joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1008f610
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
mov esi, dword [esp + 0x34]
push edi
push esi
mov edi, ecx
call fcn.100889a0
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
mov byte [esp + 0x3c], al
lea eax, [esp + 0x14]
push eax
push 4
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0
push eax
push esi
call ebx
mov eax, dword [esp + 0x14]
test eax, eax
jg 0x1008f672
push 0x112
push str.C:UsersByrockDesktopACS_GSRVR1_ACSHSACSGuardN3BASEN3UIList.cpp
push str.No_font_name
push str.ERROR____s_n_s:__d_n_n
call fcn.10082e50
mov eax, dword [esp + 0x24]
add esp, 0x10
test eax, eax
jle 0x1008f6ec
push 0x20
push eax
lea ecx, [edi + 0x134]
call fcn.100857f0
cmp dword [edi + 0x14c], 0x10
lea eax, [edi + 0x138]
jb 0x1008f691
mov eax, dword [eax]
push 0
lea ecx, [esp + 0x14]
push ecx
push dword [esp + 0x1c]
push eax
push esi
call ebx
push 0
lea eax, [esp + 0x14]
push eax
push 4
lea eax, [edi + 0x150]
push eax
push esi
call ebx
push 0
lea eax, [esp + 0x14]
push eax
push 4
lea eax, [edi + 0x15c]
push eax
push esi
call ebx
push 0
lea eax, [esp + 0x14]
push eax
push 4
lea eax, [edi + 0x154]
push eax
push esi
call ebx
push 0
lea eax, [esp + 0x14]
push eax
push 4
lea eax, [edi + 0x158]
push eax
push esi
call ebx
mov eax, dword [edi + 0xdc]
lea ebp, [edi + 0xd8]
push ebp
lea ecx, [esp + 0x20]
mov eax, dword [eax]
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], eax
call fcn.1004a780
mov eax, dword [ebp + 4]
lea ecx, [esp + 0x28]
push ebp
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], eax
call fcn.1004a780
mov esi, dword [esp + 0x1c]
test esi, esi
je 0x1008f745
mov esi, dword [esi]
jmp 0x1008f747
xor esi, esi
lea ecx, [esp + 0x28]
call fcn.1004a7e0
cmp eax, esi
je 0x1008f798
push str.list_iterators_incompatible
push 0x101b8af8
push 0
push 0xc3
push 0x101bce28
push 2
call fcn.10127830
add esp, 0x18
cmp eax, 1
jne 0x1008f77a
int3
push 0
push 0xc3
push str.C:Program_Files__x86_Microsoft_Visual_Studio2019CommunityVCToolsMSVC14.29.30133includelist
push 0x101b8c38
push str._list_iterators_incompatible_
call fcn.10136180
add esp, 0x14
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0x18]
cmp eax, dword [esp + 0x24]
push 3
sete bl
call fcn.1011cee0
lea ecx, [esp + 0x28]
call fcn.1004a7f0
lea ecx, [esp + 0x18]
call fcn.1011cf90
test bl, bl
jne 0x1008f7ec
lea ecx, [esp + 0x1c]
call fcn.10081b60
mov eax, dword [eax]
cmp dword [eax + 0xe4], 5
jne 0x1008f7de
mov dword [edi + 0x130], eax
lea ecx, [esp + 0x1c]
call fcn.10081aa0
jmp 0x1008f718
push 3
lea ecx, [esp + 0x1c]
call fcn.1011cee0
lea ecx, [esp + 0x1c]
call fcn.1004a7f0
lea ecx, [esp + 0x18]
call fcn.1011cf90
mov al, byte [esp + 0x38]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 4
Function at 0x10091190
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
push edi
mov ecx, dword [esi + 0x120]
mov dword [esi], vtable.CN3UIString.0
test ecx, ecx
je 0x100911ab
mov eax, dword [ecx]
push 1
call dword [eax + 4]
lea edi, [esi + 0x1a8]
mov dword [esi + 0x120], 0
mov ecx, edi
call fcn.100448c0
mov eax, dword [edi + 0x18]
cmp eax, 0x10
jb 0x100911d7
inc eax
push eax
push dword [edi + 4]
call fcn.10049010
add esp, 8
mov eax, dword [edi]
push 8
push eax
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0xf
mov byte [edi + 4], 0
mov dword [edi], 0
call fcn.10049010
add esp, 8
lea ecx, [esi + 0x19c]
call fcn.1007c420
lea edi, [esi + 0x188]
mov ecx, edi
call fcn.100448c0
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x10091242
mov eax, dword [edi + 0xc]
sub eax, ecx
and eax, 0xfffffffc
push eax
push ecx
call fcn.10049010
mov dword [edi + 4], 0
add esp, 8
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov eax, dword [edi]
push 8
push eax
mov dword [edi], 0
call fcn.10049010
add esp, 8
lea edi, [esi + 0x164]
mov ecx, edi
call fcn.100448c0
mov eax, dword [edi + 0x18]
cmp eax, 0x10
jb 0x10091277
inc eax
push eax
push dword [edi + 4]
call fcn.10049010
add esp, 8
mov eax, dword [edi]
push 8
push eax
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0xf
mov byte [edi + 4], 0
mov dword [edi], 0
call fcn.10049010
add esp, 8
lea edi, [esi + 0x148]
mov ecx, edi
call fcn.100448c0
mov eax, dword [edi + 0x18]
cmp eax, 0x10
jb 0x100912be
inc eax
push eax
push dword [edi + 4]
call fcn.10049010
add esp, 8
mov eax, dword [edi]
push 8
push eax
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0xf
mov byte [edi + 4], 0
mov dword [edi], 0
call fcn.10049010
add esp, 8
lea edi, [esi + 0x12c]
mov ecx, edi
call fcn.100448c0
mov eax, dword [edi + 0x18]
cmp eax, 0x10
jb 0x10091305
inc eax
push eax
push dword [edi + 4]
call fcn.10049010
add esp, 8
mov eax, dword [edi]
push 8
push eax
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0xf
mov byte [edi + 4], 0
mov dword [edi], 0
call fcn.10049010
add esp, 8
mov ecx, esi
pop edi
pop esi
jmp fcn.100882c0
Function at 0x10093160
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017e375
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x101dadb0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
push esi
call fcn.100889a0
test al, al
je 0x1009335b
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp - 0x34]
push 0
push eax
push 4
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0
push eax
push esi
call edi
mov eax, dword [ebp - 0x30]
test eax, eax
jle 0x10093287
push 0x3f
push eax
lea ecx, [ebp - 0x2c]
call fcn.10085750
push 0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x34]
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push ecx
push dword [ebp - 0x30]
cmovae eax, dword [ebp - 0x28]
push eax
push esi
call edi
push 0
lea eax, [ebp - 0x34]
mov dword [ebp - 0x38], 0
push eax
push 4
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], 0
push eax
push esi
call edi
push 0
lea eax, [ebp - 0x34]
push eax
push 4
lea eax, [ebp - 0x38]
push eax
push esi
call edi
mov ecx, dword [ebp - 0x38]
mov eax, ecx
mov edx, dword [ebx]
and eax, 2
push eax
and ecx, 1
lea eax, [ebp - 0x2c]
push ecx
push dword [ebp - 0x3c]
mov ecx, ebx
push eax
call dword [edx + 0x78]
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.100448c0
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x1009325a
inc eax
push eax
push dword [ebp - 0x28]
call fcn.10049010
add esp, 8
mov eax, dword [ebp - 0x2c]
push 8
push eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
mov dword [ebp - 0x2c], 0
call fcn.10049010
add esp, 8
cmp dword [ebp - 0x30], 0
jg 0x100932a3
push 0x16c
push str.C:UsersByrockDesktopACS_GSRVR1_ACSHSACSGuardN3BASEN3UIString.cpp
push str.No_font_name
push str.ERROR____s_n_s:__d_n_n
call fcn.10082e50
add esp, 0x10
push 0
lea eax, [ebp - 0x34]
push eax
push 4
lea eax, [ebx + 0x180]
push eax
push esi
call edi
push 0
lea eax, [ebp - 0x34]
push eax
push 4
lea eax, [ebp - 0x30]
push eax
push esi
call edi
mov eax, dword [ebp - 0x30]
test eax, eax
jle 0x10093344
push 0x3f
push eax
lea ecx, [ebp - 0x2c]
call fcn.10085750
push 0
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x34]
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push ecx
push dword [ebp - 0x30]
cmovae eax, dword [ebp - 0x28]
push eax
push esi
call edi
mov eax, dword [ebx]
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, ebx
call dword [eax + 0x70]
lea ecx, [ebp - 0x2c]
call fcn.100448c0
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x1009331d
inc eax
push eax
push dword [ebp - 0x28]
call fcn.10049010
add esp, 8
mov eax, dword [ebp - 0x2c]
push 8
push eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
mov dword [ebp - 0x2c], 0
call fcn.10049010
add esp, 8
cmp dword [ebx + 0x40], 2
jb 0x10093359
push 0
lea eax, [ebp - 0x34]
push eax
push 4
lea eax, [ebp - 0x40]
push eax
push esi
call edi
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101204c0
mov esp, ebp
pop ebp
ret 4
Function at 0x10094840
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
cmp byte [0x102b2ce7], 0
jne 0x10094890
call fcn.1013f9b0
mov dword [0x10223634], eax
mov ecx, 1
mov edx, eax
shr edx, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
add eax, ecx
mov dword [ecx*4 + 0x10223634], eax
inc ecx
cmp ecx, 0x270
jb 0x10094858
mov dword [0x10223630], 0x270
mov byte [0x102b2ce7], 1
nop dword [eax + eax]
mov ecx, 0x10223630
call fcn.100e1cb0
mov ecx, eax
mov eax, 0x575a2ad3
mul ecx
shr edx, 0xa
cmp edx, 0x15d68a
jae 0x10094890
mov eax, ecx
xor edx, edx
mov ecx, 0xbb9
div ecx
add edx, 0x800001f4
cmp edx, 0x80000000
lea ecx, [edx - 0x80000000]
lea eax, [edx - 0x80000000]
cmovae eax, ecx
ret
Function at 0x100a4be0
Capabilities:
Terminate process

Disassembly:
sub esp, 0x440
mov eax, dword [0x101dadb0]
xor eax, esp
mov dword [esp + 0x438], eax
push esi
mov esi, dword [esp + 0x448]
lea eax, [esp + 8]
push eax
call fcn.1013ddf0
add esp, 4
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.101406d0
push 0x101be390
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push str.BYRACS_Log.txt
push eax
call fcn.101419b0
add esp, 0x14
cmp dword [esp + 4], 0
je 0x100a4cb1
push 0x400
lea eax, [esp + 0x3c]
push 0
push eax
call fcn.101234b0
mov eax, dword [esp + 0x30]
add esp, 0xc
inc eax
push esi
push dword [esp + 0x18]
push dword [esp + 0x20]
push dword [esp + 0x28]
push dword [esp + 0x30]
push eax
mov eax, dword [esp + 0x40]
add eax, 0x76c
push eax
lea eax, [esp + 0x54]
push str.____04d__02d__02d__02d:_02d:_02d__BYRACS_info___s__n
push eax
call fcn.100df190
add esp, 0x24
lea eax, [esp + 0x38]
push eax
push 0x101b8af8
push dword [esp + 0xc]
call fcn.10094640
add esp, 0xc
push dword [esp + 4]
call fcn.10136cc0
add esp, 4
cmp byte [esp + 0x44c], 0
jne 0x100a4ccb
mov ecx, dword [esp + 0x43c]
xor eax, eax
pop esi
xor ecx, esp
call fcn.101204c0
add esp, 0x440
ret 8
push 0
call fcn.101400a0
int3

Function at 0x100a4ce0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
test edi, edi
je 0x100a4d7e
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x100a4d7e
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x100a4d7e
cmp dword [eax + edi], 0x4550
jne 0x100a4d7e
mov ecx, 0x14c
cmp word [eax + edi + 4], cx
jne 0x100a4d7e
mov eax, dword [eax + edi + 0x78]
xor esi, esi
add eax, edi
mov ecx, dword [eax + 0x1c]
mov ebp, dword [eax + 0x20]
add ecx, edi
mov ebx, dword [eax + 0x18]
add ebp, edi
mov dword [esp + 0x10], ecx
mov ecx, dword [eax + 0x24]
add ecx, edi
mov dword [esp + 0x18], ecx
test ebx, ebx
je 0x100a4d7e
mov eax, dword [ebp + esi*4]
mov ecx, dword [esp + 0x1c]
add eax, edi
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100a4d70
test dl, dl
je 0x100a4d6c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100a4d70
add eax, 2
add ecx, 2
test dl, dl
jne 0x100a4d50
xor eax, eax
jmp 0x100a4d75
sbb eax, eax
or eax, 1
test eax, eax
je 0x100a4d88
inc esi
cmp esi, ebx
jb 0x100a4d45
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 8
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
movzx eax, word [eax + esi*2]
mov eax, dword [ecx + eax*4]
add eax, edi
je 0x100a4d7e
push 0
push 0x102
push 0x1a
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
pop ecx
ret 8
Function at 0x100af660
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x1c
mov eax, dword [0x101dadb0]
xor eax, esp
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x24]
push esi
push edi
mov edi, dword [0x1027c0b4]
push eax
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x100af6d8
movaps xmm0, xmmword [str.:yR__N]
sub esp, 0x1c
mov esi, esp
mov word [esp + 0x38], 0x5e1f
movups xmmword [esp + 0x28], xmm0
mov byte [esp + 0x3a], 0
xor ecx, ecx
mov al, byte [esp + 0x28]
xor byte [esp + ecx + 0x29], al
inc ecx
cmp ecx, 0x11
jb 0x100af6a6
sub esp, 0x1c
mov byte [esp + 0x56], 0
lea eax, [esp + 0x45]
mov ecx, esp
push eax
call fcn.10047780
push esi
call fcn.1004a910
add esp, 0x20
mov ecx, edi
call fcn.100ba7e0
mov ecx, dword [esp + 0x20]
mov al, 1
pop edi
pop esi
xor ecx, esp
call fcn.101204c0
add esp, 0x1c
ret 8
Function at 0x100d44a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101807d5
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x101dadb0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0x28]
mov eax, dword [ebp + 8]
mov ecx, 0x102adb84
mov dword [ebp - 4], 0
cmp dword [ebp + 0x24], 0x10
push dword [ebp + 0x20]
mov dword [0x1027c054], eax
mov eax, dword [esi]
mov dword [0x1027c070], eax
lea eax, [ebp + 0x10]
cmovae eax, dword [ebp + 0x10]
push eax
call fcn.10048350
call fcn.100d4350
mov eax, dword [0x1027c070]
test eax, eax
jne 0x100d45d6
cmp dword [ebp + 0x24], 0x10
lea eax, [ebp + 0x10]
movaps xmm0, xmmword [0x101c30c0]
cmovae eax, dword [ebp + 0x10]
xor ecx, ecx
push eax
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x1c], 0x30397f2b
mov dword [ebp - 0x18], 0x653b312a
mov dword [ebp - 0x14], 0x2c7a7f
nop dword [eax + eax]
mov al, byte [ebp - 0x2c]
xor byte [ebp + ecx - 0x2b], al
inc ecx
cmp ecx, 0x1a
jb 0x100d4540
sub esp, 0x1c
mov byte [ebp - 0x11], 0
lea eax, [ebp - 0x2b]
mov ecx, esp
push eax
call fcn.10047780
lea eax, [ebp - 0x48]
push eax
call fcn.1004a910
add esp, 8
mov byte [ebp - 4], 1
lea eax, [ebp - 0x48]
mov ecx, esp
push eax
call fcn.10047950
push 3
push dword [0x1027c0b4]
call fcn.100d7bd0
add esp, 0x24
mov dword [esi], 0
lea ecx, [ebp - 0x48]
call fcn.100448c0
mov eax, dword [ebp - 0x30]
cmp eax, 0x10
jb 0x100d45ad
inc eax
push eax
push dword [ebp - 0x44]
call fcn.10049010
add esp, 8
mov eax, dword [ebp - 0x48]
push 8
push eax
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0xf
mov byte [ebp - 0x44], 0
mov dword [ebp - 0x48], 0
call fcn.10049010
add esp, 8
jmp 0x100d45d8
mov dword [esi], eax
lea ecx, [ebp + 0xc]
call fcn.100448c0
mov eax, dword [ebp + 0x24]
cmp eax, 0x10
jb 0x100d45f5
inc eax
push eax
push dword [ebp + 0x10]
call fcn.10049010
add esp, 8
mov eax, dword [ebp + 0xc]
push 8
push eax
mov dword [ebp + 0x20], 0
mov dword [ebp + 0x24], 0xf
mov byte [ebp + 0x10], 0
mov dword [ebp + 0xc], 0
call fcn.10049010
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101204c0
mov esp, ebp
pop ebp
ret 0x24
Function at 0x100e1cb0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
push edi
mov edi, ecx
mov eax, dword [edi]
cmp eax, 0x270
jne 0x100e1d00
lea edx, [edi + 8]
mov esi, eax
mov ecx, dword [edx - 4]
lea edx, [edx + 4]
xor ecx, dword [edx - 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub esi, 1
jne 0x100e1cc2
mov eax, dword [edi]
jmp 0x100e1de7
cmp eax, 0x4e0
jb 0x100e1de7
mov eax, dword [edi + 0x9c4]
push ebx
lea ebx, [edi + 0x9c4]
push ebp
mov ebp, 0xe3
nop
mov ecx, dword [ebx + 4]
lea edx, [ebx + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx + 0x634]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub ebp, 1
jne 0x100e1d20
mov eax, dword [edi + 0xd50]
lea ebx, [edi + 0xd50]
mov ebp, 0x18c
nop word [eax + eax]
mov ecx, eax
lea edx, [ebx + 4]
xor ecx, dword [edx]
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx - 0xd4c]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub ebp, 1
jne 0x100e1d70
mov ecx, dword [edi + 0x1380]
xor ecx, dword [edi + 4]
and ecx, 0x7fffffff
xor ecx, dword [edi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop ebp
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi + 0x9c0], eax
xor eax, eax
mov dword [edi], 0
pop ebx
mov edx, dword [edi + eax*4 + 4]
inc eax
mov dword [edi], eax
mov ecx, edx
mov eax, dword [edi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
ret
Function at 0x100e29a0
Capabilities:
Create thread
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10181613
mov eax, dword fs:[0]
push eax
sub esp, 0xc4
mov eax, dword [0x101dadb0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 0
push 0
push 0x100e2980
push 0
push 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
movaps xmm0, xmmword [str._rYeh_kdah_d_nb]
xor ecx, ecx
mov eax, dword [0x1027c0b4]
movups xmmword [ebp - 0x60], xmm0
mov dword [ebp - 0x30], 0x797e6463
movaps xmm0, xmmword [0x101c2ea0]
movups xmmword [ebp - 0x50], xmm0
mov byte [eax + 0x154], 0
movaps xmm0, xmmword [0x101c2cc0]
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x2c], 0x62796c7f
mov dword [ebp - 0x28], 0x7237f
nop dword [eax + eax]
mov al, byte [ebp - 0x60]
xor byte [ebp + ecx - 0x5f], al
inc ecx
cmp ecx, 0x3a
jb 0x100e2a30
lea eax, [ebp - 0x5f]
mov byte [ebp - 0x25], 0
push eax
lea ecx, [ebp - 0x98]
call fcn.10047780
mov byte [ebp - 4], 1
xor ecx, ecx
movaps xmm0, xmmword [0x101c3160]
movups xmmword [ebp - 0x4c], xmm0
mov dword [ebp - 0x2c], 0x226b696f
movaps xmm0, xmmword [0x101c32a0]
movups xmmword [ebp - 0x3c], xmm0
mov word [ebp - 0x28], 0x2e
nop dword [eax]
mov al, byte [ebp - 0x4c]
xor byte [ebp + ecx - 0x4b], al
inc ecx
cmp ecx, 0x24
jb 0x100e2a80
lea eax, [ebp - 0x4b]
mov byte [ebp - 0x27], 0
push eax
lea ecx, [ebp - 0x7c]
call fcn.10047780
mov byte [ebp - 4], 2
xor ecx, ecx
movaps xmm0, xmmword [0x101c2200]
movups xmmword [ebp - 0x48], xmm0
mov byte [ebp - 0x28], 0
movaps xmm0, xmmword [0x101c31b0]
movups xmmword [ebp - 0x38], xmm0
nop dword [eax]
mov al, byte [ebp - 0x48]
xor byte [ebp + ecx - 0x47], al
inc ecx
cmp ecx, 0x1f
jb 0x100e2ac0
lea eax, [ebp - 0x47]
mov byte [ebp - 0x28], 0
push eax
lea ecx, [ebp - 0xb4]
call fcn.10047780
mov edx, 0x101b8c74
mov byte [ebp - 4], 3
lea ecx, [ebp + 8]
call fcn.10065c20
test al, al
je 0x100e2b7c
lea eax, [ebp - 0x7c]
push eax
lea edx, [ebp - 0x98]
lea ecx, [ebp - 0x40]
call fcn.1007d820
add esp, 4
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 4
push ecx
mov edx, eax
lea ecx, [ebp - 0xd0]
call fcn.100df1b0
movaps xmm0, xmmword [0x101c20d0]
add esp, 4
mov edx, eax
mov word [ebp - 0x14], 1
movups xmmword [ebp - 0x24], xmm0
xor ecx, ecx
nop
mov al, byte [ebp - 0x24]
xor byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0x10
jb 0x100e2b40
push 0x30
lea eax, [ebp - 0x23]
mov byte [ebp - 0x13], 0
push eax
mov ecx, edx
call fcn.10047540
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0xd0]
call fcn.100476b0
lea ecx, [ebp - 0x40]
call fcn.100476b0
jmp 0x100e2bb8
movaps xmm0, xmmword [0x101c3090]
xor ecx, ecx
movups xmmword [ebp - 0x24], xmm0
mov word [ebp - 0x14], 0x6a
nop
mov al, byte [ebp - 0x24]
xor byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0x10
jb 0x100e2b90
push 0x30
lea eax, [ebp - 0x23]
mov byte [ebp - 0x13], 0
push eax
lea ecx, [ebp + 8]
call fcn.10047540
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call fcn.101400a0
int3
Function at 0x100e4770
Capabilities:
Create thread

Disassembly:
cmp dword [esp + 8], 1
jne 0x100e47a7
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
call sym.BYRACS.dll_Init
push 0
push 0
push 0
push 0x100e4640
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [0x1027c0b4]
mov dword [ecx + 0x170], eax
mov eax, 1
ret 0xc
Function at 0x100e4c90
Capabilities:
Encode data using xor
Encrypt data using rc4 via winapi
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x101dadb0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
jmp 0x100e4cb5
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0
push 1
push str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
push 0
push 0x1027c0a8
mov dword [0x1027c09c], eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x100e4d8c
push 0x1027c098
push 0
push 0
push 0x8004
push dword [0x1027c0a8]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x100e4d8c
movaps xmm0, xmmword [0x101c2d10]
xor ecx, ecx
movups xmmword [ebp - 0x3c], xmm0
mov dword [ebp - 0xc], 0x2e013660
movaps xmm0, xmmword [0x101c2c00]
movups xmmword [ebp - 0x2c], xmm0
mov word [ebp - 8], 0x24
movaps xmm0, xmmword [0x101c2300]
movups xmmword [ebp - 0x1c], xmm0
mov al, byte [ebp - 0x3c]
xor byte [ebp + ecx - 0x3b], al
inc ecx
cmp ecx, 0x34
jb 0x100e4d30
push 1
push 0x1d
lea eax, [ebp - 0x3b]
mov byte [ebp - 7], 0
push eax
push dword [0x1027c098]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x100e4d8c
push 0x1027c0b8
push 0x800000
push dword [0x1027c098]
push 0x6801
push dword [0x1027c0a8]
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
jne 0x100e4d8c
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x100e4b60
push 0x468e60
call fcn.100020f0
push 0x100e4c70
push 0x468eb6
mov dword [0x1027c0a0], eax
call fcn.100020f0
jmp 0x100e4dc1
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.101204c0
mov esp, ebp
pop ebp
ret