joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401680
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
sub esp, 4
mov edi, eax
test eax, eax
je 0x401725
mov eax, dword [eax + 0x3c]
mov esi, dword [edi + eax + 0x78]
add esi, edi
mov eax, esi
mov dword [esp + 0x1c], esi
mov esi, dword [esi + 0x20]
mov eax, dword [eax + 0x14]
add esi, edi
mov dword [esp + 0x18], eax
test eax, eax
je 0x401723
xor eax, eax
mov dword [esp + 0x14], edi
mov edi, eax
lea esi, [esi]
nop
mov ebx, dword [esp + 0x14]
add ebx, dword [esi]
mov dword [esp + 4], 0x32
mov dword [esp], ebx
call fcn.00402670
test eax, eax
je 0x401730
lea ebp, [ebx + eax]
mov edx, 0x35
lea esi, [esi]
imul eax, edx, 0xab10f29f
movsx ecx, byte [ebx]
add ebx, 1
add eax, ecx
and eax, 0xffffff
add edx, eax
cmp ebp, ebx
jne 0x4016f8
cmp dword [esp + 0x44], edx
je 0x40173b
add edi, 1
add esi, 4
cmp edi, dword [esp + 0x18]
jne 0x4016d0
xor edi, edi
add esp, 0x2c
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, 0x35
cmp dword [esp + 0x44], edx
jne 0x401717
mov esi, dword [esp + 0x1c]
mov eax, edi
mov edi, dword [esp + 0x14]
lea eax, [edi + eax*2]
add eax, dword [esi + 0x24]
movzx eax, word [eax]
lea eax, [edi + eax*4]
add eax, dword [esi + 0x1c]
add edi, dword [eax]
add esp, 0x2c
pop ebx
mov eax, edi
pop esi
pop edi
pop ebp
ret

Function at 0x4019d0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.00402790
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.zzzzz_zzz_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.00402790
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]
Function at 0x401a30
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x406068]
test esi, esi
jle 0x401b50
mov eax, dword [0x40606c]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x401a64
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x401ae7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x401a50
mov dword [esp], ebx
call fcn.004023c0
mov edi, eax
test eax, eax
je 0x401b77
mov eax, dword [0x40606c]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.004024d0
mov edx, dword [0x40606c]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401b57
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x401ae0
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x401af0
add dword [0x406068], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 0x40
mov eax, 4
mov ecx, dword [esp + 0x20]
cmovne eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x40606c]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x401ae0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.004019d0
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x401a6e
mov eax, dword [0x40606c]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.004019d0
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.004019d0
lea esi, [esi]
nop

Function at 0x402030
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x406084
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x40607c]
sub esp, 4
test ebx, ebx
je 0x402085
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40207e
test esi, esi
je 0x40207e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402060
mov dword [esp], 0x406084
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4010e8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x442004]
jne 0x4010f2
repz ret
jmp fcn.004017b3

Function at 0x40623b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x442004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00404398
and dword [ebp - 0x14], 0
cmp dword [0x444c88], 0
mov dword [ebp - 0x18], eax
jne 0x4062ee
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x406396
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x406396
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x444c88], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x444c8c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x444c90], eax
call edi
push eax
call esi
mov dword [0x444c98], eax
test eax, eax
je 0x4062ee
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x444c94], eax
mov eax, dword [0x444c94]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x406347
cmp dword [0x444c98], ecx
je 0x406347
push eax
call esi
push dword [0x444c98]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x406347
test ebx, ebx
je 0x406347
call edi
test eax, eax
je 0x40633e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40633e
test byte [ebp - 8], 1
jne 0x406347
or dword [ebp + 0x10], 0x200000
jmp 0x40637a
mov eax, dword [0x444c8c]
cmp eax, dword [ebp - 0x18]
je 0x40637a
push eax
call esi
test eax, eax
je 0x40637a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40637a
mov eax, dword [0x444c90]
cmp eax, dword [ebp - 0x18]
je 0x40637a
push eax
call esi
test eax, eax
je 0x40637a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x444c88]
call esi
test eax, eax
je 0x406396
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x406398
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004010e8
leave
ret
Function at 0x43d9c0
Capabilities:
Encode data using xor

Disassembly:
push esi
xor esi, esi
test ebx, ebx
jle 0x43d9d4
call fcn.0043d940
xor byte [esi + edi], al
inc esi
cmp esi, ebx
jl 0x43d9c7
pop esi
cmp ebx, 0x2d
jne 0x43d9ee
mov dword [0x2bea6e8], 0xa62e7790
mov dword [0x2bea6ec], 0xffffffff
ret

Function at 0x43d9f0
Capabilities:
Create pipe

Disassembly:
sub esp, 0x24
mov eax, dword [0x442004]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [0x443200]
push ebx
mov ebx, dword [0x2bea6dc]
push edi
mov edi, dword [0x2be825c]
call fcn.0043d990
cmp dword [0x2bea6dc], 0x2f
jne 0x43da5d
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
call fcn.0043d9c0
mov ecx, dword [esp + 0x24]
pop edi
pop ebx
xor ecx, esp
call fcn.004010e8
add esp, 0x24
ret
Function at 0x40233b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x509d04]
jne 0x402345
repz ret
jmp fcn.004089f2

Function at 0x40abf4
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004041ed
and dword [ebp - 4], 0
cmp dword [0x510590], 0
mov ebx, eax
jne 0x40aca5
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40ad56
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x411030
push edi
call esi
test eax, eax
je 0x40ad56
push eax
call fcn.0040417b
mov dword [esp], 0x411020
push edi
mov dword [0x510590], eax
call esi
push eax
call fcn.0040417b
mov dword [esp], 0x41100c
push edi
mov dword [0x510594], eax
call esi
push eax
call fcn.0040417b
mov dword [esp], 0x410ff0
push edi
mov dword [0x510598], eax
call esi
push eax
call fcn.0040417b
pop ecx
mov dword [0x5105a0], eax
test eax, eax
je 0x40aca5
push 0x410fd8
push edi
call esi
push eax
call fcn.0040417b
pop ecx
mov dword [0x51059c], eax
mov eax, dword [0x51059c]
cmp eax, ebx
je 0x40acfd
cmp dword [0x5105a0], ebx
je 0x40acfd
push eax
call fcn.004041f6
push dword [0x5105a0]
mov esi, eax
call fcn.004041f6
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40acfd
test edi, edi
je 0x40acfd
call esi
test eax, eax
je 0x40acf4
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40acf4
test byte [ebp - 0xc], 1
jne 0x40acfd
or dword [ebp + 0x10], 0x200000
jmp 0x40ad36
mov eax, dword [0x510594]
cmp eax, ebx
je 0x40ad36
push eax
call fcn.004041f6
pop ecx
test eax, eax
je 0x40ad36
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40ad36
mov eax, dword [0x510598]
cmp eax, ebx
je 0x40ad36
push eax
call fcn.004041f6
pop ecx
test eax, eax
je 0x40ad36
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x510590]
call fcn.004041f6
pop ecx
test eax, eax
je 0x40ad56
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40ad58
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100030b9
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10003548]
jne 0x10009f63
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x1000c4d0], eax
mov dword [0x1000c4cc], ecx
mov dword [0x1000c4c8], edx
mov dword [0x1000c4c4], ebx
mov dword [0x1000c4c0], esi
mov dword [0x1000c4bc], edi
mov word [0x1000c4e8], ss
mov word [0x1000c4dc], cs
mov word [0x1000c4b8], ds
mov word [0x1000c4b4], es
mov word [0x1000c4b0], fs
mov word [0x1000c4ac], gs
pushfd
pop dword [0x1000c4e0]
mov eax, dword [ebp]
mov dword [0x1000c4d4], eax
mov eax, dword [ebp + 4]
mov dword [0x1000c4d8], eax
lea eax, [ebp + 8]
mov dword [0x1000c4e4], eax
mov eax, dword [ebp - 0x320]
mov dword [0x1000c420], 0x10001
mov eax, dword [0x1000c4d8]
mov dword [0x1000c3d4], eax
mov dword [0x1000c3c8], 0xc0000409
mov dword [0x1000c3cc], 1
mov eax, dword [0x10003548]
mov dword [ebp - 0x328], eax
mov eax, dword [0x1000c198]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x1000c418], eax
push 1
call sub.msvcr100.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x1000a064
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x1000c418], 0
jne 0x1000a04f
push 1
call sub.msvcr100.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret

Function at 0x10003de4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x10003df3
pop dword [ebp - 0x20]
mov eax, 0x10003df3
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x429e611d
sub dword [ebp - 0x30], 0xf44c1bd2
mov dword [ebp - 0x2c], 0x92142389
sub dword [ebp - 0x2c], 0x5fe0d744
mov dword [ebp - 0x28], 0x5dba0069
add dword [ebp - 0x28], 0xee9243c5
mov dword [ebp - 0x24], 0x66a0ce1b
sub dword [ebp - 0x24], 0x66a0ce1b
lea eax, [ebp - 0x30]
push eax
mov eax, 0x9d6e5ffe
sub eax, 0x8d6e4f02
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0xda1f88b
add dword [ebp - 0x30], 0x66d070cb
mov dword [ebp - 0x2c], 0xd2cf9ac3
sub dword [ebp - 0x2c], 0x9163394e
mov dword [ebp - 0x28], 0x5be48b8c
sub dword [ebp - 0x28], 0xf8751f20
mov dword [ebp - 0x24], 0x852c4090
sub dword [ebp - 0x24], 0x852c4090
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x3d2b8
push 0
call eax
mov ecx, 0x5634
xor esi, esi
add esi, eax
mov edi, 0x16b2a971
add edi, 0xf94e3e8f
add edi, dword [ebp - 0x20]
mov edx, 0x3bea2fb8
sub edx, 0x53b17538
sub dword [ebp - 0x1c], 0x7d866dd9
mov ebx, dword [edi]
sub dword [ebp - 0x10], ecx
add ebx, edx
xor dword [ebp - 0xc], ecx
mov dword [esi], ebx
sub dword [ebp - 8], 0x5f16b7a5
add esi, 0xb1526e6b
sub esi, 0xb1526e67
add edi, 0x2d880965
sub edi, 0x2d880961
loop 0x10003f07
add eax, 0xf78179a7
sub eax, 0xf7802e04
xor ebx, ebx
add ebx, eax
add eax, 0xdc30f086
add eax, 0x23cf0f7f
mov ecx, 0x10000000
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x408cfd
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x810030]
jne 0x408d07
repz ret
jmp fcn.0040cf92

Function at 0x40a10d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004055a8
and dword [ebp - 4], 0
cmp dword [0x814944], 0
mov ebx, eax
jne 0x40a1be
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40a26f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40a26f
push eax
call fcn.00405536
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x814944], eax
call esi
push eax
call fcn.00405536
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x814948], eax
call esi
push eax
call fcn.00405536
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x81494c], eax
call esi
push eax
call fcn.00405536
pop ecx
mov dword [0x814954], eax
test eax, eax
je 0x40a1be
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00405536
pop ecx
mov dword [0x814950], eax
mov eax, dword [0x814950]
cmp eax, ebx
je 0x40a216
cmp dword [0x814954], ebx
je 0x40a216
push eax
call fcn.004055b1
push dword [0x814954]
mov esi, eax
call fcn.004055b1
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40a216
test edi, edi
je 0x40a216
call esi
test eax, eax
je 0x40a20d
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40a20d
test byte [ebp - 0xc], 1
jne 0x40a216
or dword [ebp + 0x10], 0x200000
jmp 0x40a24f
mov eax, dword [0x814948]
cmp eax, ebx
je 0x40a24f
push eax
call fcn.004055b1
pop ecx
test eax, eax
je 0x40a24f
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40a24f
mov eax, dword [0x81494c]
cmp eax, ebx
je 0x40a24f
push eax
call fcn.004055b1
pop ecx
test eax, eax
je 0x40a24f
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x814944]
call fcn.004055b1
pop ecx
test eax, eax
je 0x40a26f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40a271
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40479e
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00437c8e
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x4048c1
push ecx
lea ecx, [esi + 0x18]
call fcn.00423fbe
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x4048d8
push ecx
lea ecx, [esi + 0x24]
call fcn.00423ece
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x423d9e
Capabilities:
Encode data using xor

Disassembly:
jl 0x423d28
clc
ret 0x14cb
adc al, 0xb7
cmp ah, dl
or al, cl
xchg esi, eax
jecxz 0x423d0f
jmp 0xb06d6c72
mov al, 0x58
jb 0x423d15
leave
out 0x48, al
dec eax
salc
adc ebx, esi
cmp edx, dword [edi]
pushfd
fiadd dword [ebx + 0xe84b37a]
sbb byte [ecx], ah
cwde
push ecx
cmp al, dh
add eax, 0x58760625
push edx
push 0xa6a5b984
adc ecx, dword [eax - 0x38]
test al, 0x10
fldenv [eax + 0x158880a6]
pop ss
jno 0x423ce8
push es
sbb byte [ecx - 1], dl
ret
jge 0x423d64
not byte [edx + 0x48]
sbb al, ch
scasb al, byte es:[edi]
je 0x423dcf
adc ah, 0x38
rcl byte [edi], 0xe0
jecxz 0x423cee
mov dword [eax + 0x6a], eax
mov ah, 0xfc
in eax, dx
dec ebp
inc ecx
pop ecx
lodsb al, byte [esi]
xchg dword [ebx + ebx], edx
add eax, edi
push ecx
dec eax
add al, 0xd7
mov dword [0xbe15f1dd], eax
cmp eax, dword [ebp + 0x46]
jo 0x423d61
pop eax
cmpsd dword [esi], dword es:[edi]
push cs
sub ch, byte [edx - 0x21f61744]
mov dl, 0xd6
push edx
cmpsd dword [esi], dword es:[edi]
nop
jne 0x423dc6
mov ebx, 0xb00dd643
movsd dword es:[edi], dword [esi]
invalid
inc ebx
sbb bh, byte [eax + 0x71]
test eax, 0x1580319f
pushfd
xor eax, 0xd9de6b1b
jno 0x423d4c
lahf
xor dword [eax + 0x1b359c15], eax
imul ebx, esi, 0xffffffd9
call 0x273cc759
mov ecx, 0xd8c1b3a0
outsd dx, dword [esi]
mov esp, 0xe6a2e822
xchg esp, eax
push ebx
jge 0x423da1
stc
sub al, 0x78
sbb dl, byte [ebx]
or al, 0x4b
dec ebx
imul edi, dword [eax], 0x5993e778
loopne 0x423ddf
invalid
cmp ch, byte [ebp + ebp*4 + 0x568dd995]
push es
mov ebp, 0x103a03fa
movsd dword es:[edi], dword [esi]
mov word [edi + 0x74197a99], ds
aaa
lahf
cdq
jp 0x423dfc
je 0x423e1c
jnp 0x423dc7
nop
jmp 0x487dd580
inc ebx
sal ah, cl
mov eax, dword [esi]
xchg edx, eax
sub cl, byte [edi]
inc eax
nop
insb byte es:[edi], dx
test al, 0x61
shr byte [edx + 0x21], 0xb1
loope 0x423e59
and edi, eax
in al, 0x98
sbb dword [ecx - 0x70], esi
movsd dword es:[edi], dword [esi]
lodsd eax, dword [esi]
pushfd
xchg esi, eax
cwde
xchg ebp, eax
adc eax, 0xb3d494c1
pop ds
or byte [esi], al
xor al, 0x6f
sub al, 0xed
or eax, 0x1d3a5feb
stosb byte es:[edi], al
stc
iretd
Function at 0x44d65e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47262f
mov eax, dword fs:[0]
push eax
sub esp, 0x138
mov eax, dword [0x4a2008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x13c], edx
mov eax, ecx
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x134], eax
mov esi, dword [ebp + 8]
mov edi, esi
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x140], 0
cmp dword [esi + 0x14], 0x10
mov ecx, dword [esi + 0x10]
mov dword [ebp - 0x138], ecx
jb 0x44d6c5
mov edi, dword [esi]
cmp dword [edx + 0x14], 0x10
mov ecx, dword [edx + 0x10]
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x130], edx
jb 0x44d6e2
mov ecx, dword [edx]
mov dword [ebp - 0x130], ecx
cmp dword [edx + 0x10], 0
jbe 0x44d74b
push 0x100
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.0049662e
mov ecx, dword [ebp - 0x138]
add esp, 0xc
add ecx, edi
cmp edi, ecx
je 0x44d71e
nop dword [eax]
movzx eax, byte [edi]
inc edi
mov byte [ebp + eax - 0x128], 1
cmp edi, ecx
jne 0x44d70e
mov edx, dword [ebp - 0x130]
mov edi, edx
mov ecx, dword [ebp - 0x134]
add ecx, edx
cmp edx, ecx
jae 0x44d745
movzx eax, byte [edi]
mov al, byte [ebp + eax - 0x128]
test al, al
je 0x44d79f
inc edi
cmp edi, ecx
jb 0x44d732
mov eax, dword [ebp - 0x12c]
xorps xmm0, xmm0
mov ecx, eax
push 0
movups xmmword [eax], xmm0
push 0x491667
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
call fcn.00480fce
mov dword [ebp - 4], 0
mov dword [ebp - 0x140], 1
mov eax, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00494eaa
mov esp, ebp
pop ebp
ret
sub edi, edx
cmp edi, 0xffffffff
je 0x44d745
cmp dword [esi + 0x14], 0x10
jb 0x44d7ae
mov esi, dword [esi]
mov ecx, dword [ebp - 0x13c]
mov dword [ebp - 0x130], ecx
cmp dword [ecx + 0x14], 0x10
jb 0x44d7c8
mov eax, dword [ecx]
mov dword [ebp - 0x130], eax
push 0x100
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.0049662e
mov ecx, dword [ebp - 0x138]
add esp, 0xc
add ecx, esi
cmp esi, ecx
je 0x44d7fe
nop dword [eax]
movzx eax, byte [esi]
inc esi
mov byte [ebp + eax - 0x128], 1
cmp esi, ecx
jne 0x44d7ee
mov eax, dword [ebp - 0x134]
or ecx, 0xffffffff
mov edx, dword [ebp - 0x130]
dec eax
cmp eax, ecx
cmovb ecx, eax
movzx eax, byte [ecx + edx]
add ecx, edx
mov al, byte [ebp + eax - 0x128]
test al, al
je 0x44d83c
cmp ecx, edx
je 0x44d8b3
movzx eax, byte [ecx - 1]
dec ecx
mov al, byte [ebp + eax - 0x128]
test al, al
jne 0x44d824
sub ecx, edx
sub ecx, edi
lea eax, [ebp - 0x28]
inc ecx
push ecx
mov ecx, dword [ebp - 0x13c]
push edi
push eax
call fcn.0046c59e
mov dword [ebp - 4], 1
xorps xmm0, xmm0
mov esi, dword [ebp - 0x12c]
mov dword [ebp - 0x140], 1
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
movups xmm0, xmmword [ebp - 0x28]
mov dword [esi + 0x14], 0
mov byte [ebp - 0x28], 0
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x18]
movq qword [esi + 0x10], xmm0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.004810fe
mov eax, esi
jmp 0x44d784
or ecx, 0xffffffff
jmp 0x44d83e
Function at 0x44dade
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00480fce
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x44dc01
push ecx
lea ecx, [esi + 0x18]
call fcn.0046d2fe
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x44dc18
push ecx
lea ecx, [esi + 0x24]
call fcn.0046d20e
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret