joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0xab00b0
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00ab0200
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xab00d6
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xab00c2
add dl, dl
jne 0xab00e1
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xab0134
xor eax, eax
add dl, dl
jne 0xab00ee
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xab01d5
add dl, dl
jne 0xab00fd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xab0108
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xab0113
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xab011e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xab012a
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xab00cd
mov eax, 1
add dl, dl
jne 0xab0142
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xab014d
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xab0139
sub eax, ebx
mov ebx, 1
jne 0xab0180
mov ecx, 1
add dl, dl
jne 0xab0166
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xab0171
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xab015d
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xab00cd
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xab0197
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xab01a2
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xab018e
cmp eax, 0x7d00
jae 0xab01c5
cmp eax, 0x500
jb 0xab01c0
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xab00cd
cmp eax, 0x7f
ja 0xab01c8
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xab00cd
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xab01f6
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xab00cd
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x40491e
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00437e0e
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x404a41
push ecx
lea ecx, [esi + 0x18]
call fcn.0042413e
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x404a58
push ecx
lea ecx, [esi + 0x24]
call fcn.0042404e
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x493570
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
push esi
lea eax, [ebp - 0x198]
push edi
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
call fcn.0044a210
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 8], 1
call edi
lea ecx, [ebp - 4]
mov esi, eax
push ecx
push 0x2000000
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4935f0
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push 4
push edx
push 0x18
push eax
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
je 0x4935e6
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x4935f0
call edi
jmp 0x4935f0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0xb462c1
Function at 0x496fae
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.004ca49e
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x4970d1
push ecx
lea ecx, [esi + 0x18]
call fcn.004b67ce
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x4970e8
push ecx
lea ecx, [esi + 0x24]
call fcn.004b66de
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x49cc48
Capabilities:
Encode data using xor

Disassembly:
invalid
das
push es
pop edx
push edx
bound edi, qword [ebp + 0x36]
xor dword [ebx - 0x6e3fe43f], edi
xchg ecx, eax
scasb al, byte es:[edi]
rol bl, 0x8b
stosb byte es:[edi], al
salc
in eax, 0xfb
stosb byte es:[edi], al
mov bl, 0xef
sub eax, ebx
inc esp
sub eax, 0xbc14472e
adc dword [edi + edx*4], ebp
sub dl, byte [ecx]
dec esp
mov edi, 0xabe92274
mov al, 0x98
sti
push ds
cmp al, 0x42
mov bh, 0x8f
jns 0x49cc4a
jb 0x49cc1a
mov bh, 0xc0
loope 0x49cd02
or byte [edi + 0xc], ch
mov bh, 0xea
mov al, 0x3c
or dword [esi*4 + 0x5f2e3978], esp
jl 0x49cd03
dec edx
fild qword [esp + eax*4]
xchg ebp, eax
adc al, 0xfc
xchg byte [edx], al
clc
mov ebp, 0x9c3f6790
or dword [edi - 0x2824f10c], eax
push eax
leave
jl 0x49cc9e
pop edx
out dx, al
sub al, 0xac
into
adc dword [esi + edi], edi
test eax, 0x9c6fd61f
lodsb al, byte [esi]
mov cs, word [edx - 0x30435d61]
inc ecx
jp 0x49cc54
pop ebp
test al, 4
or al, 0x1f
pop ebx
xchg ecx, eax
das
or dh, byte ss:[0xb467fb30]
fimul word [eax - 0x24374bdb]
mov ebp, 0x268fdd8f
sbb esi, 0x9da664a2
sti
push 0x74
scasd eax, dword es:[edi]
scasd eax, dword es:[edi]
ljmp 0xe2a8
stc
push ds
dec ebx
dec esi
in al, dx
inc edi
push 0x60
sahf
push edi
sahf
xor dword [ebp + ecx*4 - 0x5fea90c7], ecx
invalid
Function at 0x4e040e
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call int.005138fe
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x4e0531
push ecx
lea ecx, [esi + 0x18]
call fcn.004ffc2e
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x4e0548
push ecx
lea ecx, [esi + 0x24]
call 0x4ffb3e
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x513a2e
Capabilities:
Check for vm using instruction vpcext

Disassembly:
dec cl
sbb al, 0xde
invalid
imul ebx, dword [0x6a914d2b]
inc edi
lodsd eax, dword [esi]
adc edi, dword [ebp - 0x720f4ded]
lodsd eax, dword [esi]
mov esi, 0x83314cf8
sti
in eax, 0xee
adc esi, dword [edx - 0x41527210]
clc
dec esp
xor dword [ebx - 0x20111a05], eax
cwde
sbb al, 0xd8
jmp 0xcdde77e
out dx, al
fistp word [eax + 0x5de9d81c]
lodsd eax, dword [esi]
mov word [esi + edi*4], cs
int 0x8f
fdiv qword [0xa103f33c]
push ds
and eax, 0xdbe0e0fc
loopne 0x513a0b
loopne 0x513a0b
rcr byte [ecx + 0x11fede89], cl
imul dword [edx - 0x5dc3903f]
cmp al, 0xee
xchg ebx, eax
popfd
js 0x513a48
out 0x59, eax
jp 0x513a24
sbb byte [ecx + 0x79], bl
jge 0x513a5e
pop ecx
jns 0x513ac8
adc bh, byte [edx]
lds ebp, [eax - 0x7da44ca8]
mov eax, 0x12338f5c
mov edx, 0xee471380
cmp al, ch
test al, 0x58
mov bl, 0x5b
cmp byte [eax + 0x12338f5c], 0xba
adc byte [ebx], 0x47
out dx, al
cmp dword [edx + ebp*4], 0x71
sahf
cmp al, 0xaa
jno 0x513a00
jne 0x5139e5
cld
adc ebx, dword [eax + 0x1e]
add ch, byte [eax + eax + 0x5f8d0a22]
add ecx, dword [edi]
mov al, byte [ecx]
bound esi, qword [esi + 0x1d]
lcall 0xc6b9, 0x616a7841
push ecx
xchg ecx, eax
bound eax, qword [eax - 0x1f]
xchg ebx, eax
js 0x513ae5
popal
mov ecx, 0x629151c6
inc eax
loope 0x513a17
mov cl, 0x95
sub dl, ah
inc esp
pop edi
invalid
test byte [ecx], 0xfe
fadd qword [ebx]
xor dword [esi + 0x4b7c8f80], ebx
sub al, byte [ecx + 0x12317f5c]
mov ebx, edi
dec ebp
jb 0x513aff
int1
rcl dword [edx - 0x3f], 0xfe
enter 0xffffffffffffa111, 0xffffffffffffff96
in al, 0x80
sub dword [ebp + 0xc], ebx
rcr dword [esp + edx*2], 0x98
and dword [eax - 0x518eb395], eax
dec esp
jno 0x513a79
ja 0x513a9d
shr dword [ebx + eax*8 + 0x3123d6a3], 0x7c
in al, dx
adc dword [ecx], esp
jns 0x513b35
retf
lahf
invalid
mov ch, byte [edx + esi*2 - 0x47]
dec eax
mov dword [0x35b11ab2], eax
adc byte [ebx], al
mov dl, 0xc5
pop esp
push cs
push esi
cmp dword [esi - 0x28955138], 0x51
into
xchg esp, eax
ficom word [ebx]
sti
insd dword es:[edi], dx
adc dword [ebp - 0x48], edx
lodsb al, byte [esi]
in al, dx
and byte [esi + 0x4b12713c], al
jp 0x513af3
sub eax, 0xc4f2a1a6
adc dword [ecx + 0x79ee5397], ecx
or byte [edx - 0x11], cl
push ebx
out dx, al
jns 0x513b32
dec edx
out dx, eax
popal
fisttp dword [ebx + ebx*2 - 0x2bb2c1b0]
pop esp
dec ebp
aam 0x5c
lahf
jecxz 0x513b26
fsubr st(1), st(0)
retf 0xd28b
Function at 0x529b3e
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.0055d02e
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x529c61
push ecx
lea ecx, [esi + 0x18]
call fcn.0054935e
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x529c78
push ecx
lea ecx, [esi + 0x24]
call fcn.0054926e
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x549f5e
Capabilities:
Encode data using xor

Disassembly:
mov dl, 0x23
mov al, byte [0xcb83c0bc]
and byte [edx + 0x1c], cl
xlatb
pushal
add eax, 0x79bb5672
in al, dx
add esp, dword [ebx + 0x2c8a011e]
imul edx, dword [eax + eax*8 - 0x47], 0x31
push es
sub dword [ecx - 0x1f4d749], edi
mov ebx, 0xe0c35d9b
out 0x50, al
shl dword [0xaf13310], cl
dec ebp
and al, bh
or cl, byte [ebp + 0x20]
clc
mov byte [0xf377a5b9], al
jno 0x549f52
xchg ebx, eax
nop
pushfd
xchg byte [ebx - 0x167332cc], ah
jle 0x549f6a
push esi
div ah
loope 0x549f22
hlt
invalid
Function at 0x54b6de
Capabilities:
Encode data using xor

Disassembly:
xor eax, 0x8b2b9023
pop ds
cmp al, 0x81
mov bl, 0xdf
xlatb
cmp dword [eax + ebx + 0x13], esi
sbb byte [ebp + ebp*8 - 0x25fd00ad], ch
xor dword [eax + 0x2f], esp
or byte [eax], 0x2d
aam 0x66
cmp eax, 0x74117244
js 0x54b73d
cwde
push cs
insd dword es:[edi], dx
mov eax, dword [ecx]
in eax, 0x4d
dec ebp
dec ebp
push edi
fist dword [ebx - 0x30fb45f]
sar dword [eax - 1], cl
mov esp, 0xe398d6bf
push edi
ja 0x54b717
test al, 0x3c
adc dword [edx - 0x607d1038], edx
add eax, 0xd0de7252
dec ebx
sub eax, 0x10228270
xchg ecx, eax
loopne 0x54b6b2
aam 1
imul edx, dword [esi - 0x46230958], 0x3009edc0
invalid
xchg esi, eax
arpl word [ebp - 0x39], bx
or ebp, ebp
pop edi
xchg edi, eax
test eax, 0x23d68fad
dec ebx
pop esp
cmp al, 0x9c
into
sti
xchg esp, eax
mov bh, al
clc
sub byte [eax], ah
xchg ecx, eax
fmulp st(0)
sbb al, 2
dec esi
stosd dword es:[edi], eax
pop esi
test byte [edx], dl
into
inc edx
fld st(2)
push esi
mov dword [0x9dba83b9], eax
xor al, 0xd8
inc esi
xchg ebp, eax
cmp dword [edx + 0x46d8349d], 0xffffff95
ror dh, 1
inc esp
rcl dword [ebx - 0x38b8ea25], 0x37
fsub st(4), st(0)
nop
cmp ebx, dword [eax + 0x3a614b43]
mov edx, 0xf732c6f4
dec esi
adc dh, byte [ebp - 0x6d]
sahf
xor eax, 0x55fa11c1
jo 0x54b743
mov eax, 0x4b0f9c9
mov eax, dword [0x42333784]
das
invalid

Function at 0x55c76e
Capabilities:
Encode data using xor

Disassembly:
aaa
xchg esp, eax
in al, 0x2c
jo 0x55c797
pushal
mov bl, 0x14
adc al, byte [eax]
jge 0x55c78c
test eax, 0xa25f7a7c
push edx
movsd dword es:[edi], dword [esi]
insd dword es:[edi], dx
mov ss, word [eax - 0x3b]
xor byte [ebx - 0x1c317f82], dh
mov bl, 0x7e
or dh, 0xe3
into
jecxz 0x55c79d
push cs
inc ebx
cmp eax, 0x9110bbcc
xchg ebx, eax
or al, 0xc
mov cl, 0x83
test dword [edi - 0x59], edi
or al, 0xb1
add dword [ebp - 0x472f5881], 0x70
mov dl, 0x14
scasd eax, dword es:[edi]
sar byte [eax - 0x50eb4d90], 1
mov byte [0x399c242], al
adc eax, 0x44e7401f
xor dword [ecx - 0x5fdce0a2], edx
cmp edx, dword [edi + ebp*2]
add esp, dword [eax + 0xe]
push 0xffffffffffffffdb
dec ebx
dec esi
adc ecx, dword ds:[eax + 0x75]
mov dl, 0xe3
cmp dword [eax], esi
cmp eax, 0xe2e340e9
xchg ebp, eax
add dh, dl
push ecx
jo 0x55c789
xchg esi, eax
cmp ebp, dword [eax]
iretd
Function at 0x57314e
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call int.005a663e
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x573271
push ecx
lea ecx, [esi + 0x18]
call fcn.0059296e
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x573288
push ecx
lea ecx, [esi + 0x24]
call fcn.0059287e
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x59274e
Capabilities:
Encode data using xor

Disassembly:
or al, 0xce
lea edi, [edx]
jb 0x59276f
lahf
dec esp
int 0xe1
invalid
xor bl, 7
dec ebx
not dword [ebx - 0x12]
push ebx
out dx, al
push ecx
inc ebx
xor ch, byte [ecx]
jno 0x592774
bts dword [esi + esi - 0x34], eax
invalid

Function at 0x5a601e
Capabilities:
Encode data using xor

Disassembly:
les esi, [eax - 0xf]
std
pop es
jl 0x5a604b
add edx, dword [esi - 0x73]
wait
pop ecx
dec dword gs:[edi]
push esp
jecxz 0x5a6059
mov cl, 0xd4
xlatb
mov ebx, 0x93bef7f3
jno 0x5a6061
xchg dword [edx], edi
out dx, al
in al, 0x84
retf
daa
in eax, dx
je 0x5a6047
cmp byte [edx + 0x307136a4], dl
pushal
mov edi, 0xc563c726
jbe 0x5a60ab
pop edx
and al, 0xe5
cmp al, 0x27
adc byte [ebp - 0x46], bh
cmp ah, byte [eax + 0x47f26922]
jnp 0x5a605c
salc
and eax, 0xbdc39bf2
xchg esi, eax
lds eax, [edi]
mov ebp, 0xd07c596
jmp 0x5a5fd7
or eax, 0xd32f89eb
sbb dl, byte [ecx]
mov dword [0xfde7b87e], eax
jg 0x5a6068
adc byte [edx], al
outsb dx, byte [esi]
xchg ebx, eax
rcl dword [edi + 0x15]
push edi
invalid
mov dl, 0x9f
lahf
rol dword [ecx - 0x4f59672a], 0x13
adc edi, dword [edi]
xor edx, dword [edx + 0x13aee3fc]
in al, dx
sub dword [ebx*2 + 0x755ece95], 0x57
or esi, dword [ebp - 0x25]
pop ss
invalid
Function at 0x5db77e
Capabilities:
Encode data using xor

Disassembly:
inc edi
push ebp
xor dword [ebp - 0x510185d2], eax
imul ebp, eax, 8
outsb dx, byte ds:[esi]
jb 0x5db781
xchg ebx, eax
xchg ecx, eax
arpl word [ecx + 0x71], cx
jne 0x5db7c9
in eax, 0x57
cwde
invalid
retf
imul ebx, dword [0x762ec946], 9
jbe 0x5db7d4
or ebx, dword [edi]
dec ebx
dec eax
jmp [eax + edi*4]
clc
adc ecx, ebx
sub ch, ch
push eax
stosd dword es:[edi], eax
add byte [ebp + 0x5dce57c1], bh
push esp
sub eax, 0x71befe3a
sbb al, 0x7e
or dh, dl
bound eax, qword [edx + 0x74]
adc al, dh
stosd dword es:[edi], eax
fcomp st(5)
stc
xchg edx, eax
jecxz 0x5db7b8
push edx
jns 0x5db7c4
out dx, eax
mov esp, 0x6957c69b
sub eax, 0x1cd3ba76
fcmovbe st(0), st(4)
popfd
sbb eax, 0x9e576c0a
pminub mm1, qword [bx - 0x4c]
mov esi, 0xdfaab8d6
push ebx
daa
mov eax, 0x2753dfaa
stosb byte es:[edi], al
fist word [ebx + 0x27]
and byte [eax - 0x4d12311e], al
pop ecx
cmp al, 0x9e
sahf
ja 0x5db844
jns 0x5db815
jp 0x5db88e
dec edx
imul ebp, dword [ebp - 0x691127b3], 0xffffffce
xchg byte [edi - 0x39], bh
fisub word [edi]
iretd
mov bl, 0x1f
mov esi, 0xc3838a5
bound eax, qword [esi + ecx*2 - 0x73a3ba6]
loopne 0x5db816
int 0x1d
and dword [eax + 0x4df92b9c], edx
cli
and dword [edx + 0x478ead1a], ebx
xchg byte [eax + ecx*8 - 0x48f83abb], al
or ch, cl
mov esp, 0xfe0430ec
sbb ch, byte [ebp - 0x7b79b872]
enter 0xffffffffffffc545, 7
mov bh, 8
int 0xbc
in al, dx
xor byte [esi + edi*8], al
mov dword [0x7c968ec8], eax
xchg edi, eax
pushfd
push 0xc7f69aef
adc al, 0x5c
inc ebp
retf
jecxz 0x5db85f
push ebx
invalid
Function at 0x64cd5d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x654390
cmp edx, dword [eax]
je 0x64cd7f
add eax, 8
inc ecx
cmp eax, 0x654420
jl 0x64cd70
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x654390]
jne 0x64cead
mov eax, dword [0xa57cf0]
cmp eax, 1
je 0x64ce87
test eax, eax
jne 0x64cdb0
cmp dword [0x6542b8], 1
je 0x64ce87
cmp edx, 0xfc
je 0x64cead
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x64cde7
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0064d740
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0064dbd0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x64ce2a
lea eax, [ebp - 0x1a4]
push eax
call fcn.0064dbd0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x652524
push edi
call fcn.0064faa0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0064d740
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0064d750
lea eax, [ebp - 0xa0]
push 0x652504
push eax
call fcn.0064d750
push dword [esi + 0x654394]
lea eax, [ebp - 0xa0]
push eax
call fcn.0064d750
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0064fa14
add esp, 0x2c
pop edi
jmp 0x64cead
lea eax, [ebp + 8]
lea esi, [esi + 0x654394]
push 0
push eax
push dword [esi]
call fcn.0064dbd0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret