joyce8/EMBER2024-capa huggingface dataset:
Function at 0x645520
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x6455d6
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
mov eax, esi
call fcn.004a7ae4
push eax
call sub.VERSION.DLL_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
jbe 0x6455c0
lea eax, [ebp - 4]
mov edx, edi
call fcn.004a7c70
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
push eax
push edi
mov eax, dword [ebp - 0x10]
push eax
mov eax, esi
call fcn.004a7ae4
push eax
call sub.VERSION.DLL_GetFileVersionInfoW
test eax, eax
je 0x6455c0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x6455e8
mov eax, dword [ebp - 4]
push eax
call sub.VERSION.DLL_VerQueryValueW
test eax, eax
je 0x6455c0
cmp dword [ebp - 0xc], 0x34
jne 0x6455c0
mov bl, 1
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
mov esi, eax
mov edi, edx
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6455dd
lea eax, [ebp - 4]
call fcn.004a6c80
ret

Function at 0x655d1c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x655d38
call fcn.00657100
pop ebx
pop ebp
ret
test byte [ebp + 0xc], 2
je 0x655d57
test bl, 1
je 0x655d57
call fcn.0065ded0
mov dword [eax], 5
or eax, 0xffffffff
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x655f38
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
call fcn.00656c7c
test byte [ebp + 0xd], 0xc0
jne 0x655f5c
mov eax, dword [0x74621c]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x655f69
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x655f96
je 0x655fa8
sub ecx, 0x100
je 0x655fba
sub ecx, 0x100
je 0x655fc3
sub ecx, 0x100
je 0x655fb1
jmp 0x655fcc
sub ecx, 0x600
je 0x655fc3
sub ecx, 0x100
je 0x655fa8
jmp 0x655fcc
mov dword [ebp - 8], 1
jmp 0x655fd3
mov dword [ebp - 8], 2
jmp 0x655fd3
mov dword [ebp - 8], 4
jmp 0x655fd3
mov dword [ebp - 8], 5
jmp 0x655fd3
mov dword [ebp - 8], 3
test byte [ebp + 0xd], 1
je 0x655ffa
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x745c94]
test al, 0x80
je 0x655ff3
mov ebx, 0x80
jmp 0x65600c
mov ebx, 1
jmp 0x65600c
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x65600c
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x65601e
je 0x656027
dec eax
je 0x656030
jmp 0x656039
mov dword [ebp - 4], SysStringLen
jmp 0x656048
mov dword [ebp - 4], 0x40000000
jmp 0x656048
mov dword [ebp - 4], 0xc0000000
jmp 0x656048
push 1
call fcn.00657094
pop ecx
mov ebx, eax
jmp 0x656148
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x656064
sub eax, 0x10
je 0x656068
sub eax, 0x10
je 0x65606f
sub eax, 0x10
je 0x656076
jmp 0x656076
xor edi, edi
jmp 0x65607b
mov edi, 1
jmp 0x65607b
mov edi, 2
jmp 0x65607b
mov edi, 3
test byte [ebp + 0xc], 4
je 0x656093
cmp dword [ebp - 4], 0x80000000
jne 0x656091
mov edi, 1
jmp 0x656093
xor edi, edi
mov dword [ebp - 0x14], 0xc
xor eax, eax
mov dword [ebp - 0x10], eax
mov edx, dword [ebp + 0xc]
and edx, 0x80
cmp edx, 1
sbb ecx, ecx
neg ecx
mov dword [ebp - 0xc], ecx
push 0
push ebx
mov ecx, dword [ebp - 8]
push ecx
lea eax, [ebp - 0x14]
push eax
push edi
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x656101
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x6560f6
test byte [ebp + 0xd], 1
je 0x6560f1
mov ebx, 0x50
jmp 0x6560f6
mov ebx, 2
push ebx
call fcn.00657094
pop ecx
mov ebx, eax
jmp 0x656148
mov edi, esi
push edi
call fcn.00655e9c
pop ecx
test eax, eax
je 0x656115
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x656121
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.00656dbc
add esp, 8
mov ebx, eax
inc eax
jne 0x656148
push 4
call fcn.00657094
pop ecx
push esi
call sub.KERNEL32.DLL_CloseHandle
call fcn.00656cb0
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x65a5dc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea eax, [ebp - 0x200]
push eax
push 0x1001
mov edx, dword [ebx + 4]
push edx
call sub.KERNEL32.DLL_GetLocaleInfoA
push str._._n
lea ecx, [ebp - 0x200]
push ecx
call fcn.006549c8
add esp, 8
lea ecx, [ebp - 0x200]
push ecx
call fcn.00654ac8
pop ecx
mov edx, pe_nt_image_headers32
sub edx, eax
push edx
lea eax, [ebp - 0x200]
push eax
call fcn.00654ac8
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
push 0x1002
mov eax, dword [ebx + 4]
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
push 0x746e49
lea ecx, [ebp - 0x200]
push ecx
call fcn.006549c8
add esp, 8
push 0xa
lea ecx, [ebp - 0x200]
push ecx
call fcn.00654ac8
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
mov eax, dword [ebx]
push eax
call fcn.0065b9f4
add esp, 0xc
cmp dword [ebx + 0x24], 0
jne 0x65a6ed
push esi
call fcn.00654ac8
pop ecx
mov edi, eax
lea eax, [ebp - 0x200]
push eax
call fcn.00654ac8
pop ecx
add edi, eax
add edi, 3
push edi
call fcn.00653b20
pop ecx
mov edi, eax
mov dword [ebx + 0x24], edi
test edi, edi
jne 0x65a6c4
xor eax, eax
jmp 0x65a774
push esi
call fcn.00654ac8
pop ecx
push eax
lea edx, [ebp - 0x200]
push edx
call fcn.00654ac8
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push 0
push edi
call fcn.006548f7
add esp, 0xc
jmp 0x65a72d
mov edi, dword [ebx + 0x24]
push edi
call fcn.00654ac8
pop ecx
push eax
push esi
call fcn.00654ac8
pop ecx
pop edx
add edx, eax
push edx
lea eax, [ebp - 0x200]
push eax
call fcn.00654ac8
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push edi
call fcn.00653b40
add esp, 8
mov dword [ebx + 0x24], eax
cmp dword [ebx + 0x24], 0
jne 0x65a72d
xor eax, eax
jmp 0x65a774
push esi
mov edx, dword [ebx + 0x24]
push edx
call fcn.006549c8
add esp, 8
push 0x746e4b
mov ecx, dword [ebx + 0x24]
push ecx
call fcn.006549c8
add esp, 8
lea ecx, [ebp - 0x200]
push ecx
mov eax, dword [ebx + 0x24]
push eax
call fcn.006549c8
add esp, 8
push 0x746e4d
mov edx, dword [ebx + 0x24]
push edx
call fcn.006549c8
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x65de64
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
jne 0x65de91
jmp 0x65dec8
call fcn.0065de14
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.00654ac8
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.00654ac8
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x65df4c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x747484], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x65e026
cmp dword [0x747480], 0
jne 0x65e026
cmp dword [0x7476c8], 0
je 0x65dfe0
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.0065d91c
add esp, 8
mov ebx, eax
test eax, eax
jne 0x65dfc6
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.0065d91c
add esp, 8
mov ebx, eax
test eax, eax
jne 0x65dfc6
lea ebx, [ebp - 0x84]
jmp 0x65dfc7
inc ebx
call fcn.0065df04
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x65e061
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x747488
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.00654ac8
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x74748b
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x65e061
cmp dword [0x747480], 0
je 0x65e040
cmp dword [0x747480], 0xffffffff
je 0x65e061
push esi
call dword [0x747480]
pop ecx
mov eax, dword [0x747484]
test eax, eax
je 0x65e061
cmp dword [0x747484], 0xffffffff
je 0x65e061
cmp byte [eax], 0
je 0x65e061
push esi
push eax
call fcn.0065de64
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x65e988
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x7d1e7c], 0
jne 0x65ea14
cmp dword [0x7d1eb0], 0
jne 0x65e9b8
call sub.KERNEL32.DLL_GetEnvironmentStringsW
mov dword [0x7d1eb0], eax
test eax, eax
jne 0x65e9b8
push str.GetEnvironmentStrings_failed
call fcn.0065e078
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x7d1eb0]
jmp 0x65e9d1
lea eax, [edi + 1]
add edi, edi
add edi, 2
add ebp, eax
inc esi
add ebx, edi
push ebx
call fcn.00654d88
pop ecx
mov edi, eax
test eax, eax
jne 0x65e9c4
lea edi, [ebp + 1]
mov eax, edi
add eax, eax
push eax
call fcn.00653b20
pop ecx
mov ebx, eax
mov dword [0x7d1e80], ebx
test ebx, ebx
jne 0x65e9ff
xor eax, eax
jmp 0x65eadb
add edi, edi
mov edx, dword [0x7d1eb0]
push edi
push edx
push ebx
call fcn.0065472c
add esp, 0xc
jmp 0x65ea34
xor esi, esi
mov ebx, dword [0x7d1e7c]
jmp 0x65ea2e
push eax
call fcn.00654d88
pop ecx
test eax, eax
jne 0x65ea2a
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x65ea1e
lea ebx, [esi + 4]
push 4
mov dword [0x7d1e84], ebx
inc ebx
push ebx
call fcn.00653a84
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x65ea57
xor eax, eax
jmp 0x65eadb
cmp dword [0x7d1e7c], 0
jne 0x65ea8c
xor esi, esi
mov ebx, dword [0x7d1e80]
mov eax, dword [esp]
mov ebp, eax
jmp 0x65ea7d
mov dword [ebp], ebx
add edi, edi
add ebp, 4
add edi, 2
inc esi
add ebx, edi
push ebx
call fcn.00654d88
pop ecx
mov edi, eax
test eax, eax
jne 0x65ea6f
jmp 0x65eabd
xor esi, esi
mov ebx, dword [0x7d1e7c]
mov eax, dword [esp]
mov edi, eax
jmp 0x65eab7
push eax
call fcn.00654d88
pop ecx
test eax, eax
je 0x65eaac
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x65eab0
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x65ea9b
mov eax, dword [0x7d1e7c]
test eax, eax
je 0x65eacd
push eax
call fcn.00653b30
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x7d1e7c], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x661b68
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, eax
mov eax, esi
call fcn.004a7ae4
mov ebp, eax
push ebp
call sub.KERNEL32.DLL_DeleteFileW
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x48afa9
call sub.KERNEL32.DLL_GetLastError
mov edi, eax
push ebp
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
je 0x48afa3
test ah, 4
je 0x48afa3
test al, 0x10
je 0x48afa3
mov eax, esi
call fcn.004a7ae4
push eax
call sub.KERNEL32.DLL_RemoveDirectoryW
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x48afa9
push edi
call sub.KERNEL32.DLL_SetLastError
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
ret
jmp 0x48af54
Function at 0x422fe5
Capabilities:
Encode data using xor

Disassembly:
xchg edx, eax
mov eax, 0x7189d640
mov al, byte [0x9441ad5f]
stosb byte es:[edi], al
push eax
mov dl, 0x60
invalid

Function at 0x426255
Capabilities:
Encode data using xor

Disassembly:
sub byte [esi], dl
jo 0x4262c5
xor byte [ebp + 0x4d], bh
rcr al, cl
popfd
cli
int 0x55
invalid
invalid

Function at 0x42aaa5
Capabilities:
Encode data using xor

Disassembly:
movsd dword es:[edi], dword [esi]
cli
and eax, 0x9c884e6b
invalid
int1
and byte [ebp + esi*2 + 0x6bdbbe99], bl
cmp byte [edx + 0x6d], dh
mov al, byte [0x6c95d5ae]
sub dh, byte [ecx + 4]
fidiv dword [eax + 0x45]
push esi
or ch, dl
lodsb al, byte [esi]
xor eax, 0x74d451be
je 0x42ab12
mov al, 0x33
fimul word [edi]
xchg ebx, eax
adc eax, 0x472b2b24
invalid
das
loop 0x42ab06
je 0x42ab12
mov al, 0x33
fimul word [edi]
xchg ebx, eax
adc eax, 0x472b2b24
xor ebx, esi
setae byte [0x472b2b24]
mov al, byte [0x5251e22f]
push edx
out dx, al
and byte [eax + edx], dl
ja 0x42aa50
and dl, byte [esi - 0x5b]
mov ch, 0x3d
div dword [edx + 0x55]
out dx, al
retf
movsd dword es:[edi], dword [esi]
cmp eax, 0x1029c027
ficom dword [edi + 0x60]
nop
pop ss
je 0x42ab33
nop
jb 0x42aa87
cmpsd dword [esi], dword es:[edi]
jne 0x42aaa8
push 0x6b
lea esi, [ebx]
int3
xor ecx, esp
or byte [edx + 0x54], ch
add eax, dword [edi + 0x137df386]
invalid
xchg dword [esi - 0x1ec820d], eax
jg 0x42ab55
jbe 0x42aaf6
cwde
cmc
cli
and eax, 0x7a16527d
mov ch, 0x9b
int3
pop eax
jp 0x42aafc
mov ss, ebx
push es
imul eax, dword [eax], 0xffffff94
dec esp
into
mov esp, 0x7220107a
pop ss
dec ebp
cmpsb byte [esi], byte es:[edi]
add dl, byte [ecx]
dec edi
jle 0x42aab1
pop eax
and ah, 0xa0
jl 0x42aae0
enter 0x7e3f, 0xffffffffffffff8f
and byte gs:[eax - 0x1a5eafa2], dl
idiv ch
sub cl, byte [esi + 0x59d0e424]
invalid
invalid
mov eax, dword [0x2afdf6e5]
mov fs, word [esp]
rcr byte [ecx - 2], 1
push esp
loop 0x42aba2
mov cl, 0x7d
pop ebx
jge 0x42aba5
xchg dword [eax - 0x61], edx
inc edx
dec ebx
test byte [edi - 0x19], al
mov al, 0xe1
jnp 0x42abb7
popal
scasb al, byte es:[edi]
pop ds
nop
adc esp, dword [ebp - 0x302d047b]
xor ah, byte [eax - 0x5c]
dec ebp
loopne 0x42ab39
loope 0x42ab6c
add dword [edi + 0x7a0fb5a4], 0xffffffda
jp 0x42ab48
dec edi
mov bh, 0x4d
and al, 0x90
aam 0x81
pushal
mov dh, 0x62
lea ecx, [ebp + 0xbd0441a]
lahf
test al, 2
stosd dword es:[edi], eax
and eax, 0x3090caa
add ah, byte [0x9c417932]
push dword [ecx + 0xe]
jno 0x42ab9e
mov ah, 0x58
xchg dword [edx + ebp*4], ebx
js 0x42abb9
jae 0x42ab8e
add eax, 0x34c351f2
sal dword [eax - 0x75], 1
or edx, ebx
mov ah, 0xbf
sal dword [edi + edi*4 - 0x2aa70b36], cl
stosd dword es:[edi], eax
mov al, 0xb8
wait
imul edx, dword [esi + 0x53], 0x4fa523bf
cmp byte [eax - 0x63], 0xe0
wait
retf 0x58f4
loopne 0x42ab54
pop ebx
adc eax, 0x71121991
invalid
Function at 0x4372e5
Capabilities:
Encode data using xor

Disassembly:
sbb esi, dword [ebx - 0xc]
test eax, 0x95f64f13
cmp al, 0x6e
cmp al, 0x1f
loope 0x43735f
inc ecx
test dword [esi + 0x7eb67e53], ecx
push edx
inc ebp
sub dword [edx + 0x1220349b], ebp
xor eax, 0xb50355dc
daa
push esp
lds eax, [eax + edi*8 - 0x6f]
mov eax, dword [0xc45d5d36]
aaa
push 0x4bd6ca8f
adc eax, 0xd504a540
and ebx, ecx
shr dword [edi], cl
inc edx
xor al, 0xd9
invalid
push es
mov ebp, dword [ebx - 0x2b]
leave
xor byte [ebx + 0x39fc2375], bh
xor al, 0x60
les ebp, [edi + edx*2 + 0x31fdaa8d]
inc eax
stosb byte es:[di], al
add ch, al
mov ecx, 0xf44a347b
dec ebp
jbe 0x43739a
pop ds
adc dword [edi + edx*4], edi
pop ebp
sbb ah, bh
test byte [edi + 0x7f817c77], 0x87
pop edi
aad 0x8d
mov ch, 0xbd
inc eax
movsb byte es:[edi], byte [esi]
mov edi, 0xe5fd0689
jmp 0x4373ec
xor eax, dword [ebx - 0x76]
push 0x2922a51
xchg ebp, eax
movsb byte es:[edi], byte [esi]
pop eax
lodsb al, byte [esi]
push edx
xor eax, dword [ebp - 0x1acde301]
hlt

Function at 0x44a210
Capabilities:
Accept command line arguments
Log keystrokes via polling

Disassembly:
push ecx
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, dword [esp + 0x14]
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
mov edi, eax
mov dword [esi], 0
call ebx
test ax, ax
jge 0x44a23b
or dword [esi], 0x2000000
lea eax, [esp + 0xc]
push eax
push edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push 0x11
mov edi, eax
call ebx
test ax, ax
jge 0x44a258
or dword [esi], 0x4000000
test edi, edi
je 0x44a26e
mov ecx, dword [0x657a4c]
push 0x657768
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
push 0x12
call ebx
test ax, ax
jge 0x44a27d
or dword [esi], 0x8000000
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x44da25
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00480f15
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x44db48
push ecx
lea ecx, [esi + 0x18]
call fcn.0046d245
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x44db5f
push ecx
lea ecx, [esi + 0x24]
call fcn.0046d155
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x496db5
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.004ca2a5
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x496ed8
push ecx
lea ecx, [esi + 0x18]
call fcn.004b65d5
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x496eef
push ecx
lea ecx, [esi + 0x24]
call fcn.004b64e5
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4b5615
Capabilities:
Encode data using xor

Disassembly:
test al, 0x4c
loope 0x4b5655
stc
fsubr qword [eax - 0x25]
fstp xword [ebx]
push 0x26007bdb
pop esi
fstp xword [ebx]
pop esi
leave
pop eax
xchg esp, eax
js 0x4b5628
popal
ja 0x4b569e
ljmp 0x9995:0x2b607c55
cdq
or dword [ecx], esi
push ecx
repne cmpsd dword [esi], dword es:[edi]
xchg ebx, eax
adc bl, byte [ebx - 0x56418c21]
inc ebp
pop ebx
adc al, 0xc6
cdq
add dword [edi - 0x41], esi
pushal
das
cmp byte [ebx - 0x31d407a4], dh
sub ecx, esi
dec esi
aas
outsb dx, byte [esi]
mov eax, 0xa9bb430e
jbe 0x4b5667
and eax, 0x5eb7f6f5
sub byte [esi - 0x41], 0xd8
mov dword [0x69fd0d8b], eax
loop 0x4b565a
mov ecx, dword [0xe22e69fd]
stc
jg 0x4b560e
fidivr word [eax - 0x34]
stosb byte es:[edi], al
das
jnp 0x4b5614
mov bh, 0xcb
dec eax
cmp al, 0x2b
mov byte [esp + edi + 0x48], ah
iretd
inc esp
mov bl, 0x3d
imul ebp, dword ss:[ecx - 0x68ddfcf5], 0xffffff8e
and dh, 0x38
ror al, cl
clc
pop edx
sbb al, 0x50
inc esp
shl byte [ecx], 0x9c
cwde
xor bl, byte [edi + ecx + 0x395c9875]
pushal
fldenv [ecx]
cmp byte [ecx - 0x42b52928], ah
pcmpeqw mm3, qword [eax - 0x269fc6a4]
and dword [eax], edi
mov eax, dword [0xbd4ad6d8]
pop esi
dec ecx
clc
jle 0x4b5683
mov byte [esi + eax*8 - 0x217613e1], bl
jnp 0x4b5643
and bh, bl
cmp byte [edx + 0x6b], ch
in eax, 0x57
dec esi
wait
pop esi
pop ebx
lahf
jmp 0x1a4e51a5
Function at 0x4ca2a5
Capabilities:
Encode data using xor

Disassembly:
push ebx
inc esp
or eax, 0xb47e7f85
call 0x8af8bcb7
mov bl, 0x9c
invalid
shr dword [ebp + 0x55], 1
in al, dx
sub esi, edi
jns 0x4ca235
fsubr dword [edx + 0xf]
mov dword [ecx + 0x3a], edi
push ebp
cmp cl, byte [eax + 0x53df0a38]
xor ebp, esi
div dword [ebp - 0x67]
dec eax
outsb dx, byte [esi]
iretd
sbb al, 0x3e
lahf
push 0x4f
ficomp word [ebx - 5]
int 0x66
jne 0x4ca2f5
jb 0x4ca264
pop ds
and eax, 0x1fab155d
pop ds
cmc
push 0x8fce527b
cli
jo 0x4ca309
js 0x4ca29b
or al, 0xee
or eax, 0xee0ec0f5
cwde
lds esi, fs:[esi + 0x5eaca8c9]
mov dh, 0xc9
test al, 0xac
pop esi
xchg edx, eax
cmp cl, al
xor dword [edi], edi
std
sub byte [esp + esi*8 + 0x6f], dl
mov dword [edx + 0x78], ecx
test byte [esi + ebx*8], bh
or edx, edi
imul esi, dword [ebp - 0x45b9a288], 0x59
xchg edi, eax
fdivr qword [esi - 0x17]
mov esp, 0x9bee999e
xchg esp, eax
jle 0x4ca2bc
leave
sahf
pushal
scasb al, byte es:[edi]
je 0x4ca2c7
into
and al, 0x9a
pop eax
mov edx, 0xea4ff74
or edi, ecx
ret
dec esi
mov esp, 0x38e65b23
jg 0x4ca33e
movaps xmm3, xmm1
sbb byte [ebp + esi*8 + 0x19ce2cff], bh
retf 0x44c
sbb al, 0xaa
push edx
invalid

Function at 0x4e0215
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00513705
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x4e0338
push ecx
lea ecx, [esi + 0x18]
call fcn.004ffa35
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x4e034f
push ecx
lea ecx, [esi + 0x24]
call fcn.004ff945
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4ffb25
Capabilities:
Encode data using xor

Disassembly:
push esi
add al, 0x33
xor byte [edi + 0x7f], 0xe9
invalid