joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401170
Capabilities:
Set console window title

Disassembly:
sub esp, 0x104
mov eax, dword [0x410868]
push ebx
push ebp
push esi
push edi
push str.CIMIT
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
push 0xa
mov ebx, eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
or ecx, 0xffffffff
mov ebp, eax
xor eax, eax
mov edi, 0x410750
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
or ecx, 0xffffffff
mov esi, edi
mov edi, str.console_
repne scasb al, byte es:[edi]
mov ecx, edx
shr ecx, 2
dec edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov word [esp + 0x10], 0x84
mov word [esp + 0x12], 0x3e8
mov esi, str.console_
mov eax, str.consolecimit
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x40120e
test cl, cl
je 0x40120a
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x40120e
add eax, 2
add esi, 2
test cl, cl
jne 0x4011ea
xor eax, eax
jmp 0x401213
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x401229
push str.console_
push str.consolecimit
call fcn.00402470
add esp, 8
or ecx, 0xffffffff
xor eax, eax
mov edi, str.console_
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
mov edi, 0x410750
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_AllocConsole]
mov ecx, dword [0x410864]
push ebx
push 0xfffffffffffffff2
push ecx
call dword [sym.imp.USER32.dll_SetClassLongA]
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x401270
call esi
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 3
push eax
mov dword [0x410870], eax
call dword [sym.imp.KERNEL32.dll_SetConsoleMode]
call sub.cimit.dll_gui_iswin95
test eax, eax
jne 0x4012a0
mov edx, dword [esp + 0x10]
mov eax, dword [0x410870]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferSize]
lea ecx, [esp + 0x14]
push ecx
call sub.cimit.dll_get_console_title
add esp, 4
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x14]
push eax
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [0x41086c], eax
mov dword [0x41074c], eax
call esi
mov edx, dword [0x410880]
mov eax, ebp
sub eax, edx
cmp eax, 0x5a
jge 0x4012f0
add eax, 0xa
jmp 0x4012f5
mov eax, 0x64
mov ecx, dword [0x410890]
test ecx, ecx
push 0x40
jne 0x401332
mov ecx, dword [0x41087c]
mov edx, dword [0x41074c]
push 0xc8
push ecx
sub ebp, eax
sub ebp, 0xc8
push ebp
push 0
push 0xfffffffffffffffe
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret
mov eax, dword [0x410738]
mov ecx, dword [0x41073c]
mov edx, dword [0x410744]
push eax
mov eax, dword [0x410740]
push ecx
mov ecx, dword [0x41074c]
push edx
push eax
push 0xfffffffffffffffe
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret
Function at 0x401b10
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x140
push ebx
push ebp
push esi
push edi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.GDI32.dll_GetTextMetricsA]
mov edi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0xa
push esi
call edi
push 8
push esi
mov dword [esp + 0x18], eax
call edi
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x14], eax
call sub.cimit.dll_gui_iswin95
test eax, eax
je 0x401b64
mov ebp, 6
add ebx, 0xa
jmp 0x401b6c
mov ebp, 2
add ebx, 5
mov eax, dword [0x41085c]
test eax, eax
je 0x401b8e
lea eax, [ebp + 0x400]
lea ecx, [ebx + 0x300]
mov dword [0x41087c], eax
mov dword [0x410880], ecx
jmp 0x401bd0
mov eax, dword [0x410880]
test eax, eax
jne 0x401b9e
push 0xa
push esi
call edi
jmp 0x401ba6
mov eax, dword [0x410880]
add eax, 0x14
mov dword [0x410880], eax
mov eax, dword [0x41087c]
test eax, eax
jne 0x401bb9
push 8
push esi
call edi
mov ecx, dword [0x410880]
lea ecx, [ecx + ebx - 0x14]
add eax, ebp
mov dword [0x410880], ecx
mov dword [0x41087c], eax
mov ebx, dword [esp + 0x14]
cmp ebx, eax
jge 0x401be0
mov dword [0x41087c], ebx
jmp 0x401be6
mov dword [esp + 0x14], eax
mov ebx, eax
mov edi, dword [esp + 0x10]
cmp edi, ecx
jge 0x401bf6
mov dword [0x410880], edi
jmp 0x401bfc
mov dword [esp + 0x10], ecx
mov edi, ecx
call fcn.00401000
lea edx, [esp + 0x50]
push edx
call sub.cimit.dll_get_title
mov esi, dword [esp + 0x158]
mov eax, dword [0x410898]
mov ecx, dword [0x410894]
add esp, 4
push 0
push esi
push 0
push 0
push edi
push ebx
push eax
push ecx
push 0x28a0000
lea edx, [esp + 0x74]
push edx
push 0x410634
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
test eax, eax
mov dword [0x410864], eax
jne 0x401c56
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x140
ret
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call sub.cimit.dll_ShowSplashScreen
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x140
ret
Function at 0x8ea320
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x303000]
push edi
jmp 0x8ea33a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x8ea341
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8ea330
mov eax, 1
add ebx, ebx
jne 0x8ea353
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x8ea364
jne 0x8ea383
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8ea383
dec eax
add ebx, ebx
jne 0x8ea370
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x8ea348
add ebx, ebx
jne 0x8ea37f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x8ea3d5
xor ecx, ecx
sub eax, 3
jb 0x8ea39b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x8ea40a
sar eax, 1
mov ebp, eax
jmp 0x8ea3a6
add ebx, ebx
jne 0x8ea3a6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8ea374
inc ecx
add ebx, ebx
jne 0x8ea3b4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8ea374
add ebx, ebx
jne 0x8ea3c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x8ea3b6
jne 0x8ea3d2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x8ea3b6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x8ea3f4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x8ea3e6
jmp 0x8ea336
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x8ea3f4
add edi, ecx
jmp 0x8ea336
pop esi
mov edi, esi
mov ecx, 0xd45b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x8ea412
cmp byte [edi], 0x2e
jne 0x8ea412
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x8ea417
lea edi, [esi + 0x4da000]
mov eax, dword [edi]
or eax, eax
je 0x8ea486
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x50156c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x501594]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x8ea444
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x501598]
or eax, eax
je 0x8ea480
mov dword [ebx], eax
add ebx, 4
jmp 0x8ea461
call dword [esi + 0x5015a8]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x8ea4b7
cmp al, 0xef
ja 0x8ea4aa
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x8ea48c
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x8ea499
mov ebp, dword [esi + 0x50159c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x26f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x8ea4eb
sub esp, 0xffffff80
jmp 0x58795a
Function at 0x201087
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.00201087
xor esi, esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
lea ebx, [ebp - 0xa0]
push ebx
push 1
push 0
mov ebx, dword [ebp + 0xc]
push ebx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExA]
fldcw word [ebp - 0x10]
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0
jne 0x20119d
push 0
lea ebx, [ebp - 0xa8]
push ebx
push 0
mov eax, 1
lea ebx, [esp + 8]
push ebx
mov dword [ebx], eax
push 0
mov ebx, dword [ebp + 0x10]
push ebx
mov eax, dword [ebp - 0xa0]
push eax
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExA]
add esp, 4
fldcw word [ebp - 0x10]
mov dword [ebp - 0x9c], eax
mov ebx, dword [ebp - 0xa8]
xor eax, eax
call fcn.00203c74
lea ebx, [ebp - 0xa4]
call fcn.00204ce3
push 0
lea ebx, [ebp - 0xa8]
push ebx
lea ebx, [ebp - 0xa4]
call fcn.00204df9
mov eax, ebx
push eax
mov eax, 1
lea ebx, [esp + 8]
push ebx
mov dword [ebx], eax
push 0
mov ebx, dword [ebp + 0x10]
push ebx
mov eax, dword [ebp - 0xa0]
push eax
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExA]
add esp, 4
fldcw word [ebp - 0x10]
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0xa0]
push eax
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
fldcw word [ebp - 0x10]
mov edx, dword [ebp - 0xa4]
call fcn.00204ccc
push 0
xor eax, eax
call fcn.0020361f
call fcn.002035d0
call fcn.002042e8
lea ebx, [ebp - 0x98]
call fcn.00204ce3
call fcn.00204be0
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x2011c3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
invalid

Function at 0x2011d2
Capabilities:
Query or enumerate registry value

Disassembly:
ret

Function at 0x201352
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.00201352
xor esi, esi
push esi
push esi
push esi
push esi
push esi
push esi
mov ebx, dword [ebp + 8]
mov edx, dword [ebx]
call fcn.00204ccc
call fcn.00204c98
mov dword [ebp - 0x98], eax
mov ebx, dword [ebp + 8]
call fcn.00204df9
mov eax, ebx
mov dword [ebp - 0x9c], eax
fild dword [0x206fc8]
mov eax, dword [ebp - 0x98]
call fcn.00204578
fcompp
fnstsw ax
sahf
jne 0x2013af
jmp 0x2013c8
mov ecx, dword [ebp - 0x98]
dec ecx
mov esi, dword [ebp - 0x9c]
mov edi, esi
mov bl, byte [ebp + 0xc]
cld
lodsb al, byte [esi]
xor al, bl
stosb byte es:[edi], al
loop 0x2013c2
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x202ca0
Capabilities:
Accept command line arguments
Allocate thread local storage
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, section..data
test word [0x202c82], 0x100
jne 0x202cbb
jmp 0x2030ec
jmp fcn.00202ed9
call fcn.00202dd5
mov dword [ebx + 0x600], 1
mov dword [ebx + 0x5dc], 0
lea eax, [ebx + 0x8e4]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
mov cx, word [0x202c82]
mov edx, dword [ebx + 0x8f4]
test cx, 0x20
jne 0x203161
cmp edx, 2
je 0x203170
test cx, 0x40
jne 0x203161
push 0x12000
push 0
call 0x20314f
push edi
imul ebp, dword [esi + 0x39], 0x6f4e2038
and byte [ebx + 0x75], dl
jo 0x2031bb
outsd dx, dword [esi]
jb 0x2031c2
add byte [edx], ch
call dword [sym.imp.USER32.DLL_MessageBoxA]
push 0xff
jmp 0x20322a
call fcn.00202ed9
or dword [ebx + 0x5dc], 0x80
sub esp, 0x44
mov dword [esp], 0x44
mov dword [esp + 0x2c], 0
push esp
call dword [sym.imp.KERNEL32.DLL_GetStartupInfoA]
mov eax, 0xa
test dword [esp + 0x2c], 1
je 0x20319d
movzx eax, word [esp + 0x30]
add esp, 0x44
mov dword [ebx + 0x5f4], eax
call dword [sym.imp.KERNEL32.DLL_GetCommandLineW]
call fcn.00202e6d
mov dword [ebx + 0x5f0], eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
mov dword [ebx + 0x5fc], eax
call fcn.00202cc0
push 0xff
jb 0x20322a
inc eax
and dword [eax], 0xfc838900
add eax, 0xf6e80000
cli
invalid
pop eax
push 0
call dword [sym.imp.OLE32.DLL_CoInitialize]
movzx ecx, word [0x202c80]
jecxz 0x2031ef
push ecx
push 8
push esp
call dword [sym.imp.COMCTL32.DLL_InitCommonControlsEx]
pop eax
pop eax
call fcn.00202d21
push eax
mov ebx, section..data
mov ecx, dword [ebx + 0xdc]
call fcn.00203230
mov ecx, dword [ebx + 0xb8]
jecxz 0x203214
push ecx
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov edi, dword [ebx + 0x638]
call fcn.00202d26
call fcn.00202d0d
call dword [sym.imp.OLE32.DLL_CoUninitialize]
call dword [sym.imp.KERNEL32.DLL_ExitProcess]

Function at 0x202cc0
Capabilities:
Allocate thread local storage

Disassembly:
call dword [sym.imp.KERNEL32.DLL_TlsAlloc]
cmp eax, 0xffffffff
stc
je 0x202d0c
mov dword [ebx + 0x5e0], eax
mov dword [ebx + 0x5e8], 0
call fcn.00202fcc
jb 0x202d0c
mov dword [ebx + 0x5e4], eax
mov dword [eax + 0x68], 1
mov dword [eax + 0x6c], 1
mov dword [eax + 0x70], 2
mov dword [eax + 0x74], 3
mov dword [eax + 0x78], 0
ret

Function at 0x2035d0
Capabilities:
Terminate process

Disassembly:
push eax
push ecx
push esi
push edi
lea esi, [esp + 0x18]
mov ecx, dword [esi - 4]
push ecx
call fcn.00204060
jb 0x203606
jecxz 0x2035f3
lea esi, [esi + ecx*4 - 4]
mov eax, dword [esi]
mov byte [edi], al
sub esi, 4
inc edi
loop 0x2035e9
call fcn.00204d8e
pop edx
pop edi
pop esi
pop ecx
pop eax
shl edx, 2
pop dword [esp + edx]
add esp, edx
ret
call fcn.00204d8c
pop edx
pop edi
pop esi
pop ecx
add esp, 4
shl edx, 2
pop dword [esp + edx]
add esp, edx
jmp fcn.00202ef0
Function at 0x203704
Capabilities:
Terminate process

Disassembly:
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x64], edi
pop dword [ebp - 0x6c]
pop edx
pop ax
test byte [ebx + 4], 4
je 0x203726
pop cx
movzx ecx, ch
add esp, 4
add esp, 8
loop 0x20371e
jmp dword [ebp - 0x6c]
mov byte [ebx + 5], 2
mov byte [ebx + 4], al
mov dword [ebx], edx
pop word [ebx + 6]
pop dword [ebx + 0x14]
movzx ecx, byte [ebx + 7]
mov esi, ecx
shl esi, 1
add esi, ecx
shl esi, 2
pop dword [ebx + esi + 0x10]
pop dword [ebx + esi + 0xc]
sub esi, 0xc
jne 0x203743
mov eax, dword [ebx + esi + 0x1c]
sub eax, dword [ebx + esi + 0x18]
jl 0x2037b8
inc eax
dec ecx
je 0x20377b
add esi, 0xc
mov dword [ebx + esi + 0x14], eax
mov eax, dword [ebx + esi + 0x1c]
sub eax, dword [ebx + esi + 0x18]
jl 0x2037b8
inc eax
mul dword [ebx + esi + 0x14]
dec ecx
ja 0x20375e
je 0x20377b
jb 0x2037b8
mov dword [ebx + 8], eax
mul dword [ebx + 0x14]
jb 0x2037b8
test byte [ebx + 4], 1
je 0x20378e
mov dword [ebx + 0xc], eax
jmp 0x2037ab
push eax
call fcn.00202ea1
pop ecx
jb 0x2037ba
mov dword [ebx], eax
mov dword [ebx + 0xc], ecx
mov edi, eax
cld
xor eax, eax
shr ecx, 1
rep stosw word es:[edi], ax
adc cl, 0
rep stosb byte es:[edi], al
or byte [ebx + 4], 4
mov esi, dword [ebp - 0x68]
mov edi, dword [ebp - 0x64]
jmp dword [ebp - 0x6c]
mov al, 9
mov esi, dword [ebp - 0x68]
mov edi, dword [ebp - 0x64]
push dword [ebp - 0x6c]
jmp fcn.00202ef0

Function at 0x203830
Capabilities:
Terminate process

Disassembly:
call fcn.0020383d
jb 0x203838
ret
jmp fcn.00202ef0

Function at 0x203a44
Capabilities:
Terminate process

Disassembly:
push eax
push ecx
push esi
push edi
push ebp
add ebp, dword [ebp - 0x88]
mov esi, dword [ebp - 0x6c]
call fcn.002040bc
jecxz 0x203a75
call fcn.00204060
jb 0x203a7b
lea edi, [edi + ecx - 1]
lodsb al, byte [esi]
mov byte [edi], al
dec edi
loop 0x203a64
mov esi, dword [ebp - 0x6c]
call fcn.00204094
mov dword [ebp - 0x6c], edx
pop ebp
pop edi
pop esi
pop ecx
pop eax
ret
mov edx, eax
pop ebp
pop edi
pop esi
pop ecx
pop eax
jmp fcn.00202ee5

Function at 0x203c74
Capabilities:
Terminate process

Disassembly:
push edi
xchg ecx, ebx
call fcn.00204060
jb 0x203c94
call fcn.00204d8e
cld
mov ah, al
shr ecx, 1
rep stosw word es:[edi], ax
adc cl, 0
rep stosb byte es:[edi], al
xchg ecx, ebx
pop edi
ret
call fcn.00204d8c
pop edi
jmp fcn.00202ef0

Function at 0x2042e8
Capabilities:
Terminate process

Disassembly:
or edx, edx
jns 0x2042a2
xor edx, edx
mov esi, eax
mov ecx, edx
pop ebp
call fcn.00204060
jb 0x2042dc
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0020527a
call fcn.002041dc
mov edi, dword [ebp - 0x88]
mov dword [ebp + edi - 0x6c], edx
pop edi
pop esi
pop ecx
pop ebx
pop eax
ret
pop ebp
call fcn.0020527a
jmp 0x2042ce
mov edx, eax
pop edi
pop esi
pop ecx
pop ebx
pop eax
jmp fcn.00202ee5
push eax
call fcn.0020435c
jb 0x2042d4
cmp ecx, edx
ja 0x2042d4
mov eax, esi
add esi, edx
sub esi, ecx
mov ebx, ecx
mov ebp, edi
repe cmpsb byte [esi], byte es:[edi]
jne 0x20429c
sub esi, ebx
sub esi, ebx
sub edx, ebx
jl 0x20429c
mov ecx, ebx
mov edi, ebp
jmp 0x2042fe
Function at 0x20462d
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [ebp - 0x88]
mov eax, dword [ebp + esi - 0x6c]
add dword [ebp - 0x88], 4
pop esi
test eax, 1
jne 0x20464d
mov dword [ebx], eax
pop edx
push eax
push edx
ret
push esi
push edi
mov esi, eax
call fcn.002040bc
call fcn.00204060
jb 0x204672
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
mov dword [ebx], edx
pop eax
push edx
push eax
ret
pop edi
pop esi
mov dword [ebx], edx
pop ebx
push edx
push ebx
jmp fcn.00202ef0

Function at 0x204be0
Capabilities:
Terminate process

Disassembly:
push eax
push edx
push esi
mov ebx, dword [ebp - 0x84]
sub ebx, 0xe
mov esi, dword [ebx]
sub ebx, 4
shr esi, 1
jb 0x204c0d
je 0x204c09
shr esi, 1
jae 0x204c2e
shl esi, 2
mov esi, dword [ebp + esi]
call fcn.00204094
jmp 0x204bec
pop esi
pop edx
pop eax
ret
shr esi, 1
jb 0x204c3f
push ebx
shl esi, 2
lea ebx, [ebp + esi]
mov eax, 1
call fcn.0020383d
pop ebx
jae 0x204bec
pop esi
pop edx
pop eax
jmp fcn.00202ef0
shl esi, 2
mov ecx, dword [ebp + esi]
jecxz 0x204bec
push ecx
mov ecx, dword [ecx]
call dword [ecx + 8]
jmp 0x204bec
lea ecx, [ebp + esi*4]
push ecx
call dword [sym.imp.OLEAUT32.DLL_VariantClear]
jmp 0x204bec

Function at 0x204ce3
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
add dword [ebp - 0x88], 4
test esi, 1
je 0x204d03
and esi, 0xfffffffe
jne 0x204d0d
xchg dword [ebx], esi
call fcn.00204094
pop edi
pop esi
ret
call fcn.002040bc
mov edi, dword [ebx]
or edi, edi
je 0x204d1d
cmp ecx, dword [edi - 4]
je 0x204d3d
call fcn.00204060
jb 0x204d4d
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xchg dword [ebx], edx
mov esi, edx
call fcn.00204094
pop edi
pop esi
ret
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
ret
xchg dword [ebx], edx
mov esi, edx
call fcn.00204094
pop edi
pop esi
jmp fcn.00202ef0

Function at 0x205148
Capabilities:
Terminate process

Disassembly:
push ebx
push ecx
push esi
push edi
mov edi, dword [ebp - 0x88]
mov esi, dword [ebp + edi - 0x6c]
call fcn.002040bc
mov ebx, ecx
push esi
mov esi, dword [ebp + edi - 0x68]
call fcn.002040bc
jecxz 0x2051be
test ebx, ebx
je 0x2051c6
add ebx, ecx
xchg ecx, ebx
call fcn.00204060
jb 0x2051d3
xchg ecx, ebx
sub ebx, ecx
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
mov ecx, ebx
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp - 0x88]
mov esi, edx
xchg dword [ebp + edi - 0x68], esi
call fcn.00204094
mov esi, dword [ebp + edi - 0x6c]
call fcn.00204094
add dword [ebp - 0x88], 4
pop edi
pop esi
pop ecx
pop ebx
ret
mov esi, dword [ebp + edi - 0x6c]
mov dword [ebp + edi - 0x68], esi
add dword [ebp - 0x88], 4
pop esi
pop edi
pop esi
pop ecx
pop ebx
ret
pop esi
pop edi
pop esi
pop ecx
pop ebx
jmp fcn.00202ef0
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403daa
nop
nop
sub eax, 0x403d50
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x405358
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [0x422538], 0x44
push eax
xor eax, eax
push 0x422538
push eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x405393
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x40541d
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push ebx
mov ebx, dword [ebp + 8]
push esi
push ebx
call fcn.004056bf
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], eax
test cl, 8
je 0x405453
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x423fa8], eax
jmp 0x4055d8
mov dword [ebp + 8], ecx
push edi
and dword [ebp + 8], 1
je 0x40546e
test eax, eax
je 0x405583
test cl, 2
je 0x405583
mov esi, 0x421538
push ebx
push esi
call fcn.00405aeb
cmp dword [ebp + 8], 0
je 0x40548d
push 0x409398
push esi
call sub.KERNEL32.dll_lstrcatA
jmp 0x405493
push ebx
call fcn.00405625
push 0x409010
push ebx
call sub.KERNEL32.dll_lstrcatA
push ebx
call sub.KERNEL32.dll_lstrlenA
mov edi, eax
lea eax, [ebp - 0x148]
push eax
push esi
add edi, ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x405579
lea eax, [ebp - 0x11c]
push 0x3f
push eax
lea esi, [ebp - 0x11c]
call fcn.00405609
cmp byte [eax], 0
je 0x4054e4
cmp byte [ebp - 0x18], 0
je 0x4054e4
lea esi, [ebp - 0x18]
cmp byte [esi], 0x2e
jne 0x4054fa
mov al, byte [esi + 1]
test al, al
je 0x405558
cmp al, 0x2e
jne 0x4054fa
cmp byte [esi + 2], 0
je 0x405558
push esi
push edi
call fcn.00405aeb
test byte [ebp - 0x148], 0x10
je 0x40551f
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405558
push dword [ebp + 0xc]
push ebx
call fcn.0040541d
jmp 0x405558
push ebx
call fcn.004057a3
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x405550
test byte [ebp + 0xc], 4
je 0x405548
push ebx
push 0xfffffffffffffff1
call fcn.00404e9f
push 0
push ebx
call fcn.00405839
jmp 0x405558
inc dword [0x423fa8]
jmp 0x405558
push ebx
push 0xfffffffffffffff2
call fcn.00404e9f
lea eax, [ebp - 0x148]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4054c2
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x405583
and byte [edi - 1], 0
xor esi, esi
pop edi
cmp dword [ebp + 8], esi
je 0x4055d8
cmp dword [ebp - 8], esi
jne 0x405598
inc dword [0x423fa8]
jmp 0x4055d8
push ebx
call fcn.00405d93
test eax, eax
je 0x4055d8
push ebx
call fcn.004055de
push ebx
call fcn.004057a3
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x4055d0
test byte [ebp + 0xc], 4
je 0x405590
push ebx
push 0xfffffffffffffff1
call fcn.00404e9f
push esi
push ebx
call fcn.00405839
jmp 0x4055d8
push ebx
push 0xffffffffffffffe5
call fcn.00404e9f
pop esi
pop ebx
leave
ret 8