joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a735c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x11c], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404b94
mov eax, dword [ebp - 8]
call fcn.00404b94
mov eax, dword [ebp + 8]
call fcn.00404b94
xor eax, eax
push ebp
push 0x4a7469
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x115]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea edx, [ebp - 0x10]
lea eax, [ebp - 0x115]
call fcn.004090a8
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00404ba4
push eax
mov ecx, dword [0x4c0714]
mov dl, 1
mov eax, dword [0x4186c4]
call fcn.0041ce90
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4a7421
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp - 0x10]
push 0x4a7484
push dword [ebp + 8]
lea eax, [ebp - 0x11c]
mov edx, 3
call fcn.00404a6c
mov edx, dword [ebp - 0x11c]
mov eax, dword [ebp - 0xc]
call fcn.0041cc8c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a742b
mov eax, dword [ebp - 0xc]
call fcn.00403904
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a7470
lea eax, [ebp - 0x11c]
call fcn.004046f4
lea eax, [ebp - 0x10]
call fcn.004046f4
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404718
lea eax, [ebp + 8]
call fcn.004046f4
ret

Function at 0x4d0878
Capabilities:
Parse pe header

Disassembly:
mov eax, dword [esp + 8]
dec eax
je 0x4d0895
sub eax, 2
jne 0x4d088d
push eax
call fcn.00524158
add esp, 4
mov eax, 1
ret 0xc
call fcn.004d0828
mov ecx, dword [esp + 4]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x4d088d
mov eax, dword [ecx + 0x3c]
cmp dword [eax + ecx], 0x4550
jne 0x4d088d
cmp ecx, dword [eax + ecx + 0x34]
mov eax, 1
je 0x4d0892
mov dword [0x1111cf9c], eax
ret 0xc
Function at 0x4d96df
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa0
call fcn.00580538
mov eax, dword [0x1111bac8]
xor eax, esp
mov dword [esp + 0x9c], eax
mov eax, dword [esp + 0xa8]
push ebp
mov ebp, dword [esp + 0xa8]
push esi
mov esi, ecx
test eax, eax
je 0x4d9842
push ebx
dec eax
push edi
lea edi, [ebp + 0xc]
shr eax, 3
add ebp, 0x14
inc eax
mov dword [esp + 0x18], eax
movzx eax, byte [esi + 1]
movzx ebx, byte [esi]
movzx ecx, byte [esi + 2]
movzx edx, byte [esi + 3]
shl eax, 8
or ebx, eax
movzx eax, byte [esi + 4]
shl ecx, 0x10
or ebx, ecx
movzx ecx, byte [esi + 5]
shl edx, 0x18
or ebx, edx
movzx edx, byte [esi + 6]
shl ecx, 8
or eax, ecx
movzx ecx, byte [esi + 7]
shl edx, 0x10
or eax, edx
mov dl, byte [edi]
shl ecx, 0x18
or eax, ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], eax
mov al, byte [ebp]
and dl, 0xdf
and al, 0xbf
or dl, 0x40
or al, 0x20
push edi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], ebx
add esi, 8
mov byte [edi], dl
mov byte [ebp], al
call fcn.004dbc38
lea ecx, [esp + 0x30]
push ecx
push edi
call fcn.004dbd38
push 1
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x38]
push eax
call fcn.004dfc38
push ebp
call fcn.004dbc38
lea ecx, [esp + 0x48]
push ecx
push ebp
call fcn.004dbd38
push 1
lea edx, [esp + 0x54]
push edx
lea eax, [esp + 0x48]
push eax
call fcn.004dfc38
mov ecx, dword [esp + 0x4c]
mov eax, dword [esp + 0x50]
xor eax, dword [esp + 0x40]
mov edx, dword [esp + 0x58]
xor dword [esp + 0x40], edx
xor ecx, ebx
xor ebx, dword [esp + 0x54]
mov dword [esp + 0x44], eax
mov eax, edi
mov byte [eax], bl
mov edx, ebx
shr edx, 8
mov byte [eax + 1], dl
mov edx, ebx
shr edx, 0x10
mov byte [eax + 2], dl
mov edx, dword [esp + 0x44]
shr ebx, 0x18
mov byte [eax + 3], bl
mov ebx, edx
add esp, 0x30
mov byte [eax + 4], dl
shr ebx, 8
mov byte [eax + 5], bl
mov ebx, edx
shr edx, 0x18
shr ebx, 0x10
mov byte [eax + 6], bl
mov byte [eax + 7], dl
mov eax, ebp
mov byte [eax], cl
mov edx, ecx
shr edx, 8
mov byte [eax + 1], dl
mov edx, ecx
shr edx, 0x10
mov byte [eax + 2], dl
shr ecx, 0x18
mov byte [eax + 3], cl
mov ecx, dword [esp + 0x10]
mov edx, ecx
shr edx, 8
mov byte [eax + 4], cl
mov byte [eax + 5], dl
mov edx, ecx
shr edx, 0x10
shr ecx, 0x18
dec dword [esp + 0x18]
mov byte [eax + 6], dl
mov byte [eax + 7], cl
jne 0x4d96fb
pop edi
pop ebx
mov ecx, dword [esp + 0xa4]
pop esi
pop ebp
xor ecx, esp
call fcn.00580a46
add esp, 0xa0
ret
Function at 0x4fd718
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
cmp ecx, dword [edi + 4]
jge 0x4fd731
mov esi, edi
mov edi, eax
jmp 0x4fd733
mov esi, eax
mov eax, dword [esi + 4]
mov ebx, dword [esp + 0x10]
cmp eax, dword [ebx + 8]
jg 0x4fd743
mov eax, ebx
jmp 0x4fd74d
push eax
push ebx
call fcn.004f4b28
add esp, 8
test eax, eax
jne 0x4fd755
pop edi
pop esi
pop ebx
ret
xor eax, eax
cmp dword [edi + 4], eax
jle 0x4fd771
mov edx, dword [esi]
mov ecx, dword [edi]
mov edx, dword [edx + eax*4]
xor edx, dword [ecx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [edi + 4]
jl 0x4fd75c
cmp eax, dword [esi + 4]
jge 0x4fd788
mov edi, edi
mov edx, dword [esi]
mov edx, dword [edx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [esi + 4]
jl 0x4fd778
mov eax, dword [esi + 4]
mov dword [ebx + 4], eax
test eax, eax
jle 0x4fd7a9
mov ecx, dword [ebx]
lea ecx, [ecx + eax*4 - 4]
mov edx, dword [ecx]
sub ecx, 4
test edx, edx
jne 0x4fd7a6
dec eax
test eax, eax
jg 0x4fd798
mov dword [ebx + 4], eax
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x5f8ab0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x587008], 0x8088405
inc edx
mov dword [ebx + 0x587008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x6245c4
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x6245ca
ret

Function at 0x6320f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x43cba9
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.005fa8b4
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x43cbc0
call fcn.005fa510
mov eax, ebx
call fcn.00622380
mov edi, eax
dec edi
test edi, edi
jl 0x6321a8
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.00622354
mov edx, dword [0x45845c]
call fcn.005f93f4
test al, al
je 0x6321a4
push dword [ebp - 0xc]
mov edx, esi
mov eax, ebx
call fcn.00622354
lea edx, [ebp - 0x14]
call fcn.00670f40
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.005fa8b4
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.005fa584
inc esi
dec edi
jne 0x632156
mov al, byte [0x43cbc4]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x43cbd0
mov eax, dword [ebp - 0xc]
call fcn.0060584c
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.005fa29c
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.00670f40
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x43cbc0
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x2f8]
call fcn.00670f40
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x43cbc0
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x43cbc0
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x43cbdc
call fcn.00600f88
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43cbb0
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.005fa228
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.005fa228
lea eax, [ebp - 0x14]
call fcn.005fa204
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.005fa228
ret
Function at 0x6ba8ec
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4c531c
push dword fs:[eax]
mov dword fs:[eax], esp
mov ax, word [ebp + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.006ba7d8
mov eax, dword [esi]
call fcn.005fb770
add eax, 0x28
push eax
lea eax, [ebp - 8]
mov ecx, 1
mov edx, dword [0x4bb9a4]
call fcn.005fb92c
add esp, 4
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x1c]
mov ecx, 0x1c
call fcn.005f8328
mov ebx, 0x1c
mov eax, dword [ebp - 8]
lea edx, [eax + ebx]
lea eax, [ebp - 0x2c]
mov ecx, 0x1c
call fcn.005f8328
add ebx, 0x1c
mov eax, dword [esi]
call fcn.005fb770
mov dword [ebp - 0xc], eax
mov eax, dword [0x5927a8]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x30]
lea edx, [ebp - 8]
mov ecx, ebx
call fcn.006b2c5c
add ebx, 4
mov eax, dword [ebp - 8]
add eax, ebx
xor ecx, ecx
mov edx, 3
call fcn.005f8a90
add ebx, 3
mov eax, dword [ebp - 8]
mov byte [eax + ebx], 0x3a
inc ebx
mov eax, dword [esi]
mov byte [eax + 2], 0
mov eax, dword [esi]
mov byte [eax + 3], 0
push ebx
mov eax, dword [esi]
call fcn.005fb770
push eax
lea ecx, [ebp - 8]
mov eax, dword [esi]
xor edx, edx
call fcn.006b2b88
mov edx, dword [ebp - 8]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x98]
mov ebx, eax
mov eax, ebx
call fcn.006b2988
mov edx, esi
mov ecx, dword [ebp + 0x10]
call fcn.006b2c54
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c5323
lea eax, [ebp - 8]
mov edx, dword [0x4bb9a4]
call fcn.005fba4c
ret

Function at 0x6cf384
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4d9d56
push dword fs:[eax]
mov dword fs:[eax], esp
push 4
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x4bb9a4]
call fcn.005fb92c
add esp, 4
mov eax, edi
and al, 0xff
mov edx, dword [ebp - 4]
mov byte [edx], al
mov eax, edi
shr eax, 8
and al, 0xff
mov edx, dword [ebp - 4]
mov byte [edx + 1], al
mov eax, edi
shr eax, 0x10
and al, 0xff
mov edx, dword [ebp - 4]
mov byte [edx + 2], al
mov eax, edi
shr eax, 0x18
and al, 0xff
mov edx, dword [ebp - 4]
mov byte [edx + 3], al
mov eax, esi
call fcn.005fb770
mov edi, eax
push edi
mov eax, ebx
mov ecx, 1
mov edx, dword [0x4bb9a4]
call fcn.005fb92c
add esp, 4
mov edx, edi
dec edx
test edx, edx
jl 0x6cf432
inc edx
xor eax, eax
mov ecx, eax
and ecx, 0x80000003
jns 0x6cf420
dec ecx
or ecx, 0xfffffffc
inc ecx
mov edi, dword [ebp - 4]
mov cl, byte [edi + ecx]
xor cl, byte [esi + eax]
mov edi, dword [ebx]
mov byte [edi + eax], cl
inc eax
dec edx
jne 0x6cf411
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d9d5d
lea eax, [ebp - 4]
mov edx, dword [0x4bb9a4]
call fcn.005fba4c
ret
Function at 0x6e43a4
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
mov edx, 0x40
call fcn.005fd80c
ret
Function at 0x715858
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, edx
mov esi, eax
mov eax, dword [esi + 0x45]
test eax, eax
je 0x71586c
cmp byte [eax], 0
jne 0x71587b
cmp dword [esi + 0x20], 0
je 0x71587b
cmp edi, 4
jg 0x71587b
test edi, edi
jge 0x715885
mov eax, 0xfffffffe
jmp 0x715ab4
mov ebx, dword [esi + 0x20]
cmp dword [esi + 0x10], 0
je 0x7158a7
cmp dword [esi], 0
jne 0x715899
cmp dword [esi + 4], 0
jne 0x7158a7
cmp dword [ebx + 4], 0x29a
jne 0x7158b1
cmp edi, 4
je 0x7158b1
mov eax, 0xfffffffe
jmp 0x715ab4
cmp dword [esi + 0x14], 0
jne 0x7158c1
mov eax, 0xfffffffb
jmp 0x715ab4
mov dword [ebx], esi
mov ebp, dword [ebx + 0x20]
mov dword [ebx + 0x20], edi
cmp dword [ebx + 4], 0x2a
jne 0x715957
mov cx, word [ebx + 0x28]
sub cx, 8
shl ecx, 4
add cx, 8
shl ecx, 8
mov eax, dword [ebx + 0x78]
dec eax
shr eax, 1
cmp ax, 3
jbe 0x7158f5
mov ax, 3
shl eax, 6
or cx, ax
cmp dword [ebx + 0x64], 0
je 0x715905
or cx, 0x20
movzx eax, cx
push ecx
mov ecx, 0x1f
xor edx, edx
div ecx
pop ecx
mov ax, 0x1f
sub ax, dx
add cx, ax
mov dword [ebx + 4], 0x71
mov eax, ebx
mov edx, ecx
call fcn.007154e8
cmp dword [ebx + 0x64], 0
je 0x715950
mov edx, dword [esi + 0x34]
shr edx, 0x10
mov eax, ebx
call fcn.007154e8
mov dx, word [esi + 0x34]
and dx, 0xffff
mov eax, ebx
call fcn.007154e8
mov dword [esi + 0x34], 1
cmp dword [ebx + 0x14], 0
je 0x715978
mov eax, esi
call fcn.00715514
cmp dword [esi + 0x14], 0
jne 0x715991
mov dword [ebx + 0x20], 0xffffffff
xor eax, eax
jmp 0x715ab4
cmp dword [esi + 4], 0
jne 0x715991
cmp ebp, edi
jl 0x715991
cmp edi, 4
je 0x715991
mov eax, 0xfffffffb
jmp 0x715ab4
cmp dword [ebx + 4], 0x29a
jne 0x7159aa
cmp dword [esi + 4], 0
je 0x7159aa
mov eax, 0xfffffffb
jmp 0x715ab4
cmp dword [esi + 4], 0
jne 0x7159cb
cmp dword [ebx + 0x6c], 0
jne 0x7159cb
test edi, edi
je 0x715a62
cmp dword [ebx + 4], 0x29a
je 0x715a62
mov eax, dword [ebx + 0x78]
lea eax, [eax + eax*2]
mov ebp, dword [eax*4 + 0x58d564]
mov eax, ebx
mov edx, edi
call ebp
cmp al, 2
je 0x7159e6
cmp al, 3
jne 0x7159ed
mov dword [ebx + 4], 0x29a
test al, al
je 0x7159f5
cmp al, 2
jne 0x715a09
cmp dword [esi + 0x14], 0
jne 0x715a02
mov dword [ebx + 0x20], 0xffffffff
xor eax, eax
jmp 0x715ab4
cmp al, 1
jne 0x715a62
cmp edi, 1
jne 0x715a1b
mov eax, ebx
call fcn.00715670
jmp 0x715a4a
push 0
mov eax, ebx
xor ecx, ecx
xor edx, edx
call fcn.007157fc
cmp edi, 3
jne 0x715a4a
mov eax, dword [ebx + 0x3c]
mov edx, dword [ebx + 0x44]
mov word [eax + edx*2 - 2], 0
mov eax, dword [ebx + 0x44]
dec eax
mov edx, eax
add edx, edx
mov eax, dword [ebx + 0x3c]
call fcn.00715850
mov eax, esi
call fcn.00715514
cmp dword [esi + 0x14], 0
jne 0x715a62
mov dword [ebx + 0x20], 0xffffffff
xor eax, eax
jmp 0x715ab4
cmp edi, 4
je 0x715a6b
xor eax, eax
jmp 0x715ab4
cmp dword [ebx + 0x18], 0
je 0x715a78
mov eax, 1
jmp 0x715ab4
mov edx, dword [esi + 0x34]
shr edx, 0x10
mov edi, ebx
mov eax, edi
call fcn.007154e8
mov dx, word [esi + 0x34]
and dx, 0xffff
mov eax, edi
call fcn.007154e8
mov eax, esi
call fcn.00715514
mov dword [ebx + 0x18], 0xffffffff
cmp dword [ebx + 0x14], 0
je 0x715aaf
xor eax, eax
jmp 0x715ab4
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x721f94
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
test edx, edx
jle 0x721fc0
mov ebx, dword [ecx]
movzx esi, byte [eax]
xor ebx, esi
and ebx, 0xff
mov esi, dword [0x592484]
movzx ebx, word [esi + ebx*2]
mov esi, dword [ecx]
shr esi, 8
xor ebx, esi
mov dword [ecx], ebx
inc eax
dec edx
test edx, edx
jg 0x721f9a
pop esi
pop ebx
ret

Function at 0x722188
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
mov edx, 0x594068
and eax, 0xff
mov ecx, dword [edx]
xor eax, ecx
and eax, 0xff
mov ebx, dword [0x5923fc]
mov ebx, dword [ebx + eax*4]
shr ecx, 8
and ecx, 0xffffff
xor ebx, ecx
mov dword [edx], ebx
and ebx, 0xff
add dword [edx + 4], ebx
imul eax, dword [edx + 4], 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
mov ecx, dword [edx + 8]
xor eax, ecx
and eax, 0xff
mov ebx, dword [0x5923fc]
mov eax, dword [ebx + eax*4]
shr ecx, 8
and ecx, 0xffffff
xor eax, ecx
mov dword [edx + 8], eax
pop ebx
ret

Function at 0x7222a8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
lea esi, [ebp - 4]
mov ebx, edx
test ebx, ebx
jle 0x7222d1
call fcn.00722288
mov edx, dword [esi]
xor byte [edx], al
mov eax, dword [esi]
mov al, byte [eax]
call fcn.00722188
inc dword [esi]
dec ebx
jne 0x7222ba
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x7222d8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
lea edi, [ebp - 4]
mov ebx, edx
test ebx, ebx
jle 0x72230c
call fcn.00722288
mov esi, eax
and esi, 0xff
mov eax, dword [edi]
mov al, byte [eax]
call fcn.00722188
mov eax, esi
mov edx, dword [edi]
xor byte [edx], al
inc dword [edi]
dec ebx
jne 0x7222eb
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x724ed4
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x724ee6
add esp, 0xfffffff0
call fcn.005f95cc
mov esi, ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov eax, dword [ebp + 0xc]
call fcn.005fa6b4
xor eax, eax
push ebp
push 0x52f8bb
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebx + 0x68], esi
mov eax, esi
mov dword [ebx + 0x34], eax
mov edx, dword [eax]
mov edx, dword [edx + 0xa0]
mov dword [ebx + 0x30], edx
mov dword [ebx + 0x3c], eax
mov edx, dword [eax]
mov edx, dword [edx + 0xa4]
mov dword [ebx + 0x38], edx
mov dword [ebx + 0x44], eax
mov edx, dword [eax]
mov edx, dword [edx + 0xa8]
mov dword [ebx + 0x40], edx
mov dword [ebx + 0x2c], eax
mov edx, dword [eax]
mov edx, dword [edx + 0xac]
mov dword [ebx + 0x28], edx
mov eax, dword [eax + 0x558]
mov dword [ebx + 0x6c], eax
mov ax, word [ebp + 8]
and ax, 0xffff
cmp ax, 0xffff
jne 0x724f75
lea eax, [ebx + 0x74]
mov edx, 0x52f8ec
call fcn.005fa258
lea eax, [ebx + 0x64]
mov edx, dword [ebp + 0xc]
call fcn.005fa258
mov byte [ebx + 0x60], 1
jmp 0x724f8c
lea eax, [ebx + 0x74]
mov edx, dword [ebp + 0xc]
call fcn.005fa258
lea eax, [ebx + 0x64]
call fcn.005fa204
mov byte [ebx + 0x60], 0
xor edx, edx
mov eax, ebx
call fcn.005f9238
mov ax, word [ebp + 8]
mov word [ebx + 0x70], ax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52f8c2
lea eax, [ebp + 0xc]
call fcn.005fa204
ret

Function at 0x725364
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 8], ebx
test dl, dl
je 0x72537d
add esp, 0xfffffff0
call fcn.005f95cc
mov esi, ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov eax, dword [ebp + 0x10]
call fcn.005fa6b4
mov eax, dword [ebp + 0xc]
call fcn.005fa6b4
xor eax, eax
push ebp
push 0x52fd7c
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebx + 0x58], esi
mov eax, esi
mov dword [ebx + 0x34], eax
mov edx, dword [eax]
mov edx, dword [edx + 0xa0]
mov dword [ebx + 0x30], edx
mov dword [ebx + 0x3c], eax
mov edx, dword [eax]
mov edx, dword [edx + 0xa4]
mov dword [ebx + 0x38], edx
mov dword [ebx + 0x44], eax
mov edx, dword [eax]
mov edx, dword [edx + 0xa8]
mov dword [ebx + 0x40], edx
mov dword [ebx + 0x2c], eax
mov edx, dword [eax]
mov edx, dword [edx + 0xac]
mov dword [ebx + 0x28], edx
mov eax, dword [eax + 0x558]
mov dword [ebx + 0x5c], eax
mov ax, word [ebp + 8]
and ax, 0xffff
cmp ax, 0xffff
jne 0x72541d
lea edx, [ebp - 8]
mov eax, dword [ebp + 0x10]
call fcn.0071c14c
mov edx, dword [ebp - 8]
lea eax, [ebx + 0x64]
call fcn.005fa258
lea eax, [ebx + 0x54]
mov edx, dword [ebp + 0xc]
call fcn.005fa258
mov byte [ebx + 0x50], 1
jmp 0x725434
lea eax, [ebx + 0x64]
mov edx, dword [ebp + 0xc]
call fcn.005fa258
lea eax, [ebx + 0x54]
call fcn.005fa204
mov byte [ebx + 0x50], 0
mov ax, word [ebp + 8]
push eax
mov ecx, dword [ebx + 0x64]
xor edx, edx
mov eax, ebx
call fcn.00722a70
mov ax, word [ebp + 8]
mov word [ebx + 0x62], ax
mov byte [ebx + 0x60], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52fd83
lea eax, [ebp - 8]
call fcn.005fa204
lea eax, [ebp + 0xc]
mov edx, 2
call fcn.005fa228
ret
Function at 0x73e03c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.005fa6b4
xor eax, eax
push ebp
push 0x548b50
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x548b13
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.005fa4c4
cmp eax, 0xa
jge 0x73e09c
mov eax, dword [ebp - 8]
call fcn.005fa204
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x73e21d
mov eax, dword [ebp - 4]
call fcn.005fa4c4
mov ebx, eax
lea eax, [ebp - 0xc]
push eax
mov esi, ebx
dec esi
mov edx, esi
mov ecx, 2
mov eax, dword [ebp - 4]
call fcn.005fa724
mov edx, esi
lea eax, [ebp - 4]
mov ecx, 2
call fcn.005fa764
xor esi, esi
mov eax, dword [ebp - 4]
call fcn.005fa4c4
test eax, eax
jle 0x73e0ec
mov ebx, 1
mov edx, dword [ebp - 4]
movzx edx, byte [edx + ebx - 1]
xor esi, edx
inc ebx
dec eax
jne 0x73e0de
lea eax, [ebp - 0x10]
push eax
and esi, 0x800000ff
jns 0x73e100
dec esi
or esi, 0xffffff00
inc esi
mov dword [ebp - 0x18], esi
mov byte [ebp - 0x14], 0
lea edx, [ebp - 0x18]
xor ecx, ecx
mov eax, 0x548b68
call fcn.00600f88
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.005fa610
je 0x73e138
mov eax, dword [ebp - 8]
call fcn.005fa204
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x73e21d
mov eax, dword [ebp - 4]
call fcn.005fa4c4
mov ebx, eax
lea eax, [ebp - 0xc]
push eax
mov ecx, 1
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.005fa724
lea eax, [ebp - 4]
mov ecx, 1
mov edx, ebx
call fcn.005fa764
mov eax, dword [ebp - 0xc]
call fcn.005ff93c
mov ebx, eax
test ebx, ebx
jle 0x73e181
lea eax, [ebp - 4]
mov ecx, ebx
mov edx, 1
call fcn.005fa764
lea eax, [ebp - 0xc]
call fcn.005fa204
mov eax, dword [ebp - 4]
movzx esi, byte [eax]
sub esi, 0x30
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.005fa764
jmp 0x73e1eb
mov eax, dword [ebp - 4]
mov al, byte [eax]
call fcn.0073e00c
mov ebx, eax
shl ebx, 4
mov eax, dword [ebp - 4]
mov al, byte [eax + 1]
call fcn.0073e00c
add ebx, eax
add ebx, esi
lea eax, [ebp - 4]
mov ecx, 2
mov edx, 1
call fcn.005fa764
lea eax, [ebp - 0x1c]
mov edx, ebx
call fcn.005fa3ec
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.005fa4cc
mov eax, dword [ebp - 4]
call fcn.005fa4c4
dec eax
jg 0x73e1a6
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
call fcn.005fa258
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x73e21d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x548b57
lea eax, [ebp - 0x1c]
call fcn.005fa204
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.005fa228
lea eax, [ebp - 4]
call fcn.005fa204
ret