joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1007fed0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x1007fedf
pop dword [ebp - 0x24]
mov eax, 0x1007fedf
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x59978299
add dword [ebp - 0x34], 0xf4bac2b2
mov dword [ebp - 0x30], 0xc948543b
sub dword [ebp - 0x30], 0x971507f6
mov dword [ebp - 0x2c], 0x9306be5b
add dword [ebp - 0x2c], 0xb94585d3
mov dword [ebp - 0x28], 0xd246d467
sub dword [ebp - 0x28], 0xd246d467
lea eax, [ebp - 0x34]
push eax
mov eax, 0x567bde82
add eax, 0xb98f925e
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x3376e873
add dword [ebp - 0x34], 0x40fb80e3
mov dword [ebp - 0x30], 0x41e8894e
sub dword [ebp - 0x30], 0x7c27d9
mov dword [ebp - 0x2c], 0x6e51773f
sub dword [ebp - 0x2c], 0xae20ad3
mov dword [ebp - 0x28], 0xf776fe84
add dword [ebp - 0x28], 0x889017c
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x5c712
push 0
call eax
mov ecx, 0x95c129fa
sub ecx, 0x95c0e899
xor esi, esi
add esi, eax
mov edx, 0x11e0b5ab
sub edx, 0x1d181ab
add edx, dword [ebp - 0x24]
mov ebx, 0xcd2fc7e3
xor dword [ebp - 4], 0x346b467c
mov edi, dword [edx]
xor dword [ebp - 0x14], eax
sub edi, ebx
mov dword [ebp - 0x20], 0xd199fa92
mov dword [esi], edi
xor dword [ebp - 0x10], edi
add esi, 4
add edx, 0xc08f3484
add edx, 0x3f70cb80
loop 0x1007fff3
add eax, 0x634e2c18
sub eax, 0x634d33c1
mov ebx, eax
add eax, 5
mov ecx, 0x27d8462c
sub ecx, 0x17d8462c
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x40de38
mov ecx, 0x524b15b9
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
mov eax, section..data_1
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x697b2b2a
nop
nop
nop
test eax, eax
nop
je 0x433084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x100010e3
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push dword [ebp + 8]
push 0
push 0
call sub.kernel32.dll_CreateMutexA
mov dword [ebp - 4], eax
or eax, eax
je 0x10001115
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
jne 0x10001115
push dword [ebp - 4]
call fcn.100010c6
push 0
pop dword [ebp - 4]
mov eax, dword [ebp - 4]
leave
ret 4

Function at 0x10001134
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push 0x44
lea eax, [ebp - 0x44]
push eax
call fcn.1000111c
push 0x10
lea eax, [ebp - 0x54]
push eax
call fcn.1000111c
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x44]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp + 8]
push 0
call sub.kernel32.dll_CreateProcessA
lea edi, [ebp - 0x54]
push dword [edi]
push dword [edi + 4]
call sub.kernel32.dll_CloseHandle
call sub.kernel32.dll_CloseHandle
leave
ret 4

Function at 0x940058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.009401a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x94007e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x94006a
add dl, dl
jne 0x940089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9400dc
xor eax, eax
add dl, dl
jne 0x940096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x94017d
add dl, dl
jne 0x9400a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9400b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9400bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9400c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x9400d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x940075
mov eax, 1
add dl, dl
jne 0x9400ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9400f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9400e1
sub eax, ebx
mov ebx, 1
jne 0x940128
mov ecx, 1
add dl, dl
jne 0x94010e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x940119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x940105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x940075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x94013f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x94014a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x940136
cmp eax, 0x7d00
jae 0x94016d
cmp eax, 0x500
jb 0x940168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x940075
cmp eax, 0x7f
ja 0x940170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x940075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x94019e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x940075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x594008], 0x8088405
inc edx
mov dword [ebx + 0x594008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41cf44
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41cf75
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cf5d
add dl, dl
jne 0x41cf80
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cfd1
xor eax, eax
add dl, dl
jne 0x41cf8d
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d06e
add dl, dl
jne 0x41cf9c
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfa7
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfb2
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfbd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41cfc7
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41cf6c
mov eax, 1
add dl, dl
jne 0x41cfdf
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfea
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cfd6
sub eax, ebx
mov ebx, 1
jne 0x41d01d
mov ecx, 1
add dl, dl
jne 0x41d003
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41d00e
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cffa
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cf6c
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41d034
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41d03f
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41d02b
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cf6c
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41d08f
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41cf6c
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41f0a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x57858e
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
mov dword [ebp - 8], edx
mov esi, ebx
xor ecx, ecx
cmp byte [eax + 0x6a], 0
je 0x41f0ef
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x88]
test edx, edx
je 0x41f10e
mov ecx, edx
add ecx, ebx
jmp 0x41f10e
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41f10e
mov ecx, edx
add ecx, ebx
test ecx, ecx
je 0x41f180
mov esi, dword [ecx + 0x18]
mov eax, dword [ecx + 0x1c]
add eax, ebx
mov dword [ebp - 0x10], eax
mov edi, dword [ecx + 0x20]
add edi, ebx
mov eax, dword [ecx + 0x24]
add eax, ebx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
cmp eax, 0xffff
jbe 0x41f169
test esi, esi
jbe 0x41f180
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088ec
test eax, eax
jne 0x41f15b
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41f180
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41f138
jmp 0x41f180
mov edx, eax
sub edx, dword [ecx + 0x10]
cmp edx, dword [ecx + 0x14]
jae 0x41f180
mov eax, edx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x578595
ret
Function at 0x4202d8
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov word [ebp - 4], cx
mov byte [ebp - 1], dl
xor eax, eax
push ebp
push 0x5798f3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x420313
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x42032c
lea eax, [ebp - 0x10]
mov edx, dword [0x59654c]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404d30
jmp 0x42033f
lea eax, [ebp - 0x10]
mov edx, dword [0x59654c]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x42034b
adc edx, 0
mov edx, dword [edx*4 + 0x595378]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x4204c5
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x4204b8
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x4204b8
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406ddc
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x18
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x4204b8
mov eax, edi
cmp dword [eax], 0x4550
jne 0x4204b8
add eax, 4
mov dword [ebp - 0xc], eax
cmp byte [ebp - 1], 0
je 0x420456
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x8664
jne 0x420456
mov eax, edi
call fcn.00403288
mov eax, 0xf0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xf0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420456
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x420456
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
cmp byte [ebp - 1], 0
jne 0x4204b8
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x14c
jb 0x4204b8
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x150
ja 0x4204b8
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xe0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x4204b8
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x4204b8
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x4204dd
inc ebx
cmp ebx, 0x19
jne 0x420305
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5798fa
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x3ad7258d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x3ad7a064]
jne 0x3ad72597
repz ret
jmp fcn.3ad73d0c

Function at 0x3ad75025
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x3ad75034
pop dword [ebp - 0x2c]
mov eax, 0xe1eac997
add eax, 0x58ec869d
sub dword [ebp - 0x2c], eax
push 0x40
push 0x1000
push 0x3bac8
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x2c]
call dword [eax]
mov ecx, 0x5571e476
sub ecx, 0x55718c73
xor ebx, ebx
add ebx, eax
mov edx, 0xeea0247d
add edx, 0x4c386983
add edx, dword [ebp - 0x2c]
mov edi, 0xf98cf211
sub edi, 0x497763ab
xor dword [ebp - 4], edx
mov esi, dword [edx]
add dword [ebp - 4], 0x825d56c7
sub esi, edi
sub dword [ebp - 0x24], 0x169aeccc
mov dword [ebx], esi
xor dword [ebp - 0x1c], ebx
add ebx, 4
add edx, 4
loop 0x3ad75090
add eax, 0x394b158b
add eax, 0xc6b63d54
xor ebx, ebx
add ebx, eax
add eax, 0xb5af7582
add eax, 0x4a508a83
mov ecx, 0x5bb78a73
add ecx, 0xdf1f758d
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0xae5da0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x4a9000]
push edi
jmp 0xae5dba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xae5dc1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xae5db0
mov eax, 1
add ebx, ebx
jne 0xae5dd3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xae5de4
jne 0xae5e03
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xae5e03
dec eax
add ebx, ebx
jne 0xae5df0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xae5dc8
add ebx, ebx
jne 0xae5dff
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xae5e55
xor ecx, ecx
sub eax, 3
jb 0xae5e1b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xae5e8a
sar eax, 1
mov ebp, eax
jmp 0xae5e26
add ebx, ebx
jne 0xae5e26
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xae5df4
inc ecx
add ebx, ebx
jne 0xae5e34
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xae5df4
add ebx, ebx
jne 0xae5e41
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xae5e36
jne 0xae5e52
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xae5e36
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xae5e74
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xae5e66
jmp 0xae5db6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xae5e74
add edi, ecx
jmp 0xae5db6
pop esi
mov edi, esi
mov ecx, 0x17e47
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xae5e92
cmp byte [edi], 0x2f
jne 0xae5e92
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xae5e97
lea edi, [esi + 0x6ca000]
mov eax, dword [edi]
or eax, eax
je 0xae5f0f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x6f05e0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x6f0630]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xae5ec4
mov ecx, edi
jns 0xae5ef3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x6f0638]
or eax, eax
je 0xae5f09
mov dword [ebx], eax
add ebx, 4
jmp 0xae5ee1
call dword [esi + 0x6f0634]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0xae5f40
cmp al, 0xef
ja 0xae5f33
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0xae5f15
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0xae5f22
mov ebp, dword [esi + 0x6f063c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x237]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xae5f74
sub esp, 0xffffff80
jmp 0x63e977
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x401c66
pop dword [ebp - 0x28]
mov eax, 0x401c66
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x7a7adbce
add dword [ebp - 0x38], 0xd3d7697d
mov dword [ebp - 0x34], 0xc6342113
sub dword [ebp - 0x34], 0x9400d4ce
mov dword [ebp - 0x30], 0x97fa00a1
add dword [ebp - 0x30], 0xb452438d
mov dword [ebp - 0x2c], 0xf8b6fae6
add dword [ebp - 0x2c], 0x749051a
lea eax, [ebp - 0x38]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x8fae5b22
sub dword [ebp - 0x38], 0x1b3bf1cc
mov dword [ebp - 0x34], 0xbbd26c89
add dword [ebp - 0x34], 0x8599f4ec
mov dword [ebp - 0x30], 0x66e6896e
sub dword [ebp - 0x30], 0x3771d02
mov dword [ebp - 0x2c], 0x4bb67795
add dword [ebp - 0x2c], 0xb449886b
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0xbd07c553
sub eax, 0xbcc79527
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x379c2
push 0
call eax
mov ecx, 0x67c9513f
add ecx, 0x9836fb45
mov esi, eax
mov edx, 0x2ad7ad8
add edx, 0xfd92f528
add edx, dword [ebp - 0x28]
mov ebx, 0xcd118ba5
sub ebx, 0x5bd3635
add dword [ebp - 0xc], 0x2b02d19d
mov edi, dword [edx]
xor dword [ebp - 0xc], esi
add edi, ebx
xor dword [ebp - 0x10], 0xde9ac753
mov dword [esi], edi
mov dword [ebp - 0x10], 0xe14792f8
add esi, 0xdc391c21
add esi, 0x23c6e3e3
add edx, 0x7386898f
add edx, 0x8c797675
loop 0x401d7e
add eax, 0xf266194c
sub eax, 0xf264f469
xor ebx, ebx
add ebx, eax
add eax, 0xea34362f
add eax, 0x15cbc9d6
mov ecx, 0x400000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x401000
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x409a18
mov eax, dword fs:[0]
push eax
sub esp, 0x2c4
mov eax, dword [0x40d0a0]
xor eax, ebp
mov dword [ebp - 0x20], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [ebp - 0x10]
push ecx
movzx edx, word [ebp - 0x12]
push edx
movzx eax, word [ebp - 0x14]
push eax
movzx ecx, word [ebp - 0x16]
push ecx
movzx edx, word [ebp - 0x1a]
push edx
movzx eax, word [ebp - 0x1c]
push eax
push str._4d__.2d__.2d_.2d:_.2d:_.2d
lea ecx, [ebp - 0xbc]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x20
push str.MiniThunderPlatform
lea ecx, [ebp - 0x3c]
call fcn.00401180
mov dword [ebp - 4], 0
lea edx, [ebp - 0xbc]
push edx
lea ecx, [ebp - 0x3c]
call fcn.004011e0
cmp dword [ebp + 8], 3
jne 0x4010d4
push 0x40a1ac
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 4]
push ecx
call fcn.004023f6
add esp, 8
test eax, eax
jne 0x4010d2
push 0x40a1b4
lea ecx, [ebp - 0x3c]
call fcn.004011e0
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 8]
push eax
lea ecx, [ebp - 0x3c]
call fcn.004011e0
push 0x40a1bc
lea ecx, [ebp - 0x3c]
call fcn.004011e0
jmp 0x40111e
lea ecx, [ebp - 0x2cc]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0
jbe 0x40111e
push 0x40a1c0
lea ecx, [ebp - 0x3c]
call fcn.004011e0
lea edx, [ebp - 0x2cc]
push edx
lea ecx, [ebp - 0x3c]
call fcn.004011e0
push str.MiniThunderPlatform.exe_
lea ecx, [ebp - 0x3c]
call fcn.004011e0
push 0
push 0x40a1fc
lea ecx, [ebp - 0x3c]
call fcn.00401200
push eax
push str.ThunderFW.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x2d0], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.004011c0
mov eax, dword [ebp - 0x2d0]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.00402813
mov esp, ebp
pop ebp
ret

Function at 0x402813
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40d0a0]
jne 0x40281d
repz ret
jmp fcn.0040413c
Function at 0x40828c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00403b23
and dword [ebp - 4], 0
cmp dword [0x40e800], 0
mov ebx, eax
jne 0x40833d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4083ee
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4083ee
push eax
call fcn.00403ab1
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40e800], eax
call esi
push eax
call fcn.00403ab1
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40e804], eax
call esi
push eax
call fcn.00403ab1
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x40e808], eax
call esi
push eax
call fcn.00403ab1
pop ecx
mov dword [0x40e810], eax
test eax, eax
je 0x40833d
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00403ab1
pop ecx
mov dword [0x40e80c], eax
mov eax, dword [0x40e80c]
cmp eax, ebx
je 0x408395
cmp dword [0x40e810], ebx
je 0x408395
push eax
call fcn.00403b2c
push dword [0x40e810]
mov esi, eax
call fcn.00403b2c
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x408395
test edi, edi
je 0x408395
call esi
test eax, eax
je 0x40838c
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40838c
test byte [ebp - 0xc], 1
jne 0x408395
or dword [ebp + 0x10], 0x200000
jmp 0x4083ce
mov eax, dword [0x40e804]
cmp eax, ebx
je 0x4083ce
push eax
call fcn.00403b2c
pop ecx
test eax, eax
je 0x4083ce
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4083ce
mov eax, dword [0x40e808]
cmp eax, ebx
je 0x4083ce
push eax
call fcn.00403b2c
pop ecx
test eax, eax
je 0x4083ce
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40e800]
call fcn.00403b2c
pop ecx
test eax, eax
je 0x4083ee
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4083f0
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret