
inc ecx
cmp ecx, 0x100
jl 0x405da6
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405e02
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42c570]
xor eax, esi
inc ecx
dec edx
jne 0x405de4
pop edi
not eax
pop esi
ret 0xc

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x432f021e
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
mov ecx, 0x5a723fa6
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x510024
Capabilities:
Packed with generic packer

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [edx], al
add al, byte [eax]
add byte [eax], al
cld
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add al, byte [eax]
add byte [eax], al
cld
invalid
stc
jb 0x51002e
pop ds
xor esi, dword [ecx - 0x49]
jno 0x50ffe2
cwde
leave
jmp 0x51008f
pushal
jmp 0x510034
call 0x51003f
dec ecx
stc
mov dl, 0xed
pop ecx
pop ebx
jb 0x510049
jne 0x50ffd9
jge 0x510029
sbb dword [edx - 0x383c7edc], 0xffffffff
invalid
add ebx, 0xffffffc7
jmp 0x510058
cmp dword [ebx], 0
stc
jmp 0x510067
je 0x5100ed
jmp 0x510076
mov ecx, ebx
jmp 0x510081
add ebx, 4
jmp 0x510089
mov edx, dword [ebx]
jmp 0x510097
and eax, 0x8ced9cec
in eax, dx
cmp ebp, dword [ebx + 3]
sar ecx, cl
add edx, ebx
stc
jb 0x5100a3
mov ah, 0xb1
mov ebx, 0xc91a740d
mov eax, dword [ebx + 4]
jmp 0x5100ac
sub dword [edx], 0x3c62176a
jmp 0x5100b6
add edx, 4
jmp 0x5100bf
sub eax, 1
jmp 0x5100c6
jne 0x5100a6
jmp 0x5100d0
add ebx, 8
jmp 0x5100d7
sub dword [ecx], 1
stc
jb 0x5100de
and ecx, dword [edi]
test dword [eax + 0x72ffffff], esp
add dh, byte [ecx + 0xee83b]
add byte [eax], al
jne 0x510084
jb 0x5100e8
mov cl, 0x3b
call 0x5100fb
jmp 0x5100f1
popal
jmp 0x5100f6
jmp 0x50ed00

Function at 0x430000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x40499d
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00437e8d
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x404ac0
push ecx
lea ecx, [esi + 0x18]
call fcn.004241bd
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x404ad7
push ecx
lea ecx, [esi + 0x24]
call fcn.004240cd
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x49700d
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.004ca4fd
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x497130
push ecx
lea ecx, [esi + 0x18]
call fcn.004b682d
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x497147
push ecx
lea ecx, [esi + 0x24]
call fcn.004b673d
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4b334d
Capabilities:
Encode data using xor

Disassembly:
xor ebx, dword [esi]
add byte [edi - 0xe23c8ed], al
sbb ebp, 0xa495d433
movsb byte es:[edi], byte [esi]
cmp al, 0xe6
inc ebx
movsd dword es:[edi], dword gs:[esi]
inc ebp
aaa
pop esi
add bh, byte [edx + 0x6e]
xor al, 0x1e
loop 0x4b3361
push ss
inc ebp
push 0x26
and edi, edi
sal dword [ebp + 0x8ecfc93], cl
or al, byte [esi]
xchg ebx, eax
xlatb
or eax, 0x52456047
sal dword es:[edi + 0x63], 0x68
adc dword [edx + edx*2 + 0xe], 0xf1b279f
sub ebx, dword [esi - 0xc]
arpl word [edi], bx
scasd eax, dword es:[edi]
sar edx, cl
inc ebx
mov al, byte [0x37a3dc22]
and bl, ah
mov dword [0x476dec37], eax
aaa
in al, dx
insd dword es:[edi], dx
inc edi
cmpsb byte [esi], byte es:[edi]
lodsd eax, dword [esi]
mov bh, 0xe5
or al, 0xb9
pop ss
cmp eax, 0xd74c8097
mov dword [0xd62fb32e], eax
fnstsw word [edx - 0x6c]
sal esi, cl
or dword [edx - 0x18], esp
pop esp
mov dword [edi + 0x691cbb83], eax
jge 0x4b335a
std
fsubr st(6)
xor eax, 0x1782569c
stosd dword es:[edi], eax
je 0x4b3411
out 0x2b, eax
cmpsd dword [esi], dword es:[edi]
sti
fnstenv [edx + 0x2a]
fcompi st(2)
add esp, esp
jl 0x4b339f
push edx
mov edx, 0xd4caaa9f
imul esi, dword [ebx], 0xcf53b7a3
mov bh, 0x8b
bound ebp, qword [esi]
aam 0x69
xor esp, dword [ebx - 0x4830ac49]
mov esp, dword [edx + 0x2e]
js 0x4b33de
push ds
or byte [edx - 0x56292f8d], cl
jmp 0x4b3397
loop 0x4b339a
call [ebp + 0x46fcf08f]
vsubps ymm6, ymm5, ymmword [ebp + 0x72]
pop es
mov edi, 0x875459b4
js 0x4b3495
add edi, dword [edx]
pop ds
sbb dword [0xcf30c677], esp
mov al, byte [0xc5c6d3b4]
neg ah
sal dword [0x10188cd7], cl
out 0x87, al
mov ch, 0xf0
dec edx
push ebx
inc ebx
invalid
add al, 0x80
rcl bl, 0xd2
salc
jae 0x4b34bf
push ds
xchg byte [ecx + 0x76], cl
mov dword [0x8d58c217], eax
and ecx, dword [eax*2 - 0x310e4a7d]
add edx, dword [ebx - 0x6a33e046]
ret
mov bl, 0x9d
push eax
push esi
stosd dword es:[edi], eax
pop ecx
mov dh, 0xe1
and eax, 0x2edb08ce
xchg ebx, eax
aad 0x23
salc
and edx, esi
shr dword [ecx - 0x20], cl
test byte [ebp + 0xdbfa3bd], 0x57
or byte [0x6faf26b3], bh
scasb al, byte es:[edi]
jecxz 0x4b355e
jge 0x4b34cf
jne 0x4b34ef
add eax, dword [ebx + 0x32313e27]
mov dword [0x3a4dc357], eax
rcl dword [ebx + esi*8 - 0x31], 0
xchg edi, eax
invalid
fsub dword [edi + 0x555f9310]
pop edi
invalid

Function at 0x4b88cd
Capabilities:
Encode data using xor

Disassembly:
sub al, 0xa2
sub al, 0xa2
pop ecx
mov dword [ebx], ecx
pop eax
mov bl, 0xf7
les eax, [ebx + 0x28]
nop
mov dl, 0xff
xor cl, ah
sbb dword [ecx - 0x2ab4429a], edi
imul ecx, ebx, 0x2d04776
clc
xchg edx, eax
mov dh, 0xd3
dec eax
sahf
jne 0x4b88ce
pop edi
into
daa
sbb al, 0xe0
invalid