joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4014d0
Capabilities:
Create process on windows
Read .ini file

Disassembly:
sub esp, 0x684
mov eax, dword [0x40b004]
xor eax, esp
mov dword [esp + 0x680], eax
push ebp
mov ebp, dword [esp + 0x68c]
push esi
push edi
push 0x104
lea eax, [esp + 0x280]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [esp + 0x27c]
push 0x5c
push ecx
call fcn.0040199f
add esp, 8
test eax, eax
je 0x40151e
xor edx, edx
mov word [eax], dx
xor eax, eax
movzx ecx, word [esp + eax + 0x27c]
mov word [esp + eax + 0x74], cx
add eax, 2
test cx, cx
jne 0x401520
lea edi, [esp + 0x74]
add edi, 0xfffffffe
lea esp, [esp]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x401540
mov ecx, 6
mov esi, str.RunLoad.ini
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x74]
push eax
push 0x40
lea ecx, [esp + 0x3c]
push ecx
push str.TaxACT.exe
push 0x40a3a0
movsw word es:[edi], word [esi]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push str.runload
call esi
lea edx, [esp + 0x74]
push edx
push 0x28
lea eax, [esp + 0x14]
push eax
push 0x40a3a8
push 0x40a3ac
push str.runload
call esi
lea ecx, [esp + 0xc]
push ecx
call fcn.0040187b
mov edi, eax
add esp, 4
test edi, edi
je 0x4016fb
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x401678
movzx ecx, word [esp + eax + 0x27c]
mov word [esp + eax + 0x484], cx
add eax, 2
test cx, cx
jne 0x4015c0
lea edi, [esp + 0x484]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4015e2
mov edx, dword [0x40a3b4]
lea eax, [esp + 0x34]
mov dword [edi], edx
mov edx, eax
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401600
lea edi, [esp + 0x484]
sub eax, edx
add edi, 0xfffffffe
jmp 0x401620
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x401620
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
push 5
mov ecx, eax
and ecx, 3
lea eax, [esp + 0x280]
push eax
push 0x40a310
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x490]
push ecx
push 0x40a3b8
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x680]
xor ecx, esp
call fcn.00401856
add esp, 0x684
ret
push ebx
lea edx, [esp + 0x78]
push edx
push 0x28
lea eax, [esp + 0x18]
push eax
push str.1038
push 0x40a3d0
push str.runload
call esi
lea ecx, [esp + 0x10]
push ecx
call fcn.0040187b
mov ebx, eax
add esp, 4
cmp ebx, 0x400
jle 0x4016fa
push 0x40a3d8
push ebp
call fcn.004019cb
mov esi, eax
add esp, 8
test esi, esi
je 0x4016fa
push 0x2f
push esi
call fcn.0040199f
add esp, 8
test eax, eax
je 0x4016d5
xor edx, edx
mov word [eax], dx
lea eax, [esp + 0x78]
push eax
add esi, 6
push esi
push str.data
push str.runload
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 0
push 0
push ebx
push edi
call dword [sym.imp.USER32.dll_PostMessageW]
pop ebx
mov ecx, dword [esp + 0x68c]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.00401856
add esp, 0x684
ret

Function at 0x401856
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40b004]
jne 0x401860
repz ret
jmp fcn.00401bdd
Function at 0x405d96
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00403d50
and dword [ebp - 4], 0
cmp dword [0x40c5d8], 0
mov ebx, eax
jne 0x405e47
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x405ef8
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x405ef8
push eax
call fcn.00403cde
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40c5d8], eax
call esi
push eax
call fcn.00403cde
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40c5dc], eax
call esi
push eax
call fcn.00403cde
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x40c5e0], eax
call esi
push eax
call fcn.00403cde
pop ecx
mov dword [0x40c5e8], eax
test eax, eax
je 0x405e47
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00403cde
pop ecx
mov dword [0x40c5e4], eax
mov eax, dword [0x40c5e4]
cmp eax, ebx
je 0x405e9f
cmp dword [0x40c5e8], ebx
je 0x405e9f
push eax
call fcn.00403d59
push dword [0x40c5e8]
mov esi, eax
call fcn.00403d59
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x405e9f
test edi, edi
je 0x405e9f
call esi
test eax, eax
je 0x405e96
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x405e96
test byte [ebp - 0xc], 1
jne 0x405e9f
or dword [ebp + 0x10], 0x200000
jmp 0x405ed8
mov eax, dword [0x40c5dc]
cmp eax, ebx
je 0x405ed8
push eax
call fcn.00403d59
pop ecx
test eax, eax
je 0x405ed8
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x405ed8
mov eax, dword [0x40c5e0]
cmp eax, ebx
je 0x405ed8
push eax
call fcn.00403d59
pop ecx
test eax, eax
je 0x405ed8
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40c5d8]
call fcn.00403d59
pop ecx
test eax, eax
je 0x405ef8
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x405efa
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x633529
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 2]
mov dword [esp], edx
call 0x63352b
imul ebp, esp, 0x73f40562
jns 0x63357f
mov ebx, 0x88e8eb92
inc esp
and al, 1
call fcn.00633564
or eax, 0x97641d8d
popfd
push ds
mov ebx, gs
invalid
jmp 0x633513
jmp 0xe558e49c

Function at 0x633564
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 2]
lea esp, [esp + 2]
mov dword [esp], esp
push dx
jmp 0x633584
mov dword [esp + 4], ebx
push edx
mov dword [esp], edi
jmp 0x63354e
lea esp, [esp + 2]
push ebp
pushfd
call fcn.0063356e

Function at 0x63356e
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop dword [esp]
mov word [esp], bx
push bp
call fcn.006335a5
sahf
sbb byte [esi - 0xa50e717], cl
in al, 0x8d
and al, 2
Function at 0x6335a5
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 2]
mov dword [esp + 4], esi
pushal
push esi
mov dword [esp + 0x24], edi
call fcn.006335a7
pop ss
jle 0x6335ee
jmp 0x63358f
bswap esi
lea ecx, reloc.MSVCRT.dll___dllonexit
mov si, bp
lea esi, [ebp*4]
xchg bp, di
stc
jmp 0x633610
lea esp, [esp + 3]
xchg dword [esp + 0x14], ecx
adc al, dh
not dl
mov si, cx
adc si, 0x1b06
jmp 0x6335dc
bsf eax, ecx
xchg dword [esp + 0x14], ecx
pushal
stc
mov ebp, dword [esp + 0x1d]
call fcn.0063364f
js 0x63367f
mov dl, 0xad
mov esp, 0x661dec83
sub esp, 0x1d
xchg bx, bp
lea esp, [esp + 6]
lea ebx, reloc.MSVCRT.dll___dllonexit
jmp 0x6335fa
jmp 0x6336cb
scasd eax, dword es:[edi]
das
mov edi, 0xc28029da
jge 0x633613
je 0x6336ae
sub al, 0x8a
out 0xb0, al
outsb dx, byte [esi]
adc dh, 0x98
jp 0x633671
jnp 0x6336cb
dec ecx
into
pop esp
cmp edx, esi
pushal
fldenv [ebx - 0xd]
xchg esi, eax
shl dword gs:[esi], 1
push ecx
rcl byte [ebx - 0x36]
push bp
push word [esp + 1]
push dword [esp + 0x28]
ret 0x2c
jmp 0x6336ff
lea ebp, [esp]
setne al
xchg ecx, eax
clc
jg 0x6336b5
rol cx, 9
jmp 0x633703
rol cx, 9
sub esp, 0xc0
jmp 0x633738
inc eax
jbe 0x63385c
lea ecx, [ebx*4]
jmp 0x633793
mov edi, esp
mov cl, byte [esp]
rdtsc
mov bx, word [esp]
mov ebx, esi
jmp 0x633722
xor esi, 0x49b2eccf
sub esp, 3
jnp 0x63376f
push word [esp]
xchg ah, cl
setl dl
rdtsc
rcr cx, 0xc
jmp 0x633825
btc edx, edi
jmp 0x633872
push word [esp]
jmp 0x633779
xchg ah, cl
setl dl
rdtsc
jmp 0x633821
mov dx, word [esp]
lea eax, [esp + 0x6d]
mov dx, 0xa120
jmp 0x633767
bswap ecx
call fcn.006337b7
mov al, 0x94
bswap edx
sub esp, 0x19
je 0x633809
mov byte [esp + 0xe], ch
mov ecx, dword [esp]
call fcn.00633999
sar dword [edx - reloc.MSVCRT.dll___dllonexit], 0x9c
ror esi, 0
jmp 0x6337e8
mov byte [esp + 0xe], ch
jmp 0x633833
rcr cx, 0xc
pop cx
lea esp, [esp + 3]
sub esi, 0x25175dd6
jmp 0x6337e1
mov ecx, dword [esp]
mov word [esp + 0x10], di
jmp 0x6338f4
lea ecx, [ebx*4]
mov dx, word [esp]
lea eax, [esp + 0x6d]
mov dx, 0xa120
btc edx, edi
mov dh, dl
lea ecx, reloc.MSVCRT.dll___dllonexit
mov ax, bx
jmp 0x633747
mov cx, 0x1fde
cmc
jae 0x63391a
neg cx
jmp 0x633904
lea esp, [esp + 1]
lea esp, [esp + 0x24]
not esi
mov dx, 0xc1d
jmp 0x6338de
mov al, ch
jmp 0x63391f
neg cx
mov al, ch
dec esi
setnp cl
cmc
jmp 0x633979
mov eax, esi
rdtsc
call fcn.00633981
mov cl, 0x10
neg al
jmp 0x633a6a
jae 0x63392a
mov eax, esi
rdtsc
jmp 0x63392e

Function at 0x6337a1
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg dl
jle 0x6337bc
dec dl
jmp 0x6337c8
dec dl
mov dword [esp + 2], eax
jmp 0x6337fe
mov dword [esp + 2], eax
mov edx, 0xc2b2e695
pushfd
jmp 0x633804
mov edx, 0xc2b2e695
pushfd
Function at 0x63582a
Capabilities:
Execute anti-debugging instructions

Disassembly:
add dword [ebp - reloc.MSVCRT.dll___dllonexit], ecx
fsub dword [esi - 0x71]
add al, 0x24
mov byte [esp], ch
jmp 0x635865
mov dword [esp], edx
mov dword [esp], esp
mov dword [esp], esp
call 0x63582a
mov word [esp], bp
call 0x635873
inc esp
rcl dword [ecx + 0x30], 0xc3
ja 0x635823
inc edi
xlatb
mov dl, 0x41
std
jp 0x6358ba
lea esp, [esp + 1]
lea esp, [esp + 1]
push ebp
call 0x63584e
mov byte [esp + 6], ch
mov dword [esp + 4], esi
jmp 0x6358b9
pushfd
call fcn.006358a3

Function at 0x635840
Capabilities:
Execute anti-debugging instructions

Disassembly:
add dword [ebp - reloc.MSVCRT.dll___dllonexit], ecx
fsub dword [esi - 0x71]
add al, 0x24
mov byte [esp], ch
jmp 0x635865
mov dword [esp], edx
mov dword [esp], esp
mov dword [esp], esp
call 0x63582a
mov word [esp], bp
call 0x635873
inc esp
rcl dword [ecx + 0x30], 0xc3
ja 0x635823
inc edi
xlatb
mov dl, 0x41
std
jp 0x6358ba
lea esp, [esp + 1]
lea esp, [esp + 1]
push ebp
call 0x63584e
mov byte [esp + 6], ch
mov dword [esp + 4], esi
jmp 0x6358b9
pushfd
call fcn.006358a3

Function at 0x63584e
Capabilities:
Execute anti-debugging instructions

Disassembly:
add dword [ebp - reloc.MSVCRT.dll___dllonexit], ecx
fsub dword [esi - 0x71]
add al, 0x24
mov byte [esp], ch
jmp 0x635865
mov dword [esp], edx
mov dword [esp], esp
mov dword [esp], esp
call 0x63582a
mov word [esp], bp
call 0x635873
inc esp
rcl dword [ecx + 0x30], 0xc3
ja 0x635823
inc edi
xlatb
mov dl, 0x41
std
jp 0x6358ba
lea esp, [esp + 1]
lea esp, [esp + 1]
push ebp
call 0x63584e
mov byte [esp + 6], ch
mov dword [esp + 4], esi
jmp 0x6358b9
pushfd
call fcn.006358a3

Function at 0x635873
Capabilities:
Execute anti-debugging instructions

Disassembly:
add dword [ebp - reloc.MSVCRT.dll___dllonexit], ecx
fsub dword [esi - 0x71]
add al, 0x24
mov byte [esp], ch
jmp 0x635865
mov dword [esp], edx
mov dword [esp], esp
mov dword [esp], esp
call 0x63582a
mov word [esp], bp
call 0x635873
inc esp
rcl dword [ecx + 0x30], 0xc3
ja 0x635823
inc edi
xlatb
mov dl, 0x41
std
jp 0x6358ba
lea esp, [esp + 1]
lea esp, [esp + 1]
push ebp
call 0x63584e
mov byte [esp + 6], ch
mov dword [esp + 4], esi
jmp 0x6358b9
pushfd
call fcn.006358a3
Function at 0x6358a3
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf0621814
jmp 0x6358cd
call 0x635892
mov byte [esp + 1], dh
mov dword [esp], eax
push ecx
push ecx
pop dword [esp]
push word [esp + 2]
jmp 0x6357b0
jp 0x6357f6
lea esp, [esp + 2]
mov dword [esp], ecx
jmp 0x6357fd
lea esp, [esp + 2]
mov dword [esp], ecx
call fcn.0063579a
mov dword [esp], ebx
call fcn.00635840
cmp dword [edx + reloc.MSVCRT.dll___dllonexit], edi
sbb dword [edi + 0x58996a0f], ebx
jb 0x635885
mov dword [esp], eax
mov byte [esp + 2], bh
push word [esp + 1]
lea esp, [esp + 2]
jmp 0x635802
imul ecx, dword [esi], reloc.MSVCRT.dll___dllonexit
or ebx, dword [edi - 0x24]
jb 0x6358a2
in al, 7
test eax, 0x89666bc8
dec esp
and al, 1
mov word [esp], ax
mov dword [esp], edx
jmp 0x6356fb
dec dword [edi - reloc.MSVCRT.dll___dllonexit]
xor al, 0x24
mov byte [esp + 2], dl
mov dword [esp], ebp
jmp 0x6358bf
mov dword [esp + 4], edi
lea esp, [esp + 4]
pushfd
jmp 0x634821
mov bh, byte [esp]
rcr ah, cl
jmp 0x635978
lea esp, [esp + 2]
jmp 0x635948
jge 0x63593f
mov di, ax
mov bl, ch
jmp 0x6358f4
mov cl, 0x1f
jmp 0x635952
mov cl, 0x1f
bsr ebx, eax
xchg cx, bp
jmp 0x635958
mov ebp, esp
not cl
mov ebx, esi
sub esp, 0x16
js 0x635960
rdtsc
mov ecx, 0xf8975dc3
jmp 0x635962
mov di, ax
mov bl, ch
lea esp, [esp + 2]
lea edi, [esp + 0xc]
neg ebp
jne 0x635913
je 0x63591c
bsr ebx, eax
xchg cx, bp
sub esp, 0xb4
jmp 0x635926
jmp 0x6359e1
lea esp, [esp + 6]
mov cx, 0xc406
bswap ecx
jmp 0x6359f2
js 0x635b03
lea ebx, [ebp - 0x7d]
jmp 0x635b06
xchg edx, eax
call 0x6359cb
mov byte [0xeb310f92], al
push 0x94cd5dda
loop 0x6359c5
xchg edx, eax
rdtsc
jmp 0x6359fa
scasb al, byte es:[edi]
cmp al, 0x5b
mov dh, 0x46
ret
mov al, 0x95
add esi, 0x40853e88
dec cx
jp 0x635986
jnp 0x63598d
rdtsc
lea eax, [eax*4]
mov edx, esi
jmp 0x635a22
ret 0xc031
rdtsc
mov ecx, 0xf8975dc3
lea esp, [esp + 6]
mov cx, 0xc406
bswap ecx
lea edx, reloc.MSVCRT.dll___dllonexit
jmp 0x6359a7
lea eax, [eax*4]
mov edx, esi
jmp 0x635a22
stc
lea eax, [ebp*4]
xchg dx, ax
push dword [esp + 4]
ret 8
rol esi, 0
clc
jmp 0x635a76
add ax, bp
inc esi
mov eax, dword [esp]
jmp 0x635a60
sub esp, 8
jmp 0x635a93
xchg dx, cx
mov ch, byte [esp]
bswap ecx
mov eax, 0x7c7d3d74
xchg dword [esp], esi
push esp
jmp 0x635a10
xchg ecx, edx
bswap edx
rcl ecx, 0x18
jle 0x635a35
sub esp, 8
rcl cx, cl
jmp 0x635a96
jge 0x635a2c
add ax, bp
jmp 0x635a2f
rcl cx, cl
lea esp, [esp + 8]
xor esi, 0x7d327889
call 0x635a7d
push edx
xlatb
inc edi
and dl, cl
cmp al, 0xc8
dec eax
fidivr word [ecx - 0x6b9a48b8]
pop es
scasb al, byte es:[edi]
setg dl
rdtsc
setae ah
shl ch, 0
lea esi, [esi + 0x29]
mov ecx, edx
jmp 0x635a4d
lea ebx, [ebp - 0x7d]
mov esi, dword [esp + 0x2c]
sub esp, 0xe
jmp 0x63590a
Function at 0xab7a45
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 9]
xchg ebx, edx
jmp 0xab7a29

Function at 0xab7ea7
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, dword [esp + 7]
mov ah, byte [esp + 5]
bswap ebx
not ebx
jmp 0xab7f92
mov edi, esp
mov bx, bp
rcr esi, cl
push dword [esp + 0xa]
xchg ebx, ecx
add dh, cl
jmp 0xab7f1f
sbb ah, bh
mov dl, al
sub bx, cx
bsr ebx, ebx
push dword [esp + 4]
xchg dword [esp + 6], ecx
jmp 0xab7ef1
add esp, 0xc
btr eax, ebx
rdtsc
cmc
mov ch, cl
xchg word [esp], bp
jmp 0xab7f66
cpuid
push dword [esp + 2]
xchg dh, bl
lea esp, [esp + 5]
mov edx, 0x7348d1a4
mov edx, 0x4cc3ddd6
jmp 0xab7f0b
push word [esp + 1]
shr esi, 0x19
mov edx, dword [esp + 4]
seto cl
jmp 0xab7f76
mov word [esp], dx
mov byte [esp], cl
sets ch
cmc
not cl
cld
jmp 0xab7f4f
lea esp, [esp + 2]
shl ebx, cl
mov ebx, 0xe511cae7
mov bl, byte [esp + 2]
add esp, 1
neg cx
jmp 0xab7fbe
mov al, ah
xchg dword [esp], ecx
mov ebx, 0x8bb98840
xchg word [esp], cx
xchg dword [esp + 3], ebp
rdtsc
jmp 0xab7f37
lea ebx, [edx + edx]
xchg word [esp + 0xe], si
cpuid
rdtsc
xchg dword [esp + 0xa], edi
jmp 0xab7fe5
xchg al, bl
sub esp, 0x14
xchg byte [esp + 0x13], cl
pop esi
mov dh, dl
lea edx, [ecx + ebp]
jmp 0xab7fa8
add esp, 0xd
setle dh
mov edx, eax
mov dword [esp + 0x10], edi
xchg dword [esp + 2], ebx
jmp 0xab9fc5
bsf ebx, esp
mov bp, word [esp + 0xe]
pop ebp
pushal
pushfd
add esp, 0xc
jmp 0xab7fcf
xchg edi, eax
mov dword [esp + 5], ebp
xchg dword [esp + 5], esi
xchg word [esp + 1], dx
add esp, 3
call fcn.00ab808f
mov word [esp], sp
mov bx, word [esp + 6]
xchg dword [esp + 5], edx
cpuid
mov dx, word [esp + 5]
xchg bh, ch
jmp 0xab80f7
mov bh, 0x42
mov esi, 0x2c25ec48
xchg ch, dl
add esp, 9
cpuid
pop eax
jmp 0xab843a
lea ebx, reloc.MSVCRT.dll___dllonexit
mov word [esp + 0xb], di
mov bp, word [esp + 4]
pop ebp
lea edx, [edi + edi]
push word [esp + 0xb]
jmp 0xab856b

Function at 0xab846b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bx, word [esp + 2]
mov al, byte [esp + 3]
mov word [esp], bx
jmp 0xab846f
mov edx, eax
jmp 0xab8455
push word [esp]
inc eax
xchg dl, bh
mov word [esp + 2], di
mov ebx, 0x7a455307
mov ecx, edx
jmp 0xab84b2
bt ax, cx
rcl ebp, cl
xchg edx, ebx
xchg byte [esp + 1], cl
xchg bh, dh
lea edx, [ebp*4]
jmp 0xab849c

Function at 0xab87e1
Capabilities:
Parse pe header

Disassembly:
mov byte [esp + 2], bl
jmp 0xab8870
push dword [esp + 1]
mov dword [esp + 4], ebx
push esp
pop word [esp]
push word [esp + 1]
mov dword [esp], eax
call fcn.00ab8843
pushal
mov dword [esp + 0x11], esp
lea esp, [esp + 0x14]
mov dword [esp + 6], ebx
pop word [esp]
push word [esp + 7]
jmp 0xab894f

Function at 0xab8843
Capabilities:
Parse pe header

Disassembly:
pushfd
mov dword [esp + 0xc], esp
pushal
mov dword [esp], ebp
mov dword [esp + 0x28], ebp
pushal
jmp 0xab8845
jmp 0xab8825
mov dword [esp + 0xc], ebp
mov dword [esp + 0xd], eax
lea esp, [esp + 3]
call fcn.00ab8857
push esi

Function at 0xab8857
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
push dword [esp + 0xc]
lea esp, [esp + 1]
mov dword [esp + 0x48], esi
jmp 0xab888a
Function at 0x435ff7
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00421d43
and dword [ebp - 4], 0
cmp dword [0x44d9f4], 0
mov ebx, eax
jne 0x4360a8
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x436159
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x436159
push eax
call fcn.00421cd1
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x44d9f4], eax
call esi
push eax
call fcn.00421cd1
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x44d9f8], eax
call esi
push eax
call fcn.00421cd1
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x44d9fc], eax
call esi
push eax
call fcn.00421cd1
pop ecx
mov dword [0x44da04], eax
test eax, eax
je 0x4360a8
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00421cd1
pop ecx
mov dword [0x44da00], eax
mov eax, dword [0x44da00]
cmp eax, ebx
je 0x436100
cmp dword [0x44da04], ebx
je 0x436100
push eax
call fcn.00421d4c
push dword [0x44da04]
mov esi, eax
call fcn.00421d4c
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x436100
test edi, edi
je 0x436100
call esi
test eax, eax
je 0x4360f7
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4360f7
test byte [ebp - 0xc], 1
jne 0x436100
or dword [ebp + 0x10], 0x200000
jmp 0x436139
mov eax, dword [0x44d9f8]
cmp eax, ebx
je 0x436139
push eax
call fcn.00421d4c
pop ecx
test eax, eax
je 0x436139
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x436139
mov eax, dword [0x44d9fc]
cmp eax, ebx
je 0x436139
push eax
call fcn.00421d4c
pop ecx
test eax, eax
je 0x436139
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x44d9f4]
call fcn.00421d4c
pop ecx
test eax, eax
je 0x436159
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x43615b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x315f4f60
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x375c5851
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x4020a4
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x144], ecx
mov dword [ebp - 0x148], ecx
mov dword [ebp - 0x138], ecx
mov dword [ebp - 0x13c], ecx
mov dword [ebp - 0x140], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sub.rtl70.bpl__System__LStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x402212
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, 2
call fcn.00401be4
mov esi, eax
mov dword [ebp - 0x134], 0x128
lea edx, [ebp - 0x134]
mov eax, esi
call fcn.00401c04
mov ebx, eax
xor edi, edi
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call sub.rtl70.bpl__Sysutils_UpperCase_qqrx17System_AnsiString
jmp 0x4021d4
lea eax, [ebp - 0x140]
lea edx, [ebp - 0x110]
mov ecx, 0x104
call sub.rtl70.bpl__System__LStrFromArray_qqrr17System_AnsiStringpci
mov eax, dword [ebp - 0x140]
lea edx, [ebp - 0x13c]
call sub.rtl70.bpl__Sysutils_ExtractFileName_qqrx17System_AnsiString
mov eax, dword [ebp - 0x13c]
lea edx, [ebp - 0x138]
call sub.rtl70.bpl__Sysutils_UpperCase_qqrx17System_AnsiString
mov eax, dword [ebp - 0x138]
mov edx, dword [ebp - 0xc]
call sub.rtl70.bpl__System__LStrCmp_qqrv
je 0x4021a7
lea eax, [ebp - 0x148]
lea edx, [ebp - 0x110]
mov ecx, 0x104
call sub.rtl70.bpl__System__LStrFromArray_qqrr17System_AnsiStringpci
mov eax, dword [ebp - 0x148]
lea edx, [ebp - 0x144]
call sub.rtl70.bpl__Sysutils_UpperCase_qqrx17System_AnsiString
mov eax, dword [ebp - 0x144]
mov edx, dword [ebp - 0xc]
call sub.rtl70.bpl__System__LStrCmp_qqrv
jne 0x4021c5
push 0
mov eax, dword [ebp - 0x12c]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
inc edi
cmp edi, dword [ebp - 8]
jge 0x4021dc
lea edx, [ebp - 0x134]
mov eax, esi
call fcn.00401c24
mov ebx, eax
test ebx, ebx
jne 0x402128
push esi
call sub.kernel32.dll_CloseHandle
mov ebx, edi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402219
lea eax, [ebp - 0x148]
mov edx, 5
call sub.rtl70.bpl__System__LStrArrayClr_qqrpvi
lea eax, [ebp - 0xc]
call sub.rtl70.bpl__System__LStrClr_qqrpv
lea eax, [ebp - 4]
call sub.rtl70.bpl__System__LStrClr_qqrpv
ret
Function at 0x4032fc
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sub.rtl70.bpl__System__LStrAddRef_qqrpv
mov eax, dword [ebp - 8]
call sub.rtl70.bpl__System__LStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x40339e
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [ebp - 4]
call sub.rtl70.bpl__Sysutils_FileExists_qqrx17System_AnsiString
test al, al
je 0x403383
mov eax, dword [ebp - 8]
call sub.rtl70.bpl__System__LStrToPChar_qqrx17System_AnsiString
mov esi, eax
mov eax, esi
call fcn.00403288
mov eax, dword [ebp - 8]
call sub.rtl70.bpl__Sysutils_DeleteFile_qqrx17System_AnsiString
push 0
push esi
mov eax, dword [ebp - 4]
call sub.rtl70.bpl__System__LStrToPChar_qqrx17System_AnsiString
mov edi, eax
push edi
call sub.kernel32.dll_CopyFileA
test eax, eax
jne 0x40336e
mov bl, 1
jmp 0x403383
cmp byte [ebp - 9], 0
je 0x403383
mov eax, edi
call fcn.00403288
mov eax, dword [ebp - 4]
call sub.rtl70.bpl__Sysutils_DeleteFile_qqrx17System_AnsiString
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4033a5
lea eax, [ebp - 8]
mov edx, 2
call sub.rtl70.bpl__System__LStrArrayClr_qqrpvi
ret