joyce8/EMBER2024-capa huggingface dataset:
Function at 0x116cdc0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test dword [esi + 0x2b660], 0x400
je 0x116cdfd
cmp dword [esi + 0x14], 0
jne 0x116cdfd
mov eax, dword [esi]
mov eax, dword [eax + 0x131c]
push 0x2030
push 0x1010180
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
pop esi
pop ebp
ret 4
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov ecx, dword [esi + 0x2d47c]
add ecx, 0xea60
cmp eax, ecx
jbe 0x116ce3d
mov edx, dword [esi + 8]
push edi
mov edi, dword [edx]
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x1152ed0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x116ce3c
mov ecx, dword [edi + 0x1c0]
push eax
call ecx
pop edi
push esi
call fcn.0116ca30
xor eax, eax
pop esi
pop ebp
ret 4

Function at 0x116cec0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [esi + 0x2d3c8], 0x1c
test eax, eax
je 0x116cefd
push eax
call fcn.010d5a20
cmp dword [esi + 0x2d2d0], 0
je 0x116cefd
mov edi, dword [sym.imp.KERNEL32.DLL_Sleep]
push 0xa
call edi
cmp dword [esi + 0x2d2d0], 0
jne 0x116cef0
push 0
lea eax, [esi + 0x2d470]
push eax
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
cmp dword [esi + 0x240e4], 0
jne 0x116cf3d
mov ecx, dword [esi + 8]
mov edi, dword [ecx]
lea edx, [ebp + 8]
push edx
push 0
push esi
push fcn.0116ce50
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x116cf3d
push eax
mov eax, dword [edi + 0x1c0]
call eax
pop edi
pop esi
pop ebp
ret 8
Function at 0x116dba0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 4], edi
cmp ecx, edi
je 0x116dcdd
mov eax, ecx
cmp word [ecx], di
je 0x116dbcb
add eax, 2
cmp word [eax], di
jne 0x116dbc3
sub eax, ecx
sar eax, 1
cmp eax, 4
jbe 0x116dcdd
mov ebx, dword [ebp + 0x10]
cmp ebx, edi
je 0x116dcdd
mov eax, ebx
cmp word [ebx], di
je 0x116dbf8
lea ebx, [ebx]
add eax, 2
cmp word [eax], di
jne 0x116dbf0
sub eax, ebx
sar eax, 1
cmp eax, 4
jbe 0x116dcdd
mov eax, dword [esi]
lea edx, [ebp + 8]
push edx
push edi
push esi
push 0x1102b60
mov dword [eax + 0x26800], edi
mov ecx, dword [esi]
push edi
push edi
mov dword [ecx + 0x26804], edi
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov edi, eax
test edi, edi
je 0x116dc7e
cmp edi, 0xffffffff
je 0x116dc7e
mov eax, dword [esi]
push ebx
mov ebx, dword [ebp + 0xc]
push ebx
push eax
call fcn.010e3aa0
mov ecx, dword [esi]
test eax, eax
je 0x116dc60
mov edx, dword [ecx + 8]
push ebx
push 0x15
push edx
call fcn.010de740
mov eax, dword [esi]
mov dword [eax + 0x26800], 1
jmp 0x116dc6e
mov eax, 1
mov dword [ecx + 0x26804], eax
mov dword [ebp - 4], eax
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [esi]
cmp dword [eax + 0x26800], 0
je 0x116dcd5
cmp dword [eax + 0x26808], 0
jne 0x116dc9f
mov edx, dword [eax + 8]
push 0
push 0x12
push edx
call fcn.010de530
mov eax, dword [esi]
mov ecx, dword [eax + 8]
push 0x20
push ecx
call fcn.010de4b0
test eax, eax
jne 0x116dccd
mov edx, dword [esi]
mov eax, dword [edx + 8]
push 1
push 0x20
push eax
call fcn.010de530
push 4
push 0
push 0x1b
push esi
call fcn.01060140
jmp 0x116dcd5
push 0
push esi
call fcn.0116cf90
cmp dword [ebp - 4], 0
je 0x116dd28
xor edi, edi
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 0xca4]
push 0x2030
push 0x1010180
push eax
mov eax, dword [esi + 0xc]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [esi]
mov eax, dword [ecx + 0x25f4c]
mov ebx, dword [sym.imp.USER32.dll_SetWindowTextW]
cmp eax, edi
je 0x116dd15
mov edx, dword [eax + 0x1c]
push edi
push edx
call ebx
mov eax, dword [esi]
mov eax, dword [eax + 0x25f50]
cmp eax, edi
je 0x116dd28
mov ecx, dword [eax + 0x1c]
push edi
push ecx
call ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x116e950
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi]
push edi
lea eax, [ebp - 4]
push eax
push ecx
mov dword [ebp - 4], 0
call fcn.0102e6f0
mov edi, eax
test edi, edi
je 0x116e98f
mov edx, dword [ebp - 4]
push edi
push edx
push esi
call fcn.0106ff10
push edi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
push esi
call fcn.01070230
cmp dword [esi + 0x4c], 0
je 0x116e9d0
push 0x1010150
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x116e9b6
push 0x2710
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov eax, dword [esi + 8]
xor ecx, ecx
cmp dword [esi + 0x50], ecx
push eax
sete cl
push ecx
call fcn.01164520
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x1010164
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x116e9eb
push 0x2710
call dword [sym.imp.KERNEL32.DLL_Sleep]
push esi
call fcn.0116dae0
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x116ea00
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x6d4
push 0x10700e0
push 0
call dword [sym.imp.KERNEL32.DLL_AddVectoredExceptionHandler]
push 0x6d4
lea eax, [ebp - 0x6d4]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x20d
push 8
mov dword [ebp - 0x264], 2
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov dword [ebp - 0x278], eax
test eax, eax
je 0x116ea83
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x6d4]
push edx
mov dword [ebp - 0x6d4], eax
mov dword [ebp - 0x6d0], ecx
call fcn.0116e950
mov eax, dword [ebp - 0x278]
push eax
call fcn.0103ecf0
mov ecx, dword [ebp - 0x264]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x116f4d0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 0x1ddc]
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
mov dword [ebp - 0xc], edx
mov edx, dword [eax + 0x1e54]
mov eax, dword [eax + 0x1e58]
push 1
add ecx, 0x29170
push ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
call edi
test eax, eax
jne 0x116f55e
mov edx, dword [esi]
push 3
lea ecx, [ebp - 0xc]
push ecx
push eax
mov eax, dword [edx]
mov ecx, dword [eax + 0x1ddc]
push 0x1082390
push ecx
push 0x1c
push 0x17
push 0
push 0x1c
push 0x50a47e
push 0x73b69a
push esi
call fcn.0112ea70
push esi
call fcn.010eb570
push esi
call fcn.01134b90
push esi
call fcn.0116eb90
push esi
call fcn.0111e630
push esi
call fcn.010b6510
mov edx, dword [esi]
push 0
add edx, 0x2915c
push edx
call edi
test eax, eax
jne 0x116f5a0
mov eax, dword [esi]
test byte [eax + 0x2d438], 2
je 0x116f5a0
mov edi, dword [esi + 4]
lea ecx, [ebp + 8]
push ecx
push 0
push eax
push 0x10e5960
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x116f5a0
mov edx, dword [edi + 0x1c0]
push eax
call edx
push 1
push 0
push 0x1c
push esi
call fcn.01060140
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x1170b60
Capabilities:
Hash data using sha256

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [0x11a4d7c], 2
push esi
push edi
mov edi, eax
mov esi, ecx
jl 0x1170b79
call fcn.0116fa40
push 0xf0
push 0
push esi
call sub.msvcrt.dll_memset
mov dword [esi + 0x100], 0
mov byte [esi + 0x104], 0
mov eax, dword [esi + 0xf4]
mov dword [eax], 0x6a09e667
mov ecx, dword [esi + 0xf4]
mov dword [ecx + 4], 0xbb67ae85
mov edx, dword [esi + 0xf4]
mov dword [edx + 8], 0x3c6ef372
mov eax, dword [esi + 0xf4]
mov dword [eax + 0xc], 0xa54ff53a
mov ecx, dword [esi + 0xf4]
mov dword [ecx + 0x10], 0x510e527f
mov edx, dword [esi + 0xf4]
mov dword [edx + 0x14], 0x9b05688c
mov eax, dword [esi + 0xf4]
mov edx, dword [ebp + 8]
mov dword [eax + 0x18], 0x1f83d9ab
mov ecx, dword [esi + 0xf4]
mov dword [ecx + 0x1c], 0x5be0cd19
mov eax, dword [esi + 0xf4]
xor dword [eax], 0x2080020
mov eax, dword [esi + 0xf4]
xor dword [eax + 8], edx
mov esi, dword [esi + 0xf4]
or edi, 0x2000
add esp, 0xc
shl edi, 0x10
xor dword [esi + 0xc], edi
pop edi
pop esi
pop ebp
ret 4
Function at 0x1171520
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
test esi, esi
jbe 0x1171551
test cl, 7
je 0x1171551
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x11a2c08]
dec esi
inc ecx
test esi, esi
ja 0x1171534
cmp esi, 8
jb 0x11715df
mov edx, esi
shr edx, 3
mov dword [ebp + 8], edx
push ebx
mov edx, dword [ecx + 4]
xor eax, dword [ecx]
mov ebx, edx
shr ebx, 0x10
movzx edi, bl
mov edi, dword [edi*4 + 0x11a3008]
mov ebx, edx
shr ebx, 0x18
xor edi, dword [ebx*4 + 0x11a2c08]
mov ebx, edx
shr ebx, 8
movzx ebx, bl
xor edi, dword [ebx*4 + 0x11a3408]
mov ebx, eax
shr ebx, 0x18
xor edi, dword [ebx*4 + 0x11a3c08]
mov ebx, eax
shr ebx, 0x10
movzx ebx, bl
xor edi, dword [ebx*4 + 0x11a4008]
mov ebx, eax
shr ebx, 8
movzx ebx, bl
xor edi, dword [ebx*4 + 0x11a4408]
movzx edx, dl
xor edi, dword [edx*4 + 0x11a3808]
movzx eax, al
xor edi, dword [eax*4 + 0x11a4808]
sub esi, 8
add ecx, 8
sub dword [ebp + 8], 1
mov eax, edi
jne 0x1171563
pop ebx
test esi, esi
jbe 0x11715fb
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x11a2c08]
dec esi
inc ecx
test esi, esi
ja 0x11715e3
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x1172490
Capabilities:
Hash data using sha256

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
pop ebp
ret 4

Function at 0x1176320
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0xc], 1
push edi
jne 0x117633c
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
mov dword [esi + 4], eax
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov ecx, dword [esi + 4]
push 0
lea eax, [ebp - 4]
push eax
push edi
push ebx
push ecx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x11763ea
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x1176393
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileType]
cmp eax, 2
je 0x1176375
cmp eax, 3
jne 0x1176393
cmp edi, 0x4e20
jbe 0x1176393
push 0x4e20
push ebx
mov ecx, esi
call fcn.01176320
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [esi + 0xc], 1
jne 0x11763af
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x6d
jne 0x11763af
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [esi + 0xc], 0
jne 0x11763de
cmp edi, 0x8000
jbe 0x11763de
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x21
jne 0x11763de
push 0x8000
push ebx
mov ecx, esi
call fcn.01176320
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1177de0
Capabilities:
Hash data using sha256

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x128
push ebx
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 0x20]
push edi
lea eax, [esi + 0x2c]
push 0
mov dword [ebp + 8], eax
mov dword [esi + 0x28], eax
mov eax, dword [esi + 0x24]
push 8
push eax
push ecx
call fcn.01194910
mov edi, dword [esi + 0x20]
and edi, 0x3f
mov byte [edi + esi + 0x2c], 0x80
inc edi
mov ecx, edx
mov ebx, eax
mov dword [ebp - 4], ecx
cmp edi, 0x38
je 0x1177e3e
and edi, 0x3f
jne 0x1177e31
push esi
call fcn.01177890
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov byte [edx + edi], 0
inc edi
cmp edi, 0x38
jne 0x1177e23
mov eax, ecx
shr eax, 0x18
shld ecx, ebx, 8
mov byte [edi + esi + 0x2c], al
mov edx, ecx
shr edx, 0x18
shl ebx, 8
mov byte [edi + esi + 0x2d], dl
mov eax, ebx
shld ecx, eax, 8
shl eax, 8
mov edx, ecx
shld ecx, eax, 8
shr edx, 0x18
mov byte [edi + esi + 0x2e], dl
shl eax, 8
mov edx, ecx
shld ecx, eax, 8
shr edx, 0x18
shl eax, 8
mov byte [edi + esi + 0x2f], dl
mov edx, ecx
shld ecx, eax, 8
shr edx, 0x18
shl eax, 8
mov byte [edi + esi + 0x30], dl
mov edx, ecx
shld ecx, eax, 8
shl eax, 8
mov dword [ebp - 8], eax
mov eax, ecx
shr edx, 0x18
shr eax, 0x18
shr ecx, 0x10
push esi
mov byte [edi + esi + 0x31], dl
mov byte [edi + esi + 0x32], al
mov byte [edi + esi + 0x33], cl
call fcn.01177890
mov edi, dword [ebp + 0xc]
xor edx, edx
xor eax, eax
mov ebx, eax
and ebx, 3
mov ecx, 3
sub ecx, ebx
add ecx, ecx
mov ebx, eax
shr ebx, 2
mov ebx, dword [esi + ebx*4]
add ecx, ecx
add ecx, ecx
shr ebx, cl
inc eax
mov byte [eax + edi - 1], bl
cmp eax, 0x20
jb 0x1177ec0
pop edi
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
mov dword [esi + 0x20], edx
mov dword [esi + 0x24], edx
pop esi
mov ecx, 0x20
lea eax, [ebp - 0x28]
pop ebx
mov edi, edi
mov byte [eax], 0
inc eax
sub ecx, 1
jne 0x1177f30
mov ecx, pe_nt_image_headers32
lea eax, [ebp - 0x128]
mov byte [eax], 0
inc eax
sub ecx, 1
jne 0x1177f44
mov eax, dword [ebp + 8]
mov ecx, 0x40
mov byte [eax], 0
inc eax
sub ecx, 1
jne 0x1177f55
mov esp, ebp
pop ebp
ret 8
Function at 0x11784a0
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [0x11a4d88]
push esi
test edx, edx
jne 0x11784fd
cmp byte [0x11a4d84], dl
jne 0x11784fd
push 0x1025354
call fcn.011780d0
mov dword [0x11a4d80], eax
test eax, eax
je 0x11784f0
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push 0x1025340
push eax
call esi
mov dword [0x11a4d88], eax
mov eax, dword [0x11a4d80]
push 0x1025328
push eax
call esi
mov dword [0x11a4d8c], eax
mov edx, dword [0x11a4d88]
mov byte [0x11a4d84], 1
mov esi, dword [ebp + 0xc]
mov ecx, esi
and ecx, 0xf
mov eax, esi
sub eax, ecx
xor ecx, ecx
cmp byte [ebp + 0x14], cl
setne cl
cmp byte [ebp + 0x10], 0
je 0x1178562
test edx, edx
je 0x11785ab
push ecx
push eax
mov eax, dword [ebp + 8]
push eax
call edx
test eax, eax
jne 0x11785cd
push 0x10253a4
push 0x11a1484
call fcn.01176250
add esp, 8
push 2
mov ecx, 0x11a1484
call fcn.01171870
push 0x11996fc
lea ecx, [ebp + 0x14]
push ecx
mov dword [ebp + 0x14], 2
call sub.msvcrt.dll__CxxThrowException
mov edx, dword [0x11a4d8c]
test edx, edx
je 0x11785ab
push ecx
push eax
mov eax, dword [ebp + 8]
push eax
call edx
test eax, eax
jne 0x11785cd
push 0x102536c
push 0x11a1484
call fcn.01176250
add esp, 8
push 2
mov ecx, 0x11a1484
call fcn.01171870
push 0x11996fc
lea ecx, [ebp + 0x14]
push ecx
mov dword [ebp + 0x14], 2
call sub.msvcrt.dll__CxxThrowException
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
xor ecx, ecx
test esi, esi
jbe 0x11785cd
mov dl, al
mov eax, dword [ebp + 8]
add dl, 0x4b
push ebx
mov bl, dl
add bl, cl
xor byte [ecx + eax], bl
inc ecx
cmp ecx, esi
jb 0x11785c0
pop ebx
pop esi
pop ebp
ret 0x10

Function at 0x117a290
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x10]
push edi
push eax
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov ecx, dword [esi + 0x10]
push ecx
mov byte [esi + 8], 1
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
lea edx, [ebp - 4]
push edx
push 0
push esi
push fcn.01175870
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov edi, eax
test edi, edi
jne 0x117a2e1
push esi
call fcn.01175870
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x3e8
push edi
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x117c170
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x11a1280]
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x34]
push 0x1026318
push eax
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x34], 0x1025420
mov dword [ebp - 0x30], 0x81002
mov dword [ebp - 0x18], 0x10000
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], 1
call fcn.01175520
mov ebx, dword [ebp + 8]
add esp, 8
push ebx
call fcn.010c81b0
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x10]
push ecx
push edx
push eax
mov eax, dword [ebp + 0xc]
lea ecx, [eax + 0x1fc]
push ecx
lea edx, [eax + 0x76]
push edx
lea ecx, [eax + 0x4d]
push ecx
add eax, 0xc
push eax
lea edx, [ebp - 0x34]
push edx
call fcn.0117a560
mov edi, dword [ebp + 0x1c]
push esi
push edi
push 0x100cbd4
lea eax, [ebp - 0x34]
push eax
call fcn.0117bfa0
push esi
lea ecx, [edi + 0x2f8]
push ecx
push 0x100cbcc
lea edx, [ebp - 0x34]
push edx
call fcn.0117bfa0
push 1
add edi, 0x5f0
push edi
push 0x1026310
lea eax, [ebp - 0x34]
push eax
call fcn.0117bfa0
lea ecx, [ebp - 0x34]
push 0x1025b7c
push ecx
call fcn.01175520
push 0x8c
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov edi, eax
add esp, 0xc
cmp edi, esi
je 0x117c26f
push 0x8c
push esi
push edi
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x41
push 0x10262dc
push edi
call fcn.0102cdc0
mov edx, dword [ebp - 8]
mov dword [edi + 0x84], edx
mov eax, dword [ebp - 0xc]
mov dword [edi + 0x88], eax
push 0xc
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
call fcn.0102a6e0
cmp eax, esi
je 0x117c2c1
push esi
push esi
push eax
push 0x1175970
push esi
push esi
mov dword [eax], ebx
mov dword [eax + 4], edi
mov dword [eax + 8], 0x2710
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov eax, dword [ebp - 8]
mov dword [ebp - 0x34], 0x1025420
cmp eax, esi
je 0x117c2ed
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
cmp dword [ebp - 4], esi
je 0x117c2ea
push eax
lea ecx, [ebp - 0x34]
call dword [fcn.01025470]
mov dword [ebp - 8], esi
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
call fcn.01179af0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x117cc70
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
xor esi, esi
push edi
mov edi, ecx
cmp ebx, esi
jne 0x117cc8c
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret 8
cmp dword [edi + 0xc], 1
jne 0x117cca0
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
mov dword [edi + 4], eax
lea ecx, [ecx]
xor al, al
mov dword [ebp + 0xc], esi
cmp dword [edi + 0xc], esi
je 0x117ccee
test ebx, ebx
jbe 0x117cd0c
mov edi, edi
mov eax, ebx
sub eax, esi
cmp eax, 0x4000
jb 0x117ccc0
mov eax, 0x4000
mov edx, dword [ebp + 8]
push 0
lea ecx, [ebp + 0xc]
push ecx
mov ecx, dword [edi + 4]
push eax
lea eax, [esi + edx]
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
cmp eax, 1
sete al
test al, al
je 0x117cd0c
add esi, 0x4000
cmp esi, ebx
jb 0x117ccb0
jmp 0x117cd08
mov eax, dword [ebp + 8]
mov ecx, dword [edi + 4]
push esi
lea edx, [ebp + 0xc]
push edx
push ebx
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
cmp eax, 1
sete al
test al, al
jne 0x117cd28
cmp byte [edi + 0x14], 0
je 0x117cd28
cmp dword [edi + 0xc], 0
jne 0x117cd28
add edi, 0x1e
push edi
push 0
mov ecx, 0x11a1484
call fcn.0117cbb0
mov byte [edi + 8], 1
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x117d190
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.01194980
push edi
mov edi, dword [ebp + 8]
movzx eax, word [edi]
test ax, ax
jne 0x117d1b4
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 0xc
movzx eax, ax
cmp ax, 0x69
je 0x117d1c7
movzx eax, ax
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
mov eax, edi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x117d1d0
push esi
sub eax, edx
sar eax, 1
push edi
mov esi, eax
call fcn.0117d0d0
test al, al
je 0x117d2af
push edi
call fcn.0117d080
test al, al
je 0x117d23a
add esi, 4
cmp dword [ebp + 0x10], esi
jbe 0x117d3d9
mov esi, dword [ebp + 0xc]
push 4
push 0x1015894
push esi
call dword [sym.imp.msvcrt.dll_wcsncpy]
add esp, 0xc
sub esi, edi
mov eax, edi
lea edx, [esi + 8]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x117d221
pop esi
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret 0xc
cmp word [edi], 0x5c
jne 0x117d3d9
add edi, 2
cmp word [edi], 0x5c
jne 0x117d3d9
add esi, 6
cmp dword [ebp + 0x10], esi
jbe 0x117d3d9
mov esi, dword [ebp + 0xc]
push 4
push 0x1015894
push esi
call dword [sym.imp.msvcrt.dll_wcsncpy]
mov eax, 0x1026368
mov ecx, esi
add esp, 0xc
sub ecx, eax
lea edx, [ecx + 8]
lea ecx, [ecx]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x117d280
sub esi, edi
mov eax, edi
lea edx, [esi + 0xe]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x117d296
pop esi
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret 0xc
lea edx, [ebp - 0x1000]
push edx
push 0x7ff
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
test eax, eax
je 0x117d3d9
cmp eax, 0x7ff
ja 0x117d3d9
movzx eax, word [edi]
push ebx
push eax
call fcn.01171d60
test al, al
je 0x117d33a
add esi, 6
cmp dword [ebp + 0x10], esi
jbe 0x117d36e
mov esi, dword [ebp + 0xc]
mov ebx, dword [sym.imp.msvcrt.dll_wcsncpy]
push 4
push 0x1015894
push esi
call ebx
push 2
lea ecx, [ebp - 0x1000]
push ecx
lea edx, [esi + 8]
push edx
call ebx
add esp, 0x18
sub esi, edi
mov eax, edi
lea edx, [esi + 0xc]
lea ebx, [ebx]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x117d320
pop ebx
pop esi
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret 0xc
push 0x800
lea eax, [ebp - 0x1000]
push eax
call fcn.01171d90
lea eax, [ebp - 0x1000]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x117d354
mov ebx, dword [ebp + 0x10]
sub eax, edx
sar eax, 1
lea ecx, [eax + esi + 4]
cmp ebx, ecx
ja 0x117d379
pop ebx
pop esi
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 0xc
mov esi, dword [ebp + 0xc]
push 4
push 0x1015894
push esi
call dword [sym.imp.msvcrt.dll_wcsncpy]
lea eax, [ebp - 0x1000]
mov edx, esi
mov ecx, eax
sub edx, ecx
add esp, 0xc
add edx, 8
lea esp, [esp]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x117d3a0
cmp word [edi], 0x2e
jne 0x117d3c6
movzx edx, word [edi + 2]
push edx
call fcn.01171d60
test al, al
je 0x117d3c6
add edi, 4
push ebx
push edi
push esi
call fcn.01172560
pop ebx
pop esi
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret 0xc
pop esi
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 0xc