joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2005e03
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [ebp - 0x33c], eax
call fcn.02005160
lds ecx, [edx + 4]
movsb byte es:[edi], byte [esi]
push 0x104
lea eax, [ebp - 0x334]
push eax
push dword [ebp + 8]
call dword [ebp - 0x538]
mov dword [ebp - 0x398], eax
cld
invalid
inc esi
test dword [edx + edi*8 - 0x7cfe0001], edi
mov ebp, 0xfffffc68
invalid
je 0x2005e54
cmp dword [ebp - 0x398], 0
je 0x200601e
cmp dword [ebp + 0xc], 1
je 0x200601e
cmp dword [ebp + 0xc], 8
jne 0x2005fe6
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
mov byte [ebp - 0x6ae], 0x16
call dword [esi]
inc esp
stc
invalid
call fcn.02005160
popal
and bh, cl
jb 0x2005f70
movsd dword es:[edi], dword [esi]
mov esp, 0xfffffa
push 0
call dword [ebp - 0x340]
mov dword [ebp + 8], eax
push 0x104
lea eax, [ebp - 0x334]
push eax
push 0
call dword [ebp - 0x538]
call fcn.02005160
dec esi
enter 0xffffffffffffd2cc, 0xffffffffffffff80
movsd dword es:[edi], dword [esi]
sar ch, 1
invalid
and byte [ebp - 0x230], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x22f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
inc dword [eax]

Function at 0x200774e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x200d004]
jne 0x200775f
test ecx, 0xffff0000
jne 0x200775f
ret
jmp fcn.02007769
Function at 0x200784e
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 1
push esi
push edi
jne 0x2007955
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x94
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x2007898
push esi
mov dword [esi], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
push esi
push 0
jne 0x200789f
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
jmp 0x2007948
mov eax, dword [esi + 0x10]
mov dword [0x200d96c], eax
mov eax, dword [esi + 4]
mov dword [0x200d978], eax
mov eax, dword [esi + 8]
mov dword [0x200d97c], eax
mov eax, dword [esi + 0xc]
and eax, 0x7fff
mov dword [0x200d970], eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [0x200d96c], 2
je 0x20078dd
or byte [0x200d971], 0x80
mov eax, dword [0x200d978]
shl eax, 8
add eax, dword [0x200d97c]
push 0
mov dword [0x200d974], eax
call fcn.02008556
test eax, eax
pop ecx
je 0x2007898
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x200f214], eax
call fcn.02008643
mov dword [0x200d950], eax
call fcn.02008045
test eax, eax
jge 0x2007924
call fcn.020085b2
jmp 0x2007898
call fcn.0200848f
test eax, eax
jl 0x200794e
call fcn.02008237
test eax, eax
jl 0x200794e
call fcn.02007f31
test eax, eax
jne 0x200794e
inc dword [0x200d94c]
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
ret 0xc
call fcn.0200820d
jmp 0x200791a
xor esi, esi
cmp dword [ebp + 0xc], esi
jne 0x2007945
cmp dword [0x200d94c], esi
jle 0x2007898
dec dword [0x200d94c]
cmp dword [0x200d9a8], esi
jne 0x200797b
call fcn.0200802d
cmp dword [ebp + 0x10], esi
jne 0x2007945
call fcn.0200820d
call fcn.020085b2
jmp 0x2007945
Function at 0x2008643
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x200dab8]
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push edi
xor ebx, ebx
xor edi, edi
cmp eax, ebx
jne 0x200868f
call esi
mov edi, eax
cmp edi, ebx
je 0x2008675
mov dword [0x200dab8], 1
jmp 0x2008694
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x200868a
push 2
pop eax
mov dword [0x200dab8], eax
jmp 0x200868f
mov eax, dword [0x200dab8]
cmp eax, 1
jne 0x200870c
cmp edi, ebx
jne 0x20086a0
call esi
mov edi, eax
cmp edi, ebx
je 0x2008715
cmp word [edi], bx
mov eax, edi
je 0x20086b5
inc eax
inc eax
cmp word [eax], bx
jne 0x20086a7
inc eax
inc eax
cmp word [eax], bx
jne 0x20086a7
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
push ebx
push ebx
sub eax, edi
push ebx
sar eax, 1
inc eax
push eax
push edi
push ebx
push ebx
mov dword [ebp - 0xc], eax
call esi
mov ecx, eax
cmp ecx, ebx
mov dword [ebp - 8], ecx
je 0x2008703
call fcn.0200a038
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x2008703
push ebx
push ebx
push dword [ebp - 8]
push eax
push dword [ebp - 0xc]
push edi
push ebx
push ebx
call esi
test eax, eax
jne 0x2008700
push dword [ebp - 4]
call fcn.02007c2b
pop ecx
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x2008764
cmp eax, 2
je 0x2008719
cmp eax, ebx
je 0x2008719
xor eax, eax
jmp 0x2008766
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov esi, eax
cmp esi, ebx
mov dword [ebp - 4], esi
je 0x2008715
cmp byte [esi], bl
je 0x2008736
inc eax
cmp byte [eax], bl
jne 0x200872c
inc eax
cmp byte [eax], bl
jne 0x200872c
sub eax, esi
inc eax
mov edi, eax
mov ecx, edi
call fcn.0200a038
cmp eax, ebx
je 0x200875d
mov ecx, edi
mov edx, ecx
shr ecx, 2
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 4]
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x2008770
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword [ebp + 8]
push esi
xor esi, esi
mov dword [ebp - 4], esi
cmp ecx, dword [esi*8 + 0x200d020]
je 0x2008792
inc esi
cmp esi, 0x13
mov dword [ebp - 4], esi
jb 0x2008780
cmp esi, 0x13
je 0x20088ce
mov eax, dword [0x200d958]
cmp eax, 1
push ebx
je 0x200889d
test eax, eax
jne 0x20087bb
cmp dword [0x200d95c], 1
je 0x200889d
cmp ecx, 0xfc
je 0x20088cd
push edi
push 6
pop ecx
mov esi, 0x2002d90
mov edi, 0x200dac0
rep movsd dword es:[edi], dword [esi]
push 0x104
mov ebx, 0x200dada
push ebx
movsw word es:[edi], word [esi]
push 0
mov byte [0x200dbde], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x2008809
push 5
pop ecx
mov esi, 0x2002d78
mov edi, 0x200dada
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x200880e
sub eax, edx
inc eax
cmp eax, 0x3c
jbe 0x2008841
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x2008822
sub eax, edx
push 3
lea eax, [eax + 0x200da9f]
push 0x2002d74
push eax
call fcn.0200ac60
add esp, 0xc
mov edx, 0x200dac0
mov edi, edx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x2008849
mov eax, dword [ebp - 4]
mov eax, dword [eax*8 + 0x200d024]
mov esi, 0x2002d70
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x2008865
mov edi, edx
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x2008871
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0x12010
mov ecx, eax
and ecx, 3
push 0x2002d48
push edx
rep movsb byte es:[edi], byte [esi]
call fcn.0200ab60
add esp, 0xc
pop edi
jmp 0x20088cd
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x20088cd
mov edx, dword [esi*8 + 0x200d024]
mov ecx, edx
lea esi, [ecx + 1]
mov bl, byte [ecx]
inc ecx
test bl, bl
jne 0x20088b5
push 0
sub ecx, esi
lea esi, [ebp - 8]
push esi
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebx
pop esi
leave
ret
Function at 0x200a0c2
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
push edi
push 4
pop eax
call fcn.0200a700
mov dword [ebp - 8], esp
push 0x1c
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x200a1be
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [ebp - 0x4c]
xor esi, esi
cmp dword [0x200d96c], 2
jne 0x200a143
push 0x2003344
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp eax, esi
je 0x200a143
push 0x200332c
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, esi
je 0x200a143
lea ecx, [ebp - 4]
push ecx
mov dword [ebp - 4], esi
call eax
cmp eax, 1
pop ecx
jne 0x200a143
cmp dword [ebp - 4], esi
jbe 0x200a143
mov esi, dword [ebp - 4]
mov edx, dword [0x200d96c]
mov ebx, edx
dec ebx
neg ebx
sbb ebx, ebx
and ebx, 0x103
lea ecx, [edi - 1]
lea eax, [esi + edi - 1]
not ecx
inc ebx
and eax, ecx
mov dword [ebp - 4], eax
je 0x200a16c
add eax, edi
mov dword [ebp - 4], eax
lea ecx, [edi + edi]
cmp eax, ecx
jae 0x200a178
mov dword [ebp - 4], ecx
mov eax, ecx
lea esi, [edi - 1]
not esi
and esi, dword [ebp - 8]
sub esi, eax
cmp edx, 1
jne 0x200a18a
push 0x11
pop edi
mov ecx, dword [ebp - 0xc]
add edi, ecx
cmp esi, edi
jb 0x200a1be
push 4
push 0x1000
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
je 0x200a1be
lea eax, [ebp - 0x10]
push eax
push ebx
push dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x200a1be
xor eax, eax
inc eax
jmp 0x200a1c0
xor eax, eax
lea esp, [ebp - 0x5c]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x200ab60
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x200de08], ebx
push esi
push edi
jne 0x200abe2
push 0x20033e0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x200ac1d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x20033d4
push edi
call esi
test eax, eax
mov dword [0x200de08], eax
je 0x200ac1d
push 0x20033c4
push edi
call esi
push 0x20033b0
push edi
mov dword [0x200de0c], eax
call esi
cmp dword [0x200d96c], 2
mov dword [0x200de10], eax
jne 0x200abe2
push 0x2003394
push edi
call esi
test eax, eax
mov dword [0x200de18], eax
je 0x200abe2
push 0x200337c
push edi
call esi
mov dword [0x200de14], eax
mov eax, dword [0x200de14]
test eax, eax
je 0x200ac27
call eax
test eax, eax
je 0x200ac0e
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x200de18]
test eax, eax
je 0x200ac0e
test byte [ebp - 8], 1
jne 0x200ac27
cmp dword [0x200d978], 4
jb 0x200ac21
or byte [ebp + 0x12], 0x20
jmp 0x200ac46
xor eax, eax
jmp 0x200ac56
or byte [ebp + 0x12], 4
jmp 0x200ac46
mov eax, dword [0x200de0c]
test eax, eax
je 0x200ac46
call eax
mov ebx, eax
test ebx, ebx
je 0x200ac46
mov eax, dword [0x200de10]
test eax, eax
je 0x200ac46
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x200de08]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x200b326
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x424
mov ecx, dword [ebp + 8]
cmp ecx, dword [0x200f0e4]
mov eax, dword [0x200d004]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 0x41c], edi
jae 0x200b50c
mov eax, ecx
sar eax, 5
lea ebx, [eax*4 + 0x200f100]
mov eax, dword [ebx]
mov esi, ecx
and esi, 0x1f
shl esi, 3
mov al, byte [eax + esi + 4]
test al, 1
mov dword [ebp - 0x424], ebx
je 0x200b50c
and dword [ebp - 0x414], 0
and dword [ebp - 0x420], 0
cmp dword [ebp + 0x10], 0
jne 0x200b397
xor eax, eax
jmp 0x200b520
test al, 0x20
je 0x200b3aa
push 2
push 0
push 0
push ecx
call fcn.0200bef5
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x200b46a
and dword [ebp - 0x40c], 0
cmp dword [ebp + 0x10], 0
mov dword [ebp - 0x410], edi
jbe 0x200b4e6
mov ecx, dword [ebp - 0x410]
xor edi, edi
sub ecx, dword [ebp - 0x41c]
lea eax, [ebp - 0x408]
cmp ecx, dword [ebp + 0x10]
jae 0x200b419
mov edx, dword [ebp - 0x410]
inc dword [ebp - 0x410]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x200b407
inc dword [ebp - 0x420]
mov byte [eax], 0xd
inc eax
inc edi
mov ebx, dword [ebp - 0x424]
mov byte [eax], dl
inc eax
inc edi
cmp edi, 0x400
jl 0x200b3e3
mov edi, eax
lea eax, [ebp - 0x408]
sub edi, eax
push 0
lea eax, [ebp - 0x418]
push eax
push edi
lea eax, [ebp - 0x408]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x200b498
mov eax, dword [ebp - 0x418]
add dword [ebp - 0x414], eax
cmp eax, edi
jl 0x200b4a4
mov eax, dword [ebp - 0x410]
sub eax, dword [ebp - 0x41c]
cmp eax, dword [ebp + 0x10]
jb 0x200b3cf
jmp 0x200b4a4
push 0
lea ecx, [ebp - 0x418]
push ecx
push dword [ebp + 0x10]
push edi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x200b498
mov eax, dword [ebp - 0x418]
and dword [ebp - 0x40c], 0
mov dword [ebp - 0x414], eax
jmp 0x200b4a4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x40c], eax
mov eax, dword [ebp - 0x414]
test eax, eax
jne 0x200b504
cmp dword [ebp - 0x40c], eax
je 0x200b4e0
push 5
pop eax
cmp dword [ebp - 0x40c], eax
jne 0x200b4d2
mov dword [0x200d960], 9
mov dword [0x200d964], eax
jmp 0x200b51d
push dword [ebp - 0x40c]
call fcn.0200bdbf
pop ecx
jmp 0x200b51d
mov edi, dword [ebp - 0x41c]
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x200b4f8
cmp byte [edi], 0x1a
je 0x200b390
mov dword [0x200d960], 0x1c
jmp 0x200b516
sub eax, dword [ebp - 0x420]
jmp 0x200b520
mov dword [0x200d960], 9
and dword [0x200d964], 0
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0200774e
leave
ret
Function at 0x200bb8e
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x200bbbf
mov eax, dword fs:[4]
mov dword [ebp + 8], eax
mov eax, dword fs:[8]
mov dword [ebp - 4], eax
cmp ebx, dword [ebp - 4]
jb 0x200bbc6
cmp ebx, dword [ebp + 8]
jae 0x200bbc6
xor eax, eax
jmp 0x200bdb6
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x200bbd7
xor eax, eax
inc eax
jmp 0x200bdb5
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x200bbed
cmp ecx, edx
jae 0x200bd32
cmp dword [eax + 4], 0
je 0x200bbf6
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x200bbde
cmp dword [ebp + 8], 0
je 0x200bc18
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x200bd32
cmp eax, esi
jae 0x200bd32
mov eax, dword [0x200de28]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x200bc3d
cmp dword [esi*4 + 0x200de30], edi
je 0x200bd36
inc esi
cmp esi, eax
jl 0x200bc2b
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x200bdb2
cmp dword [ebp - 8], 0x1000000
jne 0x200bdb2
test byte [ebp - 0xc], 0xcc
je 0x200bcbb
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x200bdb2
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x200bdb2
cmp word [eax + 0x18], 0x10b
jne 0x200bdb2
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x200bdb2
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x200bcbb
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x200bcbb
test byte [ecx + 0x27], 0x80
jne 0x200bd32
push 1
push 0x200de70
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
test eax, eax
jne 0x200bbcf
mov ecx, dword [0x200de28]
test ecx, ecx
mov edx, ecx
jle 0x200bcef
lea eax, [ecx*4 + 0x200de2c]
cmp dword [eax], edi
je 0x200bcef
dec edx
sub eax, 4
test edx, edx
jg 0x200bce3
test edx, edx
jne 0x200bd20
push 0xf
pop ebx
cmp ecx, ebx
jg 0x200bcfc
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x200bd14
lea eax, [edx*4 + 0x200de30]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x200bd02
cmp ecx, 0x10
jge 0x200bd20
inc ecx
mov dword [0x200de28], ecx
push 0
push 0x200de70
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
jmp 0x200bbcf
xor eax, eax
jmp 0x200bdb5
test esi, esi
jle 0x200bbcf
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 1
push 0x200de70
call ebx
test eax, eax
jne 0x200bbcf
cmp dword [esi*4 + 0x200de30], edi
je 0x200bd8c
mov eax, dword [0x200de28]
lea esi, [eax - 1]
test esi, esi
jl 0x200bd7a
cmp dword [esi*4 + 0x200de30], edi
je 0x200bd76
dec esi
jns 0x200bd6a
test esi, esi
jge 0x200bd8a
cmp eax, 0x10
jge 0x200bd85
inc eax
mov dword [0x200de28], eax
lea esi, [eax - 1]
jmp 0x200bd8c
je 0x200bda4
xor ecx, ecx
test esi, esi
jl 0x200bda4
lea eax, [ecx*4 + 0x200de30]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x200bd92
push 0
push 0x200de70
call ebx
jmp 0x200bbcf
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10001cd9
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005c87b
call fcn.1005c3e4
sub esp, 0x14
mov byte [ebp - 0x14], cl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test cl, cl
je 0x10001d0e
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax]
mov eax, dword [ebp + 0x14]
add dword [eax], ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x1c], 0x65cf
cmp dword [ebp - 0x1c], 0x66d2
jle 0x10001d64
xor esi, esi
mov dword [ebp - 0x18], esi
xor edi, edi
and dword [ebp - 0x20], 0
mov ebx, esi
mov esi, dword [ebp - 0x20]
mov ecx, edi
sar ebx, cl
mov eax, ebx
mov ecx, 0x100758b8
xor eax, esi
cdq
push edx
push eax
call fcn.10004429
inc esi
cmp esi, 0x1381
jl 0x10001d32
mov esi, dword [ebp - 0x18]
inc edi
cmp edi, 0x2302
jl 0x10001d25
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0xa78
jl 0x10001d23
mov eax, dword [ebp + 0x10]
xor ecx, ecx
and dword [ebp - 4], ecx
cmp dword [ebp - 0x1c], 0x6310
mov word [eax], cx
jge 0x10001cfd
mov edx, str.jmpbsdnp_rqwzv_rbbumhg_aiqiumo_ufwsy_volzqcq_ecjuah_rxm_mlnjx
mov ecx, 0x100758b8
call fcn.100067d6
jmp 0x10001cfd

Function at 0x10001f68
Capabilities:
Encode data using xor
Query environment variable

Disassembly:
mov eax, 0x1005c88f
call fcn.1005c3e4
sub esp, 0x18
mov byte [ebp - 0x14], dl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test dl, dl
je 0x10001fa3
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x18]
and dword [ebp - 0x18], 0
push eax
call fcn.10004760
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x1c], 0x2180
cmp dword [ebp - 0x1c], 0x247c
jle 0x10002004
xor esi, esi
mov dword [ebp - 0x18], esi
xor edi, edi
and dword [ebp - 0x20], 0
mov ebx, edi
and ebx, esi
mov esi, dword [ebp - 0x20]
mov eax, ebx
mov ecx, 0x100758b8
xor eax, esi
cdq
push edx
push eax
call fcn.10004429
inc esi
cmp esi, 0x11c2
jl 0x10001fc5
mov esi, dword [ebp - 0x18]
inc edi
cmp edi, 0x30b5
jl 0x10001fba
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x3a28
jl 0x10001fb8
push 0x142d
push 0
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
push 0x1a5c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [ebp - 4], 2
cmp dword [ebp - 0x1c], 0x1f7b
jge 0x10001f92
mov edx, str.stmzjml_zbkhxgw_ibpdmsw_bsiels_enae_elwny_mtozrw_karcg_czw_eqlfn_ihgugq_nqs_idh
mov ecx, 0x100758b8
call fcn.100067d6
jmp 0x10001f92
Function at 0x10008572
Capabilities:
Get session user name

Disassembly:
mov eax, 0x1005cb4e
call fcn.1005c3e4
push ecx
push ecx
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
je 0x100085ee
cmp byte [ebp + 0x18], 0
je 0x100085ca
cmp byte [ecx], 0
je 0x100086a1
push 0x4ac7
push 0x559f
push 0x10c6
push 0x7480
push 1
push 0
push 0x7a32
mov edx, 0x4dc7
mov cl, 1
call fcn.1000a386
add esp, 0x1c
jmp 0x100086a1
cmp byte [edx], 0
je 0x100086a1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetClipBox]
jmp 0x100086a1
cmp byte [ebp + 0x1c], 0
je 0x1000868f
mov dword [ebp + 0x10], 0x5d93
cmp dword [ebp + 0x10], 0x5ff7
jle 0x10008631
xor esi, esi
xor edi, edi
mov ecx, edi
mov eax, esi
sar eax, cl
mov ecx, 0x100758b8
cdq
push edx
push eax
call fcn.10004429
inc edi
cmp edi, 0x6477
jl 0x1000860c
inc esi
cmp esi, 0x37dd
jl 0x1000860a
and dword [ebp - 4], 0
cmp dword [ebp + 0x10], 0x5c75
jge 0x1000864d
mov edx, str.mfyalegln_rpkjm_tsice_ickkejdw_nvbdofrwp_rnx_jjhi
mov ecx, 0x100758b8
call fcn.100067d6
mov ecx, dword [ebp + 0x24]
mov edx, dword [ebp + 0x14]
mov eax, dword [ecx]
mov eax, dword [ecx]
xor ecx, ecx
test eax, eax
mov eax, dword [edx]
sets cl
imul eax, ecx
mov ecx, dword [ebp + 0xc]
cmp eax, dword [ecx]
jge 0x1000866c
mov eax, dword [edx]
mov eax, dword [ebp + 0x20]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x100086a1
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x100086a1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100086ce
Capabilities:
Create pipe

Disassembly:
mov eax, 0x1005cb58
call fcn.1005c3e4
sub esp, 0x14
mov byte [ebp - 0x18], cl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test cl, cl
je 0x100087aa
mov esi, dword [ebp + 8]
mov dword [ebp - 0x20], esi
mov dword [esi], 0xf
cmp dword [esi], 0xffffffeb
jl 0x100087d2
mov dword [ebp - 0x1c], 0x4d81
cmp dword [ebp - 0x1c], 0x512f
jle 0x1000873a
xor edi, edi
xor ebx, ebx
mov ecx, ebx
mov eax, edi
sar eax, cl
mov ecx, 0x100758b8
cdq
push edx
push eax
call fcn.10004429
inc ebx
cmp ebx, 0x1ea7
jl 0x10008715
inc edi
cmp edi, 0x1339
jl 0x10008713
push 1
push 0x614e
push 0x5bca
lea eax, [ebp - 0x11]
mov byte [ebp - 0x11], 0
push eax
push 0x6388
push 0x76fc
xor dl, dl
mov cl, 1
call fcn.10009fcc
and dword [ebp - 4], 0
add esp, 0x18
cmp dword [ebp - 0x1c], 0x4aa4
jge 0x1000879f
mov edx, str.kpcpwlbg_zrbaafu_xqvujfte_bphotumzn_ytls_enzqhn_wwkhgckd_fcjtpsmh_ekz_kdz_detdjeif_dxrw_bdgchykyo
mov ecx, 0x100758b8
call fcn.100067d6
jmp 0x1000879f
or dword [ebp - 4], 0xffffffff
dec dword [esi]
jmp 0x100086f8
push 0
push 0xae1
push 0x10a9
push 0x1c57
push 0x1dca
push 0x24e1
push 0xc3e
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10009eef
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
push esi
push edi
lea eax, [esp + 0x14]
push eax
push ecx
push 1
push ecx
push ecx
push 0x3795
call fcn.10009c50
mov dword [esp + 0x28], 0x1935
add esp, 0x18
cmp dword [esp + 0x10], 0x1c5e
jle 0x10009f99
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
xor edi, edi
xor ebx, ebx
xor esi, esi
xor ecx, ecx
mov dword [esp + 0x10], 0x2a2c
mov dword [esp + 0xc], ecx
mov eax, ebx
shl eax, cl
lea ecx, [esp + 0x18]
and eax, edi
cdq
push edx
push eax
call fcn.10001a65
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10009f5a
mov eax, dword [eax]
push eax
call fcn.100442bc
pop ecx
push 0
push 1
lea ecx, [esp + 0x20]
call fcn.10004a91
mov ecx, dword [esp + 0xc]
add ecx, esi
dec dword [esp + 0x10]
mov dword [esp + 0xc], ecx
jne 0x10009f3e
inc esi
cmp esi, 0x655f
jl 0x10009f30
inc ebx
cmp ebx, 0x1499
jl 0x10009f2e
inc edi
cmp edi, 0x45a7
jl 0x10009f2c
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret