joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44eed0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x496043
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.00488fac
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], 0x4bddf8
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], 0x4bdd40
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [0x498120]
push eax
mov ecx, edi
call fcn.0048e64a
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.0048fb66
test eax, eax
je 0x44efec
mov ecx, dword [esp + 0x3c]
call fcn.0048e677
mov ecx, dword [esi + 0x1c]
mov ebp, dword [0x4985b8]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x44efb0
push edi
mov ecx, esi
call fcn.0048bcd9
mov ecx, esi
call fcn.0044f190
cmp dword [esp + 0x38], 1
jne 0x44efe5
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.0048be14
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28

Function at 0x4511d0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x451203
push esi
call fcn.0045f590
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x4511fc
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x451289
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x451272
mov eax, dword [esi + 8]
test eax, eax
je 0x451227
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x45126e
cmp eax, 2
je 0x451272
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x45121a
cmp eax, 3
je 0x45124d
cmp eax, 1
jne 0x45121a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x45121a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x45121a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.004512b0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x451298
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.004512b0
add esp, 4
pop esi
ret
Function at 0x473bf0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4968a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.004737a0
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.00473820
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.00473820
lea ecx, [esi + 0xc]
call fcn.00487988
lea ecx, [esi + 0x10]
call fcn.00487988
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.00474db0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.00474db0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.00474db0
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.004879fd
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.004879fd
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..reloc
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x433072
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0xf152e23
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..rdata
nop
nop
nop
cmp eax, 0
nop
je 0x4330d2
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x53876dfb
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Read file on windows

Disassembly:
push esi
push edi
push str.ShellExecuteW
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 1
xor edi, edi
push edi
push edi
push 0x10002054
push str.open
push edi
call eax
push 0x40
mov esi, 0x1000
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push str.desktop.ini
mov dword [0x10003228], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000322c], eax
cmp eax, 0xffffffff
je 0x100011f3
push edi
push 0x10003230
push esi
push dword [0x10003228]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x10003228]
movzx ecx, byte [eax]
xor ecx, 0x4e
xor esi, esi
cmp dword [0x10003230], edi
jbe 0x100011f1
mov dl, byte [eax + esi]
xor dl, cl
add dl, 0x42
mov byte [eax + esi], dl
inc esi
cmp esi, dword [0x10003230]
jb 0x100011dd
call eax
pop edi
pop esi
ret 0x10
Function at 0x4272db
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x520
add byte [eax], al
mov eax, dword [0x4badc0]
xor eax, ebp
add bh, al
cld
push ebx
jge 0x4272e9
mov dword [ebp + 0x57], edi
lea eax, [ebp - 0x518]
push eax
push dword [esi + 4]
call dword [0x48d374]
xor ebx, ebx
mov edi, 0x244c0121
inc dword [eax + eax*8 + 0x975f084]
or dword [ebx + 0x58488c3], 0xfffffffc
invalid

Function at 0x42a7a9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
inc ebx
push 0xe78105c7
sub ah, 0xa9
push edi
inc ebx
push 0xe8088951
and byte [ebp - 0x574f2d76], al
dec ebx
test al, 0x4b
add byte [ecx], cl
push dword [esi + 0x24]
inc ebp
inc dword [ecx - 0x73]
xchg esi, eax
push esi
pop esp
movsb byte es:[edi], byte [esi]
and al, 0x80
jg 0x42a7d9
retf 0x3939
lea eax, [edx + 0x795308f8]
mov byte [esi], cl
inc esi
out dx, eax
lea eax, [edx + 0x795308f8]
mov byte [esi], cl
jae 0x42a7f1
cmp dword [ecx], edi
je 0x42a7f3
jne 0x42a80f
je 0x42a7be
je 0x8d84a70b
xchg esi, eax
push ecx
or byte [ebp + 0x4d0fdbd2], al
mov al, byte [0xfad0418d]
add eax, 0x61830c75
or byte [esi - 0x169bb2c5], ch
call 0xfac64ca6
add dword [ebp + 5], esi
mov dword [ebp + 0x19e9eff0], edx
test esi, esi
jne 0x42a83b
cmp cx, word [ebp + 0x64]
jmp 0x83e73600
call 0x60a1337e
mov dword [esi + 0x60], eax
cmp dword [ecx + 4], 8
jne 0x8b8a7c1
push 0x24
pop edi
mov eax, dword [esi + 0x5c]
add edi, 0xc
and dword [edi + eax - 4], 2
je 0x42a868
clc
or byte [ebx + 0x79], dl
jl 0x42a83b
cmp dword [ecx], 0xc000008e
mov edi, dword [esi + 0x64]
jne 0x42a865
mov dword [esi + 0x64], 0xc78bfb83
xor edx, edx
hlt
pushfd
cmp eax, edi
or byte [ebx - 0x40], dl
jne 0x42a876
mov dword [esi + 0x64], 0xf84529fc
jmp 0x42a8eb
cmp dword [ecx], 0xc0530891
jne 0x42a887
mov dword [esi + 0x64], 0x2df98985
jmp 0x42a8eb
cmp dword [ecx], 0xc0530893
jne 0x42a898
mov dword [esi + 0x64], 0x2df98985
jmp 0x42a8eb
cmp dword [ecx], 0xc053088d
jne 0x42a8a9
mov dword [esi + 0x64], 0x75ff0000
jmp 0x42a8eb
cmp dword [ecx], 0xc053088f
jne 0x42a8ba
mov dword [esi + 0x64], 0x59006686
ret
cmp dword [ecx], 0xc0530892
jne 0x42a8cb
mov dword [esi + 0x64], 0x59206a03
jmp 0x42a8eb
cmp dword [ecx], 0xc05302b5
jne 0x42a8dc
mov dword [esi + 0x64], 0x8b004264
jmp 0x42a8eb
cmp dword [ecx], 0xc05302b4
jne 0x42a8eb
mov dword [esi + 0x64], 0x836608b5
push dword [esi + 0x64]
push 8
call edx
pop ecx
mov dword [esi + 0x64], edi
jmp 0x42a901
pop ecx
mov dword [esi + 0x60], ebx
pushal
mov dword [ebp - 0x3ff4eb10], edx
jne 0x42a935
mov ecx, dword [esp + 0x10]
push 8
push 0x4b6e08
call 0xf6766ae4
and al, 0xff
or ah, dh
sti
inc edi
add byte [0xe683f78b], al
pop ds
shl esi, 6
add esi, dword [ecx + eax*2]
add al, 0x20
je 0x42a948
cmp dword [esi - 0x75], 0x45
jle 0x42a8c2
inc ebp
adc al, 0x30
push 0xa
call 0xc417d18
je 0x42a948
cmp esi, 4
jne 0x42a9c6
mov eax, dword [ebp + 0x14]
adc dl, bl
dec eax
adc al, 0x83
invalid
and dword [ebp - 0x24], 0
push 0xb
call 0x89677da0
sbb al, ch
aas
inc edx
pop es
or eax, esi
jmp 0xbdce0330
fmul qword [ebx]
call 0xc417d18
je 0x42a9d4
cmp esi, 4
cmp esi, 0xb
jg 0x42a9af
or edi, dword [edi - 0x28]
cmp ebx, 0x40
jge 0xc3b2ce9
invalid
Function at 0x677d7ed0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x679362f0
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x67ad7034]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp byte [esi + 0x20], 0
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], edi
je 0x677d7f17
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x17]
inc edx
xor byte [ecx], al
cmp edx, 0x1f
jb 0x677d7f05
mov byte [esi + 0x20], 0
lea ecx, [esi + 0x1f]
mov dword [edi], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov dword [ebp - 4], 0xffffffff
cmp esi, ecx
je 0x677d7f46
push 0x1f
push esi
mov ecx, edi
call fcn.677d7ac0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x677d7f60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x679362f0
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x67ad7034]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp byte [esi + 0x17], 0
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], edi
je 0x677d7fa7
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x17]
inc edx
xor byte [ecx], al
cmp edx, 0x16
jb 0x677d7f95
mov byte [esi + 0x17], 0
lea ecx, [esi + 0x16]
mov dword [edi], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov dword [ebp - 4], 0xffffffff
cmp esi, ecx
je 0x677d7fd6
push 0x16
push esi
mov ecx, edi
call fcn.677d7ac0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x677dea60
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x677deaac
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x677dea8f
cmp edi, 2
jb 0x677dea8f
cmp byte [esi], cl
jne 0x677dea8f
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x67952818]
test edi, edi
jne 0x677dea75
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x677deadb
cmp cl, 0x23
jne 0x677deac2
cmp byte [esi], cl
jne 0x677deac2
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x67952818]
test cl, cl
jne 0x677deab3
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
Function at 0x677debf0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x677dec04
mov dword [edi], 0
mov edx, 0x679509b4
call fcn.677deaf0
mov esi, eax
test esi, esi
je 0x677ded00
mov ebx, dword [sym.imp.ucrtbase.dll_ftell]
push esi
call ebx
add esp, 4
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x677decf6
push 2
push 0
push esi
call dword [sym.imp.ucrtbase.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x677decf6
push esi
call ebx
mov ebx, eax
add esp, 4
mov dword [ebp + 8], ebx
cmp ebx, 0xffffffff
je 0x677decf6
push 0
push dword [ebp - 4]
push esi
call dword [sym.imp.ucrtbase.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x677decf6
mov eax, dword [0x67b38b68]
test eax, eax
je 0x677dec80
inc dword [eax + 0xb0]
push dword [0x67b38b60]
push ebx
call fcn.677dd990
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x677decf6
push esi
push dword [ebp + 8]
push 1
push ebx
call dword [sym.imp.ucrtbase.dll_fread]
add esp, 0x10
push esi
cmp eax, dword [ebp + 8]
je 0x677decdb
call dword [sym.imp.ucrtbase.dll_fclose]
mov eax, dword [0x67b38b68]
add esp, 4
test eax, eax
je 0x677decc3
dec dword [eax + 0xb0]
push dword [0x67b38b60]
push ebx
call fcn.677dd9b0
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.ucrtbase.dll_fclose]
add esp, 4
test edi, edi
je 0x677deced
mov eax, dword [ebp + 8]
mov dword [edi], eax
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.ucrtbase.dll_fclose]
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x677e2c90
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x67ad7034]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ecx + 0xe0]
lea edx, [ebp - 8]
push ebx
mov ebx, dword [ecx + 0xe8]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 4
mov ebx, dword [ebx + eax*4 - 4]
mov dword [ebp - 8], edi
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x67952818]
sub esi, 1
jne 0x677e2cc3
mov eax, dword [0x67b38b68]
not ebx
cmp dword [eax + 0x3e5c], ebx
jne 0x677e2cfb
push ecx
push edi
lea edx, [esi + 4]
mov ecx, ebx
call fcn.677fe2f0
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.679343f5
mov esp, ebp
pop ebp
ret 4

Function at 0x677e2d10
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x67ad7034]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov edx, ecx
push esi
push edi
lea esi, [ebp - 0x18]
mov edi, 0x10
movss xmm1, dword [edx + 0xfc]
movss xmm0, dword [eax]
movss xmm2, dword [edx + 0x100]
subss xmm0, xmm1
mov ecx, dword [edx + 0xe0]
movss dword [ebp - 0x18], xmm0
movss xmm0, dword [eax + 4]
subss xmm0, xmm2
movss dword [ebp - 0x14], xmm0
movss xmm0, dword [eax + 8]
subss xmm0, xmm1
movss dword [ebp - 0x10], xmm0
movss xmm0, dword [eax + 0xc]
mov eax, dword [edx + 0xe8]
subss xmm0, xmm2
mov edx, dword [eax + ecx*4 - 4]
movss dword [ebp - 0xc], xmm0
not edx
nop dword [eax + eax]
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x67952818]
sub edi, 1
jne 0x677e2d90
mov ecx, dword [ebp - 8]
not edx
pop edi
xor ecx, ebp
mov eax, edx
pop esi
call fcn.679343f5
mov esp, ebp
pop ebp
ret 4
Function at 0x677e6b90
Capabilities:
Hash data with crc32

Disassembly:
mov eax, ecx
or ecx, 0xffffffff
push ebx
push esi
mov bl, byte [eax]
lea esi, [eax + 1]
test bl, bl
je 0x677e6bcd
push edi
or edi, 0xffffffff
cmp bl, 0x23
jne 0x677e6bb3
cmp byte [esi], bl
jne 0x677e6bb3
cmp byte [esi + 1], bl
cmove ecx, edi
movzx edx, cl
movzx eax, bl
mov bl, byte [esi]
xor edx, eax
shr ecx, 8
inc esi
xor ecx, dword [edx*4 + 0x67952818]
test bl, bl
jne 0x677e6ba4
pop edi
pop esi
not ecx
pop ebx
jmp fcn.677e6b20
Function at 0x677ec5d0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x67b38b68]
lea edx, [ebp - 4]
push ebx
push esi
push edi
mov edi, dword [eax + 0x3e28]
mov esi, 4
mov eax, dword [edi + 0xe0]
add edi, 0xe0
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ecx
mov ebx, dword [edi + 8]
mov ebx, dword [ebx + eax*4 - 4]
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x67952818]
sub esi, 1
jne 0x677ec607
mov eax, dword [0x67b38b68]
not ebx
cmp dword [eax + 0x3e5c], ebx
jne 0x677ec641
push ecx
push dword [ebp - 8]
lea edx, [esi + 0xc]
mov ecx, ebx
call fcn.677fe2f0
add esp, 8
mov esi, dword [edi + 4]
mov ecx, dword [edi]
cmp ecx, esi
jne 0x677ec66e
inc ecx
test esi, esi
je 0x677ec65a
mov eax, esi
cdq
sub eax, edx
sar eax, 1
add eax, esi
jmp 0x677ec65f
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
push ecx
mov ecx, edi
call fcn.677ff2a0
mov ecx, dword [edi]
mov eax, dword [edi + 8]
mov dword [eax + ecx*4], ebx
inc dword [edi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x677f4be0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
cmp dword [edi + 0x5a58], 0
lea esi, [edi + 0x5a5c]
je 0x677f4c62
mov ecx, dword [esi + 4]
test ecx, ecx
jns 0x677f4c1c
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, esi
call fcn.677ff680
push dword [ebp + 8]
mov ecx, esi
mov dword [esi], 0
push ebx
call fcn.677df9d0
mov edx, dword [esi]
mov ecx, 0x67b38b64
push dword [edi + 0x5a58]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [edi + 0x5a64]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
mov ecx, esi
push ebx
call fcn.677df9d0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x677f5270
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
push esi
lea esi, [ecx + 1]
push edi
mov edi, dword [0x67b38b68]
test bl, bl
je 0x677f52b6
or edi, 0xffffffff
cmp bl, 0x23
jne 0x677f5297
cmp byte [esi], bl
jne 0x677f5297
cmp byte [esi + 1], bl
cmove eax, edi
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
xor eax, dword [edx*4 + 0x67952818]
test bl, bl
jne 0x677f5288
mov edi, dword [0x67b38b68]
mov esi, dword [edi + 0x5a00]
xor ecx, ecx
not eax
test esi, esi
jle 0x677f52dc
mov edi, dword [edi + 0x5a08]
lea edx, [edi + 4]
nop dword [eax]
cmp dword [edx], eax
je 0x677f52e2
inc ecx
add edx, 0x24
cmp ecx, esi
jl 0x677f52d0
pop edi
pop esi
xor eax, eax
pop ebx
ret
lea eax, [ecx + ecx*8]
lea eax, [edi + eax*4]
pop edi
pop esi
pop ebx
ret
Function at 0x6782dc20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x6782dc5c
mov eax, dword [0x67b38b68]
mov dword [esi + 4], 0
mov dword [esi], 0
test eax, eax
je 0x6782dc46
dec dword [eax + 0xb0]
push dword [0x67b38b60]
push ecx
call fcn.677dd9b0
add esp, 8
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x6782dc96
mov eax, dword [0x67b38b68]
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
test eax, eax
je 0x6782dc80
dec dword [eax + 0xb0]
push dword [0x67b38b60]
push ecx
call fcn.677dd9b0
add esp, 8
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x6782dcd0
mov eax, dword [0x67b38b68]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
test eax, eax
je 0x6782dcba
dec dword [eax + 0xb0]
push dword [0x67b38b60]
push ecx
call fcn.677dd9b0
add esp, 8
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x6782dd26
mov eax, dword [0x67b38b68]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
test eax, eax
je 0x6782dd10
dec dword [eax + 0xb0]
push dword [0x67b38b60]
push ecx
call fcn.677dd9b0
add esp, 8
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x6782dd60
mov eax, dword [0x67b38b68]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
test eax, eax
je 0x6782dd4a
dec dword [eax + 0xb0]
push dword [0x67b38b60]
push ecx
call fcn.677dd9b0
add esp, 8
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x6782dd9a
mov eax, dword [0x67b38b68]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
test eax, eax
je 0x6782dd84
dec dword [eax + 0xb0]
push dword [0x67b38b60]
push ecx
call fcn.677dd9b0
add esp, 8
mov dword [esi + 0x5c], 0
lea ecx, [esi + 0x78]
pop esi
jmp fcn.67831370
Function at 0x67837fe0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x67ad7034]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [0x67b38b68]
mov dword [ebp - 0x4c], edx
push edi
mov edi, ecx
test esi, esi
je 0x67838006
mov esi, dword [esi + 0x78]
jmp 0x67838008
xor esi, esi
push 0xbe2
call dword [0x67b38be0]
push 0x8006
call dword [0x67b38b90]
push 0x303
push 1
push 0x303
push 0x302
call dword [0x67b38b98]
push 0xb44
call dword [0x67b38bd0]
push 0xb71
call dword [0x67b38bd0]
push 0xb90
call dword [0x67b38bd0]
push 0xc11
call dword [0x67b38be0]
cmp dword [esi], 0x136
jb 0x67838074
push 0x8f9d
call dword [0x67b38bd0]
push ebx
push 0x1b02
push 0x408
call dword [0x67b38c34]
cmp byte [esi + 0x50], 0
mov bl, 1
je 0x678380b2
lea eax, [ebp - 0x48]
mov dword [ebp - 0x48], 0
push eax
push 0x935c
call dword [0x67b38c00]
xor eax, eax
movzx ebx, bl
cmp dword [ebp - 0x48], 0x8ca2
cmove ebx, eax
push dword [ebp + 8]
push dword [ebp - 0x4c]
push 0
push 0
call dword [0x67b38c5c]
movss xmm6, dword [edi + 0x14]
test bl, bl
movss xmm4, dword [edi + 0x18]
movaps xmm5, xmm6
addss xmm5, dword [edi + 0x1c]
movaps xmm3, xmm4
addss xmm3, dword [edi + 0x20]
pop ebx
jne 0x678380ea
movaps xmm0, xmm4
movaps xmm4, xmm3
movaps xmm3, xmm0
movss xmm2, dword [0x67ac44c0]
movaps xmm1, xmm5
subss xmm1, xmm6
mov dword [ebp - 0x1c], 0xbf800000
movaps xmm0, xmm2
mov dword [ebp - 0x18], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0x3f800000
divss xmm0, xmm1
movss dword [ebp - 0x44], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0x40], xmm0
movaps xmm0, xmm4
subss xmm0, xmm3
divss xmm2, xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0x2c], xmm0
movaps xmm0, xmm5
movss dword [ebp - 0x30], xmm2
addss xmm0, xmm6
subss xmm6, xmm5
divss xmm0, xmm6
movss dword [ebp - 0x14], xmm0
movaps xmm0, xmm3
addss xmm0, xmm4
subss xmm3, xmm4
divss xmm0, xmm3
movss dword [ebp - 0x10], xmm0
push dword [esi + 0x28]
call dword [0x67b38c54]
push 0
push dword [esi + 0x2c]
call dword [0x67b38c4c]
lea eax, [ebp - 0x44]
push eax
push 0
push 1
push dword [esi + 0x30]
call dword [0x67b38c50]
cmp dword [esi], 0x14a
jb 0x6783819e
push 0
push 0
call dword [0x67b38b84]
push dword [ebp + 0xc]
call dword [0x67b38b8c]
push dword [esi + 0x40]
push 0x8892
call dword [0x67b38b80]
push dword [esi + 0x44]
push 0x8893
call dword [0x67b38b80]
push dword [esi + 0x34]
call dword [0x67b38be4]
push dword [esi + 0x38]
call dword [0x67b38be4]
push dword [esi + 0x3c]
call dword [0x67b38be4]
push 0
push 0x14
push 0
push 0x1406
push 2
push dword [esi + 0x34]
call dword [0x67b38c58]
push 8
push 0x14
push 0
push 0x1406
push 2
push dword [esi + 0x38]
call dword [0x67b38c58]
push 0x10
push 0x14
push 1
push 0x1401
push 4
push dword [esi + 0x3c]
call dword [0x67b38c58]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.679343f5
mov esp, ebp
pop ebp
ret
Function at 0x67852e60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
or eax, 2
mov dword [ebp + 8], eax
pop ebp
jmp fcn.67852f70