joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10069545
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10073750]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.10059bc8
mov dword [ebp - 0x14], eax
cmp dword [0x10617600], esi
jne 0x10069638
push 0x800
push esi
push 0x10007530
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x100695c5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10069718
push esi
push esi
push 0x10007530
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x10069718
push 0x10007548
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10069718
push eax
call ebx
push 0x10007554
push edi
mov dword [0x10617600], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007564
push edi
mov dword [0x10617604], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007578
push edi
mov dword [0x10617608], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10617610], eax
test eax, eax
je 0x10069635
push 0x10007594
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1061760c], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1006965d
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10069650
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x10069672
push 4
pop eax
jmp 0x1006971a
cmp dword [ebp - 0x14], esi
je 0x10069672
push dword [0x10617600]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10069657
mov eax, dword [0x1061760c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x100696d0
cmp dword [0x10617610], edi
je 0x100696d0
push eax
call ebx
push dword [0x10617610]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x100696d0
test eax, eax
je 0x100696d0
call ecx
test eax, eax
je 0x100696c5
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x100696c5
test byte [ebp - 8], 1
jne 0x100696d0
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x10069700
mov eax, dword [0x10617604]
cmp eax, edi
je 0x100696fd
push eax
call ebx
test eax, eax
je 0x100696fd
call eax
mov esi, eax
test esi, esi
je 0x100696fd
mov eax, dword [0x10617608]
cmp eax, edi
je 0x100696fd
push eax
call ebx
test eax, eax
je 0x100696fd
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x10617600]
call ebx
test eax, eax
je 0x10069718
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x1006971a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100570f6
mov esp, ebp
pop ebp
ret
Function at 0x4043d7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47262f
mov eax, dword fs:[0]
push eax
sub esp, 0x138
mov eax, dword [0x4a2008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x13c], edx
mov eax, ecx
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x134], eax
mov esi, dword [ebp + 8]
mov edi, esi
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x140], 0
cmp dword [esi + 0x14], 0x10
mov ecx, dword [esi + 0x10]
mov dword [ebp - 0x138], ecx
jb 0x40443e
mov edi, dword [esi]
cmp dword [edx + 0x14], 0x10
mov ecx, dword [edx + 0x10]
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x130], edx
jb 0x40445b
mov ecx, dword [edx]
mov dword [ebp - 0x130], ecx
cmp dword [edx + 0x10], 0
jbe 0x4044c4
push 0x100
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.0044d3a7
mov ecx, dword [ebp - 0x138]
add esp, 0xc
add ecx, edi
cmp edi, ecx
je 0x404497
nop dword [eax]
movzx eax, byte [edi]
inc edi
mov byte [ebp + eax - 0x128], 1
cmp edi, ecx
jne 0x404487
mov edx, dword [ebp - 0x130]
mov edi, edx
mov ecx, dword [ebp - 0x134]
add ecx, edx
cmp edx, ecx
jae 0x4044be
movzx eax, byte [edi]
mov al, byte [ebp + eax - 0x128]
test al, al
je 0x404518
inc edi
cmp edi, ecx
jb 0x4044ab
mov eax, dword [ebp - 0x12c]
xorps xmm0, xmm0
mov ecx, eax
push 0
movups xmmword [eax], xmm0
push 0x491667
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
call fcn.00437d47
mov dword [ebp - 4], 0
mov dword [ebp - 0x140], 1
mov eax, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044bc23
mov esp, ebp
pop ebp
ret
sub edi, edx
cmp edi, 0xffffffff
je 0x4044be
cmp dword [esi + 0x14], 0x10
jb 0x404527
mov esi, dword [esi]
mov ecx, dword [ebp - 0x13c]
mov dword [ebp - 0x130], ecx
cmp dword [ecx + 0x14], 0x10
jb 0x404541
mov eax, dword [ecx]
mov dword [ebp - 0x130], eax
push 0x100
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.0044d3a7
mov ecx, dword [ebp - 0x138]
add esp, 0xc
add ecx, esi
cmp esi, ecx
je 0x404577
nop dword [eax]
movzx eax, byte [esi]
inc esi
mov byte [ebp + eax - 0x128], 1
cmp esi, ecx
jne 0x404567
mov eax, dword [ebp - 0x134]
or ecx, 0xffffffff
mov edx, dword [ebp - 0x130]
dec eax
cmp eax, ecx
cmovb ecx, eax
movzx eax, byte [ecx + edx]
add ecx, edx
mov al, byte [ebp + eax - 0x128]
test al, al
je 0x4045b5
cmp ecx, edx
je 0x40462c
movzx eax, byte [ecx - 1]
dec ecx
mov al, byte [ebp + eax - 0x128]
test al, al
jne 0x40459d
sub ecx, edx
sub ecx, edi
lea eax, [ebp - 0x28]
inc ecx
push ecx
mov ecx, dword [ebp - 0x13c]
push edi
push eax
call fcn.00423317
mov dword [ebp - 4], 1
xorps xmm0, xmm0
mov esi, dword [ebp - 0x12c]
mov dword [ebp - 0x140], 1
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
movups xmm0, xmmword [ebp - 0x28]
mov dword [esi + 0x14], 0
mov byte [ebp - 0x28], 0
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x18]
movq qword [esi + 0x10], xmm0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00437e77
mov eax, esi
jmp 0x4044fd
or ecx, 0xffffffff
jmp 0x4045b7
Function at 0x404857
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00437d47
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x40497a
push ecx
lea ecx, [esi + 0x18]
call fcn.00424077
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x404991
push ecx
lea ecx, [esi + 0x24]
call fcn.00423f87
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x423037
Capabilities:
Encode data using xor

Disassembly:
invalid
xor esp, dword [eax]
jge 0x422f80
or ecx, dword [eax - 0x4a00b401]
clc
popfd
dec edi
test eax, 0xad8d068e
xchg ebp, eax
xor byte [edx], dh
add ecx, dword [edi]
adc ebx, ebp
jge 0x422ffe
fidivr dword [0x9ea30f4]
add ebp, ecx
sbb ebp, edi
pop ebx
les ebp, [ebx - 0x48c1c019]
mov dword [esi - 0x4b], edx
push esi
mov ch, 0x6d
insd dword es:[edi], dx
add eax, 0x6e1e758f
lodsd eax, dword [esi]
in al, dx
jg 0x422fcd
ror byte [ebp - 0x12], cl
sbb eax, 0x2d7b3d5e
sub cl, byte [eax + eax*4]
sbb al, 0x37
out dx, eax
jbe 0x423008
push edi
mov eax, 0xa5200d9
push ebp
adc byte [ecx + 0x3f], ch
inc ecx
out 0xb4, eax
mov bl, 0xf9
or dl, byte [ebp + 0x10]
imul edi, dword [edi], 0xb3b4e741
stc
dec esi
or dword [esp + edx*4 + 0x130facea], eax
or ecx, dword [eax + 0x1336877f]
aas
adc edi, dword [esi + ecx*4 - 0x31]
mov edx, 0x1cf2ab72
shr dword [esi], 1
sahf
and dword [edi*2 + 0x1fe8548c], 0xffffffe0
sub al, 0xee
loopne 0x42301e
pop ebx
out dx, al
inc edx
fld xword [esi + ebp*8]
fidiv dword [esi]
shr byte [edx], 1
popfd
or al, 0x24
pop edi
push ebx
jg 0x422ffc
xchg edx, eax
jmp 0x422fea
Function at 0x425c47
Capabilities:
Encode data using xor

Disassembly:
add ah, byte [ecx - 0x1a]
rcr ebx, cl
dec edi
push ds
out dx, eax
pop ds
lds eax, [ecx]
xor byte [0x4a166f6d], 0xc6
mov ds, word [edi]
xor dword [ebp + 0x5507561a], edi
call 0xeef98a7d
test al, 0x4f
pop edi
jnp 0x425c41
imul edi, dword [esi], 0x39
aam 8
lea ecx, [ecx + ebx]
lodsd eax, dword [esi]
mov byte [ebp + 0x2ebebcd3], cl
cmp al, 0x7d
pop esi
out dx, eax
leave
cdq
adc byte [ebp + 0x61f06d49], ch
stosd dword es:[edi], eax
jge 0x425cef
jge 0x425caf
mov byte [0x8dda185c], al
fadd qword [edi - 0x748902f1]
adc ebx, edi
sti
sbb bh, ah
imul byte ds:[edx + esi*4 - 0x4f59cf76]
push cs
mov dh, byte [eax]
cmpsb byte [esi], byte es:[edi]
mov al, 0xe
mov dh, 0x38
mov esi, 0xb0659e26
cmpsd dword [esi], dword es:[edi]
or eax, 0xdcc7dbd
sbb ah, cl
pushfd
insd dword es:[edi], dx
mov ecx, 0x50c0ea3
cmp eax, 0xe1e52435
jb 0x425c65
mov dword [0x3d050c0e], eax
xor eax, 0x72e1e524
stosd dword es:[edi], eax
push ecx
sub al, 0x6d
jle 0x425c98
fimul dword [esi + 0x97148dc]
sub eax, 0x2afb6b5
fsubr dword [edi]
out dx, al
cmp al, byte [eax]
xchg byte [esi], bl
fnsave dword [esi]
adc al, 0x35
loope 0x425c91
js 0x425cd1
mov esp, 0x8c6b9c25
cmp eax, 0x7f0fbeba
fdivr qword [esi]
pop esp
xchg ebx, eax
in eax, dx
and eax, 0x5082f110
xchg ebp, eax
add dword [edx], edi
mov byte [0xce3237cd], al
cmp ah, byte [edx - 0x31cdc833]
adc dl, byte [esi - 0x62]
pop ebp
xor dword [edx + 0xd3f2eac], esi
or eax, 0xc55eaeb0
fidivr dword [ebp + 0x3e]
dec ebp
outsb dx, byte [esi]
xor byte [esi + edi - 0x30], ah
loop 0x425cfe
aas
or eax, 0xaeb0c881
pop esi
invalid
retf

Function at 0x42ac47
Capabilities:
Encode data using xor

Disassembly:
jb 0x42acc2
or byte [ebx], dh
pushal
xchg esi, eax
sub byte [ecx], cl
mov ebp, 0xd99ee309
push ebp
push es
pop edx
pop es
dec esi
scasb al, byte es:[edi]
pop esp
out dx, al
scasb al, byte es:[edi]
outsb dx, byte [esi]
wait
test al, 0x34
sub edi, ebp
xor al, 0xb0
sbb bl, byte [edx + ecx*2]
xor al, 0xbf
mov ebx, 0xfb2df026
imul byte [eax]
cmp al, 0x32
arpl word [eax], bp
cmc
jne 0x42ac4c
lcall 0xa8ed, 0x1d450b4d
mov esi, 0xe53d157d
cmpsd dword [esi], dword es:[edi]
mov dword [0xcee08ff4], eax
insd dword es:[edi], dx
sub eax, 0xac3cf6d8
dec ecx
push 0xffffffffffffffd9
sub bl, 0x30
invalid
sbb bh, byte [ebp + 0x4f]
cdq
arpl dx, cx
clc
in eax, 0xa2
and esi, dword [eax + 0x6017f06c]
lahf
dec eax
pop eax
invalid
Function at 0x44a210
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0xc]
push edi
xor ebp, ebp
push str.Kernel32
mov dword [esi], ebp
mov dword [esi + 4], ebp
mov dword [esi + 8], ebp
mov dword [esi + 0xc], ebp
mov dword [esi + 0x10], ebp
mov dword [esi + 0x14], ebp
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
cmp edi, ebp
je 0x44a2b0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CreateToolhelp32Snapshot
push edi
call ebx
push str.Thread32First
push edi
mov dword [esi + 4], eax
call ebx
push str.Thread32Next
push edi
mov dword [esi + 8], eax
call ebx
push str.Module32FirstW
push edi
mov dword [esi + 0xc], eax
call ebx
push str.Module32NextW
push edi
mov dword [esi + 0x10], eax
call ebx
mov ecx, dword [esi + 4]
mov dword [esi + 0x14], eax
cmp ecx, ebp
pop ebx
je 0x44a2a7
cmp dword [esi + 8], ebp
je 0x44a2a7
cmp dword [esi + 0xc], ebp
je 0x44a2a7
cmp dword [esi + 0x10], ebp
je 0x44a2a7
cmp eax, ebp
je 0x44a2a7
push edi
mov dword [esi], 1
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
pop edi
pop esi
pop ebp
ret
push edi
mov dword [esi], ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
pop edi
pop esi
pop ebp
ret

Function at 0x44dbf7
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.004810e7
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x44dd1a
push ecx
lea ecx, [esi + 0x18]
call fcn.0046d417
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x44dd31
push ecx
lea ecx, [esi + 0x24]
call 0x46d327
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x496f07
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.004ca3f7
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x49702a
push ecx
lea ecx, [esi + 0x18]
call fcn.004b6727
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x497041
push ecx
lea ecx, [esi + 0x24]
call fcn.004b6637
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4b6227
Capabilities:
Encode data using xor

Disassembly:
or dword [ecx - 0x1e502406], ebx
sbb ebp, dword [eax + 0x7c4c7e78]
push ecx
and dword [edi + 0x1a], edi
jp 0x4b6288
xor eax, 0x2afa0081
dec ebp
loop 0x4b623a
cmp dword [ebx - 0x67c7dd5e], eax
cld
call 0x80d9ad83
inc ebp
invalid
adc byte [ecx + 0x14493978], bl
cmp byte [ecx], bh
or edx, dword [eax + 0x28]
mov ebx, 0x2e14cb72
enter 0xfffffffffffff134, 0x1a
call 0x78f89a04
mov edx, edx
adc eax, 0x566340e7
pop ecx
sbb al, 0xd
inc edx
stosd dword es:[edi], eax
sub dword [eax - 0x66], edx
adc eax, 0x8136b815
retf
enter 0xffffffffffffbbef, 4
mov al, 0xc8
jo 0x4b62ed
cmp dword [edx], edi
add cx, dx
or dword [eax], eax
cmp dword [0x1b45d0b0], ebp
pop ebp
sub byte [esi - 0x1a7b7210], 0xcc
outsd dx, dword [esi]
aam 0x22
js 0x4b6257
dec eax
push ebx
dec ebx
lahf
cwde
pushal
test byte [eax + 0x2a], 0xaf
popfd
and dword [ecx + 0xd], esp
call dword [edx]
invalid
test dword [ecx + 0x27], 0x51aabbe4
mov word [esp + ecx*4 + 0x2dde0cc3], cs
jge 0x4b6351
mov ebx, es
or al, 0xde
sub eax, 0x9235d7d
and ecx, dword [ecx]
or dword [0x2e3cc05d], ebx
sbb eax, 0x2e3cc05d
fldcw word [ebp - 0x78]
popfd
sbb ebx, esp
js 0x4b62bb
cwde
cmp byte [edx], dh
enter 0x2ef8, 0xffffffffffffffb0
lodsb al, byte [esi]
fld dword [ebp + 0x292d859d]
loopne 0x4b62e4
sysexit
add byte [ecx], bl
sub esp, esi
push ebx
jmp 0x19bc30ab
lds ebp, [ecx + 0x1b]
jae 0x4b62f5
or byte [ebp - 0x44005138], dl
xchg byte [0x580e7049], bl
cmp dword [eax], edi
dec edi
xor eax, ebx
jae 0x4b636a
mov ecx, 0x73fb17c4
pop eax
pop edx
clc
retf 0x373a

Function at 0x4e8ad7
Capabilities:
Encode data using xor

Disassembly:
call 0xd171fa1f
outsb dx, byte [esi]
test al, 0x4b
dec edx
mov dl, 0xce
sbb byte [ecx], dl
xor dword [ecx - 0x35ea1639], 0x2d
cmp esi, dword [edi + ebp*8]
mov dh, 0x9c
push esi
and dh, al
xchg byte [ebx - 0x6bb9f1b3], bl
or edx, dword [edi + 0x51d9caeb]
stosb byte es:[edi], al
dec edx
dec esi
mov eax, 0x160285bb
mov cl, 0x55
jecxz 0x4e8ae6
mov cl, 0xc7
jmp 0x3b7c5502
mov ah, 0x9d
sbb ah, byte [eax + esi*2 + 9]
lodsd eax, dword [esi]
das
push cs
imul edx, dword [ecx + 0x64ccca3], 0x62f45b73
mov cl, 0x37
leave
movsb byte es:[edi], byte [esi]
xchg byte [ebx + 0x2b8f1547], bh
sbb ebp, eax
sub dword [ebp - 0x36], edx
jecxz 0x4e8b49
cmp ah, byte [edx - 6]
invalid
mov ecx, 0xc10bbf56
cmpsd dword [esi], dword es:[edi]
jge 0x4e8b9b
xor cl, byte [0x18e9ca2c]
popfd
xchg ecx, eax
fdivr dword [eax + 0x7d]
ja 0x4e8bd6
jge 0x4e8bd4
js 0x4e8bda
jnp 0x4e8b5b
sti
iretd
lodsd eax, dword [esi]
xchg dword [esi - 0x28], ebx
inc eax
or dl, byte [esi - 0x33438777]
scasb al, byte es:[edi]
int1
cld
invalid
push edx
ret
leave
and cl, byte [edi + 0x17]
mov dword [0x3948b31e], eax
aad 0x78
fnstsw word [ebx - 0x56e304f7]
mov edx, 0x57d71123
aaa
leave
in eax, dx
fcom dword [eax - 0x71]
fstp xword [edx*8 + 0x600f6c58]
test eax, 0x6a6f08cf
push 0x1d
das
mov dh, 0xb8
in al, dx
or dh, dl
sbb al, bl
pop edi
sub bl, byte [ecx + 0xa50f2fb]
movsb byte es:[edi], byte [esi]
xor byte [eax + 8], bh
and byte [edx + 0xb810b0b], cl
and byte [edx - 0x3d148584], ah
invalid
Function at 0x529a97
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.0055cf87
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x529bba
push ecx
lea ecx, [esi + 0x18]
call 0x5492b7
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x529bd1
push ecx
lea ecx, [esi + 0x24]
call fcn.005491c7
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x52f10b
Capabilities:
Authenticate hmac

Disassembly:
xchg dh, bh
mov esi, 0x47dbb726
push edi
fcmovb st(0), st(7)
arpl word [edi - 0x6ec29f02], sp
mov esi, 0xeba62be4
xor esp, dword [esi + 0x77]
inc esp
xchg esi, eax
in al, 0x79
pause
lodsb al, byte [esi]
cmp al, 0x97
add eax, dword [eax + 0x634d309c]
xchg ecx, eax
xor eax, dword [ecx - 0x77c19]
test byte [ebx], al
and eax, 0x6e7ad1d4
clc
inc dword [ebx + eax + 0x7ad1d425]
outsb dx, byte [esi]
xchg dword [ebx - 0x59], edx
dec esp
or dh, dl
inc ebx
stosd dword es:[edi], eax
dec ecx
stosb byte es:[edi], al
adc ebx, dword [ebx - 0x1cd9d523]
enter 0x1eb6, 0xffffffffffffff88
bnd je 0x52f1d4
stosd dword es:[edi], eax
pop ds
sal byte [ebx - 0x4879172d], cl
mov dl, 0x4a
push ebp
imul ecx, dword [edi + 0x2f86cf96], 0xffffffb5
cmpsd dword [esi], dword es:[edi]
xchg ebp, eax
or byte [edi + 0x13], dh
push ebx
daa
jb 0x52f138
and dl, 0x2d
mov eax, dword [0x7a834881]
mov esp, 0xaa2b782a
inc ecx
mov esp, 0xb46a72a5
int1
neg byte [ebx]
xor al, 0xfc
push es
and bh, byte [ecx + 0x56c0fba1]
inc edi
not dword [eax + eax*8 - 0x2b]
aam 0x5f
push 0x1a
inc esi
and cl, byte [ebx]
inc edi
test eax, 0x848343fe
add cl, dl
je 0x52f1fb
mov esp, eax
and dword [eax - 0x30cdde9d], 0x20a355a1
pushal
sti
and esp, edx
fnstenv [ebp - 0x41]
mov al, byte [0x4181a7af]
adc ecx, eax
cmc
aas
cli
pop esi
ret
nop
in al, dx
salc
lodsb al, byte [esi]
pop es
xor dword [esi - 0x18dc81ed], 0x1e
daa
xor byte [esi], 0x4c
cmp ebp, ebx
xchg bl, cl
out 0xf5, al
xor dword ss:[edx + 0x2b], 0xffffff8a
wait
xchg esi, eax
xlatb
and ecx, dword [edx + 0x7872e5a7]
shl dword [edi - 0x1d], 0x2a
jecxz 0x52f227
inc ebp
mov ch, 0x38
scasb al, byte es:[edi]
das
pop ecx
out dx, eax
loop 0x52f283
int3
xchg esi, eax
rcr dword [edi + ecx*2 - 0x652598b3], cl
mov dword [0x3ed653d2], eax
mov ah, 0x3b
fdivr dword [ebx]
add byte [eax + 0x44d62b96], ah
jl 0x52f2b7
dec edx
into
pop edi
invalid
pop es
clc
cwde
inc esi
xlatb
les esp, [esi + 0x42]
ja 0x52f2f2
mov dh, 0x3b
push 0x90cf8ac3
into
and ecx, dword [esp + edi + 0x53]
shr byte [ebx + 0x5a], 1
pop edx
dec eax
out 0xd0, al
xchg edx, eax
movq mm5, mm0
in eax, dx
fmul qword [esi]
push es
dec ecx
dec ecx
dec edx
lcall 0xb6ec, 0xee6973b1
pop es
popfd
add al, 0x17
dec edx
xchg ebp, eax
mov cl, 0xb
not bl
xchg ebp, eax
aas
mov ax, word [0x8148a32e]
jns 0x52f2cf
cmpsd dword [esi], dword es:[edi]
popfd
jno 0x52f26b
lcall 0xb5fa, 0xe57b16d8
xchg dword [esi - 0x27454f64], ebp
shl byte [ecx - 0x32e98630], 0x9e
cli
mov ch, 0x87
scasb al, byte es:[edi]
pushfd
mov al, 0xba
fadd st(0)
movsb byte es:[edi], byte [esi]
and eax, edx
jns 0x52f2db
int 0x9e
int1
stosd dword es:[edi], eax
sub eax, 0x5c0696ab
aaa
mov bh, 0x7a
sub eax, 0x38aef2c7
fdiv st(6), st(0)
int 0x80
ja 0xae301092
xchg dword [edx + 0x4baddd1d], esi
dec ebx
sar esp, 1
xlatb
cmp dword [edx], esp
popal
pop ecx
push edi
insb byte es:[edi], dx
pop edi
adc al, byte [edi]
sub eax, 0xed80273f
invalid