joyce8/EMBER2024-capa huggingface dataset:
Function at 0x548137
Capabilities:
Encode data using xor

Disassembly:
dec ebp
invalid
or edi, 0x5b
ror dword [edx + ebx*8], cl
popfd
inc ebp
stosd dword es:[edi], eax
loop 0x5480b4
salc
pop esi
sar dword [ebx - 0x7e73dab9], 1
xor dword [ecx + eax*8 - 0x69146fc9], edx
add dl, byte [ebx - 0x2b3edbaf]
and al, 0xc1
aam 0x38
or bh, byte [0x2326883c]
and al, 0xc1
aam 0x38
or bh, byte [0x2326883c]
xor eax, 0x58cddf4
outsd dx, dword [esi]
dec ecx
push es
cmc
and dword [edx - 0x1c], 0x637e84ea
mov ecx, 0xfa039589
arpl word [ecx - 0x5fc6a77], di
jge 0x548119
adc al, 0x69
xor al, byte [edi]
scasd eax, dword es:[edi]
sbb dword [ebx], esp
lahf
mov dword [0xc30c976e], eax
push edx
enter 0xffffffffffff9c07, 0x60
mov cl, 0x7d
jg 0x548150
push ebp
push ebp
fcmovnbe st(0), st(1)
wait
je 0x5481f0
mov eax, 0x31588e5
push es
xchg ecx, eax
popal
ror dword [ebx - 0x6c], 0x17
xor dword [ebx - 0x65a25edd], ebp
sub esp, dword [eax]
jle 0x5481ff
popal
mov byte [0xabc6df81], al
cli
scasb al, byte es:[edi]
xchg edx, eax
xchg edx, eax
pop esp
xor cl, 0x78
and al, 0x84
arpl sp, dx
sub al, 0xf5
sub dword [esi - 0xa27d1de], esi
fdiv st(5)
pushfd
xchg edx, eax
arpl word [ebx], dx
adc al, 0x41
push edx
enter 0xffffffffffffe744, 0x55
pop ebp
xchg esp, eax
jp 0x5481e2
aad 0xab
cdq
shl byte [edi - 0x77], 1
cmc
mov ah, 0x3a
inc ebp
mov edi, 0xa32c43dc
xor bl, al
xchg edi, eax
mov eax, dword [0x8675c8f5]
fadd dword [ebp - 0x7579fc5c]
jb 0x54822a
push ecx
js 0x54815c
sub al, 0x1d
xchg ecx, eax
out 7, al
cmc
rol esp, cl
xor edx, ecx
xchg edi, eax
and byte [esi - 0x52f2eaec], dh
add eax, 0x7749113c
movsb byte es:[edi], byte [esi]
push 0xb8da6b2
and byte [esi], 0x99
and dl, dl
mov dl, 0x87
jg 0x548222
jecxz 0x5481a4
movsb byte es:[edi], byte [esi]
cmp al, 0x24
pop ebp
xor al, 0xe4
sbb esp, eax
dec esi
inc ebx
add al, 0x43
adc eax, 0xf8b783c6
inc edi
leave
test eax, 0x2a6f6e5e
xchg edi, eax
add al, 0xd6
add eax, 0xd3e761cc
invalid
out 0x44, eax
idiv dword [edx]
push esi
jp 0x54825c
invalid
mov ebx, 0x55749334
add bl, byte [di]
xchg edx, eax
cmpsd dword [esi], dword es:[edi]
mov ebx, 0x96015cba
aad 0xbf
inc ebx
and eax, 0x1c74247a
and bl, dl
sub dh, bl
xchg edx, eax
xchg dword [esi], esi
scasb al, byte es:[edi]
inc esi
push edi
lea edx, [ebx]
push eax
or eax, 0x770dc90b
dec ebp
shl dword [eax + 0x17cc945e], cl
jecxz 0x548222
invalid
sar dword [eax], 0x32
pop es
and eax, 0x1270aaf1
mov ebx, 0x826ae1d4
inc esi
stosd dword es:[edi], eax
retf
Function at 0x553667
Capabilities:
Encode data using xor

Disassembly:
push ss
cmp al, 0x24
mov bh, 0x21
jo 0x553696
aad 0x1e
adc ch, al
mov byte [0x528299be], al
jb 0x5536b9
xor ch, ah
adc dh, byte [0xc029342a]
mov dword [ebp - 0x2ef7dbed], ebp
mov byte [0x83ed47e5], al
mul byte [esp + eax*2 - 0x696cbf74]
scasb al, byte es:[edi]
in al, 0x4c
dec esp
mov dword [0xaf8eff9d], eax
xor byte [edx], ah
push esi
inc edx
jno 0x553718
xchg dword [ebp + edx - 0x27], ebx
aam 0x71
jge 0x5536b7
pop es
lcall 0x9593, 0xc4dc499b
aam 0xda
xchg dword [ecx + 0x441c0f09], esp
mov eax, dword [0x441c0f09]
cldemote byte [esi + eax*2 - 7]
inc esi
stc
push edx
and eax, 0xc647800f
and eax, 0xce258134
test dword [ebp - 0x2c28ad98], ebp
or byte [ebx + 0x65bbc390], dh
ficomp dword [edi + 0x54]
and ecx, edx
invalid
and esp, dword [0xe0aebd15]
adc byte [ecx + 0x10624f9], dh
jge 0x553790
push ebx
mov byte fs:[0x8392b382], al
pop ebx
cmp dword [ebp - 0x6b], esp
cdq
cmc
and esp, esp
and dword [ebx - 0x5c889e0], edx
shr dword [edx], cl
dec edx
and eax, 0x91a24e2
xor eax, 0xbd00511c
invalid
sbb al, 0x9c
hlt

Function at 0x572f67
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.005a6457
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x57308a
push ecx
lea ecx, [esi + 0x18]
call fcn.00592787
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x5730a1
push ecx
lea ecx, [esi + 0x24]
call fcn.00592697
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x591747
Capabilities:
Encode data using xor

Disassembly:
clc
mov ebp, dword [ecx - 0x251077be]
jmp 0x591748
xchg esp, eax
cmp ch, cl
jmp 0x591708
lahf
mov esi, 0x56af4d81
scasb al, byte es:[edi]
pop ds
mov eax, dword [0xc119452d]
sbb ecx, eax
mov al, byte [0xcc1eb00c]
xor byte [edx + ebx*4 - 0x180da4b8], ah
or ebx, ebp
test al, 0x67
std
push ss
outsb dx, byte [esi]
mov ebp, 0x42697a8b
lea esi, [eax]
or ebx, dword [edx]
jne 0x591752
jo 0x59171e
mov dl, 0x61
test al, 0x3c
shl byte [ecx], 1
insd dword es:[edi], dx
into
sub byte [esi + 0x7b], al
call 0x8481974e
xor ebx, esi
mov al, byte [0x9a82ed8d]
pop esp
cmp dword [esi - 0x484ba285], edi
pop esi
imul eax, ebp, 0xffffffdc
sub eax, 0xd02f52da
outsb dx, byte [esi]
cmp byte [edi + 0x73], cl
shr dword [eax - 0x52ec353e], 0xee
cmpsb byte [esi], byte es:[edi]
xchg edx, eax
mov eax, 0x66df605e
dec eax
or eax, 0xe49ead4
lodsb al, byte [esi]
pop es
int1
sar dword [0x1f317618], cl
or dword [esi + 0x30a867a7], edi
pop ebp
fdivr qword [eax + 0x73]
jmp 0xd10594ae

Function at 0x5bcc87
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.005f0177
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x5bcdaa
push ecx
lea ecx, [esi + 0x18]
call fcn.005dc4a7
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x5bcdc1
push ecx
lea ecx, [esi + 0x24]
call fcn.005dc3b7
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x5efb57
Capabilities:
Encode data using xor

Disassembly:
or byte [0x2899cd78], dh
mov dh, 0x12
call 0xaf0abf
cmp dword [esi + 0x55], ecx
Function at 0x606317
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00639807
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x60643a
push ecx
lea ecx, [esi + 0x18]
call fcn.00625b37
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x606451
push ecx
lea ecx, [esi + 0x24]
call fcn.00625a47
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x64d5ed
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x655338
cmp edx, dword [eax]
je 0x64d60f
add eax, 8
inc ecx
cmp eax, 0x6553c8
jl 0x64d600
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x655338]
jne 0x64d73d
mov eax, dword [0xa58c90]
cmp eax, 1
je 0x64d717
test eax, eax
jne 0x64d640
cmp dword [0x655264], 1
Function at 0x100015a5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x100015b4
pop dword [ebp - 0x48]
mov eax, 0x100015b4
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x46f57e30
sub dword [ebp - 0x58], 0xf8a338e5
mov dword [ebp - 0x54], 0xcd15481e
sub dword [ebp - 0x54], 0x9ae1fbd9
mov dword [ebp - 0x50], 0x4f56b38
sub dword [ebp - 0x50], 0xb8a9270a
mov dword [ebp - 0x4c], 0xac7d3cfa
sub dword [ebp - 0x4c], 0xac7d3cfa
lea eax, [ebp - 0x58]
push eax
mov eax, 0x37a0755c
add eax, 0xd85fbaa8
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x42b4e7c3
sub dword [ebp - 0x58], 0xce427e6d
mov dword [ebp - 0x54], 0xe5411b85
add dword [ebp - 0x54], 0x5c2b45f0
mov dword [ebp - 0x50], 0xef85080b
add dword [ebp - 0x50], 0x73ea6461
mov dword [ebp - 0x4c], 0xaa3f253f
sub dword [ebp - 0x4c], 0xaa3f253f
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x333d7
push 0
call eax
mov ecx, 0x3b06
xor ebx, ebx
add ebx, eax
mov edx, 0x125af0d0
sub edx, 0x25a8cd0
add edx, dword [ebp - 0x48]
mov edi, 0x401b120c
mov dword [ebp - 0x24], 0xf2ef51c3
mov esi, dword [edx]
sub dword [ebp - 0x24], esi
sub esi, edi
xor dword [ebp - 0x28], eax
mov dword [ebx], esi
add ebx, 0xe483d53d
sub ebx, 0xe483d539
add edx, 0x1e8590da
sub edx, 0x1e8590d6
loop 0x100016c2
add eax, 0xdeeb
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x402bf1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x402c00
pop dword [ebp - 0x14]
mov eax, 0x7cca3711
add eax, 0x8375f4ef
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x707048f
add dword [ebp - 0x24], 0x474b40bc
mov dword [ebp - 0x20], 0xd4d60f9f
sub dword [ebp - 0x20], 0xa2a2c35a
mov dword [ebp - 0x1c], 0xdfe81b13
add dword [ebp - 0x1c], 0x6c64291b
mov dword [ebp - 0x18], 0xadc61f68
sub dword [ebp - 0x18], 0xadc61f68
lea eax, [ebp - 0x24]
push eax
mov eax, 0x6a93837e
sub eax, 0x6a53131a
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0x408e900b
add dword [ebp - 0x24], 0x33e3d94b
mov dword [ebp - 0x20], 0xd27df003
add dword [ebp - 0x20], 0x6eee7172
mov dword [ebp - 0x1c], 0xd48cd988
add dword [ebp - 0x1c], 0x8ee292e4
mov dword [ebp - 0x18], 0x641023d5
add dword [ebp - 0x18], 0x9befdc2b
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x3acf2
push 0
call eax
mov ecx, 0x2357f329
add ecx, 0xdca86552
mov edi, eax
mov edx, 0x81cc392
sub edx, 0x7dbc392
add edx, dword [ebp - 0x14]
mov esi, 0xfa166e17
xor dword [ebp - 0x10], 0x7cc412f2
mov ebx, dword [edx]
add ebx, esi
add dword [ebp - 0x10], 0x93c44663
mov dword [edi], ebx
sub dword [ebp - 8], 0xa1172d89
add edi, 4
add edx, 0x8777bc1f
add edx, 0x788843e5
loop 0x402d17
add eax, 0xe5396a35
sub eax, 0xe5381576
mov ebx, eax
add eax, 0x35038c8a
add eax, 0xcafc737b
mov ecx, 0x400000
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408e84
mov ecx, 0x202026d2
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x528e1f21
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x42335e
Capabilities:
Encode data using xor

Disassembly:
sub byte [eax + 0x339155dd], ch
mov al, byte [0xe521c29]
jne 0x423394
loop 0x4233d3
aaa
or byte [ebx], bl
or byte [ebp + edi*8 + 0x62], 0xa8
ret 0xd2b8
push esp
mov eax, dword [0x46a096fd]
xchg byte [esi - 0x5c], bh
invalid
sub dword [esi + 0x4934eed7], ebx
pop esi
sbb edi, edx
scasb al, byte es:[edi]
xchg edx, eax
sahf
adc dword [esi + 0x77], ecx
sbb al, 0xde
dec edi
xor byte ds:[esp + eax - 0x51], 0x59
jecxz 0x4233d9
or eax, 0x24bcd20b
sub eax, 0x15f3f1d2
xchg ecx, eax
and eax, 0x8032de8
retf

Function at 0x44a210
Capabilities:
Accept command line arguments
Link many functions at runtime

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
xor ebx, ebx
push edi
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push str.Kernel32
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x44a2d8
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CreateToolhelp32Snapshot
push edi
call ebx
push str.Thread32First
push edi
mov dword [esi + 4], eax
call ebx
mov dword [esi + 8], eax
lea eax, [esp + 0x14]
push eax
push ebp
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push str.Thread32Next
push edi
mov ebp, eax
call ebx
push str.Module32FirstW
push edi
mov dword [esi + 0xc], eax
call ebx
push str.Module32NextW
push edi
mov dword [esi + 0x10], eax
call ebx
mov ecx, dword [esi + 4]
mov dword [esi + 0x14], eax
test ecx, ecx
je 0x44a2c7
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x44a2c7
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x44a2c7
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x44a2c7
test eax, eax
je 0x44a2c7
push edi
mov dword [esi], 1
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
push edi
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor ebx, ebx
jmp 0x44a2dc
mov ebp, dword [esp + 0x14]
cmp ebp, ebx
je 0x44a2f2
mov ecx, dword [0x658abc]
push 0x6587d8
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x45c2fe
Capabilities:
Encode data using xor

Disassembly:
push ecx
pop eax
dec esi
sub eax, dword [ecx]
mov byte [0xf18ab73d], al
ret 0xfcd2
mov cl, 0x73
ret 0xd1e2
adc al, 0x5b
push esi
jle 0x45c2bd
mov ecx, 0x70167a26
mov al, byte [0x752da330]
mov ah, 0xbc
jp 0x45c31d
jo 0x45c2a9
xor byte [ebx - 0x434b8ad3], ah
mov bl, 0xc2
add al, 0x40
sbb ecx, edi
fdiv st(2)
stc
cmp dword [ecx - 0x76a238f3], esi
dec ebp
xlatb
mov dword [ebp - 0x29], ecx
dec esp
jbe 0x45c344
nop
push cs
jae 0x45c2ac
invalid
mov dh, 0x72
mov esp, 0x8cdfca18
jnp 0x45c38d
jb 0x45c303
sbb dl, cl
fisttp word [ebx + edi*2 + 0x4bf67a40]
jp 0x45c345
dec ebx
sub al, 0x29
and bl, al
sub byte [0x9f2e397d], 0x41
fadd dword [edx + 0x2e397d2d]
lahf
inc ecx
mov ah, byte [ecx]
out 0x9b, al
push edi
xor edi, dword [ecx]
mov eax, dword [0xf95b7e7b]
mov edi, 0x54d31e6
pop eax
call 0xd1d55a4
pop ebp
jne 0x45c353
inc edi
jmp 0x5a76b22a
xor al, 0xe3
fnstenv [ecx]
adc al, 0xf9
pop ds
ret

Function at 0x496f6e
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.004ca45e
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x497091
push ecx
lea ecx, [esi + 0x18]
call fcn.004b678e
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x4970a8
push ecx
lea ecx, [esi + 0x24]
call fcn.004b669e
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x49cd04
Capabilities:
Encode data using xor

Disassembly:
movsb byte es:[edi], byte [esi]
pop es
rcl dword [edx + 0x64f8a26f]
outsd dx, dword [esi]
rol dword [eax + 0x25], 0x56
push 0x1a
adc dword [edx + 0x3010acb1], edx
invalid
sbb eax, dword [esi - 0x170cdfef]
jae 0x49cbfd
call 0x74edf747
shl byte [ebx + 0x19], cl
movsb byte es:[edi], byte [esi]
je 0x49cba7
arpl word [ecx], bx
shl byte [edx], 0x40
fisttp word [ebx + 0x26]
invalid
pop edi
push esp
cdq
test eax, 0x74065c8f
pop esp
push es
je 0x49cc5e
invalid
xchg ebx, eax
xchg ebx, eax
jg 0x49cbca
into
lea edx, [edx - 0x4f]
cmp al, 0xa6
push edx
mov cl, 0x3c
cmpsb byte [esi], byte es:[edi]
ror byte [edx - 0x440eda52], 1
ja 0x49cbf5
mov ebx, 0x7941ec77
ret 0x5372
inc ecx
jns 0x49cbce
jb 0x49cc61
bound ecx, qword [ebx]
call 0x4e178dbc
lahf
loop 0x49cc06
xchg edx, eax
adc dword [ebx - 0x349a7a2b], edx
rol ebx, cl
fisubr dword [edi + edi]
loope 0x49cc1e
retf
jle 0x49cc7d
xor cl, cl
or dl, byte [edx + edi*8 - 0x24fcdcf]
pop ecx
sub eax, 0x6c2cae34
loop 0x49cbfb
sbb ah, byte [eax + 0xc]
dec ebx
or dword [edx - 0x40], edx
mov byte [0x62c7e3d3], al
invalid
mov cl, 0x2c
adc bh, dl
xlatb
push ecx
lea esi, [ecx + 0x7ad96272]
sti
cmc
jne 0x49cbf0
stosd dword es:[edi], eax
int3
xlatb
adc dh, byte [esi]
inc edx
cmpsb byte [esi], byte es:[edi]
push cs
cmc
or eax, 0xc5ee36f5
popal
xchg edx, eax
repne outsd dx, dword [esi]
loope 0x49ccb1
movsd dword es:[edi], dword [esi]
les eax, [eax]
xor eax, 0x451dc5ed
push 0xffffffffffffffd1
xor eax, 0x4db40351
retf
mov ebx, 0xa532024c
xchg edx, eax
loop 0x49cc3c
lahf
rcr byte [edx + 0x36e8254f], cl
jp 0x49ccb1
inc esp
pushfd
pop ss
imul esp, dword [ebp + 0x17], 0x7b1e6f3
mov bl, 0x6c
xchg esp, ebp
movsb byte es:[edi], byte [esi]
and esi, dword [eax + ebx + 0x9252ddc]
sub eax, 0x214099b6
push edx
nop
jns 0x49cc61
jecxz 0x49cd12
add eax, 0xceb30c31
xchg ebp, eax
nop
invalid
lcall 0x7287, 0xa1e9b6
inc ebp
mov eax, dword [0xc47af200]
jp 0x49ccca
xor al, 0x2a
and eax, 0x33e09923
pushfd
insd dword es:[edi], dx
scasb al, byte es:[edi]
rcr byte [ecx + 0x59], 0x49
pop ecx
dec ecx
bnd jno 0x49ccf9
ja 0x49ccab
and dh, dh
insb byte es:[edi], dx
mov ebp, 0x1d04b070
adc byte [ebx + 7], dl
in eax, 0x12
imul edx, dword [ecx + 0x54fd900a], 0xe970d8ee
cmpsd dword [esi], dword es:[edi]
inc ebx
int3
Function at 0x4e03ce
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.005138be
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x4e04f1
push ecx
lea ecx, [esi + 0x18]
call fcn.004ffbee
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x4e0508
push ecx
lea ecx, [esi + 0x24]
call fcn.004ffafe
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret