joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1008bfc0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
push esi
mov esi, dword [ebp + 8]
push edi
push esi
mov edi, ecx
call fcn.100900e0
test al, al
jne 0x1008bfe2
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0
lea eax, [esp + 0x18]
mov dword [esp + 0x14], 0
push eax
push 4
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x10]
test eax, eax
jle 0x1008c0fc
push ecx
lea ecx, [esp + 0x13]
mov byte [esp + 0x13], 0
push ecx
inc eax
lea ecx, [esp + 0x20]
push eax
call fcn.10056360
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
sub eax, ecx
jne 0x1008c074
push str.vector_subscript_out_of_range
push 0x101b8af8
push eax
push 0x611
push 0x101b9560
push 2
call fcn.10126bf0
add esp, 0x18
cmp eax, 1
jne 0x1008c052
int3
push 0
push 0x611
push str.C:Program_Files__x86_Microsoft_Visual_Studio2019CommunityVCToolsMSVC14.29.30133include_vector
push 0x101b8c38
push str._vector_subscript_out_of_range_
call fcn.10135530
mov ecx, dword [esp + 0x30]
add esp, 0x14
push 0
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x18]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [edi + 0x158], 0
je 0x1008c0ac
push 0x1a9
push str.C:UsersByrockDesktopACS_GSRVR1_ACSHSACSGuardN3BASEN3UIEdit.cpp
push str.memory_leak
push str.ERROR____s_n_s:__d_n_n
call fcn.10082390
add esp, 0x10
lea ecx, [esp + 0x18]
call fcn.10043e40
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x1008c0e5
mov eax, dword [esp + 0x24]
sub eax, ecx
push eax
push ecx
call fcn.10048530
add esp, 8
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov eax, dword [esp + 0x18]
push 8
push eax
mov dword [esp + 0x20], 0
call fcn.10048530
add esp, 8
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x1008eb40
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
mov esi, dword [esp + 0x34]
push edi
push esi
mov edi, ecx
call fcn.10087ee0
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
mov byte [esp + 0x3c], al
lea eax, [esp + 0x14]
push eax
push 4
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0
push eax
push esi
call ebx
mov eax, dword [esp + 0x14]
test eax, eax
jg 0x1008eba2
push 0x112
push str.C:UsersByrockDesktopACS_GSRVR1_ACSHSACSGuardN3BASEN3UIList.cpp
push str.No_font_name
push str.ERROR____s_n_s:__d_n_n
call fcn.10082390
mov eax, dword [esp + 0x24]
add esp, 0x10
test eax, eax
jle 0x1008ec1c
push 0x20
push eax
lea ecx, [edi + 0x134]
call fcn.10084d30
cmp dword [edi + 0x14c], 0x10
lea eax, [edi + 0x138]
jb 0x1008ebc1
mov eax, dword [eax]
push 0
lea ecx, [esp + 0x14]
push ecx
push dword [esp + 0x1c]
push eax
push esi
call ebx
push 0
lea eax, [esp + 0x14]
push eax
push 4
lea eax, [edi + 0x150]
push eax
push esi
call ebx
push 0
lea eax, [esp + 0x14]
push eax
push 4
lea eax, [edi + 0x15c]
push eax
push esi
call ebx
push 0
lea eax, [esp + 0x14]
push eax
push 4
lea eax, [edi + 0x154]
push eax
push esi
call ebx
push 0
lea eax, [esp + 0x14]
push eax
push 4
lea eax, [edi + 0x158]
push eax
push esi
call ebx
mov eax, dword [edi + 0xdc]
lea ebp, [edi + 0xd8]
push ebp
lea ecx, [esp + 0x20]
mov eax, dword [eax]
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], eax
call fcn.10049ca0
mov eax, dword [ebp + 4]
lea ecx, [esp + 0x28]
push ebp
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], eax
call fcn.10049ca0
mov esi, dword [esp + 0x1c]
test esi, esi
je 0x1008ec75
mov esi, dword [esi]
jmp 0x1008ec77
xor esi, esi
lea ecx, [esp + 0x28]
call fcn.10049d00
cmp eax, esi
je 0x1008ecc8
push str.list_iterators_incompatible
push 0x101b8af8
push 0
push 0xc3
push 0x101bce28
push 2
call fcn.10126bf0
add esp, 0x18
cmp eax, 1
jne 0x1008ecaa
int3
push 0
push 0xc3
push str.C:Program_Files__x86_Microsoft_Visual_Studio2019CommunityVCToolsMSVC14.29.30133includelist
push 0x101b8c38
push str._list_iterators_incompatible_
call fcn.10135530
add esp, 0x14
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0x18]
cmp eax, dword [esp + 0x24]
push 3
sete bl
call fcn.1011c2a0
lea ecx, [esp + 0x28]
call fcn.10049d10
lea ecx, [esp + 0x18]
call fcn.1011c350
test bl, bl
jne 0x1008ed1c
lea ecx, [esp + 0x1c]
call fcn.100810a0
mov eax, dword [eax]
cmp dword [eax + 0xe4], 5
jne 0x1008ed0e
mov dword [edi + 0x130], eax
lea ecx, [esp + 0x1c]
call fcn.10080fe0
jmp 0x1008ec48
push 3
lea ecx, [esp + 0x1c]
call fcn.1011c2a0
lea ecx, [esp + 0x1c]
call fcn.10049d10
lea ecx, [esp + 0x18]
call fcn.1011c350
mov al, byte [esp + 0x38]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 4
Function at 0x100906c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
push edi
mov ecx, dword [esi + 0x120]
mov dword [esi], vtable.CN3UIString.0
test ecx, ecx
je 0x100906db
mov eax, dword [ecx]
push 1
call dword [eax + 4]
lea edi, [esi + 0x1a8]
mov dword [esi + 0x120], 0
mov ecx, edi
call fcn.10043e40
mov eax, dword [edi + 0x18]
cmp eax, 0x10
jb 0x10090707
inc eax
push eax
push dword [edi + 4]
call fcn.10048530
add esp, 8
mov eax, dword [edi]
push 8
push eax
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0xf
mov byte [edi + 4], 0
mov dword [edi], 0
call fcn.10048530
add esp, 8
lea ecx, [esi + 0x19c]
call fcn.1007b950
lea edi, [esi + 0x188]
mov ecx, edi
call fcn.10043e40
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x10090772
mov eax, dword [edi + 0xc]
sub eax, ecx
and eax, 0xfffffffc
push eax
push ecx
call fcn.10048530
mov dword [edi + 4], 0
add esp, 8
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov eax, dword [edi]
push 8
push eax
mov dword [edi], 0
call fcn.10048530
add esp, 8
lea edi, [esi + 0x164]
mov ecx, edi
call fcn.10043e40
mov eax, dword [edi + 0x18]
cmp eax, 0x10
jb 0x100907a7
inc eax
push eax
push dword [edi + 4]
call fcn.10048530
add esp, 8
mov eax, dword [edi]
push 8
push eax
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0xf
mov byte [edi + 4], 0
mov dword [edi], 0
call fcn.10048530
add esp, 8
lea edi, [esi + 0x148]
mov ecx, edi
call fcn.10043e40
mov eax, dword [edi + 0x18]
cmp eax, 0x10
jb 0x100907ee
inc eax
push eax
push dword [edi + 4]
call fcn.10048530
add esp, 8
mov eax, dword [edi]
push 8
push eax
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0xf
mov byte [edi + 4], 0
mov dword [edi], 0
call fcn.10048530
add esp, 8
lea edi, [esi + 0x12c]
mov ecx, edi
call fcn.10043e40
mov eax, dword [edi + 0x18]
cmp eax, 0x10
jb 0x10090835
inc eax
push eax
push dword [edi + 4]
call fcn.10048530
add esp, 8
mov eax, dword [edi]
push 8
push eax
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0xf
mov byte [edi + 4], 0
mov dword [edi], 0
call fcn.10048530
add esp, 8
mov ecx, esi
pop edi
pop esi
jmp fcn.10087800
Function at 0x100926a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017d6e5
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x101dadb0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
push esi
call fcn.10087ee0
test al, al
je 0x1009289b
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp - 0x34]
push 0
push eax
push 4
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0
push eax
push esi
call edi
mov eax, dword [ebp - 0x30]
test eax, eax
jle 0x100927c7
push 0x3f
push eax
lea ecx, [ebp - 0x2c]
call fcn.10084c90
push 0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x34]
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push ecx
push dword [ebp - 0x30]
cmovae eax, dword [ebp - 0x28]
push eax
push esi
call edi
push 0
lea eax, [ebp - 0x34]
mov dword [ebp - 0x38], 0
push eax
push 4
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], 0
push eax
push esi
call edi
push 0
lea eax, [ebp - 0x34]
push eax
push 4
lea eax, [ebp - 0x38]
push eax
push esi
call edi
mov ecx, dword [ebp - 0x38]
mov eax, ecx
mov edx, dword [ebx]
and eax, 2
push eax
and ecx, 1
lea eax, [ebp - 0x2c]
push ecx
push dword [ebp - 0x3c]
mov ecx, ebx
push eax
call dword [edx + 0x78]
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.10043e40
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x1009279a
inc eax
push eax
push dword [ebp - 0x28]
call fcn.10048530
add esp, 8
mov eax, dword [ebp - 0x2c]
push 8
push eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
mov dword [ebp - 0x2c], 0
call fcn.10048530
add esp, 8
cmp dword [ebp - 0x30], 0
jg 0x100927e3
push 0x16c
push str.C:UsersByrockDesktopACS_GSRVR1_ACSHSACSGuardN3BASEN3UIString.cpp
push str.No_font_name
push str.ERROR____s_n_s:__d_n_n
call fcn.10082390
add esp, 0x10
push 0
lea eax, [ebp - 0x34]
push eax
push 4
lea eax, [ebx + 0x180]
push eax
push esi
call edi
push 0
lea eax, [ebp - 0x34]
push eax
push 4
lea eax, [ebp - 0x30]
push eax
push esi
call edi
mov eax, dword [ebp - 0x30]
test eax, eax
jle 0x10092884
push 0x3f
push eax
lea ecx, [ebp - 0x2c]
call fcn.10084c90
push 0
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x34]
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push ecx
push dword [ebp - 0x30]
cmovae eax, dword [ebp - 0x28]
push eax
push esi
call edi
mov eax, dword [ebx]
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, ebx
call dword [eax + 0x70]
lea ecx, [ebp - 0x2c]
call fcn.10043e40
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x1009285d
inc eax
push eax
push dword [ebp - 0x28]
call fcn.10048530
add esp, 8
mov eax, dword [ebp - 0x2c]
push 8
push eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
mov dword [ebp - 0x2c], 0
call fcn.10048530
add esp, 8
cmp dword [ebx + 0x40], 2
jb 0x10092899
push 0
lea eax, [ebp - 0x34]
push eax
push 4
lea eax, [ebp - 0x40]
push eax
push esi
call edi
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1011f880
mov esp, ebp
pop ebp
ret 4
Function at 0x10093d80
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
cmp byte [0x102b2ce7], 0
jne 0x10093dd0
call fcn.1013ed60
mov dword [0x10223634], eax
mov ecx, 1
mov edx, eax
shr edx, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
add eax, ecx
mov dword [ecx*4 + 0x10223634], eax
inc ecx
cmp ecx, 0x270
jb 0x10093d98
mov dword [0x10223630], 0x270
mov byte [0x102b2ce7], 1
nop dword [eax + eax]
mov ecx, 0x10223630
call fcn.100e1180
mov ecx, eax
mov eax, 0x575a2ad3
mul ecx
shr edx, 0xa
cmp edx, 0x15d68a
jae 0x10093dd0
mov eax, ecx
xor edx, edx
mov ecx, 0xbb9
div ecx
add edx, 0x800001f4
cmp edx, 0x80000000
lea ecx, [edx - 0x80000000]
lea eax, [edx - 0x80000000]
cmovae eax, ecx
ret
Function at 0x100a4100
Capabilities:
Terminate process

Disassembly:
sub esp, 0x440
mov eax, dword [0x101dadb0]
xor eax, esp
mov dword [esp + 0x438], eax
push esi
mov esi, dword [esp + 0x448]
lea eax, [esp + 8]
push eax
call fcn.1013d1a0
add esp, 4
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.1013fa80
push 0x101be390
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push str.BYRACS_Log.txt
push eax
call fcn.10140d60
add esp, 0x14
cmp dword [esp + 4], 0
je 0x100a41d1
push 0x400
lea eax, [esp + 0x3c]
push 0
push eax
call fcn.10122870
mov eax, dword [esp + 0x30]
add esp, 0xc
inc eax
push esi
push dword [esp + 0x18]
push dword [esp + 0x20]
push dword [esp + 0x28]
push dword [esp + 0x30]
push eax
mov eax, dword [esp + 0x40]
add eax, 0x76c
push eax
lea eax, [esp + 0x54]
push str.____04d__02d__02d__02d:_02d:_02d__BYRACS_info___s__n
push eax
call fcn.100de660
add esp, 0x24
lea eax, [esp + 0x38]
push eax
push 0x101b8af8
push dword [esp + 0xc]
call fcn.10093b80
add esp, 0xc
push dword [esp + 4]
call fcn.10136070
add esp, 4
cmp byte [esp + 0x44c], 0
jne 0x100a41eb
mov ecx, dword [esp + 0x43c]
xor eax, eax
pop esi
xor ecx, esp
call fcn.1011f880
add esp, 0x440
ret 8
push 0
call fcn.1013f450
int3

Function at 0x100a4200
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
test edi, edi
je 0x100a429e
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x100a429e
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x100a429e
cmp dword [eax + edi], 0x4550
jne 0x100a429e
mov ecx, 0x14c
cmp word [eax + edi + 4], cx
jne 0x100a429e
mov eax, dword [eax + edi + 0x78]
xor esi, esi
add eax, edi
mov ecx, dword [eax + 0x1c]
mov ebp, dword [eax + 0x20]
add ecx, edi
mov ebx, dword [eax + 0x18]
add ebp, edi
mov dword [esp + 0x10], ecx
mov ecx, dword [eax + 0x24]
add ecx, edi
mov dword [esp + 0x18], ecx
test ebx, ebx
je 0x100a429e
mov eax, dword [ebp + esi*4]
mov ecx, dword [esp + 0x1c]
add eax, edi
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100a4290
test dl, dl
je 0x100a428c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100a4290
add eax, 2
add ecx, 2
test dl, dl
jne 0x100a4270
xor eax, eax
jmp 0x100a4295
sbb eax, eax
or eax, 1
test eax, eax
je 0x100a42a8
inc esi
cmp esi, ebx
jb 0x100a4265
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 8
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
movzx eax, word [eax + esi*2]
mov eax, dword [ecx + eax*4]
add eax, edi
je 0x100a429e
push 0
push 0x102
push 0x1a
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
pop ecx
ret 8
Function at 0x100aeb80
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x1c
mov eax, dword [0x101dadb0]
xor eax, esp
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x24]
push esi
push edi
mov edi, dword [0x1027c0b4]
push eax
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x100aebf8
movaps xmm0, xmmword [0x101c20f0]
sub esp, 0x1c
mov esi, esp
mov word [esp + 0x38], 0x6928
movups xmmword [esp + 0x28], xmm0
mov byte [esp + 0x3a], 0
xor ecx, ecx
mov al, byte [esp + 0x28]
xor byte [esp + ecx + 0x29], al
inc ecx
cmp ecx, 0x11
jb 0x100aebc6
sub esp, 0x1c
mov byte [esp + 0x56], 0
lea eax, [esp + 0x45]
mov ecx, esp
push eax
call fcn.10046d00
push esi
call fcn.10049e30
add esp, 0x20
mov ecx, edi
call fcn.100b9c90
mov ecx, dword [esp + 0x20]
mov al, 1
pop edi
pop esi
xor ecx, esp
call fcn.1011f880
add esp, 0x1c
ret 8
Function at 0x100c0340
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017e8ed
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x101dadb0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x1027c0b4]
lea esi, [ebp - 0x38]
mov cl, 9
mov dword [ebp - 0x1c], 0x6d2c2909
mov dword [ebp - 0x18], 0x2c292629
mov word [ebp - 0x14], 0x6d
push dword [eax + 0xac]
inc dword [eax + 0xa8]
push dword [eax + 0xa8]
xor eax, eax
nop dword [eax + eax]
xor byte [ebp + eax - 0x1b], cl
inc eax
cmp eax, 8
jae 0x100c03af
mov cl, byte [ebp - 0x1c]
jmp 0x100c03a0
sub esp, 0x1c
mov byte [ebp - 0x13], 0
lea eax, [ebp - 0x1b]
mov ecx, esp
push eax
call fcn.10046d00
push esi
call fcn.10049e30
mov eax, dword [0x1027c0b4]
add esp, 0x28
mov eax, dword [eax + 0x514]
mov esi, dword [eax + 0x30]
mov dword [ebp - 4], 0
test esi, esi
je 0x100c03fc
push 4
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x100c03fc
lea eax, [ebp - 0x38]
mov ecx, esi
push eax
call dword [0x101ba78c]
lea ecx, [ebp - 0x38]
call fcn.10043e40
mov eax, dword [ebp - 0x20]
cmp eax, 0x10
jb 0x100c0419
inc eax
push eax
push dword [ebp - 0x34]
call fcn.10048530
add esp, 8
mov eax, dword [ebp - 0x38]
push 8
push eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0xf
mov byte [ebp - 0x34], 0
mov dword [ebp - 0x38], 0
call fcn.10048530
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1011f880
mov esp, ebp
pop ebp
ret
Function at 0x100d3970
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017fb45
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x101dadb0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0x28]
mov eax, dword [ebp + 8]
mov ecx, 0x102adb84
mov dword [ebp - 4], 0
cmp dword [ebp + 0x24], 0x10
push dword [ebp + 0x20]
mov dword [0x1027c054], eax
mov eax, dword [esi]
mov dword [0x1027c070], eax
lea eax, [ebp + 0x10]
cmovae eax, dword [ebp + 0x10]
push eax
call fcn.10047890
call fcn.100d3820
mov eax, dword [0x1027c070]
test eax, eax
jne 0x100d3aa6
cmp dword [ebp + 0x24], 0x10
lea eax, [ebp + 0x10]
movaps xmm0, xmmword [str.7r_RZRYC]
cmovae eax, dword [ebp + 0x10]
xor ecx, ecx
push eax
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x1c], 0x58511743
mov dword [ebp - 0x18], 0xd535942
mov dword [ebp - 0x14], 0x441217
nop dword [eax + eax]
mov al, byte [ebp - 0x2c]
xor byte [ebp + ecx - 0x2b], al
inc ecx
cmp ecx, 0x1a
jb 0x100d3a10
sub esp, 0x1c
mov byte [ebp - 0x11], 0
lea eax, [ebp - 0x2b]
mov ecx, esp
push eax
call fcn.10046d00
lea eax, [ebp - 0x48]
push eax
call fcn.10049e30
add esp, 8
mov byte [ebp - 4], 1
lea eax, [ebp - 0x48]
mov ecx, esp
push eax
call fcn.10046ed0
push 3
push dword [0x1027c0b4]
call fcn.100d70a0
add esp, 0x24
mov dword [esi], 0
lea ecx, [ebp - 0x48]
call fcn.10043e40
mov eax, dword [ebp - 0x30]
cmp eax, 0x10
jb 0x100d3a7d
inc eax
push eax
push dword [ebp - 0x44]
call fcn.10048530
add esp, 8
mov eax, dword [ebp - 0x48]
push 8
push eax
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0xf
mov byte [ebp - 0x44], 0
mov dword [ebp - 0x48], 0
call fcn.10048530
add esp, 8
jmp 0x100d3aa8
mov dword [esi], eax
lea ecx, [ebp + 0xc]
call fcn.10043e40
mov eax, dword [ebp + 0x24]
cmp eax, 0x10
jb 0x100d3ac5
inc eax
push eax
push dword [ebp + 0x10]
call fcn.10048530
add esp, 8
mov eax, dword [ebp + 0xc]
push 8
push eax
mov dword [ebp + 0x20], 0
mov dword [ebp + 0x24], 0xf
mov byte [ebp + 0x10], 0
mov dword [ebp + 0xc], 0
call fcn.10048530
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1011f880
mov esp, ebp
pop ebp
ret 0x24
Function at 0x100e1180
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
push edi
mov edi, ecx
mov eax, dword [edi]
cmp eax, 0x270
jne 0x100e11d0
lea edx, [edi + 8]
mov esi, eax
mov ecx, dword [edx - 4]
lea edx, [edx + 4]
xor ecx, dword [edx - 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub esi, 1
jne 0x100e1192
mov eax, dword [edi]
jmp 0x100e12b7
cmp eax, 0x4e0
jb 0x100e12b7
mov eax, dword [edi + 0x9c4]
push ebx
lea ebx, [edi + 0x9c4]
push ebp
mov ebp, 0xe3
nop
mov ecx, dword [ebx + 4]
lea edx, [ebx + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx + 0x634]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub ebp, 1
jne 0x100e11f0
mov eax, dword [edi + 0xd50]
lea ebx, [edi + 0xd50]
mov ebp, 0x18c
nop word [eax + eax]
mov ecx, eax
lea edx, [ebx + 4]
xor ecx, dword [edx]
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx - 0xd4c]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub ebp, 1
jne 0x100e1240
mov ecx, dword [edi + 0x1380]
xor ecx, dword [edi + 4]
and ecx, 0x7fffffff
xor ecx, dword [edi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop ebp
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi + 0x9c0], eax
xor eax, eax
mov dword [edi], 0
pop ebx
mov edx, dword [edi + eax*4 + 4]
inc eax
mov dword [edi], eax
mov ecx, edx
mov eax, dword [edi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
ret
Function at 0x100e1e70
Capabilities:
Create thread
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10180983
mov eax, dword fs:[0]
push eax
sub esp, 0xc4
mov eax, dword [0x101dadb0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 0
push 0
push 0x100e1e50
push 0
push 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
movaps xmm0, xmmword [0x101c2b40]
xor ecx, ecx
mov eax, dword [0x1027c0b4]
movups xmmword [ebp - 0x60], xmm0
mov dword [ebp - 0x30], 0x60677d7a
movaps xmm0, xmmword [0x101c2db0]
movups xmmword [ebp - 0x50], xmm0
mov byte [eax + 0x154], 0
movaps xmm0, xmmword [0x101c2f00]
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x2c], 0x7b607566
mov dword [ebp - 0x28], 0x1e3a66
nop dword [eax + eax]
mov al, byte [ebp - 0x60]
xor byte [ebp + ecx - 0x5f], al
inc ecx
cmp ecx, 0x3a
jb 0x100e1f00
lea eax, [ebp - 0x5f]
mov byte [ebp - 0x25], 0
push eax
lea ecx, [ebp - 0x98]
call fcn.10046d00
mov byte [ebp - 4], 1
xor ecx, ecx
movaps xmm0, xmmword [0x101c1980]
movups xmmword [ebp - 0x4c], xmm0
mov dword [ebp - 0x2c], 0x51181a1c
movaps xmm0, xmmword [0x101c1ab0]
movups xmmword [ebp - 0x3c], xmm0
mov word [ebp - 0x28], 0x5d
nop dword [eax]
mov al, byte [ebp - 0x4c]
xor byte [ebp + ecx - 0x4b], al
inc ecx
cmp ecx, 0x24
jb 0x100e1f50
lea eax, [ebp - 0x4b]
mov byte [ebp - 0x27], 0
push eax
lea ecx, [ebp - 0x7c]
call fcn.10046d00
mov byte [ebp - 4], 2
xor ecx, ecx
movaps xmm0, xmmword [0x101c25e0]
movups xmmword [ebp - 0x48], xmm0
mov byte [ebp - 0x28], 0
movaps xmm0, xmmword [0x101c1bb0]
movups xmmword [ebp - 0x38], xmm0
nop dword [eax]
mov al, byte [ebp - 0x48]
xor byte [ebp + ecx - 0x47], al
inc ecx
cmp ecx, 0x1f
jb 0x100e1f90
lea eax, [ebp - 0x47]
mov byte [ebp - 0x28], 0
push eax
lea ecx, [ebp - 0xb4]
call fcn.10046d00
mov edx, 0x101b8c74
mov byte [ebp - 4], 3
lea ecx, [ebp + 8]
call fcn.10065150
test al, al
je 0x100e204c
lea eax, [ebp - 0x7c]
push eax
lea edx, [ebp - 0x98]
lea ecx, [ebp - 0x40]
call fcn.1007cd60
add esp, 4
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 4
push ecx
mov edx, eax
lea ecx, [ebp - 0xd0]
call fcn.100de680
movaps xmm0, xmmword [0x101c2770]
add esp, 4
mov edx, eax
mov word [ebp - 0x14], 0x4e
movups xmmword [ebp - 0x24], xmm0
xor ecx, ecx
nop
mov al, byte [ebp - 0x24]
xor byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0x10
jb 0x100e2010
push 0x30
lea eax, [ebp - 0x23]
mov byte [ebp - 0x13], 0
push eax
mov ecx, edx
call fcn.10046ac0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0xd0]
call fcn.10046c30
lea ecx, [ebp - 0x40]
call fcn.10046c30
jmp 0x100e2088
movaps xmm0, xmmword [0x101c19f0]
xor ecx, ecx
movups xmmword [ebp - 0x24], xmm0
mov word [ebp - 0x14], 0x17
nop
mov al, byte [ebp - 0x24]
xor byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0x10
jb 0x100e2060
push 0x30
lea eax, [ebp - 0x23]
mov byte [ebp - 0x13], 0
push eax
lea ecx, [ebp + 8]
call fcn.10046ac0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call fcn.1013f450
int3
Function at 0x100e3c10
Capabilities:
Create thread

Disassembly:
cmp dword [esp + 8], 1
jne 0x100e3c47
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
call sym.BYRACS.dll_Init
push 0
push 0
push 0
push 0x100e3ae0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [0x1027c0b4]
mov dword [ecx + 0x170], eax
mov eax, 1
ret 0xc