joyce8/EMBER2024-capa huggingface dataset:
Function at 0x694c70
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.004044cc
xor eax, eax
push ebp
push 0x694dad
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
lea eax, [ebp - 0x18]
call fcn.0069495c
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov ecx, 0x694dc4
call fcn.00404364
mov eax, dword [ebp - 0x14]
call fcn.0040ab94
test al, al
je 0x694cd1
mov eax, dword [ebp - 0x14]
call fcn.004044dc
push eax
call sub.kernel32.dll_DeleteFileA_1
xor edx, edx
push ebp
push 0x694d2b
push dword fs:[edx]
mov dword fs:[edx], esp
push 0xffff
mov ecx, dword [ebp - 0x14]
mov dl, 1
mov eax, dword [0x412984]
call fcn.00416864
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x694d32
mov eax, dword [ebp - 4]
call fcn.00694a38
mov ebx, eax
mov ecx, ebx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
call fcn.004166a0
cmp ebx, eax
jne 0x694d22
mov byte [ebp - 9], 1
mov eax, dword [ebp - 0x10]
call fcn.00403260
ret

Function at 0x694dd0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.004044cc
xor eax, eax
push ebp
push 0x694f56
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404120
mov eax, dword [ebp - 4]
call fcn.0040ab94
test al, al
jne 0x694e17
xor ebx, ebx
jmp 0x694f33
xor ecx, ecx
mov dl, 1
mov eax, dword [0x68db90]
call fcn.006908d8
mov ebx, eax
lea eax, [ebp - 0xc]
call fcn.0069495c
lea eax, [ebp - 0xc]
mov edx, 0x694f70
call fcn.00404320
mov edx, dword [ebp - 0xc]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov eax, dword [ebx + 0x30]
mov edx, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov byte [ebx + 0x194], 1
mov dl, 1
mov eax, ebx
call fcn.00690d34
mov dword [ebx + 0x190], 9
mov eax, ebx
call fcn.00690dd0
mov eax, ebx
call fcn.00403260
xor eax, eax
push ebp
push 0x694ef0
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 0x10]
call fcn.0069495c
lea eax, [ebp - 0x10]
mov edx, 0x694f70
call fcn.00404320
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x412984]
call fcn.00416864
mov ebx, eax
mov eax, dword [esi]
xor ecx, ecx
mov edx, ebx
call fcn.004166a0
mov eax, ebx
call fcn.00403260
lea eax, [ebp - 0x14]
call fcn.0069495c
lea eax, [ebp - 0x14]
mov edx, 0x694f70
call fcn.00404320
mov eax, dword [ebp - 0x14]
call fcn.004044dc
push eax
call sub.kernel32.dll_DeleteFileA_1
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x694f33
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x694f5d
lea eax, [ebp - 0x18]
mov edx, 5
call fcn.004040ac
lea eax, [ebp - 4]
call fcn.00404088
ret
Function at 0x695498
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, eax
mov dword [ebp - 8], 0x10
mov eax, ebx
call fcn.00404088
mov eax, dword [ebp - 8]
call fcn.00402858
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x6954f9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x6954e3
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00404250
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x695500
mov eax, dword [ebp - 4]
call fcn.00402870
ret

Function at 0x69649c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.004044cc
mov eax, dword [ebp - 8]
call fcn.004044cc
xor eax, eax
push ebp
push 0x696555
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
mov eax, dword [ebp - 8]
call fcn.00404318
mov ebx, eax
test ebx, ebx
jle 0x6964fb
mov esi, 1
mov eax, dword [ebp - 8]
movzx eax, byte [eax + esi - 1]
cmp edi, eax
jge 0x6964f7
mov edx, dword [ebp - 8]
mov edi, eax
inc esi
dec ebx
jne 0x6964e6
mov eax, dword [ebp - 4]
call fcn.00404318
mov ebx, eax
test ebx, ebx
jle 0x69652f
mov esi, 1
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
movzx edx, byte [edx + esi - 1]
xor edx, edi
call fcn.00404230
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.00404320
inc esi
dec ebx
jne 0x69650e
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
call fcn.004040dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x69655c
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.004040ac
ret
Function at 0x6e341c
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
xor ecx, ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004044cc
xor eax, eax
push ebp
push 0x6e3600
push dword fs:[eax]
mov dword fs:[eax], esp
test byte [ebx + 0x20], 0x10
jne 0x6e35d8
mov dword [ebp - 0xc], 0x10
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x21]
push eax
call sub.kernel32.dll_GetComputerNameA
lea eax, [ebx + 0x318]
mov edx, dword [ebp - 4]
call fcn.004040dc
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404120
mov edx, dword [ebp - 4]
mov eax, 0x6e3614
call fcn.00404604
test eax, eax
jne 0x6e34b3
mov edx, dword [ebx + 0x318]
mov eax, dword [ebx + 0x300]
call fcn.0051caec
jmp 0x6e34c1
mov edx, dword [ebp - 8]
mov eax, dword [ebx + 0x300]
call fcn.0051ca6c
mov eax, dword [ebx + 0x300]
call fcn.0051cc18
lea edx, [ebp - 8]
mov eax, dword [ebx + 0x300]
mov eax, dword [eax + 0x80]
call fcn.0051c1a0
lea edx, [ebp - 0x28]
mov eax, dword [ebx + 0x300]
mov eax, dword [eax + 0x80]
call fcn.0051c114
mov edx, dword [ebp - 0x28]
lea eax, [ebx + 0x31c]
call fcn.004040dc
mov eax, dword [ebx + 0x300]
call fcn.0051cc20
mov edx, dword [ebp - 8]
mov eax, dword [ebx + 0x300]
call fcn.0051ca6c
xor edx, edx
mov eax, dword [ebx + 0x300]
call fcn.0051caec
cmp dword [ebp - 4], 0
je 0x6e359c
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 4]
call fcn.0040a27c
mov eax, dword [ebp - 0x2c]
push eax
lea eax, [ebp - 0x34]
lea edx, [ebp - 0x21]
mov ecx, 0x15
call fcn.004042c8
mov eax, dword [ebp - 0x34]
lea edx, [ebp - 0x30]
call fcn.0040a27c
mov edx, dword [ebp - 0x30]
pop eax
call fcn.00404428
je 0x6e359c
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 4]
call fcn.0040a27c
mov eax, dword [ebp - 0x38]
push eax
lea edx, [ebp - 0x40]
mov eax, dword [ebx + 0x300]
mov eax, dword [eax + 0x80]
call fcn.0051c114
mov eax, dword [ebp - 0x40]
lea edx, [ebp - 0x3c]
call fcn.0040a27c
mov edx, dword [ebp - 0x3c]
pop eax
call fcn.00404428
jne 0x6e35a5
mov byte [ebx + 0x32c], 1
jmp 0x6e35ac
mov byte [ebx + 0x32c], 0
lea eax, [ebp - 8]
mov edx, 0x6e3620
call fcn.00404320
mov edx, dword [ebp - 8]
mov eax, dword [ebx + 0x304]
mov ecx, dword [eax]
call dword [ecx + 0x50]
inc eax
jne 0x6e35d8
mov edx, dword [ebp - 8]
mov eax, dword [ebx + 0x304]
mov ecx, dword [eax]
call dword [ecx + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6e3607
lea eax, [ebp - 0x40]
mov edx, 7
call fcn.004040ac
lea eax, [ebp - 8]
mov edx, 2
call fcn.004040ac
ret

Function at 0x8a0c78
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004044dc
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
setne al
pop ebx
ret
Function at 0x8ad3ac
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x8ad3d9
mov eax, ebx
call fcn.008ad33c
cmp byte [ebx + 0x38], 0
je 0x8ad3d2
mov dword [ebx + 0x10], 0xcf
mov al, 1
pop esi
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
mov eax, dword [ebx + 0x10]
cmp eax, 0xcb
jne 0x8ad446
mov eax, dword [ebx + 0x178]
cmp byte [eax + 0x10], 0
je 0x8ad43e
mov eax, dword [ebx + 8]
test eax, eax
je 0x8ad3fc
mov esi, eax
mov eax, ebx
call dword [esi]
mov esi, dword [ebx + 0x178]
mov eax, ebx
call dword [esi]
test eax, eax
jne 0x8ad40f
xor eax, eax
pop esi
pop ebx
ret
cmp eax, 2
je 0x8ad43e
cmp dword [ebx + 8], 0
je 0x8ad3ef
cmp eax, 3
je 0x8ad422
dec eax
jne 0x8ad3ef
mov eax, dword [ebx + 8]
inc dword [eax + 4]
mov eax, dword [ebx + 8]
mov edx, dword [eax + 4]
cmp edx, dword [eax + 8]
jl 0x8ad3ef
mov edx, dword [ebx + 0x104]
add dword [eax + 8], edx
jmp 0x8ad3ef
mov eax, dword [ebx + 0x68]
mov dword [ebx + 0x70], eax
jmp 0x8ad458
cmp eax, 0xcc
je 0x8ad458
mov ecx, eax
mov dl, 0x12
mov eax, ebx
call fcn.008a1638
mov eax, ebx
call fcn.008ad464
pop esi
pop ebx
ret

Function at 0x8b6014
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
cmp dword [esp + 0x10], 2
jne 0x8b6039
cmp dword [esp + 4], 5
jb 0x8b6039
mov al, 1
jmp 0x8b603b
xor eax, eax
add esp, 0x94
ret
Function at 0x8d1bc0
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xffffff34
mov ebx, eax
push esp
push 0xc9
call sub.kernel32.dll_GetTempPathA
push esp
push 0
push 0x8d1bf8
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetTempFileNameA
mov edx, ebx
mov eax, esp
call fcn.0040b56c
add esp, 0xcc
pop ebx
ret

Function at 0x8dbaa4
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x8dbbd2
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, dword [ebx + 0x308]
mov dl, byte [edx + 0x254]
call fcn.00404230
mov eax, dword [ebp - 4]
mov edx, 0x8dbbe8
call fcn.00404428
je 0x8dbaee
mov eax, dword [ebp - 4]
mov edx, 0x8dbbf4
call fcn.00404428
jne 0x8dbb1e
push 0x40
mov ecx, 0x8dbbf8
mov edx, 0x8dbc04
mov eax, dword [0x9b8724]
mov eax, dword [eax]
call fcn.0045b480
mov eax, dword [ebx + 0x30c]
call fcn.00523dd4
mov edx, eax
mov eax, dword [ebx + 0x308]
call fcn.00522cd0
lea eax, [ebp - 8]
mov edx, dword [ebx + 0x308]
mov dl, byte [edx + 0x254]
call fcn.00404230
lea eax, [ebp - 8]
mov edx, 0x8dbc48
call fcn.00404320
mov edx, dword [ebp - 8]
mov eax, 0x9bdafc
call fcn.0040b3cc
push 0x9bdaf8
push 0x9bdaf4
push 0x9bdaf0
push 0x9bdaec
push 0x9bdafc
call sub.kernel32.dll_GetDiskFreeSpaceA
test eax, eax
je 0x8dbb87
mov eax, dword [ebx + 0x308]
mov dl, byte [eax + 0x254]
mov eax, dword [ebx + 0x30c]
call fcn.00523de0
jmp 0x8dbbb7
mov eax, dword [ebx + 0x30c]
call fcn.00523dd4
mov edx, eax
mov eax, dword [ebx + 0x308]
call fcn.00522cd0
push 0x10
mov ecx, 0x8dbc4c
mov edx, 0x8dbc58
mov eax, dword [0x9b8724]
mov eax, dword [eax]
call fcn.0045b480
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x8dbbd9
lea eax, [ebp - 8]
mov edx, 2
call fcn.004040ac
ret
Function at 0x8e88d8
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x8e89c3
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, dword [esi + 0x28]
mov eax, ebx
call fcn.004a51e8
mov edx, 0x8e89d8
mov eax, dword [ebx + 0x238]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, ebx
call fcn.004a51dc
mov eax, ebx
call fcn.004a7260
test al, al
jne 0x8e893e
mov edx, 0x8e8a38
mov eax, ebx
call fcn.004a60d8
lea edx, [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x58]
mov eax, dword [ebp - 4]
call fcn.0040a988
mov dword [esi + 0x48], eax
jmp 0x8e8943
xor eax, eax
mov dword [esi + 0x48], eax
mov eax, ebx
call fcn.004a51e8
mov edx, 0x8e8a48
mov eax, dword [ebx + 0x238]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, ebx
call fcn.004a51dc
mov eax, ebx
call fcn.004a7260
test al, al
jne 0x8e898d
mov edx, 0x8e8a38
mov eax, ebx
call fcn.004a60d8
lea edx, [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x58]
mov eax, dword [ebp - 8]
call fcn.0040a988
mov dword [esi + 0x4c], eax
jmp 0x8e8992
xor eax, eax
mov dword [esi + 0x4c], eax
cmp dword [esi + 0x48], 0
je 0x8e899e
cmp dword [esi + 0x4c], 0
jne 0x8e89a4
mov byte [esi + 0x40], 0
jmp 0x8e89a8
mov byte [esi + 0x40], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x8e89ca
lea eax, [ebp - 8]
mov edx, 2
call fcn.004040ac
ret

Function at 0x8e9ed4
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], ebx
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004044cc
mov eax, dword [ebp - 8]
call fcn.004044cc
xor eax, eax
push ebp
push 0x8ea00a
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x8e9fdb
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4b3600]
call fcn.004c26f8
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.004bd244
push 0x8ea020
push dword [ebp - 8]
push 0x8ea074
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.004043d8
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x238]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebp - 0xc]
call fcn.004a51dc
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x14c]
test eax, eax
je 0x8e9fbe
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x24]
mov edx, 1
call fcn.0049b520
lea edx, [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x58]
push dword [ebp - 0x14]
push 0x8ea080
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x24]
xor edx, edx
call fcn.0049b520
lea edx, [ebp - 0x18]
mov ecx, dword [eax]
call dword [ecx + 0x58]
push dword [ebp - 0x18]
mov eax, ebx
mov edx, 3
call fcn.004043d8
jmp 0x8e9fc5
mov eax, ebx
call fcn.00404088
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x8e9fe2
mov eax, dword [ebp - 0xc]
call fcn.00403260
ret
Function at 0x930ec0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe6c
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x194], ecx
test dl, dl
je 0x930edf
add esp, 0xfffffff0
call fcn.004035a0
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x930f6a
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, esi
call fcn.00931d88
lea eax, [ebp - 0x190]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
inc eax
jne 0x930f24
mov ecx, 0x930f98
mov dl, 1
mov eax, dword [0x409664]
call fcn.0040e274
call fcn.00403ab8
lea edx, [ebp - 0x194]
lea eax, [ebp - 0x18c]
call fcn.0040b56c
mov edx, dword [ebp - 0x194]
lea eax, [esi + 4]
call fcn.004040dc
movzx eax, word [ebp - 8]
mov dword [esi + 0xc], eax
movzx eax, word [ebp - 0xa]
mov dword [esi + 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x930f71
lea eax, [ebp - 0x194]
call fcn.00404088
ret

Function at 0x934e60
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push ecx
mov esi, ecx
mov ebx, edx
push 2
push 0
push 0
push ebx
call sub.kernel32.dll_SetFilePointer_1
push 0
lea eax, [esp + 4]
push eax
mov eax, esi
call fcn.00404318
push eax
mov eax, esi
call fcn.004044dc
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
pop edx
pop esi
pop ebx
ret

Function at 0x9394a4
Capabilities:
Encrypt data using des

Disassembly:
push ebx
mov ecx, edx
and cl, 0x20
mov ebx, edx
and bl, 0x1e
and ebx, 0xff
shr ebx, 1
or cl, bl
and dl, 1
shl edx, 4
or cl, dl
mov edx, ecx
and edx, 0xff
and eax, 0xff
shl eax, 3
lea eax, [eax*8 + 0x9b7904]
mov al, byte [eax + edx]
and al, 0xf
pop ebx
ret

Function at 0x9394e0
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, edx
test ebx, ebx
js 0x9394f8
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x9394f1
mov eax, esp
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
xor ecx, ecx
mov edx, 7
call fcn.00402e48
xor edx, edx
mov eax, 0x9b7b04
mov bl, byte [eax]
mov ecx, ebx
and cl, 7
and ecx, 0xff
push ecx
mov ecx, 7
pop esi
sub ecx, esi
mov esi, 1
shl esi, cl
xor ecx, ecx
mov cl, bl
shr ecx, 3
mov ebx, dword [ebp - 4]
movzx ecx, byte [ebx + ecx]
and esi, ecx
je 0x939562
mov ecx, edx
and ecx, 7
push ecx
mov ecx, 7
pop ebx
sub ecx, ebx
mov bl, 1
shl bl, cl
mov ecx, edx
shr ecx, 3
mov esi, dword [ebp - 8]
or byte [esi + ecx], bl
inc edx
inc eax
cmp edx, 0x38
jne 0x939516
mov esi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x9397a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov ebx, dword [ebp + 0x10]
test ebx, ebx
js 0x9397b9
shr ebx, 2
mov esi, dword [ecx + ebx*4]
dec ebx
push esi
jns 0x9397b2
mov ecx, esp
mov ebx, edx
test ebx, ebx
js 0x9397cb
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x9397c4
mov eax, esp
mov dword [ebp - 4], ecx
push 5
lea ecx, [ebp - 0xa]
call fcn.00939394
mov ebx, 6
mov eax, dword [ebp - 4]
lea edx, [ebp - 0xa]
mov cl, byte [eax]
xor byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x9397e5
mov al, byte [ebp - 0xa]
xor edx, edx
mov dl, al
shr edx, 2
mov byte [ebp - 0x12], dl
and al, 3
shl eax, 4
mov dl, byte [ebp - 9]
xor ecx, ecx
mov cl, dl
shr ecx, 4
or al, cl
mov byte [ebp - 0x11], al
and dl, 0xf
shl edx, 2
mov al, byte [ebp - 8]
xor ecx, ecx
mov cl, al
shr ecx, 6
or dl, cl
mov byte [ebp - 0x10], dl
and al, 0x3f
mov byte [ebp - 0xf], al
mov al, byte [ebp - 7]
xor edx, edx
mov dl, al
shr edx, 2
mov byte [ebp - 0xe], dl
and al, 3
shl eax, 4
xor edx, edx
mov dl, byte [ebp - 6]
shr edx, 4
or al, dl
mov byte [ebp - 0xd], al
mov al, byte [ebp - 6]
and al, 0xf
shl eax, 2
xor edx, edx
mov dl, byte [ebp - 5]
shr edx, 6
or al, dl
mov byte [ebp - 0xc], al
mov al, byte [ebp - 5]
and al, 0x3f
mov byte [ebp - 0xb], al
xor ebx, ebx
lea esi, [ebp - 0x12]
mov eax, ebx
mov dl, byte [esi]
call fcn.009394a4
mov byte [esi], al
inc ebx
inc esi
cmp ebx, 8
jne 0x93986a
mov ebx, 4
lea eax, [ebp - 0x12]
lea edx, [ebp - 0xa]
mov cl, byte [eax]
shl ecx, 4
or cl, byte [eax + 1]
mov byte [edx], cl
inc edx
add eax, 2
dec ebx
jne 0x939887
lea eax, [ebp - 0xa]
mov edx, 5
call fcn.00939424
mov ebx, 4
lea eax, [ebp - 0xa]
mov edx, dword [ebp + 0xc]
mov cl, byte [eax]
mov byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x9398b0
mov esi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x9398c8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov ebx, ecx
test ebx, ebx
js 0x9398e1
shr ebx, 2
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x9398da
mov edx, esp
mov dword [ebp - 4], edx
mov ebx, eax
mov dword [ebp - 8], 8
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov dl, byte [eax]
mov byte [ecx], dl
inc ecx
inc eax
dec dword [ebp - 8]
jne 0x9398f5
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.0093928c
test bl, bl
jne 0x9399c8
mov dword [ebp - 8], 0x10
mov dword [ebp - 0x14], 0x9bdd7c
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
mov cl, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x93992c
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
mov cl, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x939940
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.009397a0
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
mov bl, byte [edx]
xor bl, byte [esi]
mov byte [ecx], bl
inc ecx
inc esi
inc edx
dec eax
jne 0x939972
add dword [ebp - 0x14], 6
dec dword [ebp - 8]
jne 0x939921
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ecx, [ebp - 0xc]
mov bl, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x939995
mov eax, 4
mov edx, dword [ebp + 0xc]
mov cl, byte [edx]
mov byte [edx + 4], cl
inc edx
dec eax
jne 0x9399a6
mov eax, 4
lea edx, [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
mov bl, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x9399ba
jmp 0x939a83
cmp bl, 1
jne 0x939a83
mov dword [ebp - 8], 0xfffffff0
mov ebx, 0x9bddd6
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
mov cl, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x9399e8
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
mov cl, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x9399fc
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov ecx, ebx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.009397a0
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
mov dword [ebp - 0x18], ecx
mov cl, byte [edx]
xor cl, byte [esi]
mov edi, dword [ebp - 0x18]
mov byte [edi], cl
inc dword [ebp - 0x18]
inc esi
inc edx
dec eax
jne 0x939a2e
sub ebx, 6
inc dword [ebp - 8]
jne 0x9399dd
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ebx, [ebp - 0xc]
mov cl, byte [edx]
mov byte [ebx], cl
inc ebx
inc edx
dec eax
jne 0x939a55
mov eax, 4
mov ebx, dword [ebp + 0xc]
mov dl, byte [ebx]
mov byte [ebx + 4], dl
inc ebx
dec eax
jne 0x939a66
mov eax, 4
lea ebx, [ebp - 0xc]
mov edx, dword [ebp + 0xc]
mov cl, byte [ebx]
mov byte [edx], cl
inc edx
inc ebx
dec eax
jne 0x939a7a
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.00939310
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret 8
Function at 0x93a9e0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffb6c
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x494], edx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x93ac1a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0093ad48
lea eax, [ebp - 0x490]
xor ecx, ecx
mov edx, 0x41c
call fcn.00402e48
mov dword [ebp - 0x490], 0x41c
lea eax, [ebp - 0x48c]
mov edx, dword [ebx + 0x3c]
call fcn.0040b3cc
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x490]
push eax
push 0
call fcn.0093c478
mov esi, eax
lea eax, [ebp - 0x289]
mov edx, dword [ebx + 0x24]
call fcn.0040b3cc
lea eax, [ebp - 0x188]
mov edx, dword [ebx + 0x28]
call fcn.0040b3cc
lea eax, [ebp - 0x87]
mov edx, dword [ebx + 0x30]
call fcn.0040b3cc
lea eax, [ebp - 0x38b]
mov edx, dword [ebx + 0x2c]
call fcn.0040b3cc
test esi, esi
je 0x93aab2
mov dword [ebp - 4], esi
cmp word [ebx + 0xa2], 0
je 0x93abf9
push 0x93ac34
mov ecx, esi
mov edx, ebx
mov eax, dword [ebx + 0xa4]
call dword [ebx + 0xa0]
jmp 0x93abf9
xor eax, eax
mov dword [ebx + 0xb0], eax
cmp byte [ebx + 0x38], 1
jne 0x93ab74
cmp word [ebx + 0x82], 0
je 0x93aadc
mov edx, ebx
mov eax, dword [ebx + 0x84]
call dword [ebx + 0x80]
lea eax, [ebx + 0xb0]
push eax
push 0
push 0
lea eax, [ebp - 0x490]
push eax
push 0
push 0
call fcn.0093c340
mov esi, eax
test esi, esi
jne 0x93ab1e
cmp word [ebx + 0x8a], 0
je 0x93abf6
mov edx, ebx
mov eax, dword [ebx + 0x8c]
call dword [ebx + 0x88]
jmp 0x93abf6
mov eax, dword [ebx + 0xb0]
test eax, eax
je 0x93ab31
mov edx, eax
mov eax, ebx
call fcn.0093ad54
push 0x64
lea eax, [ebp - 0x71]
push eax
push esi
call fcn.0093c408
lea eax, [ebp - 0xc]
lea edx, [ebp - 0x71]
mov ecx, 0x65
call fcn.004042c8
cmp word [ebx + 0x92], 0
je 0x93abf6
mov eax, dword [ebp - 0xc]
push eax
mov ecx, esi
mov edx, ebx
mov eax, dword [ebx + 0x94]
call dword [ebx + 0x90]
jmp 0x93abf6
mov dword [0x9bdde4], ebx
cmp word [ebx + 0x82], 0
je 0x93ab92
mov edx, ebx
mov eax, dword [ebx + 0x84]
call dword [ebx + 0x80]
lea eax, [ebx + 0xb0]
push eax
push 0x93a8b4
push 0
lea eax, [ebp - 0x490]
push eax
push 0
push 0
call fcn.0093c340
mov esi, eax
test esi, esi
je 0x93abf6
push 0x64
lea eax, [ebp - 0x71]
push eax
push esi
call fcn.0093c408
cmp word [ebx + 0xa2], 0
je 0x93abf6
lea eax, [ebp - 0x494]
lea edx, [ebp - 0x71]
mov ecx, 0x65
call fcn.004042c8
mov eax, dword [ebp - 0x494]
push eax
mov ecx, esi
mov edx, ebx
mov eax, dword [ebx + 0xa4]
call dword [ebx + 0xa0]
mov dword [ebp - 4], esi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x93ac21
lea eax, [ebp - 0x494]
call fcn.00404088
lea eax, [ebp - 0xc]
call fcn.00404088
ret