joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1167190
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test dword [esi + 0x2b660], 0x400
je 0x11671cd
cmp dword [esi + 0x14], 0
jne 0x11671cd
mov eax, dword [esi]
mov eax, dword [eax + 0x131c]
push 0x2030
push 0x100f60c
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
pop esi
pop ebp
ret 4
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov ecx, dword [esi + 0x2d47c]
add ecx, 0xea60
cmp eax, ecx
jbe 0x116720d
mov edx, dword [esi + 8]
push edi
mov edi, dword [edx]
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x114ce20
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x116720c
mov ecx, dword [edi + 0x1c0]
push eax
call ecx
pop edi
push esi
call fcn.01166e00
xor eax, eax
pop esi
pop ebp
ret 4

Function at 0x1167290
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [esi + 0x2d3c8], 0x1c
test eax, eax
je 0x11672cd
push eax
call fcn.010d24e0
cmp dword [esi + 0x2d2d0], 0
je 0x11672cd
mov edi, dword [sym.imp.KERNEL32.DLL_Sleep]
push 0xa
call edi
cmp dword [esi + 0x2d2d0], 0
jne 0x11672c0
push 0
lea eax, [esi + 0x2d470]
push eax
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
cmp dword [esi + 0x240e4], 0
jne 0x116730d
mov ecx, dword [esi + 8]
mov edi, dword [ecx]
lea edx, [ebp + 8]
push edx
push 0
push esi
push fcn.01167220
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x116730d
push eax
mov eax, dword [edi + 0x1c0]
call eax
pop edi
pop esi
pop ebp
ret 8
Function at 0x1167f60
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 4], edi
cmp ecx, edi
je 0x116809d
mov eax, ecx
cmp word [ecx], di
je 0x1167f8b
add eax, 2
cmp word [eax], di
jne 0x1167f83
sub eax, ecx
sar eax, 1
cmp eax, 4
jbe 0x116809d
mov ebx, dword [ebp + 0x10]
cmp ebx, edi
je 0x116809d
mov eax, ebx
cmp word [ebx], di
je 0x1167fb8
lea ebx, [ebx]
add eax, 2
cmp word [eax], di
jne 0x1167fb0
sub eax, ebx
sar eax, 1
cmp eax, 4
jbe 0x116809d
mov eax, dword [esi]
lea edx, [ebp + 8]
push edx
push edi
push esi
push 0x10fe860
mov dword [eax + 0x26800], edi
mov ecx, dword [esi]
push edi
push edi
mov dword [ecx + 0x26804], edi
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov edi, eax
test edi, edi
je 0x116803e
cmp edi, 0xffffffff
je 0x116803e
mov eax, dword [esi]
push ebx
mov ebx, dword [ebp + 0xc]
push ebx
push eax
call fcn.010dfbf0
mov ecx, dword [esi]
test eax, eax
je 0x1168020
mov edx, dword [ecx + 8]
push ebx
push 0x15
push edx
call fcn.010da8a0
mov eax, dword [esi]
mov dword [eax + 0x26800], 1
jmp 0x116802e
mov eax, 1
mov dword [ecx + 0x26804], eax
mov dword [ebp - 4], eax
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [esi]
cmp dword [eax + 0x26800], 0
je 0x1168095
cmp dword [eax + 0x26808], 0
jne 0x116805f
mov edx, dword [eax + 8]
push 0
push 0x12
push edx
call fcn.010da690
mov eax, dword [esi]
mov ecx, dword [eax + 8]
push 0x20
push ecx
call fcn.010da610
test eax, eax
jne 0x116808d
mov edx, dword [esi]
mov eax, dword [edx + 8]
push 1
push 0x20
push eax
call fcn.010da690
push 4
push 0
push 0x1b
push esi
call fcn.0105e320
jmp 0x1168095
push 0
push esi
call fcn.01167350
cmp dword [ebp - 4], 0
je 0x11680e8
xor edi, edi
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 0xca4]
push 0x2030
push 0x100f60c
push eax
mov eax, dword [esi + 0xc]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [esi]
mov eax, dword [ecx + 0x25f4c]
mov ebx, dword [sym.imp.USER32.dll_SetWindowTextW]
cmp eax, edi
je 0x11680d5
mov edx, dword [eax + 0x1c]
push edi
push edx
call ebx
mov eax, dword [esi]
mov eax, dword [eax + 0x25f50]
cmp eax, edi
je 0x11680e8
mov ecx, dword [eax + 0x1c]
push edi
push ecx
call ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1168d10
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi]
push edi
lea eax, [ebp - 4]
push eax
push ecx
mov dword [ebp - 4], 0
call fcn.0102d580
mov edi, eax
test edi, edi
je 0x1168d4f
mov edx, dword [ebp - 4]
push edi
push edx
push esi
call fcn.0106bde0
push edi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
push esi
call fcn.0106c0b0
cmp dword [esi + 0x4c], 0
je 0x1168d90
push 0x100f5dc
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1168d76
push 0x2710
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov eax, dword [esi + 8]
xor ecx, ecx
cmp dword [esi + 0x50], ecx
push eax
sete cl
push ecx
call fcn.0115e330
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x100f5f0
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1168dab
push 0x2710
call dword [sym.imp.KERNEL32.DLL_Sleep]
push esi
call fcn.01167ea0
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x1168dc0
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x6d4
push 0x106bf60
push 0
call dword [sym.imp.KERNEL32.DLL_AddVectoredExceptionHandler]
push 0x6d4
lea eax, [ebp - 0x6d4]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x20d
push 8
mov dword [ebp - 0x264], 2
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov dword [ebp - 0x278], eax
test eax, eax
je 0x1168e43
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x6d4]
push edx
mov dword [ebp - 0x6d4], eax
mov dword [ebp - 0x6d0], ecx
call fcn.01168d10
mov eax, dword [ebp - 0x278]
push eax
call fcn.0103dbc0
mov ecx, dword [ebp - 0x264]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1169890
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 0x1ddc]
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
mov dword [ebp - 0xc], edx
mov edx, dword [eax + 0x1e54]
mov eax, dword [eax + 0x1e58]
push 1
add ecx, 0x29170
push ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
call edi
test eax, eax
jne 0x116991e
mov edx, dword [esi]
push 3
lea ecx, [ebp - 0xc]
push ecx
push eax
mov eax, dword [edx]
mov ecx, dword [eax + 0x1ddc]
push 0x107e1c0
push ecx
push 0x1c
push 0x17
push 0
push 0x1c
push 0x50a47e
push 0x73b69a
push esi
call fcn.0112f440
push esi
call fcn.010e76c0
push esi
call fcn.01135540
push esi
call fcn.01168f50
push esi
call fcn.0111df70
push esi
call fcn.010b1fa0
mov edx, dword [esi]
push 0
add edx, 0x2915c
push edx
call edi
test eax, eax
jne 0x1169960
mov eax, dword [esi]
test byte [eax + 0x2d438], 2
je 0x1169960
mov edi, dword [esi + 4]
lea ecx, [ebp + 8]
push ecx
push 0
push eax
push 0x10e1ab0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x1169960
mov edx, dword [edi + 0x1c0]
push eax
call edx
push 1
push 0
push 0x1c
push esi
call fcn.0105e320
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x1169b70
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [0x118a6bc], 0
jne 0x1169b83
call fcn.01169ad0
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
test esi, esi
jbe 0x1169baf
test dl, 7
je 0x1169baf
movzx ecx, byte [edx]
movzx edi, al
xor ecx, edi
shr eax, 8
xor eax, dword [ecx*4 + 0x118a6b8]
dec esi
inc edx
test esi, esi
ja 0x1169b92
cmp esi, 8
jb 0x1169c3c
mov edi, esi
shr edi, 3
lea ecx, [ecx]
xor eax, dword [edx]
add edx, 8
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x118a6b8]
sub esi, 8
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x118a6b8]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x118a6b8]
mov ecx, eax
movzx eax, cl
mov eax, dword [eax*4 + 0x118a6b8]
xor eax, dword [edx - 4]
shr ecx, 8
xor eax, ecx
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x118a6b8]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x118a6b8]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x118a6b8]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x118a6b8]
sub edi, 1
jne 0x1169bc0
xor ecx, ecx
test esi, esi
jbe 0x1169c5c
push ebx
movzx edi, byte [ecx + edx]
movzx ebx, al
xor edi, ebx
shr eax, 8
xor eax, dword [edi*4 + 0x118a6b8]
inc ecx
cmp ecx, esi
jb 0x1169c43
pop ebx
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x116d290
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
cmp byte [esi + 0x16], 0
push edi
mov dword [esi + 0xc18], 0
mov al, 1
jne 0x116d2af
mov al, byte [ebp + 0x10]
cmp byte [ebp + 0x14], 0
mov dword [ebp + 0x10], connect
je 0x116d2c3
mov dword [ebp + 0x10], 0xc0000000
mov ebx, 1
test al, al
je 0x116d2d1
mov ebx, 3
xor eax, eax
cmp byte [esi + 0x15], al
setne al
dec eax
and eax, 0x8000000
mov edi, eax
call fcn.01169f90
test eax, eax
je 0x116d30c
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x116d30c
cmp word [eax], 0
je 0x116d30c
mov ecx, dword [ebp + 0x10]
push 0
push edi
push 3
push 0
push ebx
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
jmp 0x116d322
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
push 0
push edi
push 3
push 0
push ebx
push edx
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x116d33e
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 2
jne 0x116d33e
mov dword [esi + 0xc18], 1
cmp edi, 0xffffffff
setne al
mov byte [esi + 0x12], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
mov byte [ebp + 0x13], al
test al, al
je 0x116d3f5
mov ebx, dword [sym.imp.msvcrt.dll_memmove]
mov dword [esi + 4], edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x116d396
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x116d373
sub eax, edx
sar eax, 1
lea ecx, [eax + eax + 2]
push ecx
lea edx, [esi + 0x418]
push edi
push edx
call ebx
add esp, 0xc
jmp 0x116d39f
xor eax, eax
mov word [esi + 0x418], ax
mov eax, dword [ebp + 8]
test eax, eax
je 0x116d3ca
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x116d3b0
mov ecx, dword [ebp + 8]
sub eax, edx
inc eax
push eax
push ecx
lea edx, [esi + 0x17]
push edx
call ebx
add esp, 0xc
jmp 0x116d3e7
push 0
push 0
push 0x1000000
lea eax, [esi + 0x17]
push eax
push 0xffffffffffffffff
push edi
push 0
push 0
mov byte [eax], 0
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
mov eax, dword [esi + 4]
push eax
mov ecx, esi
call fcn.01169f20
mov al, byte [ebp + 0x13]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x116d5d0
Capabilities:
Delete file

Disassembly:
mov edi, edi
push esi
mov esi, ecx
cmp dword [esi + 0xc], 0
je 0x116d5df
xor al, al
pop esi
ret
cmp dword [esi + 4], 0xffffffff
je 0x116d5ea
call fcn.0116d540
cmp byte [esi + 0x13], 0
je 0x116d5db
lea eax, [esi + 0x17]
test eax, eax
je 0x116d60c
push eax
call dword [sym.imp.msvcrt.dll_remove]
add esp, 4
test eax, eax
jne 0x116d60c
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x116d620
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0xc], 1
push edi
mov edi, dword [ebp + 0xc]
jne 0x116d64b
cmp edi, 0x4e20
jbe 0x116d640
mov edi, 0x4e20
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
mov dword [esi + 4], eax
mov ebx, dword [ebp + 8]
mov ecx, dword [esi + 4]
push 0
lea eax, [ebp + 0xc]
push eax
push edi
push ebx
push ecx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x116d6bd
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x116d699
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileType]
cmp eax, 2
je 0x116d67d
cmp eax, 3
jne 0x116d699
cmp edi, 0x4e20
jbe 0x116d699
push 0x4e20
push ebx
mov ecx, esi
call fcn.0116d620
pop edi
pop esi
pop ebx
pop ebp
ret 8
cmp dword [esi + 0xc], 1
jne 0x116d6b3
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x6d
jne 0x116d6b3
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8
pop edi
pop esi
or eax, 0xffffffff
pop ebx
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x116d840
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
call fcn.01169f90
test eax, eax
je 0x116d86f
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x116d86f
cmp word [eax], 0
je 0x116d86f
mov ecx, dword [ebp + 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
test eax, eax
setne al
pop ebp
ret 0xc
mov eax, dword [ebp + 8]
test eax, eax
je 0x116d88a
mov edx, dword [ebp + 0x10]
push edx
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
test eax, eax
setne al
pop ebp
ret 0xc
xor al, al
pop ebp
ret 0xc

Function at 0x116fdd0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x10]
push edi
push eax
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov ecx, dword [esi + 0x10]
push ecx
mov byte [esi + 8], 1
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
lea edx, [ebp - 4]
push edx
push 0
push esi
push fcn.0116cc00
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov edi, eax
test edi, edi
jne 0x116fe21
push esi
call fcn.0116cc00
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x3e8
push edi
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1171f50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
sub esp, 0xc00
push ebx
push esi
test edx, edx
je 0x1171f80
mov eax, edx
lea esi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1171f70
sub eax, esi
cmp eax, 0x3f6
ja 0x1171fa6
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x1171fb0
mov eax, ebx
lea esi, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1171f90
sub eax, esi
sar eax, 1
cmp eax, 0x3f6
jbe 0x1171fb0
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [ebp + 0xc], 0
test edx, edx
je 0x1171fea
cmp byte [edx], 0
je 0x1171fea
push edx
call fcn.0116dc80
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x1171fe7
mov esi, dword [ebp + 8]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1171fd5
sub eax, edx
add eax, esi
mov dword [ebp + 0xc], eax
mov edx, esi
jmp 0x1171fea
mov edx, dword [ebp + 8]
push edi
xor edi, edi
test ebx, ebx
je 0x1172028
cmp word [ebx], di
je 0x1172028
push 0x2e
push ebx
call fcn.0116d940
push eax
call dword [sym.imp.msvcrt.dll_wcsrchr]
mov edi, eax
add esp, 8
test edi, edi
jne 0x1172025
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1172013
sub eax, edx
sar eax, 1
lea edi, [ebx + eax*2]
mov edx, dword [ebp + 8]
xor eax, eax
mov byte [ebp - 0x400], 0
mov word [ebp - 0xc00], ax
lea esi, [eax + 1]
jmp 0x1172040
test edx, edx
je 0x1172067
cmp byte [edx], 0
je 0x1172067
mov eax, dword [ebp + 0xc]
push eax
push esi
push edx
sub eax, edx
push eax
lea ecx, [ebp - 0x400]
push 0x1024ea4
push ecx
call dword [sym.imp.msvcrt.dll_sprintf]
add esp, 0x18
test ebx, ebx
je 0x1172095
cmp word [ebx], 0
je 0x1172095
push edi
push esi
mov edx, edi
push ebx
sub edx, ebx
sar edx, 1
push edx
push 0x1024e8c
lea eax, [ebp - 0xc00]
push 0x400
push eax
call dword [sym.imp.msvcrt.dll__snwprintf]
add esp, 0x1c
call fcn.01169f90
test eax, eax
je 0x11720d0
cmp word [ebp - 0xc00], 0
je 0x11720d0
lea ecx, [ebp - 0xc00]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
test al, al
je 0x11720e2
cmp esi, 0xf4240
jge 0x117213a
mov edx, dword [ebp + 8]
inc esi
jmp 0x1172040
lea edx, [ebp - 0x400]
push edx
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
jmp 0x11720bd
mov edx, dword [ebp + 8]
test edx, edx
je 0x1172102
cmp byte [edx], 0
je 0x1172102
lea eax, [ebp - 0x400]
mov ecx, eax
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x11720f8
test ebx, ebx
je 0x117212f
cmp word [ebx], 0
je 0x117212f
lea eax, [ebp - 0xc00]
mov edx, ebx
mov ecx, eax
sub edx, ecx
jmp 0x1172120
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x1172120
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x1172150
Capabilities:
Delete file

Disassembly:
cmp dword [ecx + 4], 0xffffffff
mov dword [ecx], 0x1022aa8
je 0x1172172
cmp byte [ecx + 0x10], 0
jne 0x1172172
cmp byte [ecx + 0x12], 0
je 0x117216d
jmp fcn.0116d5d0
jmp fcn.0116d540
ret
Function at 0x1172200
Capabilities:
Create directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x400
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x1172312
cmp byte [ebx], 0
je 0x1172312
push esi
push edi
mov byte [ebp + 0xb], 1
mov edi, ebx
xor esi, esi
lea ebx, [ebx]
cmp esi, 0x400
jge 0x11722bd
cmp byte [edi], 0x5c
jne 0x117228f
push esi
lea eax, [ebp - 0x400]
push ebx
push eax
call dword [sym.imp.msvcrt.dll_strncpy]
add esp, 0xc
mov byte [ebp + esi - 0x400], 0
call fcn.01169f90
push 0
lea ecx, [ebp - 0x400]
push ecx
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
test eax, eax
je 0x1172285
push 0
push 0
lea edx, [ebp - 0x400]
push edx
call fcn.0116d840
jmp 0x117228f
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov byte [ebp + 0xb], 0
cmp byte [0x118abc8], 0
je 0x11722b2
movzx eax, byte [edi]
cmp byte [eax + 0x118aac8], 0
je 0x11722b2
cmp byte [edi + 1], 0
je 0x11722b2
add edi, 2
add esi, 2
jmp 0x11722b4
inc edi
inc esi
cmp byte [edi], 0
jne 0x1172230
cmp byte [ebp + 0xc], 0
pop edi
pop esi
jne 0x1172308
push ebx
call fcn.0116d9a0
movsx eax, byte [eax]
cmp eax, 0x5c
je 0x1172308
cmp eax, 0x2f
je 0x1172308
call fcn.01169f90
push 0
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
test eax, eax
je 0x11722fe
push 0
push 0
push ebx
call fcn.0116d840
mov al, byte [ebp + 0xb]
pop ebx
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov byte [ebp + 0xb], 0
mov al, byte [ebp + 0xb]
pop ebx
mov esp, ebp
pop ebp
ret 8
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1172320
Capabilities:
Create directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc00
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x1172478
cmp word [ebx], 0
je 0x1172478
push esi
push edi
mov byte [ebp + 0xb], 1
xor edi, edi
lea esp, [esp]
mov esi, edi
sar esi, 1
cmp esi, 0x400
jge 0x1172401
cmp word [edi + ebx], 0x5c
jne 0x11723f3
push esi
lea eax, [ebp - 0x800]
push ebx
push eax
call dword [sym.imp.msvcrt.dll_wcsncpy]
xor ecx, ecx
add esp, 0xc
mov word [ebp + esi*2 - 0x800], cx
call fcn.01169f90
test eax, eax
je 0x11723ef
cmp word [ebp - 0x800], 0
je 0x11723ef
push 0
lea edx, [ebp - 0x800]
push edx
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
test eax, eax
je 0x11723e9
push 0
lea eax, [ebp - 0x800]
push eax
push 0
call fcn.0116d840
push 0
push 0
push 0x400
lea ecx, [ebp - 0xc00]
push ecx
push 0xffffffffffffffff
lea edx, [ebp - 0x800]
push edx
push 0
push 0
mov byte [ebp - 0xc00], 0
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
jmp 0x11723f3
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov byte [ebp + 0xb], 0
add edi, 2
cmp word [edi + ebx], 0
jne 0x1172350
cmp byte [ebp + 0xc], 0
pop edi
pop esi
jne 0x117246e
mov eax, ebx
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1172410
sub eax, edx
sar eax, 1
lea eax, [ebx + eax*2 - 2]
jne 0x1172427
mov eax, ebx
movzx eax, word [eax]
cmp eax, 0x5c
je 0x117246e
cmp eax, 0x2f
je 0x117246e
call fcn.01169f90
test eax, eax
je 0x117246a
cmp word [ebx], 0
je 0x117246a
push 0
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
test eax, eax
je 0x1172464
push 0
push ebx
push 0
call fcn.0116d840
mov al, byte [ebp + 0xb]
pop ebx
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov byte [ebp + 0xb], 0
mov al, byte [ebp + 0xb]
pop ebx
mov esp, ebp
pop ebp
ret 8
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x11774e0
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebx
mov ebx, dword [sym.imp.msvcrt.dll_free]
push esi
mov esi, ecx
mov eax, dword [esi + 0x68b8]
push edi
test eax, eax
je 0x11774fd
push eax
call ebx
add esp, 4
mov eax, dword [esi + 0x5ba8]
test eax, eax
je 0x117750d
push eax
call ebx
add esp, 4
push 0x42d8
lea edi, [esi + 0xc28]
push 0
push edi
call sub.msvcrt.dll_memset
mov edi, dword [edi + 0x2d58]
add esp, 0xc
test edi, edi
je 0x1177533
push edi
call ebx
add esp, 4
cmp dword [esi + 4], 0xffffffff
mov dword [esi], 0x1022aa8
je 0x117755a
cmp byte [esi + 0x10], 0
jne 0x117755a
cmp byte [esi + 0x12], 0
pop edi
mov ecx, esi
pop esi
pop ebx
je 0x1177555
jmp fcn.0116d5d0
jmp fcn.0116d540
pop edi
pop esi
pop ebx
ret
Function at 0x1178c70
Capabilities:
Check if file exists
Get file attributes
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x30c0
call fcn.0117ec90
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push esi
lea eax, [ebp - 0x30c0]
push eax
push edi
push esi
mov dword [ebp - 0x24ac], esi
mov dword [ebp - 0x2488], esi
mov dword [ebp - 0x2464], esi
call fcn.011778c0
test al, al
jne 0x1178cb5
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
cmp word [ebp - 0x2440], si
je 0x1178cab
lea ecx, [ebp - 0x2440]
push ecx
lea edx, [ebp - 0x2cc0]
push edx
call fcn.0116d940
push eax
call fcn.0116ecd0
test eax, eax
je 0x1178cab
lea eax, [ebp - 0x2440]
push eax
push edi
call fcn.0116d940
push eax
call fcn.0116ecd0
test eax, eax
jne 0x1178cab
push ebx
mov ebx, dword [sym.imp.msvcrt.dll_wcsncpy]
mov word [ebp - 0x800], ax
test ax, ax
jne 0x1178d94
push 0x3ff
lea ecx, [ebp - 0x800]
push edi
push ecx
call ebx
add esp, 0xc
push esi
push 0x1027c78
push 0x400
lea eax, [ebp - 0x800]
xor edx, edx
push eax
mov word [ebp - 2], dx
call fcn.0116d940
push eax
call dword [sym.imp.msvcrt.dll__snwprintf]
add esp, 0x10
call fcn.01169f90
test eax, eax
je 0x1178d79
mov ax, word [ebp - 0x800]
test ax, ax
je 0x1178d80
lea ecx, [ebp - 0x800]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
test al, al
je 0x1178d79
xor eax, eax
mov word [ebp - 0x800], ax
jmp 0x1178d80
mov ax, word [ebp - 0x800]
add esi, 0x7b
cmp esi, 0x2710
jl 0x1178d00
test ax, ax
je 0x1178dfb
push 0x3ff
lea edx, [ebp - 0x1c20]
push edi
push edx
call ebx
add esp, 0xc
lea ecx, [ebp - 0x2cc0]
xor eax, eax
push ecx
mov word [ebp - 0x1422], ax
call fcn.0116d940
lea edx, [ebp - 0x1c20]
push edx
mov esi, eax
call fcn.0116d940
lea esp, [esp]
movzx ecx, word [esi]
mov word [eax], cx
add esi, 2
add eax, 2
test cx, cx
jne 0x1178dd0
mov esi, dword [sym.imp.KERNEL32.DLL_MoveFileW]
lea eax, [ebp - 0x800]
push eax
lea ecx, [ebp - 0x1c20]
push ecx
call esi
test eax, eax
jne 0x1178e06
pop ebx
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 0x1420]
call fcn.01169ed0
xor bl, bl
call fcn.01169f90
test eax, eax
je 0x1178e37
test edi, edi
je 0x1178e37
cmp word [edi], 0
je 0x1178e37
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
test al, al
jne 0x1178e49
push 1
push edi
push 0
lea ecx, [ebp - 0x1420]
call fcn.0116d410
mov bl, al
lea edx, [ebp - 0x1c20]
push edx
lea eax, [ebp - 0x800]
push eax
call esi
test bl, bl
je 0x1178e73
lea ecx, [ebp - 0x1420]
call fcn.0116d540
lea ecx, [ebp - 0x1420]
call fcn.0116d5d0
cmp dword [ebp - 0x141c], 0xffffffff
mov dword [ebp - 0x1420], 0x1022aa8
je 0x1178eb3
cmp byte [ebp - 0x1410], 0
jne 0x1178eb3
cmp byte [ebp - 0x140e], 0
lea ecx, [ebp - 0x1420]
je 0x1178eae
call fcn.0116d5d0
pop ebx
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 4
call fcn.0116d540
pop ebx
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 4