joyce8/EMBER2024-capa huggingface dataset:
Function at 0x424ee5
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x435168]
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor ebx, ebx
push str.kernel32.dll
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], ebx
xor esi, esi
call edi
push str.GetUserDefaultUILanguage
push eax
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x424f87
call eax
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov ebx, 0x3ff
mov edi, 0xfc00
mov dword [ebp - 0x18], eax
movzx eax, ax
mov ecx, eax
and ecx, ebx
movzx ecx, cx
and eax, edi
or eax, ecx
push eax
mov dword [ebp - 0x1c], ecx
call esi
push dword [ebp - 0x1c]
mov dword [ebp - 0x3c], eax
call esi
push str.GetSystemDefaultUILanguage
push dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
mov dword [ebp - 0x18], eax
movzx eax, ax
mov ecx, eax
and ecx, ebx
movzx ebx, cx
and eax, edi
or eax, ebx
push eax
call esi
push ebx
mov dword [ebp - 0x34], eax
call esi
mov dword [ebp - 0x30], eax
push 4
xor ebx, ebx
jmp 0x425089
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jns 0x425037
lea eax, [ebp - 0x1c]
push eax
push 0x20019
push ebx
push str.Control_PanelDesktopResourceLocale
push SysReAllocString
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42508a
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x24]
push eax
push ebx
push ebx
push dword [ebp - 0x1c]
mov dword [ebp - 0x20], 0x10
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x42502c
cmp dword [ebp - 0x24], 1
jne 0x42502c
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x14]
push 0x42b0cc
push eax
call fcn.0040cb2f
add esp, 0xc
cmp eax, 1
jne 0x42502c
mov eax, dword [ebp - 0x28]
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov dword [ebp - 0x18], eax
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
movzx edi, cx
and eax, 0xfc00
or eax, edi
push eax
call esi
push edi
mov dword [ebp - 0x3c], eax
call esi
push 2
mov dword [ebp - 0x38], eax
pop esi
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x42508a
push str.ntdll.dll
call edi
cmp eax, ebx
je 0x42508a
lea ecx, [ebp - 0x18]
push ecx
push 0x424ecf
push 1
push 0x10
push eax
mov dword [ebp - 0x18], ebx
call dword [sym.imp.KERNEL32.dll_EnumResourceLanguagesA]
cmp word [ebp - 0x18], bx
je 0x42508a
movzx eax, word [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov ecx, eax
and ecx, 0x3ff
movzx edi, cx
and eax, 0xfc00
or eax, edi
push eax
call esi
push edi
mov dword [ebp - 0x3c], eax
call esi
mov dword [ebp - 0x38], eax
push 2
pop esi
mov dword [ebp + esi*4 - 0x3c], 0x800
inc esi
xor edi, edi
cmp esi, ebx
jle 0x4250b0
push dword [ebp + edi*4 - 0x3c]
push dword [ebp + 8]
call fcn.00424e50
cmp eax, ebx
pop ecx
pop ecx
jne 0x4250b2
inc edi
cmp edi, esi
jl 0x425099
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0040b516
leave
ret 4
Function at 0x4250c1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push edi
xor edi, edi
mov dword [ecx + 0x9c], edi
cmp dword [str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer], edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0xc], edi
mov ebx, 0x434758
je 0x42517d
push esi
lea eax, [ebp - 4]
push eax
push 1
push edi
push dword [ebx]
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x425165
mov esi, dword [ebx + 4]
jmp 0x42515f
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push edi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x42514f
cmp dword [ebp - 0xc], 4
jne 0x42514f
cmp dword [ebp - 8], edi
mov eax, dword [ebp - 0x10]
mov ecx, dword [esi + 4]
je 0x425147
or dword [eax + 0x9c], ecx
jmp 0x42514f
not ecx
and dword [eax + 0x9c], ecx
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0xc], edi
add esi, 8
mov eax, dword [esi]
cmp eax, edi
jne 0x425113
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add ebx, 8
cmp dword [ebx], edi
mov dword [ebp - 4], edi
jne 0x4250f6
pop esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
inc eax
pop ebx
leave
ret

Function at 0x425536
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x428624
call fcn.0040c184
sub esp, 0x11c
mov eax, dword [0x435168]
push ebx
push esi
push edi
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x10], esp
lea ecx, [ebp - 0x124]
push ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov esi, eax
test esi, esi
jne 0x42562f
push 0x104
lea eax, [ebp - 0x11c]
push eax
push 0
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov esi, eax
test esi, esi
jne 0x425603
and dword [ebp - 4], eax
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x120]
call fcn.004027f2
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0x124]
mov byte [ebp - 4], 1
call fcn.00425536
mov ecx, dword [ebp - 0x120]
mov esi, eax
test esi, esi
setne bl
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.004017e9
test bl, bl
jne 0x425603
or dword [ebp - 4], 0xffffffff
jmp 0x425574
cmp esi, 0x103
je 0x425613
cmp esi, 0x3f2
jne 0x425623
mov eax, dword [ebp + 0xc]
push dword [eax]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
mov eax, esi
call fcn.0040b516
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x425c68
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [esp + 0x10]
test edi, edi
jle 0x425c9d
cmp edi, dword [esi + 0xc]
jge 0x425c9d
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x425c9d
cmp edi, dword [eax + 8]
jge 0x425c9d
mov eax, dword [eax + 0xc]
mov edi, dword [eax + edi*4]
jmp 0x425c9f
xor edi, edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
pop ebx
ret 4

Function at 0x425da3
Capabilities:
Allocate thread local storage

Disassembly:
xor eax, eax
push esi
mov esi, ecx
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x18], 4
mov dword [esi + 4], eax
mov dword [esi + 8], 1
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x425dd7
jmp fcn.0041756b
lea eax, [esi + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, esi
pop esi
ret

Function at 0x425e48
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x1c]
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp eax, ebx
jle 0x425f41
cmp eax, dword [edi + 0xc]
jge 0x425f41
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
cmp esi, ebx
je 0x425e99
mov ecx, dword [ebp + 8]
cmp ecx, dword [esi + 8]
jl 0x425f2a
cmp dword [ebp + 0xc], ebx
je 0x425f2a
jmp 0x425ec3
push 0x10
call fcn.00425b34
cmp eax, ebx
je 0x425eaf
mov ecx, eax
call fcn.00425d9a
mov esi, eax
jmp 0x425eb1
xor esi, esi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov ecx, dword [edi + 0x14]
mov eax, dword [edi + 0x18]
mov dword [esi + eax], ecx
mov dword [edi + 0x14], esi
mov eax, dword [esi + 0xc]
cmp eax, ebx
jne 0x425eda
mov eax, dword [edi + 0xc]
shl eax, 2
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
jmp 0x425eea
mov ecx, dword [edi + 0xc]
push 2
shl ecx, 2
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
cmp eax, ebx
jne 0x425efc
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.0041756b
mov ecx, dword [esi + 8]
mov dword [esi + 0xc], eax
mov edx, dword [edi + 0xc]
sub edx, ecx
shl edx, 2
push edx
lea eax, [eax + ecx*4]
push ebx
push eax
call fcn.0040c920
mov eax, dword [edi + 0xc]
add esp, 0xc
push esi
mov dword [esi + 8], eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x425f3c
cmp ecx, dword [esi + 8]
jge 0x425f3c
mov edx, dword [ebp + 0xc]
mov dword [eax + ecx*4], edx
push dword [ebp - 4]
jmp 0x425f42
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x426001
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x42602f
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x42604d
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00425f6b
jmp 0x42604d
mov eax, dword [esi + 0x14]
test eax, eax
je 0x42604d
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.00425f6b
test edi, edi
mov eax, edi
jne 0x426037
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x437c64]
test ecx, ecx
je 0x426100
jmp 0x426000
ret 8
Function at 0x4021566a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov byte [ebp - 0x28], 0x38
mov byte [ebp - 0x27], 0x35
mov byte [ebp - 0x26], 0x66
mov byte [ebp - 0x25], 0x63
mov byte [ebp - 0x24], 0x65
mov byte [ebp - 0x23], 0x38
mov byte [ebp - 0x22], 0x32
mov byte [ebp - 0x21], 0x32
mov byte [ebp - 0x20], 0x32
mov byte [ebp - 0x1f], 0x33
mov byte [ebp - 0x1e], 0x30
mov byte [ebp - 0x1d], 0x35
mov byte [ebp - 0x1c], 0x34
mov byte [ebp - 0x1b], 0x37
mov byte [ebp - 0x1a], 0x32
mov byte [ebp - 0x19], 0x32
mov byte [ebp - 0x18], 0x61
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x16], 0x37
mov byte [ebp - 0x15], 0x33
mov byte [ebp - 0x14], 0x65
mov byte [ebp - 0x13], 0x39
mov byte [ebp - 0x12], 0x30
mov byte [ebp - 0x11], 0x64
mov byte [ebp - 0x10], 0x61
mov byte [ebp - 0xf], 0x38
mov byte [ebp - 0xe], 0x32
mov byte [ebp - 0xd], 0x61
mov byte [ebp - 0xc], 0x30
mov byte [ebp - 0xb], 0x63
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 9], 0x63
mov byte [ebp - 8], 0
lea eax, [ebp - 0x28]
push eax
push 0
push 0x1f0003
mov eax, dword [ebp + 8]
call dword [eax + 0x24]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40215713
xor eax, eax
inc eax
jmp 0x4021572b
cmp dword [ebp + 0xc], 0
je 0x40215729
lea eax, [ebp - 0x28]
push eax
push 0
push 0
push 0
mov eax, dword [ebp + 8]
call dword [eax + 0x28]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1358222
Capabilities:
Encode data using xor

Disassembly:
dec esi
lea edx, [eax + edx - 0x74a69fb8]
dec eax
mov dword [esp + eax - 0x74a69fb4], 0x30bd1cb0
inc esi
mov ebp, dword [eax + edx - 0x74a69fb4]
jmp 0x217b9d1
sbb byte [esi + 0x6348e89b], 0xdb
inc edx
add dword [esp + ebx - 0x51225e12], esi
dec esp
adc ecx, ebx
dec ecx
lea eax, [ebx + esi*2 + 0x383ae239]
dec word [esp + edi*2 + 0xe]
dec eax
mov edx, dword [esp + 0x10]
dec eax
add edx, 0xff32e709
jmp edx
call fcn.01497986
xor byte [edi - 0x3f0743b1], 0x25
push ebx
add ebp, ebx
jp 0x217b9ed
fnstsw word [edx + 0xb]
inc byte [esp + edx + 0x5c9c79b3]
cmp al, 4
cld
xor ebx, ebp
mov al, bh
imul ecx, esi, 0x7c
div dword [edi - 0x45]
mov gs, word [esi + 0x6c]
push cs
adc byte [ecx], bl
jo 0x217b9df
jmp 0x217b977
mov dword [edi], eax
dec edi
cli
invalid

Function at 0x13d5ec6
Capabilities:
Encode data using xor

Disassembly:
bswap edx
mov dword [esp + eax*2 - 0x7450f95a], 0x8131cb12
not ecx
sub edx, 0xb324b43b
xor ecx, dword [esp + eax*2 - 0x7450f95a]
bswap edx
rol byte [esp + ecx - 0x44e6483d], 0x63
shl ax, 0xcb
lea edx, [edx + eax*2 - 0x6f43a254]
xor ebx, edx
sal byte [esp + ecx - 0x44e6483d], 2
adc esi, edx
call fcn.014325c7
mov dword [edi], ecx
not word [esp + 0xa]
mov ecx, dword [ebp]
add ebp, 4
xor ecx, ebx
call fcn.013741fb
lahf
or cl, byte [0xda6fdec5]
cmpsw word [esi], word es:[edi]
add al, 0x58
dec edx
push ebx
and dword [eax + 0xab65d28], ebx
sti
stc
movsb byte es:[edi], byte [esi]
dec eax
adc bl, dh
sbb dword [edi + 0x56], edx
add al, 0xd3
jle 0x13d5ede
cmpsb byte [esi], byte es:[edi]
push es
scasd eax, dword es:[edi]
mov ecx, dword [edi]
retf 0x84c0
cmp eax, 0x968bf3f8
daa
fstpnce st(6), st(0)
sub dword [eax - 0x32], esi
and dh, cl
fidivr word [eax + 0x7f5295d]
jnp 0x13d5faa
inc ecx
aaa
and dword [esi + 0x1b], ebx
mov eax, dword [0xaae7f809]
invalid
add dl, ah
and cl, byte [edx - 0x63]
dec edx
popfd
add ch, byte [edi - 0x31]
int 0xe7
sbb ebp, dword [ecx + 0xc0644ed]
push 0x45
and dword [ebx + 0x4513ed4], eax
or dword [edx], edi
pop eax
pop esp
das
xlatb
movsb byte es:[edi], byte [esi]
loop 0x13d5f4a
lodsb al, byte [esi]
pop edi
add eax, 0xf00e1b8b
lodsb al, byte [esi]
rcl dword [ebx + 0x3d]
xor edi, dword [edi + 0x161bb58f]
fistp dword [eax]
inc edi
jnp 0x13d5fa7
adc cl, ah
inc eax
xchg ecx, eax
sub byte [ebp + 0x49], dh
das
into
rcr dh, cl
popfd
jle 0x13d5ff3
inc eax
jbe 0x13d604b
sbb eax, dword [ebx + 0x3e4fa249]
or dword [edi], edi
mov byte [0x3f093e4f], al
aad 0x2d
les ecx, [eax + 0x78]
sub byte [edi - 0x4c], dl
push ss
inc edi
jnp 0x13d6022
mov esp, 0x6835f8c4
pop edx
sub dh, bl
add al, 0x91
push ebx
adc eax, dword [edi]
cmpsd dword [esi], dword es:[edi]
cmp byte [ebx], 0xd1
and dword [edx - 0x7102481], ebp
adc edx, dword [esi + 0x140459bd]
xchg ecx, eax
lodsd eax, dword [esi]
and dword [esp - 0x67], edx
insd dword es:[edi], dx
hlt
cmpsb byte [esi], byte es:[edi]
shr dword [esi + ebx*8 - 0x21], cl
xchg edi, eax
ljmp 0x2fa3
Function at 0x13d66d3
Capabilities:
Authenticate hmac

Disassembly:
rol cl, 0x23
ror edx, 1
mov dword [esp], ecx
lea edx, [edx + ecx - 0x2c70afdd]
xor ecx, eax
neg word [esp + ecx - 0x7b9a4213]
inc cl
xor edx, 0x18be2a84
sal cl, 0xa4
rol edx, 1
shl byte [esp + ecx - 0x7b9a424f], 0xc2
jnp 0x2264af2
pop esi
cmpsb byte [esi], byte es:[edi]
leave
and ch, ah
lds ebx, [eax + 0x5720d01e]
mov dl, 0x19
invalid
bswap edx
jne 0x218a15a
mov dx, word [ebp]
mov eax, 0xa02eedb5
movzx ecx, ax
sub ecx, eax
add cl, byte [ebp + ecx - 0x5fd1fffe]
neg ax
sar al, 0xc1
not ax
add ebp, 2
shl dx, cl

Function at 0x13dd688
Capabilities:
Encode data using xor

Disassembly:
add dword [esp + ecx*2 - 0x22b6], eax
bswap edx
sal byte [esp + ecx*4 - 0x4569], 0x21
lea edx, [edx + ecx*2 + 0x751f08cf]
jb 0x22b3355
ror eax, 1
not ecx
lea edx, [ecx*8 + 0x409e3da0]
xor dword [esp + ecx - 0x536ef4ba], 0x598063a0
lea eax, [eax + ecx*2 + 0x37d77b1b]
mov dword [esp + ecx - 0x536ef4c2], 0xea13cb29
adc cx, dx
cmove dx, cx
xor eax, 0xd28e6e80
add dword [esp + ecx - 0x536ed86d], ecx
dec eax
add dword [esp + ecx - 0x536ed86a], ecx
jb 0x1a45aa2
xor edx, ebx
inc dword [esp + ecx*2 - 0x46]
ror ecx, 0x19
lea edx, [edx + ecx*2 + 0x19a90189]
and ax, cx
not edx
xor cx, word [esp + ecx*2 - 0x2300]
not cl
neg dword [esp + ecx - 0x115b]
xor edx, 0x23008816
jmp 0x1394ee9
neg eax
xor ebx, eax
sal dl, 0xa1
shl dword [esp + ecx - 0x536ed86d], cl
add esi, eax
movzx eax, cx
fsub qword [ebp + eax*8 - 0x6c390]
shl edx, cl
mov dword [esp + eax - 0xd872], esi
ret 8
Function at 0x13e5139
Capabilities:
Get number of processors

Disassembly:
inc ebp
xadd ebp, ebx
xor dword [esp + ecx*2 - 0x78], esi
call fcn.013c11c6
mov edx, 0x8617bfa6
inc cx
shl ebp, 0x63
inc edx
xor dword [esp + ebp - 0x593f44d0], ecx
inc esp
movsx ebx, si
inc cx
sar eax, 0xe5
inc ecx
pop esp
dec eax
arpl cx, cx
inc ecx
movzx ebx, bl
dec esp
adc ecx, ecx
inc ecx
sub ebx, ebp
movsx ecx, bp
inc di
mov ebx, dword [ebp + edi - 0x593f44d0]
inc cx
or edx, eax
add bp, dx
dec edi
lea edi, [edi + ebp - 0x593f44ce]
dec eax
sbb edi, 0xd6a6de83
inc ecx
xchg dh, dl
dec ecx
bswap eax
dec edi
lea edx, [ebp + edx - 0x593f44d1]
inc esp
add ch, bl
push ebp
inc dx
sbb dword [esp + ebp - 0x593f44cc], 0xf431508
mov dh, 0x94
adc eax, 0xa6c0bb33
movzx eax, byte [esp + ecx*4 - 0x3e9d]
sbb dword [esp + ecx*4 - 0x3e9d], edi
inc ecx
xor dl, ah
dec eax
dec dword [esp + ecx*2 - 0x1f50]
dec eax
rol dword [esp + ecx*2 - 0x1f50], 0x87
inc dl
dec eax
neg eax
jbe 0x21a02f2
mov dword [edi + 4], eax
neg word [esp + 0xa]
mov edx, dword [ebp]
add ebp, 4
pop ecx
lea eax, [ecx*8 + 0x30a7108e]
xor edx, ebx
xadd cx, ax
pop eax
setbe byte [esp + ecx*4 - 0x44682b40]
lea edx, [edx + ecx*8 - 0x4c86cdb]
push ecx
neg dword [esp + ecx*2 - 0x2234159c]
rol edx, 1
shr cx, 0xc5
adc dword [esp + ecx - 0x111a0056], 0xfe362692
inc edx
not ecx
ror edx, 1
or cx, 0xb2bd
not edx
xor ebx, edx
sar byte [esp + 3], 0x25
neg cl
add esi, edx
call fcn.0218cdfd
lea esp, [esp + 4]
jne 0x143800f
mov eax, dword [ebp]
push 0x77bf20bc
lea esp, [esp + 4]
call eax
mov ebx, 0x5293b73d
movsx edx, bl
jmp 0x2312d58
mov eax, 0xebb8a539
ror eax, 0x13
adc ax, 0xb431
mov eax, dword [ebp + ebx*4]
push 0x94134815
mov dword [esp], eax
dec ebx
call 0x13e5139
mov ecx, 0x2a265e2b
mov edx, ecx
mov eax, dword [ecx + esi - 0x2a265e2b]
mov cx, word [eax + ecx - 0x2a265e2b]
push edx
push edx
lea esi, [esi + edx*2 - 0x544cbc54]
mov word [esi + edx*2 - 0x544cbc56], cx
mov ecx, edx
lea ebp, [ebp + edx - 0x2a265e2f]
movsx eax, cx
sub al, al
mov edx, dword [edx + ebp - 0x2a265e2b]
inc al
xor edx, ebx
inc edx
jmp 0x2282807
not dl
dec dl
mov dword [esp + ecx - 0xfa4], edi
call fcn.014784a7
mov ebp, dword [ebp + ebx - 0x5293b741]
mov dword [ebp + edx*8 - 0x1e8], eax
movzx eax, bl
movzx esi, dx
mov ecx, esi
mov edi, ebp
or al, dh
sbb ecx, ecx
pop ebx
pop esi
sal al, 0x46
pop ebp
neg eax
inc edx
or edx, 0xe798fd3e
mov eax, dword [ebp + ecx]
and ecx, 0xe2e700b
xadd ecx, edx
inc cx
lea ebp, [ebp + edx*8 + 4]
call fcn.01a77297
movsx eax, dx
add dl, al
mov ecx, dword [ebp]
add dx, ax
xor ecx, ebx
neg ecx
dec ecx
jmp 0x1a795ed

Function at 0x1400f14
Capabilities:
Get number of processors

Disassembly:
rol eax, cl
lea edx, [ecx + ecx*8 + 0x5cbb6aa4]
inc ecx
pop ecx
bswap eax
not eax
lea edx, [edx + edx + 0x2f232ead]
not edx
ror edx, 0x14
xor ebx, eax
movzx ecx, dl
add edi, eax
shl edx, cl
ja fcn.01387fe3
dec cx
shl dl, 0x87
not eax
neg eax
lea eax, [eax + ecx*4 - 0x1a07d6d8]
rol cl, 0x43
rol eax, 2
xor ecx, ecx
xor ebx, eax
jmp 0x226961d
Function at 0x141a909
Capabilities:
Encode data using xor

Disassembly:
add ebp, edx
mov dword [esp + ecx*2 - 0x75f9ec0], ecx
sar dword [esp + ecx*8 - 0x1d7e7b00], 0x18
lea edx, [ecx + eax*8 - 0x22686f44]
pop eax
pop edx
jns fcn.022522c1
syscall
push edi
pushfd
dec eax
mov edi, 0x7b0b61c
cmp al, 0x1d
xchg edx, eax
and cl, byte [eax - 0x75]
jl 0x141a95f
or byte [eax - 0x39], cl
inc esp
and al, 8
pop edi
test eax, 0x74ffd90a
and al, 0
popfd
dec eax
lea esp, [esp + 8]
call fcn.022243d8
les edx, [esi + 0x1a9c1343]
pop edx
adc bl, byte [eax - 0x29]
pushfd
sbb bl, byte [edx + 0x12]
pop eax
xlatb
sub al, 0x3f
aas
xor ebx, eax
in al, 0xcb
jne 0x141a958
and edx, dword [ecx - 0x54863907]
inc esp
mov ch, bh
sal byte [edi], 0x1a
xor al, 0x35
rcl byte [edx - 0x62], cl
xor dword [edi + 0x4e], ebx
sub edi, edx
xor esp, dword [eax]
aad 0x8d
test dword [edx], ecx
invalid

Function at 0x141b440
Capabilities:
Execute syscall

Disassembly:
lea ecx, [esp + ecx + 0x10]
shl word [esp + eax - 0x19b70], 0xaf
mov edx, dword [ecx + eax - 0x19b7c]
lea ebp, [ebp + eax*8 - 0xcdbe4]
push eax
mov dword [ebp + eax - 0x19b7c], edx
mov edx, dword [esp + eax - 0x19b6c]
mov eax, dword [edi + eax*8 - 0xcdbe0]
shr dx, 0xc5
mov dword [esp + 4], edx
dec byte [esp + 6]
adc edi, 4
lea ecx, [edx + edx - 0x3bfd3dd2]
mov dword [esp + 8], edx
neg cl
xor eax, ebx
jmp 0x1427edd
rol eax, 3
sub eax, 0x800e058a
inc byte [esp + 0xa]
add dx, dx
ror eax, 3
inc dword [esp + 2]
jnp 0x213c140
sysenter
push ebx
mov dword [esp], 0xee7997fa
call int.0225944d
shr ax, 0x49
mov eax, dword [ebp + eax*2 - 0x6300001e]
push edx
shl byte [esp + 2], 4
sar byte [esp + 3], 0xa1
mov ecx, dword fs:[eax]
movsx eax, dx
mov dword [eax + ebp - 0x1e58], ecx
and edx, edx
mov dword [esp + eax*2 - 0x3cb0], esi
ret
neg word [esp + 0xa]
bswap eax
and dx, dx
sal edx, cl
pop ecx
xor ebx, eax
xchg byte [esp + edx - 0x1ffffff5], dh
add esi, eax
xadd edx, ecx
call fcn.0135d454
Function at 0x1429a3b
Capabilities:
Encode data using xor

Disassembly:
shr dl, 0xa4
bswap edx
xor ebx, eax
shr edx, cl
adc ebp, eax
push edx
mov dword [esp + edx*8], ecx
rdtsc
sub edi, 8
xchg dword [esp], ecx
mov dword [edi + 4], eax
dec ecx
mov eax, 0x9b0cf521
mov dword [esp + 4], eax
mov dword [edi], edx
push ecx
bswap eax
pop eax
pop ecx
pop eax
jle fcn.022522c1
jge 0x1429ab1
ret
mul byte [eax + eax + 0x68]
cmpsb byte [esi], byte es:[edi]
jbe 0x1429ae3
xchg edx, eax
shl word [esp + 0x16], 0x21
mov word [edi], dx
jne 0x22fddc5
xor ah, byte [ebp - 0x132f7913]
inc eax
and al, 0x27
and eax, 0x9cede0a4
pushfd
add eax, 0x57db2962
xor al, 0xa9
sub eax, 0x3aa88647
push eax
sub eax, 0xb122bd57
out 0x42, eax
sbb al, 0x53
mov byte [0xd6aff773], al
push ecx
jecxz 0x1429ad5
stosb byte es:[edi], al
mov dl, 0xea
sbb dh, dl
imul esp, dword [ecx - 0x7c], 0xffffffdb
lodsb al, byte [esi]
cmp al, ah
fiadd word [ecx + 1]
adc al, 0x91
mov ebx, 0x5a2f4518
out 0x94, al
test eax, 0x8c1244b1
sbb dword [ecx + 0x475ec434], edx
xor dl, byte [edi - 0x20]
stosb byte es:[edi], al
dec bx
sahf
out 0x24, eax
jo 0x1429b0a
movsb byte es:[edi], byte ss:[esi]
mov bh, 0xb5
jns 0x1429ba4
aad 0xf0
wait
or dh, byte [edi + ebx*4]
invalid
call fcn.02264488
mov eax, dword [edi]
mov ecx, 0x21918082
mov ecx, dword [ecx + edi - 0x2191807e]
mov edx, 0xae9a3580
add edi, 4
sal dl, 0xc7
xor edx, 0x6f029626
add edx, edx
add eax, ecx
mov dword [edi], eax
movzx ecx, dl
mov edx, dword [ebp + ecx*4 - 0x130]
lea ebp, [ebp + ecx*2 - 0x94]
xor edx, ebx
inc edx
call fcn.013c760c

Function at 0x143a8d1
Capabilities:
Get number of processors

Disassembly:
mov dword [esp + eax - 0x8f38d00], eax
lea edi, [edi + eax - 0x8f38d02]
mov word [edi + eax*2 - 0x11e71a00], dx
jmp 0x20b53c0

Function at 0x143fccb
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov edx, dword [ebp + ecx - 0x8a054b5]
push eax
ror cx, 0xe2
bswap eax
lea ebp, [ebp + ecx*2 - 0x1140aa56]
xor edx, ebx
neg ecx
sal eax, cl
inc edx
ror edx, 3
lea edx, [edx + ecx - 0x78489440]
rol edx, 2
xor ebx, edx
add ecx, 0xdca9a8b3
add esi, edx
sar cl, cl
or cl, ch
mov ecx, dword [edi]
mov eax, dword [edi + 4]
jl 0x2321d77
mov ebx, 0xb3077191
dec ecx
mov eax, dword [edi]
dec eax
lea ecx, [ebx*8 + 0x591c8fa9]
dec eax
and ebx, ecx
dec ecx
mov esi, dword [edi + 8]
dec eax
lea ecx, [ecx*2 - 0x1272f667]
movzx edi, bl
inc esp
movsx ebx, bx
imul ecx
add byte [esp], 0xa0
dec dword [esp]
mov dword [edi], edx
mov dword [edi + 4], eax
setns byte [esp + 2]
mov dword [esp + 4], 0x17aa9682
pop eax
pop eax
jmp esi