joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40484f
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00437d3f
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x404972
push ecx
lea ecx, [esi + 0x18]
call fcn.0042406f
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x404989
push ecx
lea ecx, [esi + 0x24]
call fcn.00423f7f
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x42317f
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x6ac4272f
xor cl, byte [edx + 0x33]
mov ch, 0x8d
div byte [edi]
xchg ecx, eax
pop ebx
xchg edi, eax
xchg ebx, eax
and bl, ah
xor ecx, edx
call 0x15961809
xchg byte [edx + 0x4ab20f45], al
in al, dx
and ebx, dword [eax - 0x67365c9]
or edi, dword [edx]
scasd eax, dword es:[edi]
xor ch, cl
mov dword ss:[0xe81ad394], eax
mov dword [0xe81ad394], eax
cmp byte [esi - 0x4b], 0x9f
inc esi
sahf
inc ebx
fld qword [edx + 0xa44e69]
cli
mov dl, 0xc7
salc
cli
jecxz 0x423127
adc ah, byte [eax + edx*8]
rcr byte [edi], cl
scasb al, byte es:[edi]
test dword [esi - 0x5a], ecx
das
cli
fldenv [edi]
invalid
je 0x423154
xor ch, byte [eax + esi + 0x43]
mov cs, word [edx]
mov dl, 0x3b
mov dl, 0x4e
push esp
mov dl, 0x82
mov bh, 0x9d
xlatb
xor al, 0x93
cmp ch, byte [ecx + eax*8 - 0x452c010b]
int3
Function at 0x44a210
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0xc]
push edi
xor ebp, ebp
push str.Kernel32
mov dword [esi], ebp
mov dword [esi + 4], ebp
mov dword [esi + 8], ebp
mov dword [esi + 0xc], ebp
mov dword [esi + 0x10], ebp
mov dword [esi + 0x14], ebp
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
cmp edi, ebp
je 0x44a2b0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CreateToolhelp32Snapshot
push edi
call ebx
push str.Thread32First
push edi
mov dword [esi + 4], eax
call ebx
push str.Thread32Next
push edi
mov dword [esi + 8], eax
call ebx
push str.Module32FirstW
push edi
mov dword [esi + 0xc], eax
call ebx
push str.Module32NextW
push edi
mov dword [esi + 0x10], eax
call ebx
mov ecx, dword [esi + 4]
mov dword [esi + 0x14], eax
cmp ecx, ebp
pop ebx
je 0x44a2a7
cmp dword [esi + 8], ebp
je 0x44a2a7
cmp dword [esi + 0xc], ebp
je 0x44a2a7
cmp dword [esi + 0x10], ebp
je 0x44a2a7
cmp eax, ebp
je 0x44a2a7
push edi
mov dword [esi], 1
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
pop edi
pop esi
pop ebp
ret
push edi
mov dword [esi], ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
pop edi
pop esi
pop ebp
ret

Function at 0x46d30f
Capabilities:
Encode data using xor

Disassembly:
push ss
aas
mov dl, 0xcb
in al, dx
pop ebp
cmp dword [ecx - 0x63], 0xe64d7502
push eax
inc edi
and byte [ecx + 0x64d575e2], dl
xchg ecx, eax
loop 0x46d397
aad 0x64
and eax, 0x13648303
inc esp
xor dword [eax + 0x28], 0xffffffb4
mov byte [0x52184129], al
add eax, dword [ebx - 0x7cbbec9c]
jo 0x46d355
mov ah, 0xa2
sub dword [ecx + 0x18], eax
push edx
jge 0x46d315
rcr dword [ecx], cl
mov es, word gs:[ebx - 0x1590b068]
jge 0x46d325
std
cmp byte [ebx + 7], bh
test dword [bx + di - 0x70], 0x92d9938d
lds eax, [esi]
add byte [ecx + 0x46], ch
or eax, 0xa7f1f39
pop ds
jg 0x46d362
or edx, dword [eax]
bound eax, qword [eax - 0x6124e050]
cmpsd dword ss:[esi], dword es:[edi]
mov ah, 6
lodsb al, byte [esi]
invalid

Function at 0x49cd15
Capabilities:
Encode data using xor

Disassembly:
popfd
loop 0x49cd0c
invalid
out 0x31, eax
cmp ebx, edi
sti
jns 0x49cd8f
adc ecx, dword [edi + ebp - 0x389ddf56]
xor dword [ebx - 0x64], ebx
invalid
dec esp
jae 0x49cd7b
jbe 0x49cd0f
imul esp, dword [ebp + 0x52], 0x76
jmp 0x49ccb9
mov al, 0x3f
in eax, 0xec
or al, 0x4f
mov eax, edx
adc dl, bh
sahf
or edx, dword [ecx + 0x17]
mov edi, 0x7a7e6610
cli
scasd eax, dword es:[edi]
or byte [ecx - 0x67], ch
inc ebp
pushfd
xor bh, byte [ecx]
ror byte [ecx - 0x6e], cl
inc edx
push ebp
push esp
dec eax
insd dword es:[edi], dx
adc ebp, dword [ebx]
jecxz 0x49cd26
invalid
in al, 0x37
adc ah, byte [ebp - 0x5c46a2be]
popal
jae 0x49cd7d
aaa
test edx, edx
mov al, 0x27
hlt
jecxz 0x49cdc5
pop ds
pop ds
inc edi
punpcklwd mm3, dword [0x80b2834b]
aad 0xdb
xor edx, dword [edi - 0x1d]
pop edi
and dh, byte [esi]
movlps xmm2, qword [edi + edx*4 - 0x7374049f]
rol dl, 1
insb byte es:[edi], dx
dec edi
or eax, 0x6281b277
xchg edx, edx
mov dh, 0x5a
in al, 0x2a
rcr dword [ebx - 0xa], cl
mov dword [0x20de370c], eax
lea edx, [eax]
ret 0x2306
Function at 0x4e036f
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.0051385f
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x4e0492
push ecx
lea ecx, [esi + 0x18]
call fcn.004ffb8f
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x4e04a9
push ecx
lea ecx, [esi + 0x24]
call fcn.004ffa9f
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4feb4f
Capabilities:
Encode data using xor

Disassembly:
adc byte [ebx + 8], al
push eax
retf 0x85ba
push cs
neg byte [ecx + 0xa]
dec ecx
sub byte [ecx + 0x13794921], dh
cmp byte [eax + 0x5a1dd91e], bl
sbb bl, al
mov ecx, 0xa8ebf9d9
dec eax
fimul dword [edx]
sbb ch, ch
push esi
sub bh, byte [ebp + esi*4 - 0x68]
outsd dx, dword [esi]
or cl, bh
pop es
add eax, 0x729fdc6b
mov esp, edi
scasd eax, dword es:[edi]
imul eax, edi, 0xea96d19f
add al, 0xb4
push 0xf925ba10
jp 0x4febc2
bound ebx, qword [edi]
xchg esi, eax
and dword [eax], edx
jno 0x4feb17
lds edi, [ecx]
sub ecx, ebx
mov bl, 0xda
xor byte [edx - 0x61f94f6c], cl
jae 0x4feaf6
xchg edx, eax
or dword [ebx - 0xbfcfb9e], edi
loopne 0x4feb7b
jne 0x4feb9f
and al, 0x4f
imul ecx, ebx, 0x19
cmp ecx, dword [eax - 0x7cf5b96]
or bl, bl
wait
sbb eax, 0x674fdb2e
push cs
add al, 0xc4
in eax, dx
mov ebx, edi
cmp al, 0x96
nop
inc ebx
cmp byte [ecx], ch
call 0x49b8409
push cs
js 0x4fec09
and al, 0x2e
invalid
invalid
cmp byte [ecx + 0x6bcb31f8], dh
mov dl, 0xc7
sbb bl, 0xfd
loop 0x4fec35
adc eax, dword [edi]
cli
mov dl, 0xfb
xor dword [ebx + edx*8], edi
pop esp
salc
imul edi, eax, 0x73
cmp dword [esi], esp
sub al, 0xa3
mov al, byte [0x1dfdfb01]
test eax, 0xcf6cfc08
push ss
mov ebx, 0xafdb1db0
outsd dx, dword [esi]
adc byte [eax + 0x39], 0x8e
imul ebx, dword [ebx + 0xa], 0x9d9b7e48
adc ch, byte [eax]
push ds
xchg esi, eax
jnp 0x4febcd
invalid
push ds
or bl, bl
wait
test byte [edx + 0x45dc40bf], ch
jno 0x4fec7a
xor byte [ecx + 0x45], ah
cmp al, 8
xor byte [edi], bh
jae 0x4fec85
lcall 0xb88f, 0x61e81cbb
sub al, 0x61
lds ecx, ds:[eax - 0x3b]
fimul word [edx + 0x41]
mov bl, bl
mov dword [0x32945caa], eax
aas
hlt
popal
pop eax
add eax, dword [ebx + 0x43dc0041]
lds ebx, [edx - 0xc]
rol dword [esi], cl
dec ecx
invalid
Function at 0x4ff53f
Capabilities:
Encode data using xor

Disassembly:
inc esi
cwde
retf
fisttp qword [eax + 0x7a]
outsb dx, byte [esi]
scasb al, byte es:[edi]
sbb dword [edx + 0x53], ebp
sti
out dx, al
sub dword [edx + 0x85a1bbb], esi
xor al, 0xae
cmp dl, byte [esi - 0x7c3c79d8]
xchg esi, eax
sub byte [esi + 0x2dca83c3], al
dec edx
xchg esi, eax
sub byte [esi + 0x2dca83c3], al
dec edx
push ebx
push ebp
sub cl, dl
xchg edi, eax
inc eax
sti
stosb byte es:[edi], al
pop ebx
dec esi
fsubr qword [eax + ebx*4]
add eax, 0xce571b79
in eax, 0x3b
imul edi, dword [ecx], 0xffffffb4
enter 0x6bea, 0xffffffffffffff94
fidivr word [ebp - 0x47b7db18]
sbb byte [ebx], bl
xlatb
sti
js 0x4ff52b
ficomp dword [edi - 0x1918e808]
sub bh, byte [ecx]
push 0x38c698ca
dec ebp
mov cl, 0x99
add edi, dword gs:[ecx + 0x33]
stosd dword es:[edi], eax
wait
loopne 0x4ff527
sbb ebp, dword [ebp - 0x23]
or edi, dword [eax - 0x3adf5719]
pop es
xchg byte [eax + ebp*8 - 0x2f6c97b3], dl
sub eax, 0x2b3e1b0b
sub bl, byte [ebx]
dec esi
lodsb al, byte [esi]
lodsd eax, dword [esi]
sub ecx, dword [edx]
lodsd eax, dword [esi]
jae 0x4ff604
xchg esi, eax
mov edx, esi
movsb byte es:[edi], byte [esi]
scasb al, byte es:[edi]
sub ebp, dword [ebx - 0x3ad06737]
dec edi
aam 0x7c
fnstenv [edx + 0x5b288e10]
cmp ebp, esp
jns 0x4ff5d9
inc esi
invalid
inc ebp
ret 0xe519
loopne 0x4ff681
cld
or esi, dword [ebx]
jae 0x4ff61c
out 0x31, al
fist word [ecx + 0xf]
ret 0xb8da
cmp eax, 0x92e6c65
xchg edi, eax
int 0xc1
mov ebp, 0x40fdf9a5
into
pop ds
invalid
xchg ebx, eax
xchg esp, eax
mov bh, 0xfe
int 0xb9
invalid
Function at 0x529a9f
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.0055cf8f
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x529bc2
push ecx
lea ecx, [esi + 0x18]
call fcn.005492bf
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x529bd9
push ecx
lea ecx, [esi + 0x24]
call fcn.005491cf
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5730af
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call int.005a659f
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x5731d2
push ecx
lea ecx, [esi + 0x18]
call fcn.005928cf
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x5731e9
push ecx
lea ecx, [esi + 0x24]
call fcn.005927df
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x59496f
Capabilities:
Encode data using xor

Disassembly:
aad 0x72
inc eax
add eax, 0x11405368
mov bh, 0x48
sal esp, 0xe3
outsb dx, byte [esi]
jmp 0x59497c
add byte [ebx + 0x55e9d279], 0xa3
test dword [edx - 0x1e], 0x641c49ac
xor ah, byte [ecx - 0x48fd674c]
xor ah, byte fs:[ecx - 0x48fd674c]
sbb byte [ebx + 0x65c3cc18], bh
jne 0x594916
and ebp, dword [ecx]
lodsd eax, dword [esi]
fidiv word [ebx]
xor edx, dword [edi + ebp + 0x6f]
popal
inc ecx
sti
inc ecx
push edi
mov al, byte [0x57551d9a]
push ebp
push edi
test byte [edx - 0x168a7e26], dl
adc eax, 0x694067dd
and byte [eax - 0x3f0632cf], bl
rol byte [edx], 1
add byte [edx + 0x15cb0952], ch
imul esi, esi, 0x343375f9
adc al, 4
xor byte [edx + 0x13], cl
mov dh, 0x1c
movsb byte es:[edi], byte [esi]
xor ah, byte [edi - 0x1a]
cmp dword [0xa6d5b2e5], edx
jnp 0x59499c
retf
Function at 0x5a60ef
Capabilities:
Encode data using xor

Disassembly:
xchg ebx, eax
lock xchg dword [edi], ecx
jg 0x5a60da
add byte [ebp - 0x5f096e7e], bh
push ebx
insd dword es:[edi], dx
mov ch, 0xa2
mov al, byte [0xa2b56d53]
mov edx, 0xabecfbd1
invalid
sbb byte gs:[ecx + 0x36], al
leave
inc ecx
leave
or al, 0x7b
nop
wait
jo 0x5a60a8
jp 0x5a608e
call 0x330f7411
inc byte [ebp + 0x60ca1512]
sbb eax, 0x93143418
push edi
adc esi, dword [ebp + 0x1285fe32]
adc eax, 0x181d60ca
xor al, 0x14
xchg ebx, eax
ljmp 0x6320:0xfc2cfcd0
jge 0x5a610e
test byte [ebp - 0x79069dc6], 0xd0
inc esp
push esp
adc al, 0x86
xchg ebp, eax
sar dword [ecx], cl
jno 0x5a6099
daa
cmc
fldcw word fs:[ebp - 0x1d]
nop
pushal
inc ebp
imul ebx, dword [edx], 0x27bfb772
jno 0x5a60aa
sal ah, 1
mov word [esi - 0x5e], ds
movsd dword es:[edi], dword [esi]
mov dl, 0xe2
scasb al, byte es:[edi]
cmpsb byte [esi], byte es:[edi]
aam 0xe3
push ebx
pop edi
dec ecx
jb 0x5a6118
dec esi
and eax, 0x7bb06a2f
dec ebp
xchg esp, eax
xor edi, dword [edi - 0x69af1a5f]
wait
arpl bp, dx
aaa
xchg ebp, eax
clc
loopne 0x5a60e3
loope 0x5a60b6
pop ecx
pop ebp
jne 0x5a6188
in eax, dx
dec esi
test byte [edx], ch
inc ecx
sub dword [ecx], eax
mov cl, 0x2a
pop ss
push 0x54
xor dh, dl
bound ecx, qword [edx - 0x561d962b]
and bh, byte [eax - 0x62]
scasb al, byte es:[edi]
and byte [edx + 0x6d53b479], ah
rcr byte [0xb2bd0516], 1
inc edi
mov byte ss:[0x690d7217], al
jg 0x5a6137
xchg al, bh
invalid
or eax, 0xa56e0222
ljmp 0x463
arpl cx, si
out 0x43, eax
mov al, byte [0xe0376078]
les esi, [edx - 0x1c25cc7d]
xor byte [edi], dl
jb 0x5a6172
scasd eax, dword es:[edi]
insd dword es:[edi], dx
mov dh, 0x27
cmp edi, ebx
mov ebx, 0x82c782e1
les edx, [esi + eax*8 - 0x3c957cc]
lds edx, [edi + 0x6aca52d5]
push eax
inc esi
in al, 0x34
or dword [ebx + 0x20], eax
aas
push 0xffffffffffffffc5
xchg dword [ebx], esi
salc
and ch, 0xf6
or byte [ecx + 0x5b415467], dh
pushfd
push 0x46
xor ebx, ebx
add dword [ecx], 0x42
xor eax, 0x9a246b1f
xlatb
invalid
Function at 0x5bd29f
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.005f078f
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x5bd3c2
push ecx
lea ecx, [esi + 0x18]
call fcn.005dcabf
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x5bd3d9
push ecx
lea ecx, [esi + 0x24]
call fcn.005dc9cf
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x5c4c7f
Capabilities:
Encode data using xor

Disassembly:
aam 0x80
rol dword [ebp - 0x17], cl
xor bh, byte [ecx - 0x55]
test byte [ebx + 0x527ed520], dh
aad 0xb4
imul ebp, dword [ebx], 0xae110b00
pop ds
sbb dword [esi], esp
pop ss
mov ecx, ebp
mov esp, 0x3054868a
adc ah, bl
dec ecx
rcl bl, 1
cmpsd dword [esi], dword es:[edi]
mov cl, 0xd3
shr dword [edx - 0x4f], cl
shr dword [edx - 0x4f], cl
push edx
pop ds
aam 0x87
ror bl, 1
cmp al, 0x31
imul esp, edx, 0xffffffc5
and eax, 0xe0043f10
lds esp, [0xe0043f10]
cmp eax, 0xe01b3def
xchg ebx, esp
cmpsd dword [esi], dword es:[edi]
mov dword [0xf244da02], eax
push ebx
movsb byte es:[edi], byte [esi]
sbb ah, byte [esi - 0x107f1964]
imul ecx, dword [edx + 0x6787406d], 0xffffffee
or eax, 0x69af2618
inc eax
jbe 0x5c4cb3
imul eax, dword [eax + 0x76], 0x6d3ba6fc
inc ebp
cmpsb byte [esi], byte es:[edi]
cmp ebp, dword [ebp + 0x26]
inc ebp
jl 0x5c4c8d
shl cl, 0xf5
jbe 0x5c4c54
and ah, 0xf
inc esp
cmp dword [esi + 0x4166a75], esp
dec esi
imul dword ds:[eax]
xchg byte [ecx - 0x73], bl
salc
dec esp
cli
xchg esi, eax
jg 0x5c4ce5
xchg edx, eax
retf 0x848e
mov dword [esi + eax + 0x11], esi
invalid
Function at 0x5db6df
Capabilities:
Encode data using xor

Disassembly:
into
mov eax, dword [0x9392a6a8]
mov dl, 0x1d
add byte [ebp + 0x5d], 0x8e
stosb byte es:[edi], al
mov esi, 0x30f706c8
dec ebx
push es
mov ah, 0x56
mov al, 0xeb
fidiv dword [esi + 0x5192326d]
sbb byte [edi + 0x7ad5387e], ch
lds ebx, [ebx + 0x5220dbde]
and eax, eax
daa
inc edx
and byte [edx + 0x21], dl
shl byte [edi], 0x42
inc eax
scasb al, byte es:[edi]
pop eax
mov ebp, 0x1ae65412
adc dword [edx], ecx
inc ebp
cli
div byte [0x86c875b8]
xchg esp, eax
xchg ebx, eax
pop ecx
cld
xchg ebx, eax
inc esp
into
push ss
and eax, 0xd0cc9cce
sbb al, 0x1c
retf
mov di, 0xc6bd
mov ebx, 0xc496b6d7
xlatb
mov dh, 0x96
les eax, [esi - 0x3bbcff9d]
xlatb
mov dh, 0x96
les eax, [esi - 0x3bbcff9d]
cld
pop esi
xor dword [ebp + esi - 0x2baea1f7], 0xffffffa6
jne 0x5db6da
cmp dword [ecx], edi
loopne 0x5db678
mov edx, fs
add eax, 0xf658f7
push eax
test byte [eax], 0x50
xlatb
push ss
xor edx, esp
jno 0x5db6a1
sar dword [edi + 0x48], 1
aas
push esp
push es
je 0x5db750
sbb al, 0x41
clc
mov dword [edx], 0x698954bc
add al, 0xa6
clc
cmc
mov bl, 0xe4
int 0x5c
nop
add eax, edi
pop ds
mov al, byte [0xb6e09f2d]
out dx, al
imul edx, dword [ecx - 0x4f9b97b9], 0x6c
bound esp, qword [ebx]
arpl word [eax + edi*8 + 0x24], cx
and byte [ebx + 0x16c445d4], 0xa
invalid
arpl word [ebx - 0x675c594c], bp
inc esp
popfd
mov al, byte [0xa541caaf]
push 0x2de3e5dc
xchg edi, eax
aaa
je 0x5db736
loopne 0x5db6fd
inc ebx
imul ebp, dword [ecx], 0xd7053786
mov edi, 0x872a5026
invalid

Function at 0x5dbdff
Capabilities:
Encode data using xor

Disassembly:
fild dword [ebp - 0x5a]
dec esi
pop edx
or byte [ecx + 0x3764003c], 0xa4
salc
dec ecx
push ss
pop ebx
jb 0x5dbe12
iretd
invalid
Function at 0x5f08bf
Capabilities:
Encode data using xor

Disassembly:
nop
invalid
or dword [ecx], edi
cdq
movsd dword es:[edi], dword [esi]
cmp dword [ebp - 0x320644e7], eax
ja 0x5f089c
jo 0x5f08df
mov byte [0xcb338b29], al
or dword [ebx + 0x24f687aa], ecx
cmpsd dword [esi], dword es:[edi]
aaa
xchg dword [edi], esi
sbb ecx, eax
popal
xchg ebx, eax
cmc
xor bl, byte [edx + 0x250569f8]
cmc
imul edx, dword [0x1b8629d9], 0xffffffa7
add eax, 0xfcd4fbac
lodsb al, byte [esi]
sti
aam 0xfc
mul dword [ebx + 0x28]
sub dword [ecx], ebx
pushal
and al, byte [ebp + 0x162aee43]
pop esi
aaa
xor ebx, dword [ebp + 0x2e041606]
cmp dword [esp], 0x55
les ebx, [edi + 0x4b2bfcc5]
xchg ebp, eax
salc
mov dword [edi], ebp
aad 0x76
xor eax, 0x451b7415
aaa
mov ebx, 0x94e156d9
jo 0x5f08f1
mov edx, 0x278b2c75
push es
cmovg edx, dword [edx]
mov dh, 0xa4
mov al, 0x74
mov dword [0xebf023e4], eax
arpl si, sp
aad 0xef
cli
mov dh, 0x49
pop edi
adc dword [eax], edi
mov ah, 0
push es
cmp bh, byte [ecx - 0x5ed1cd17]
sbb eax, dword [esi]
stosd dword es:[edi], eax
pop ss
aas
cdq
cmp esi, dword [eax - 0xbdbbf94]
daa
mov al, byte [0xc282d7fd]
add byte [edi + 0x1b], dh
movsd dword es:[edi], dword [esi]
xchg ebp, eax
mov al, 0xae
mov edx, 0x75d8684f
aad 0xa5
fcom dword [edx]
xchg ebx, eax
shr byte [ecx - 0x27], 1
sub eax, 0xf4268393
frstor dword [esi + esi*8 + 0x43]
xchg ebp, eax
sub eax, esi
int1
out dx, eax
enter 0x6600, 0x29
and dl, dh
aaa
lodsd eax, dword [esi]
js 0x5f09b4
aaa
aas
sub eax, esi
pop eax
mov dl, 0xcb
adc dword [0x5322], 0xf9a013ab
imul ebp, dword [ebx + 0x69efc7b6], 0x15
outsd dx, dword [esi]
push ebp
xchg ecx, eax
sub esi, eax
ret
retf