joyce8/EMBER2024-capa huggingface dataset:
Function at 0x419ec0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov dword [esp + 0x20], 0x23b521c2
mov dword [esp + 0x24], 0xdf57ddbd
mov dword [esp + 0x28], 0xdb0ed912
mov dword [esp + 0x2c], 0xd736d546
lea eax, [esp + 0x30]
mov word [esp + 0x30], 0xd1d6
mov dword [esp + 0x32], 0
mov dword [esp + 0x36], 0
mov dword [esp + 0x3a], 0
mov dword [esp + 0x3e], 0
mov byte [esp + 0x42], 0
mov dword [esp + 0xc], 0
mov ecx, dword [esp + 0xc]
cmp ecx, 0x22
ja 0x419f57
nop
nop
nop
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0xc]
add cl, 0xfb
xor cl, byte [esp + edx + 0x20]
add cl, 0x23
mov edx, dword [esp + 0xc]
mov byte [esp + edx + 0x20], cl
inc dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
cmp ecx, 0x23
jb 0x419f30
mov ebx, dword [ebp + 8]
lea edi, [esp + 0xc]
lea esi, [esp + 0x20]
mov edx, esi
mov ecx, 4
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x1c]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x419f90
mov edi, esi
cmp eax, 0xffffffed
jge 0x419fa9
mov eax, 0xffffffff
jmp 0x419fac
add eax, 0x12
push eax
call fcn.00435440
add esp, 4
mov esi, eax
movzx ecx, word [ebx]
test cx, cx
je 0x419fe1
add ebx, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [ebx]
add ebx, 2
test cx, cx
jne 0x419fd0
mov word [eax], 0
movzx ecx, word [esp + 0xc]
test cx, cx
je 0x41a011
lea edx, [esp + 0xe]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41a000
mov word [eax], 0
push edi
push esi
call fcn.0043a250
add esp, 8
not eax
shr eax, 0x1f
mov eax, dword [eax*4 + 0x441a4c]
mov ecx, 0x8b573026
xor ecx, dword [0x441a54]
add eax, ecx
inc eax
xor ebx, ebx
jmp eax
Function at 0x41db10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
mov eax, 0x2220
call fcn.00408760
mov dword [esp + 0x1210], 0x63da65c2
mov dword [esp + 0x1214], 0x6fa961a9
mov dword [esp + 0x1218], 0x6bd16dd9
mov dword [esp + 0x121c], 0x57d669d6
mov dword [esp + 0x1220], 0x53f055f1
mov dword [esp + 0x1224], 0x5fed51e9
mov dword [esp + 0x1228], 0x5be25d95
mov word [esp + 0x122c], 0x595a
mov dword [esp + 0x122e], 0
mov dword [esp + 0x1232], 0
mov dword [esp + 0x1236], 0
mov dword [esp + 0x1239], 0
mov dword [esp + 0xa0], 0
mov eax, dword [esp + 0xa0]
cmp eax, 0x2c
ja 0x41dbfa
nop
nop
nop
mov eax, dword [esp + 0xa0]
mov ecx, dword [esp + 0xa0]
add al, 0x91
xor al, byte [esp + ecx + 0x1210]
add al, 9
mov ecx, dword [esp + 0xa0]
mov byte [esp + ecx + 0x1210], al
inc dword [esp + 0xa0]
mov eax, dword [esp + 0xa0]
cmp eax, 0x2d
jb 0x41dbc0
lea eax, [esp + 0x1c]
lea edi, [esp + 0x1210]
push 0
push 0
push 0x20019
push eax
push edi
call fcn.0043a900
add esp, 0x14
shr eax, 0x1f
mov eax, dword [eax*4 + 0x4426d4]
mov ecx, 0x36c1f367
xor ecx, dword [0x4426dc]
add eax, ecx
inc eax
jmp eax
mov edx, dword [esi + 0x28]
inc ebx
movzx ecx, byte [edx]
test cl, cl
mov dword [esi + 0x28], edx
je 0x4287cb
inc edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [ebx], cl
inc ebx
movzx ecx, byte [edx]
inc edx
test cl, cl
jne 0x4287c0
mov byte [ebx], 0
mov edi, dword [edi]
xor eax, eax
test edi, edi
setne al
mov eax, dword [eax*4 + 0x443ee4]
mov ecx, 0x62b8497a
xor ecx, dword [0x443eec]
add eax, ecx
inc eax
jmp eax
add bh, al
test byte [eax + ecx*2], ah
add al, byte [eax]
add byte [eax], al
add byte [eax], al
add bh, al
inc esp
and al, 0x60
add byte [eax], al
add byte [eax], al
mov ecx, dword [esp + 0x60]
cmp ecx, 0x2d
jae 0x42a26f
jmp 0x42a239
mov ecx, dword [esp + 0x60]
mov edx, dword [esp + 0x60]
mov dl, byte [esp + edx + 0x230]
add cl, 0x32
xor cl, dl
add cl, 0xa2
mov edx, dword [esp + 0x60]
mov byte [esp + edx + 0x230], cl
mov ecx, dword [esp + 0x60]
inc ecx
mov dword [esp + 0x60], ecx
mov ecx, dword [esp + 0x60]
cmp ecx, 0x2d
jb 0x42a239
jmp 0x42a26f
mov ecx, dword [eax]
mov ecx, dword [ecx + 0x10]
lea edx, [esp + 0x2b0]
mov dword [esp + 0xc], edx
lea edx, [esp + 0x230]
mov dword [esp + 4], edx
mov dword [esp], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0
call ecx
sub esp, 0x18
not eax
shr eax, 0x1f
mov dword [esp + 0x490], eax
mov eax, dword [esp + 0x494]
mov ecx, dword [esp + 0x490]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x4443c8]
xor eax, 0xdbe90ffc
sub ecx, eax
xor eax, eax
jmp ecx
Function at 0x42eab0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xa0
mov eax, dword [ebp + 8]
mov byte [esp + 0x17], 0
xor eax, eax
lea eax, [esp + 0x5c]
mov dword [esp], 0
mov dword [esp + 4], eax
call dword [sym.imp.USER32.dll_GetWindowInfo]
sub esp, 8
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
sub esp, 4
cmp eax, 0
je 0x42ec74
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
sub esp, 4
mov dword [esp + 0x20], eax
cmp dword [esp + 0x20], 0
setne al
test al, 1
jne 0x42eb21
jmp 0x42ec66
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call fcn.004088b0
mov dword [esp + 0x28], eax
cmp dword [esp + 0x28], 0
setne al
test al, 1
jne 0x42eb56
jmp 0x42ec52
mov esi, dword [ebp + 8]
mov edi, dword [esp + 0x28]
mov ebx, dword [esp + 0x2c]
jmp 0x42eb63
call fcn.0040f5a0
mov al, byte [esp + 0x1c]
mov byte [esp + 0x24], al
mov byte [esp + 0x30], 0xeb
mov byte [esp + 0x31], 0xc1
mov byte [esp + 0x32], 0xc3
mov byte [esp + 0x33], 0xc3
mov byte [esp + 0x34], 0xcc
mov byte [esp + 0x35], 0xc0
mov byte [esp + 0x36], 0xcf
mov byte [esp + 0x37], 0x41
mov byte [esp + 0x38], 0xb2
mov byte [esp + 0x39], 0xff
mov byte [esp + 0x3a], 0x40
mov byte [esp + 0x3b], 0x43
mov byte [esp + 0x3c], 0x46
mov byte [esp + 0x3d], 0xc9
mov dword [esp + 0x4a], 0
mov dword [esp + 0x46], 0
mov dword [esp + 0x42], 0
mov dword [esp + 0x3e], 0
mov dword [esp + 0x18], 0
mov eax, dword [esp + 0x18]
cmp eax, 0x1e
jae 0x42ec29
jmp 0x42ebe9
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
movzx ecx, byte [esp + ecx + 0x30]
mov edx, eax
add edx, 0x9fbb8a39
lea eax, [eax + ecx - 0x604475c7]
and edx, ecx
add edx, edx
sub eax, edx
add al, 0x71
mov ecx, dword [esp + 0x18]
mov byte [esp + ecx + 0x30], al
mov eax, dword [esp + 0x18]
inc eax
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
cmp eax, 0x1e
jb 0x42ebe9
jmp 0x42ec29
lea eax, [esp + 0x30]
mov ecx, esi
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], edi
call fcn.00409140
sub esp, 0xc
jmp 0x42ec44
and al, 1
mov byte [esp + 0x17], al
jmp 0x42ec4c
jmp 0x42ec4e
jmp 0x42ec50
jmp 0x42ec52
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
sub esp, 4
jmp 0x42ec64
jmp 0x42ec66
jmp 0x42ec68
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x42ec70
jmp 0x42ec72
jmp 0x42ec74
mov al, byte [esp + 0x17]
and al, 1
movzx eax, al
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x439370
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov dword [esp + 0x10], 0x7b787956
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xf
ja 0x4393ed
nop
nop
nop
nop
nop
mov edx, dword [esp]
mov eax, dword [esp]
movzx esi, byte [esp + eax + 0x10]
lea eax, [edx - 0x513a951]
mov ecx, eax
and ecx, esi
xor eax, esi
mov edi, 0x50
sub edi, edx
or edi, esi
add edi, edx
add edi, ecx
sub eax, edi
lea eax, [eax + ecx*2]
add al, 0x87
mov ecx, dword [esp]
mov byte [esp + ecx + 0x10], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x10
jb 0x4393b0
mov eax, dword [esp + 0x10]
mov eax, dword fs:[eax]
xor ecx, ecx
cmp dword [ebp + 8], 0
sete cl
mov ecx, dword [ecx*4 + 0x446fb0]
mov edx, 0xe68f69a0
xor edx, dword [0x446fb8]
add ecx, edx
inc ecx
jmp ecx
Function at 0x4013ca
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x40706c], 1
mov dword [0x407070], 1
mov dword [0x407074], 1
mov dword [ebp - 4], 0x400000
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x40140b
mov eax, 0
jmp 0x4014a5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x40142e
mov eax, 0
jmp 0x4014a5
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
movzx eax, ax
cmp eax, 0x10b
je 0x401450
cmp eax, 0x20b
je 0x401475
jmp 0x4014a0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x5c]
cmp eax, 0xe
ja 0x401462
mov eax, 0
jmp 0x4014a5
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x4014a5
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x6c]
cmp eax, 0xe
ja 0x40148d
mov eax, 0
jmp 0x4014a5
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x4014a5
mov eax, 0
leave
ret

Function at 0x401a37
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x364
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s.
lea eax, [ebp - 0x110]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x250]
mov dword [esp + 4], eax
lea eax, [ebp - 0x110]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_FindFirstFileA]
call eax
sub esp, 8
mov dword [ebp - 0xc], eax
mov dword [esp + 4], 0x4050a8
lea eax, [ebp - 0x250]
add eax, 0x2c
mov dword [esp], eax
mov eax, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
call eax
test eax, eax
je 0x401b3e
mov dword [esp + 4], 0x4050aa
lea eax, [ebp - 0x250]
add eax, 0x2c
mov dword [esp], eax
mov eax, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
call eax
test eax, eax
je 0x401b3e
lea eax, [ebp - 0x250]
add eax, 0x2c
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_s
lea eax, [ebp - 0x354]
mov dword [esp], eax
call sym._sprintf
mov eax, dword [ebp - 0x250]
and eax, 0x10
test eax, eax
je 0x401b0e
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
lea eax, [ebp - 0x354]
mov dword [esp], eax
call sym._FindFiles
jmp 0x401b3f
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + 4]
mov eax, dword [eax]
add eax, 1
adc edx, 0
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + 4]
mov eax, dword [eax]
mov ebx, 0xf423a
mov ecx, 0
cmp ebx, eax
sbb ecx, edx
jb 0x401b61
jmp 0x401b3f
nop
lea eax, [ebp - 0x250]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_FindNextFileA]
call eax
sub esp, 8
test eax, eax
jne 0x401a7e
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x401b66
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov byte [0x407058], 1
mov eax, dword [0x407044]
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_ShowWindow]
call eax
sub esp, 8
mov eax, dword [0x407040]
mov dword [esp + 0xc], 0x81
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_RedrawWindow]
call eax
sub esp, 0x10
mov eax, dword [0x407040]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0x3e9
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0x32
mov dword [esp + 0x18], 0xc8
mov dword [esp + 0x14], 0x64
mov dword [esp + 0x10], 0x14
mov dword [esp + 0xc], 0x50000001
mov dword [esp + 8], str.Scanned
mov dword [esp + 4], str.STATIC
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_CreateWindowExA]
call eax
sub esp, 0x30
mov dword [ebp - 0xc], eax
mov eax, dword [0x407040]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0x3e9
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0x1e
mov dword [esp + 0x18], 0x1f4
mov dword [esp + 0x14], 0xa0
mov dword [esp + 0x10], 0xa
mov dword [esp + 0xc], 0x50000001
mov dword [esp + 8], str.0_files_because_this_does_nothing_LMAO
mov dword [esp + 4], str.STATIC
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_CreateWindowExA]
call eax
sub esp, 0x30
mov dword [0x40705c], eax
mov eax, dword [0x407050]
mov dword [esp + 0xc], 1
mov dword [esp + 8], eax
mov dword [esp + 4], 0x30
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_SendMessageA]
call eax
sub esp, 0x10
mov eax, dword [0x407054]
mov edx, eax
mov eax, dword [0x40705c]
mov dword [esp + 0xc], 1
mov dword [esp + 8], edx
mov dword [esp + 4], 0x30
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_SendMessageA]
call eax
sub esp, 0x10
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x18]
mov dword [esp + 4], eax
mov dword [esp], 0x4050e3
call sym._FindFiles
nop
leave
ret
Function at 0x40241c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [esp], 2
call sym.___acrt_iob_func
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov ebx, dword [ebp - 0xc]
mov dword [esp], 2
call sym.___acrt_iob_func
mov dword [esp + 8], ebx
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._vfprintf
call sym._abort

Function at 0x402ff0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x40300f
mov eax, 0
jmp 0x403053
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x403032
mov eax, 0
jmp 0x403053
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
cmp ax, 0x10b
je 0x40304e
mov eax, 0
jmp 0x403053
mov eax, 1
leave
ret

Function at 0x403055
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 0x14]
movzx edx, ax
mov eax, dword [ebp - 0xc]
add eax, edx
add eax, 0x18
mov dword [ebp - 4], eax
jmp 0x4030b4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
cmp dword [ebp + 0xc], eax
jb 0x4030ac
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
add eax, edx
cmp dword [ebp + 0xc], eax
jae 0x4030ac
mov eax, dword [ebp - 4]
jmp 0x4030c8
add dword [ebp - 8], 1
add dword [ebp - 4], 0x28
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 6]
movzx eax, ax
cmp dword [ebp - 8], eax
jb 0x403089
mov eax, 0
leave
ret
Function at 0x402130
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x408048
call sym._EnterCriticalSection_4
mov ebx, dword [0x408040]
sub esp, 4
test ebx, ebx
je 0x40217b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x402174
test esi, esi
je 0x402174
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402150
mov dword [esp], 0x408048
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x402360
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x4023b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x402488
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x4023ee
cmp eax, 4
jne 0x402410
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x4023fe
cmp edx, 4
je 0x4023fe
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00402360
Function at 0x40233f
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x4051f8
call fcn.00402861
push 1
call fcn.004023c2
pop ecx
test al, al
jne 0x4021e8
push 7
call fcn.00402a74
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.0040238d
mov byte [ebp - 0x24], al
mov eax, dword [0x40633c]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x4021e1
test eax, eax
jne 0x402252
mov dword [0x40633c], ecx
push 0x40429c
push 0x404284
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x402235
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x402339
push 0x404280
push 0x40426c
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
pop ecx
pop ecx
mov dword [0x40633c], 2
jmp 0x402257
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.0040251f
pop ecx
call fcn.00402a68
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x402287
push esi
call fcn.00402492
pop ecx
test al, al
je 0x402287
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.00402ca3
call esi
call fcn.00402a6e
mov esi, eax
cmp dword [esi], edi
je 0x4022a5
push esi
call fcn.00402492
pop ecx
test al, al
je 0x4022a5
push dword [esi]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
pop ecx
push edi
call sub.VCRUNTIME140.dll___telemetry_main_invoke_trigger
pop ecx
call fcn.00402b89
movzx eax, ax
push eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_wide_winmain_command_line
push eax
push edi
push 0x400000
call main
mov esi, eax
push edi
call sub.VCRUNTIME140.dll___telemetry_main_return_trigger
pop ecx
call fcn.00402bbc
test al, al
jne 0x4022de
push esi
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
test bl, bl
jne 0x4022e7
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
push edi
push 1
call fcn.0040253c
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x402339
call fcn.004028a7
ret
call fcn.00402059
jmp 0x4021c9

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403daa
sub eax, 0x403d50
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x405f4e
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x4ccbf8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, 0x12b
lea eax, [ebp - 0x25c]
push ebx
mov edi, ecx
xor esi, esi
push eax
push edi
call dword [sym.imp.USER32.dll_GetClassNameA]
push 0x12
lea eax, [ebp - 0x25c]
push str.HwndWrapper_VMware
push eax
call fcn.00486932
add esp, 0xc
test eax, eax
jne 0x406001
push edi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x406001
push ebx
lea eax, [ebp - 0x130]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xd
lea eax, [ebp - 0x130]
push str.Hidden_Window
push eax
call fcn.00486932
add esp, 0xc
test eax, eax
je 0x40601f
push 0x1a
lea eax, [ebp - 0x130]
push str.SystemResourceNotifyWindow
push eax
call fcn.00486932
add esp, 0xc
test eax, eax
je 0x40601f
push 0x15
lea eax, [ebp - 0x130]
push str.VMware_Horizon_Client
push eax
call fcn.00486932
add esp, 0xc
test eax, eax
je 0x40601f
inc esi
jmp 0x40601f
push 0x16
lea eax, [ebp - 0x25c]
push str.TscShellContainerClass
push eax
call fcn.00486932
xor ecx, ecx
add esp, 0xc
inc ecx
test eax, eax
cmove esi, ecx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047f41c
leave
ret