joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1008c940
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
push esi
mov esi, dword [ebp + 8]
push edi
push esi
mov edi, ecx
call fcn.10090a60
test al, al
jne 0x1008c962
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0
lea eax, [esp + 0x18]
mov dword [esp + 0x14], 0
push eax
push 4
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x10]
test eax, eax
jle 0x1008ca7c
push ecx
lea ecx, [esp + 0x13]
mov byte [esp + 0x13], 0
push ecx
inc eax
lea ecx, [esp + 0x20]
push eax
call fcn.10056ce0
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
sub eax, ecx
jne 0x1008c9f4
push str.vector_subscript_out_of_range
push 0x101b8af8
push eax
push 0x611
push 0x101b9560
push 2
call fcn.101275c0
add esp, 0x18
cmp eax, 1
jne 0x1008c9d2
int3
push 0
push 0x611
push str.C:Program_Files__x86_Microsoft_Visual_Studio2019CommunityVCToolsMSVC14.29.30133include_vector
push 0x101b8c38
push str._vector_subscript_out_of_range_
call fcn.10135f00
mov ecx, dword [esp + 0x30]
add esp, 0x14
push 0
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x18]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [edi + 0x158], 0
je 0x1008ca2c
push 0x1a9
push str.C:UsersByrockDesktopACS_GSRVR1_ACSHSACSGuardN3BASEN3UIEdit.cpp
push str.memory_leak
push str.ERROR____s_n_s:__d_n_n
call fcn.10082cd0
add esp, 0x10
lea ecx, [esp + 0x18]
call fcn.100447b0
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x1008ca65
mov eax, dword [esp + 0x24]
sub eax, ecx
push eax
push ecx
call fcn.10048ea0
add esp, 8
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov eax, dword [esp + 0x18]
push 8
push eax
mov dword [esp + 0x20], 0
call fcn.10048ea0
add esp, 8
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x1008f4c0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
mov esi, dword [esp + 0x34]
push edi
push esi
mov edi, ecx
call fcn.10088830
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
mov byte [esp + 0x3c], al
lea eax, [esp + 0x14]
push eax
push 4
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0
push eax
push esi
call ebx
mov eax, dword [esp + 0x14]
test eax, eax
jg 0x1008f522
push 0x112
push str.C:UsersByrockDesktopACS_GSRVR1_ACSHSACSGuardN3BASEN3UIList.cpp
push str.No_font_name
push str.ERROR____s_n_s:__d_n_n
call fcn.10082cd0
mov eax, dword [esp + 0x24]
add esp, 0x10
test eax, eax
jle 0x1008f59c
push 0x20
push eax
lea ecx, [edi + 0x134]
call fcn.10085680
cmp dword [edi + 0x14c], 0x10
lea eax, [edi + 0x138]
jb 0x1008f541
mov eax, dword [eax]
push 0
lea ecx, [esp + 0x14]
push ecx
push dword [esp + 0x1c]
push eax
push esi
call ebx
push 0
lea eax, [esp + 0x14]
push eax
push 4
lea eax, [edi + 0x150]
push eax
push esi
call ebx
push 0
lea eax, [esp + 0x14]
push eax
push 4
lea eax, [edi + 0x15c]
push eax
push esi
call ebx
push 0
lea eax, [esp + 0x14]
push eax
push 4
lea eax, [edi + 0x154]
push eax
push esi
call ebx
push 0
lea eax, [esp + 0x14]
push eax
push 4
lea eax, [edi + 0x158]
push eax
push esi
call ebx
mov eax, dword [edi + 0xdc]
lea ebp, [edi + 0xd8]
push ebp
lea ecx, [esp + 0x20]
mov eax, dword [eax]
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], eax
call fcn.1004a610
mov eax, dword [ebp + 4]
lea ecx, [esp + 0x28]
push ebp
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], eax
call fcn.1004a610
mov esi, dword [esp + 0x1c]
test esi, esi
je 0x1008f5f5
mov esi, dword [esi]
jmp 0x1008f5f7
xor esi, esi
lea ecx, [esp + 0x28]
call fcn.1004a670
cmp eax, esi
je 0x1008f648
push str.list_iterators_incompatible
push 0x101b8af8
push 0
push 0xc3
push 0x101bce28
push 2
call fcn.101275c0
add esp, 0x18
cmp eax, 1
jne 0x1008f62a
int3
push 0
push 0xc3
push str.C:Program_Files__x86_Microsoft_Visual_Studio2019CommunityVCToolsMSVC14.29.30133includelist
push 0x101b8c38
push str._list_iterators_incompatible_
call fcn.10135f00
add esp, 0x14
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0x18]
cmp eax, dword [esp + 0x24]
push 3
sete bl
call fcn.1011cc50
lea ecx, [esp + 0x28]
call fcn.1004a680
lea ecx, [esp + 0x18]
call fcn.1011cd00
test bl, bl
jne 0x1008f69c
lea ecx, [esp + 0x1c]
call fcn.100819e0
mov eax, dword [eax]
cmp dword [eax + 0xe4], 5
jne 0x1008f68e
mov dword [edi + 0x130], eax
lea ecx, [esp + 0x1c]
call fcn.10081920
jmp 0x1008f5c8
push 3
lea ecx, [esp + 0x1c]
call fcn.1011cc50
lea ecx, [esp + 0x1c]
call fcn.1004a680
lea ecx, [esp + 0x18]
call fcn.1011cd00
mov al, byte [esp + 0x38]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 4
Function at 0x10091040
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
push edi
mov ecx, dword [esi + 0x120]
mov dword [esi], vtable.CN3UIString.0
test ecx, ecx
je 0x1009105b
mov eax, dword [ecx]
push 1
call dword [eax + 4]
lea edi, [esi + 0x1a8]
mov dword [esi + 0x120], 0
mov ecx, edi
call fcn.100447b0
mov eax, dword [edi + 0x18]
cmp eax, 0x10
jb 0x10091087
inc eax
push eax
push dword [edi + 4]
call fcn.10048ea0
add esp, 8
mov eax, dword [edi]
push 8
push eax
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0xf
mov byte [edi + 4], 0
mov dword [edi], 0
call fcn.10048ea0
add esp, 8
lea ecx, [esi + 0x19c]
call fcn.1007c2a0
lea edi, [esi + 0x188]
mov ecx, edi
call fcn.100447b0
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x100910f2
mov eax, dword [edi + 0xc]
sub eax, ecx
and eax, 0xfffffffc
push eax
push ecx
call fcn.10048ea0
mov dword [edi + 4], 0
add esp, 8
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov eax, dword [edi]
push 8
push eax
mov dword [edi], 0
call fcn.10048ea0
add esp, 8
lea edi, [esi + 0x164]
mov ecx, edi
call fcn.100447b0
mov eax, dword [edi + 0x18]
cmp eax, 0x10
jb 0x10091127
inc eax
push eax
push dword [edi + 4]
call fcn.10048ea0
add esp, 8
mov eax, dword [edi]
push 8
push eax
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0xf
mov byte [edi + 4], 0
mov dword [edi], 0
call fcn.10048ea0
add esp, 8
lea edi, [esi + 0x148]
mov ecx, edi
call fcn.100447b0
mov eax, dword [edi + 0x18]
cmp eax, 0x10
jb 0x1009116e
inc eax
push eax
push dword [edi + 4]
call fcn.10048ea0
add esp, 8
mov eax, dword [edi]
push 8
push eax
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0xf
mov byte [edi + 4], 0
mov dword [edi], 0
call fcn.10048ea0
add esp, 8
lea edi, [esi + 0x12c]
mov ecx, edi
call fcn.100447b0
mov eax, dword [edi + 0x18]
cmp eax, 0x10
jb 0x100911b5
inc eax
push eax
push dword [edi + 4]
call fcn.10048ea0
add esp, 8
mov eax, dword [edi]
push 8
push eax
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0xf
mov byte [edi + 4], 0
mov dword [edi], 0
call fcn.10048ea0
add esp, 8
mov ecx, esi
pop edi
pop esi
jmp fcn.10088150
Function at 0x10093010
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017e0d5
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x101dadb0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
push esi
call fcn.10088830
test al, al
je 0x1009320b
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp - 0x34]
push 0
push eax
push 4
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0
push eax
push esi
call edi
mov eax, dword [ebp - 0x30]
test eax, eax
jle 0x10093137
push 0x3f
push eax
lea ecx, [ebp - 0x2c]
call fcn.100855e0
push 0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x34]
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push ecx
push dword [ebp - 0x30]
cmovae eax, dword [ebp - 0x28]
push eax
push esi
call edi
push 0
lea eax, [ebp - 0x34]
mov dword [ebp - 0x38], 0
push eax
push 4
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], 0
push eax
push esi
call edi
push 0
lea eax, [ebp - 0x34]
push eax
push 4
lea eax, [ebp - 0x38]
push eax
push esi
call edi
mov ecx, dword [ebp - 0x38]
mov eax, ecx
mov edx, dword [ebx]
and eax, 2
push eax
and ecx, 1
lea eax, [ebp - 0x2c]
push ecx
push dword [ebp - 0x3c]
mov ecx, ebx
push eax
call dword [edx + 0x78]
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.100447b0
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x1009310a
inc eax
push eax
push dword [ebp - 0x28]
call fcn.10048ea0
add esp, 8
mov eax, dword [ebp - 0x2c]
push 8
push eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
mov dword [ebp - 0x2c], 0
call fcn.10048ea0
add esp, 8
cmp dword [ebp - 0x30], 0
jg 0x10093153
push 0x16c
push str.C:UsersByrockDesktopACS_GSRVR1_ACSHSACSGuardN3BASEN3UIString.cpp
push str.No_font_name
push str.ERROR____s_n_s:__d_n_n
call fcn.10082cd0
add esp, 0x10
push 0
lea eax, [ebp - 0x34]
push eax
push 4
lea eax, [ebx + 0x180]
push eax
push esi
call edi
push 0
lea eax, [ebp - 0x34]
push eax
push 4
lea eax, [ebp - 0x30]
push eax
push esi
call edi
mov eax, dword [ebp - 0x30]
test eax, eax
jle 0x100931f4
push 0x3f
push eax
lea ecx, [ebp - 0x2c]
call fcn.100855e0
push 0
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x34]
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push ecx
push dword [ebp - 0x30]
cmovae eax, dword [ebp - 0x28]
push eax
push esi
call edi
mov eax, dword [ebx]
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, ebx
call dword [eax + 0x70]
lea ecx, [ebp - 0x2c]
call fcn.100447b0
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x100931cd
inc eax
push eax
push dword [ebp - 0x28]
call fcn.10048ea0
add esp, 8
mov eax, dword [ebp - 0x2c]
push 8
push eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
mov dword [ebp - 0x2c], 0
call fcn.10048ea0
add esp, 8
cmp dword [ebx + 0x40], 2
jb 0x10093209
push 0
lea eax, [ebp - 0x34]
push eax
push 4
lea eax, [ebp - 0x40]
push eax
push esi
call edi
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10120250
mov esp, ebp
pop ebp
ret 4
Function at 0x100946f0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
cmp byte [0x102b2ce7], 0
jne 0x10094740
call fcn.1013f740
mov dword [0x10223634], eax
mov ecx, 1
mov edx, eax
shr edx, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
add eax, ecx
mov dword [ecx*4 + 0x10223634], eax
inc ecx
cmp ecx, 0x270
jb 0x10094708
mov dword [0x10223630], 0x270
mov byte [0x102b2ce7], 1
nop dword [eax + eax]
mov ecx, 0x10223630
call fcn.100e1b20
mov ecx, eax
mov eax, 0x575a2ad3
mul ecx
shr edx, 0xa
cmp edx, 0x15d68a
jae 0x10094740
mov eax, ecx
xor edx, edx
mov ecx, 0xbb9
div ecx
add edx, 0x800001f4
cmp edx, 0x80000000
lea ecx, [edx - 0x80000000]
lea eax, [edx - 0x80000000]
cmovae eax, ecx
ret
Function at 0x100a4a60
Capabilities:
Terminate process

Disassembly:
sub esp, 0x440
mov eax, dword [0x101dadb0]
xor eax, esp
mov dword [esp + 0x438], eax
push esi
mov esi, dword [esp + 0x448]
lea eax, [esp + 8]
push eax
call fcn.1013db80
add esp, 4
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.10140460
push 0x101be390
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push str.BYRACS_Log.txt
push eax
call fcn.10141740
add esp, 0x14
cmp dword [esp + 4], 0
je 0x100a4b31
push 0x400
lea eax, [esp + 0x3c]
push 0
push eax
call fcn.10123240
mov eax, dword [esp + 0x30]
add esp, 0xc
inc eax
push esi
push dword [esp + 0x18]
push dword [esp + 0x20]
push dword [esp + 0x28]
push dword [esp + 0x30]
push eax
mov eax, dword [esp + 0x40]
add eax, 0x76c
push eax
lea eax, [esp + 0x54]
push str.____04d__02d__02d__02d:_02d:_02d__BYRACS_info___s__n
push eax
call fcn.100df000
add esp, 0x24
lea eax, [esp + 0x38]
push eax
push 0x101b8af8
push dword [esp + 0xc]
call fcn.100944f0
add esp, 0xc
push dword [esp + 4]
call fcn.10136a40
add esp, 4
cmp byte [esp + 0x44c], 0
jne 0x100a4b4b
mov ecx, dword [esp + 0x43c]
xor eax, eax
pop esi
xor ecx, esp
call fcn.10120250
add esp, 0x440
ret 8
push 0
call fcn.1013fe30
int3

Function at 0x100a4b60
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
test edi, edi
je 0x100a4bfe
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x100a4bfe
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x100a4bfe
cmp dword [eax + edi], 0x4550
jne 0x100a4bfe
mov ecx, 0x14c
cmp word [eax + edi + 4], cx
jne 0x100a4bfe
mov eax, dword [eax + edi + 0x78]
xor esi, esi
add eax, edi
mov ecx, dword [eax + 0x1c]
mov ebp, dword [eax + 0x20]
add ecx, edi
mov ebx, dword [eax + 0x18]
add ebp, edi
mov dword [esp + 0x10], ecx
mov ecx, dword [eax + 0x24]
add ecx, edi
mov dword [esp + 0x18], ecx
test ebx, ebx
je 0x100a4bfe
mov eax, dword [ebp + esi*4]
mov ecx, dword [esp + 0x1c]
add eax, edi
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100a4bf0
test dl, dl
je 0x100a4bec
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100a4bf0
add eax, 2
add ecx, 2
test dl, dl
jne 0x100a4bd0
xor eax, eax
jmp 0x100a4bf5
sbb eax, eax
or eax, 1
test eax, eax
je 0x100a4c08
inc esi
cmp esi, ebx
jb 0x100a4bc5
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 8
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
movzx eax, word [eax + esi*2]
mov eax, dword [ecx + eax*4]
add eax, edi
je 0x100a4bfe
push 0
push 0x102
push 0x1a
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
pop ecx
ret 8
Function at 0x100af4e0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x1c
mov eax, dword [0x101dadb0]
xor eax, esp
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x24]
push esi
push edi
mov edi, dword [0x1027c0b4]
push eax
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x100af558
movaps xmm0, xmmword [str.:yR__N]
sub esp, 0x1c
mov esi, esp
mov word [esp + 0x38], 0x5e1f
movups xmmword [esp + 0x28], xmm0
mov byte [esp + 0x3a], 0
xor ecx, ecx
mov al, byte [esp + 0x28]
xor byte [esp + ecx + 0x29], al
inc ecx
cmp ecx, 0x11
jb 0x100af526
sub esp, 0x1c
mov byte [esp + 0x56], 0
lea eax, [esp + 0x45]
mov ecx, esp
push eax
call fcn.10047670
push esi
call fcn.1004a7a0
add esp, 0x20
mov ecx, edi
call fcn.100ba660
mov ecx, dword [esp + 0x20]
mov al, 1
pop edi
pop esi
xor ecx, esp
call fcn.10120250
add esp, 0x1c
ret 8
Function at 0x100d4310
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10180535
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x101dadb0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0x28]
mov eax, dword [ebp + 8]
mov ecx, 0x102adb84
mov dword [ebp - 4], 0
cmp dword [ebp + 0x24], 0x10
push dword [ebp + 0x20]
mov dword [0x1027c054], eax
mov eax, dword [esi]
mov dword [0x1027c070], eax
lea eax, [ebp + 0x10]
cmovae eax, dword [ebp + 0x10]
push eax
call fcn.10048200
call fcn.100d41c0
mov eax, dword [0x1027c070]
test eax, eax
jne 0x100d4446
cmp dword [ebp + 0x24], 0x10
lea eax, [ebp + 0x10]
movaps xmm0, xmmword [0x101c3050]
cmovae eax, dword [ebp + 0x10]
xor ecx, ecx
push eax
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x1c], 0x30397f2b
mov dword [ebp - 0x18], 0x653b312a
mov dword [ebp - 0x14], 0x2c7a7f
nop dword [eax + eax]
mov al, byte [ebp - 0x2c]
xor byte [ebp + ecx - 0x2b], al
inc ecx
cmp ecx, 0x1a
jb 0x100d43b0
sub esp, 0x1c
mov byte [ebp - 0x11], 0
lea eax, [ebp - 0x2b]
mov ecx, esp
push eax
call fcn.10047670
lea eax, [ebp - 0x48]
push eax
call fcn.1004a7a0
add esp, 8
mov byte [ebp - 4], 1
lea eax, [ebp - 0x48]
mov ecx, esp
push eax
call fcn.10047840
push 3
push dword [0x1027c0b4]
call fcn.100d7a40
add esp, 0x24
mov dword [esi], 0
lea ecx, [ebp - 0x48]
call fcn.100447b0
mov eax, dword [ebp - 0x30]
cmp eax, 0x10
jb 0x100d441d
inc eax
push eax
push dword [ebp - 0x44]
call fcn.10048ea0
add esp, 8
mov eax, dword [ebp - 0x48]
push 8
push eax
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0xf
mov byte [ebp - 0x44], 0
mov dword [ebp - 0x48], 0
call fcn.10048ea0
add esp, 8
jmp 0x100d4448
mov dword [esi], eax
lea ecx, [ebp + 0xc]
call fcn.100447b0
mov eax, dword [ebp + 0x24]
cmp eax, 0x10
jb 0x100d4465
inc eax
push eax
push dword [ebp + 0x10]
call fcn.10048ea0
add esp, 8
mov eax, dword [ebp + 0xc]
push 8
push eax
mov dword [ebp + 0x20], 0
mov dword [ebp + 0x24], 0xf
mov byte [ebp + 0x10], 0
mov dword [ebp + 0xc], 0
call fcn.10048ea0
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10120250
mov esp, ebp
pop ebp
ret 0x24
Function at 0x100e1b20
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
push edi
mov edi, ecx
mov eax, dword [edi]
cmp eax, 0x270
jne 0x100e1b70
lea edx, [edi + 8]
mov esi, eax
mov ecx, dword [edx - 4]
lea edx, [edx + 4]
xor ecx, dword [edx - 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub esi, 1
jne 0x100e1b32
mov eax, dword [edi]
jmp 0x100e1c57
cmp eax, 0x4e0
jb 0x100e1c57
mov eax, dword [edi + 0x9c4]
push ebx
lea ebx, [edi + 0x9c4]
push ebp
mov ebp, 0xe3
nop
mov ecx, dword [ebx + 4]
lea edx, [ebx + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx + 0x634]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub ebp, 1
jne 0x100e1b90
mov eax, dword [edi + 0xd50]
lea ebx, [edi + 0xd50]
mov ebp, 0x18c
nop word [eax + eax]
mov ecx, eax
lea edx, [ebx + 4]
xor ecx, dword [edx]
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx - 0xd4c]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub ebp, 1
jne 0x100e1be0
mov ecx, dword [edi + 0x1380]
xor ecx, dword [edi + 4]
and ecx, 0x7fffffff
xor ecx, dword [edi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop ebp
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi + 0x9c0], eax
xor eax, eax
mov dword [edi], 0
pop ebx
mov edx, dword [edi + eax*4 + 4]
inc eax
mov dword [edi], eax
mov ecx, edx
mov eax, dword [edi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
ret
Function at 0x100e2810
Capabilities:
Create thread
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10181373
mov eax, dword fs:[0]
push eax
sub esp, 0xc4
mov eax, dword [0x101dadb0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 0
push 0
push 0x100e27f0
push 0
push 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
movaps xmm0, xmmword [0x101c2a60]
xor ecx, ecx
mov eax, dword [0x1027c0b4]
movups xmmword [ebp - 0x60], xmm0
mov dword [ebp - 0x30], 0x5e594344
movaps xmm0, xmmword [0x101c2890]
movups xmmword [ebp - 0x50], xmm0
mov byte [eax + 0x154], 0
movaps xmm0, xmmword [0x101c2780]
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x2c], 0x455e4b58
mov dword [ebp - 0x28], 0x200458
nop dword [eax + eax]
mov al, byte [ebp - 0x60]
xor byte [ebp + ecx - 0x5f], al
inc ecx
cmp ecx, 0x3a
jb 0x100e28a0
lea eax, [ebp - 0x5f]
mov byte [ebp - 0x25], 0
push eax
lea ecx, [ebp - 0x98]
call fcn.10047670
mov byte [ebp - 4], 1
xor ecx, ecx
movaps xmm0, xmmword [0x101c2270]
movups xmmword [ebp - 0x4c], xmm0
mov dword [ebp - 0x2c], 0x7e373533
movaps xmm0, xmmword [0x101c2150]
movups xmmword [ebp - 0x3c], xmm0
mov word [ebp - 0x28], 0x72
nop dword [eax]
mov al, byte [ebp - 0x4c]
xor byte [ebp + ecx - 0x4b], al
inc ecx
cmp ecx, 0x24
jb 0x100e28f0
lea eax, [ebp - 0x4b]
mov byte [ebp - 0x27], 0
push eax
lea ecx, [ebp - 0x7c]
call fcn.10047670
mov byte [ebp - 4], 2
xor ecx, ecx
movaps xmm0, xmmword [0x101c28a0]
movups xmmword [ebp - 0x48], xmm0
mov byte [ebp - 0x28], 0
movaps xmm0, xmmword [0x101c1e00]
movups xmmword [ebp - 0x38], xmm0
nop dword [eax]
mov al, byte [ebp - 0x48]
xor byte [ebp + ecx - 0x47], al
inc ecx
cmp ecx, 0x1f
jb 0x100e2930
lea eax, [ebp - 0x47]
mov byte [ebp - 0x28], 0
push eax
lea ecx, [ebp - 0xb4]
call fcn.10047670
mov edx, 0x101b8c74
mov byte [ebp - 4], 3
lea ecx, [ebp + 8]
call fcn.10065ac0
test al, al
je 0x100e29ec
lea eax, [ebp - 0x7c]
push eax
lea edx, [ebp - 0x98]
lea ecx, [ebp - 0x40]
call fcn.1007d6a0
add esp, 4
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 4
push ecx
mov edx, eax
lea ecx, [ebp - 0xd0]
call fcn.100df020
movaps xmm0, xmmword [0x101c30f0]
add esp, 4
mov edx, eax
mov word [ebp - 0x14], 0x67
movups xmmword [ebp - 0x24], xmm0
xor ecx, ecx
nop
mov al, byte [ebp - 0x24]
xor byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0x10
jb 0x100e29b0
push 0x30
lea eax, [ebp - 0x23]
mov byte [ebp - 0x13], 0
push eax
mov ecx, edx
call fcn.10047430
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0xd0]
call fcn.100475a0
lea ecx, [ebp - 0x40]
call fcn.100475a0
jmp 0x100e2a28
movaps xmm0, xmmword [str._aLin_osHiKnib_b]
xor ecx, ecx
movups xmmword [ebp - 0x24], xmm0
mov word [ebp - 0x14], 0x62
nop
mov al, byte [ebp - 0x24]
xor byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0x10
jb 0x100e2a00
push 0x30
lea eax, [ebp - 0x23]
mov byte [ebp - 0x13], 0
push eax
lea ecx, [ebp + 8]
call fcn.10047430
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call fcn.1013fe30
int3
Function at 0x100e45b0
Capabilities:
Create thread

Disassembly:
cmp dword [esp + 8], 1
jne 0x100e45e7
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
call sym.BYRACS.dll_Init
push 0
push 0
push 0
push 0x100e4480
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [0x1027c0b4]
mov dword [ecx + 0x170], eax
mov eax, 1
ret 0xc
Function at 0x100e4ad0
Capabilities:
Encode data using xor
Encrypt data using rc4 via winapi
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x101dadb0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
jmp 0x100e4af5
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0
push 1
push str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
push 0
push 0x1027c0a8
mov dword [0x1027c09c], eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x100e4bcc
push 0x1027c098
push 0
push 0
push 0x8004
push dword [0x1027c0a8]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x100e4bcc
movaps xmm0, xmmword [0x101c2170]
xor ecx, ecx
movups xmmword [ebp - 0x3c], xmm0
mov dword [ebp - 0xc], 0x68477026
movaps xmm0, xmmword [0x101c2290]
movups xmmword [ebp - 0x2c], xmm0
mov word [ebp - 8], 0x62
movaps xmm0, xmmword [0x101c2bb0]
movups xmmword [ebp - 0x1c], xmm0
mov al, byte [ebp - 0x3c]
xor byte [ebp + ecx - 0x3b], al
inc ecx
cmp ecx, 0x34
jb 0x100e4b70
push 1
push 0x1d
lea eax, [ebp - 0x3b]
mov byte [ebp - 7], 0
push eax
push dword [0x1027c098]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x100e4bcc
push 0x1027c0b8
push 0x800000
push dword [0x1027c098]
push 0x6801
push dword [0x1027c0a8]
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
jne 0x100e4bcc
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x100e49a0
push 0x468e60
call fcn.100020f0
push 0x100e4ab0
push 0x468eb6
mov dword [0x1027c0a0], eax
call fcn.100020f0
jmp 0x100e4c01
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.10120250
mov esp, ebp
pop ebp
ret