joyce8/EMBER2024-capa huggingface dataset:
Function at 0x638370
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x6383ff
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, esi
call fcn.00424e30
test al, al
je 0x6383ae
lea eax, [ebp - 4]
mov edx, esi
call fcn.0040abb8
jmp 0x6383b6
lea eax, [ebp - 4]
call fcn.00638334
lea eax, [ebp - 0x20c]
push eax
xor bl, 1
movzx eax, bl
push eax
push 0x638410
mov eax, dword [ebp - 4]
call fcn.0040b7f8
push eax
call sub.KERNEL32.DLL_GetTempFileNameW
mov eax, edi
lea edx, [ebp - 0x20c]
mov ecx, 0x104
call fcn.0040b8b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x638406
lea eax, [ebp - 4]
call fcn.0040a790
ret

Function at 0x638490
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x63854c
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.004257c4
mov edx, dword [ebp - 4]
mov eax, 0x638568
call fcn.004c5a3c
test al, al
je 0x6384d9
lea eax, [ebp - 4]
mov ecx, 8
mov edx, 1
call fcn.0040bc7c
jmp 0x6384fc
mov edx, dword [ebp - 4]
mov eax, 0x638588
call fcn.004c5a3c
test al, al
je 0x6384fc
lea eax, [ebp - 4]
mov ecx, 4
mov edx, 1
call fcn.0040bc7c
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00425660
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.0042c2e4
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.0040abb8
mov eax, dword [ebp - 4]
call fcn.0040b7f8
push eax
call sub.KERNEL32.DLL_GetDriveTypeW
cmp eax, 2
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x638553
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040a7f0
ret

Function at 0x6396b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
mov esi, edx
mov edx, dword [eax]
dec ecx
test ecx, ecx
jl 0x6396db
inc ecx
mov ebx, edx
xor bl, byte [esi]
movzx ebx, bl
mov ebx, dword [ebx*4 + 0x8bb268]
shr edx, 8
and edx, 0xffffff
xor ebx, edx
mov edx, ebx
inc esi
dec ecx
jne 0x6396bc
mov dword [eax], edx
pop esi
pop ebx
ret

Function at 0x63b190
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, edx
mov edx, dword [eax]
dec ecx
test ecx, ecx
jl 0x63b1b8
inc ecx
mov ebx, edx
xor bl, byte [esi]
movzx ebx, bl
mov edi, dword [0x8c16e0]
mov ebx, dword [edi + ebx*4]
shr edx, 8
xor ebx, edx
mov edx, ebx
inc esi
dec ecx
jne 0x63b19d
mov dword [eax], edx
pop edi
pop esi
pop ebx
ret

Function at 0x63fdd4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x63fe1a
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x30]
call fcn.0063ec0c
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63fe21
lea eax, [ebp - 4]
call fcn.0040a790
ret
Function at 0x641e68
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x641f85
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebx + 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, dword [ebp - 8]
xor ecx, ecx
mov dword [edx], ecx
call fcn.00408ac4
inc dword [ebx + 0x10]
cmp dword [ebx + 0x2c], 0
jne 0x641eae
cmp dword [ebx + 0x28], 0
jbe 0x641ee8
jmp 0x641eb0
jle 0x641ee8
mov esi, dword [ebx + 4]
lea ecx, [ebp - 0xc]
mov edx, dword [ebx + 0x10]
mov eax, ebx
call fcn.00641848
mov edi, dword [ebp - 0xc]
mov dword [ebp - 0x10], edi
mov eax, dword [ebp - 0x10]
call fcn.0040b7f8
push eax
mov dword [ebp - 0x14], esi
mov eax, dword [ebp - 0x14]
call fcn.0040b7f8
push eax
call sub.KERNEL32.DLL_MoveFileW
cmp eax, 1
sbb eax, eax
inc eax
jmp 0x641f4a
cmp word [ebx + 0x32], 0
je 0x641f29
mov byte [ebp - 1], 0
lea ecx, [ebp - 1]
mov edx, ebx
mov eax, dword [ebx + 0x34]
call dword [ebx + 0x30]
cmp byte [ebp - 1], 0
je 0x641f15
mov dl, 1
mov eax, dword [0x634048]
call fcn.006369d0
call fcn.00409e94
mov eax, dword [ebx + 4]
call fcn.00638594
cmp edx, 0xffffffff
jne 0x641f25
cmp eax, 0xffffffff
je 0x641ef3
jmp 0x641f3a
mov dl, 1
mov eax, dword [0x634048]
call fcn.006369d0
call fcn.00409e94
mov eax, dword [ebx + 4]
call fcn.00638418
mov edx, dword [ebx + 0x10]
call fcn.00639b78
push 0xff20
mov ecx, dword [ebx + 4]
mov dl, 1
mov eax, dword [0x4817c0]
call fcn.004a2a38
mov dword [ebx + 0x20], eax
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x1c], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x641f8c
lea eax, [ebp - 0xc]
call fcn.0040a790
ret
Function at 0x6551a8
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
mov dword [ebp - 8], eax
mov ebx, edx
mov esi, ecx
dec esi
test esi, esi
jl 0x655230
inc esi
mov eax, dword [ebp - 8]
and eax, 0xffff
or eax, 2
movzx edx, byte [ebx]
mov ecx, 1
xor ecx, eax
imul ecx, eax
shr ecx, 8
xor dl, cl
mov byte [ebx], dl
movzx eax, byte [ebx]
mov edx, dword [ebp - 0x10]
call fcn.006396e0
mov edi, eax
mov dword [ebp - 0x10], edi
and edi, 0xff
add dword [ebp - 0xc], edi
imul edi, dword [ebp - 0xc], 0x8088405
inc edi
mov dword [ebp - 0xc], edi
mov eax, edi
shr eax, 0x18
mov edx, dword [ebp - 8]
call fcn.006396e0
mov dword [ebp - 8], eax
inc ebx
dec esi
jne 0x6551d9
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
mov dword [eax + 8], edx
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x10], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x655254
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov edx, ecx
mov eax, ebx
call fcn.006552e8
mov dword [ebp - 8], 0xc
mov edi, dword [ebp - 4]
lea esi, [ebp - 0x14]
mov eax, dword [ebx + 0x10]
and eax, 0xffff
or eax, 2
mov edx, 1
xor edx, eax
imul edx, eax
shr edx, 8
xor dl, byte [edi]
mov byte [esi], dl
mov edx, dword [ebx + 8]
movzx eax, byte [esi]
call fcn.006396e0
mov dword [ebx + 8], eax
mov eax, dword [ebx + 8]
and eax, 0xff
add dword [ebx + 0xc], eax
imul eax, dword [ebx + 0xc], 0x8088405
inc eax
mov dword [ebx + 0xc], eax
mov eax, dword [ebx + 0xc]
shr eax, 0x18
mov edx, dword [ebx + 0x10]
call fcn.006396e0
mov dword [ebx + 0x10], eax
inc esi
inc edi
dec dword [ebp - 8]
jne 0x655278
movzx eax, byte [ebp + 0xb]
cmp al, byte [ebp - 9]
sete al
mov byte [ebx + 4], al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x6552e8
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov dword [ebx + 8], 0x12345678
mov dword [ebx + 0xc], 0x23456789
mov dword [ebx + 0x10], 0x34567890
mov eax, dword [ebp - 4]
test eax, eax
je 0x655315
sub eax, 4
mov eax, dword [eax]
mov esi, eax
test esi, esi
jle 0x65535e
mov edi, 1
mov eax, dword [ebp - 4]
movzx eax, byte [eax + edi - 1]
mov edx, dword [ebx + 8]
call fcn.006396e0
mov dword [ebx + 8], eax
mov eax, dword [ebx + 8]
and eax, 0xff
add dword [ebx + 0xc], eax
imul eax, dword [ebx + 0xc], 0x8088405
inc eax
mov dword [ebx + 0xc], eax
mov eax, dword [ebx + 0xc]
shr eax, 0x18
mov edx, dword [ebx + 0x10]
call fcn.006396e0
mov dword [ebx + 0x10], eax
inc edi
dec esi
jne 0x655320
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x6554f8
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00655780
mov dword [ebp - 0x10], 0xa
lea edi, [ebp - 0x1c]
mov eax, pe_nt_image_headers32
call fcn.00407638
mov byte [ebp - 9], al
mov esi, dword [ebx + 0x10]
and esi, 0xffff
or esi, 2
mov eax, 1
xor eax, esi
imul esi
shr eax, 8
mov esi, eax
mov edx, dword [ebx + 8]
movzx eax, byte [ebp - 9]
call fcn.006396e0
mov dword [ebx + 8], eax
mov eax, dword [ebx + 8]
and eax, 0xff
add dword [ebx + 0xc], eax
imul eax, dword [ebx + 0xc], 0x8088405
inc eax
mov dword [ebx + 0xc], eax
mov eax, dword [ebx + 0xc]
shr eax, 0x18
mov edx, dword [ebx + 0x10]
call fcn.006396e0
mov dword [ebx + 0x10], eax
mov eax, esi
xor al, byte [ebp - 9]
mov byte [edi], al
inc edi
dec dword [ebp - 0x10]
jne 0x65551d
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00655780
mov dword [ebp - 0x10], 0xa
lea edi, [ebp - 0x1c]
mov esi, dword [ebx + 0x10]
and esi, 0xffff
or esi, 2
mov eax, 1
xor eax, esi
imul esi
shr eax, 8
mov esi, eax
mov edx, dword [ebx + 8]
movzx eax, byte [edi]
call fcn.006396e0
mov dword [ebx + 8], eax
mov eax, dword [ebx + 8]
and eax, 0xff
add dword [ebx + 0xc], eax
imul eax, dword [ebx + 0xc], 0x8088405
inc eax
mov dword [ebx + 0xc], eax
mov eax, dword [ebx + 0xc]
shr eax, 0x18
mov edx, dword [ebx + 0x10]
call fcn.006396e0
mov dword [ebx + 0x10], eax
mov eax, esi
xor byte [edi], al
inc edi
dec dword [ebp - 0x10]
jne 0x65559b
movzx eax, byte [ebp + 0xa]
mov byte [ebp - 9], al
mov esi, dword [ebx + 0x10]
and esi, 0xffff
or esi, 2
mov eax, 1
xor eax, esi
imul esi
shr eax, 8
mov esi, eax
mov edx, dword [ebx + 8]
movzx eax, byte [ebp - 9]
call fcn.006396e0
mov edi, eax
mov dword [ebx + 8], edi
and edi, 0xff
add dword [ebx + 0xc], edi
imul edi, dword [ebx + 0xc], 0x8088405
inc edi
mov dword [ebx + 0xc], edi
mov eax, edi
shr eax, 0x18
mov edx, dword [ebx + 0x10]
call fcn.006396e0
mov dword [ebx + 0x10], eax
mov eax, esi
xor al, byte [ebp - 9]
mov byte [ebp - 0x12], al
movzx eax, byte [ebp + 0xb]
mov byte [ebp - 9], al
mov esi, dword [ebx + 0x10]
and esi, 0xffff
or esi, 2
mov eax, 1
xor eax, esi
imul esi
shr eax, 8
mov esi, eax
mov edx, dword [ebx + 8]
movzx eax, byte [ebp - 9]
call fcn.006396e0
mov edi, eax
mov dword [ebx + 8], edi
and edi, 0xff
add dword [ebx + 0xc], edi
imul edi, dword [ebx + 0xc], 0x8088405
inc edi
mov dword [ebx + 0xc], edi
mov eax, edi
shr eax, 0x18
mov edx, dword [ebx + 0x10]
call fcn.006396e0
mov dword [ebx + 0x10], eax
mov eax, esi
xor al, byte [ebp - 9]
mov byte [ebp - 0x11], al
mov byte [ebx + 4], 1
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x1c]
mov dword [eax], edx
mov edx, dword [ebp - 0x18]
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x14]
mov dword [eax + 8], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x6556d4
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
mov dword [ebp - 8], eax
mov esi, edx
mov edi, ecx
dec edi
test edi, edi
jl 0x65575d
inc edi
mov eax, dword [ebp - 8]
and eax, 0xffff
or eax, 2
movzx ebx, byte [esi]
mov edx, ebx
mov ecx, 1
xor ecx, eax
imul ecx, eax
shr ecx, 8
xor dl, cl
mov byte [esi], dl
mov edx, dword [ebp - 0x10]
mov eax, ebx
call fcn.006396e0
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
and eax, 0xff
add dword [ebp - 0xc], eax
imul ebx, dword [ebp - 0xc], 0x8088405
inc ebx
mov dword [ebp - 0xc], ebx
mov eax, ebx
shr eax, 0x18
mov edx, dword [ebp - 8]
call fcn.006396e0
mov dword [ebp - 8], eax
inc esi
dec edi
jne 0x655705
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
mov dword [eax + 8], edx
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x10], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x655780
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov dword [ebx + 8], 0x12345678
mov dword [ebx + 0xc], 0x23456789
mov dword [ebx + 0x10], 0x34567890
mov eax, dword [ebp - 4]
test eax, eax
je 0x6557ad
sub eax, 4
mov eax, dword [eax]
mov esi, eax
test esi, esi
jle 0x6557f6
mov edi, 1
mov eax, dword [ebp - 4]
movzx eax, byte [eax + edi - 1]
mov edx, dword [ebx + 8]
call fcn.006396e0
mov dword [ebx + 8], eax
mov eax, dword [ebx + 8]
and eax, 0xff
add dword [ebx + 0xc], eax
imul eax, dword [ebx + 0xc], 0x8088405
inc eax
mov dword [ebx + 0xc], eax
mov eax, dword [ebx + 0xc]
shr eax, 0x18
mov edx, dword [ebx + 0x10]
call fcn.006396e0
mov dword [ebx + 0x10], eax
inc edi
dec esi
jne 0x6557b8
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x6560dc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebx + 0x28]
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 8]
jle 0x6560f9
inc eax
mov edx, dword [ebx + 0x18]
mov dword [ebp - 0xc], edx
mov ecx, dword [ebx + 0x1c]
mov edx, dword [ebx + 0x20]
mov esi, dword [ebp - 8]
dec esi
test esi, esi
jl 0x656139
inc esi
mov dword [ebp - 0x10], esi
shl edx, 5
movzx esi, byte [eax + 2]
xor edx, esi
and edx, 0x3fff
mov esi, dword [ebx + 0x5c]
and esi, eax
mov edi, dword [ebp - 0xc]
lea edi, [edi + esi*4]
mov esi, dword [ecx + edx*4]
mov dword [edi], esi
mov dword [ecx + edx*4], eax
inc eax
dec dword [ebp - 0x10]
jne 0x656111
mov esi, dword [ebp - 0xc]
mov dword [ebx + 0x18], esi
mov dword [ebx + 0x1c], ecx
mov dword [ebx + 0x20], edx
mov dword [ebx + 0x28], eax
cmp byte [ebx + 4], 0
je 0x656171
mov eax, dword [ebp - 4]
add dword [ebx + 0x44], eax
mov eax, dword [ebp - 4]
add dword [ebx + 0x48], eax
cmp byte [ebx + 0x34], 0
je 0x65618b
mov eax, dword [ebx + 0x44]
cmp eax, dword [ebx + 0x40]
jb 0x65618b
mov eax, ebx
call fcn.00656534
jmp 0x65618b
mov edx, eax
sub edx, dword [ebx + 0x44]
cmp edx, dword [ebx + 0x60]
jl 0x65618b
mov byte [ebx + 4], 1
sub eax, dword [ebx + 0x60]
sub eax, dword [ebx + 0x44]
add dword [ebx + 0x44], eax
add dword [ebx + 0x48], eax
cmp word [ebx + 0x3a], 0
je 0x6561c1
mov eax, dword [ebp - 4]
add dword [ebx + 0x10], eax
mov esi, dword [ebx + 0x10]
test esi, 0xfff
jne 0x6561c1
mov dword [ebp - 0x14], esi
fild dword [ebp - 0x14]
fmul dword [0x6561d8]
fild qword [ebx + 0x50]
fdivp st(1)
call fcn.004078b0
mov edx, eax
mov eax, dword [ebx + 0x3c]
call dword [ebx + 0x38]
mov eax, dword [ebx + 0x44]
cmp eax, dword [ebx + 0x40]
jb 0x6561d0
mov eax, ebx
call fcn.00656534
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x65f328
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 4], edx
mov ebx, eax
mov byte [ebp - 5], 0
test ebx, ebx
je 0x65f3ae
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
cmp edx, 0
jne 0x65f351
cmp eax, 0x1d08
jae 0x65f353
jmp 0x65f3ae
jl 0x65f3ae
xor ecx, ecx
xor edx, edx
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0x1c]
mov edx, dword [ebp - 4]
mov ecx, 0x1d08
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, dword [ebp - 4]
mov ecx, 2
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, ecx
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov esi, eax
movzx eax, byte [esi]
mov edx, dword [ebp - 4]
xor al, byte [edx]
push eax
pop eax
mov byte [esi], al
inc ecx
cmp ecx, 0x1d08
jne 0x65f375
mov eax, dword [ebp - 4]
cmp word [eax + 2], 0xff
ja 0x65f3ae
mov byte [ebp - 5], 1
movzx eax, byte [ebp - 5]
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x65f3b8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffff2e0
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x1d20]
push ecx
mov ecx, 0x742
rep movsd dword es:[edi], dword [esi]
pop ecx
mov edi, ecx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
mov eax, esi
call fcn.004a2ddc
cmp dword [ebp - 4], 0
je 0x65f55a
test esi, esi
je 0x65f55a
movzx eax, word [ebp - 0x1d1e]
cmp ax, 0xff
ja 0x65f55a
movzx eax, ax
cmp edi, eax
jge 0x65f55a
cmp edi, 0xff
jbe 0x65f428
call fcn.004089ac
imul eax, edi, 0x1d
cmp dword [ebp + eax - 0x1d03], 0
je 0x65f55a
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx]
push edx
push eax
cmp edi, 0xff
jbe 0x65f44f
call fcn.004089ac
imul eax, edi, 0x1d
mov eax, dword [ebp + eax - 0x1d03]
cmp edi, 0xff
jbe 0x65f466
call fcn.004089ac
imul edx, edi, 0x1d
add eax, dword [ebp + edx - 0x1cff]
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x65f484
cmp eax, dword [esp]
pop edx
pop eax
jbe 0x65f48c
jmp 0x65f55a
pop edx
pop eax
jg 0x65f55a
cmp edi, 0xff
jbe 0x65f499
call fcn.004089ac
imul eax, edi, 0x1d
mov eax, dword [ebp + eax - 0x1cff]
xor edx, edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
push dword [ebp - 0xc]
push dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x20]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
cmp edi, 0xff
jbe 0x65f4ce
call fcn.004089ac
imul eax, edi, 0x1d
mov eax, dword [ebp + eax - 0x1d03]
xor edx, edx
push edx
push eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 8]
cmp edi, 0xff
jbe 0x65f4f0
call fcn.004089ac
imul eax, edi, 0x1d
mov ecx, dword [ebp + eax - 0x1d03]
test ecx, ecx
jns 0x65f503
call fcn.004089ac
mov edx, dword [esi + 4]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, esi
mov edx, dword [eax]
call dword [edx]
sub eax, 1
sbb edx, 0
push eax
sar eax, 0x1f
cmp eax, edx
pop eax
je 0x65f528
call fcn.004089ac
mov ebx, eax
test ebx, ebx
jl 0x65f558
inc ebx
xor ecx, ecx
mov eax, dword [esi + 4]
xor edx, edx
push edx
push eax
mov eax, ecx
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edi, eax
movzx eax, byte [edi]
xor al, byte [ebp - 0x1d20]
push eax
pop eax
mov byte [edi], al
inc ecx
dec ebx
jne 0x65f531
mov bl, 1
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x66e668
Capabilities:
Inspect section memory permissions

Disassembly:
xor edx, edx
test eax, 0x4000000
je 0x66e677
or edx, 0x200
test eax, 0x20000000
je 0x66e6ab
test eax, 0x40000000
je 0x66e696
test eax, 0x80000000
je 0x66e691
or edx, 0x40
jmp 0x66e6d2
or edx, 0x20
jmp 0x66e6d2
test eax, 0x80000000
je 0x66e6a5
or edx, 0x80
jmp 0x66e6d2
or edx, 0x10
mov eax, edx
ret
test eax, 0x40000000
je 0x66e6c3
test eax, 0x80000000
je 0x66e6be
or edx, 4
jmp 0x66e6d2
or edx, 2
jmp 0x66e6d2
test eax, 0x80000000
je 0x66e6cf
or edx, 8
jmp 0x66e6d2
or edx, 1
mov eax, edx
ret
Function at 0x6753e0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x6755c4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
call fcn.0063ed80
cmp ebx, eax
jl 0x675447
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x14], 0
lea eax, [ebp - 0x18]
push eax
push 0
lea edx, [ebp - 0x1c]
mov eax, dword [0x8c24d8]
call fcn.00410254
mov ecx, dword [ebp - 0x1c]
mov dl, 1
mov eax, dword [0x41d20c]
call fcn.0042b008
call fcn.00409e94
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov edx, ebx
call fcn.0063ed68
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax + 0x6a]
sub al, 2
jne 0x675473
mov dl, 1
mov eax, dword [0x6354d0]
call fcn.00637f20
call fcn.00409e94
mov eax, dword [ebp - 0x10]
cmp byte [eax + 0x6a], 1
jne 0x6754ce
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x675493
sub eax, 4
mov eax, dword [eax]
cmp eax, 0x64
jl 0x67549c
mov al, 1
jmp 0x6754b9
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0x10]
call fcn.00672e4c
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x6754b3
sub eax, 4
mov eax, dword [eax]
cmp eax, 0x64
setge al
test al, al
je 0x6754ce
mov dl, 1
mov eax, dword [0x6354d0]
call fcn.00637f20
call fcn.00409e94
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x10]
test al, al
je 0x6754e7
mov eax, dword [ebp - 8]
call fcn.00638250
jmp 0x675580
push 0xff40
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x4817c0]
call fcn.004a2a38
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x67554e
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x67553d
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 0xc]
mov edx, ebx
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x675544
mov eax, dword [ebp - 0xc]
call fcn.00408ac4
ret
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x48]
add esp, 0xfffffff8
fstp qword [esp]
wait
mov eax, dword [ebp - 8]
call fcn.006399a4
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x20]
mov edx, eax
mov eax, dword [ebp - 8]
call fcn.00639a60
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6755cb
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.0040a7f0
ret