joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1173710
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
test esi, esi
jbe 0x1173741
test cl, 7
je 0x1173741
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x11a4be8]
dec esi
inc ecx
test esi, esi
ja 0x1173724
cmp esi, 8
jb 0x11737cf
mov edx, esi
shr edx, 3
mov dword [ebp + 8], edx
push ebx
mov edx, dword [ecx + 4]
xor eax, dword [ecx]
mov ebx, edx
shr ebx, 0x10
movzx edi, bl
mov edi, dword [edi*4 + 0x11a4fe8]
mov ebx, edx
shr ebx, 0x18
xor edi, dword [ebx*4 + 0x11a4be8]
mov ebx, edx
shr ebx, 8
movzx ebx, bl
xor edi, dword [ebx*4 + 0x11a53e8]
mov ebx, eax
shr ebx, 0x18
xor edi, dword [ebx*4 + 0x11a5be8]
mov ebx, eax
shr ebx, 0x10
movzx ebx, bl
xor edi, dword [ebx*4 + 0x11a5fe8]
mov ebx, eax
shr ebx, 8
movzx ebx, bl
xor edi, dword [ebx*4 + 0x11a63e8]
movzx edx, dl
xor edi, dword [edx*4 + 0x11a57e8]
movzx eax, al
xor edi, dword [eax*4 + 0x11a67e8]
sub esi, 8
add ecx, 8
sub dword [ebp + 8], 1
mov eax, edi
jne 0x1173753
pop ebx
test esi, esi
jbe 0x11737eb
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x11a4be8]
dec esi
inc ecx
test esi, esi
ja 0x11737d3
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x1174680
Capabilities:
Hash data using sha256

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
pop ebp
ret 4

Function at 0x11784e0
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0xc], 1
push edi
jne 0x11784fc
push 0xfffffffffffffff6
call dword [0x1001370]
mov dword [esi + 4], eax
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov ecx, dword [esi + 4]
push 0
lea eax, [ebp - 4]
push eax
push edi
push ebx
push ecx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x11785aa
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x1178553
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileType]
cmp eax, 2
je 0x1178535
cmp eax, 3
jne 0x1178553
cmp edi, 0x4e20
jbe 0x1178553
push 0x4e20
push ebx
mov ecx, esi
call fcn.011784e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [esi + 0xc], 1
jne 0x117856f
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x6d
jne 0x117856f
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [esi + 0xc], 0
jne 0x117859e
cmp edi, 0x8000
jbe 0x117859e
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x21
jne 0x117859e
push 0x8000
push ebx
mov ecx, esi
call fcn.011784e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1179fa0
Capabilities:
Hash data using sha256

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x128
push ebx
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 0x20]
push edi
lea eax, [esi + 0x2c]
push 0
mov dword [ebp + 8], eax
mov dword [esi + 0x28], eax
mov eax, dword [esi + 0x24]
push 8
push eax
push ecx
call fcn.01197280
mov edi, dword [esi + 0x20]
and edi, 0x3f
mov byte [edi + esi + 0x2c], 0x80
inc edi
mov ecx, edx
mov ebx, eax
mov dword [ebp - 4], ecx
cmp edi, 0x38
je 0x1179ffe
and edi, 0x3f
jne 0x1179ff1
push esi
call fcn.01179a50
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov byte [edx + edi], 0
inc edi
cmp edi, 0x38
jne 0x1179fe3
mov eax, ecx
shr eax, 0x18
shld ecx, ebx, 8
mov byte [edi + esi + 0x2c], al
mov edx, ecx
shr edx, 0x18
shl ebx, 8
mov byte [edi + esi + 0x2d], dl
mov eax, ebx
shld ecx, eax, 8
shl eax, 8
mov edx, ecx
shld ecx, eax, 8
shr edx, 0x18
mov byte [edi + esi + 0x2e], dl
shl eax, 8
mov edx, ecx
shld ecx, eax, 8
shr edx, 0x18
shl eax, 8
mov byte [edi + esi + 0x2f], dl
mov edx, ecx
shld ecx, eax, 8
shr edx, 0x18
shl eax, 8
mov byte [edi + esi + 0x30], dl
mov edx, ecx
shld ecx, eax, 8
shl eax, 8
mov dword [ebp - 8], eax
mov eax, ecx
shr edx, 0x18
shr eax, 0x18
shr ecx, 0x10
push esi
mov byte [edi + esi + 0x31], dl
mov byte [edi + esi + 0x32], al
mov byte [edi + esi + 0x33], cl
call fcn.01179a50
mov edi, dword [ebp + 0xc]
xor edx, edx
xor eax, eax
mov ebx, eax
and ebx, 3
mov ecx, 3
sub ecx, ebx
add ecx, ecx
mov ebx, eax
shr ebx, 2
mov ebx, dword [esi + ebx*4]
add ecx, ecx
add ecx, ecx
shr ebx, cl
inc eax
mov byte [eax + edi - 1], bl
cmp eax, 0x20
jb 0x117a080
pop edi
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
mov dword [esi + 0x20], edx
mov dword [esi + 0x24], edx
pop esi
mov ecx, 0x20
lea eax, [ebp - 0x28]
pop ebx
mov edi, edi
mov byte [eax], 0
inc eax
sub ecx, 1
jne 0x117a0f0
mov ecx, pe_nt_image_headers32
lea eax, [ebp - 0x128]
mov byte [eax], 0
inc eax
sub ecx, 1
jne 0x117a104
mov eax, dword [ebp + 8]
mov ecx, 0x40
mov byte [eax], 0
inc eax
sub ecx, 1
jne 0x117a115
mov esp, ebp
pop ebp
ret 8
Function at 0x117a690
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [0x11a6d68]
push esi
test edx, edx
jne 0x117a6ed
cmp byte [0x11a6d64], dl
jne 0x117a6ed
push 0x10255ec
call fcn.0117a2c0
mov dword [0x11a6d60], eax
test eax, eax
je 0x117a6e0
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push 0x10255d8
push eax
call esi
mov dword [0x11a6d68], eax
mov eax, dword [0x11a6d60]
push 0x10255c0
push eax
call esi
mov dword [0x11a6d6c], eax
mov edx, dword [0x11a6d68]
mov byte [0x11a6d64], 1
mov esi, dword [ebp + 0xc]
mov ecx, esi
and ecx, 0xf
mov eax, esi
sub eax, ecx
xor ecx, ecx
cmp byte [ebp + 0x14], cl
setne cl
cmp byte [ebp + 0x10], 0
je 0x117a752
test edx, edx
je 0x117a79b
push ecx
push eax
mov eax, dword [ebp + 8]
push eax
call edx
test eax, eax
jne 0x117a7bd
push 0x102563c
push 0x11a3474
call fcn.01178410
add esp, 8
push 2
mov ecx, 0x11a3474
call fcn.01173a60
push 0x119c06c
lea ecx, [ebp + 0x14]
push ecx
mov dword [ebp + 0x14], 2
call sub.msvcrt.dll__CxxThrowException
mov edx, dword [0x11a6d6c]
test edx, edx
je 0x117a79b
push ecx
push eax
mov eax, dword [ebp + 8]
push eax
call edx
test eax, eax
jne 0x117a7bd
push 0x1025604
push 0x11a3474
call fcn.01178410
add esp, 8
push 2
mov ecx, 0x11a3474
call fcn.01173a60
push 0x119c06c
lea ecx, [ebp + 0x14]
push ecx
mov dword [ebp + 0x14], 2
call sub.msvcrt.dll__CxxThrowException
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
xor ecx, ecx
test esi, esi
jbe 0x117a7bd
mov dl, al
mov eax, dword [ebp + 8]
add dl, 0x4b
push ebx
mov bl, dl
add bl, cl
xor byte [ecx + eax], bl
inc ecx
cmp ecx, esi
jb 0x117a7b0
pop ebx
pop esi
pop ebp
ret 0x10

Function at 0x117c480
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x10]
push edi
push eax
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov ecx, dword [esi + 0x10]
push ecx
mov byte [esi + 8], 1
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
lea edx, [ebp - 4]
push edx
push 0
push esi
push fcn.01177a30
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov edi, eax
test edi, edi
jne 0x117c4d1
push esi
call fcn.01177a30
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x3e8
push edi
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x117e360
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x11a3270]
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x34]
push 0x10265b0
push eax
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x34], 0x10256b8
mov dword [ebp - 0x30], 0x81002
mov dword [ebp - 0x18], 0x10000
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], 1
call fcn.011776e0
mov ebx, dword [ebp + 8]
add esp, 8
push ebx
call fcn.010c9650
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x10]
push ecx
push edx
push eax
mov eax, dword [ebp + 0xc]
lea ecx, [eax + 0x1fc]
push ecx
lea edx, [eax + 0x76]
push edx
lea ecx, [eax + 0x4d]
push ecx
add eax, 0xc
push eax
lea edx, [ebp - 0x34]
push edx
call fcn.0117c750
mov edi, dword [ebp + 0x1c]
push esi
push edi
push 0x100cd2c
lea eax, [ebp - 0x34]
push eax
call fcn.0117e190
push esi
lea ecx, [edi + 0x2f8]
push ecx
push 0x100cd24
lea edx, [ebp - 0x34]
push edx
call fcn.0117e190
push 1
add edi, 0x5f0
push edi
push 0x10265a8
lea eax, [ebp - 0x34]
push eax
call fcn.0117e190
lea ecx, [ebp - 0x34]
push 0x1025e14
push ecx
call fcn.011776e0
push 0x8c
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov edi, eax
add esp, 0xc
cmp edi, esi
je 0x117e45f
push 0x8c
push esi
push edi
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x41
push 0x1026574
push edi
call fcn.0102d520
mov edx, dword [ebp - 8]
mov dword [edi + 0x84], edx
mov eax, dword [ebp - 0xc]
mov dword [edi + 0x88], eax
push 0xc
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
call fcn.0102ae00
cmp eax, esi
je 0x117e4b1
push esi
push esi
push eax
push 0x1177b30
push esi
push esi
mov dword [eax], ebx
mov dword [eax + 4], edi
mov dword [eax + 8], 0x2710
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov eax, dword [ebp - 8]
mov dword [ebp - 0x34], 0x10256b8
cmp eax, esi
je 0x117e4dd
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
cmp dword [ebp - 4], esi
je 0x117e4da
push eax
lea ecx, [ebp - 0x34]
call dword [fcn.01025708]
mov dword [ebp - 8], esi
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
call fcn.0117bce0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x117f5e0
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
xor esi, esi
push edi
mov edi, ecx
cmp ebx, esi
jne 0x117f5fc
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret 8
cmp dword [edi + 0xc], 1
jne 0x117f610
push 0xfffffffffffffff5
call dword [0x1001370]
mov dword [edi + 4], eax
lea ecx, [ecx]
xor al, al
mov dword [ebp + 0xc], esi
cmp dword [edi + 0xc], esi
je 0x117f65e
test ebx, ebx
jbe 0x117f67c
mov edi, edi
mov eax, ebx
sub eax, esi
cmp eax, 0x4000
jb 0x117f630
mov eax, 0x4000
mov edx, dword [ebp + 8]
push 0
lea ecx, [ebp + 0xc]
push ecx
mov ecx, dword [edi + 4]
push eax
lea eax, [esi + edx]
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
cmp eax, 1
sete al
test al, al
je 0x117f67c
add esi, 0x4000
cmp esi, ebx
jb 0x117f620
jmp 0x117f678
mov eax, dword [ebp + 8]
mov ecx, dword [edi + 4]
push esi
lea edx, [ebp + 0xc]
push edx
push ebx
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
cmp eax, 1
sete al
test al, al
jne 0x117f698
cmp byte [edi + 0x14], 0
je 0x117f698
cmp dword [edi + 0xc], 0
jne 0x117f698
add edi, 0x1e
push edi
push 0
mov ecx, 0x11a3474
call fcn.0117f550
mov byte [edi + 8], 1
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x117fb00
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.011972f0
push edi
mov edi, dword [ebp + 8]
movzx eax, word [edi]
test ax, ax
jne 0x117fb24
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 0xc
movzx eax, ax
cmp ax, 0x69
je 0x117fb37
movzx eax, ax
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
mov eax, edi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x117fb40
push esi
sub eax, edx
sar eax, 1
push edi
mov esi, eax
call fcn.0117fa40
test al, al
je 0x117fc1f
push edi
call fcn.0117f9f0
test al, al
je 0x117fbaa
add esi, 4
cmp dword [ebp + 0x10], esi
jbe 0x117fd49
mov esi, dword [ebp + 0xc]
push 4
push 0x1015a9c
push esi
call dword [sym.imp.msvcrt.dll_wcsncpy]
add esp, 0xc
sub esi, edi
mov eax, edi
lea edx, [esi + 8]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x117fb91
pop esi
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret 0xc
cmp word [edi], 0x5c
jne 0x117fd49
add edi, 2
cmp word [edi], 0x5c
jne 0x117fd49
add esi, 6
cmp dword [ebp + 0x10], esi
jbe 0x117fd49
mov esi, dword [ebp + 0xc]
push 4
push 0x1015a9c
push esi
call dword [sym.imp.msvcrt.dll_wcsncpy]
mov eax, 0x10269ec
mov ecx, esi
add esp, 0xc
sub ecx, eax
lea edx, [ecx + 8]
lea ecx, [ecx]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x117fbf0
sub esi, edi
mov eax, edi
lea edx, [esi + 0xe]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x117fc06
pop esi
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret 0xc
lea edx, [ebp - 0x1000]
push edx
push 0x7ff
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
test eax, eax
je 0x117fd49
cmp eax, 0x7ff
ja 0x117fd49
movzx eax, word [edi]
push ebx
push eax
call fcn.01173f50
test al, al
je 0x117fcaa
add esi, 6
cmp dword [ebp + 0x10], esi
jbe 0x117fcde
mov esi, dword [ebp + 0xc]
mov ebx, dword [sym.imp.msvcrt.dll_wcsncpy]
push 4
push 0x1015a9c
push esi
call ebx
push 2
lea ecx, [ebp - 0x1000]
push ecx
lea edx, [esi + 8]
push edx
call ebx
add esp, 0x18
sub esi, edi
mov eax, edi
lea edx, [esi + 0xc]
lea ebx, [ebx]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x117fc90
pop ebx
pop esi
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret 0xc
push 0x800
lea eax, [ebp - 0x1000]
push eax
call fcn.01173f80
lea eax, [ebp - 0x1000]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x117fcc4
mov ebx, dword [ebp + 0x10]
sub eax, edx
sar eax, 1
lea ecx, [eax + esi + 4]
cmp ebx, ecx
ja 0x117fce9
pop ebx
pop esi
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 0xc
mov esi, dword [ebp + 0xc]
push 4
push 0x1015a9c
push esi
call dword [sym.imp.msvcrt.dll_wcsncpy]
lea eax, [ebp - 0x1000]
mov edx, esi
mov ecx, eax
sub edx, ecx
add esp, 0xc
add edx, 8
lea esp, [esp]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x117fd10
cmp word [edi], 0x2e
jne 0x117fd36
movzx edx, word [edi + 2]
push edx
call fcn.01173f50
test al, al
je 0x117fd36
add edi, 4
push ebx
push edi
push esi
call fcn.01174750
pop ebx
pop esi
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret 0xc
pop esi
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1185c50
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.011972f0
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, ecx
cmp byte [ebx + 0x1c], 0
push esi
mov dword [ebx + 0x1020], 0
jne 0x1185c7e
test al, 4
jne 0x1185c7e
xor cl, cl
jmp 0x1185c80
mov cl, 1
mov edx, eax
shr edx, 1
push edi
and dl, 1
movzx edi, dl
neg edi
sbb edi, edi
and edi, 0xc0000000
add edi, 0x80000000
test al, 1
je 0x1185ca5
or edi, 0x40000000
shr eax, 3
not eax
and eax, 1
mov dword [ebp + 0xc], eax
test cl, cl
je 0x1185cba
or eax, 2
mov dword [ebp + 0xc], eax
xor ecx, ecx
cmp byte [ebx + 0x15], cl
push 0
setne cl
dec ecx
and ecx, 0x8000000
push ecx
push 3
push 0
push eax
mov eax, dword [ebp + 8]
push edi
push eax
mov dword [ebp - 8], ecx
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1185d49
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, dword [ebp + 8]
push 0x800
lea ecx, [ebp - 0x1008]
push ecx
push edx
mov dword [ebp - 4], eax
call fcn.0117fb00
test al, al
je 0x1185d39
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push 0
push eax
push 3
push 0
push ecx
push edi
lea edx, [ebp - 0x1008]
push edx
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 2
jne 0x1185d34
mov dword [ebp - 4], eax
cmp esi, 0xffffffff
jne 0x1185d49
cmp dword [ebp - 4], 2
jne 0x1185d49
mov dword [ebx + 0x1020], 1
cmp esi, 0xffffffff
setne al
mov byte [ebx + 0x12], 0
mov dword [ebx + 0xc], 0
mov byte [ebx + 0x10], 0
mov byte [ebp + 0xf], al
pop edi
test al, al
je 0x1185d8b
mov eax, dword [ebp + 8]
push 0x7ff
mov dword [ebx + 4], esi
push eax
lea esi, [ebx + 0x1e]
push esi
call dword [sym.imp.msvcrt.dll_wcsncpy]
mov al, byte [ebp + 0xf]
add esp, 0xc
xor ecx, ecx
mov word [esi + 0xffe], cx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x1185f00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.011972f0
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
push ebx
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x1185f4f
push 0x800
lea eax, [ebp - 0x1000]
push eax
push ebx
call fcn.0117fb00
test al, al
je 0x1185f4d
lea ecx, [ebp - 0x1000]
push ecx
call edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1185f60
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.011972f0
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
push esi
push eax
call edi
test eax, eax
setne bl
test bl, bl
jne 0x1185fbc
mov edx, dword [ebp + 8]
push 0x800
lea ecx, [ebp - 0x1000]
push ecx
push edx
call fcn.0117fb00
test al, al
je 0x1185fbc
push esi
lea eax, [ebp - 0x1000]
push eax
call edi
pop edi
test eax, eax
pop esi
setne al
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1186100
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1250
call fcn.011972f0
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
cmp ebx, 0xffffffff
jne 0x11861a5
mov edi, dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
lea eax, [ebp - 0x250]
push eax
push esi
call edi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x11861e4
push 0x800
lea ecx, [ebp - 0x1250]
push ecx
push esi
call fcn.0117fb00
test al, al
je 0x1186169
lea edx, [ebp - 0x250]
push edx
lea eax, [ebp - 0x1250]
push eax
call edi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x11861e4
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 2
je 0x1186185
cmp eax, 3
je 0x1186185
cmp eax, 0x12
je 0x1186185
mov ecx, 1
jmp 0x1186187
xor ecx, ecx
mov eax, dword [ebp + 0x10]
pop edi
mov byte [eax + 0x1044], cl
mov dword [eax + 0x1040], 0
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
lea ecx, [ebp - 0x250]
push ecx
push ebx
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x11861e4
or esi, 0xffffffff
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x12
mov eax, dword [ebp + 0x10]
setne dl
pop edi
mov byte [eax + 0x1044], dl
mov dword [eax + 0x1040], 0
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x7ff
push esi
mov esi, dword [ebp + 0x10]
push esi
call dword [sym.imp.msvcrt.dll_wcsncpy]
add esp, 0xc
xor eax, eax
push esi
mov word [esi + 0xffe], ax
call fcn.01178bc0
mov ecx, eax
sub ecx, esi
sar ecx, 1
mov edi, 0x800
sub edi, ecx
mov dword [ebp + 0x10], eax
je 0x1186237
lea edx, [edi - 1]
push edx
lea ecx, [ebp - 0x224]
push ecx
push eax
call dword [sym.imp.msvcrt.dll_wcsncpy]
mov eax, dword [ebp + 0x10]
add esp, 0xc
xor edx, edx
mov word [eax + edi*2 - 2], dx
mov ecx, dword [ebp - 0x234]
push 1
push 0
push 0
push ecx
call fcn.01197280
mov ecx, dword [ebp - 0x230]
xor edi, edi
add eax, ecx
mov ecx, dword [ebp - 0x248]
adc edx, edi
mov edi, dword [ebp - 0x240]
mov dword [esi + 0x1034], edi
mov edi, dword [ebp - 0x23c]
mov dword [esi + 0x1038], edi
mov edi, dword [ebp - 0x238]
mov dword [esi + 0x1004], edx
mov edx, dword [ebp - 0x250]
mov dword [esi + 0x1000], eax
mov eax, dword [ebp - 0x24c]
mov dword [esi + 0x103c], edi
mov edi, dword [ebp - 0x23c]
mov dword [esi + 0x1008], edx
mov edx, dword [ebp - 0x244]
mov dword [esi + 0x1028], eax
mov dword [esi + 0x102c], ecx
mov dword [esi + 0x1030], edx
mov dword [esi + 0x1010], edi
mov edi, dword [ebp - 0x238]
mov dword [esi + 0x1014], edi
mov dword [esi + 0x1018], eax
mov eax, dword [ebp - 0x240]
mov dword [esi + 0x101c], ecx
mov dword [esi + 0x1024], eax
mov dword [esi + 0x1020], edx
pop edi
mov dword [esi + 0x1040], 0
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x11869e0
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
mov dword [edi + 4], 0
mov dword [edi], 0
mov eax, esi
cmp esi, 0x8000
jb 0x1186a09
mov eax, 0x8000
mov ebx, dword [ebp + 8]
push eax
mov eax, dword [edi + 0xc]
push ebx
push eax
call sub.msvcrt.dll_memcpy
mov eax, 1
add esp, 0xc
xor cl, cl
cmp esi, eax
jbe 0x1186a2d
xor cl, byte [eax + ebx]
inc eax
cmp eax, esi
jb 0x1186a25
mov eax, dword [edi + 4]
mov esi, dword [ebp + 0x10]
add eax, 8
mov edx, eax
shr edx, 3
add dword [edi], edx
and eax, 7
mov dword [edi + 4], eax
mov dword [esi + 0x14], 0
cmp cl, byte [ebx]
jne 0x1186aa0
mov eax, dword [ebp + 0xc]
push eax
push ebx
mov ecx, edi
call fcn.01174480
mov edi, eax
test edi, edi
je 0x1186aa0
push 1
mov ecx, esi
call fcn.01184b80
mov eax, dword [esi + 0x14]
lea ecx, [eax + 1]
mov dword [esi + 0x14], ecx
lea edx, [eax + eax*4]
mov eax, dword [esi]
lea eax, [eax + edx*8]
lea ecx, [eax + 0xc]
mov dword [ecx], edi
mov dword [eax + 0x14], ecx
lea ecx, [eax + 0x1c]
pop edi
mov dword [eax + 0x24], ecx
mov ecx, 3
pop esi
mov dword [eax], 0x28
mov dword [eax + 0x18], ecx
mov dword [eax + 8], ecx
pop ebx
pop ebp
ret 0xc
push 1
mov ecx, esi
call fcn.01184b80
mov eax, dword [esi + 0x14]
mov ecx, dword [esi]
lea edx, [eax + 1]
mov dword [esi + 0x14], edx
lea eax, [eax + eax*4]
lea eax, [ecx + eax*8]
lea ecx, [eax + 0x1c]
mov dword [eax + 0x24], ecx
mov ecx, 3
mov dword [eax + 0x18], ecx
mov dword [eax + 8], ecx
lea edx, [eax + 0xc]
xor ecx, ecx
mov dword [eax], 0x16
mov dword [eax + 0x14], edx
cmp dword [esi + 0x14], ecx
jle 0x1186b05
xor edx, edx
mov eax, dword [esi]
add eax, edx
cmp dword [eax + 0x14], 0
jne 0x1186af0
lea edi, [eax + 0xc]
mov dword [eax + 0x14], edi
cmp dword [eax + 0x24], 0
jne 0x1186afc
lea edi, [eax + 0x1c]
mov dword [eax + 0x24], edi
inc ecx
add edx, 0x28
cmp ecx, dword [esi + 0x14]
jl 0x1186ae0
pop edi
pop esi
pop ebx
pop ebp
ret 0xc