joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10026f08
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebx, dword [esp + 0x38]
mov edi, dword [esp + 0x34]
mov ebp, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
mov ecx, dword [0x100551d4]
test ecx, ecx
jne 0x10026fde
mov esi, dword [0x100551b8]
test esi, esi
jne 0x10026f4c
mov ecx, 0xf8f45725
call fcn.1002805c
mov esi, eax
mov dword [0x100551b8], eax
mov dword [esp + 0xa], 0x222f4c4a
mov dword [esp + 0xe], 0x31342c29
mov byte [esp + 0x12], 0
mov word [esp + 8], 0x5873
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x3c
xor byte [esp + eax + 8], cl
inc eax
cmp eax, 0xa
jne 0x10026f6b
mov byte [esp + 0x12], 0
mov ecx, dword [0x100551bc]
test ecx, ecx
jne 0x10026f9a
mov ecx, 0x53b2070f
call fcn.1002805c
mov ecx, eax
mov dword [0x100551bc], eax
mov dword [esp + 2], 0x7373600c
mov byte [esp + 6], 0
mov word [esp], 0x4e77
xor eax, eax
inc eax
mov edx, eax
add dl, 0x3c
xor byte [esp + eax], dl
inc eax
cmp eax, 6
jne 0x10026fb0
mov eax, esp
mov byte [eax + 6], 0
push eax
call ecx
lea ecx, [esp + 8]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x100551d4], eax
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
push ebx
push edi
push ebp
push edx
push eax
call ecx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0x14

Function at 0x10026ff0
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [esp + 0x48]
mov edx, dword [esp + 0x44]
mov esi, dword [esp + 0x40]
mov ebp, dword [esp + 0x3c]
mov ebx, dword [esp + 0x38]
mov edi, dword [esp + 0x34]
mov ecx, dword [0x100551d8]
test ecx, ecx
jne 0x100270d9
mov esi, dword [0x100551b8]
test esi, esi
jne 0x10027038
mov ecx, 0xf8f45725
call fcn.1002805c
mov esi, eax
mov dword [0x100551b8], eax
mov dword [esp + 2], 0x222f767f
mov word [esp + 6], 0x2f36
mov byte [esp + 8], 0
mov word [esp], 0x6e57
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x3c
xor byte [esp + eax], cl
inc eax
cmp eax, 8
jne 0x10027055
mov byte [esp + 8], 0
mov ecx, dword [0x100551bc]
test ecx, ecx
jne 0x10027083
mov ecx, 0x53b2070f
call fcn.1002805c
mov ecx, eax
mov dword [0x100551bc], eax
mov dword [esp + 0xe], 0x7373600c
mov byte [esp + 0x12], 0
mov word [esp + 0xc], 0x4e77
xor eax, eax
inc eax
mov edx, eax
add dl, 0x3c
xor byte [esp + eax + 0xc], dl
inc eax
cmp eax, 6
jne 0x1002709a
lea eax, [esp + 0xc]
mov byte [eax + 6], 0
push eax
call ecx
mov ecx, esp
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x100551d8], eax
mov edi, dword [esp + 0x34]
mov ebx, dword [esp + 0x38]
mov ebp, dword [esp + 0x3c]
mov eax, dword [esp + 0x48]
mov edx, dword [esp + 0x44]
mov esi, dword [esp + 0x40]
push eax
push edx
push esi
push ebp
push ebx
push edi
push dword [esp + 0x48]
push dword [esp + 0x48]
push dword [esp + 0x48]
call ecx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0x24
Function at 0x100270f8
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebx
push edi
push esi
sub esp, 0x14
mov ebx, dword [esp + 0x28]
mov edi, dword [esp + 0x24]
mov ecx, dword [0x100551dc]
test ecx, ecx
jne 0x100271b8
mov esi, dword [0x100551b8]
test esi, esi
jne 0x1002712f
mov ecx, 0xf8f45725
call fcn.1002805c
mov esi, eax
mov dword [0x100551b8], eax
mov dword [esp + 2], 0x2e244b4b
mov word [esp + 6], 0x2d35
mov byte [esp + 8], 0
mov word [esp], 0x5573
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x3c
xor byte [esp + eax], cl
inc eax
cmp eax, 8
jne 0x1002714c
mov byte [esp + 8], 0
mov ecx, dword [0x100551bc]
test ecx, ecx
jne 0x1002717a
mov ecx, 0x53b2070f
call fcn.1002805c
mov ecx, eax
mov dword [0x100551bc], eax
mov dword [esp + 0xe], 0x7373600c
mov byte [esp + 0x12], 0
mov word [esp + 0xc], 0x4e77
xor eax, eax
inc eax
mov edx, eax
add dl, 0x3c
xor byte [esp + eax + 0xc], dl
inc eax
cmp eax, 6
jne 0x10027191
lea eax, [esp + 0xc]
mov byte [eax + 6], 0
push eax
call ecx
mov ecx, esp
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x100551dc], eax
push ebx
push edi
call ecx
add esp, 0x14
pop esi
pop edi
pop ebx
ret 8

Function at 0x100271c6
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push edi
push esi
sub esp, 0x14
mov edi, dword [esp + 0x20]
mov ecx, dword [0x100551e0]
test ecx, ecx
jne 0x10027284
mov esi, dword [0x100551b8]
test esi, esi
jne 0x100271f8
mov ecx, 0xf8f45725
call fcn.1002805c
mov esi, eax
mov dword [0x100551b8], eax
mov dword [esp + 0xa], 0x32254c51
mov dword [esp + 0xe], 0x202f202d
mov word [esp + 0x12], 0x32
mov word [esp + 8], 0x5163
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x3c
xor byte [esp + eax + 8], cl
inc eax
cmp eax, 0xb
jne 0x10027219
mov byte [esp + 0x13], 0
mov ecx, dword [0x100551bc]
test ecx, ecx
jne 0x10027248
mov ecx, 0x53b2070f
call fcn.1002805c
mov ecx, eax
mov dword [0x100551bc], eax
mov dword [esp + 2], 0x7373600c
mov byte [esp + 6], 0
mov word [esp], 0x4e77
xor eax, eax
inc eax
mov edx, eax
add dl, 0x3c
xor byte [esp + eax], dl
inc eax
cmp eax, 6
jne 0x1002725e
mov eax, esp
mov byte [eax + 6], 0
push eax
call ecx
lea ecx, [esp + 8]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x100551e0], eax
push edi
call ecx
add esp, 0x14
pop esi
pop edi
ret 4
Function at 0x100275ae
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebp, dword [esp + 0x30]
mov ebx, dword [esp + 0x2c]
mov edi, dword [esp + 0x28]
mov ecx, dword [0x100551e4]
test ecx, ecx
jne 0x10027676
mov esi, dword [0x100551b8]
test esi, esi
jne 0x100275ea
mov ecx, 0xf8f45725
call fcn.1002805c
mov esi, eax
mov dword [0x100551b8], eax
mov dword [esp + 0xa], 0x222f4c4a
mov dword [esp + 0xe], 0x28252d29
mov word [esp + 0x12], 0x23
mov word [esp + 8], 0x5867
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x3c
xor byte [esp + eax + 8], cl
inc eax
cmp eax, 0xb
jne 0x1002760b
mov byte [esp + 0x13], 0
mov ecx, dword [0x100551bc]
test ecx, ecx
jne 0x1002763a
mov ecx, 0x53b2070f
call fcn.1002805c
mov ecx, eax
mov dword [0x100551bc], eax
mov dword [esp + 2], 0x7373600c
mov byte [esp + 6], 0
mov word [esp], 0x4e77
xor eax, eax
inc eax
mov edx, eax
add dl, 0x3c
xor byte [esp + eax], dl
inc eax
cmp eax, 6
jne 0x10027650
mov eax, esp
mov byte [eax + 6], 0
push eax
call ecx
lea ecx, [esp + 8]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x100551e4], eax
push ebp
push ebx
push edi
call ecx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0xc

Function at 0x10027686
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebp, dword [esp + 0x30]
mov ebx, dword [esp + 0x2c]
mov edi, dword [esp + 0x28]
mov ecx, dword [0x100551e8]
test ecx, ecx
jne 0x1002774e
mov esi, dword [0x100551b8]
test esi, esi
jne 0x100276c2
mov ecx, 0xf8f45725
call fcn.1002805c
mov esi, eax
mov dword [0x100551b8], eax
mov dword [esp + 0xa], 0x24254f4a
mov dword [esp + 0xe], 0x28252d30
mov word [esp + 0x12], 0x23
mov word [esp + 8], 0x5867
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x3c
xor byte [esp + eax + 8], cl
inc eax
cmp eax, 0xb
jne 0x100276e3
mov byte [esp + 0x13], 0
mov ecx, dword [0x100551bc]
test ecx, ecx
jne 0x10027712
mov ecx, 0x53b2070f
call fcn.1002805c
mov ecx, eax
mov dword [0x100551bc], eax
mov dword [esp + 2], 0x7373600c
mov byte [esp + 6], 0
mov word [esp], 0x4e77
xor eax, eax
inc eax
mov edx, eax
add dl, 0x3c
xor byte [esp + eax], dl
inc eax
cmp eax, 6
jne 0x10027728
mov eax, esp
mov byte [eax + 6], 0
push eax
call ecx
lea ecx, [esp + 8]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x100551e8], eax
push ebp
push ebx
push edi
call ecx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x100277b4
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [esp + 0x3c]
mov edi, dword [esp + 0x38]
mov ebp, dword [esp + 0x34]
mov ebx, dword [esp + 0x30]
mov esi, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov ecx, dword [0x100551ec]
test ecx, ecx
jne 0x10027898
mov esi, dword [0x100551b8]
test esi, esi
jne 0x100277fc
mov ecx, 0xf8f45725
call fcn.1002805c
mov esi, eax
mov dword [0x100551b8], eax
mov dword [esp + 2], 0x2f256c7f
mov word [esp + 6], 0x26
mov word [esp], 0x6e57
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x3c
xor byte [esp + eax], cl
inc eax
cmp eax, 7
jne 0x10027814
mov byte [esp + 7], 0
mov ecx, dword [0x100551bc]
test ecx, ecx
jne 0x10027842
mov ecx, 0x53b2070f
call fcn.1002805c
mov ecx, eax
mov dword [0x100551bc], eax
mov dword [esp + 0xa], 0x7373600c
mov byte [esp + 0xe], 0
mov word [esp + 8], 0x4e77
xor eax, eax
inc eax
mov edx, eax
add dl, 0x3c
xor byte [esp + eax + 8], dl
inc eax
cmp eax, 6
jne 0x10027859
lea eax, [esp + 8]
mov byte [eax + 6], 0
push eax
call ecx
mov ecx, esp
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x100551ec], eax
mov edx, dword [esp + 0x28]
mov esi, dword [esp + 0x2c]
mov ebx, dword [esp + 0x30]
mov ebp, dword [esp + 0x34]
mov edi, dword [esp + 0x38]
mov eax, dword [esp + 0x3c]
push eax
push edi
push ebp
push ebx
push esi
push edx
push dword [esp + 0x3c]
call ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 0x1c

Function at 0x10027916
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [esp + 0x3c]
mov edi, dword [esp + 0x38]
mov ebp, dword [esp + 0x34]
mov ebx, dword [esp + 0x30]
mov esi, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov ecx, dword [0x100551f0]
test ecx, ecx
jne 0x100279fa
mov esi, dword [0x100551b8]
test esi, esi
jne 0x1002795e
mov ecx, 0xf8f45725
call fcn.1002805c
mov esi, eax
mov dword [0x100551b8], eax
mov dword [esp + 2], 0x22256d7f
mov word [esp + 6], 0x34
mov word [esp], 0x6e57
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x3c
xor byte [esp + eax], cl
inc eax
cmp eax, 7
jne 0x10027976
mov byte [esp + 7], 0
mov ecx, dword [0x100551bc]
test ecx, ecx
jne 0x100279a4
mov ecx, 0x53b2070f
call fcn.1002805c
mov ecx, eax
mov dword [0x100551bc], eax
mov dword [esp + 0xa], 0x7373600c
mov byte [esp + 0xe], 0
mov word [esp + 8], 0x4e77
xor eax, eax
inc eax
mov edx, eax
add dl, 0x3c
xor byte [esp + eax + 8], dl
inc eax
cmp eax, 6
jne 0x100279bb
lea eax, [esp + 8]
mov byte [eax + 6], 0
push eax
call ecx
mov ecx, esp
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x100551f0], eax
mov edx, dword [esp + 0x28]
mov esi, dword [esp + 0x2c]
mov ebx, dword [esp + 0x30]
mov ebp, dword [esp + 0x34]
mov edi, dword [esp + 0x38]
mov eax, dword [esp + 0x3c]
push eax
push edi
push ebp
push ebx
push esi
push edx
push dword [esp + 0x3c]
call ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 0x1c
Function at 0x10027a56
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov ebx, dword [esp + 0x44]
mov edi, dword [esp + 0x40]
mov ebp, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x34]
mov ecx, dword [0x100551f4]
test ecx, ecx
jne 0x10027b30
mov esi, dword [0x100551b8]
test esi, esi
jne 0x10027a9a
mov ecx, 0xf8f45725
call fcn.1002805c
mov esi, eax
mov dword [0x100551b8], eax
mov dword [esp + 0x18], 0x3a3d281e
mov word [esp + 0x1c], 0x253c
mov byte [esp + 0x1e], 0
movaps xmm0, xmmword [0x10041e60]
movups xmmword [esp + 8], xmm0
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x3c
xor byte [esp + eax + 8], cl
inc eax
cmp eax, 0x16
jne 0x10027abd
mov byte [esp + 0x1e], 0
mov ecx, dword [0x100551bc]
test ecx, ecx
jne 0x10027aec
mov ecx, 0x53b2070f
call fcn.1002805c
mov ecx, eax
mov dword [0x100551bc], eax
mov dword [esp + 2], 0x7373600c
mov byte [esp + 6], 0
mov word [esp], 0x4e77
xor eax, eax
inc eax
mov edx, eax
add dl, 0x3c
xor byte [esp + eax], dl
inc eax
cmp eax, 6
jne 0x10027b02
mov eax, esp
mov byte [eax + 6], 0
push eax
call ecx
lea ecx, [esp + 8]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x100551f4], eax
mov eax, dword [esp + 0x34]
mov edx, dword [esp + 0x38]
push ebx
push edi
push ebp
push edx
push eax
call ecx
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret 0x14

Function at 0x10027b94
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push edi
push esi
sub esp, 0x18
mov edi, dword [esp + 0x24]
mov ecx, dword [0x100551f8]
test ecx, ecx
jne 0x10027c56
mov esi, dword [0x100551b8]
test esi, esi
jne 0x10027bc6
mov ecx, 0xf8f45725
call fcn.1002805c
mov esi, eax
mov dword [0x100551b8], eax
mov dword [esp + 2], 0x2d255c50
mov word [esp + 6], 0x2c0b
mov byte [esp + 8], 0
mov word [esp], 0x5c43
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x3c
xor byte [esp + eax], cl
inc eax
cmp eax, 8
jne 0x10027be3
mov byte [esp + 8], 0
mov ecx, dword [0x100551bc]
test ecx, ecx
jne 0x10027c11
mov ecx, 0x53b2070f
call fcn.1002805c
mov ecx, eax
mov dword [0x100551bc], eax
mov dword [esp + 0xe], 0x2d25514c
mov word [esp + 0x12], 0x7171
mov byte [esp + 0x14], 0
mov word [esp + 0xc], 0x586b
xor eax, eax
inc eax
mov edx, eax
add dl, 0x3c
xor byte [esp + eax + 0xc], dl
inc eax
cmp eax, 8
jne 0x10027c2f
lea eax, [esp + 0xc]
mov byte [eax + 8], 0
push eax
call ecx
mov ecx, esp
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x100551f8], eax
push edi
call ecx
add esp, 0x18
pop esi
pop edi
ret 4
Function at 0x10027c62
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebp, dword [esp + 0x50]
movzx eax, word [esp + 0x4c]
movzx edx, word [esp + 0x48]
mov ebx, dword [esp + 0x44]
mov edi, dword [esp + 0x40]
mov esi, dword [esp + 0x3c]
mov ecx, dword [0x100551fc]
test ecx, ecx
jne 0x10027d5f
mov esi, dword [0x100551b8]
test esi, esi
jne 0x10027cac
mov ecx, 0xf8f45725
call fcn.1002805c
mov esi, eax
mov dword [0x100551b8], eax
mov dword [esp + 0x18], 0x3a0c2218
mov dword [esp + 0x1c], 0x21373736
mov dword [esp + 0x20], 0x1102000b
mov word [esp + 0x24], 0x60
movaps xmm0, xmmword [0x10041e70]
movups xmmword [esp + 8], xmm0
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x3c
xor byte [esp + eax + 8], cl
inc eax
cmp eax, 0x1d
jne 0x10027cda
mov byte [esp + 0x25], 0
mov ecx, dword [0x100551bc]
test ecx, ecx
jne 0x10027d09
mov ecx, 0x53b2070f
call fcn.1002805c
mov ecx, eax
mov dword [0x100551bc], eax
mov dword [esp + 2], 0x28305e4d
mov byte [esp + 6], 0
mov word [esp], 0x5364
xor eax, eax
inc eax
mov edx, eax
add dl, 0x3c
xor byte [esp + eax], dl
inc eax
cmp eax, 6
jne 0x10027d1f
mov eax, esp
mov byte [eax + 6], 0
push eax
call ecx
lea ecx, [esp + 8]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x100551fc], eax
mov esi, dword [esp + 0x3c]
mov edi, dword [esp + 0x40]
mov ebx, dword [esp + 0x44]
mov ebp, dword [esp + 0x50]
movzx eax, word [esp + 0x4c]
movzx edx, word [esp + 0x48]
movzx eax, ax
movzx edx, dx
push ebp
push eax
push edx
push ebx
push edi
push esi
call ecx
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret 0x18

Function at 0x10027d78
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov ebx, dword [esp + 0x40]
mov edi, dword [esp + 0x3c]
mov ebp, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
mov ecx, dword [0x10055200]
test ecx, ecx
jne 0x10027e45
mov esi, dword [0x100551b8]
test esi, esi
jne 0x10027dbc
mov ecx, 0xf8f45725
call fcn.1002805c
mov esi, eax
mov dword [0x100551b8], eax
mov byte [esp + 0x18], 0
movaps xmm0, xmmword [0x10041e80]
movups xmmword [esp + 8], xmm0
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x3c
xor byte [esp + eax + 8], cl
inc eax
cmp eax, 0x10
jne 0x10027dd0
mov byte [esp + 0x18], 0
mov ecx, dword [0x100551bc]
test ecx, ecx
jne 0x10027dff
mov ecx, 0x53b2070f
call fcn.1002805c
mov ecx, eax
mov dword [0x100551bc], eax
mov dword [esp + 2], 0x242e5650
mov word [esp + 6], 0x36
mov word [esp], 0x5477
xor eax, eax
inc eax
mov edx, eax
add dl, 0x3c
xor byte [esp + eax], dl
inc eax
cmp eax, 7
jne 0x10027e17
mov eax, esp
mov byte [eax + 7], 0
push eax
call ecx
lea ecx, [esp + 8]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x10055200], eax
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
push ebx
push edi
push ebp
push edx
push eax
call ecx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret 0x14
Function at 0x10027e56
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov edi, dword [esp + 0x44]
mov ebp, dword [esp + 0x40]
mov ebx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
mov ecx, dword [0x10055204]
test ecx, ecx
jne 0x10027f32
mov esi, dword [0x100551b8]
test esi, esi
jne 0x10027e96
mov ecx, 0xf8f45725
call fcn.1002805c
mov esi, eax
mov dword [0x100551b8], eax
mov dword [esp + 0x18], 0x2e380c2d
mov dword [esp + 0x1c], 0x31333d39
mov word [esp + 0x20], 0x3038
mov byte [esp + 0x22], 0
movaps xmm0, xmmword [0x10041e90]
movups xmmword [esp + 8], xmm0
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x3c
xor byte [esp + eax + 8], cl
inc eax
cmp eax, 0x1a
jne 0x10027ec1
mov byte [esp + 0x22], 0
mov ecx, dword [0x100551bc]
test ecx, ecx
jne 0x10027ef0
mov ecx, 0x53b2070f
call fcn.1002805c
mov ecx, eax
mov dword [0x100551bc], eax
mov dword [esp + 2], 0x242e5650
mov word [esp + 6], 0x36
mov word [esp], 0x5477
xor eax, eax
inc eax
mov edx, eax
add dl, 0x3c
xor byte [esp + eax], dl
inc eax
cmp eax, 7
jne 0x10027f08
mov eax, esp
mov byte [eax + 7], 0
push eax
call ecx
lea ecx, [esp + 8]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x10055204], eax
mov eax, dword [esp + 0x38]
push edi
push ebp
push ebx
push eax
call ecx
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret 0x10

Function at 0x10027f42
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov ebx, dword [esp + 0x48]
movzx ebp, word [esp + 0x44]
mov edi, dword [esp + 0x40]
mov ecx, dword [0x10055208]
test ecx, ecx
jne 0x1002801c
mov esi, dword [0x100551b8]
test esi, esi
jne 0x10027f7f
mov ecx, 0xf8f45725
call fcn.1002805c
mov esi, eax
mov dword [0x100551b8], eax
movaps xmm0, xmmword [0x10041ea0]
movups xmmword [esp + 0xa], xmm0
movaps xmm0, xmmword [0x10041eb0]
movups xmmword [esp + 0x1a], xmm0
mov word [esp + 8], 0x5344
movups xmm0, xmmword [esp + 9]
xorps xmm0, xmmword [str.___ABCDEFGHIJKLMNOPQRSTUVWXYZ_CONNECT__s:_d_HTTP_1.1_r_n]
movups xmmword [esp + 9], xmm0
movups xmm0, xmmword [esp + 0x19]
xorps xmm0, xmmword [0x10041ed0]
movups xmmword [esp + 0x19], xmm0
mov byte [esp + 0x29], 0
mov ecx, dword [0x100551bc]
test ecx, ecx
jne 0x10027fe0
mov ecx, 0x53b2070f
call fcn.1002805c
mov ecx, eax
mov dword [0x100551bc], eax
mov dword [esp + 2], 0x28305e4d
mov byte [esp + 6], 0
mov word [esp], 0x5364
xor eax, eax
inc eax
mov edx, eax
add dl, 0x3c
xor byte [esp + eax], dl
inc eax
cmp eax, 6
jne 0x10027ff6
mov eax, esp
mov byte [eax + 6], 0
push eax
call ecx
lea ecx, [esp + 8]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x10055208], eax
movzx eax, bp
push ebx
push eax
push edi
call ecx
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x1002805c
Capabilities:
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [esp + 0xc], ecx
mov eax, dword [0x100551b4]
mov eax, dword [eax + 0x30]
mov edi, dword [eax + 0xc]
mov esi, dword [edi + 0x14]
add edi, 0x14
mov eax, dword [esi + 0x10]
movzx ecx, word [eax]
cmp ecx, 0x5a4d
jne 0x1002811e
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
jne 0x1002811e
cmp word [eax + ecx + 0x14], 0x60
jb 0x1002811e
cmp dword [eax + ecx + 0x74], 0
je 0x1002811e
mov edx, dword [eax + ecx + 0x78]
mov ecx, edx
mov dword [esp], edx
test edx, edx
je 0x1002811e
mov ecx, dword [esp]
mov ecx, dword [eax + ecx + 0x18]
mov dword [esp + 0x10], ecx
test ecx, ecx
je 0x1002811e
mov ecx, dword [esp]
mov ecx, dword [eax + ecx + 0x20]
add ecx, eax
mov dword [esp + 8], ecx
lea ecx, [eax + 1]
mov dword [esp + 4], ecx
xor ebx, ebx
mov ecx, dword [esp + 8]
mov ecx, dword [ecx + ebx*4]
mov dl, byte [eax + ecx]
test dl, dl
je 0x10028106
add ecx, dword [esp + 4]
mov ebp, 0x811c9dc5
movsx edx, dl
xor edx, ebp
imul ebp, edx, 0x1000193
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x100280f2
jmp 0x1002810b
mov ebp, 0x811c9dc5
cmp ebp, dword [esp + 0xc]
je 0x1002811a
inc ebx
cmp ebx, dword [esp + 0x10]
jne 0x100280db
jmp 0x1002811e
test eax, eax
jne 0x10028132
mov esi, dword [esi]
cmp esi, edi
jne 0x10028078
xor eax, eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, dword [esp]
mov ecx, dword [eax + edx + 0x24]
add ecx, eax
mov edx, dword [eax + edx + 0x1c]
add edx, eax
movzx ecx, word [ecx + ebx*2]
add eax, dword [edx + ecx*4]
jmp 0x1002812a
Function at 0x10028479
Capabilities:
Get storage device properties

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x38
mov eax, dword [esp + 0x4c]
sub esp, 0x1c
xor edi, edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], edi
movaps xmm0, xmmword [0x10041fb0]
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
call fcn.100012a6
mov esi, eax
mov ebx, 0xc
lea ebp, [esp + 4]
push ebx
push edi
push ebp
call fcn.10013ed4
add esp, 0xc
mov eax, esp
lea ecx, [esp + 0x10]
push edi
push eax
push 0x28
push ecx
mov edi, ecx
push ebx
push ebp
push 0x2d1400
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
setne al
cmp dword [edi + 0x1c], 7
sete cl
and cl, al
movzx edi, cl
push esi
call fcn.1000164e
mov eax, edi
add esp, 0x38
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100284f7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x690
mov ebx, 0x208
xor edi, edi
lea eax, [esp + 0x74]
push ebx
push edi
push eax
call fcn.10031f20
add esp, 0xc
lea eax, [esp + 0x27c]
push ebx
push edi
push eax
call fcn.10031f20
add esp, 0xc
lea esi, [esp + 0x484]
push ebx
push edi
push esi
call fcn.10031f20
add esp, 0xc
push dword [ebp + 8]
push esi
call fcn.10002fb0
push esi
call fcn.10002bee
cmp eax, 4
jl 0x1002856c
push 0x1003fd72
push esi
call fcn.10032128
add esp, 8
test eax, eax
je 0x1002856c
mov word [eax + 2], 0
lea eax, [esp + 0x34]
lea ecx, [esp + 0x38]
lea edx, [esp + 0x3c]
push ebx
lea edi, [esp + 0x280]
push edi
push eax
push ecx
push edx
push ebx
lea ebx, [esp + 0x8c]
push ebx
push esi
call fcn.10015bc6
cmp word [esp + 0x74], 0
je 0x100285b2
push ebx
push 0x10040510
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x100286d9
mov ebx, dword [ebp + 0xc]
lea eax, [esp + 0x60]
lea edi, [esp + 0x28]
lea ecx, [esp + 0x68]
push eax
push edi
push ecx
push esi
call fcn.10015cd0
movups xmm0, xmmword [0x10042b4e]
movups xmmword [esp + 0x4e], xmm0
movups xmm0, xmmword [str.Removable_Disk]
movaps xmmword [esp + 0x40], xmm0
mov eax, dword [edi + 4]
test eax, 0xffffff00
jne 0x10028648
mov ecx, dword [esp + 0x28]
cmp ecx, 0x40000000
mov edx, eax
sbb edx, 0
jae 0x1002868b
cmp ecx, 0x100000
mov edx, eax
sbb edx, 0
jb 0x100286d9
shrd ecx, eax, 0x14
shr eax, 0x14
mov dword [esp + 0x10], 0xefe4efca
mov word [esp + 0x26], 0
movaps xmm0, xmmword [0x10041fe0]
movups xmmword [esp], xmm0
xor edx, edx
inc edx
lea esi, [edx - 0x1025]
xor word [esp + edx*2], si
inc edx
cmp edx, 0x13
jne 0x10028636
jmp 0x100286bf
shr eax, 8
mov dword [esp + 0x10], 0xefe4efca
mov word [esp + 0x26], 0
movaps xmm0, xmmword [0x10041fc0]
movups xmmword [esp], xmm0
xor ecx, ecx
inc ecx
lea edx, [ecx - 0x1025]
xor word [esp + ecx*2], dx
inc ecx
cmp ecx, 0x13
jne 0x10028668
mov ecx, esp
mov word [ecx + 0x26], 0
lea edx, [esp + 0x40]
push 0
push eax
push edx
push ecx
jmp 0x100286cf
shrd ecx, eax, 0x1e
shr eax, 0x1e
mov dword [esp + 0x10], 0xefe4efca
mov word [esp + 0x26], 0
movaps xmm0, xmmword [0x10041fd0]
movups xmmword [esp], xmm0
xor edx, edx
inc edx
lea esi, [edx - 0x1025]
xor word [esp + edx*2], si
inc edx
cmp edx, 0x13
jne 0x100286af
mov edx, esp
mov word [edx + 0x26], 0
lea esi, [esp + 0x40]
push eax
push ecx
push esi
push edx
push ebx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret