joyce8/EMBER2024-capa huggingface dataset:
Function at 0x201739
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.00201739
xor esi, esi
xor edi, edi
mov ecx, 0x48
push esi
dec ecx
jne 0x201755
push 0x104
lea ebx, [ebp - 0x19c]
push ebx
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
fldcw word [ebp - 0x10]
xor eax, eax
call fcn.00208a90
xor eax, eax
call fcn.0020b206
mov ebx, dword [ebp + 8]
call fcn.00208328
call fcn.0020a0df
mov eax, 3
mov ebx, dword [ebp + 8]
mov edx, dword [ebx]
call fcn.0020a0c8
mov dword [ebp - 0x30], eax
call fcn.0020a094
cmp eax, dword [ebp - 0x30]
jl 0x2017eb
mov eax, 0x3a
mov ebx, dword [ebp + 8]
mov edx, dword [ebx]
call fcn.0020a0c8
mov ecx, 2
xchg ecx, eax
call fcn.002091d8
cmp eax, ecx
jne 0x2017eb
mov eax, 0x5c
mov ebx, dword [ebp + 8]
mov edx, dword [ebx]
call fcn.0020a0c8
mov ecx, 3
xchg ecx, eax
call fcn.002091d8
cmp eax, ecx
je 0x2018f2
mov eax, 1
mov ecx, 0xffffffff
lea ebx, [ebp - 0x19c]
call fcn.0020a200
mov edx, 0x20ce14
call fcn.0020a15c
xchg ecx, eax
call fcn.002067bc
add eax, ecx
mov esi, eax
mov eax, 0xffffffff
lea ebx, [ebp - 0x19c]
call fcn.0020a200
mov edx, 0x20ce1c
call fcn.0020a15c
call fcn.002067bc
mov edi, eax
cmp edi, esi
jge 0x20189d
mov eax, 0x40
lea ebx, [ebp - 0x19c]
call fcn.0020a200
mov ecx, 1
add ecx, esi
xchg ecx, eax
call fcn.002091d8
cmp eax, ecx
jne 0x20189d
lea ebx, [ebp - 0x19c]
call fcn.0020a200
mov ecx, esi
mov eax, 1
call fcn.00207fdf
mov edx, 0x20ced4
call fcn.0020a15c
call fcn.0020af60
lea ebx, [ebp - 0x19c]
mov ecx, 0x104
call fcn.0020a249
jmp 0x2018bc
push 0x104
lea ebx, [ebp - 0x19c]
push ebx
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
fldcw word [ebp - 0x10]
mov dword [0x20ca58], 1
lea ebx, [ebp - 0x19c]
call fcn.0020a200
mov ecx, 1
mov eax, 3
call fcn.00207fdf
mov edx, 0x20cedc
call fcn.0020a15c
call fcn.0020af60
mov ebx, dword [ebp + 8]
call fcn.0020a0df
jmp 0x2019b1
mov eax, 0x2a
mov ebx, dword [ebp + 8]
mov edx, dword [ebx]
call fcn.0020a0c8
mov ebx, dword [ebp + 8]
mov edx, dword [ebx]
call fcn.0020a0c8
mov dword [ebp - 0x30], eax
call fcn.0020a094
call fcn.002091d8
cmp eax, dword [ebp - 0x30]
jne 0x201961
mov dword [ebp - 0x98], 1
mov ebx, dword [ebp + 8]
mov edx, dword [ebx]
call fcn.0020a0c8
mov ecx, 1
mov eax, 1
mov ebx, dword [ebp + 8]
mov edx, dword [ebx]
call fcn.0020a0c8
mov dword [ebp - 0x30], eax
call fcn.0020a094
sub eax, dword [ebp - 0x30]
call fcn.00207fdf
mov ebx, dword [ebp + 8]
call fcn.0020a0df
mov eax, 0x5c
mov ebx, dword [ebp + 8]
mov edx, dword [ebx]
call fcn.0020a0c8
mov ebx, dword [ebp + 8]
mov edx, dword [ebx]
call fcn.0020a0c8
mov dword [ebp - 0x30], eax
call fcn.0020a094
call fcn.002091d8
cmp eax, dword [ebp - 0x30]
je 0x2019b1
mov ebx, dword [ebp + 8]
mov edx, dword [ebx]
call fcn.0020a0c8
mov edx, 0x20ce1c
call fcn.0020a15c
call fcn.0020af60
mov ebx, dword [ebp + 8]
call fcn.0020a0df
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x201a5c
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.00201a5c
xor esi, esi
push esi
push esi
push esi
push esi
push esi
push esi
mov ebx, dword [ebp + 8]
mov edx, dword [ebx]
call fcn.0020a0c8
mov edx, 0x20ce1c
call fcn.0020a15c
call fcn.00208f5c
lea ebx, [ebp - 0x9c]
call fcn.0020a0df
mov eax, 2
mov edx, dword [ebp - 0x9c]
call fcn.0020a0c8
mov dword [ebp - 0x30], eax
call fcn.0020a094
cmp eax, dword [ebp - 0x30]
jle 0x201b3e
xor eax, eax
mov edx, dword [ebp - 0x9c]
call fcn.0020a0c8
mov ecx, 0x10
xor ebx, ebx
xchg ecx, eax
call fcn.00208360
call fcn.002054a4
call fcn.0020b110
cmp eax, ecx
jne 0x201b3e
push 0
lea ebx, [ebp - 0x9c]
push ebx
call fcn.002019d2
call fcn.0020a174
mov ebx, esp
push ebx
call fcn.0020a0df
call fcn.00201a5c
mov ebx, eax
pop eax
call fcn.0020890a
mov eax, ebx
test eax, eax
je 0x201b39
push 0
lea ebx, [ebp - 0x9c]
call fcn.0020a4c5
mov eax, ebx
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
fldcw word [ebp - 0x10]
mov dword [ebp - 0x98], eax
jmp 0x201b48
mov dword [ebp - 0x98], 1
call fcn.00209f9c
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x2023f5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.002023f5
xor esi, esi
xor edi, edi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push 0xa
mov ebx, dword [ebp + 8]
call fcn.0020a4c5
mov eax, ebx
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
fldcw word [ebp - 0x10]
mov esi, eax
cmp esi, 0
je 0x2024d2
mov eax, esi
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
fldcw word [ebp - 0x10]
mov edi, eax
mov eax, esi
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_LoadResource]
fldcw word [ebp - 0x10]
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0xa4]
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
fldcw word [ebp - 0x10]
mov dword [ebp - 0xa8], eax
mov ebx, edi
xor eax, eax
call fcn.002081c8
lea ebx, [ebp - 0xac]
call fcn.0020a0df
lea ebx, [ebp - 0xac]
call fcn.0020a4c5
mov eax, ebx
mov ecx, dword [ebp - 0xa8]
mov dword [ebp - 0x30], eax
mov eax, edi
call fcn.00208914
mov eax, dword [ebp - 0x30]
call fcn.00208977
mov eax, dword [ebp - 0xa4]
push eax
call dword [sym.imp.KERNEL32.DLL_FreeResource]
fldcw word [ebp - 0x10]
mov edx, dword [ebp - 0xac]
call fcn.0020a0c8
lea ebx, [ebp - 0x98]
call fcn.0020a0df
call fcn.00209f9c
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x2024fc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.002024fc
xor esi, esi
mov ecx, 0x4a
push esi
dec ecx
jne 0x202516
mov ebx, dword [ebp + 8]
mov edx, dword [ebx]
call fcn.0020a0c8
mov ecx, 2
mov eax, 1
call fcn.00207fdf
mov edx, 0x20cf2c
call fcn.0020a15c
call fcn.00209dc0
je 0x2025df
push 0
call dword [sym.imp.OLE32.DLL_CoInitialize]
fldcw word [ebp - 0x10]
push 0
lea ebx, [ebp - 0x1a4]
push ebx
xor eax, eax
push eax
push 0
call dword [sym.imp.SHELL32.DLL_SHGetSpecialFolderLocation]
fldcw word [ebp - 0x10]
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jne 0x20258d
lea ebx, [ebp - 0x19c]
push ebx
mov eax, dword [ebp - 0x1a4]
push eax
call dword [sym.imp.SHELL32.DLL_SHGetPathFromIDListA]
fldcw word [ebp - 0x10]
mov eax, dword [ebp - 0x1a4]
push eax
call dword [sym.imp.OLE32.DLL_CoTaskMemFree]
fldcw word [ebp - 0x10]
call dword [sym.imp.OLE32.DLL_CoUninitialize]
fldcw word [ebp - 0x10]
lea ebx, [ebp - 0x19c]
call fcn.0020a200
mov edx, 0x20ce1c
call fcn.0020a15c
call fcn.0020af60
mov ebx, dword [ebp + 8]
mov edx, dword [ebx]
call fcn.0020a0c8
call fcn.0020af60
lea ebx, [ebp - 0x1a8]
call fcn.0020a0df
jmp 0x2025f4
mov ebx, dword [ebp + 8]
mov edx, dword [ebx]
call fcn.0020a0c8
lea ebx, [ebp - 0x1a8]
call fcn.0020a0df
xor edx, edx
push edx
push edx
push edx
mov edx, 0x20cefc
call fcn.0020a15c
lea ebx, [esp + 8]
push ebx
call fcn.0020a0df
mov eax, 1
push eax
xor eax, eax
push eax
mov edx, 0x20cefc
call fcn.0020a15c
lea ebx, [esp + 0x10]
push ebx
call fcn.0020a0df
mov ebx, dword [ebp + 0x10]
push ebx
mov edx, 0x20cefc
call fcn.0020a15c
lea ebx, [esp + 0x14]
push ebx
call fcn.0020a0df
mov ebx, dword [ebp + 0xc]
push ebx
lea ebx, [ebp - 0x1a8]
push ebx
call fcn.00201138
mov ebx, eax
pop eax
call fcn.0020890a
pop eax
call fcn.0020890a
pop eax
call fcn.0020890a
mov eax, ebx
mov esi, eax
call fcn.00209f9c
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x202844
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.00202844
xor esi, esi
xor edi, edi
mov ecx, 0x10
push esi
dec ecx
jne 0x202860
mov esi, 3
nop
nop
nop
nop
nop
nop
push 0
mov eax, esi
add eax, 0x40
call fcn.002050f7
call fcn.002050a8
lea ebx, [ebp - 0xa8]
call fcn.0020a0df
mov edx, dword [ebp - 0xa8]
call fcn.0020a0c8
mov edx, 0x20ced4
call fcn.0020a15c
call fcn.0020af60
lea ebx, [ebp - 0xac]
call fcn.0020a0df
lea ebx, [ebp - 0xac]
call fcn.0020a4c5
mov eax, ebx
push eax
call dword [sym.imp.KERNEL32.DLL_GetDriveTypeA]
fldcw word [ebp - 0x10]
mov edi, eax
cmp edi, 0
je 0x202905
cmp edi, 1
je 0x202905
cmp edi, 5
je 0x202905
mov edx, dword [ebp - 0xa8]
call fcn.0020a0c8
call fcn.00208360
call fcn.00208cf6
fistp qword [ebp - 0xb8]
jmp 0x202911
fild dword [0x20d220]
fistp qword [ebp - 0xb8]
fild dword [0x20d220]
fild qword [ebp - 0xb8]
fcompp
fnstsw ax
sahf
jbe 0x202e84
fild dword [0x20d26c]
fild qword [ebp - 0xb8]
fcompp
fnstsw ax
sahf
jbe 0x2029d0
fild dword [0x20d26c]
fild qword [ebp - 0xb8]
call fcn.002099b8
fistp qword [ebp - 0xb8]
mov dword [ebp - 0xbc], 0x4b
fild dword [0x20d26c]
fild qword [ebp - 0xb8]
fcompp
fnstsw ax
sahf
jbe 0x2029d0
fild dword [0x20d26c]
fild qword [ebp - 0xb8]
call fcn.002099b8
fistp qword [ebp - 0xb8]
mov dword [ebp - 0xbc], 0x4d
fild dword [0x20d26c]
fild qword [ebp - 0xb8]
fcompp
fnstsw ax
sahf
jbe 0x2029d0
fild dword [0x20d26c]
fild qword [ebp - 0xb8]
call fcn.002099b8
fistp qword [ebp - 0xb8]
mov dword [ebp - 0xbc], 0x47
mov eax, edi
call fcn.00209f8a
add byte [eax], al
add byte [eax], al
pop es
add byte [eax], al
add byte [ebx + 0x2d], dh
and byte [eax], al
jmp [ecx]
inc esi
cmp esi, 0x1a
jle 0x202870
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x98], eax
call fcn.00209f9c
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x204a30
Capabilities:
Accept command line arguments
Allocate thread local storage
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, section..data
test word [0x204a12], 0x100
jne 0x204a4b
jmp 0x204e7c
jmp fcn.00204c69
call fcn.00204b65
mov dword [ebx + 0x600], 1
mov dword [ebx + 0x5dc], 0
lea eax, [ebx + 0x8e4]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
mov cx, word [0x204a12]
mov edx, dword [ebx + 0x8f4]
test cx, 0x20
jne 0x204ef1
cmp edx, 2
je 0x204f00
test cx, 0x40
jne 0x204ef1
push 0x12000
push 0
call 0x204edf
push edi
imul ebp, dword [esi + 0x39], 0x6f4e2038
and byte [ebx + 0x75], dl
jo 0x204f4b
outsd dx, dword [esi]
jb 0x204f52
add byte [edx], ch
call dword [sym.imp.USER32.DLL_MessageBoxA]
push 0xff
jmp 0x204fba
call fcn.00204c69
or dword [ebx + 0x5dc], 0x80
sub esp, 0x44
mov dword [esp], 0x44
mov dword [esp + 0x2c], 0
push esp
call dword [sym.imp.KERNEL32.DLL_GetStartupInfoA]
mov eax, 0xa
test dword [esp + 0x2c], 1
je 0x204f2d
movzx eax, word [esp + 0x30]
add esp, 0x44
mov dword [ebx + 0x5f4], eax
call dword [sym.imp.KERNEL32.DLL_GetCommandLineW]
call fcn.00204bfd
mov dword [ebx + 0x5f0], eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
xor bl, ah
and byte [eax], al
mov dword [ebx + 0x5fc], eax
call fcn.00204a50
push 0xff
jb 0x204fba
add eax, 0xf6e80000
cli
invalid
pop eax
push 0
call dword [sym.imp.OLE32.DLL_CoInitialize]
movzx ecx, word [0x204a10]
jecxz 0x204f7f
push ecx
push 8
push esp
call dword [sym.imp.COMCTL32.DLL_InitCommonControlsEx]
pop eax
pop eax
call fcn.00204ab1
push eax
mov ebx, section..data
mov ecx, dword [ebx + 0xdc]
call fcn.00204fc0
mov ecx, dword [ebx + 0xb8]
jecxz 0x204fa4
push ecx
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov edi, dword [ebx + 0x638]
call fcn.00204ab6
call fcn.00204a9d
call dword [sym.imp.OLE32.DLL_CoUninitialize]
call dword [sym.imp.KERNEL32.DLL_ExitProcess]

Function at 0x204a50
Capabilities:
Allocate thread local storage

Disassembly:
call dword [sym.imp.KERNEL32.DLL_TlsAlloc]
cmp eax, 0xffffffff
stc
je 0x204a9c
mov dword [ebx + 0x5e0], eax
mov dword [ebx + 0x5e8], 0
call fcn.00204d5c
jb 0x204a9c
mov dword [ebx + 0x5e4], eax
mov dword [eax + 0x68], 1
mov dword [eax + 0x6c], 1
mov dword [eax + 0x70], 2
mov dword [eax + 0x74], 3
mov dword [eax + 0x78], 0
ret
Function at 0x204fcc
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
sub esp, 0x280
mov dword [esp], eax
mov dword [esp + 4], ecx
and eax, 0x7fff
mov esi, eax
cld
xor eax, eax
mov ecx, 4
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
mov ecx, 0x11
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
lea edx, [esp + 0x5c]
call fcn.0020b184
mov dword [esp + 0x18], 0x44
mov dword [esp + 0x44], 1
mov word [esp + 0x48], si
lea eax, [esp + 8]
lea ebx, [esp + 0x18]
mov edi, dword [esp + 4]
push edi
push 0
push 0xc
mov ecx, esp
push eax
push ebx
push 0
push 0
push 0x20
push edi
push ecx
push ecx
push edx
push 0
mov edx, dword [sym.imp.KERNEL32.DLL_CreateProcessW]
call fcn.0020b018
pop ecx
pop ecx
pop ecx
jae 0x20504f
test eax, eax
je 0x205096
mov ebx, dword [esp + 0x10]
test dword [esp], 0x8000
je 0x205076
push 0xffffffffffffffff
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov eax, dword [esp + 8]
push eax
push esp
push eax
call dword [sym.imp.KERNEL32.DLL_GetExitCodeProcess]
pop ebx
push dword [esp + 8]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, ebx
add esp, 0x280
pop edi
pop esi
pop ebx
ret
add esp, 0x280
pop edi
pop esi
pop ebx
xor eax, eax
jmp fcn.00204c75

Function at 0x2050a8
Capabilities:
Terminate process

Disassembly:
push eax
push ecx
push esi
push edi
lea esi, [esp + 0x18]
mov ecx, dword [esi - 4]
push ecx
call fcn.00208620
jb 0x2050de
jecxz 0x2050cb
lea esi, [esi + ecx*4 - 4]
mov eax, dword [esi]
mov byte [edi], al
sub esi, 4
inc edi
loop 0x2050c1
call fcn.0020a3e6
pop edx
pop edi
pop esi
pop ecx
pop eax
shl edx, 2
pop dword [esp + edx]
add esp, edx
ret
call fcn.0020a3e4
pop edx
pop edi
pop esi
pop ecx
add esp, 4
shl edx, 2
pop dword [esp + edx]
add esp, edx
jmp fcn.00204c80

Function at 0x205410
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
call fcn.002086f4
jb 0x205467
mov al, byte [esi + 0xc]
test al, 0xa
jne 0x20545b
test al, 1
jne 0x20542e
test word [esi + 0x2c], 2
jne 0x20545f
jmp 0x20545b
push ecx
call fcn.00206024
mov edx, ecx
pop ecx
jb 0x20546c
test word [esi + 0xe], 8
jne 0x20544e
test edx, edx
je 0x20545f
cmp byte [esi + ebx + 0x44], 0x1a
je 0x20545f
jmp 0x20545b
cmp edx, 2
jb 0x20545f
cmp word [esi + ebx + 0x44], 0x1a
je 0x20545f
xor eax, eax
jmp 0x205464
mov eax, 0xffffffff
pop esi
pop ebx
ret
mov eax, 0x35
mov edx, eax
pop esi
pop ebx
mov eax, 0xffffffff
jmp fcn.00204c75
Function at 0x2054a4
Capabilities:
Get disk information
Terminate process

Disassembly:
push eax
push ebx
push ecx
push esi
push edi
push ebp
mov ebp, esp
sub esp, 0x4b0
mov edi, eax
call fcn.00204d5c
mov ebx, eax
lea edx, [ebp - 0x224]
push ebp
mov ebp, dword [ebp]
call fcn.0020b184
pop ebp
test eax, eax
je 0x2055ea
xor ecx, ecx
xchg dword [ebx + 8], ecx
jecxz 0x2054ea
push eax
push edx
push ecx
mov edx, dword [sym.imp.KERNEL32.DLL_FindClose]
call fcn.0020b018
pop edx
pop eax
mov esi, edx
shl eax, 1
add esi, eax
mov ax, word [esi - 2]
and edi, 0x9e
test edi, 0x80
je 0x205510
test edi, 0x16
jne 0x205510
xor edi, 0x80
mov dword [ebx + 0xc], edi
test edi, 8
jne 0x205562
cmp ax, 0x3a
je 0x205527
cmp ax, 0x5c
jne 0x20553e
mov word [esi], 0x2a
mov word [esi + 2], 0x2e
mov word [esi + 4], 0x2a
mov word [esi + 6], 0
lea eax, [ebp - 0x4b0]
push eax
push edx
mov edx, dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
call fcn.0020b018
cmp eax, 0xffffffff
je 0x20561b
mov dword [ebx + 8], eax
jmp 0x20561b
push eax
cld
xor al, al
mov ecx, 0x250
lea edi, [ebp - 0x4b0]
rep stosb byte es:[edi], al
pop eax
cmp dword [edx], 0x5c005c
jne 0x20558a
cmp ax, 0x5c
je 0x205597
mov dword [esi], 0x5c
jmp 0x205597
mov word [edx + 2], 0x3a
mov dword [edx + 4], 0x5c
push 0
push 0
lea eax, [ebp - 0x4b0]
push eax
lea eax, [ebp - 0x48c]
push eax
push 0
push 0x208
lea eax, [ebp - 0x484]
push eax
push edx
call dword [sym.imp.KERNEL32.DLL_GetVolumeInformationW]
xor ecx, ecx
xor esi, esi
test eax, eax
je 0x2056e7
lea esi, [ebp - 0x484]
jmp 0x2056b8
xor ecx, ecx
test dword [ebx + 8], 0xffffffff
je 0x2056e7
test dword [ebx + 0xc], 8
jne 0x2056e7
lea edx, [ebp - 0x4b0]
push edx
push dword [ebx + 8]
mov edx, dword [sym.imp.KERNEL32.DLL_FindNextFileW]
call fcn.0020b018
cmp eax, 0xffffffff
je 0x20562a
lea esi, [ebp - 0x484]
test eax, eax
jne 0x205654
cld
xor al, al
mov ecx, 0x250
lea edi, [ebp - 0x4b0]
rep stosb byte es:[edi], al
xor ecx, ecx
mov byte [esi], cl
mov dword [ebx + 0xc], ecx
xchg dword [ebx + 8], ecx
jecxz 0x205652
push ecx
mov edx, dword [sym.imp.KERNEL32.DLL_FindClose]
call fcn.0020b018
jmp 0x2056b8
mov eax, dword [ebp - 0x4b0]
mov ecx, dword [ebx + 0xc]
test ecx, 8
je 0x20566e
test eax, 8
je 0x205606
jmp 0x2056b8
and eax, 0x16
je 0x2056a8
test eax, 2
je 0x205682
test ecx, 2
je 0x205606
test eax, 4
je 0x205695
test ecx, 4
je 0x205606
test eax, 0x10
je 0x2056a8
test ecx, 0x10
je 0x205606
test ecx, 0x80
je 0x2056b8
test ecx, eax
je 0x205606
cld
xor eax, eax
mov ecx, 0x103
mov edi, esi
repne scasw ax, word es:[edi]
lea ecx, [edi - 2]
sub ecx, esi
shr ecx, 1
mov eax, dword [esi]
cmp eax, 0x2e
je 0x205606
cmp eax, 0x2e002e
jne 0x2056e7
cmp ecx, 2
je 0x205606
push ecx
push esi
cld
mov ecx, 0x250
lea esi, [ebp - 0x4b0]
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x2056fe
rep movsb byte es:[edi], byte [esi]
pop esi
pop ecx
push ebp
mov ebp, dword [ebp]
call fcn.0020a494
pop ebp
mov esp, ebp
pop ebp
pop edi
pop esi
pop ecx
pop ebx
jb 0x205715
pop eax
ret
mov edx, eax
pop eax
jmp fcn.00204c75
Function at 0x2057fc
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov ecx, eax
mov ax, word [ebp - 0x46]
call fcn.002086f4
jb 0x205872
test word [esi + 0xc], 0x20
je 0x20586e
call fcn.00208620
jb 0x205874
push ecx
push edx
lea edx, [esi + 0x3c]
push 0
push edx
push ecx
push edi
push dword [esi + 6]
mov edx, dword [sym.imp.KERNEL32.DLL_ReadFile]
call fcn.0020b018
mov al, dl
pop edx
pop ecx
jb 0x205865
and word [esi + 0x2c], 0xfffd
mov eax, dword [esi + 0x3c]
cmp eax, ecx
je 0x205856
or word [esi + 0x2c], 2
push esi
mov ecx, eax
mov esi, edx
call fcn.002086a2
pop esi
jb 0x205874
add dword [esi + 0x14], eax
adc dword [esi + 0x18], 0
call fcn.0020a3e6
pop edi
pop esi
ret
mov esi, edx
call fcn.00208654
jmp 0x205874
mov al, 0x36
jmp 0x205874
mov al, 0x34
call fcn.0020a3e4
pop edi
pop esi
jmp fcn.00204c80
Function at 0x207a40
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
push edi
push ebp
add ebp, dword [ebp - 0x88]
mov esi, dword [ebp - 0x6c]
call fcn.0020867c
jecxz 0x207a82
call fcn.00208620
jb 0x207ace
cld
test eax, eax
je 0x207a6d
lodsb al, byte [esi]
call fcn.00207b99
stosb byte es:[edi], al
loop 0x207a60
mov esi, edx
jmp 0x207a7a
push edi
push ecx
push edi
cld
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.USER32.DLL_CharLowerBuffA]
pop esi
xchg dword [ebp - 0x6c], esi
call fcn.00208654
pop ebp
pop edi
pop esi
pop ecx
ret

Function at 0x207a87
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
push edi
push ebp
add ebp, dword [ebp - 0x88]
mov esi, dword [ebp - 0x6c]
call fcn.0020867c
jecxz 0x207ac9
call fcn.00208620
jb 0x207ace
cld
test eax, eax
je 0x207ab4
lodsb al, byte [esi]
call fcn.00207bd5
stosb byte es:[edi], al
loop 0x207aa7
mov esi, edx
jmp 0x207ac1
push edi
push ecx
push edi
cld
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.USER32.DLL_CharUpperBuffA]
pop esi
xchg dword [ebp - 0x6c], esi
call fcn.00208654
pop ebp
pop edi
pop esi
pop ecx
ret
mov edx, eax
pop ebp
pop edi
pop esi
pop ecx
jmp fcn.00204c75

Function at 0x207fdf
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov edx, ecx
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
call fcn.0020867c
test eax, eax
jns 0x207ff8
add eax, ecx
test edx, edx
je 0x208038
jns 0x208003
add edx, ecx
js 0x208038
inc edx
dec edx
add esi, edx
sub ecx, edx
jae 0x20800c
xor ecx, ecx
cmp ecx, eax
jb 0x208012
mov ecx, eax
call fcn.00208620
jb 0x20803c
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.002088f8
mov esi, dword [ebp - 0x88]
mov dword [ebp + esi - 0x6c], edx
pop edi
pop esi
ret
xor edx, edx
jmp 0x208026
pop edi
pop esi
jmp fcn.00204c80

Function at 0x2080b1
Capabilities:
Terminate process

Disassembly:
sub esp, 0x224
mov edx, esp
call fcn.00207c58
test al, al
je 0x2080dc
mov word [edx + 2], 0x3a
mov word [edx + 4], 0
push edx
mov edx, dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryW]
call fcn.0020b018
jb 0x2080e3
add esp, 0x224
ret
add esp, 0x224
jmp fcn.00204c75

Function at 0x2081c8
Capabilities:
Terminate process

Disassembly:
push edi
xchg ecx, ebx
call fcn.00208620
jb 0x2081e8
call fcn.0020a3e6
cld
mov ah, al
shr ecx, 1
rep stosw word es:[edi], ax
adc cl, 0
rep stosb byte es:[edi], al
xchg ecx, ebx
pop edi
ret
call fcn.0020a3e4
pop edi
jmp fcn.00204c80

Function at 0x2082b4
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov ax, word [ebp - 0x46]
call fcn.00208732
jb 0x20830b
test word [edi + 0xc], 0x20
je 0x20830f
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
call fcn.0020867c
lea edx, [edi + 0x3c]
push 0
push edx
push ecx
push esi
push dword [edi + 6]
mov edx, dword [sym.imp.KERNEL32.DLL_WriteFile]
call fcn.0020b018
jb 0x208307
mov eax, dword [edi + 0x3c]
add dword [edi + 0x14], eax
adc dword [edi + 0x18], 0
and word [edi + 0x2c], 0xfffd
call fcn.0020affe
pop edi
pop esi
ret
mov al, dl
jmp 0x208311
mov al, 0x34
jmp 0x208311
mov al, 0x36
call fcn.0020affe
pop edi
pop esi
jmp fcn.00204c80
Function at 0x208a28
Capabilities:
Terminate process

Disassembly:
call fcn.0020a507
jb 0x208a30
ret
jmp fcn.00204c80

Function at 0x208a90
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
push edi
mov esi, dword [0x20c5f0]
mov ecx, eax
jecxz 0x208afd
cld
lodsw ax, word [esi]
test ax, ax
je 0x208af9
cmp ax, 0x20
je 0x208a9e
cmp ax, 0x22
je 0x208ad2
lea edi, [esi - 2]
lodsw ax, word [esi]
test ax, ax
je 0x208ac5
cmp ax, 0x20
jne 0x208ab4
loop 0x208a9e
jmp 0x208ac7
loop 0x208af9
lea ecx, [esi - 2]
mov esi, edi
sub ecx, esi
shr ecx, 1
jmp 0x208b12
mov edi, esi
lodsw ax, word [esi]
test ax, ax
je 0x208aec
cmp ax, 0x22
jne 0x208ad4
cmp word [esi - 4], 0x22
je 0x208a9e
loop 0x208a9e
jmp 0x208aee
loop 0x208af9
lea ecx, [esi - 2]
mov esi, edi
sub ecx, esi
shr ecx, 1
jmp 0x208b12
xor ecx, ecx
jmp 0x208b12
push esi
mov ecx, 0xffffffff
sub esi, 2
inc ecx
add esi, 2
test word [esi], 0xffff
jne 0x208b06
pop esi
call fcn.0020a494
pop edi
pop esi
pop ecx
jb 0x208b1d
ret
jmp fcn.00204c80

Function at 0x208bcc
Capabilities:
Terminate process

Disassembly:
mov edx, 0x34
jmp fcn.00204c75
push esi
or eax, eax
je 0x208c35
dec eax
je 0x208c44
dec eax
je 0x208c51
dec eax
je 0x208c5d
cmp eax, 0xfffffffc
je 0x208c29
cmp eax, 0xfffffffb
je 0x208c1c
cmp eax, 0xfffffffa
je 0x208c0f
cmp eax, 0xfffffff9
je 0x208c03
cmp eax, 0xfffffff8
jne 0x208c35
call fcn.00208c66
jb 0x208c6d
mov eax, dword [esi + 0x34]
jmp 0x208c64
call fcn.00208c66
jb 0x208c6d
mov eax, dword [esi + 0x30]
jmp 0x208c64
call fcn.00208c66
jb 0x208c6d
movzx eax, word [esi + 0xa]
jmp 0x208c64
call fcn.00208c66
jb 0x208c6d
movzx eax, word [esi + 0x2e]
jmp 0x208c64
call fcn.00208c66
jb 0x208c6d
mov eax, dword [esi + 0x1c]
jmp 0x208c64
call fcn.00208c66
mov eax, 0
jb 0x208c64
dec eax
jmp 0x208c64
call fcn.00208c66
jb 0x208c6d
movzx eax, word [esi + 0xc]
jmp 0x208c64
call fcn.00208c66
jb 0x208c6d
mov eax, dword [esi + 6]
jmp 0x208c64
mov eax, ecx
call fcn.00208810
pop esi
ret
pop esi
xor eax, eax
jmp 0x204c5b