joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40eb68
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40ec3d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x40ec58
push ebx
push 0x40ec68
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.0040513c
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00403250
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404d24
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x40ebe8
mov al, 0x6a
call fcn.0040e788
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.0040eb3c
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x40ebf1
call fcn.0040eb3c
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40ec44
lea eax, [ebp - 4]
call fcn.00404c88
ret

Function at 0x40ed58
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo_1
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery_1
test eax, eax
je 0x40ee23
jmp 0x40ee17
cmp dword [esi + 0x10], 0x1000
jne 0x40ee03
test byte [esi + 0x15], 1
jne 0x40ee03
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x40edb4
cmp ebp, 2
je 0x40edb4
cmp ebp, 0x10
je 0x40edb4
cmp ebp, 0x20
jne 0x40edd0
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x40edd0
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x40ede1
mov eax, dword [esi]
add eax, ebx
call fcn.0040ed50
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x40edd4
cmp byte [esp + 4], 0
je 0x40ee03
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery_1
test eax, eax
je 0x40ee23
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x40ed89
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x430a67ba
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x430aa9f0]
jne 0x430a67c4
repz ret
jmp fcn.430a7df9
Function at 0x40f22e
Capabilities:
Create pipe

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 0x84], edi
jne 0x40f2cb
push edi
xor ebx, ebx
mov dword [esi + 0x84], 2
inc ebx
push ebx
push edi
call dword [sym.imp.kernel32.dll_CreateMutexW]
mov dword [esi + 0x44], eax
test eax, eax
je 0x40f2cb
push edi
push edi
push ebx
push edi
call dword [sym.imp.kernel32.dll_CreateEventW]
mov dword [esi + 0x9c], eax
test eax, eax
je 0x40f2cb
push 4
push 0xffffffffffffffff
push esi
push 0x40f9e5
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.kernel32.dll_RegisterWaitForSingleObject]
test eax, eax
je 0x40f2cb
lea eax, [esi + 0x20]
cmp dword [eax + 0x14], 8
jb 0x40f296
mov eax, dword [eax]
push dword [esi + 0x38]
push edi
push 0x40
push 0x40
push ebx
push 6
push 0x40080003
push eax
call dword [sym.imp.kernel32.dll_CreateNamedPipeW]
mov dword [esi + 0x3c], eax
cmp eax, 0xffffffff
je 0x40f2cb
push dword [esi + 0x9c]
call dword [sym.imp.kernel32.dll_SetEvent]
test eax, eax
jne 0x40f2d1
mov dword [esi + 0x84], ebx
xor al, al
pop edi
pop esi
pop ebx
ret
mov al, bl
jmp 0x40f2cd

Function at 0x413ca1
Capabilities:
Identify system language via api

Disassembly:
push ebx
mov ebx, ecx
push esi
test dl, dl
je 0x413cb1
call dword [sym.imp.kernel32.dll_GetSystemDefaultLangID]
jmp 0x413cb7
call dword [sym.imp.kernel32.dll_GetUserDefaultLangID]
xor edx, edx
movzx esi, ax
mov ecx, 0x409
push edi
mov edi, edx
mov eax, ecx
cmp si, ax
je 0x413cdf
inc edi
imul eax, edi, 0x1a
movzx eax, word [eax + 0x438830]
test ax, ax
jne 0x413cc6
mov esi, ecx
jmp 0x413ce2
movzx esi, si
pop edi
cmp cx, si
je 0x413cff
inc edx
imul eax, edx, 0x1a
movzx ecx, word [eax + 0x438830]
test cx, cx
jne 0x413ce3
mov eax, 0x437338
jmp 0x413d07
imul eax, edx, 0x1a
add eax, 0x438832
push eax
mov ecx, ebx
call main
pop esi
mov eax, ebx
pop ebx
ret

Function at 0x415005
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x415014
pop dword [ebp - 0x20]
mov eax, 0x415014
sub dword [ebp - 0x20], eax
push 0x40
push 0x1000
push 0x416b5
push 0
mov eax, 0x58b84c18
sub eax, 0x5875891c
add eax, dword [ebp - 0x20]
call dword [eax]
mov ecx, 0x425b
mov edi, eax
mov ebx, 0x448800
add ebx, dword [ebp - 0x20]
mov esi, 0xb1fe6191
sub dword [ebp - 0xc], 0xfa1cd08a
mov edx, dword [ebx]
xor dword [ebp - 8], 0x2dd819d5
xor edx, esi
mov dword [edi], edx
sub dword [ebp - 0x1c], eax
add edi, 4
add ebx, 0xd776079c
sub ebx, 0xd7760798
loop 0x41505c
add eax, 0xf2837f58
sub eax, 0xf2828319
mov ebx, eax
add eax, 5
mov ecx, 0xeaa373e9
sub ecx, 0xea6373e9
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x10006089
Capabilities:
Resume thread

Disassembly:
push 0x10
mov eax, 0x10011324
call fcn.10010dbc
mov ebx, ecx
mov dword [ebp - 0x18], ebx
cmp byte [ebx + 4], 0
jne 0x100061ed
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
cmp eax, dword [ebx]
jne 0x100061ed
push 0x1000334a
push 0xd008
call fcn.10007073
mov edi, eax
mov dword [ebp - 0x1c], edi
pop ecx
pop ecx
test edi, edi
je 0x100061e6
push 0xc000
xor ebx, ebx
push ebx
push edi
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xc000], ebx
lea eax, [edi + 0xc004]
push 0x1000
push ebx
push eax
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xd004], ebx
test edi, edi
je 0x100061e6
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
lea ecx, [ebp - 0x1c]
call fcn.10007073
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.10007073
mov esi, eax
push esi
push 0x10003028
mov dword [ebp - 0x10], esi
call fcn.10007073
pop ecx
pop ecx
test esi, esi
jne 0x1000619a
mov ecx, edi
call fcn.10007073
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100061fa
mov eax, dword [eax]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x10014250]
mov ecx, dword [ebp - 0x14]
call esi
call fcn.10007073
test eax, eax
je 0x10006190
jg 0x10006175
mov esi, eax
mov dword [ebp - 0x10], eax
jmp 0x10006181
movzx esi, ax
or esi, 0x80070000
mov dword [ebp - 0x10], esi
push esi
push 0x10003050
call fcn.10007073
pop ecx
pop ecx
jmp 0x1000619a
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x10]
mov byte [eax + 4], 1
lea ecx, [ebp - 0x1c]
call fcn.1000704c
lea eax, [edi + 0xc000]
mov dword [ebp - 0x1c], eax
cmp dword [eax], ebx
jbe 0x100061ce
lea esi, [edi + 8]
test byte [esi - 4], 1
je 0x100061c3
push dword [esi]
call dword [sym.imp.kernel32.dll_ResumeThread]
mov eax, dword [ebp - 0x1c]
inc ebx
add esi, 0xc
cmp ebx, dword [eax]
jb 0x100061b2
mov esi, dword [ebp - 0x10]
mov ecx, edi
call fcn.10007073
push 0xd008
push edi
call fcn.10007073
pop ecx
pop ecx
mov eax, esi
jmp 0x100061f2
mov eax, 0x8007000e
jmp 0x100061f2
mov eax, 0x800710dd
call fcn.10010d85
ret 4
call fcn.10007073
int3

Function at 0x10007073
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x10007082
pop dword [ebp - 0x44]
mov eax, 0xa18e4796
sub eax, 0x918dd714
sub dword [ebp - 0x44], eax
push 0x40
push 0x1000
push 0x38119
push 0
mov eax, 0x19384c3e
add eax, 0xf6c8f426
add eax, dword [ebp - 0x44]
call dword [eax]
mov ecx, 0xb5e3c61e
sub ecx, 0xb5e381f6
mov esi, eax
mov edx, 0x10018600
add edx, dword [ebp - 0x44]
mov ebx, 0x5b85cfe5
sub dword [ebp - 0x18], 0xfdddd3f4
mov edi, dword [edx]
xor dword [ebp - 0xc], edx
xor edi, ebx
mov dword [ebp - 0x10], 0x20a85bee
mov dword [esi], edi
mov dword [ebp - 0xc], 0xb5858d56
add esi, 0x6036ee8f
sub esi, 0x6036ee8b
add edx, 0x4d604717
add edx, 0xb29fb8ed
loop 0x100070d5
add eax, 0x6623b85d
sub eax, 0x6622b4ea
mov ebx, eax
add eax, 0xdf22c5d2
sub eax, 0xdf22c5cd
mov ecx, 0x53a45702
sub ecx, 0x43a45702
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x42616e
Capabilities:
Encode data using xor

Disassembly:
in al, 0x5e
lcall 0x740f, 0x4c67eea6
mov esp, 0x669e279a
jbe 0x4261c8
mov dh, byte [edx]
xor al, 0x8a
mov eax, dword [0xe0db3b1b]
ja 0x426180
sbb al, 0xa3
pop edi
aad 0xfb
push es
xchg ebp, eax
mov ebx, 0x3423ba1c
mov eax, dword gs:[0xb83040]
adc dword [esp + ebp], 0xfffffff6
invalid
inc ebx
nop
pop edi
push esp
mov ebp, 0x49c265e
mov edx, 0x1fa03b3
invalid

Function at 0x45619e
Capabilities:
Encode data using xor

Disassembly:
fdivr qword [edx + eax*8 + 0x466dfb9d]
invalid
mov bl, 0x52
mov edi, 0x758e84fa
xor esi, esi
call 0x774db6e0
movnti dword [edx - 0x29], esp
cmp byte [ebp + 0x57], 0x75
je 0x45613b
popfd
or al, 0xed
invalid

Function at 0x496d6e
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.004ca25e
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x496e91
push ecx
lea ecx, [esi + 0x18]
call fcn.004b658e
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x496ea8
push ecx
lea ecx, [esi + 0x24]
call fcn.004b649e
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x49cbdd
Capabilities:
Encode data using xor

Disassembly:
in al, 0x6f
out dx, al
adc ecx, ebx
mov bl, 0x76
xchg byte [esi + esi*8 + 0x39], cl
arpl word [edi - 0x786aefad], ax
adc byte [ebp - 0x2b57cf79], dl
mov esi, 0xf9eb82df
adc byte [ebp - 0x2b57cf79], dl
test al, 0xd4
mov esi, 0xf9eb82df
arpl word [ecx + 0x5d], bx
clc
shr dword [esi], 0x80
sub eax, 0xa1517207
lodsd eax, dword [esi]
pop ds
loop 0x49cbfd
clc
sbb eax, 0xc8e06eea
add al, byte [eax]
add bl, 0x55
pushfd
and ecx, dword [ebx - 0x572cd718]
mov dword cs:[0x227f31d7], eax
in al, 0x6a
loope 0x49cc41
enter 2, 0xffffffffffffff82
ret
mov dword [0x9ede4519], eax
inc esp
scasd eax, dword es:[edi]
pop eax
idiv byte [ecx]
salc
jle 0x49cbcf
mov esp, 0xb47e4168
neg dword [esp + edx*4 + 0x7c268e7b]
mov edx, 0x3857d440
jnp 0x49cc7a
aam 0x19
dec edx
lahf
sbb eax, 0x832a88a9
mov ebx, 0x4f19e393
dec edi
xor byte [0x61377bc], ah
arpl cx, di
bound edi, qword [0x3b3a8d74]
xor dh, byte [edx]
fst st(7)
adc byte [eax], dl
invalid
in eax, dx
dec edi
stosd dword es:[edi], eax
mov ebx, ecx
pop ebp
xor dword [ebp + 0x14], ebp
cli
dec ebx
or al, 0xa1
pop es
je 0x49cd06
add esi, esp
push ebp
scasb al, byte es:[edi]
inc eax
invalid
mov cl, 0xc9
mov dword [0x126d8878], eax
fdivr st(4), st(0)
fscale
pop ebx
aas
jge 0x49cd76
push es
fstp qword [edi + 0x493d2e6]
in eax, 0x7a
invalid
inc edx
push ds
ljmp 0xd64a

Function at 0x4e01ce
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.005136be
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x4e02f1
push ecx
lea ecx, [esi + 0x18]
call fcn.004ff9ee
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x4e0308
push ecx
lea ecx, [esi + 0x24]
call int.004ff8fe
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x501d6e
Capabilities:
Encode data using xor

Disassembly:
sbb dword [ebx - 0x50d18cf7], 0x3a
add dword [edi + 0x1afb68c8], edi
push 0x6a3b1afb
invalid
push 0x6a3b1afb
xor byte [eax - 0x56], al
inc eax
stosb byte es:[edi], al
pop edx
sbb byte [eax + eax*4 + 0x5686b4f1], 0x15
xor bl, byte [edx + 0x1a475a8]
inc esi
or bh, byte [edi + 0x6acbc036]
push ebp
dec ecx
jle 0x501d74
jnp 0x501d74
xchg byte [edi + 0x7b], al
salc
add dword [esi + 0x19], 0xffffffea
out dx, al
jb 0x501dd1
push ds
stosd dword es:[edi], eax
xchg ecx, eax
adc byte [edx + 0x6b], dh
jg 0x501d64
jle 0x501dd5
jl 0x501dad
add ah, bl
jmp dword [esp + ecx]
and al, 0xc
mov dh, 0x6a
out 0x42, al
mov dh, 0x72
add dword [ebp + 0x79a3ad12], esp
fild dword [edi - 0xa]
sub dh, byte [0x1a782ee2]
push esp
test al, 0xe
mov dh, byte [ebx + 0x3a]
dec edi
xor esp, edx
invalid
and esp, dword [esi - 0x2ed53937]
jmp 0xccd41a43
invalid

Function at 0x545c3e
Capabilities:
Encode data using xor

Disassembly:
adc ebp, esp
jae fcn.00545c3e
and al, 2
cmpsb byte [esi], byte es:[edi]
in al, 0xa3
inc edx
cld
ror esp, cl
xor bh, byte [esi + eax*8]
add edi, dword [edi + 0x5e]
mov bl, 0x82
aaa
dec edx
dec esp
dec ecx
pop ebx
add esp, dword [edi]
pushal
xor byte [esi - 0x57877a99], 0x42
push ebx
mov edi, 0xbe25c5a0
rol dword [eax - 0x61], cl
mov byte [0x83da43c6], al
mov dh, 0x60
fld xword [ebx]
push ecx
les esp, [edx]
jno 0x545c5e
and esp, dword [esi + esi*4 + 0x10d170ec]
inc eax
and esi, edx
fimul word [ebx + 0x4c714083]
jno 0x545c87
mov eax, dword [ebx + 0x714c7140]
stc
pop ecx
iretd

Function at 0x55360e
Capabilities:
Encode data using xor

Disassembly:
sbb al, 0x2e
pop esi
pop esi
cmp edi, dword [ecx + 8]
or dword [eax + 0x3f], ecx
inc ebx
mov ecx, 0xcd06c2f0
stc
fist dword [edi - 0x1d]
mov esi, dword [ebx + 0x60]
mov ds, word [esi]
mov cs, word [esi + 0x23]
inc eax
aam 0x1e
mov byte [0xe10f70a1], al
adc byte [ebx - 0x39c353a1], bh
lea edi, [ebx]
inc eax
sub ebx, dword [edi*2 + 0x779a9390]
dec edi
lahf
mov esp, 0xa99d6d58
mov al, byte [0xfdb5db00]
push esp
xor ebx, ecx
xor al, 0x1d
add byte [esi], bh
or edi, esp
adc dword fs:[edx - 0x20ff1c77], eax
out dx, al
mov cl, 0xdd
pop ecx
stosd dword es:[edi], eax
add byte [eax + 0x5eb256a4], 0x80
aad 0x85
adc cl, byte [ebp + eax - 0x584b838f]
push es
fdivr qword [0x9b10f6e0]
push eax
dec eax
jo 0x55360f
dec eax
nop
dec ebx
jmp 0x55368d
push edx
invalid

Function at 0x55c52e
Capabilities:
Encode data using xor

Disassembly:
mov esp, 0xdbf78970
cmp al, 0x5e
mov byte [ebx + edx*2 + 0x13], 0
stc
loope 0x55c598
pop esi
shr dword [ebp - 0x5cb3adae], 1
mov eax, dword [0xfd2c7a50]
rcl byte [esp - 0x1f]
in al, 0xf1
retf 0x2ece
add dword [ebp + 0x49], ebx
invalid
Function at 0x572f0e
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.005a63fe
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x573031
push ecx
lea ecx, [esi + 0x18]
call fcn.0059272e
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x573048
push ecx
lea ecx, [esi + 0x24]
call fcn.0059263e
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x5a5c7e
Capabilities:
Encode data using xor

Disassembly:
push edx
int1
mov ebx, 0x6da5a4c
mov ebp, 0x90727f61
loop 0x5a5bdb
in al, dx
lodsb al, byte gs:[esi]
mov ebx, 0x3ab4503b
jecxz 0x5a5c1d
push edx
imul esi, dword [edi + 0xa], 0xffffff8a
outsb dx, byte [esi]
movsd dword es:[edi], dword ss:[esi]
shr byte [edi - 0x37], cl
arpl si, si
pushfd
pop edx
neg byte [edx + ebx*2 - 0x6762a047]
iretd
mov ecx, 0xcf989d5f
popfd
int 0x17
sub ebp, esp
pop ecx
daa
int 0xb4
push 0xffffffffffffffb2
push eax
popfd
mov al, ah
xor dword [edi + edi*8], eax
xchg edx, eax
jle 0x5a5c97
push cs
dec ecx
fisub word [ebx]
sub al, 0xa4
mov dword [0x454b9c04], eax
pushfd
dec ebx
inc ebp
pushfd
jns 0x5a5c24
add eax, 0x7d190408
sub eax, 0xceb39255
push ss
js 0x5a5c3d
loop 0x5a5be7
cmp dword [ebx], 0x9aeafecc
insb byte es:[edi], dx
xor byte [edx - 0x6cc0de39], 0x22
jo 0x5a5bff
ljmp 0x21c7:0xb2806c9a
push ebp
clc
add al, 0xb
invalid
jl 0x5a5c37
popfd
dec eax
fldcw word [esi + edx*4 - 0x3c]
cld
jl 0x5a5cb5
cmp eax, 0x3b7ebacc
ficom word [edi + edi*2]
push esp
push es
mov bh, 0x1e
cmp edx, dword [edi + 0x14]
xchg ebx, eax
adc al, 0x93
fistp qword [edi]
xchg ebp, eax
bound ebx, qword [edx]
push ss
push edx
xlatb
inc esp
jo 0x5a5ce9
fisubr dword [esi + 0x7b]
cmp eax, 0x542a210d
fsubrp st(4)
outsb dx, byte [esi]
adc eax, 0x8c6e923a
aaa
test eax, 0x912ff424
mov fs, word [edx + ecx - 0x5c]
add byte [ebx - 0x6c2fd342], ah
cmp dl, byte [esi + 0xa9ae2f1]
ljmp 0x2339
mov cl, 0xe5
cld
cmp al, 0xf6
iretd
Function at 0x5bcc1e
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call int.005f010e
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x5bcd41
push ecx
lea ecx, [esi + 0x18]
call fcn.005dc43e
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x5bcd58
push ecx
lea ecx, [esi + 0x24]
call fcn.005dc34e
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x6062ae
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.0063979e
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x6063d1
push ecx
lea ecx, [esi + 0x18]
call 0x625ace
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x6063e8
push ecx
lea ecx, [esi + 0x24]
call fcn.006259de
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x64d5dd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x655338
cmp edx, dword [eax]
je 0x64d5ff
add eax, 8
inc ecx
cmp eax, 0x6553c8
jl 0x64d5f0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x655338]
jne 0x64d72d
mov eax, dword [0xa58c90]
cmp eax, 1
je 0x64d707
test eax, eax
jne 0x64d630
cmp dword [0x655264], 1
je 0x64d707
cmp edx, 0xfc
je 0x64d72d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x64d667
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0064dfc0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0064e450
lea eax, [ebp + 8]
lea esi, [esi + 0x65533c]
push 0
push eax
push dword [esi]
call fcn.0064e450
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]