joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44d558
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47262f
mov eax, dword fs:[0]
push eax
sub esp, 0x138
mov eax, dword [0x4a2008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x13c], edx
mov eax, ecx
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x134], eax
mov esi, dword [ebp + 8]
mov edi, esi
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x140], 0
cmp dword [esi + 0x14], 0x10
mov ecx, dword [esi + 0x10]
mov dword [ebp - 0x138], ecx
jb 0x44d5bf
mov edi, dword [esi]
cmp dword [edx + 0x14], 0x10
mov ecx, dword [edx + 0x10]
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x130], edx
jb 0x44d5dc
mov ecx, dword [edx]
mov dword [ebp - 0x130], ecx
cmp dword [edx + 0x10], 0
jbe 0x44d645
push 0x100
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.00496528
mov ecx, dword [ebp - 0x138]
add esp, 0xc
add ecx, edi
cmp edi, ecx
je 0x44d618
nop dword [eax]
movzx eax, byte [edi]
inc edi
mov byte [ebp + eax - 0x128], 1
cmp edi, ecx
jne 0x44d608
mov edx, dword [ebp - 0x130]
mov edi, edx
mov ecx, dword [ebp - 0x134]
add ecx, edx
cmp edx, ecx
jae 0x44d63f
movzx eax, byte [edi]
mov al, byte [ebp + eax - 0x128]
test al, al
je 0x44d699
inc edi
cmp edi, ecx
jb 0x44d62c
mov eax, dword [ebp - 0x12c]
xorps xmm0, xmm0
mov ecx, eax
push 0
movups xmmword [eax], xmm0
push 0x491667
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
call fcn.00480ec8
mov dword [ebp - 4], 0
mov dword [ebp - 0x140], 1
mov eax, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00494da4
mov esp, ebp
pop ebp
ret
sub edi, edx
cmp edi, 0xffffffff
je 0x44d63f
cmp dword [esi + 0x14], 0x10
jb 0x44d6a8
mov esi, dword [esi]
mov ecx, dword [ebp - 0x13c]
mov dword [ebp - 0x130], ecx
cmp dword [ecx + 0x14], 0x10
jb 0x44d6c2
mov eax, dword [ecx]
mov dword [ebp - 0x130], eax
push 0x100
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.00496528
mov ecx, dword [ebp - 0x138]
add esp, 0xc
add ecx, esi
cmp esi, ecx
je 0x44d6f8
nop dword [eax]
movzx eax, byte [esi]
inc esi
mov byte [ebp + eax - 0x128], 1
cmp esi, ecx
jne 0x44d6e8
mov eax, dword [ebp - 0x134]
or ecx, 0xffffffff
mov edx, dword [ebp - 0x130]
dec eax
cmp eax, ecx
cmovb ecx, eax
movzx eax, byte [ecx + edx]
add ecx, edx
mov al, byte [ebp + eax - 0x128]
test al, al
je 0x44d736
cmp ecx, edx
je 0x44d7ad
movzx eax, byte [ecx - 1]
dec ecx
mov al, byte [ebp + eax - 0x128]
test al, al
jne 0x44d71e
sub ecx, edx
sub ecx, edi
lea eax, [ebp - 0x28]
inc ecx
push ecx
mov ecx, dword [ebp - 0x13c]
push edi
push eax
call fcn.0046c498
mov dword [ebp - 4], 1
xorps xmm0, xmm0
mov esi, dword [ebp - 0x12c]
mov dword [ebp - 0x140], 1
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
movups xmm0, xmmword [ebp - 0x28]
mov dword [esi + 0x14], 0
mov byte [ebp - 0x28], 0
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x18]
movq qword [esi + 0x10], xmm0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00480ff8
mov eax, esi
jmp 0x44d67e
or ecx, 0xffffffff
jmp 0x44d738
Function at 0x44d9d8
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00480ec8
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x44dafb
push ecx
lea ecx, [esi + 0x18]
call 0x46d1f8
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x44db12
push ecx
lea ecx, [esi + 0x24]
call 0x46d108
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4535e2
Capabilities:
Encode data using xor

Disassembly:
cmp al, 0x5c
out dx, eax
pushal
ret 0xdf69
pop es
sbb eax, 0x19d88e01
push eax
je 0x4535fc
cld
mov ah, 0x1a
mov cs, word [bx - 0x6b13]
aad 0x37
in eax, 0x78
xor eax, 0x3b460414
sbb dword [ecx - 0x518c361a], 0x3c
movsd dword es:[edi], dword [esi]
dec ecx
dec ebp
test dword [esp + edx*4 + 0x68], 0x8c9897e7
test byte [esi + esi*8 + 0x2842c98c], ah
stosd dword es:[edi], eax
mov edx, 0xa369608f
ret
out 0x1c, al
pop ebx
jge 0x453582
jns 0x45359e
invalid
fmulp st(7)
mov al, 0xf0
and al, 0x1f
pop ds
inc ebp
sbb dword [ebp + 0x5c47ec8e], esi
rol dword [esp + edi + 0x68], 0x41
loope 0x4535f7
add al, 0x8b
jae 0x4535a4
sub byte [ebx - 0x2953cf35], bl
invalid
Function at 0x4776e8
Capabilities:
Encode data using xor

Disassembly:
sbb eax, 0x8f3d092f
push es
mov byte [0x36a6720b], al
je 0x4776e0
cmpsb byte [esi], byte es:[edi]
je 0x4776e0
xchg al, al
push es
insb byte es:[edi], dx
lodsd eax, dword [esi]
and ah, byte [edi + 0x257888cc]
sbb eax, 0x5412533a
mov al, byte [0xfe4ceaee]
jge 0x4776a2
out dx, al
ljmp 0x65ad
lodsd eax, dword [esi]
xchg esi, eax
adc bh, byte [ecx + eax - 0x28976452]
wait
push 0x64876ed7
movsb byte es:[edi], byte [esi]
loope 0x4776dc
outsb dx, byte [esi]
xchg dword [esp - 0x1f], esp
xor ebp, esp
aad 0x29
idiv byte [edi + 0x36]
in eax, 0xd5
sub esi, esi
jg 0x4776e7
les ebp, [eax]
push ss
push ecx
and eax, dword [eax + 0x48]
push ss
div dword [esi - 0xaebf749]
pop ebx
jns 0x4776a5
pop ds
sub eax, dword [edi - 0x35]
push edx
cmpsd dword [esi], dword es:[edi]
into
rep lodsd eax, dword [esi]
sub dword [esi], 0xffffff85
outsb dx, byte [esi]
or al, 0xe6
stosb byte es:[edi], al
push ecx
adc edi, esi
fadd qword [edi - 0x53]
rcl dword [ecx + 0x75], cl
mov bh, 0x5d
jne 0x477695
pop ebp
push 0x8f65ef5
dec edx
cmc
pop esi
test byte [eax], 0x4a
sub byte [ecx], 0xec
in al, dx
add al, byte [ebx + 0x72]
js 0x477677
jb 0x477680
ret 0xacb7

Function at 0x496d68
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.004ca258
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x496e8b
push ecx
lea ecx, [esi + 0x18]
call fcn.004b6588
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x496ea2
push ecx
lea ecx, [esi + 0x24]
call fcn.004b6498
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4b5828
Capabilities:
Encode data using xor

Disassembly:
cmp bh, ch
dec ebx
xor cl, dh
ret 0x9ac3
cmp dword [ebx], ebx
aam 0xb
pushal
jne 0x4b589a
scasb al, byte es:[edi]
sbb byte [edi - 0x68], 0xce
xor byte [edi], cl
sub dword [edx + eax*4 - 0x22], ebx
test byte [esi - 0x30eb539c], al
sbb dh, 0x84
xchg byte [esp + ebp*4 + 0x14], ah
iretd
adc al, 0xcf
enter 0xffffffffffffc424, 0xffffffffffffffad
sbb byte [edx + 0x1e94eee4], dl
xor al, 0xc4
jne 0x4b5833
mov ecx, 0x842c6bb4
push cs
lodsd eax, dword [esi]
mov bh, 0x92
js 0x4b57fc
xor al, byte [esi - 0x72]
movsb byte es:[edi], byte [esi]
sbb byte ds:[esi + 0xef61c04], bl
push ss
ftst
into
aad 0x58
inc ebx
pop ebp
mov esp, dword [edi - 0x648af9b0]
xor dword [edx + 0x54fab11b], edx
and bh, al
mov dword [0x8118168], eax
outsd dx, dword fs:[esi]
jnp 0x4b584f
das
jge 0x4b5823
mov bl, 0x58
cwde
cmpsd dword [esi], dword es:[edi]
or eax, 0x8f3f3b84
js 0x4b5839
cmp bh, byte [eax]
mov ecx, 0xc9ee365d
invalid
cmp al, 0x32
push 0x22
sub byte [esp + ebp*8 + 0x62], ch
sahf
test al, 0xd0
cmp cl, byte [ebp - 0x691353c8]
salc
mov cl, 0x88
dec esp
xchg esi, edi
popfd
jg 0x4b5920
aad 0x7b
dec esp
das
sbb dh, byte [edi + 0x38]
invalid
mov ecx, 0xebda4fc1
sub ebp, ebp
out 0x38, al
push 0xabbc279e
mov esp, 0xa592deab
aas
invalid
invalid
jle 0x4b5882
cdq
loop 0x4b591a
xchg dword [ecx - 0x37f7caee], ecx
push ss
loope 0x4b58bc
psubq mm1, qword [eax + 0x78ea7aac]
popfd
in eax, dx
mov edi, 0x38ab5080
movsb byte es:[edi], byte [esi]
jp 0x4b5991
scasb al, byte es:[edi]
dec edi
xchg esi, eax
pop ebx
cli
rcr dword [ebp + 0x4a], 0x4a
sub cl, byte [ebx - 0x5f]
int1
ret 0x86fa
jnp 0x4b5a0e
nop
int3
lodsd eax, dword [esi]
xchg ecx, eax
salc
xchg ebp, eax
aas
into
int1
inc ebx
sahf
daa
rcl dword [edi]
or eax, 0xbab7e18a
pop ss
invalid
imul eax, dword [esi], 0x16088b99
inc edi
adc byte [edi], bh
cld
loop 0x4b59dc
in eax, dx
retf
jmp 0x4b59f7
Function at 0x4e01c8
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.005136b8
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x4e02eb
push ecx
lea ecx, [esi + 0x18]
call fcn.004ff9e8
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x4e0302
push ecx
lea ecx, [esi + 0x24]
call fcn.004ff8f8
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4ffad8
Capabilities:
Encode data using xor

Disassembly:
sti
add ebp, dword [ecx]
mov word [edx - 0x319a7459], ss
into
outsb dx, byte gs:[esi]
push eax
mov eax, dword [0xa524732]
pop ss
fsub dword [esi + 0x5b]
xor dword [eax + 0x40], ecx
cmc
mov ecx, eax
cmp dword [ebx - 0x402c316e], ebx
loop 0x4ffb12
imul dword [esp + 0x710789ee]
dec esi
jle 0x4ffad9
sbb eax, 0x23f417da
sub dword [eax], esi
iretd
adc eax, 0x98c7c787
xchg dword [esi + 0x2bf2de70], ecx
jp 0x4ffb2e
loop 0x4ffae0
pop ebx
mov edx, 0x9f040970
pop es
scasd eax, dword es:[edi]
dec esi
push es
fnstenv [ebx]
xor ebp, dword [ebp + 0x73a91e5b]
mov bl, 0xae
adc byte [ecx], dh
aad 0x92
lodsd eax, dword [esi]
pop ebx
push ds
test eax, 0x10aeb373
xor dword [esi], ebp
aad 0x92
wait
dec edx
xchg ebp, eax
rcr byte [edi + 0x12347eca], cl
invalid
Function at 0x5065b8
Capabilities:
Encode data using xor

Disassembly:
test eax, 0x3c3ed70
xor eax, 0x554b8a22
xor dh, byte [esi]
dec ebx
out 0x5f, al
pop edi
xor bh, byte [esi]
jb 0x50660b
push edx
stosb byte es:[edi], al
lodsd eax, dword [esi]
pop es
inc esi
mov ecx, 0x5b41929f
in eax, dx
loope 0x5065c6
in eax, dx
in eax, dx
sub edi, dword [edi + ebp*8 - 0x6a060e29]
pop edx
pop eax
adc al, byte [0xc53edd6c]
imul esp, dword [ecx], 0x4a
xchg esi, eax
push ecx
test byte [esi - 0x74f95920], ah
invalid
xchg edi, eax
cmc
les esp, [eax]
inc ecx
sbb eax, 0x53300d0
call fcn.004ff45e
push 0x919bdfa8
or dword [ebp - 0x41], esi
das
xchg edx, eax
cwde
xchg esp, eax
mov esi, 0x769914e0
mov bl, byte [esi - 0x4d71bdf7]
fbld tbyte [0xee34c3ce]
scasb al, byte es:[edi]
cmp al, 0xed
test eax, 0xd6bba163
cmpsd dword [esi], dword es:[edi]
out 0xfa, eax
out dx, eax
jmp 0xb6bc5d4

Function at 0x5298f8
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.0055cde8
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x529a1b
push ecx
lea ecx, [esi + 0x18]
call fcn.00549118
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x529a32
push ecx
lea ecx, [esi + 0x24]
call fcn.00549028
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x538018
Capabilities:
Encode data using xor

Disassembly:
adc dword [esi - 0x3c], ebx
call 0xa5989baf
xor dword [edx], 0x1e6decef
cmp eax, dword [ebx]
inc ebx
push eax
add eax, 0xdd785a6a
and edi, edi
inc ebp
add ecx, ebx
invalid
Function at 0x572f08
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.005a63f8
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x57302b
push ecx
lea ecx, [esi + 0x18]
call fcn.00592728
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x573042
push ecx
lea ecx, [esi + 0x24]
call fcn.00592638
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x578af7
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xf816be31
or eax, 0x858e0a99
imul edi, dword [esi - 0x65aa3ff1], 0x8afa524f
pop ebx
cmp byte [0x7402e68a], dh
test dword [ecx - 0x42], ebp
xadd byte [ebp - 0x66], dl
dec edi
push edx
cli
mov bl, byte [ebx - 0xe]
cmp byte [0x7402e68a], dh
dec ecx
inc esi
xor bl, al
mov ebx, dword [eax - 0x30]
mov ah, 0xa8
add eax, 0x62f317d9
mov ebx, 0x216a5ce0
xchg esi, eax
jge 0x578b00
xor eax, 0x6a682a9
cmp byte [0x29d6986e], 0x57
pop ecx
dec esi
retf 0x943c

Function at 0x5daffd
Capabilities:
Encode data using xor

Disassembly:
lodsd eax, dword [esi]
sal byte [si], 1
out dx, eax
fdivr dword [ebx]
fxch st(4)
add al, 0xb2
lds esi, [esi]
and byte [ecx], al
push 0x29
xor byte [esi], al
test dword [eax], esp
and dl, byte [ecx + 0x6f]
scasb al, byte es:[edi]
sbb eax, 0x8226e454
invalid
Function at 0x6062a8
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00639798
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x6063cb
push ecx
lea ecx, [esi + 0x18]
call fcn.00625ac8
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x6063e2
push ecx
lea ecx, [esi + 0x24]
call fcn.006259d8
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x625ac8
Capabilities:
Encode data using xor

Disassembly:
cmpsd dword [esi], dword es:[edi]
sbb ah, ch
pop ss
push esi
loop 0x625a7b
iretd
cmpsb byte [esi], byte es:[edi]
sahf
dec edx
inc ebx
adc eax, 0x1ce7aa4a
and byte [ebx + 0x51e6908a], cl
in eax, 0x4e
or eax, 0xf477ab8e
cwde
jno 0x625ace
sbb ah, cl
add dword [ecx + edx*4 - 0x26267593], edi
or dword es:[edx], edi
insd dword es:[edi], dx
mov bl, cl
fldenv [esi]
or dword [edx], edi
sahf
cmpsd dword [esi], dword es:[edi]
sbb bh, byte [eax + 0x51]
ret
inc esi
rcr bh, 0x4e
jbe 0x625a58
loop 0x625a76
adc al, 0xd7
jbe 0x625a31
test dword [ecx + 0x70], 0xec9674b
push edi
cmpsb byte [esi], byte es:[edi]
call 0x4a16302
dec esi
test al, 0x89
inc ebx
test dword [eax + 0x3a82d813], 0xd9d9bdde
wait
mov byte [esp + esi*8 - 0x297264ea], bh
dec ecx
xchg byte [ecx], cl
jbe 0x625a77
arpl word [edx + ebx], cx
or al, 0x1a
inc ebp
and al, 0x2c
adc esp, dword [edi - 0x5a]
cmpsb byte [si], byte es:[di]
cmpsb byte [esi], byte es:[edi]
jns 0x625b0d
mov dword [esi + 0x13], edx
add al, 0x6b
sbb al, 0x42
pop edx
pop ds
inc esi
push ds
push esi
and esi, dword [eax]
mov bh, 0x91
inc esi
xchg byte [edx - 0xf], bl
sbb eax, 0x3f3ee49d
nop
pop edx
out dx, al
cmpsb byte [esi], byte es:[edi]
xchg edx, eax
mov edi, 0xd157370b
add dword [ebx - 0x1fe03dcb], ebp
insb byte es:[edi], dx
xor edx, dword [edi + 0x50]
ja 0x625ad9
wait
jne 0x625a91
jp 0x625a9b
mov word [edi - 0x3be1e494], fs
or eax, 0xd4632fd7
xlatb
das
arpl sp, dx
push esi
push ebp
cmp al, 0xc5
imul ebx, dword [ebp - 0x4dacf8ef], 0xac81ab94
jp 0x625acf
popfd
imul edx, esp, 0xac6e4bb6
test byte [edx - 0x454c5b16], 0x9b
out 0xd8, al
pop edi
mov dl, 0x97
lcall 0x41a7, 0x9e82d82f
aad 0xf4
invalid

Function at 0x625bb8
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x9ba794b2
cwde
add byte [eax + 0x412765ea], bh
sbb ch, al
cmp bl, dh
sub al, 0xe6
mov esp, 0xd73f2b2e
dec eax
cmpsd dword [esi], dword es:[edi]
mov dh, 0x94
imul edi, dword fs:[ebp - 0x56], 0x28437825
invalid

Function at 0x64d5dd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x655338
cmp edx, dword [eax]
je 0x64d5ff
add eax, 8
inc ecx
cmp eax, 0x6553c8
jl 0x64d5f0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x655338]
jne 0x64d72d
mov eax, dword [0xa58c90]
cmp eax, 1
je 0x64d707
test eax, eax
jne 0x64d630
cmp dword [0x655264], 1
je 0x64d707
cmp edx, 0xfc
je 0x64d72d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x64d667
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0064dfc0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
invalid
lea eax, [ebp + 8]
lea esi, [esi + 0x65533c]
push 0
push eax
push dword [esi]
call fcn.0064e450
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]