joyce8/EMBER2024-capa huggingface dataset:
Function at 0x11643c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi]
push edi
lea eax, [ebp - 4]
push eax
push ecx
mov dword [ebp - 4], 0
call fcn.0102bfa0
mov edi, eax
test edi, edi
je 0x11643ff
mov edx, dword [ebp - 4]
push edi
push edx
push esi
call fcn.0106a890
push edi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
push esi
call fcn.0106a970
cmp dword [esi + 0x4c], 0
je 0x1164440
push 0x100f728
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1164426
push 0x2710
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov eax, dword [esi + 8]
xor ecx, ecx
cmp dword [esi + 0x50], ecx
push eax
sete cl
push ecx
call fcn.01159aa0
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x100f73c
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x116445b
push 0x2710
call dword [sym.imp.KERNEL32.DLL_Sleep]
push esi
call fcn.01163550
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x1164470
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x6c8
push 0x6c8
lea eax, [ebp - 0x6c8]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x20d
push 8
mov dword [ebp - 0x254], 2
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov dword [ebp - 0x268], eax
test eax, eax
je 0x11644e6
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x6c8]
push edx
mov dword [ebp - 0x6c8], eax
mov dword [ebp - 0x6c4], ecx
call fcn.011643c0
mov eax, dword [ebp - 0x268]
push eax
call fcn.0103c5c0
mov ecx, dword [ebp - 0x254]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1164f30
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 0x1ddc]
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
mov dword [ebp - 0xc], edx
mov edx, dword [eax + 0x1e54]
mov eax, dword [eax + 0x1e58]
push 1
add ecx, 0x29170
push ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
call edi
test eax, eax
jne 0x1164fbe
mov edx, dword [esi]
push 3
lea ecx, [ebp - 0xc]
push ecx
push eax
mov eax, dword [edx]
mov ecx, dword [eax + 0x1ddc]
push 0x107ca80
push ecx
push 0x1c
push 0x17
push 0
push 0x1c
push 0x50a47e
push 0x73b69a
push esi
call fcn.0112b8c0
push esi
call fcn.010e45c0
push esi
call fcn.01131990
push esi
call fcn.011645f0
push esi
call fcn.0111a430
push esi
call fcn.010afc90
mov edx, dword [esi]
push 0
add edx, 0x2915c
push edx
call edi
test eax, eax
jne 0x1165000
mov eax, dword [esi]
test byte [eax + 0x2d438], 2
je 0x1165000
mov edi, dword [esi + 4]
lea ecx, [ebp + 8]
push ecx
push 0
push eax
push 0x10de990
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x1165000
mov edx, dword [edi + 0x1c0]
push eax
call edx
push 1
push 0
push 0x1c
push esi
call fcn.0105ce00
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x1165210
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [0x118366c], 0
jne 0x1165223
call fcn.01165170
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
test esi, esi
jbe 0x116524f
test dl, 7
je 0x116524f
movzx ecx, byte [edx]
movzx edi, al
xor ecx, edi
shr eax, 8
xor eax, dword [ecx*4 + 0x1183668]
dec esi
inc edx
test esi, esi
ja 0x1165232
cmp esi, 8
jb 0x11652dc
mov edi, esi
shr edi, 3
lea ecx, [ecx]
xor eax, dword [edx]
add edx, 8
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1183668]
sub esi, 8
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1183668]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1183668]
mov ecx, eax
movzx eax, cl
mov eax, dword [eax*4 + 0x1183668]
xor eax, dword [edx - 4]
shr ecx, 8
xor eax, ecx
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1183668]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1183668]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1183668]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1183668]
sub edi, 1
jne 0x1165260
xor ecx, ecx
test esi, esi
jbe 0x11652fc
push ebx
movzx edi, byte [ecx + edx]
movzx ebx, al
xor edi, ebx
shr eax, 8
xor eax, dword [edi*4 + 0x1183668]
inc ecx
cmp ecx, esi
jb 0x11652e3
pop ebx
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x1168830
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
cmp byte [esi + 0x16], 0
push edi
mov dword [esi + 0xc18], 0
mov al, 1
jne 0x116884f
mov al, byte [ebp + 0x10]
cmp byte [ebp + 0x14], 0
mov dword [ebp + 0x10], connect
je 0x1168863
mov dword [ebp + 0x10], 0xc0000000
mov ebx, 1
test al, al
je 0x1168871
mov ebx, 3
xor eax, eax
cmp byte [esi + 0x15], al
setne al
dec eax
and eax, 0x8000000
mov edi, eax
call fcn.01165630
test eax, eax
je 0x11688ac
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x11688ac
cmp word [eax], 0
je 0x11688ac
mov ecx, dword [ebp + 0x10]
push 0
push edi
push 3
push 0
push ebx
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
jmp 0x11688c2
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
push 0
push edi
push 3
push 0
push ebx
push edx
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x11688de
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 2
jne 0x11688de
mov dword [esi + 0xc18], 1
cmp edi, 0xffffffff
setne al
mov byte [esi + 0x12], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
mov byte [ebp + 0x13], al
test al, al
je 0x1168995
mov ebx, dword [sym.imp.msvcrt.dll_memmove]
mov dword [esi + 4], edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x1168936
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1168913
sub eax, edx
sar eax, 1
lea ecx, [eax + eax + 2]
push ecx
lea edx, [esi + 0x418]
push edi
push edx
call ebx
add esp, 0xc
jmp 0x116893f
xor eax, eax
mov word [esi + 0x418], ax
mov eax, dword [ebp + 8]
test eax, eax
je 0x116896a
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1168950
mov ecx, dword [ebp + 8]
sub eax, edx
inc eax
push eax
push ecx
lea edx, [esi + 0x17]
push edx
call ebx
add esp, 0xc
jmp 0x1168987
push 0
push 0
push 0x1000000
lea eax, [esi + 0x17]
push eax
push 0xffffffffffffffff
push edi
push 0
push 0
mov byte [eax], 0
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
mov eax, dword [esi + 4]
push eax
mov ecx, esi
call fcn.011655c0
mov al, byte [ebp + 0x13]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x1168b70
Capabilities:
Delete file

Disassembly:
mov edi, edi
push esi
mov esi, ecx
cmp dword [esi + 0xc], 0
je 0x1168b7f
xor al, al
pop esi
ret
cmp dword [esi + 4], 0xffffffff
je 0x1168b8a
call fcn.01168ae0
cmp byte [esi + 0x13], 0
je 0x1168b7b
lea eax, [esi + 0x17]
test eax, eax
je 0x1168bac
push eax
call dword [sym.imp.msvcrt.dll_remove]
add esp, 4
test eax, eax
jne 0x1168bac
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x1168bc0
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0xc], 1
push edi
mov edi, dword [ebp + 0xc]
jne 0x1168beb
cmp edi, 0x4e20
jbe 0x1168be0
mov edi, 0x4e20
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
mov dword [esi + 4], eax
mov ebx, dword [ebp + 8]
mov ecx, dword [esi + 4]
push 0
lea eax, [ebp + 0xc]
push eax
push edi
push ebx
push ecx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x1168c5d
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x1168c39
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileType]
cmp eax, 2
je 0x1168c1d
cmp eax, 3
jne 0x1168c39
cmp edi, 0x4e20
jbe 0x1168c39
push 0x4e20
push ebx
mov ecx, esi
call fcn.01168bc0
pop edi
pop esi
pop ebx
pop ebp
ret 8
cmp dword [esi + 0xc], 1
jne 0x1168c53
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x6d
jne 0x1168c53
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8
pop edi
pop esi
or eax, 0xffffffff
pop ebx
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x1168de0
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
call fcn.01165630
test eax, eax
je 0x1168e0f
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x1168e0f
cmp word [eax], 0
je 0x1168e0f
mov ecx, dword [ebp + 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
test eax, eax
setne al
pop ebp
ret 0xc
mov eax, dword [ebp + 8]
test eax, eax
je 0x1168e2a
mov edx, dword [ebp + 0x10]
push edx
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
test eax, eax
setne al
pop ebp
ret 0xc
xor al, al
pop ebp
ret 0xc

Function at 0x116b470
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x10]
push edi
push eax
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov ecx, dword [esi + 0x10]
push ecx
mov byte [esi + 8], 1
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
lea edx, [ebp - 4]
push edx
push 0
push esi
push fcn.011681a0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov edi, eax
test edi, edi
jne 0x116b4c1
push esi
call fcn.011681a0
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x3e8
push edi
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x116c9a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
sub esp, 0xc00
push ebx
push esi
test edx, edx
je 0x116c9d0
mov eax, edx
lea esi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x116c9c0
sub eax, esi
cmp eax, 0x3f6
ja 0x116c9f6
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x116ca00
mov eax, ebx
lea esi, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x116c9e0
sub eax, esi
sar eax, 1
cmp eax, 0x3f6
jbe 0x116ca00
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [ebp + 0xc], 0
test edx, edx
je 0x116ca3a
cmp byte [edx], 0
je 0x116ca3a
push edx
call fcn.01169220
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x116ca37
mov esi, dword [ebp + 8]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x116ca25
sub eax, edx
add eax, esi
mov dword [ebp + 0xc], eax
mov edx, esi
jmp 0x116ca3a
mov edx, dword [ebp + 8]
push edi
xor edi, edi
test ebx, ebx
je 0x116ca78
cmp word [ebx], di
je 0x116ca78
push 0x2e
push ebx
call fcn.01168ee0
push eax
call dword [sym.imp.msvcrt.dll_wcsrchr]
mov edi, eax
add esp, 8
test edi, edi
jne 0x116ca75
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x116ca63
sub eax, edx
sar eax, 1
lea edi, [ebx + eax*2]
mov edx, dword [ebp + 8]
xor eax, eax
mov byte [ebp - 0x400], 0
mov word [ebp - 0xc00], ax
lea esi, [eax + 1]
jmp 0x116ca90
test edx, edx
je 0x116cab7
cmp byte [edx], 0
je 0x116cab7
mov eax, dword [ebp + 0xc]
push eax
push esi
push edx
sub eax, edx
push eax
lea ecx, [ebp - 0x400]
push 0x10242b0
push ecx
call dword [sym.imp.msvcrt.dll_sprintf]
add esp, 0x18
test ebx, ebx
je 0x116cae5
cmp word [ebx], 0
je 0x116cae5
push edi
push esi
mov edx, edi
push ebx
sub edx, ebx
sar edx, 1
push edx
push 0x1024298
lea eax, [ebp - 0xc00]
push 0x400
push eax
call dword [sym.imp.msvcrt.dll__snwprintf]
add esp, 0x1c
call fcn.01165630
test eax, eax
je 0x116cb20
cmp word [ebp - 0xc00], 0
je 0x116cb20
lea ecx, [ebp - 0xc00]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
test al, al
je 0x116cb32
cmp esi, 0xf4240
jge 0x116cb8a
mov edx, dword [ebp + 8]
inc esi
jmp 0x116ca90
lea edx, [ebp - 0x400]
push edx
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
jmp 0x116cb0d
mov edx, dword [ebp + 8]
test edx, edx
je 0x116cb52
cmp byte [edx], 0
je 0x116cb52
lea eax, [ebp - 0x400]
mov ecx, eax
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x116cb48
test ebx, ebx
je 0x116cb7f
cmp word [ebx], 0
je 0x116cb7f
lea eax, [ebp - 0xc00]
mov edx, ebx
mov ecx, eax
sub edx, ecx
jmp 0x116cb70
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x116cb70
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x116cba0
Capabilities:
Delete file

Disassembly:
cmp dword [ecx + 4], 0xffffffff
mov dword [ecx], 0x10227e8
je 0x116cbc2
cmp byte [ecx + 0x10], 0
jne 0x116cbc2
cmp byte [ecx + 0x12], 0
je 0x116cbbd
jmp fcn.01168b70
jmp fcn.01168ae0
ret
Function at 0x116cc50
Capabilities:
Create directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x400
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x116cd62
cmp byte [ebx], 0
je 0x116cd62
push esi
push edi
mov byte [ebp + 0xb], 1
mov edi, ebx
xor esi, esi
lea ebx, [ebx]
cmp esi, 0x400
jge 0x116cd0d
cmp byte [edi], 0x5c
jne 0x116ccdf
push esi
lea eax, [ebp - 0x400]
push ebx
push eax
call dword [sym.imp.msvcrt.dll_strncpy]
add esp, 0xc
mov byte [ebp + esi - 0x400], 0
call fcn.01165630
push 0
lea ecx, [ebp - 0x400]
push ecx
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
test eax, eax
je 0x116ccd5
push 0
push 0
lea edx, [ebp - 0x400]
push edx
call fcn.01168de0
jmp 0x116ccdf
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov byte [ebp + 0xb], 0
cmp byte [0x1183b78], 0
je 0x116cd02
movzx eax, byte [edi]
cmp byte [eax + 0x1183a78], 0
je 0x116cd02
cmp byte [edi + 1], 0
je 0x116cd02
add edi, 2
add esi, 2
jmp 0x116cd04
inc edi
inc esi
cmp byte [edi], 0
jne 0x116cc80
cmp byte [ebp + 0xc], 0
pop edi
pop esi
jne 0x116cd58
push ebx
call fcn.01168f40
movsx eax, byte [eax]
cmp eax, 0x5c
je 0x116cd58
cmp eax, 0x2f
je 0x116cd58
call fcn.01165630
push 0
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
test eax, eax
je 0x116cd4e
push 0
push 0
push ebx
call fcn.01168de0
mov al, byte [ebp + 0xb]
pop ebx
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov byte [ebp + 0xb], 0
mov al, byte [ebp + 0xb]
pop ebx
mov esp, ebp
pop ebp
ret 8
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x116cd70
Capabilities:
Create directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc00
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x116cec8
cmp word [ebx], 0
je 0x116cec8
push esi
push edi
mov byte [ebp + 0xb], 1
xor edi, edi
lea esp, [esp]
mov esi, edi
sar esi, 1
cmp esi, 0x400
jge 0x116ce51
cmp word [edi + ebx], 0x5c
jne 0x116ce43
push esi
lea eax, [ebp - 0x800]
push ebx
push eax
call dword [sym.imp.msvcrt.dll_wcsncpy]
xor ecx, ecx
add esp, 0xc
mov word [ebp + esi*2 - 0x800], cx
call fcn.01165630
test eax, eax
je 0x116ce3f
cmp word [ebp - 0x800], 0
je 0x116ce3f
push 0
lea edx, [ebp - 0x800]
push edx
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
test eax, eax
je 0x116ce39
push 0
lea eax, [ebp - 0x800]
push eax
push 0
call fcn.01168de0
push 0
push 0
push 0x400
lea ecx, [ebp - 0xc00]
push ecx
push 0xffffffffffffffff
lea edx, [ebp - 0x800]
push edx
push 0
push 0
mov byte [ebp - 0xc00], 0
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
jmp 0x116ce43
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov byte [ebp + 0xb], 0
add edi, 2
cmp word [edi + ebx], 0
jne 0x116cda0
cmp byte [ebp + 0xc], 0
pop edi
pop esi
jne 0x116cebe
mov eax, ebx
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x116ce60
sub eax, edx
sar eax, 1
lea eax, [ebx + eax*2 - 2]
jne 0x116ce77
mov eax, ebx
movzx eax, word [eax]
cmp eax, 0x5c
je 0x116cebe
cmp eax, 0x2f
je 0x116cebe
call fcn.01165630
test eax, eax
je 0x116ceba
cmp word [ebx], 0
je 0x116ceba
push 0
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
test eax, eax
je 0x116ceb4
push 0
push ebx
push 0
call fcn.01168de0
mov al, byte [ebp + 0xb]
pop ebx
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov byte [ebp + 0xb], 0
mov al, byte [ebp + 0xb]
pop ebx
mov esp, ebp
pop ebp
ret 8
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1171190
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebx
mov ebx, dword [sym.imp.msvcrt.dll_free]
push esi
mov esi, ecx
mov eax, dword [esi + 0x68b8]
push edi
test eax, eax
je 0x11711ad
push eax
call ebx
add esp, 4
mov eax, dword [esi + 0x5ba8]
test eax, eax
je 0x11711bd
push eax
call ebx
add esp, 4
push 0x42d8
lea edi, [esi + 0xc28]
push 0
push edi
call sub.msvcrt.dll_memset
mov edi, dword [edi + 0x2d58]
add esp, 0xc
test edi, edi
je 0x11711e3
push edi
call ebx
add esp, 4
cmp dword [esi + 4], 0xffffffff
mov dword [esi], 0x10227e8
je 0x117120a
cmp byte [esi + 0x10], 0
jne 0x117120a
cmp byte [esi + 0x12], 0
pop edi
mov ecx, esi
pop esi
pop ebx
je 0x1171205
jmp fcn.01168b70
jmp fcn.01168ae0
pop edi
pop esi
pop ebx
ret
Function at 0x1172920
Capabilities:
Check if file exists
Get file attributes
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x30c0
call fcn.01178910
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push esi
lea eax, [ebp - 0x30c0]
push eax
push edi
push esi
mov dword [ebp - 0x24ac], esi
mov dword [ebp - 0x2488], esi
mov dword [ebp - 0x2464], esi
call fcn.01171570
test al, al
jne 0x1172965
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
cmp word [ebp - 0x2440], si
je 0x117295b
lea ecx, [ebp - 0x2440]
push ecx
lea edx, [ebp - 0x2cc0]
push edx
call fcn.01168ee0
push eax
call fcn.0116a280
test eax, eax
je 0x117295b
lea eax, [ebp - 0x2440]
push eax
push edi
call fcn.01168ee0
push eax
call fcn.0116a280
test eax, eax
jne 0x117295b
push ebx
mov ebx, dword [sym.imp.msvcrt.dll_wcsncpy]
mov word [ebp - 0x800], ax
test ax, ax
jne 0x1172a44
push 0x3ff
lea ecx, [ebp - 0x800]
push edi
push ecx
call ebx
add esp, 0xc
push esi
push 0x10266d0
push 0x400
lea eax, [ebp - 0x800]
xor edx, edx
push eax
mov word [ebp - 2], dx
call fcn.01168ee0
push eax
call dword [sym.imp.msvcrt.dll__snwprintf]
add esp, 0x10
call fcn.01165630
test eax, eax
je 0x1172a29
mov ax, word [ebp - 0x800]
test ax, ax
je 0x1172a30
lea ecx, [ebp - 0x800]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
test al, al
je 0x1172a29
xor eax, eax
mov word [ebp - 0x800], ax
jmp 0x1172a30
mov ax, word [ebp - 0x800]
add esi, 0x7b
cmp esi, 0x2710
jl 0x11729b0
test ax, ax
je 0x1172aab
push 0x3ff
lea edx, [ebp - 0x1c20]
push edi
push edx
call ebx
add esp, 0xc
lea ecx, [ebp - 0x2cc0]
xor eax, eax
push ecx
mov word [ebp - 0x1422], ax
call fcn.01168ee0
lea edx, [ebp - 0x1c20]
push edx
mov esi, eax
call fcn.01168ee0
lea esp, [esp]
movzx ecx, word [esi]
mov word [eax], cx
add esi, 2
add eax, 2
test cx, cx
jne 0x1172a80
mov esi, dword [sym.imp.KERNEL32.DLL_MoveFileW]
lea eax, [ebp - 0x800]
push eax
lea ecx, [ebp - 0x1c20]
push ecx
call esi
test eax, eax
jne 0x1172ab6
pop ebx
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 0x1420]
call fcn.01165570
xor bl, bl
call fcn.01165630
test eax, eax
je 0x1172ae7
test edi, edi
je 0x1172ae7
cmp word [edi], 0
je 0x1172ae7
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
test al, al
jne 0x1172af9
push 1
push edi
push 0
lea ecx, [ebp - 0x1420]
call fcn.011689b0
mov bl, al
lea edx, [ebp - 0x1c20]
push edx
lea eax, [ebp - 0x800]
push eax
call esi
test bl, bl
je 0x1172b23
lea ecx, [ebp - 0x1420]
call fcn.01168ae0
lea ecx, [ebp - 0x1420]
call fcn.01168b70
cmp dword [ebp - 0x141c], 0xffffffff
mov dword [ebp - 0x1420], 0x10227e8
je 0x1172b63
cmp byte [ebp - 0x1410], 0
jne 0x1172b63
cmp byte [ebp - 0x140e], 0
lea ecx, [ebp - 0x1420]
je 0x1172b5e
call fcn.01168b70
pop ebx
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 4
call fcn.01168ae0
pop ebx
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x1173570
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
xor esi, esi
push edi
mov edi, ecx
cmp ebx, esi
je 0x1173644
mov eax, dword [edi + 0xc]
cmp eax, esi
je 0x11735a8
sub eax, 1
je 0x117359d
sub eax, 1
jne 0x11735a8
push 0xfffffffffffffff4
jmp 0x117359f
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
mov dword [edi + 4], eax
mov dword [ebp - 4], esi
cmp dword [edi + 0xc], esi
je 0x11735fd
cmp ebx, esi
jbe 0x117361b
mov ebx, dword [ebp + 8]
jmp 0x11735c0
mov eax, dword [ebp + 0xc]
sub eax, esi
cmp eax, 0x4000
jb 0x11735d1
mov eax, 0x4000
push 0
lea ecx, [ebp - 4]
push ecx
push eax
mov eax, dword [edi + 4]
lea edx, [esi + ebx]
push edx
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
cmp eax, 1
sete al
test al, al
je 0x117361b
add esi, 0x4000
cmp esi, dword [ebp + 0xc]
jb 0x11735c0
jmp 0x1173617
mov edx, dword [ebp + 8]
mov eax, dword [edi + 4]
push esi
lea ecx, [ebp - 4]
push ecx
push ebx
push edx
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
cmp eax, 1
sete al
test al, al
jne 0x1173640
cmp byte [edi + 0x14], 0
je 0x1173640
cmp dword [edi + 0xc], 0
jne 0x1173640
lea ecx, [edi + 0x418]
push ecx
add edi, 0x17
push edi
push 0
push 0
mov ecx, 0x1182db0
call fcn.011687c0
mov byte [edi + 8], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8