joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431bd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
dec dword [0x44c334]
mov ax, word [0x44c1d0]
mov ecx, dword [0x44c334]
cwde
add eax, 0xc9f131b0
add ecx, eax
mov word [0x44c1d0], cx
sub esp, 0xc
fld dword [0x44c5a4]
push esi
fadd qword [0x445c40]
push edi
fld dword [0x44c208]
mov edi, 1
fsub qword [0x445c38]
fcompp
fnstsw ax
fld dword [0x44c208]
fld1
fadd st(1), st(0)
fxch st(1)
fstp dword [0x44c208]
test ah, 1
jne 0x431c56
mov edx, dword [0x44c5d0]
mov eax, 0x3f4f4e74
sub eax, edx
mov dword [ebp - 4], eax
fild dword [ebp - 4]
fmul qword [0x44c540]
fstp qword [0x44c540]
add dword [0x44c5d0], edi
fld dword [0x44c500]
mov edx, dword [ebp + 8]
fmul qword [0x445c30]
mov ecx, dword [ebp + 0xc]
lea eax, [edx + ecx*4]
mov dword [ebp - 4], eax
fstp dword [0x44c500]
fld qword [0x44c618]
fmul qword [0x445c28]
fstp qword [0x44c618]
mov cx, word [0x44c400]
movsx ecx, cx
mov dword [ebp + 8], ecx
mov ecx, dword [ebp + 0x10]
fild dword [ebp + 8]
fadd qword [0x44c438]
fstp qword [0x44c438]
fld dword [0x44c32c]
mov esi, dword [0x44c610]
fsub qword [0x445c20]
mov dword [ebp + 8], esi
fsub qword [0x445c18]
fild dword [ebp + 8]
faddp st(1)
fistp qword [ebp - 0xc]
mov esi, dword [ebp - 0xc]
mov dword [0x44c610], esi
fld dword [0x44c32c]
fsub st(1)
fstp dword [0x44c32c]
cmp edx, eax
je 0x431e5c
fld qword [0x445c10]
fld qword [0x445c08]
fld qword [0x445c00]
fld qword [0x445bf8]
add word [0x44c630], di
mov ax, word [0x44c630]
cwde
sub eax, 0x57a04c3c
mov dword [ebp + 8], eax
fild dword [ebp + 8]
fld qword [0x44c478]
fsub qword [0x44c058]
fucompp
fnstsw ax
test ah, 0x44
jp 0x431d3a
mov eax, 0x5bb
mov word [0x44c2b0], ax
jmp 0x431d79
fld dword [0x44c5a4]
fadd st(5)
fstp dword [0x44c5a4]
fld dword [0x44c32c]
fsub st(4)
fld qword [0x44c3b0]
fsubr st(4)
fadd dword [0x44c5a4]
fcompp
fnstsw ax
test ah, 0x41
jne 0x431d79
movzx eax, word [0x44c008]
add eax, 0x40ac8c05
mov word [0x44c008], ax
xor dword [edx], ecx
movzx eax, word [0x44c504]
movsx esi, ax
movzx eax, word [0x44c004]
cwde
sub eax, esi
movzx esi, word [0x44c4e0]
sub eax, esi
mov word [0x44c004], ax
add word [0x44c504], di
add dword [0x44c168], 0x9cc7a1f8
ror ecx, 1
mov eax, ecx
mov cx, word [0x44c02c]
mov esi, dword [0x44c4d8]
movsx ecx, cx
mov dword [ebp + 8], eax
sub ecx, esi
shr eax, 8
add al, byte [ebp + 8]
mov word [0x44c02c], cx
mov ecx, dword [0x44c4cc]
cmp ecx, 0x9a07c1d2
mov byte [ebp + 9], al
jl 0x431df8
fld dword [0x44c208]
fsub qword [0x445bf0]
fstp dword [0x44c208]
fld qword [0x44c518]
add byte [ebp + 8], al
mov eax, dword [0x44c138]
fsub st(2)
mov dword [ebp + 0xc], eax
fild dword [ebp + 0xc]
fsub qword [0x44c528]
add dword [0x44c138], edi
fsub st(2)
fcompp
fnstsw ax
fld qword [0x44c518]
fsub st(5)
fstp qword [0x44c518]
test ah, 0x41
jne 0x431e45
fld dword [0x44c280]
fadd qword [0x44c130]
fstp dword [0x44c280]
mov ecx, dword [ebp + 8]
add edx, 4
cmp edx, dword [ebp - 4]
jne 0x431cff
fstp st(4)
fstp st(2)
fstp st(0)
fstp st(0)
mov edx, dword [0x44c558]
fstp st(0)
mov dword [ebp + 8], edx
fild dword [ebp + 8]
pop edi
mov eax, ecx
pop esi
fmul dword [0x44c09c]
fstp dword [0x44c09c]
mov esp, ebp
pop ebp
ret
Function at 0x40480e
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00437cfe
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x404931
push ecx
lea ecx, [esi + 0x18]
call fcn.0042402e
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x404948
push ecx
lea ecx, [esi + 0x24]
call fcn.00423f3e
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x44a210
Capabilities:
Accept command line arguments
Link many functions at runtime

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
xor ebx, ebx
push edi
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push str.Kernel32
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x44a2d8
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CreateToolhelp32Snapshot
push edi
call ebx
push str.Thread32First
push edi
mov dword [esi + 4], eax
call ebx
mov dword [esi + 8], eax
lea eax, [esp + 0x14]
push eax
push ebp
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push str.Thread32Next
push edi
mov ebp, eax
call ebx
push str.Module32FirstW
push edi
mov dword [esi + 0xc], eax
call ebx
push str.Module32NextW
push edi
mov dword [esi + 0x10], eax
call ebx
mov ecx, dword [esi + 4]
mov dword [esi + 0x14], eax
test ecx, ecx
je 0x44a2c7
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x44a2c7
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x44a2c7
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x44a2c7
test eax, eax
je 0x44a2c7
push edi
mov dword [esi], 1
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
push edi
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor ebx, ebx
jmp 0x44a2dc
mov ebp, dword [esp + 0x14]
cmp ebp, ebx
je 0x44a2f2
mov ecx, dword [0x658abc]
push 0x6587d8
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x453828
Capabilities:
Encode data using xor

Disassembly:
add cl, byte [edi - 0xf0e0c0a]
mov bh, 0x86
daa
jb 0x45385a
jle 0x453845
pushal
push esi
outsd dx, dword [esi]
pop eax
and ch, byte [edi + 0x3e]
xchg edx, eax
div byte [eax + 0x5e]
push es
mov bh, 0x49
shl dword [esi], cl
invalid
invalid
mov esp, 0x4b4822fc
adc eax, 0xf9569824
push 0x7f
mov al, ch
mov bh, 0xf7
cwde
cwde
cmp dl, byte [edx + 0x33b8b0c]
push ss
cmpsb byte [esi], byte es:[edi]
push es
and ebp, dword [eax - 0x1f]
in eax, 0x23
ja 0x4538d1
or eax, 0x591289da
cmp dword [esi - 0x180bd8a7], 0xa07143e7
xchg edi, eax
arpl ax, dx
out 0x85, al
and byte [eax], cl
aaa
or dword [esi], 0xb
retf 0x7e62
stosb byte es:[edi], al
push eax
jcxz 0x453902
xchg esi, eax
jno 0x453913
mov ecx, dword [edi + eax*2 + 0x47]
sbb eax, dword [esi]
cmp al, 0xa7
sub esi, 0xfffffff9
add eax, 0x19e146f3
sahf
xor eax, 0xcf29db41
nop
mov ecx, 0x8212de68
cdq
adc byte [ebx - 0x42], ah
xor eax, 0x9fc1eac5
mov esi, 0x5edec2ef
pop esi
invalid
push eax
pop esp
xchg dword [edi + 0x776cf44b], esi
xchg ecx, eax
dec ebp
fadd st(4), st(0)
shl dword [esi - 0x3d2c495d], cl
xchg ebx, eax
ror dword [esi], 1
push ebx
iretd
Function at 0x48081e
Capabilities:
Encode data using xor

Disassembly:
jg 0x480896
mov al, 0xfb
cmpsd dword [esi], dword es:[edi]
lea ebx, [esi]
add cl, byte [edx + esi*8]
mov edx, 0xaa8ae4a2
mov byte [0x9348b015], al
invalid
add bh, byte [esi]
pop esp
xchg esi, eax
or eax, 0x3a66fafd
je 0x480870
cmp dh, byte [esp + edx - 0x46]
out dx, al
push 0x22
cmpsb byte [esi], byte es:[edi]
mov edx, 0xa6226aee
inc esi
salc
xor byte [edx - 0x42], ah
jns 0x480850
invalid
push ss
inc ecx
xor al, 0xde
pop es
or dword [eax + 0x3d], esi
arpl cx, sp
outsd dx, dword [esi]
add eax, 0x6b48c77
dec edi
cmp al, 0x77
sub eax, 0x136fb296
int1
add eax, 0xce5449d6
out 0xf7, al
mov dl, 0x34
mov bl, 0x17
inc esi
sahf
adc byte [esi - 6], dh
pop eax
adc byte [esi - 0x572c7394], dh
jb 0x480859
adc byte [ebp - 0x17c6e118], cl
xchg esp, eax
pop edx
push ss
salc
push ds
invalid

Function at 0x496f7e
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.004ca46e
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x4970a1
push ecx
lea ecx, [esi + 0x18]
call fcn.004b679e
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x4970b8
push ecx
lea ecx, [esi + 0x24]
call fcn.004b66ae
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x49c8cf
Capabilities:
Encode data using xor

Disassembly:
push dword [ebp + 0x22]
arpl word [edi + edx + 0x762273c2], cx
lcall 0x63e2, 0x54215092
fiadd word [edx + 0x6afda06]
arpl si, bx
add byte [esi], 0xda
scasd eax, dword es:[edi]
push es
xchg edi, eax
outsb dx, byte [esi]
daa
insb byte es:[edi], dx
inc ecx
popal
mov word [ebx + 0x74], ss
push esi
mov cl, 0x1f
pop esi
add esp, dword [ecx]
aas
push ebx
xchg byte [esi], cl
xlatb
or dword [eax - 0x7d], 0x60
clc
xor ch, byte [0x744e148f]
test dword [eax + 0x32], ebp
push esi
fld dword [ebp - 0x5980d118]
sub dword fs:[eax + 0x26163d46], eax
push ds
sti
inc esi
dec ebx
pop ebx
xor dh, bl
or dl, bh
fist word [edi - 0x5b5deeae]
jecxz 0x49c815
pop es
xor dword [edx], eax
loop 0x49c861
xor bh, byte [esi + 0x4a281a5d]
test al, 4
jae 0x49c805
jb 0x49c8b1
and bl, ah
ror bl, 1
push edx
adc dl, byte [ebp + 0x44]
push cs
xchg esi, eax
pop esi
lea esi, [eax]
inc eax
lea ebx, [ebx + 0x77]
dec ebp
xor cl, byte [ebx]
dec edi
cwde
add dh, byte [ebx - 0x1a]
pop ebp
int3
jo 0x49c81b
mov byte [0x736f18dd], al
jg 0x49c88f
rcr byte [ebx], cl
nop
stosb byte es:[edi], al
cmpsb byte [esi], byte es:[edi]
ret 0xc859
and edx, dword [esi + 0x37]
push edi
jbe 0x49c87e
jno 0x49c8c0
mov eax, 0xc06e17d4
ljmp 0x51ad
mov fs, word [edx]
sbb dword [ebp - 0x12290daf], ebp
xchg bh, cl
xor ebp, dword [ecx + ebp*8 - 0x49]
in al, 1
add esi, edx
add esi, edx
push esi
aam 0x4a
wait
xlatb
pop ss
outsd dx, dword [esi]
adc esi, dword [edi + eax - 0x6d]
cld
ja 0x49c891
sub edx, dword [edx + 0x3c1d9351]
dec eax
fiadd dword [ebx]
pop es
push edi
stosd dword es:[edi], eax
ret 0x4830

Function at 0x50a0ee
Capabilities:
Encode data using xor

Disassembly:
loopne 0x50a14b
and bh, byte [ebp - 0x50bf9e90]
or ah, 0x26
scasd eax, dword es:[edi]
pushal
xchg byte [edi], bh
jno 0x50a175
sbb byte [eax + edx*2 - 0x46aba9db], al
cmpsd dword [esi], dword es:[edi]
dec esp
jae 0x50a165
mov eax, fs
rol cl, cl
leave
imul edi, dword [ebx - 0x3d], 0xffffffcd
xor al, 0xfc
push 0xd710bdc7
sar byte [esi + 0x30108a63], cl
ljmp 0xc72b
lahf
cli
dec ebx
xlatb
outsd dx, dword [esi]
push es
popal
mov dword [eax - 0x52], 0x17bb36f
fisttp word [ecx + 3]
leave
lahf
idiv byte [ebx + eax*4 + 0x4d]
dec esi
mov dword [ebx - 0x75bdf45f], esp
mov al, byte [0xee07f66]
pop esp
adc ecx, esi
jbe 0x50a13d
cli
leave
mov eax, 0x6c5b3866
mov dword [0x5717ddb6], edi
pushf
dec ebp
fiadd word [edi + 0x5f]
aaa
or cl, byte [esi - 0x52]
xor edi, ebx
popal
js 0x50a1cc
dec ebx
jle 0x50a180
pop es
inc ebx
in eax, dx
shr dword [ebx - 0x4b657ae2], 0x6e
xor byte [edi], cl
jnp 0x50a186
mov ch, byte [0x667a35c6]
int3
xchg esi, eax
outsd dx, dword [esi]
fimul dword [edx]
cld
int 0x61
invalid
Function at 0x52968e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47262f
mov eax, dword fs:[0]
push eax
sub esp, 0x138
mov eax, dword [0x4a2008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x13c], edx
mov eax, ecx
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x134], eax
mov esi, dword [ebp + 8]
mov edi, esi
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x140], 0
cmp dword [esi + 0x14], 0x10
mov ecx, dword [esi + 0x10]
mov dword [ebp - 0x138], ecx
jb 0x5296f5
mov edi, dword [esi]
cmp dword [edx + 0x14], 0x10
mov ecx, dword [edx + 0x10]
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x130], edx
jb 0x529712
mov ecx, dword [edx]
mov dword [ebp - 0x130], ecx
cmp dword [edx + 0x10], 0
jbe 0x52977b
push 0x100
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.0057265e
mov ecx, dword [ebp - 0x138]
add esp, 0xc
add ecx, edi
cmp edi, ecx
je 0x52974e
nop dword [eax]
movzx eax, byte [edi]
inc edi
mov byte [ebp + eax - 0x128], 1
cmp edi, ecx
jne 0x52973e
mov edx, dword [ebp - 0x130]
mov edi, edx
mov ecx, dword [ebp - 0x134]
add ecx, edx
cmp edx, ecx
jae 0x529775
movzx eax, byte [edi]
mov al, byte [ebp + eax - 0x128]
test al, al
je 0x5297cf
inc edi
cmp edi, ecx
jb 0x529762
mov eax, dword [ebp - 0x12c]
xorps xmm0, xmm0
mov ecx, eax
push 0
movups xmmword [eax], xmm0
push 0x491667
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
call fcn.0055cffe
mov dword [ebp - 4], 0
mov dword [ebp - 0x140], 1
mov eax, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00570eda
mov esp, ebp
pop ebp
ret
sub edi, edx
cmp edi, 0xffffffff
je 0x529775
cmp dword [esi + 0x14], 0x10
jb 0x5297de
mov esi, dword [esi]
mov ecx, dword [ebp - 0x13c]
mov dword [ebp - 0x130], ecx
cmp dword [ecx + 0x14], 0x10
jb 0x5297f8
mov eax, dword [ecx]
mov dword [ebp - 0x130], eax
push 0x100
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.0057265e
mov ecx, dword [ebp - 0x138]
add esp, 0xc
add ecx, esi
cmp esi, ecx
je 0x52982e
nop dword [eax]
movzx eax, byte [esi]
inc esi
mov byte [ebp + eax - 0x128], 1
cmp esi, ecx
jne 0x52981e
mov eax, dword [ebp - 0x134]
or ecx, 0xffffffff
mov edx, dword [ebp - 0x130]
dec eax
cmp eax, ecx
cmovb ecx, eax
movzx eax, byte [ecx + edx]
add ecx, edx
mov al, byte [ebp + eax - 0x128]
test al, al
je 0x52986c
cmp ecx, edx
je 0x5298e3
movzx eax, byte [ecx - 1]
dec ecx
mov al, byte [ebp + eax - 0x128]
test al, al
jne 0x529854
sub ecx, edx
sub ecx, edi
lea eax, [ebp - 0x28]
inc ecx
push ecx
mov ecx, dword [ebp - 0x13c]
push edi
push eax
call fcn.005485ce
mov dword [ebp - 4], 1
xorps xmm0, xmm0
mov esi, dword [ebp - 0x12c]
mov dword [ebp - 0x140], 1
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
movups xmm0, xmmword [ebp - 0x28]
mov dword [esi + 0x14], 0
mov byte [ebp - 0x28], 0
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x18]
movq qword [esi + 0x10], xmm0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call int.0055d12e
mov eax, esi
jmp 0x5297b4
or ecx, 0xffffffff
jmp 0x52986e
Function at 0x529b0e
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.0055cffe
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x529c31
push ecx
lea ecx, [esi + 0x18]
call int.0054932e
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x529c48
push ecx
lea ecx, [esi + 0x24]
call fcn.0054923e
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x531fae
Capabilities:
Encode data using xor

Disassembly:
scasd eax, dword es:[edi]
fild word [edi - 0x1a]
dec edi
rcr dword [eax - 5], 0x38
sbb al, 0xed
and eax, dword [ebx]
push cs
xor dl, byte [ebx + 0x37d2bd22]
stc
mov bl, 5
test al, 0xe9
inc eax
pop edx
cmc
in al, 0x87
dec esp
shr byte [0x38db771a], 1
rol byte [ecx], 1
pushal
push 0xfffffffffffffffd
cmp al, 0x49
lcall 0xa4bd, 0xfda30689
mov ecx, 0x23bd5ee8
push cs
movhps xmm5, qword [edx - 0x38]
mov eax, 0x93533f32
push ebx
xchg ebx, eax
push ebx
xchg ebx, eax
fldcw word [ecx]
sbb dword [ebx], edx
cmp ebp, edi
inc esp
std
imul eax, dword [eax + 0x37], 0x785b149d
aam 0xe0
aas
xor eax, 0x5f58310f
jl 0x531f6e
out 0xdf, eax
pop ss
pop ecx
imul edx, dword [ebx - 0x2cf528b7], 0x5c94ced0
sbb ebx, esp
daa
das
invalid

Function at 0x53822e
Capabilities:
Encode data using xor

Disassembly:
mov ch, 0x16
stc
pushal
wait
or dh, byte [ebx - 7]
stc
mov dword [ebp + 0x51], ecx
outsb dx, byte [esi]
jmp 0x5381f4
jle 0x5381ed
dec ebp
outsb dx, byte [esi]
sbb dh, byte [ebp - 0x382548b]
pop ss
mov bh, 0xcf
mov edx, 0xa9aa5834
out 0xf1, al
push ds
test eax, 0x771a8c2
and eax, 0xdd0d1d06
wait
stosb byte es:[edi], al
scasb al, byte es:[edi]
mov bh, 0xb6
fnstenv [ecx]
lahf
jnp 0x538229
call dword [edi + 0x43]
push edi
inc ebx
mov word [ebx + 0x7b], es
shr dword [eax + 8], 1
mov ebp, cs
loope 0x538229
jnp 0x538201
push 0xe1cd8c08
mov eax, 0x16bd30eb
mov eax, 0x16bd30eb
invalid
Function at 0x57311e
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.005a660e
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x573241
push ecx
lea ecx, [esi + 0x18]
call fcn.0059293e
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x573258
push ecx
lea ecx, [esi + 0x24]
call fcn.0059284e
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5788b2
Capabilities:
Encode data using xor

Disassembly:
scasb al, byte es:[edi]
xchg esp, eax
sar ebx, 1
in al, 0xe6
cld
xchg esi, eax
push edx
xchg edx, eax
jnp 0x578719
fbstp tbyte [ebp - 0x60]
retf 0x14de
lahf
xor edi, dword [ebx - 0x3aa54907]
shl byte [ecx], 0xfa
in eax, 4
loopne 0x57870d
in al, 0x5f
push es
shl dword [esi + 0x405e3ea6], 1
add esi, esi
push ss
aam 0xfc
nop
wait
test byte [ebx], cl
sbb dword [eax + 0x67], esp
adc byte [ebx - 0x76], ah
add esi, dword [ebp + 0x2e17ee24]
sub ebp, ebp
adc dword [ecx + edi*8], 0xc5b4ce0f
xor ebp, ebp
push es
xor eax, 0x1677a83a
lds eax, [esi]
adc al, 0x71
movsd dword es:[edi], dword [esi]
invalid
je 0x5787fd
cmpsb byte [esi], byte es:[edi]
ja 0x578752
adc byte [edi], dh
inc eax
hlt
out 0x41, al
mov ch, 0x10
stosd dword es:[edi], eax
pop es
adc eax, 0x317d0eeb
sub byte [esi + eax*8 + 0x2bc09573], ah
shr dword [ebx - 0x729b5a33], 1
mov byte [0x4e339f72], al
lahf
xor ecx, dword [esi - 0x80]
clc
popfd
dec ebp
cmpsd dword [esi], dword es:[edi]
adc eax, 0x1eca3c9
invalid
sar bh, 1
adc ah, byte [ebx - 0x62]
adc eax, 0xdb4e08e0
or esp, dword [edi - 0x7f]
xor eax, 0x70551ba1
or dword [esi - 0x5d3a65dc], edi
lcall 0x2d25, 0x25b09cc2
insb byte es:[edi], dx
mov word [edx], es
sbb al, 0xd2
mov bh, 0xa4
daa
add eax, 0xcc6af5a4
cmc
push 0xffffffffffffffcc
loope 0x578840
out dx, eax
jns 0x5787d4
add al, 0xe3
loopne 0x5787c8
inc ecx
mov eax, 0xcddaa3f2
or bh, ch
loop 0x57883e
dec esp
in al, dx
int 9
and byte [0xb62b2494], al
or dword [eax], esp
add eax, 0xb62b2494
int3
xor byte [edx], bl
mov ebp, 0x2ff55049
xchg ebx, eax
std
dec edx
fbld tbyte [edx]
mov eax, dword [0x7c25d079]
adc eax, 0x3a6e94b0
and byte [0x14d0bfa0], dh
push ebp
pop ebp
mov ecx, 0x3c460f86
jo 0x578826
lds edx, [edi]
in eax, 0xea
add eax, 0x34e0da84
pop esp
dec ecx
xor dword [edx + 0x83c7390], edx
lea eax, [ebx + 0x75ed8bd6]
mov al, byte [0x30f996d5]
cmp dword [bx + di], eax
inc eax
aam 0x99
sbb al, byte [esi + 0x537fd609]
je 0x57887e
sub eax, 0xe8503ceb
push eax
mov dword [ecx], edx
xchg ebp, eax
stosd dword es:[edi], eax
loopne 0x578933
xchg ebp, eax
sti
sti
push ecx
stosd dword es:[edi], eax
and dword [esi - 0x79160c6f], 0xdcb4b21f
xchg ecx, eax
jmp 0xb509a848
jne 0x5788c9
inc ebx
inc ebp
add dword [esp + ebx*2], eax
pop esp
sbb eax, 0x756c1a10
stosb byte es:[edi], al
add al, 0xe4
push ebx
jge 0x578859
xor edi, edi
xchg dword cs:[eax - 0x17], esp
adc al, 0xd7
mov bh, 0x98
add al, 0x8a
add eax, 0x2e307021
dec esp
jge 0x578930
or al, 0x56
pop eax
xchg byte [ecx + 0x30b278d5], ah
mov cl, 0x70
movsd dword es:[edi], dword [esi]
push ecx
dec eax
mov esp, 0xe8497acd
add byte [eax], 0xf5
or dl, byte [0xcdf82f82]
dec ecx
sahf
sub byte [edi - 0x49], ah
popal
sahf
ja 0x5788bb
and al, 0x9e
popal
mov cl, 0x35
pop ss
push edi
push eax
mov ecx, 0xf6475c74
cmp eax, 0xeddea360
loope 0x57892f
test ah, 0xc7
xor byte ss:[ebx - 0x34132efb], ch
js 0x5788c3
xchg ebx, eax
jne 0x5788b6
mov ebp, 0x703585ce
in eax, dx
jns 0x5788c9
into
test dword [0x8f79ed70], esi
inc ebp
and byte [ebp + 0x74], al
retf 0xa6a0