joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100a6d60
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b2fc5
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x100c700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x20], edi
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, ebx
push eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push edx
push eax
call fcn.100a6cf0
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x100a6dea
mov dword [edi], eax
mov byte [edi + 4], 0
jmp 0x100a6f30
cmp dword [ebx + 8], 0xfffffff
jne 0x100a6dfe
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ebx + 4]
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x24], 0
call fcn.100a9322
mov ecx, dword [ebp - 0x10]
mov esi, eax
add esp, 4
mov dword [ebp - 0x24], esi
mov ecx, dword [ecx]
mov dword [esi + 8], ecx
mov byte [esi + 0xc], 0
mov dword [ebp - 4], 1
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 0x1c]
inc eax
movss xmm3, dword [ebx]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100bc8e0]
mov eax, ecx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x100bc8e0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x100a6ee3
divss xmm2, xmm3
sub esp, 8
movss dword [ebp - 0x10], xmm2
fld dword [ebp - 0x10]
fstp qword [esp]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceil
add esp, 8
fstp dword [ebp - 0x10]
movss xmm0, dword [ebp - 0x10]
call fcn.100aa590
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x100a6ec5
cmp eax, 0x200
jae 0x100a6ec3
shl eax, 3
cmp eax, ecx
jae 0x100a6ec5
mov eax, ecx
push eax
mov ecx, ebx
call fcn.100467e0
push dword [ebp - 0x14]
lea eax, [esi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.100a6cf0
mov edx, dword [eax]
jmp 0x100a6ee6
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 4]
inc dword [ebx + 8]
mov edi, dword [ebp - 0x28]
mov dword [esi + 4], eax
mov dword [esi], edx
mov dword [eax], esi
mov dword [edx + 4], esi
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
and eax, dword [ebp - 0x14]
mov ebx, dword [ecx + eax*8]
cmp ebx, dword [edi]
jne 0x100a6f11
mov dword [ecx + eax*8], esi
jmp 0x100a6f23
cmp ebx, edx
jne 0x100a6f1a
mov dword [ecx + eax*8], esi
jmp 0x100a6f27
mov edx, dword [ebp - 0x10]
cmp dword [ecx + eax*8 + 4], edx
jne 0x100a6f27
mov dword [ecx + eax*8 + 4], esi
mov edi, dword [ebp - 0x20]
mov dword [edi], esi
mov byte [edi + 4], 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100a73f0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b2fc5
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x100c700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x20], edi
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, ebx
push eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push edx
push eax
call fcn.100a6cf0
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x100a747a
mov dword [edi], eax
mov byte [edi + 4], 0
jmp 0x100a75c2
cmp dword [ebx + 8], 0xfffffff
jne 0x100a748e
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ebx + 4]
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x24], 0
call fcn.100a9322
mov edx, dword [ebp - 0x10]
mov esi, eax
add esp, 4
mov dword [ebp - 0x24], esi
mov ecx, dword [edx]
mov edx, dword [edx + 4]
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
mov dword [ebp - 4], 1
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 0x1c]
inc eax
movss xmm3, dword [ebx]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100bc8e0]
mov eax, ecx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x100bc8e0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x100a7575
divss xmm2, xmm3
sub esp, 8
movss dword [ebp - 0x10], xmm2
fld dword [ebp - 0x10]
fstp qword [esp]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceil
add esp, 8
fstp dword [ebp - 0x10]
movss xmm0, dword [ebp - 0x10]
call fcn.100aa590
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x100a7557
cmp eax, 0x200
jae 0x100a7555
shl eax, 3
cmp eax, ecx
jae 0x100a7557
mov eax, ecx
push eax
mov ecx, ebx
call fcn.100467e0
push dword [ebp - 0x14]
lea eax, [esi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.100a6cf0
mov edx, dword [eax]
jmp 0x100a7578
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 4]
inc dword [ebx + 8]
mov edi, dword [ebp - 0x28]
mov dword [esi + 4], eax
mov dword [esi], edx
mov dword [eax], esi
mov dword [edx + 4], esi
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
and eax, dword [ebp - 0x14]
mov ebx, dword [ecx + eax*8]
cmp ebx, dword [edi]
jne 0x100a75a3
mov dword [ecx + eax*8], esi
jmp 0x100a75b5
cmp ebx, edx
jne 0x100a75ac
mov dword [ecx + eax*8], esi
jmp 0x100a75b9
mov edx, dword [ebp - 0x10]
cmp dword [ecx + eax*8 + 4], edx
jne 0x100a75b9
mov dword [ecx + eax*8 + 4], esi
mov edi, dword [ebp - 0x20]
mov dword [edi], esi
mov byte [edi + 4], 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x404600
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call int.00437af0
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x404723
push ecx
lea ecx, [esi + 0x18]
call int.00423e20
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x40473a
push ecx
lea ecx, [esi + 0x24]
call fcn.00423d30
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x437af0
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov dh, 0x3f
pop es
lcall 0x6bea, 0x262b46e4
xor al, 0xce
pushal
shl dword [eax + 0x12], 1
invalid
or dl, byte [eax - 8]
adc edx, ebx
cmpsd dword [esi], dword es:[edi]
mov dh, 0x91
mov ecx, 0xe3022b50
add ah, bl
and eax, 0xae3b61d5
jnp 0x437ad1
cmp eax, 0x548ef381
nop
xor eax, dword [ebx + 0x186e05d3]
mov byte [eax + 0x38], dl
and al, 0x53
or eax, 0x17ee9034
and bh, byte [ebp + 0x2c28e2ce]
sti
dec eax
mov esi, 0xd3e00d5d
fidiv word [esi + 0x20]
inc esi
and byte [0xc4d4d726], 0x24
mov gs, word [esi + 0x42]
je 0x437afb
mov bl, 0xea
in eax, 0xed
jl 0x437b7d
fmul dword [edx + 0x5e]
sub edx, ebx
pushal
xchg edi, eax
inc ebx
invalid
dec edx
mov al, byte [0x6f89f4c]
test al, 0x53
xchg dword [edx + 0x2b3124a3], edi
adc ch, 0x20
or dword [ecx - 0x11a0af65], esi
inc esp
jecxz 0x437c0a
invalid
and dword [ebx], edx
pop esi
jae 0x437c6c
movsb byte es:[edi], byte [esi]
sbb dh, cl
scasd eax, dword es:[edi]
push esp
sal dword [edx], cl
pop esi
cwde
sub byte [edi], al
pop edx
cwde
sar dword [edx], cl
cmp esp, dword [ecx]
aam 0xf3
wait
mov ah, 0xeb
pop esp
mov edx, 0x91306adf
and byte [ebx - 0x352fcced], al
xchg ebx, eax
sub ch, byte cs:[ebx - 0x29]
js 0x437c90
mov ah, al
jmp 0x437cec
invalid
or esi, dword [ecx + 0x24]
mov ah, 0xfa
inc esp
scasd eax, dword es:[edi]
add byte [esp + esi*2 + 0x1fab209f], cl
lodsd eax, dword [esi]
dec eax
xor esp, 0xffffff98
popal
imul esp, esp, 0x72
cmp byte [edi], 0x11
invalid
Function at 0x44da10
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00480f00
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x44db33
push ecx
lea ecx, [esi + 0x18]
call fcn.0046d230
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x44db4a
push ecx
lea ecx, [esi + 0x24]
call fcn.0046d140
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4532e1
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebx, 0xc426839
push edi
sbb edi, esp
xor dword [esp + ecx*2 + 0x20c75981], esi
aaa
inc esi
cmc
sbb dword [esi + 0x18c1919], 0x353e20c9
scasd eax, dword es:[edi]
push esi
pop ebx
pop ebp
jp 0x4532bc
add ecx, dword [edi - 0x1bfc2ffd]
cmp eax, dword [edx + 0x7a]
salc
mov cl, 0x44
int3
jno 0x453329
push es
invalid
lds edi, [ebx + ebx*8 + 0x24]
movsb byte es:[edi], byte [esi]
lds esi, [ebp - 0x64c8cab3]
cmp al, 0xcc
stosb byte es:[edi], al
stc
loope 0x45328c
popfd
pop ebp
and eax, 0x21132025
dec ebx
fstp qword [ebx + 0x18d57b32]
invalid
iretd
Function at 0x480f00
Capabilities:
Encode data using xor

Disassembly:
lds ecx, [ebx - 0x80]
sbb al, byte [0x189f8f50]
cmp byte [ebp + 0x34954d25], 0x96
adc dword [ebx + edx*2 + 0x790dfb82], esp
js 0x480e5f
xchg edx, eax
ror ch, 0x13
sbb ah, ah
cmc
sbb eax, 0x68dd503
xchg ebx, eax
invalid
inc edx
ja 0x480ef9
ret
push ebp
add eax, 0x9475f473
jae 0x480e5c
xchg ebp, eax
cmp bh, byte [edi - 0x38]
xchg esi, eax
pop ecx
and byte [ecx + 0x66], 0x82
movsd dword es:[edi], dword [esi]
xchg ecx, eax
inc esp
xor eax, 0xea5de9e5
pushal
add dword [0xfb2dfe73], edx
jns 0x480eb6
inc ebx
std
test al, 0xe4
add ah, 0xd4
fdivr dword [edx + 0x69]
xor al, 0xf0
and eax, 0x16a63c57
jae 0x480e88
jp 0x480f03
xchg esp, eax
call 0x4d028958
push 0x2ea5bb95
push 0x70598ff5
imul esi, dword [eax], 0xffffffeb
sbb cl, byte [edx - 0x46]
jmp 0x480f11
jmp 0x480f10
sub al, 0xa4
and eax, 0x3129220c
or al, 0x22
sub dword [ecx], esi
mov ch, 0x33
sbb edi, ebp
or edi, dword [esi]
jp 0x480f15
jmp 0x480ef5
in al, 0x7e
xchg edi, eax
jle 0x480eaa
in eax, dx
or dword [eax - 0x67], esi
jo 0x480eb0
mov al, byte [0x5ea7c6e3]
fcom st(0)
test byte [ebx - 0x58], ch
xchg esi, eax
pop ss
pop ds
pushal
adc esi, dword [eax - 0x2b]
mov bl, byte [ebp + 0x2d3fb503]
ja 0x480f7d
xchg dword [ebp - 0x63], edi
sub eax, 0x30262ad5
mov ah, byte [ebx + esi + 0x1a]
pop ebx
cmp dword [ebx - 0x2b0f7c45], edi
aam 0xa9
push 0x53d7473d
invalid
cmp al, 0x36
das
out 0x39, eax
sub al, 0x2b
sub byte [eax - 0x159ec790], ch
invalid

Function at 0x496da0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.004ca290
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x496ec3
push ecx
lea ecx, [esi + 0x18]
call fcn.004b65c0
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x496eda
push ecx
lea ecx, [esi + 0x24]
call fcn.004b64d0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4c9de0
Capabilities:
Encode data using xor

Disassembly:
mov ebp, 0xdc39caf5
js 0x4c9de4
fdivr qword [eax - 3]
or al, 0x88
mov ecx, 0x9985b69c
stc
sub eax, 0xd7bad2a
invalid
Function at 0x5294b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47262f
mov eax, dword fs:[0]
push eax
sub esp, 0x138
mov eax, dword [0x4a2008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x13c], edx
mov eax, ecx
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x134], eax
mov esi, dword [ebp + 8]
mov edi, esi
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x140], 0
cmp dword [esi + 0x14], 0x10
mov ecx, dword [esi + 0x10]
mov dword [ebp - 0x138], ecx
jb 0x529517
mov edi, dword [esi]
cmp dword [edx + 0x14], 0x10
mov ecx, dword [edx + 0x10]
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x130], edx
jb 0x529534
mov ecx, dword [edx]
mov dword [ebp - 0x130], ecx
cmp dword [edx + 0x10], 0
jbe 0x52959d
push 0x100
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.00572480
mov ecx, dword [ebp - 0x138]
add esp, 0xc
add ecx, edi
cmp edi, ecx
je 0x529570
nop dword [eax]
movzx eax, byte [edi]
inc edi
mov byte [ebp + eax - 0x128], 1
cmp edi, ecx
jne 0x529560
mov edx, dword [ebp - 0x130]
mov edi, edx
mov ecx, dword [ebp - 0x134]
add ecx, edx
cmp edx, ecx
jae 0x529597
movzx eax, byte [edi]
mov al, byte [ebp + eax - 0x128]
test al, al
je 0x5295f1
inc edi
cmp edi, ecx
jb 0x529584
mov eax, dword [ebp - 0x12c]
xorps xmm0, xmm0
mov ecx, eax
push 0
movups xmmword [eax], xmm0
push 0x491667
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
call fcn.0055ce20
mov dword [ebp - 4], 0
mov dword [ebp - 0x140], 1
mov eax, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00570cfc
mov esp, ebp
pop ebp
ret
sub edi, edx
cmp edi, 0xffffffff
je 0x529597
cmp dword [esi + 0x14], 0x10
jb 0x529600
mov esi, dword [esi]
mov ecx, dword [ebp - 0x13c]
mov dword [ebp - 0x130], ecx
cmp dword [ecx + 0x14], 0x10
jb 0x52961a
mov eax, dword [ecx]
mov dword [ebp - 0x130], eax
push 0x100
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.00572480
mov ecx, dword [ebp - 0x138]
add esp, 0xc
add ecx, esi
cmp esi, ecx
je 0x529650
nop dword [eax]
movzx eax, byte [esi]
inc esi
mov byte [ebp + eax - 0x128], 1
cmp esi, ecx
jne 0x529640
mov eax, dword [ebp - 0x134]
or ecx, 0xffffffff
mov edx, dword [ebp - 0x130]
dec eax
cmp eax, ecx
cmovb ecx, eax
movzx eax, byte [ecx + edx]
add ecx, edx
mov al, byte [ebp + eax - 0x128]
test al, al
je 0x52968e
cmp ecx, edx
je 0x529705
movzx eax, byte [ecx - 1]
dec ecx
mov al, byte [ebp + eax - 0x128]
test al, al
jne 0x529676
sub ecx, edx
sub ecx, edi
lea eax, [ebp - 0x28]
inc ecx
push ecx
mov ecx, dword [ebp - 0x13c]
push edi
push eax
call fcn.005483f0
mov dword [ebp - 4], 1
xorps xmm0, xmm0
mov esi, dword [ebp - 0x12c]
mov dword [ebp - 0x140], 1
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
movups xmm0, xmmword [ebp - 0x28]
mov dword [esi + 0x14], 0
mov byte [ebp - 0x28], 0
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x18]
movq qword [esi + 0x10], xmm0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.0055cf50
mov eax, esi
jmp 0x5295d6
or ecx, 0xffffffff
jmp 0x529690
Function at 0x529930
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.0055ce20
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x529a53
push ecx
lea ecx, [esi + 0x18]
call fcn.00549150
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x529a6a
push ecx
lea ecx, [esi + 0x24]
call fcn.00549060
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x54b1f0
Capabilities:
Encode data using xor

Disassembly:
mov esp, 0x56633730
cmp ebx, dword [edi - 0x4cd57395]
arpl word [edx], sp
sbb eax, 0xd3f8d287
nop
xor eax, 0x3c2b9377
mov ch, 0xd3
jnp 0x54b1fb
lahf
das
pop es
movsb byte es:[edi], byte [esi]
mov ecx, 0x79f34b59
adc al, 0xe8
inc ebx
mov ds, eax
pop esi
add byte [edi], dl
adc eax, 0x15840c7d
dec edi
ret 0xca6e
Function at 0x55cf50
Capabilities:
Encode data using xor

Disassembly:
dec edi
inc edx
and ah, byte [edx]
dec esi
jecxz 0x55cf98
push ecx
pop esp
bound edx, qword [ebp + 0x67]
push ebp
out dx, eax
push ebp
out dx, eax
imul ebx, dword [ebx + 0x5e03e240], 0x3e31eb73
wait
inc eax
loop 0x55cf5b
pop esi
jae 0x55cf46
xor dword [esi], edi
xchg ebp, eax
cmpsb byte ds:[esi], byte es:[edi]
jl 0x55cf54
aaa
dec ecx
sbb eax, 0x3c9f4fdc
xchg esp, ecx
mov al, byte [0xc35b9263]
cmp eax, 0xd767aa46
pop ds
mov es, word [edx]
std
pop edi
aaa
lahf
pop ebx
ret
invalid
mov dl, 0xeb
mov bh, byte [edi]
out dx, al
push 0x3b
js 0x55cf98
insb byte es:[edi], dx
xlatb
pop ss
xchg ebx, eax
push cs
xlatb
mov esi, ebx
out dx, eax
mov byte [0x9b4fc9ae], al
stosd dword es:[edi], eax
js 0x55cf6e
sbb bl, byte [esi]
push ds
adc eax, dword [ebp - 0xdf85259]
jae 0x55cf7d
add byte [ebx + 0x4be72923], ch
neg dword [edi - 0x39]
dec edi
enter 0x37ab, 0xffffffffffffff9f
out 0x57, al
push edi
bound ecx, qword [edi]
xchg edi, eax
jl 0x55d019
or al, 0x64
out 0x12, eax
pop esi
inc ecx
invalid
pop edi
arpl word [ebx - 0x19], bx
adc eax, 0x9c5b2c76
pop esi
mov ebx, 0xe564bf96
arpl word [edi + 0x7f1761fc], ax
inc ecx
sub edi, edx
das
nop
aaa
xchg edx, eax
int 0x10
das
sbb ch, byte [edx*4 - 0x560048f4]
mov byte [0x9b475ebf], al
add esi, ebp
jae 0x55cfec
sub dword [edi + 0x36130c1f], ebx
ja 0x55cfcc
jmp 0x55cfb4

Function at 0x572f40
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.005a6430
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x573063
push ecx
lea ecx, [esi + 0x18]
call int.00592760
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x57307a
push ecx
lea ecx, [esi + 0x24]
call fcn.00592670
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret