joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000cd30
Capabilities:
Log keystrokes via input method manager

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x10021258]
mov ecx, 0x299
push esi
sub ecx, eax
push edi
je 0x1000cd62
mov edx, dword [0x10021244]
mov esi, dword [0x10021248]
mov ecx, dword [0x10021250]
sub edx, esi
add ecx, edx
mov dword [0x10021250], ecx
mov ecx, dword [0x10021254]
add ecx, eax
mov eax, dword [0x1002126c]
add eax, ecx
mov dword [0x1002126c], eax
push 0x1000cee0
push dword fs:[0]
mov dword fs:[0], esp
mov dword [0x1016c31c], esp
mov dword [0x1016c320], ebp
mov esi, dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorDacl]
mov dword [0x1016c318], 0x1c
mov eax, 0xffff915c
mov ecx, 0xffff238c
xor edi, edi
lea edx, [ecx + 0x105]
test edx, edx
je 0x1000cdc2
lea eax, [eax + eax - 0x254]
mov edx, 0xffffff6f
sub edx, eax
je 0x1000cdd4
mov edx, 0xffffff71
sub edx, eax
add ecx, edx
mov edx, 0x2a5
sub edx, eax
add ecx, edx
mov edx, 0x289
sub edx, ecx
add eax, edx
lea edx, [ecx + eax*2]
mov ecx, 0x38f
sub ecx, edx
add eax, ecx
lea ecx, [edx - 0x6f]
test ecx, ecx
je 0x1000ce02
mov ecx, 0x2d1
sub ecx, edx
add eax, ecx
lea ecx, [eax + eax*2]
lea eax, [ecx - 0x36c]
test eax, eax
je 0x1000ce11
neg ecx
lea eax, [ecx + ecx]
test eax, eax
je 0x1000ce21
mov eax, 0x3e6
sub eax, ecx
add edx, eax
lea eax, [edx + edx]
mov edx, ecx
sub eax, ecx
sub edx, eax
je 0x1000ce35
mov edx, 0xfffffea6
sub edx, ecx
add eax, edx
lea ecx, [ecx + eax + 0x163]
sub eax, 0x20
add ecx, 0x34
lea eax, [ecx + ecx + 0xa9]
mov dword [ebp - 8], eax
call sub.IMM32.dll_ImmCreateContext
lea ecx, [ebp - 4]
lea edx, [ebp - 0x10]
push ecx
lea eax, [ebp - 8]
push edx
lea ecx, [ebp - 0x24]
push eax
push ecx
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
call esi
push 0x27
lea edx, [ebp - 0x40]
push 0x35
push edx
push 0x100212ac
push 0x27
push 0x36
call sub.IMM32.dll_ImmGetConversionListA
push 0x39
push 0x60e
push 0x20
call sub.IMM32.dll_ImmSetConversionStatus
push edi
push 0x2d
push 0x39
push 0x2b
call sub.IMM32.dll_ImmEscapeA
lea eax, [ebp - 8]
lea ecx, [ebp - 4]
push eax
push ecx
push 0x36
mov dword [ebp - 4], 0x39
mov dword [ebp - 8], 0x31
call sub.IMM32.dll_ImmGetConversionStatus
push 0x730
push edi
push 0x28
push 0x32
call sub.IMM32.dll_ImmGetCompositionStringA
mov eax, dword [0x1016c318]
mov ecx, 0xfff64a5d
dec eax
mov dword [0x1016c318], eax
mov eax, 0xffffffee
jne 0x1000cdb1
mov ebp, dword [0x1016c320]
mov esp, dword [0x1016c31c]
pop dword fs:[0]
add esp, 4
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10016331
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x10016340
pop dword [ebp - 0x50]
mov eax, 0x6a152b73
sub eax, 0x5a13c833
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x505051dc
add dword [ebp - 0x60], 0xfe01f36f
mov dword [ebp - 0x5c], 0x3402af4b
sub dword [ebp - 0x5c], 0x1cf6306
mov dword [ebp - 0x58], 0x6809f9ed
add dword [ebp - 0x58], 0xe4424a41
mov dword [ebp - 0x54], 0xdbe09f0
add dword [ebp - 0x54], 0xf241f610
lea eax, [ebp - 0x60]
push eax
mov eax, 0xc9920dc9
sub eax, 0xb9906dc1
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0xf249a9e6
add dword [ebp - 0x60], 0x8228bf70
mov dword [ebp - 0x5c], 0x4505d1d2
sub dword [ebp - 0x5c], 0x399705d
mov dword [ebp - 0x58], 0xd0ced73e
add dword [ebp - 0x58], 0x92a0952e
mov dword [ebp - 0x54], 0x91a120b8
add dword [ebp - 0x54], 0x6e5edf48
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0x8357138e
sub eax, 0x73557382
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x3b0bc
push 0
call eax
mov ecx, 0x2250fc1b
add ecx, 0xddaf4f20
xor esi, esi
add esi, eax
mov edx, 0x10024a00
add edx, dword [ebp - 0x50]
mov edi, 0x111f30fb
add edi, 0xa9350687
xor dword [ebp - 0x10], ecx
mov ebx, dword [edx]
sub dword [ebp - 0x28], ebx
add ebx, edi
add dword [ebp - 0x2c], 0xeda0be5
mov dword [esi], ebx
add dword [ebp - 0xc], esi
add esi, 0xd5b892bb
add esi, 0x2a476d49
add edx, 4
loop 0x1001645e
add eax, 0x11fbf
xor ebx, ebx
add ebx, eax
add eax, 0xc8bedb95
add eax, 0x37412470
mov ecx, 0x10000000
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push ebp
push esi
push edi
call fcn.0040eb78
push str._JAVA_LAUNCHER_DEBUG
mov eax, dword [eax]
mov dword [0x433680], eax
call fcn.0040dad4
xor ebp, ebp
pop ecx
test eax, eax
je 0x401059
push str.Windows_original_main_args:_n
call fcn.00401112
pop ecx
mov esi, ebp
call fcn.0040e6c7
cmp dword [eax], ebp
jle 0x401059
call fcn.0040e6cd
mov eax, dword [eax]
push dword [eax + esi*4]
push esi
push str.wwwd_args__d____s_n
call fcn.00401112
add esp, 0xc
inc esi
call fcn.0040e6c7
cmp esi, dword [eax]
jl 0x401037
call dword [sym.imp.kernel32.dll_GetCommandLineA]
push eax
call fcn.0040121d
call fcn.00401285
mov ebx, eax
lea ecx, [ebx*4 + 4]
push ecx
call fcn.00401135
pop ecx
pop ecx
mov esi, eax
call fcn.0040128b
mov edx, ebp
test ebx, ebx
jle 0x401093
mov ecx, dword [eax + edx*8]
mov dword [esi + edx*4], ecx
inc edx
cmp edx, ebx
jl 0x401088
mov edi, dword [str.java]
mov dword [esi + edx*4], ebp
test edi, edi
jne 0x4010a2
mov edi, dword [esi]
mov edx, dword [section..data]
test edx, edx
jne 0x4010ae
mov edx, dword [esi]
mov ecx, dword [0x432990]
push ebp
xor ebp, ebp
inc ebp
test ecx, ecx
push ebp
push ebp
setne al
movzx eax, al
push eax
push edi
push edx
push 0x426274
push 0x426278
push dword [0x432994]
push ebp
push ecx
push ebp
push esi
push ebx
call fcn.00401d65
add esp, 0x38
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
Function at 0x404305
Capabilities:
Read file on windows

Disassembly:
push ecx
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
push 2
push 0xffffffffffffffff
push 0xffffffffffffffea
push ebp
call fcn.0040dad4
mov ebx, edx
add esp, 0x10
mov esi, eax
test ebx, ebx
jl 0x404478
jg 0x404334
test esi, esi
jb 0x404478
mov edi, dword [esp + 0x20]
push 0x16
push edi
push ebp
call fcn.004175dd
add esp, 0xc
test eax, eax
js 0x404478
movzx ecx, byte [edi + 3]
movzx eax, byte [edi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi]
shl ecx, 8
or ecx, eax
cmp ecx, 0x6054b50
jne 0x404396
push edi
call fcn.00404887
pop ecx
test eax, eax
je 0x40438d
push ebx
push esi
push edi
push ebp
call fcn.0040dad4
add esp, 0x10
mov esi, eax
mov ebx, edx
mov eax, esi
mov edx, ebx
jmp 0x40447d
push 2
xor ebx, ebx
push ebx
push ebx
push ebp
call fcn.0040dad4
mov ebp, eax
add esp, 0x10
mov eax, edx
mov dword [esp + 0x14], eax
cmp eax, ebx
jl 0x404478
jg 0x4043bf
cmp ebp, ebx
jb 0x404478
mov ecx, 0x10015
cmp eax, ebx
jg 0x4043d4
jl 0x4043ce
cmp ebp, ecx
jae 0x4043d4
mov esi, ebp
mov ecx, eax
jmp 0x4043d8
mov esi, ecx
mov ecx, ebx
mov eax, esi
neg eax
push 2
adc ecx, ebx
neg ecx
push ecx
push eax
push dword [esp + 0x28]
call fcn.0040dad4
add esp, 0x10
cmp edx, ebx
jl 0x404478
jg 0x4043fe
cmp eax, ebx
jb 0x404478
push 0x10015
call fcn.0040dad4
mov ebx, eax
pop ecx
test ebx, ebx
je 0x404478
push esi
push ebx
push dword [esp + 0x24]
call fcn.004175dd
add esp, 0xc
mov dword [esp + 0x10], eax
test eax, eax
js 0x404471
lea edx, [ebx + eax]
lea esi, [edx - 0x16]
jmp 0x40446d
cmp byte [esi], 0x50
jne 0x40446c
movzx ecx, byte [esi + 3]
movzx eax, byte [esi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 1]
shl ecx, 8
or ecx, eax
shl ecx, 8
or ecx, 0x50
cmp ecx, 0x6054b50
jne 0x40446c
movzx ecx, byte [esi + 0x15]
movzx eax, byte [esi + 0x14]
shl ecx, 8
or ecx, eax
lea eax, [esi + 0x16]
add eax, ecx
cmp eax, edx
je 0x404484
dec esi
cmp esi, ebx
jae 0x40442d
push ebx
call fcn.0040dad4
pop ecx
or eax, 0xffffffff
or edx, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
push 0x16
push esi
push edi
call fcn.0040a170
push ebx
call fcn.0040dad4
mov eax, dword [esp + 0x20]
add eax, ebx
sub eax, esi
mov esi, dword [esp + 0x24]
cdq
sub ebp, eax
push edi
sbb esi, edx
call fcn.00404887
add esp, 0x14
test eax, eax
je 0x4044c4
push esi
push ebp
push edi
push dword [esp + 0x28]
call fcn.0040dad4
add esp, 0x10
mov ebp, eax
mov esi, edx
mov eax, ebp
mov edx, esi
jmp 0x40447d
Function at 0x40d754
Capabilities:
Authenticate hmac

Disassembly:
mov al, byte [ecx + 0x31]
cmp al, 0x46
jne 0x40d775
mov eax, dword [ecx]
and eax, 8
or eax, 0
jne 0x40d89f
mov dword [ecx + 0x1c], 7
jmp fcn.0040dad4
cmp al, 0x4e
jne 0x40d79f
mov eax, dword [ecx]
push 8
pop edx
and eax, edx
or eax, 0
jne 0x40d89f
mov dword [ecx + 0x1c], edx
call fcn.004145d7
mov dword [eax], 0x16
call fcn.004183a3
xor al, al
ret
cmp dword [ecx + 0x2c], 0
jne 0x40d78c
cmp al, 0x6a
jg 0x40d85e
je 0x40d855
cmp al, 0x49
je 0x40d7fa
cmp al, 0x4c
je 0x40d7ee
cmp al, 0x54
je 0x40d7e2
cmp al, 0x68
jne 0x40d89f
mov eax, dword [ecx + 0x10]
cmp byte [eax], 0x68
jne 0x40d7db
inc eax
mov dword [ecx + 0x10], eax
xor eax, eax
inc eax
jmp 0x40d89c
push 2
jmp 0x40d89b
mov dword [ecx + 0x2c], 0xd
jmp 0x40d89f
mov dword [ecx + 0x2c], 8
jmp 0x40d89f
mov edx, dword [ecx + 0x10]
mov al, byte [edx]
cmp al, 0x33
jne 0x40d81b
cmp byte [edx + 1], 0x32
jne 0x40d81b
lea eax, [edx + 2]
mov dword [ecx + 0x2c], 0xa
mov dword [ecx + 0x10], eax
jmp 0x40d89f
cmp al, 0x36
jne 0x40d834
cmp byte [edx + 1], 0x34
jne 0x40d834
lea eax, [edx + 2]
mov dword [ecx + 0x2c], 0xb
mov dword [ecx + 0x10], eax
jmp 0x40d89f
cmp al, 0x64
je 0x40d84c
cmp al, 0x69
je 0x40d84c
cmp al, 0x6f
je 0x40d84c
cmp al, 0x75
je 0x40d84c
cmp al, 0x78
je 0x40d84c
cmp al, 0x58
jne 0x40d89f
mov dword [ecx + 0x2c], 9
jmp 0x40d89f
mov dword [ecx + 0x2c], 5
jmp 0x40d89f
cmp al, 0x6c
je 0x40d889
cmp al, 0x74
je 0x40d880
cmp al, 0x77
je 0x40d877
cmp al, 0x7a
jne 0x40d89f
mov dword [ecx + 0x2c], 6
jmp 0x40d89f
mov dword [ecx + 0x2c], 0xc
jmp 0x40d89f
mov dword [ecx + 0x2c], 7
jmp 0x40d89f
mov eax, dword [ecx + 0x10]
cmp byte [eax], 0x6c
jne 0x40d899
inc eax
mov dword [ecx + 0x10], eax
push 4
jmp 0x40d89b
push 3
pop eax
mov dword [ecx + 0x2c], eax
mov al, 1
ret
Function at 0x40dad4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x40dae3
pop dword [ebp - 0x4c]
mov eax, 0x40dae3
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x63e7a6f4
add dword [ebp - 0x5c], 0xea6a9e57
mov dword [ebp - 0x58], 0xb5a7669b
sub dword [ebp - 0x58], 0x83741a56
mov dword [ebp - 0x54], 0xa4bbfdc
sub dword [ebp - 0x54], 0xbdff7bae
mov dword [ebp - 0x50], 0x85bd0104
sub dword [ebp - 0x50], 0x85bd0104
lea eax, [ebp - 0x5c]
push eax
mov eax, 0x4a74759
add eax, 0xfb9b18fb
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0xc6ffcf86
sub dword [ebp - 0x5c], 0x528d6630
mov dword [ebp - 0x58], 0x7547f7ea
sub dword [ebp - 0x58], 0x33db9675
mov dword [ebp - 0x54], 0xac9a83e4
add dword [ebp - 0x54], 0xb6d4e888
mov dword [ebp - 0x50], 0xb6b3724c
sub dword [ebp - 0x50], 0xb6b3724c
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x3ef29
push 0
call eax
mov ecx, 0x4cc9
xor edx, edx
add edx, eax
mov edi, 0x43ea00
add edi, dword [ebp - 0x4c]
mov esi, 0x23f73aa7
sub esi, 0xdfb50dce
mov ebx, dword [edi]
xor dword [ebp - 0x40], 0x2459d07c
sub ebx, esi
add dword [ebp - 0x2c], 0xdec6daea
mov dword [edx], ebx
xor dword [ebp - 0x40], edi
add edx, 4
add edi, 4
loop 0x40dbf1
add eax, 0x125f7
xor ebx, ebx
add ebx, eax
add eax, 0x7b089691
sub eax, 0x7b08968c
mov ecx, 0xeb6f45c9
sub ecx, 0xeb2f45c9
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x404698
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00437b88
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x4047bb
push ecx
lea ecx, [esi + 0x18]
call fcn.00423eb8
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x4047d2
push ecx
lea ecx, [esi + 0x24]
call fcn.00423dc8
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x44a210
Capabilities:
Accept command line arguments
Log keystrokes via polling

Disassembly:
push ecx
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, dword [esp + 0x14]
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
mov edi, eax
mov dword [esi], 0
call ebx
test ax, ax
jge 0x44a23b
or dword [esi], 0x2000000
lea eax, [esp + 0xc]
push eax
push edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push 0x11
mov edi, eax
call ebx
test ax, ax
jge 0x44a258
or dword [esi], 0x4000000
test edi, edi
je 0x44a26e
mov ecx, dword [0x657a4c]
push 0x657768
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
push 0x12
call ebx
test ax, ax
jge 0x44a27d
or dword [esi], 0x8000000
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x496d98
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.004ca288
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x496ebb
push ecx
lea ecx, [esi + 0x18]
call fcn.004b65b8
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x496ed2
push ecx
lea ecx, [esi + 0x24]
call fcn.004b64c8
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4accb8
Capabilities:
Encode data using xor

Disassembly:
xchg ecx, eax
cmp bh, byte [esi + 0x67]
and bl, 0x3d
fnsave dword [ecx + 0x16]
sti
mov dh, 0xef
mov edx, 0x4013020f
test al, 0xaf
mov dword [0xeeee738c], eax
mov cl, 0x71
or byte [ebx + 0x7eadc2b6], 0x87
invalid

Function at 0x4b5858
Capabilities:
Encode data using xor

Disassembly:
cmpsd dword [esi], dword es:[edi]
out 0x41, eax
or dword [ecx - 0x4b], edx
and eax, 0xc2c3f2d2
add al, 0x46
jae 0x4b5894
and byte [ebp + 0x51fc4f6f], al
in eax, 0x18
out 0xb7, eax
pop eax
add ch, byte [edx + 0x53]
mov dh, 0x7f
pushfd
int3
and eax, dword [ebp + 0xb77911b]
Function at 0x4c99c8
Capabilities:
Encode data using xor

Disassembly:
xor dh, byte [ebx]
mov dl, 0x42
mov ah, 0xa7
out dx, eax
popfd
mov bl, 0xb
fst dword [edi + 0x730347a1]
inc esp
lock add bh, byte [edx]
out dx, al
idiv byte [ebp + 0x1d4d4f5f]
mov dh, 0x2e
in eax, dx
push eax
pop ebx
xor dword [0x8fb64549], ebx
in eax, dx
mov edi, 0x2e902a9e
add bl, byte [ebx - 0xb4b78f9]
mov dh, 0xed
cwde
adc edx, dword [eax]
pushfd
xlatb
sbb dh, byte [ebx + 0x7aa6a207]
mov byte [0xeda27aa6], al
out dx, eax
pop ds
cmp byte [ebp + 0x2d1e8e5e], 0xb4
popal
mov byte [0xeda27aa6], al
out dx, eax
pop ds
cmp byte [ebp + 0x2d1e8e5e], 0xb4
popal
loop 0x4c998c
adc dword [ecx - 0x760d86d0], ecx
and ecx, dword [eax - 7]
sbb eax, 0x6c24ad75
adc dword [bp - 0xf], eax
jecxz 0x4c99fd
jp 0x4c9a51
or bh, byte [esi + ecx*2 - 0x40]
sbb dword [ebx], 0xffffff83
int 0x91
aad 0xfc
sahf
fsub st(5), st(0)
and byte [esi + edi*8], dh
and al, 0xd6
xchg byte [esi + 0x4c19751], al
popfd
mov esp, 0x6e5882cf
jmp 0x4c9a82
push 0xffffffffffffff93
add byte [ecx], al
add edi, esp
retf
test eax, 0x94438bf7
dec edi
mov byte [0x8e231bb7], al
xchg ecx, eax
sti
lahf
mov esp, 0xe8d2466f
mov al, dh
mov bh, 0x42
xor edx, eax
mov byte [0x538c1205], al
jne 0x4c9a1d
inc eax
pop ss
outsb dx, byte [esi]
push edx
push edx
les ebp, [ebx - 0x72a29eb0]
or byte [ebx + 0x7c3fa610], 0x44
jl 0x4c9ac8
ret
xor esi, dword [esi + 0x265c1500]
sbb bh, ch
add byte [eax - 0x4ed278e5], al
xlatb
mov al, byte [0xba2bd313]
invalid

Function at 0x4e01f8
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.005136e8
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x4e031b
push ecx
lea ecx, [esi + 0x18]
call fcn.004ffa18
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x4e0332
push ecx
lea ecx, [esi + 0x24]
call fcn.004ff928
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x529928
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.0055ce18
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x529a4b
push ecx
lea ecx, [esi + 0x18]
call fcn.00549148
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x529a62
push ecx
lea ecx, [esi + 0x24]
call fcn.00549058
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x572f38
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.005a6428
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x57305b
push ecx
lea ecx, [esi + 0x18]
call fcn.00592758
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x573072
push ecx
lea ecx, [esi + 0x24]
call fcn.00592668
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x57b4f8
Capabilities:
Encode data using xor

Disassembly:
pop ebx
adc dword [eax + 0x62], ebx
cmpsd dword [esi], dword es:[edi]
retf
outsd dx, dword [esi]
cdq
pop edx
cmp al, 0x4f
cmp al, 0xad
adc eax, 0xcb6cc98d
outsd dx, dword [esi]
sub byte [edx - 0x555cf82d], cl
pcmpeqd mm1, qword [eax - 0x22c279a0]
lock inc dword [edx]
mov edx, 0x8557ea10
pushal
popal
dec esi
mov dword [0x3a2dbed7], eax
xor ah, byte [ebp + 0x61]
mov al, 0x4f
sahf
add edx, dword [bp + di]
out 0x30, eax
mov eax, dword cs:[0x64203d6a]
out 0xe6, eax
jg 0x57b4e1
mov ebx, 0x8475b2e3
pop ds
bound ebp, qword [ebx + 0x6a]
xor ecx, dword [ebp + 0x3125abb5]
xchg ebp, eax
xchg esp, eax
out 0x1e, al
pop esp
xor dword [ebp + 0x5c1ee694], edx
push 0xffce9df5
mov ebp, 0xd92e2911
sub dword [ebx], ebp
jecxz 0x57b546
mov ecx, 0xa73e86d3
dec esp
add eax, 0xef3aef
cdq
adc al, 0xc0
sbb al, 0x60
mov ah, 0x22
ror edi, cl
xchg ebx, eax
pop edx
pop ebx
ret