joyce8/EMBER2024-capa huggingface dataset:
Function at 0x70261a40
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
push ebp
push edi
mov edi, ecx
cmp byte [edi + 0x18], 0
mov byte [esp + 0xf], 0
je 0x70261b27
mov ebx, dword [esp + 0x14]
test ebx, ebx
je 0x70261b27
mov ebp, dword [esp + 0x18]
test ebp, ebp
jle 0x70261b27
push esi
push 0x34
call fcn.702e1f8d
mov esi, eax
add esp, 4
test esi, esi
je 0x70261b1b
mov dword [esi + 0x2c], 0xf
mov dword [esi + 0x28], 0
mov byte [esi + 0x18], 0
mov eax, dword [edi + 4]
lea ecx, [esi + 0x14]
mov dword [esi], eax
mov edx, dword [edi + 0xc]
mov eax, dword [esp + 0x28]
mov dword [esi + 4], edx
mov dword [esi + 8], eax
mov edx, dword [edi + 0x14]
mov dword [esi + 0x10], edx
mov eax, dword [edi + 0x1c]
push ebp
push ebx
mov dword [esi + 0xc], eax
call fcn.7020c1f0
mov al, byte [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov bl, 1
mov dword [esi + 0x30], ecx
test bl, al
je 0x70261ae5
push esi
call fcn.70261b60
test eax, eax
je 0x70261b1b
pop esi
pop edi
pop ebp
mov byte [esp + 7], bl
mov al, bl
pop ebx
pop ecx
ret 0x14
test al, 0x10
je 0x70261b1b
push 0
push 0
push esi
push fcn.70261b60
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x70261b16
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop edi
pop ebp
mov byte [esp + 7], bl
mov al, bl
pop ebx
pop ecx
ret 0x14
call fcn.70261b30
mov al, byte [esp + 0x13]
pop esi
pop edi
pop ebp
pop ebx
pop ecx
ret 0x14
pop edi
pop ebp
xor al, al
pop ebx
pop ecx
ret 0x14
Function at 0x70265970
Capabilities:
Read file via mapping

Disassembly:
push edi
mov edi, eax
push edi
push 0
push 6
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
test eax, eax
je 0x7026598f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
ret 4
push esi
push edi
push 0x3200000
xor esi, esi
push esi
push 0x8000004
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edi, eax
test edi, edi
je 0x70265a08
push esi
push esi
push esi
push 6
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
je 0x702659f1
test ebx, ebx
je 0x702659c5
mov dword [ebx], edi
mov eax, dword [esp + 0xc]
mov dword [esi], 1
mov ecx, dword [eax + 0x64]
mov dword [esi + 4], ecx
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0x18
mov dword [esi + 0x14], 0
mov eax, esi
pop esi
pop edi
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x70265a08
mov dword [ebx], 0
mov eax, esi
pop esi
pop edi
ret 4
Function at 0x70267b90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x7033c410
push 0x702e96c0
mov eax, dword fs:[0]
push eax
sub esp, 0xa4
push ebx
push esi
push edi
mov eax, dword [0x7034b250]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov ecx, 0xb
mov dword [ebp - 0xb4], ecx
xor edi, edi
mov dword [ebp - 0xb0], edi
mov eax, 0x2580
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xa8], 0x45b0
mov dword [ebp - 0xa4], 0x22020
mov dword [ebp - 0xa0], ecx
mov dword [ebp - 0x9c], edi
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], 0x49aa
mov dword [ebp - 0x90], 0x34fa0
mov dword [ebp - 0x8c], ecx
mov dword [ebp - 0x88], edi
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], 0x4b03
mov dword [ebp - 0x7c], 0x13a50
mov dword [ebp - 0x78], ecx
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], 0x4c8d
mov dword [ebp - 0x68], 0x15a20
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x60], edi
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], 0x4d9b
mov dword [ebp - 0x54], 0x11600
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], 0x4de4
mov edx, 0x1d3c0
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], 0x4dfb
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x24], edi
push 0x703274f8
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call esi
mov dword [ebp - 0x28], eax
cmp eax, edi
je 0x70267d86
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x20]
push ecx
push 0x703274f8
call esi
mov ecx, eax
call fcn.702149e0
add esp, 8
test eax, eax
je 0x70267d86
xor esi, esi
mov dword [ebp - 0x1c], esi
cmp esi, 7
jae 0x70267d86
lea eax, [esi + esi*4]
add eax, eax
add eax, eax
movzx edx, word [ebp + eax - 0xac]
shl edx, 0x10
movzx ecx, word [ebp + eax - 0xa8]
or edx, ecx
movzx ecx, word [ebp + eax - 0xb4]
shl ecx, 0x10
movzx ebx, word [ebp + eax - 0xb0]
or ecx, ebx
mov ebx, dword [ebp - 0x20]
cmp ebx, ecx
ja 0x70267d80
jb 0x70267d80
mov ecx, dword [ebp - 0x24]
cmp ecx, edx
ja 0x70267d80
jb 0x70267d80
mov eax, dword [ebp + eax - 0xa4]
add eax, dword [ebp - 0x28]
mov dword [ebp - 4], edi
cmp dword [eax], 0x8b55ff8b
jne 0x70267d5e
cmp dword [eax + 4], 0x38ec83ec
jne 0x70267d5e
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xfffffffe
inc esi
jmp 0x70267cd8
inc esi
jmp 0x70267cd8
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x7026a870
Capabilities:
Get common file path

Disassembly:
sub esp, 0x210
mov eax, dword [0x7034b250]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
push esi
push edi
push str.ieframe.dll
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
test edi, edi
je 0x7026a8ca
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.IEIsProtectedModeProcess
push edi
mov dword [esp + 0x14], 0
call ebx
test eax, eax
je 0x7026a936
lea ecx, [esp + 0xc]
push ecx
call eax
test eax, eax
jge 0x7026a936
cmp eax, 0x80070005
je 0x7026a93d
push 0x208
lea ecx, [esp + 0x14]
push 0
push ecx
call fcn.702e95e0
add esp, 0xc
push 1
push 0x1a
lea edx, [esp + 0x18]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x7026a9a3
lea eax, [esp + 0x10]
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x7026a900
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x14]
call fcn.7020f4d0
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.702e1c2f
add esp, 0x210
ret
cmp dword [esp + 0xc], 0
je 0x7026a8ca
push str.IEGetWriteableFolderPath
push edi
call ebx
test eax, eax
je 0x7026a8ca
lea edx, [esp + 0xc]
push edx
push 0x7031c7fc
mov dword [esp + 0x14], 0
call eax
test eax, eax
jl 0x7026a8ca
mov eax, dword [esp + 0xc]
test eax, eax
je 0x7026a8ca
push esi
call fcn.7020f580
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.702e1c2f
add esp, 0x210
ret
mov ecx, dword [esp + 0x218]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.702e1c2f
add esp, 0x210
ret
Function at 0x7026a9c0
Capabilities:
Check if file exists
Copy file
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x703137eb
mov eax, dword fs:[0]
push eax
sub esp, 0x430
mov eax, dword [0x7034b250]
xor eax, esp
mov dword [esp + 0x42c], eax
push ebx
push esi
push edi
mov eax, dword [0x7034b250]
xor eax, esp
push eax
lea eax, [esp + 0x440]
mov dword fs:[0], eax
xor eax, eax
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], 0
mov word [esp + 0x14], ax
lea ecx, [esp + 0x10]
mov dword [esp + 0x448], eax
call fcn.7026a870
mov esi, 8
test eax, eax
je 0x7026ab5b
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x28], esi
jae 0x7026aa3c
lea eax, [esp + 0x14]
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push eax
call edi
test eax, eax
je 0x7026ab5b
push 0x208
lea ecx, [esp + 0x30]
push 0
push ecx
call fcn.702e95e0
mov eax, dword [esp + 0x20]
add esp, 0xc
cmp dword [esp + 0x28], esi
jae 0x7026aa6f
lea eax, [esp + 0x14]
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
push str.CNTV
push eax
lea edx, [esp + 0x34]
push edx
call esi
lea eax, [esp + 0x2c]
push eax
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x7026aa9c
push 0
lea ecx, [esp + 0x30]
push ecx
call ebx
push str.CNTV_Live
lea edx, [esp + 0x30]
push edx
mov eax, edx
push eax
call esi
lea ecx, [esp + 0x2c]
push ecx
call edi
test eax, eax
jne 0x7026aabe
push eax
lea edx, [esp + 0x30]
push edx
call ebx
push str.KooLiveMod.dll
lea eax, [esp + 0x30]
push eax
mov ecx, eax
push ecx
call esi
lea edx, [esp + 0x2c]
push edx
call edi
test eax, eax
je 0x7026aaf3
cmp dword [esp + 0x28], 8
jb 0x7026aaec
mov eax, dword [esp + 0x14]
push eax
call fcn.702e1c24
add esp, 4
mov eax, 1
jmp 0x7026ab70
push 0x208
lea ecx, [esp + 0x238]
push 0
push ecx
call fcn.702e95e0
add esp, 0xc
push str..._netmonKooLiveMod.dll
push 0x70359d48
lea edx, [esp + 0x23c]
push edx
call esi
lea eax, [esp + 0x234]
push eax
call edi
test eax, eax
jne 0x7026ab37
lea esi, [esp + 0x10]
call fcn.7021ae80
jmp 0x7026ab6e
push 1
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x23c]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea esi, [esp + 0x10]
mov edi, eax
call fcn.7021ae80
mov eax, edi
jmp 0x7026ab70
cmp dword [esp + 0x28], esi
jb 0x7026ab6e
mov eax, dword [esp + 0x14]
push eax
call fcn.702e1c24
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x440]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x42c]
xor ecx, esp
call fcn.702e1c2f
add esp, 0x43c
ret
Function at 0x7026adb0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x214
mov eax, dword [0x7034b250]
xor eax, esp
mov dword [esp + 0x210], eax
push esi
push 0x208
lea eax, [esp + 0x10]
push 0
push eax
mov esi, ecx
call fcn.702e95e0
add esp, 0xc
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0xc]
push eax
push str.cntvzhibo
push str.SOFTWARE360safe_netmon
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x20], 0x208
mov dword [esp + 0x1c], 1
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x7026ae2b
xor eax, eax
pop esi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.702e1c2f
add esp, 0x214
ret
lea eax, [esp + 0xc]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x7026ae32
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x10]
call fcn.7020f4d0
mov ecx, dword [esp + 0x214]
pop esi
xor ecx, esp
mov eax, 1
call fcn.702e1c2f
add esp, 0x214
ret

Function at 0x7026c580
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x703110c6
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x7034b250]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x7034b250]
xor eax, esp
push eax
lea eax, [esp + 0x228]
mov dword fs:[0], eax
cmp byte [0x70359616], 0
jne 0x7026c68a
push 0
push 0x20
lea eax, [esp + 0x24]
push eax
push 0
mov byte [0x70359616], 1
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov ebp, dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
mov ebx, dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
je 0x7026c638
lea ecx, [esp + 0x1c]
push ecx
call ebp
lea edx, [esp + 0x1c]
push edx
call ebx
mov esi, eax
mov dword [esp + 0x18], esi
test esi, esi
jne 0x7026c612
push 0x8007000e
call fcn.702042c0
lea edi, [esp + 0x18]
mov dword [esp + 0x230], 0
call fcn.7026cc90
push esi
mov dword [esp + 0x234], 0xffffffff
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push 0
push 0x28
lea eax, [esp + 0x24]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x7026c68a
lea ecx, [esp + 0x1c]
push ecx
call ebp
lea edx, [esp + 0x1c]
push edx
call ebx
mov esi, eax
mov dword [esp + 0x18], esi
test esi, esi
jne 0x7026c66f
push 0x8007000e
call fcn.702042c0
lea edi, [esp + 0x18]
mov dword [esp + 0x230], 1
call fcn.7026cc90
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov ecx, dword [esp + 0x228]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.702e1c2f
add esp, 0x220
ret
Function at 0x7026df00
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x7034b250]
xor eax, esp
mov dword [esp + 0x208], eax
push ebx
push ebp
mov ebp, dword [esp + 0x218]
push esi
mov esi, ecx
xor eax, eax
xor ecx, ecx
cmp dword [esi + ecx*4], eax
je 0x7026e00b
mov edx, dword [esi + ecx*4]
mov ebx, edx
and ebx, edi
cmp ebx, edx
je 0x7026df56
inc ecx
cmp ecx, 5
jl 0x7026df24
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.702e1c2f
add esp, 0x20c
ret
xor ebx, ebx
mov esi, 1
cmp byte [0x70359483], bl
jne 0x7026e009
push 0x103
lea eax, [esp + 0x115]
push ebx
push eax
mov byte [esp + 0x11c], bl
call fcn.702e95e0
add esp, 0xc
mov eax, ebp
mov edx, 0x104
lea ecx, [esp + 0x110]
call fcn.7020dec0
lea ecx, [esp + 0x110]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push 0x103
lea edx, [esp + 0x11]
push ebx
push edx
mov byte [esp + 0x18], bl
call fcn.702e95e0
add esp, 0xc
lea eax, [esp + 0xc]
push eax
push ebx
push ebx
push 0x25
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jne 0x7026e009
cmp byte [esp + 0xc], bl
je 0x7026e009
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x114]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x7026e009
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.702e1c2f
add esp, 0x20c
ret
mov eax, esi
mov ecx, dword [esp + 0x214]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.702e1c2f
add esp, 0x20c
ret

Function at 0x7026e5e0
Capabilities:
Create thread

Disassembly:
push ecx
push 1
push 0
push 0x70371024
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, 1
je 0x7026e5f9
xor eax, eax
pop ecx
ret
lea eax, [esp]
push eax
push 0
push 0
push 0x7026e570
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test eax, eax
je 0x7026e622
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop ecx
ret
Function at 0x7026e6b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x124
mov eax, dword [0x7034b250]
xor eax, esp
mov dword [esp + 0x120], eax
cmp dword [ebp + 8], 0
push esi
jne 0x7026e894
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
or eax, 0x73425242
cmp eax, ebx
jne 0x7026e6fb
xor eax, eax
pop esi
mov ecx, dword [esp + 0x120]
xor ecx, esp
call fcn.702e1c2f
mov esp, ebp
pop ebp
ret 4
cmp ebx, 0x201
je 0x7026e71f
cmp ebx, 0x202
je 0x7026e71f
cmp ebx, 0x207
je 0x7026e71f
cmp ebx, 0x208
jne 0x7026e894
test edi, edi
je 0x7026e894
push 0x14
push edi
mov dword [esp + 0x14], 1
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x7026e87b
mov esi, dword [edi + 8]
push esi
mov dword [esp + 0x20], esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x7026e87b
xor eax, eax
push 0xfe
push eax
lea ecx, [esp + 0x2a]
push ecx
mov word [esp + 0x2c], ax
call fcn.702e95e0
add esp, 0xc
push 0x80
lea edx, [esp + 0x24]
push edx
push esi
call dword [sym.imp.USER32.dll_GetClassNameW]
cmp ebx, 0x201
jne 0x7026e79d
cmp byte [0x7034d285], 0
je 0x7026e79d
lea edx, [esp + 0x20]
mov ecx, esi
call fcn.7029f710
mov esi, dword [sym.imp.SHLWAPI.dll_StrCmpIW]
push str.Shell_DocObject_View
lea eax, [esp + 0x24]
push eax
call esi
test eax, eax
je 0x7026e7c7
push str.Internet_Explorer_Server
lea ecx, [esp + 0x24]
push ecx
call esi
test eax, eax
jne 0x7026e87b
cmp ebx, 0x201
jne 0x7026e7d4
call fcn.7026e5e0
mov eax, dword [0x703548b4]
mov dword [esp + 8], 0
cmp eax, 0xffffffff
je 0x7026e87b
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
xor ecx, ecx
test eax, eax
je 0x7026e807
mov dword [esp + ecx*4 + 8], eax
mov eax, dword [eax + 0x1f0]
inc ecx
cmp ecx, 1
jb 0x7026e7f3
test ecx, ecx
je 0x7026e87b
mov edx, dword [esp + 8]
mov esi, dword [edx + 0x1ec]
test esi, esi
je 0x7026e87b
mov eax, dword [edi]
mov ecx, dword [edi + 4]
lea edx, [esp + 0x14]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
push edx
push eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], ecx
call dword [sym.imp.USER32.dll_ScreenToClient]
cmp ebx, 0x201
je 0x7026e84e
cmp ebx, 0x207
jne 0x7026e87b
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 8]
push ecx
mov ecx, dword [edi + 8]
push edx
push eax
push ecx
lea edx, [esp + 0x20]
mov ecx, esi
call fcn.7026f3c0
cmp dword [esp + 0x10], 0
je 0x7026e87b
mov dword [esp + 0xc], 0
mov eax, dword [esp + 0xc]
pop esi
mov ecx, dword [esp + 0x120]
xor ecx, esp
call fcn.702e1c2f
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esp + 0x124]
pop esi
xor ecx, esp
mov eax, 1
call fcn.702e1c2f
mov esp, ebp
pop ebp
ret 4
Function at 0x70275730
Capabilities:
Check if file exists
Query or enumerate registry value
Read .ini file

Disassembly:
sub esp, 0x41c
mov eax, dword [0x7034b250]
xor eax, esp
mov dword [esp + 0x418], eax
push 0
push 1
push 0x7036eea4
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x70275771
mov eax, dword [0x7036eea8]
mov ecx, dword [esp + 0x418]
xor ecx, esp
call fcn.702e1c2f
add esp, 0x41c
ret
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x12]
push ecx
mov word [esp + 0x14], ax
call fcn.702e95e0
add esp, 0xc
lea edx, [esp + 4]
push edx
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 8]
push ecx
push str.InstallLocation
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_thunder_is1
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x1c], 0x208
mov dword [esp + 0x18], 1
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp word [esp + 8], 0
jne 0x702757de
xor eax, eax
mov ecx, dword [esp + 0x418]
xor ecx, esp
call fcn.702e1c2f
add esp, 0x41c
ret
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_StrCmpIW]
push str.thunderservice.exe
push 0x70359f90
call edi
test eax, eax
jne 0x70275804
push str.UserDataProfilesProgramUserConfig.ini
lea edx, [esp + 0x10]
push edx
mov eax, edx
push eax
jmp 0x70275821
push str.thunderplatform.exe
push 0x70359f90
call edi
test eax, eax
jne 0x70275827
push str.Profilesconfig.ini
lea ecx, [esp + 0x10]
push ecx
mov edx, ecx
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [esp + 0x10]
push eax
call ebx
test eax, eax
jne 0x70275850
pop ebx
pop edi
mov ecx, dword [esp + 0x418]
xor ecx, esp
call fcn.702e1c2f
add esp, 0x41c
ret
push esi
lea ecx, [esp + 0x14]
push ecx
push 1
push str.AutoScan
push str.SafeHost
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
xor edx, edx
push 0x206
mov esi, eax
push edx
lea eax, [esp + 0x226]
push eax
mov word [esp + 0x228], dx
call fcn.702e95e0
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
push 0x104
lea edx, [esp + 0x224]
push edx
push 0x70326328
push str.ProgramPath
push str.SafeHost
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test esi, esi
pop esi
je 0x702758f3
cmp word [esp + 0x218], 0
je 0x702758f3
lea eax, [esp + 0x218]
push eax
call ebx
test eax, eax
je 0x702758f3
lea ecx, [esp + 0x218]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push str.360sd.exe
push eax
call edi
test eax, eax
jne 0x702758f3
mov dword [0x7036eea8], 1
mov eax, dword [0x7036eea8]
mov ecx, dword [esp + 0x420]
pop ebx
pop edi
xor ecx, esp
call fcn.702e1c2f
add esp, 0x41c
ret
Function at 0x70277a60
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
push esi
push edi
mov esi, eax
call fcn.70202720
cmp byte [0x7034d4ef], 0
je 0x70277b34
test esi, esi
je 0x70277b34
push esi
call fcn.70277c00
add esp, 4
test al, al
jne 0x70277b34
call fcn.70277b40
push 0x2024
call fcn.702e20da
add esp, 4
push 0x2024
mov edi, eax
push 0
push edi
call fcn.702e95e0
add esp, 0xc
push esi
mov eax, SysReAllocString
mov ecx, 0x800
mov edx, edi
call fcn.7020f5f0
test ebx, ebx
je 0x70277ae8
lea edx, [edi + 0x1000]
push ebx
mov eax, SysReAllocString
mov ecx, 0x800
call fcn.7020f5f0
mov eax, dword [ebp + 8]
push eax
lea edx, [edi + 0x2000]
mov eax, SysReAllocString
mov ecx, 0x10
call fcn.7020f5f0
mov ecx, dword [ebp + 0xc]
lea edx, [esp + 0xc]
push edx
push 0
push edi
push 0x702778d0
push 0
mov dword [edi + 0x2020], ecx
push 0
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x70277b34
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x702788c0
Capabilities:
Encode data using base64

Disassembly:
sub esp, 8
push ebp
xor ebp, ebp
push esi
mov esi, eax
test ecx, ecx
jg 0x702788d5
pop esi
xor eax, eax
pop ebp
add esp, 8
ret
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add eax, edx
lea edx, [eax + eax*2]
mov eax, ecx
sub eax, edx
je 0x702788f3
mov ebp, 3
sub ebp, eax
push ebx
push edi
lea edi, [ecx + ebp]
mov eax, 0x55555556
imul edi
mov eax, edx
shr eax, 0x1f
add eax, edx
add eax, ebp
lea ebx, [eax + ecx + 1]
push ebx
mov dword [esp + 0x18], ebx
call fcn.702e20da
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
jne 0x70278929
pop edi
pop ebx
pop esi
pop ebp
add esp, 8
ret
xor edx, edx
test edi, edi
jle 0x70278a22
lea ecx, [eax + 2]
movzx eax, byte [esi]
shr al, 2
movsx eax, al
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 2], al
lea eax, [edi - 3]
cmp edx, eax
jne 0x702789b7
test ebp, ebp
je 0x702789b7
cmp ebp, 1
jne 0x70278994
movzx eax, byte [esi]
mov bl, byte [esi + 1]
and al, 3
shl al, 4
movsx eax, al
shr bl, 4
movsx ebx, bl
movzx eax, byte [eax + ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
movzx eax, byte [esi + 1]
and al, 0xf
add al, al
add al, al
movsx eax, al
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
mov byte [ecx + 1], 0x3d
jmp 0x70278a09
cmp ebp, 2
jne 0x70278a09
movzx eax, byte [esi]
and al, 3
shl al, 4
movsx eax, al
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
mov byte [ecx], 0x3d
mov byte [ecx + 1], 0x3d
jmp 0x70278a09
movzx eax, byte [esi]
movzx ebx, byte [esi + 1]
and al, 3
shl al, 4
movsx eax, al
shr bl, 4
movsx ebx, bl
movzx eax, byte [eax + ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
movzx eax, byte [esi + 1]
movzx ebx, byte [esi + 2]
and al, 0xf
add al, al
add al, al
movsx eax, al
shr bl, 6
movsx ebx, bl
movzx eax, byte [eax + ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
movsx eax, byte [esi + 2]
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], al
add edx, 3
add ecx, 4
add esi, 3
cmp edx, edi
jl 0x70278936
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
pop edi
mov byte [eax + ebx - 1], 0
pop ebx
pop esi
pop ebp
add esp, 8
ret