joyce8/EMBER2024-capa huggingface dataset:
Function at 0x461040
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [0xf335f8]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4610db
sub esp, 0x30
lea ecx, [esp + 0x34]
mov dword [esp + 4], ecx
mov edx, dword [0xf335f8]
mov edx, dword fs:[edx]
mov edx, dword [edx]
mov dword [esp + 8], 0
lea edi, [esp + 0xc]
xor eax, eax
call fcn.0046d987
lea ecx, [0x4610f0]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 4]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
lea ecx, [esp + 8]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0xc]
mov dword [esp], ecx
call fcn.0046c200
mov ecx, dword [esp + 8]
mov dword [esp + 0x44], ecx
add esp, 0x30
ret
call fcn.0046c2f0
jmp fcn.00461040

Function at 0x461330
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword [0xf335f8]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x46148f
sub esp, 0x18
call fcn.0044daa0
cmp dword [esp], 1
jg 0x461486
movzx eax, byte [esp + 0x28]
cmp al, 0x15
jne 0x46137d
movzx eax, byte [esp + 0x2d]
cmp al, 9
je 0x46137d
cmp al, 0x12
je 0x46137d
cmp al, 0xe
je 0x46137d
mov byte [esp + 0x30], 0
add esp, 0x18
ret
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x46138b
xor ecx, ecx
xor eax, eax
jmp 0x4613a3
mov dword [esp], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
call fcn.00458690
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
cmp ecx, 0xf
je 0x4613b4
xor edx, edx
jmp 0x4613dd
mov dword [esp], eax
lea ecx, [0xa22a8d]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0xf
call fcn.00406ed0
movzx eax, byte [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, eax
mov eax, dword [esp + 0x14]
test dl, dl
je 0x4613f3
movzx edx, byte [esp + 0x2c]
test dl, dl
jne 0x4613f3
mov byte [esp + 0x30], 1
add esp, 0x18
ret
mov dword [esp], eax
mov dword [esp + 4], ecx
mov byte [esp + 8], 0x2e
call fcn.00406f40
mov eax, dword [esp + 0xc]
test eax, eax
jl 0x46147c
mov eax, dword [esp + 0x10]
cmp eax, 8
jge 0x461419
xor ecx, ecx
jmp 0x461442
mov eax, dword [esp + 0x14]
mov dword [esp], eax
lea ecx, [0xa1d289]
mov dword [esp + 4], ecx
mov dword [esp + 8], 8
call fcn.00406ed0
movzx eax, byte [esp + 0xc]
mov ecx, eax
mov eax, dword [esp + 0x10]
test cl, cl
je 0x461475
cmp eax, 8
jle 0x461471
mov eax, dword [esp + 0x14]
cmp dword [eax], 0x746e7572
jne 0x461471
cmp dword [eax + 4], 0x2e656d69
jne 0x461471
movzx eax, byte [eax + 8]
cmp al, 0x41
jb 0x461471
cmp al, 0x5a
setbe al
jmp 0x46147e
xor eax, eax
jmp 0x46147e
mov eax, 1
jmp 0x46147e
xor eax, eax
mov byte [esp + 0x30], al
add esp, 0x18
ret
mov byte [esp + 0x30], 1
add esp, 0x18
ret
call fcn.0046c2f0
jmp fcn.00461330
Function at 0x46d5a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0xf33d20]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x46bd2b
je 0x46bd7e
cmp ebx, 0x20
jbe 0x46bd84
cmp ebx, 0x40
jbe 0x46bdca
jmp 0x46be6b
test ebx, ebx
je 0x46bd74
add eax, 0x10
test ax, 0xff0
je 0x46bd60
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0xb2d120]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0xb2d220]
jmp 0x46bd48
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x46bd48
pxor xmm1, xmmword [0xf33d30]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
pxor xmm2, xmm0
pxor xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0xf33d30]
pxor xmm2, xmmword [0xf33d40]
pxor xmm3, xmmword [0xf33d50]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
pxor xmm4, xmm0
pxor xmm5, xmm1
pxor xmm6, xmm2
pxor xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0xf33d30]
pxor xmm2, xmmword [0xf33d40]
pxor xmm3, xmmword [0xf33d50]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x46beca
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0xf33409], 0
je 0x46d5ba
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x46bcf0
jmp fcn.0040c390
Function at 0x201087
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.00201087
xor esi, esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
lea ebx, [ebp - 0xa0]
push ebx
push 1
push 0
mov ebx, dword [ebp + 0xc]
push ebx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExA]
fldcw word [ebp - 0x10]
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0
jne 0x20119d
push 0
lea ebx, [ebp - 0xa8]
push ebx
push 0
mov eax, 1
lea ebx, [esp + 8]
push ebx
mov dword [ebx], eax
push 0
mov ebx, dword [ebp + 0x10]
push ebx
mov eax, dword [ebp - 0xa0]
push eax
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExA]
add esp, 4
fldcw word [ebp - 0x10]
mov dword [ebp - 0x9c], eax
mov ebx, dword [ebp - 0xa8]
xor eax, eax
call fcn.00204188
lea ebx, [ebp - 0xa4]
call fcn.00205183
push 0
lea ebx, [ebp - 0xa8]
push ebx
lea ebx, [ebp - 0xa4]
call fcn.00205299
mov eax, ebx
push eax
mov eax, 1
lea ebx, [esp + 8]
push ebx
mov dword [ebx], eax
push 0
mov ebx, dword [ebp + 0x10]
push ebx
mov eax, dword [ebp - 0xa0]
push eax
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExA]
add esp, 4
fldcw word [ebp - 0x10]
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0xa0]
push eax
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
fldcw word [ebp - 0x10]
mov edx, dword [ebp - 0xa4]
call fcn.0020516c
push 0
xor eax, eax
call fcn.002034f7
call fcn.002034a8
call fcn.002047fc
lea ebx, [ebp - 0x98]
call fcn.00205183
call fcn.00205080
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x2011c3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.002011c3
xor esi, esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
lea ebx, [ebp - 0xa0]
push ebx
push 1
push 0
mov ebx, dword [ebp + 0xc]
push ebx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExA]
fldcw word [ebp - 0x10]
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0
jne 0x201271
mov dword [ebp - 0xa8], 4
push 0
lea ebx, [ebp - 0xa8]
push ebx
lea ebx, [ebp - 0xa4]
push ebx
mov eax, 4
lea ebx, [esp + 8]
push ebx
mov dword [ebx], eax
push 0
mov ebx, dword [ebp + 0x10]
push ebx
mov eax, dword [ebp - 0xa0]
push eax
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExA]
add esp, 4
fldcw word [ebp - 0x10]
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0xa0]
push eax
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
fldcw word [ebp - 0x10]
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x201352
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.00201352
xor esi, esi
push esi
push esi
push esi
push esi
push esi
push esi
mov ebx, dword [ebp + 8]
mov edx, dword [ebx]
call fcn.0020516c
call fcn.00205138
mov dword [ebp - 0x98], eax
mov ebx, dword [ebp + 8]
call fcn.00205299
mov eax, ebx
mov dword [ebp - 0x9c], eax
fild dword [0x2070b0]
mov eax, dword [ebp - 0x98]
call fcn.00204a8c
fcompp
fnstsw ax
sahf
jne 0x2013af
jmp 0x2013c8
mov ecx, dword [ebp - 0x98]
dec ecx
mov esi, dword [ebp - 0x9c]
mov edi, esi
mov bl, byte [ebp + 0xc]
cld
lodsb al, byte [esi]
xor al, bl
stosb byte es:[edi], al
loop 0x2013c2
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x2028c0
Capabilities:
Accept command line arguments
Allocate thread local storage
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, section..data
test word [0x2028a2], 0x100
jne 0x2028db
jmp 0x202f90
jmp fcn.00202d7e
call fcn.00202bf5
mov dword [ebx + 0x600], 1
mov dword [ebx + 0x5dc], 0
lea eax, [ebx + 0x8e4]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
mov cx, word [0x2028a2]
mov edx, dword [ebx + 0x8f4]
test cx, 0x20
jne 0x203005
cmp edx, 2
je 0x203014
test cx, 0x40
jne 0x203005
push 0x12000
push 0
call 0x202ff3
push edi
imul ebp, dword [esi + 0x39], 0x6f4e2038
and byte [ebx + 0x75], dl
jo 0x20305f
outsd dx, dword [esi]
jb 0x203066
add byte [edx], ch
call dword [sym.imp.USER32.DLL_MessageBoxA]
push 0xff
jmp 0x203103
call fcn.00202d7e
or dword [ebx + 0x5dc], 0x80
call fcn.002029ee
sub esp, 0x44
mov dword [esp], 0x44
mov dword [esp + 0x2c], 0
push esp
call dword [sym.imp.KERNEL32.DLL_GetStartupInfoA]
test dword [esp + 0x2c], 0x100
je 0x20305a
mov ecx, dword [esp + 0x40]
mov dword [ebx + 0x990], ecx
mov ecx, dword [esp + 0x38]
mov dword [ebx + 0x994], ecx
mov ecx, dword [esp + 0x3c]
mov dword [ebx + 0x998], ecx
mov eax, 0xa
test dword [esp + 0x2c], 1
je 0x20306e
add byte [ebp + eax + 0xf], dh
mov bh, 0x44
and al, 0x30
movzx eax, word [esp + 0x30]
add esp, 0x44
mov dword [ebx + 0x5f4], eax
call dword [sym.imp.KERNEL32.DLL_GetCommandLineW]
call fcn.00202cb1
mov dword [ebx + 0x5f0], eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
mov dword [ebx + 0x5fc], eax
call fcn.00202ae0
push 0xff
jb 0x203103
pop eax
push 0
call dword [sym.imp.OLE32.DLL_CoInitialize]
call fcn.00202b41
push eax
mov ebx, section..data
mov ecx, dword [ebx + 0x988]
call fcn.00203109
mov ecx, dword [ebx + 0xdc]
call fcn.00203109
mov ecx, dword [ebx + 0xb8]
jecxz 0x2030db
push ecx
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov edi, dword [ebx + 0x638]
call fcn.00202b46
call fcn.00202b2d
call dword [sym.imp.OLE32.DLL_CoUninitialize]
test word [0x2028a2], 0x1000
jne 0x203103
xor eax, eax
call fcn.0020295d
call dword [sym.imp.KERNEL32.DLL_ExitProcess]

Function at 0x2028e0
Capabilities:
Set console window title

Disassembly:
push ebx
push ecx
push esi
mov esi, section..data
mov eax, dword [esi + 0x3dc]
test eax, eax
jne 0x202959
sub esp, 0x220
mov eax, esp
push 0x100
push eax
call dword [sym.imp.KERNEL32.DLL_GetConsoleTitleW]
mov ebx, eax
mov eax, 0x200020
mov dword [esp + ebx*2], eax
mov dword [esp + ebx*2 + 4], eax
mov dword [esp + ebx*2 + 8], eax
mov eax, 0x20
mov dword [esp + ebx*2 + 0xc], eax
push esp
call dword [sym.imp.KERNEL32.DLL_SetConsoleTitleW]
push 0xc8
call dword [sym.imp.KERNEL32.DLL_Sleep]
push esp
push 0
call dword [sym.imp.USER32.DLL_FindWindowW]
mov word [esp + ebx*2], 0
mov ebx, eax
push esp
call dword [sym.imp.KERNEL32.DLL_SetConsoleTitleW]
mov eax, ebx
mov dword [esi + 0x3dc], eax
add esp, 0x220
pop esi
pop ecx
pop ebx
ret
Function at 0x202ae0
Capabilities:
Allocate thread local storage

Disassembly:
call dword [sym.imp.KERNEL32.DLL_TlsAlloc]
cmp eax, 0xffffffff
stc
je 0x202b2c
mov dword [ebx + 0x5e0], eax
mov dword [ebx + 0x5e8], 0
call fcn.00202e71
jb 0x202b2c
mov dword [ebx + 0x5e4], eax
mov dword [eax + 0x68], 1
mov dword [eax + 0x6c], 1
mov dword [eax + 0x70], 2
mov dword [eax + 0x74], 3
mov dword [eax + 0x78], 0
ret

Function at 0x2034a8
Capabilities:
Terminate process

Disassembly:
push eax
push ecx
push esi
push edi
lea esi, [esp + 0x18]
mov ecx, dword [esi - 4]
push ecx
call fcn.00204574
jb 0x2034de
jecxz 0x2034cb
lea esi, [esi + ecx*4 - 4]
mov eax, dword [esi]
mov byte [edi], al
sub esi, 4
inc edi
loop 0x2034c1
call fcn.0020522e
pop edx
pop edi
pop esi
pop ecx
pop eax
shl edx, 2
pop dword [esp + edx]
add esp, edx
ret
call fcn.0020522c
pop edx
pop edi
pop esi
pop ecx
add esp, 4
shl edx, 2
pop dword [esp + edx]
add esp, edx
jmp fcn.00202d95

Function at 0x2035dc
Capabilities:
Terminate process

Disassembly:
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x64], edi
pop dword [ebp - 0x6c]
pop edx
pop ax
test byte [ebx + 4], 4
je 0x2035fe
pop cx
movzx ecx, ch
add esp, 4
add esp, 8
loop 0x2035f6
jmp dword [ebp - 0x6c]
mov byte [ebx + 5], 2
mov byte [ebx + 4], al
mov dword [ebx], edx
pop word [ebx + 6]
pop dword [ebx + 0x14]
movzx ecx, byte [ebx + 7]
mov esi, ecx
shl esi, 1
add esi, ecx
shl esi, 2
pop dword [ebx + esi + 0x10]
pop dword [ebx + esi + 0xc]
sub esi, 0xc
jne 0x20361b
mov eax, dword [ebx + esi + 0x1c]
sub eax, dword [ebx + esi + 0x18]
jl 0x203690
inc eax
dec ecx
je 0x203653
add esi, 0xc
mov dword [ebx + esi + 0x14], eax
mov eax, dword [ebx + esi + 0x1c]
sub eax, dword [ebx + esi + 0x18]
jl 0x203690
inc eax
mul dword [ebx + esi + 0x14]
dec ecx
ja 0x203636
je 0x203653
jb 0x203690
mov dword [ebx + 8], eax
mul dword [ebx + 0x14]
jb 0x203690
test byte [ebx + 4], 1
je 0x203666
mov dword [ebx + 0xc], eax
jmp 0x203683
push eax
call fcn.00202d46
pop ecx
jb 0x203692
mov dword [ebx], eax
mov dword [ebx + 0xc], ecx
mov edi, eax
cld
xor eax, eax
shr ecx, 1
rep stosw word es:[edi], ax
adc cl, 0
rep stosb byte es:[edi], al
or byte [ebx + 4], 4
mov esi, dword [ebp - 0x68]
mov edi, dword [ebp - 0x64]
jmp dword [ebp - 0x6c]
mov al, 9
mov esi, dword [ebp - 0x68]
mov edi, dword [ebp - 0x64]
push dword [ebp - 0x6c]
jmp fcn.00202d95

Function at 0x203708
Capabilities:
Terminate process

Disassembly:
call fcn.00203715
jb 0x203710
ret
jmp fcn.00202d95
Function at 0x203cdc
Capabilities:
Manipulate console buffer

Disassembly:
push ebx
push ecx
push edx
push esi
push edi
push ebp
mov ebp, esp
sub esp, 0x400
mov ebx, section..data
push esi
push edx
mov eax, dword [ebx + 0x3e8]
shl eax, 4
or eax, dword [ebx + 0x3e4]
shl eax, 0x10
push eax
call fcn.00203ed9
push eax
call fcn.00203e6e
push dx
push ax
mov eax, dword [ebp - 0x40c]
movzx ecx, word [ebp - 0x414]
sub cx, word [ebp - 0x410]
mov edx, dword [ebp - 0x408]
mov esi, dword [ebp - 0x404]
lea edi, [ebp - 0x400]
test edx, edx
je 0x203df7
test byte [ebx + 0x3e1], 0xff
je 0x203d56
mov byte [ebx + 0x3e1], 0
call fcn.00203e21
cld
and ecx, 0xff
push ecx
lodsw ax, word [esi]
stosd dword es:[edi], eax
dec edx
loopne 0x203d5e
mov dword [ebp - 0x408], edx
mov dword [ebp - 0x404], esi
pop edx
sub edx, ecx
movzx ecx, word [ebp - 0x410]
add word [ebp - 0x410], dx
mov ax, word [ebp - 0x40e]
push ax
add cx, dx
dec ecx
push cx
push ax
inc ecx
sub cx, dx
push cx
push esp
push 0
or edx, 0x10000
push edx
lea eax, [ebp - 0x400]
push eax
push dword [ebx + 0x98c]
call dword [sym.imp.KERNEL32.DLL_WriteConsoleOutputW]
pop eax
pop eax
mov ax, word [ebp - 0x410]
cmp ax, word [ebp - 0x414]
jb 0x203df2
mov word [ebp - 0x410], 0
mov ax, word [ebp - 0x40e]
inc ax
cmp ax, word [ebp - 0x412]
je 0x203deb
mov word [ebp - 0x40e], ax
jmp 0x203df2
mov byte [ebx + 0x3e1], 0xff
jmp 0x203d13
movzx eax, word [ebp - 0x410]
movzx ecx, word [ebp - 0x40e]
inc eax
inc ecx
mov dl, byte [ebx + 0x3e1]
call fcn.00203efe
mov byte [ebx + 0x3e1], dl
mov esp, ebp
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret

Function at 0x203efe
Capabilities:
Manipulate console buffer

Disassembly:
push ebx
push edx
push esi
push edi
mov ebx, eax
call fcn.00203e6e
mov esi, eax
mov edi, edx
call fcn.00203ed9
add eax, 0x10001
cmp ebx, 1
jl 0x203f20
cmp ebx, esi
jle 0x203f23
movzx ebx, ax
cmp ecx, 1
jl 0x203f2c
cmp ecx, edi
jle 0x203f35
rol eax, 0x10
movzx ecx, ax
rol eax, 0x10
push eax
push ecx
dec ebx
dec ecx
push cx
push bx
push dword [0x20698c]
call dword [sym.imp.KERNEL32.DLL_SetConsoleCursorPosition]
xor al, al
mov byte [0x2063e1], al
pop ecx
pop eax
pop edi
pop esi
pop edx
pop ebx
ret

Function at 0x203f58
Capabilities:
Terminate process

Disassembly:
push eax
push ecx
push esi
push edi
push ebp
add ebp, dword [ebp - 0x88]
mov esi, dword [ebp - 0x6c]
call fcn.002045d0
jecxz 0x203f89
call fcn.00204574
jb 0x203f8f
lea edi, [edi + ecx - 1]
lodsb al, byte [esi]
mov byte [edi], al
dec edi
loop 0x203f78
mov esi, dword [ebp - 0x6c]
call fcn.002045a8
mov dword [ebp - 0x6c], edx
pop ebp
pop edi
pop esi
pop ecx
pop eax
ret
mov edx, eax
pop ebp
pop edi
pop esi
pop ecx
pop eax
jmp fcn.00202d8a
Function at 0x204123
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov edx, ecx
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
call fcn.002045d0
test eax, eax
jns 0x20413c
add eax, ecx
test edx, edx
je 0x20417c
jns 0x204147
add edx, ecx
js 0x20417c
inc edx
dec edx
add esi, edx
sub ecx, edx
jae 0x204150
xor ecx, ecx
cmp ecx, eax
jb 0x204156
mov ecx, eax
call fcn.00204574
jb 0x204180
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.002046f0
mov esi, dword [ebp - 0x88]
mov dword [ebp + esi - 0x6c], edx
pop edi
pop esi
ret
xor edx, edx
jmp 0x20416a
pop edi
pop esi
jmp fcn.00202d95

Function at 0x204188
Capabilities:
Terminate process

Disassembly:
push edi
xchg ecx, ebx
call fcn.00204574
jb 0x2041a8
call fcn.0020522e
cld
mov ah, al
shr ecx, 1
rep stosw word es:[edi], ax
adc cl, 0
rep stosb byte es:[edi], al
xchg ecx, ebx
pop edi
ret
call fcn.0020522c
pop edi
jmp fcn.00202d95

Function at 0x2047fc
Capabilities:
Terminate process

Disassembly:
or edx, edx
jns 0x2047b6
xor edx, edx
mov esi, eax
mov ecx, edx
pop ebp
call fcn.00204574
jb 0x2047f0
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0020571a
call fcn.002046f0
mov edi, dword [ebp - 0x88]
mov dword [ebp + edi - 0x6c], edx
pop edi
pop esi
pop ecx
pop ebx
pop eax
ret
pop ebp
call fcn.0020571a
jmp 0x2047e2
mov edx, eax
pop edi
pop esi
pop ecx
pop ebx
pop eax
jmp fcn.00202d8a
push eax
call fcn.00204870
jb 0x2047e8
cmp ecx, edx
ja 0x2047e8
mov eax, esi
add esi, edx
sub esi, ecx
mov ebx, ecx
mov ebp, edi
repe cmpsb byte [esi], byte es:[edi]
jne 0x2047b0
sub esi, ebx
sub esi, ebx
sub edx, ebx
jl 0x2047b0
mov ecx, ebx
mov edi, ebp
jmp 0x204812

Function at 0x204b41
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [ebp - 0x88]
mov eax, dword [ebp + esi - 0x6c]
add dword [ebp - 0x88], 4
pop esi
test eax, 1
jne 0x204b61
mov dword [ebx], eax
pop edx
push eax
push edx
ret
push esi
push edi
mov esi, eax
call fcn.002045d0
call fcn.00204574
jb 0x204b86
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
mov dword [ebx], edx
pop eax
push edx
push eax
ret
pop edi
pop esi
mov dword [ebx], edx
pop ebx
push edx
push ebx
jmp fcn.00202d95

Function at 0x205080
Capabilities:
Terminate process

Disassembly:
push eax
push edx
push esi
mov ebx, dword [ebp - 0x84]
sub ebx, 0xe
mov esi, dword [ebx]
sub ebx, 4
shr esi, 1
jb 0x2050ad
je 0x2050a9
shr esi, 1
jae 0x2050ce
shl esi, 2
mov esi, dword [ebp + esi]
call fcn.002045a8
jmp 0x20508c
pop esi
pop edx
pop eax
ret
shr esi, 1
jb 0x2050df
push ebx
shl esi, 2
lea ebx, [ebp + esi]
mov eax, 1
call fcn.00203715
pop ebx
jae 0x20508c
pop esi
pop edx
pop eax
jmp fcn.00202d95
shl esi, 2
mov ecx, dword [ebp + esi]
jecxz 0x20508c
push ecx
mov ecx, dword [ecx]
call dword [ecx + 8]
jmp 0x20508c
lea ecx, [ebp + esi*4]
push ecx
call dword [sym.imp.OLEAUT32.DLL_VariantClear]
jmp 0x20508c
Function at 0x205183
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
add dword [ebp - 0x88], 4
test esi, 1
je 0x2051a3
and esi, 0xfffffffe
jne 0x2051ad
xchg dword [ebx], esi
call fcn.002045a8
pop edi
pop esi
ret
call fcn.002045d0
mov edi, dword [ebx]
or edi, edi
je 0x2051bd
cmp ecx, dword [edi - 4]
je 0x2051dd
call fcn.00204574
jb 0x2051ed
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xchg dword [ebx], edx
mov esi, edx
call fcn.002045a8
pop edi
pop esi
ret
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
ret
xchg dword [ebx], edx
mov esi, edx
call fcn.002045a8
pop edi
pop esi
jmp fcn.00202d95

Function at 0x2055e8
Capabilities:
Terminate process

Disassembly:
push ebx
push ecx
push esi
push edi
mov edi, dword [ebp - 0x88]
mov esi, dword [ebp + edi - 0x6c]
call fcn.002045d0
mov ebx, ecx
push esi
mov esi, dword [ebp + edi - 0x68]
call fcn.002045d0
jecxz 0x20565e
test ebx, ebx
je 0x205666
add ebx, ecx
xchg ecx, ebx
call fcn.00204574
jb 0x205673
xchg ecx, ebx
sub ebx, ecx
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
mov ecx, ebx
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp - 0x88]
mov esi, edx
xchg dword [ebp + edi - 0x68], esi
call fcn.002045a8
mov esi, dword [ebp + edi - 0x6c]
call fcn.002045a8
add dword [ebp - 0x88], 4
pop edi
pop esi
pop ecx
pop ebx
ret
mov esi, dword [ebp + edi - 0x6c]
mov dword [ebp + edi - 0x68], esi
add dword [ebp - 0x88], 4
pop esi
pop edi
pop esi
pop ecx
pop ebx
ret
pop esi
pop edi
pop esi
pop ecx
pop ebx
jmp fcn.00202d95

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
mov ecx, 0xb3d533e
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x70834e14
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x4013ca
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0xe6bf20], 1
mov dword [0xe6bf24], 1
mov dword [0xe6bf28], 1
mov dword [0xe6bf14], 1
mov dword [ebp - 4], 0x400000
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x401415
mov eax, 0
jmp 0x4014af
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x401438
mov eax, 0
jmp 0x4014af
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
movzx eax, ax
cmp eax, 0x10b
je 0x40145a
cmp eax, 0x20b
je 0x40147f
jmp 0x4014aa
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x5c]
cmp eax, 0xe
ja 0x40146c
mov eax, 0
jmp 0x4014af
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x4014af
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x6c]
cmp eax, 0xe
ja 0x401497
mov eax, 0
jmp 0x4014af
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x4014af
mov eax, 0
leave
ret