joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100329b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x100329bf
pop dword [ebp - 0x1c]
mov eax, 0x9aea3296
sub eax, 0x8ae708d7
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0xe65697b7
add dword [ebp - 0x2c], 0x67fbad94
mov dword [ebp - 0x28], 0x259bab33
add dword [ebp - 0x28], 0xc97a112
mov dword [ebp - 0x24], 0xb02ed5c5
add dword [ebp - 0x24], 0x9c1d6e69
mov dword [ebp - 0x20], 0xa4f887c5
sub dword [ebp - 0x20], 0xa4f887c5
lea eax, [ebp - 0x2c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x49874b47
add dword [ebp - 0x2c], 0x2aeb1e0f
mov dword [ebp - 0x28], 0x689fe9b0
add dword [ebp - 0x28], 0xd8cc77c5
mov dword [ebp - 0x24], 0x5b08070e
add dword [ebp - 0x24], 0x867655e
mov dword [ebp - 0x20], 0x6f4239c1
add dword [ebp - 0x20], 0x90bdc63f
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0xdb363129
add eax, 0x34cd203b
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x4047a
push 0
call eax
mov ecx, 0x16a7de8a
sub ecx, 0x16a781ba
mov ebx, eax
mov edi, 0xb53f65dd
sub edi, 0xa536e1dd
add edi, dword [ebp - 0x1c]
mov edx, 0xa1172
add edx, 0xd4099cee
mov dword [ebp - 0xc], 0x6cc4bbb4
mov esi, dword [edi]
mov dword [ebp - 0xc], 0x676f815a
xor esi, edx
sub dword [ebp - 0xc], 0xe0a182fd
mov dword [ebx], esi
add ebx, 0x900d7131
sub ebx, 0x900d712d
add edi, 0x87b079cf
add edi, 0x784f8635
loop 0x10032adc
add eax, 0xc6caac03
add eax, 0x3936ba10
mov ebx, eax
add eax, 0x1750c98c
add eax, 0xe8af3679
mov ecx, 0x4d702628
add ecx, 0xc28fd9d8
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret

Function at 0x1003384b
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov eax, dword [esi + 0x50]
cmp eax, dword [esi + 0x54]
jae 0x10033862
mov bl, byte [eax]
inc eax
mov dword [esi + 0x50], eax
jmp 0x100338ce
cmp dword [esi + 0x4c], 0
jl 0x100338cc
mov edi, dword [esi + 0x58]
push 0xfa0
push edi
push dword [esi + 0x4c]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
mov ebx, eax
add esp, 0xc
cmp ebx, 0xffffffff
jne 0x1003389a
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [eax], 4
je 0x1003386b
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [eax], 0xb
je 0x1003386b
cmp ebx, 1
jge 0x100338a7
or dword [esi + 0x4c], 0xffffffff
xor bl, bl
jmp 0x100338ec
lea eax, [edi + 1]
mov dword [esi + 0x50], eax
lea eax, [ebx + edi]
mov dword [esi + 0x54], eax
mov bl, byte [edi]
test bl, bl
jne 0x100338ce
push esi
call fcn.100348ff
mov eax, dword [esi + 0x50]
or dword [esi + 0x4c], 0xffffffff
pop ecx
mov dword [esi + 0x54], eax
jmp 0x100338ce
xor bl, bl
cmp bl, 0xa
jne 0x100338e2
mov eax, dword [esp + 0x18]
and dword [eax], 0
mov eax, dword [esp + 0x14]
inc dword [eax]
jmp 0x100338ec
test bl, bl
je 0x100338ec
mov ecx, dword [esp + 0x18]
inc dword [ecx]
pop edi
pop esi
mov al, bl
pop ebx
ret
Function at 0x401070
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x818030]
jne 0x40107a
repz ret
jmp fcn.00401ac1

Function at 0x409195
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404bf5
and dword [ebp - 4], 0
cmp dword [0x81a794], 0
mov ebx, eax
jne 0x409246
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4092f7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4092f7
push eax
call fcn.00404b83
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x81a794], eax
call esi
push eax
call fcn.00404b83
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x81a798], eax
call esi
push eax
call fcn.00404b83
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x81a79c], eax
call esi
push eax
call fcn.00404b83
pop ecx
mov dword [0x81a7a4], eax
test eax, eax
je 0x409246
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404b83
pop ecx
mov dword [0x81a7a0], eax
mov eax, dword [0x81a7a0]
cmp eax, ebx
je 0x40929e
cmp dword [0x81a7a4], ebx
je 0x40929e
push eax
call fcn.00404bfe
push dword [0x81a7a4]
mov esi, eax
call fcn.00404bfe
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40929e
test edi, edi
je 0x40929e
call esi
test eax, eax
je 0x409295
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x409295
test byte [ebp - 0xc], 1
jne 0x40929e
or dword [ebp + 0x10], 0x200000
jmp 0x4092d7
mov eax, dword [0x81a798]
cmp eax, ebx
je 0x4092d7
push eax
call fcn.00404bfe
pop ecx
test eax, eax
je 0x4092d7
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4092d7
mov eax, dword [0x81a79c]
cmp eax, ebx
je 0x4092d7
push eax
call fcn.00404bfe
pop ecx
test eax, eax
je 0x4092d7
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x81a794]
call fcn.00404bfe
pop ecx
test eax, eax
je 0x4092f7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4092f9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40b010
Capabilities:
Set console window title

Disassembly:
mov eax, dword [0x2ff801c]
sub esp, 0x1c
push ebx
mov ebx, dword [0x2ff7e68]
push esi
mov esi, dword [0x818f60]
push edi
mov edi, eax
cmp eax, 0x930
jne 0x40b040
push str.toxoporeh
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
mov eax, dword [0x2ff801c]
mov dword [0x81a8f4], esi
cmp eax, 0x114e
jne 0x40b06e
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapCreate]
lea eax, [esp + 0xc]
push eax
push str.liyezejozonoduhu
call dword [sym.imp.KERNEL32.dll_BuildCommDCBA]
mov eax, dword [0x2ff801c]
cmp eax, 0x2f
jne 0x40b08b
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
call fcn.0040af50
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
Function at 0x407c70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x407c7f
pop dword [ebp - 0x28]
mov eax, 0x407c7f
sub dword [ebp - 0x28], eax
push 0x40
push 0x1000
push 0x3b0d2
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x28]
call dword [eax]
mov ecx, 0x6cd8d5f
sub ecx, 0x6cd5058
mov esi, eax
mov edx, 0x6f947f8c
add edx, 0x90aed474
add edx, dword [ebp - 0x28]
mov edi, 0x3e6c9f8c
xor dword [ebp - 0xc], 0xc91dcd9d
mov ebx, dword [edx]
sub dword [ebp - 0x20], 0xdb6d2c2d
xor ebx, edi
sub dword [ebp - 0x1c], esi
mov dword [esi], ebx
sub dword [ebp - 0x1c], 0xd3f51f74
add esi, 4
add edx, 0xd55f4bf4
add edx, 0x2aa0b410
loop 0x407cce
add eax, 0x190b6ed5
sub eax, 0x190a87e6
mov ebx, eax
add eax, 0xbf3cdfc0
sub eax, 0xbf3cdfbb
mov ecx, 0x400000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x2763120
Capabilities:
Encode data using xor

Disassembly:
push esi
call fcn.02763158
mov edx, dword [esp + 0x10]
mov esi, dword [esp + 0xc]
not edx
test esi, esi
je 0x2763152
push edi
mov edi, dword [esp + 0xc]
movzx eax, byte [edi]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x2a058c0]
inc edi
sub esi, 1
jne 0x2763139
pop edi
not edx
mov eax, edx
pop esi
ret

Function at 0x2763158
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp byte [0x2a02440], 0
jne 0x276319b
push esi
xor edx, edx
push edi
push 8
mov esi, edx
pop edi
mov ecx, esi
mov eax, esi
shr ecx, 1
mov esi, ecx
xor esi, 0xedb88320
and al, 1
cmove esi, ecx
sub edi, 1
jne 0x276316a
mov dword [edx*4 + 0x2a058c0], esi
inc edx
cmp edx, 0x100
jb 0x2763165
pop edi
mov byte [0x2a02440], 1
pop esi
ret

Function at 0x276319c
Capabilities:
Encode data using xor

Disassembly:
cmp byte [0x2a02c48], 0
push ebx
push esi
push edi
jne 0x27631f1
xor edx, edx
push 8
mov eax, edx
xor ecx, ecx
pop esi
mov edi, eax
and eax, 1
shrd edi, ecx, 1
shr ecx, 1
or eax, 0
mov eax, edi
je 0x27631ce
xor eax, 0xd7870f42
xor ecx, 0xc96c5795
sub esi, 1
jne 0x27631b1
mov dword [edx*8 + 0x2a02448], eax
mov dword [edx*8 + 0x2a0244c], ecx
inc edx
cmp edx, 0x100
jb 0x27631aa
mov byte [0x2a02c48], 1
mov ebx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
not ebx
mov esi, dword [esp + 0x14]
not edx
test esi, esi
je 0x276322c
mov edi, dword [esp + 0x10]
movzx eax, byte [edi]
movzx ecx, bl
shrd ebx, edx, 8
xor ecx, eax
shr edx, 8
xor ebx, dword [ecx*8 + 0x2a02448]
xor edx, dword [ecx*8 + 0x2a0244c]
inc edi
sub esi, 1
jne 0x2763209
pop edi
not ebx
not edx
pop esi
mov eax, ebx
pop ebx
ret
Function at 0x2789a4c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x34
mov eax, dword [0x2a00294]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push ebp
mov ebp, dword [esp + 0x40]
xor eax, eax
mov dword [esp + 8], eax
mov ebx, ecx
mov dword [esp + 0xc], eax
lea ecx, [esp + 8]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 4]
sub eax, dword [ebp]
push esi
push edi
sar eax, 5
push eax
mov dword [esp + 0x20], ebx
call fcn.0278b16a
mov esi, dword [ebx + 0x128]
lea eax, [esi + 4]
neg esi
sbb esi, esi
and esi, eax
mov ecx, dword [ebx + 0x128]
lea eax, [ecx + 4]
neg ecx
sbb ecx, ecx
and ecx, eax
mov eax, dword [ebx + 0x120]
lea eax, [ecx + eax*4]
cmp esi, eax
je 0x2789bba
mov eax, dword [esi]
cmp dword [eax + 0x44], 5
jne 0x2789b81
mov edi, dword [ebp]
cmp edi, dword [ebp + 4]
je 0x2789b81
mov eax, dword [esi]
mov ecx, dword [edi + 0x10]
push dword [eax + 0x20]
call fcn.0270605c
test al, al
je 0x2789b71
lea eax, [esp + 0x10]
mov ecx, 0xac
push eax
mov eax, dword [esp + 0x18]
sub eax, dword [esp + 0x14]
cdq
idiv ecx
lea ecx, [esp + 0x14]
inc eax
push eax
call fcn.027885b0
push dword [edi + 0x18]
xor ebx, ebx
lea ecx, [esp + 0x2c]
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
call fcn.02705f91
cmp dword [esp + 0x38], 0x10
jb 0x2789b89
jbe 0x2789b30
push ebx
push 0x10
lea ecx, [esp + 0x30]
call fcn.02765660
mov ebx, dword [esp + 0x14]
push dword [edi + 0x14]
lea ecx, [ebx - 0xac]
call fcn.0270552f
push dword [edi + 0x1c]
lea ecx, [ebx - 0x94]
call fcn.0270552f
push dword [edi + 0x10]
lea ecx, [ebx - 0x1c]
call fcn.0270552f
lea eax, [esp + 0x28]
push eax
lea ecx, [ebx - 0x7c]
call fcn.0270552f
lea ecx, [esp + 0x28]
call fcn.027010f8
add edi, 0x20
cmp edi, dword [ebp + 4]
jne 0x2789ad0
mov ebx, dword [esp + 0x1c]
add esi, 4
jmp 0x2789a98
push dword [esp + 0x38]
push 0x2880ec8
push ebx
push 0x461
push 0x2880eec
push 0x287fdd8
call fcn.0275d935
add esp, 0x18
lea ecx, [esp + 0x28]
call fcn.027010f8
mov edi, 0x127
jmp 0x2789c09
mov ecx, dword [ebx + 4]
lea edx, [esp + 0x10]
push edx
mov eax, dword [ecx]
call dword [eax + 0x54]
mov edi, eax
cmp edi, 2
jne 0x2789c09
mov esi, dword [ebp]
cmp esi, dword [ebp + 4]
je 0x2789c00
lea eax, [ebx + 0x78]
mov dword [esp + 0x20], eax
mov ebx, eax
push dword [esp + 0x20]
lea eax, [esp + 0x24]
mov ecx, ebx
push dword [esi + 0x14]
push 0
push eax
call fcn.02766136
add esi, 0x20
cmp esi, dword [ebp + 4]
jne 0x2789bdf
mov ebx, dword [esp + 0x1c]
mov ecx, dword [ebx + 8]
push ebp
mov edx, dword [ecx]
call dword [edx + 0x18]
lea ecx, [esp + 0x10]
call fcn.0278afe2
mov ecx, dword [esp + 0x40]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.027f10fe
add esp, 0x34
ret 4
Function at 0x27afaed
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 8]
xor edx, edx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov ecx, dword [ebx + 4]
push edi
mov esi, dword [ebp + 4]
cmp esi, ecx
jle 0x27afb1b
mov eax, dword [ebp]
mov edi, esi
sub edi, ecx
lea eax, [eax + ecx*4]
or edx, dword [eax]
lea eax, [eax + 4]
sub edi, 1
jne 0x27afb0f
cmp esi, ecx
jge 0x27afb30
mov eax, dword [ebx]
mov edi, ecx
sub edi, esi
lea eax, [eax + esi*4]
or edx, dword [eax]
lea eax, [eax + 4]
sub edi, 1
jne 0x27afb26
cmp ecx, esi
cmovge ecx, esi
test ecx, ecx
jle 0x27afb4f
mov edi, dword [ebp]
mov esi, dword [ebx]
sub edi, esi
mov eax, dword [edi + esi]
xor eax, dword [esi]
lea esi, [esi + 4]
or edx, eax
sub ecx, 1
jne 0x27afb40
mov eax, dword [ebx + 0xc]
xor eax, dword [ebp + 0xc]
or eax, edx
pop edi
neg eax
pop esi
sbb eax, eax
pop ebp
inc eax
pop ebx
ret
Function at 0x27b1fee
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
cmp dword [esp + 0x24], 0
push ebx
push ebp
push esi
mov esi, dword [esp + 0x34]
push edi
mov dword [esp + 0x10], esi
je 0x27b2008
test esi, esi
jne 0x27b201c
push 0x3f
push 0x288f7c8
push 0x288f8b0
call fcn.02810043
add esp, 0xc
mov ebx, dword [esp + 0x30]
mov edi, dword [esp + 0x2c]
mov ebp, dword [esp + 0x28]
test ebx, ebx
je 0x27b2048
test ebp, ebp
je 0x27b2034
test edi, edi
jne 0x27b2048
push 0x40
push 0x288f7c8
push 0x288f8e8
call fcn.02810043
add esp, 0xc
cmp ebx, 0x10
jb 0x27b20eb
mov eax, ebx
shr eax, 4
mov dword [esp + 0x14], eax
mov ebx, dword [esp + 0x10]
sub ebx, ebp
mov dword [esp + 0x1c], ebp
sub edi, ebp
mov dword [esp + 0x10], 4
mov dword [esp + 0x18], edi
mov ebp, edi
mov edi, dword [esp + 0x1c]
lea eax, [ebx + edi]
push eax
call fcn.027c716f
push edi
mov esi, eax
call fcn.027c716f
xor esi, eax
lea eax, [esp + 0x28]
push 4
push eax
lea eax, [edi + ebp]
mov dword [esp + 0x30], esi
push eax
call fcn.02808da0
add esp, 0x14
add edi, 4
sub dword [esp + 0x10], 1
jne 0x27b2078
push dword [esp + 0x34]
mov edi, dword [esp + 0x30]
push edi
push edi
call dword [esp + 0x48]
mov ebx, dword [esp + 0x3c]
mov esi, edi
mov ebp, dword [esp + 0x34]
sub ebx, 0x10
add ebp, 0x10
mov dword [esp + 0x1c], esi
add edi, 0x10
mov dword [esp + 0x3c], ebx
add esp, 0xc
mov dword [esp + 0x28], ebp
sub dword [esp + 0x14], 1
mov dword [esp + 0x2c], edi
jne 0x27b205a
test ebx, ebx
je 0x27b2167
sub esi, ebp
mov eax, edi
xor ecx, ecx
mov dword [esp + 0x30], esi
sub eax, ebp
mov edx, ebp
mov ebp, esi
mov dword [esp + 0x20], eax
mov esi, eax
cmp ecx, ebx
jae 0x27b2118
mov al, byte [edx + ebp]
xor al, byte [edx]
inc ecx
mov byte [esi + edx], al
inc edx
cmp ecx, 0x10
jb 0x27b2105
mov ebp, dword [esp + 0x28]
mov esi, dword [esp + 0x10]
cmp ecx, 0x10
jae 0x27b2140
push 0x10
pop eax
sub esi, edi
lea edx, [ecx + edi]
sub eax, ecx
mov dword [esp + 0x30], eax
mov ecx, eax
mov al, byte [esi + edx]
mov byte [edx], al
inc edx
sub ecx, 1
jne 0x27b2135
push dword [esp + 0x34]
push edi
push edi
call dword [esp + 0x48]
add esp, 0xc
mov esi, edi
mov dword [esp + 0x10], esi
cmp ebx, 0x10
jbe 0x27b2167
add ebp, 0x10
add edi, 0x10
mov dword [esp + 0x28], ebp
sub ebx, 0x10
jne 0x27b20ef
push 0x10
push esi
push dword [esp + 0x40]
call fcn.02808da0
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x27b2460
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x2a00294]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0x14], 0x30
mov eax, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
jbe 0x27b2484
xor eax, eax
jmp 0x27b2513
push 0x30
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.02808da0
xor edx, edx
add esp, 0xc
cmp dword [ebp + 0x14], edx
jbe 0x27b24b4
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 0x34]
sub ebx, eax
lea ecx, [ebp - 0x34]
add ecx, edx
mov al, byte [ebx + ecx]
xor byte [ecx], al
inc edx
cmp edx, dword [ebp + 0x14]
jb 0x27b24a3
pop ebx
xor eax, eax
movups xmm0, xmmword [ebp + eax - 0x34]
movups xmm1, xmmword [eax + 0x288c040]
pxor xmm1, xmm0
movups xmmword [ebp + eax - 0x34], xmm1
add eax, 0x10
cmp eax, 0x30
jb 0x27b24b6
push 0x20
lea eax, [ebp - 0x34]
push eax
lea eax, [edi + 0xf4]
push eax
push 0
push edi
call fcn.027b91fe
mov dword [edi + 0xf8], eax
lea eax, [ebp - 0x14]
push 0x10
push eax
lea eax, [edi + 0xfc]
push eax
call fcn.02808da0
xor eax, eax
add esp, 0x20
inc eax
and dword [edi + 0x114], 0
mov dword [edi + 0x110], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.027f10fe
leave
ret

Function at 0x27b2520
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x2a00294]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 8]
test esi, esi
je 0x27b2575
cmp esi, 0x30
ja 0x27b2585
push 0x30
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.02808da0
add esp, 0xc
xor edx, edx
test esi, esi
je 0x27b2572
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 0x34]
sub ebx, eax
lea ecx, [ebp - 0x34]
add ecx, edx
mov al, byte [ebx + ecx]
xor byte [ecx], al
inc edx
cmp edx, esi
jb 0x27b2562
pop ebx
lea eax, [ebp - 0x34]
push 0x30
push eax
push edi
call fcn.027bf262
add esp, 0xc
test eax, eax
jne 0x27b2589
xor eax, eax
jmp 0x27b2599
xor eax, eax
inc eax
and dword [edi + 0x114], 0
mov dword [edi + 0x110], eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.027f10fe
leave
ret
Function at 0x27b6793
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x1a8
mov eax, dword [0x2a00294]
xor eax, esp
mov dword [esp + 0x1a4], eax
mov eax, dword [esp + 0x1ac]
push edi
mov edi, dword [esp + 0x1b4]
mov dword [esp + 4], eax
test edi, edi
je 0x27b6922
push ebp
call fcn.027d17a3
xor ebp, ebp
test eax, eax
push 0x20
lea eax, [esp + 0x130]
jne 0x27b67e1
push eax
call fcn.027d1770
pop ecx
pop ecx
jmp 0x27b67eb
push ebp
push eax
call fcn.02809ce0
add esp, 0xc
mov edx, dword [esp + 0x1bc]
lea eax, [esp + 0x12c]
mov ecx, ebp
sub edx, eax
lea eax, [esp + 0x12c]
add eax, ecx
add ecx, 0x10
movups xmm0, xmmword [eax]
movups xmm1, xmmword [edx + eax]
pxor xmm1, xmm0
movups xmmword [eax], xmm1
cmp ecx, 0x20
jb 0x27b67fd
push ebx
xor ebx, ebx
push esi
inc ebx
push ebx
call fcn.027d14a2
mov esi, eax
pop ecx
test esi, esi
jne 0x27b688c
push pe_nt_image_headers32
call fcn.027d131b
mov esi, eax
pop ecx
test esi, esi
je 0x27b6852
push 0x27c828b
push esi
push ebx
call fcn.027d14f1
add esp, 0xc
test eax, eax
jne 0x27b6856
lea esi, [esp + 0x14]
lea eax, [esp + 0x154]
mov dword [esi + 0x11c], ebp
push 0x30
push eax
call fcn.027d1770
push ebp
push ebp
lea eax, [esp + 0x164]
push eax
push esi
call fcn.027b2460
add esp, 0x18
test eax, eax
je 0x27b6938
mov dword [esi + 0x118], ebp
cmp dword [esi + 0x118], 0x1000
jb 0x27b68c4
lea eax, [esp + 0x184]
push 0x30
push eax
call fcn.027d1770
push ebp
push ebp
lea eax, [esp + 0x194]
push eax
push esi
call fcn.027b2520
add esp, 0x18
test eax, eax
je 0x27b6938
mov dword [esi + 0x118], ebp
test edi, edi
je 0x27b690a
mov eax, 0x10000
cmp edi, eax
mov ebp, edi
cmova ebp, eax
shl ebx, 5
push ebx
mov ebx, dword [esp + 0x14]
lea eax, [esp + 0x138]
push eax
push ebp
push ebx
push esi
call fcn.027b22b9
add esp, 0x14
test eax, eax
je 0x27b6938
add ebx, ebp
mov eax, 0x10000
inc dword [esi + 0x118]
mov dword [esp + 0x10], ebx
xor ebx, ebx
sub edi, ebp
jne 0x27b68cd
lea eax, [esp + 0x14]
cmp esi, eax
jne 0x27b691f
push 0x118
push esi
call fcn.027d12e2
pop ecx
pop ecx
pop esi
pop ebx
pop ebp
mov ecx, dword [esp + 0x1a8]
pop edi
xor ecx, esp
call fcn.027f10fe
add esp, 0x1a8
ret
call fcn.028144e3
int3

Function at 0x27b8f32
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0xd0], ecx
mov dword [eax + 0xd4], 0x40
xor eax, eax
inc eax
ret
Function at 0x27ba582
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x18]
push ebp
mov ebp, dword [esp + 0x24]
mov eax, ebp
push edi
xor edi, edi
cmp ebx, ebp
mov edx, edi
cmovb eax, ebx
mov dword [esp + 0x10], edx
test eax, eax
je 0x27ba61a
mov edi, dword [esp + 0x1c]
mov ebx, eax
push esi
mov esi, dword [esp + 0x28]
sub edi, esi
mov dword [esp + 0x10], esi
mov edx, dword [edi + esi]
mov ecx, edx
xor ecx, dword [esi]
mov ebp, dword [esp + 0x10]
mov eax, ecx
not eax
shr eax, 0x1f
lea esi, [ecx - 1]
shr esi, 0x1f
and esi, eax
mov eax, edx
sub eax, dword [ebp]
neg esi
mov ebp, dword [esp + 0x14]
xor eax, edx
or eax, ecx
and ebp, esi
xor eax, edx
shr eax, 0x1f
neg eax
mov ecx, eax
not ecx
and ecx, 1
or ecx, eax
mov eax, esi
mov esi, dword [esp + 0x10]
not eax
and ecx, eax
add esi, 4
or ebp, ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], ebp
sub ebx, 1
jne 0x27ba5b4
mov ebx, dword [esp + 0x24]
xor edi, edi
mov ebp, dword [esp + 0x2c]
mov edx, dword [esp + 0x14]
pop esi
cmp ebx, ebp
jae 0x27ba63f
mov eax, dword [esp + 0x24]
or edi, dword [eax + ebx*4]
inc ebx
cmp ebx, ebp
jb 0x27ba622
lea ecx, [edi - 1]
not edi
shr ecx, 0x1f
shr edi, 0x1f
and ecx, edi
neg ecx
and edx, ecx
not ecx
jmp 0x27ba663
jbe 0x27ba665
mov eax, dword [esp + 0x1c]
or edi, dword [eax + ebp*4]
inc ebp
cmp ebp, ebx
jb 0x27ba645
lea ecx, [edi - 1]
not edi
shr ecx, 0x1f
shr edi, 0x1f
and ecx, edi
neg ecx
and edx, ecx
not ecx
and ecx, 1
or edx, ecx
pop edi
pop ebp
mov eax, edx
pop ebx
add esp, 0xc
ret

Function at 0x27bc076
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
cmp bx, 1
ja 0x27bc085
xor eax, eax
pop ebx
ret
push ebp
push esi
movzx eax, bx
dec eax
push edi
push eax
call fcn.027b12de
mov ebp, eax
pop ecx
cmp ebp, 0x10
jbe 0x27bc0ae
push 0x48
push 0x288c928
push 0x288ca20
call fcn.02810043
add esp, 0xc
xor edi, edi
movzx eax, bx
xor esi, esi
cdq
lea ecx, [ebp + 0x20]
bts edi, ecx
cmp ecx, 0x20
push edx
cmovae esi, edi
xor edi, esi
cmp ecx, 0x40
push eax
cmovae esi, edi
add edi, eax
adc esi, edx
add edi, 0xffffffff
adc esi, 0xffffffff
push esi
push edi
call fcn.027f1d10
mov edx, eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x18], edx
mov edi, dword [eax + 4]
sub edi, 1
js 0x27bc138
xor ecx, ecx
mov eax, dword [eax]
push edx
movzx ecx, cx
push ebp
mov esi, dword [eax + edi*4]
mov eax, esi
shl ecx, 0x10
shr eax, 0x10
or ecx, eax
push ebx
push ecx
call fcn.027c8884
push dword [esp + 0x28]
movzx ecx, ax
shl ecx, 0x10
movzx eax, si
push ebp
or ecx, eax
push ebx
push ecx
call fcn.027c8884
mov edx, dword [esp + 0x38]
add esp, 0x20
sub edi, 1
movzx ecx, ax
mov eax, dword [esp + 0x14]
jns 0x27bc0f1
jmp 0x27bc13a
xor ecx, ecx
pop edi
pop esi
pop ebp
mov ax, cx
pop ebx
ret