joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18004dad
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x27c
mov eax, dword [0x180f51f0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x250
xor ebx, ebx
lea eax, [ebp - 0x258]
mov esi, ecx
push ebx
push eax
mov dword [ebp - 0x278], esi
call fcn.1809d820
add esp, 0xc
push esi
lea eax, [ebp - 0x260]
call fcn.18003fba
push 0x5c
lea eax, [ebp - 0x260]
call fcn.180030ba
push 0x180c2be8
lea eax, [ebp - 0x260]
push eax
call fcn.18003097
lea eax, [ebp - 0x258]
push eax
push dword [ebp - 0x260]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x274], eax
cmp eax, 0xffffffff
jne 0x18004eae
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x18004e58
mov eax, dword [ebp - 0x260]
add eax, 0xfffffff0
call fcn.18004250
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.1809ccb5
leave
ret
call fcn.1800fc86
movzx ecx, byte [0x180fb8f9]
neg ecx
sbb ecx, ecx
and ecx, 0x180fbba0
mov ebx, eax
je 0x18004e39
push 0xfffffffffffffffe
pop edi
xor esi, esi
push edi
inc esi
push esi
mov dword [ebp - 0x270], ecx
call fcn.18001d8a
push ebx
mov dword [ebp - 0x26c], eax
lea eax, [ebp - 0x270]
push str._DeleteWildcardFiles__failed_to_get_first_file__0x_08x_
push eax
mov dword [ebp - 0x268], edi
mov dword [ebp - 0x264], esi
call fcn.18001000
add esp, 0xc
jmp 0x18004e39
push 0xfffffffffffffffe
xor esi, esi
pop edi
inc esi
test byte [ebp - 0x258], 0x10
jne 0x18004f6f
push dword [ebp - 0x278]
lea eax, [ebp - 0x25c]
call fcn.18003fba
push 0x5c
lea eax, [ebp - 0x25c]
call fcn.180030ba
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x25c]
push eax
call fcn.18003097
push dword [ebp - 0x25c]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x18004f61
push dword [ebp - 0x25c]
call fcn.1800ccae
mov ebx, eax
pop ecx
test ebx, ebx
jge 0x18004f61
movzx ecx, byte [0x180fb8f9]
neg ecx
sbb ecx, ecx
and ecx, 0x180fbba0
je 0x18004f61
push edi
push esi
mov dword [ebp - 0x270], ecx
call fcn.18001d8a
push ebx
push dword [ebp - 0x25c]
mov dword [ebp - 0x26c], eax
lea eax, [ebp - 0x270]
push str._DeleteWildcardFiles__failed_to_delete_after_reboot___s__0x_08x_
push eax
mov dword [ebp - 0x268], edi
mov dword [ebp - 0x264], esi
call fcn.18001000
add esp, 0x10
mov eax, dword [ebp - 0x25c]
add eax, 0xfffffff0
call fcn.18004250
lea eax, [ebp - 0x258]
push eax
push dword [ebp - 0x274]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x18004eb4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x18004fe3
call fcn.1800fc86
movzx ecx, byte [0x180fb8f9]
neg ecx
sbb ecx, ecx
and ecx, 0x180fbba0
mov ebx, eax
je 0x18004fe3
push edi
push esi
mov dword [ebp - 0x270], ecx
call fcn.18001d8a
push ebx
mov dword [ebp - 0x26c], eax
lea eax, [ebp - 0x270]
push str._DeleteWildcardFiles__failed_to_get_next_file__0x_08x_
push eax
mov dword [ebp - 0x268], edi
mov dword [ebp - 0x264], esi
call fcn.18001000
add esp, 0xc
push dword [ebp - 0x274]
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x18004e39
Function at 0x18005c52
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push str.ADVAPI32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
neg eax
sbb eax, eax
and eax, dword [fcn.1800234b]
xor ebx, ebx
cmp eax, ebx
je 0x18005ca9
push str.SystemFunction036
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x18005c96
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov byte [ebp - 1], 1
test al, al
jne 0x18005c99
mov byte [ebp - 1], bl
cmp esi, ebx
je 0x18005ca4
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov al, byte [ebp - 1]
jmp 0x18005cfc
push 0xf0000040
push 1
push ebx
push ebx
lea eax, [ebp - 8]
push eax
mov dword [ebp - 8], ebx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x18005ce5
push dword [ebp + 8]
push dword [ebp + 0xc]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x18005ce5
cmp esi, ebx
je 0x18005ce1
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov al, 1
jmp 0x18005cfc
push ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
cmp esi, ebx
je 0x18005cfa
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor al, al
pop esi
pop ebx
leave
ret

Function at 0x18005dad
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
push dword [ebp + 8]
lea eax, [ebp - 4]
call fcn.18003fba
lea eax, [ebp - 4]
call fcn.18006473
mov esi, dword [ebp - 4]
cmp dword [esi - 0xc], 0
jne 0x18005de3
lea eax, [esi - 0x10]
call fcn.18004250
mov eax, 0x80070057
jmp 0x18005e78
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push esi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [ebp - 8], 0
mov edi, eax
je 0x18005e23
test edi, edi
je 0x18005e23
push dword [edi]
push dword [ebp + 0xc]
call fcn.1800422d
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp + 0xc]
call fcn.18006473
lea eax, [esi - 0x10]
call fcn.18004250
xor eax, eax
jmp 0x18005e78
call fcn.1800fc86
movzx ecx, byte [0x180fb8f9]
neg ecx
sbb ecx, ecx
and ecx, 0x180fbba0
mov dword [ebp - 4], eax
je 0x18005e6d
xor edi, edi
push 0xfffffffffffffffe
inc edi
push edi
mov dword [ebp - 0x18], ecx
call fcn.18001d8a
push dword [ebp - 4]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push str._::CommandLineToArgvW_failed__0x_08x_
push eax
mov dword [ebp - 0x10], 0xfffffffe
mov dword [ebp - 0xc], edi
call fcn.18001000
add esp, 0xc
lea eax, [esi - 0x10]
call fcn.18004250
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret
Function at 0x18005e7c
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push str.Global_MSIExecute
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov ebx, eax
test ebx, ebx
jne 0x18005ebd
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x18005ead
xor eax, eax
pop esi
pop ebx
leave
ret
test eax, eax
jle 0x18005ea9
and eax, 0xffff
or eax, 0x80070000
jmp 0x18005ea9
movzx ecx, byte [0x180fb8f9]
neg ecx
sbb ecx, ecx
and ecx, 0x180fbba0
je 0x18005efb
xor esi, esi
push 3
inc esi
push esi
mov dword [ebp - 0x10], ecx
call fcn.18001d8a
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push str._Wait_for__MSIExecute_
push eax
mov dword [ebp - 8], 3
mov dword [ebp - 4], esi
call fcn.18001000
pop ecx
pop ecx
push 0x493e0
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x18005f41
cmp eax, 0x80
je 0x18005f41
cmp eax, 0x102
je 0x18005f2e
cmp eax, 0xffffffff
je 0x18005f25
mov esi, 0x80004005
jmp 0x18005f33
call fcn.1800fc86
mov esi, eax
jmp 0x18005f33
mov esi, 0x800705b4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x18005ea9
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor esi, esi
jmp 0x18005f33

Function at 0x180061de
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x180f51f0]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x88]
push eax
call fcn.18008da2
mov edi, dword [ebp - 0x88]
and dword [ebp - 0x70], 0
and dword [ebp - 0x74], 0
mov dword [ebp - 0x84], 0x67452301
mov dword [ebp - 0x80], 0xefcdab89
mov dword [ebp - 0x7c], 0x98badcfe
mov dword [ebp - 0x78], 0x10325476
cmp dword [edi - 4], 1
mov esi, dword [edi - 0xc]
pop ecx
pop ecx
jle 0x1800624f
push esi
lea eax, [ebp - 0x88]
push eax
call fcn.1800332a
mov edi, dword [ebp - 0x88]
mov eax, esi
push edi
lea esi, [ebp - 0x84]
call fcn.18013e9c
pop ecx
mov ecx, esi
lea ebx, [ebp - 0x28]
call fcn.18013f33
mov byte [ebp - 0x18], 0xd4
mov byte [ebp - 0x17], 0x78
mov byte [ebp - 0x16], 0x5f
mov byte [ebp - 0x15], 0xa
mov byte [ebp - 0x14], 0x13
mov byte [ebp - 0x13], 0x90
mov byte [ebp - 0x12], 0x5c
mov byte [ebp - 0x11], 0x97
mov byte [ebp - 0x10], 9
mov byte [ebp - 0xf], 0xb4
mov byte [ebp - 0xe], 0x67
mov byte [ebp - 0xd], 0xfd
mov byte [ebp - 0xc], 0x4e
mov byte [ebp - 0xb], 0xa7
mov byte [ebp - 0xa], 0xfa
mov byte [ebp - 9], 0x72
xor eax, eax
mov cl, byte [ebp + eax - 0x28]
cmp cl, byte [ebp + eax - 0x18]
jne 0x180062be
inc eax
cmp eax, 0x10
jl 0x180062aa
mov bl, 1
jmp 0x180062c0
xor bl, bl
lea eax, [edi - 0x10]
call fcn.18004250
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.18004250
mov ecx, dword [ebp - 8]
pop edi
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.1809ccb5
leave
ret
Function at 0x18007485
Capabilities:
Compare security identifiers

Disassembly:
push esi
lea esi, [eax + 4]
push edi
test esi, esi
je 0x180074b9
lea edi, [ebx + 4]
test edi, edi
je 0x180074b9
call fcn.18007f63
test al, al
je 0x180074b9
mov eax, ebx
call fcn.18007f63
test al, al
je 0x180074b9
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
jmp 0x180074bb
xor al, al
pop edi
pop esi
ret

Function at 0x1800942b
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
jg 0x18009438
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 0xc]
push ebx
push edi
push 3
pop edi
jmp 0x18009499
sub dword [ebp + 0x10], 4
js 0x18009522
movzx edx, byte [ecx]
shr edx, 2
mov dl, byte [edx + esi]
mov byte [eax], dl
movzx edx, byte [ecx]
movzx ebx, byte [ecx + 1]
and edx, edi
shl edx, 4
add edx, esi
shr ebx, 4
mov dl, byte [ebx + edx]
mov byte [eax + 1], dl
movzx ebx, byte [ecx + 2]
movzx edx, byte [ecx + 1]
and edx, 0xf
shr ebx, 6
add ebx, esi
mov dl, byte [ebx + edx*4]
mov byte [eax + 2], dl
movzx edx, byte [ecx + 2]
and edx, 0x3f
mov dl, byte [edx + esi]
mov byte [eax + 3], dl
add eax, 4
add ecx, edi
sub dword [ebp + 8], edi
cmp dword [ebp + 8], 2
jg 0x18009442
mov edx, dword [ebp + 8]
dec edx
je 0x180094f4
dec edx
jne 0x1800952f
sub dword [ebp + 0x10], edi
js 0x18009522
movzx edx, byte [ecx]
shr edx, 2
mov dl, byte [edx + esi]
mov byte [eax], dl
movzx edx, byte [ecx]
movzx ebx, byte [ecx + 1]
and edx, edi
shl edx, 4
shr ebx, 4
add edx, esi
mov dl, byte [ebx + edx]
mov byte [eax + 1], dl
movzx ecx, byte [ecx + 1]
and ecx, 0xf
mov cl, byte [esi + ecx*4]
mov byte [eax + 2], cl
add eax, edi
cmp byte [ebp + 0x14], 0
je 0x1800952f
mov ecx, dword [ebp + 0x10]
dec ecx
js 0x18009522
mov byte [eax], 0x3d
inc eax
jmp 0x1800952f
mov edx, dword [ebp + 0x10]
sub edx, 2
js 0x18009522
movzx ebx, byte [ecx]
shr ebx, 2
mov bl, byte [ebx + esi]
mov byte [eax], bl
movzx ecx, byte [ecx]
and ecx, edi
shl ecx, 4
mov cl, byte [ecx + esi]
mov byte [eax + 1], cl
inc eax
inc eax
cmp byte [ebp + 0x14], 0
je 0x1800952f
add edx, 0xfffffffe
jns 0x18009526
xor eax, eax
jmp 0x18009532
mov byte [eax], 0x3d
mov byte [eax + 1], 0x3d
inc eax
inc eax
sub eax, dword [ebp + 0xc]
pop edi
pop ebx
pop ebp
ret
Function at 0x1800af1f
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0x180f51f0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
push 0x800
push eax
mov word [ebp - 0x808], ax
lea eax, [ebp - 0x806]
push eax
call fcn.1809d820
mov esi, dword [0x180fbc80]
lea eax, [ebp - 0x80c]
push 0
push eax
call fcn.180088ed
push dword [ebp + 0xc]
lea eax, [ebp - 0x808]
push str.baselogging.cc
push 0
push esi
mov esi, dword [ebp - 0x80c]
push esi
push dword [ebp + 8]
push str.Exception__x_in__s__s__u_r_n_r_n_hs:_d_r_n
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x34
lea eax, [esi - 0x10]
call fcn.18004250
lea eax, [ebp - 0x808]
push eax
call fcn.18014ef5
mov dword [esp], 0x250012
push str.Exception
lea eax, [ebp - 0x808]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
sub eax, 3
pop esi
je 0x1800afd4
dec eax
jne 0x1800afc5
int3
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
inc eax
call fcn.1809ccb5
leave
ret
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x1800bae8
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x278
mov eax, dword [0x180f51f0]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, edi
mov esi, ecx
mov ebx, edx
call fcn.180066f9
push dword [esi]
call fcn.1800c3b2
pop ecx
test al, al
jne 0x1800bb2c
mov eax, 0x80070003
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1809ccb5
leave
ret
push ebx
mov eax, esi
lea ebx, [ebp - 0x264]
call fcn.1800bc24
xor ebx, ebx
mov dword [esp], 0x24c
lea eax, [ebp - 0x258]
push ebx
push eax
mov dword [ebp - 0x25c], ebx
call fcn.1809d820
add esp, 0xc
lea eax, [ebp - 0x25c]
push eax
push dword [ebp - 0x264]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1800bbdc
call fcn.1800fc86
movzx ecx, byte [0x180fb8f9]
neg ecx
sbb ecx, ecx
and ecx, 0x180fbba0
mov ebx, eax
je 0x1800bbc7
push 5
pop edi
xor esi, esi
push edi
inc esi
push esi
mov dword [ebp - 0x274], ecx
call fcn.18001d8a
push ebx
mov dword [ebp - 0x270], eax
lea eax, [ebp - 0x274]
push str._File::GetWildcards___FindFirstFile_failed__0x_x_
push eax
mov dword [ebp - 0x26c], edi
mov dword [ebp - 0x268], esi
call fcn.18001000
add esp, 0xc
mov eax, dword [ebp - 0x264]
add eax, 0xfffffff0
call fcn.18004250
mov eax, ebx
jmp 0x1800bb1d
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x260]
call fcn.18003fba
lea eax, [ebp - 0x260]
push eax
push edi
call fcn.18006696
mov eax, dword [ebp - 0x260]
add eax, 0xfffffff0
call fcn.18004250
lea eax, [ebp - 0x25c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1800bbdc
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x1800bbc7
Function at 0x1800c461
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x280
mov eax, dword [0x180f51f0]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 0x27c], eax
call fcn.180066f9
push esi
lea edi, [ebp - 0x264]
call fcn.180092f5
mov dword [esp], 0x250
xor esi, esi
lea eax, [ebp - 0x25c]
push esi
push eax
call fcn.1809d820
add esp, 0xc
push ebx
mov eax, edi
lea ecx, [ebp - 0x278]
call fcn.18002e5e
mov eax, dword [eax]
pop ecx
lea ecx, [ebp - 0x25c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
mov eax, dword [ebp - 0x278]
add eax, 0xfffffff0
call fcn.18004250
cmp edi, 0xffffffff
jne 0x1800c555
call fcn.1800fc86
movzx ecx, byte [0x180fb8f9]
neg ecx
sbb ecx, ecx
and ecx, 0x180fbba0
mov ebx, eax
je 0x1800c534
push 5
pop edi
push edi
inc esi
push esi
mov dword [ebp - 0x274], ecx
call fcn.18001d8a
push ebx
mov dword [ebp - 0x270], eax
lea eax, [ebp - 0x274]
push str._File::GetWildcards___FindFirstFile_failed__0x_x_
push eax
mov dword [ebp - 0x26c], edi
mov dword [ebp - 0x268], esi
call fcn.18001000
add esp, 0xc
mov esi, ebx
mov eax, dword [ebp - 0x264]
add eax, 0xfffffff0
call fcn.18004250
mov ecx, dword [ebp - 8]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.1809ccb5
leave
ret
cmp dword [ebp - 0x25c], 0x80
je 0x1800c56a
test byte [ebp - 0x25c], 0x10
jne 0x1800c5a3
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x264]
lea ecx, [ebp - 0x260]
call fcn.18002e5e
pop ecx
lea eax, [ebp - 0x260]
push eax
push dword [ebp - 0x27c]
call fcn.18006696
mov eax, dword [ebp - 0x260]
add eax, 0xfffffff0
call fcn.18004250
lea eax, [ebp - 0x25c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1800c555
call fcn.1800fc86
mov dword [ebp - 0x260], eax
cmp eax, 0x80070012
je 0x1800c62b
movzx ecx, byte [0x180fb8f9]
neg ecx
sbb ecx, ecx
and ecx, 0x180fbba0
je 0x1800c619
push 0xfffffffffffffffe
pop ebx
xor esi, esi
push ebx
inc esi
push esi
mov dword [ebp - 0x274], ecx
call fcn.18001d8a
push dword [ebp - 0x260]
mov dword [ebp - 0x270], eax
lea eax, [ebp - 0x274]
push str._File::GetWildcards___FindNextFile_failed__0x_x_
push eax
mov dword [ebp - 0x26c], ebx
mov dword [ebp - 0x268], esi
call fcn.18001000
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, dword [ebp - 0x260]
jmp 0x1800c536
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x1800c536
Function at 0x1800c65b
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x284
mov eax, dword [0x180f51f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push eax
lea edi, [ebp - 0x260]
mov esi, ecx
call fcn.180092f5
pop ecx
push esi
lea edi, [ebp - 0x264]
call fcn.180092f5
lea eax, [ebp - 0x260]
lea ecx, [ebp - 0x26c]
mov dword [esp], 0x180c439c
call fcn.18002e5e
mov dword [esp], 0x250
lea eax, [ebp - 0x258]
push 0
push eax
call fcn.1809d820
add esp, 0xc
lea eax, [ebp - 0x258]
push eax
push dword [ebp - 0x26c]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x25c], eax
cmp eax, 0xffffffff
jne 0x1800c772
call fcn.1800fc86
movzx ecx, byte [0x180fb8f9]
neg ecx
sbb ecx, ecx
and ecx, 0x180fbba0
mov ebx, eax
je 0x1800c735
push 0xfffffffffffffffe
pop edi
xor esi, esi
push edi
inc esi
push esi
mov dword [ebp - 0x27c], ecx
call fcn.18001d8a
push ebx
mov dword [ebp - 0x278], eax
lea eax, [ebp - 0x27c]
push str._File::CopyWildcards___FindFirstFile_failed__0x_x_
push eax
mov dword [ebp - 0x274], edi
mov dword [ebp - 0x270], esi
call fcn.18001000
add esp, 0xc
mov esi, ebx
mov eax, dword [ebp - 0x26c]
add eax, 0xfffffff0
call fcn.18004250
mov eax, dword [ebp - 0x264]
add eax, 0xfffffff0
call fcn.18004250
mov eax, dword [ebp - 0x260]
add eax, 0xfffffff0
call fcn.18004250
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.1809ccb5
leave
ret
cmp dword [ebp - 0x258], 0x80
je 0x1800c78b
test byte [ebp - 0x258], 0x10
jne 0x1800c810
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x260]
lea ecx, [ebp - 0x268]
call fcn.18002e5e
pop ecx
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x264]
lea ecx, [ebp - 0x280]
call fcn.18002e5e
cmp byte [ebp + 0xc], 0
mov esi, dword [ebp - 0x280]
pop ecx
jne 0x1800c7e7
push esi
call fcn.1800c3b2
pop ecx
test al, al
je 0x1800c7e7
lea eax, [esi - 0x10]
call fcn.18004250
mov eax, dword [ebp - 0x268]
add eax, 0xfffffff0
jmp 0x1800c80b
push dword [ebp + 0xc]
mov edi, dword [ebp - 0x268]
push esi
push edi
call fcn.1800cbab
mov ebx, eax
add esp, 0xc
lea eax, [esi - 0x10]
call fcn.18004250
lea eax, [edi - 0x10]
test ebx, ebx
jl 0x1800c889
call fcn.18004250
lea eax, [ebp - 0x258]
push eax
push dword [ebp - 0x25c]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1800c772
call fcn.1800fc86
mov ebx, eax
cmp ebx, 0x80070012
je 0x1800c89f
movzx ecx, byte [0x180fb8f9]
neg ecx
sbb ecx, ecx
and ecx, 0x180fbba0
je 0x1800c88e
push 0xfffffffffffffffe
pop edi
xor esi, esi
push edi
inc esi
push esi
mov dword [ebp - 0x27c], ecx
call fcn.18001d8a
push ebx
mov dword [ebp - 0x278], eax
lea eax, [ebp - 0x27c]
push str._File::CopyWildcards___FindNextFile_failed__0x_x_
push eax
mov dword [ebp - 0x274], edi
mov dword [ebp - 0x270], esi
call fcn.18001000
add esp, 0xc
jmp 0x1800c88e
call fcn.18004250
push dword [ebp - 0x25c]
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x1800c735
push dword [ebp - 0x25c]
call dword [sym.imp.KERNEL32.dll_FindClose]
xor esi, esi
jmp 0x1800c737
Function at 0x1800cbab
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp byte [ebp + 0x10], 0
push ebx
jne 0x1800cbc5
push dword [ebp + 0xc]
call fcn.1800c3b2
pop ecx
test al, al
jne 0x1800cc36
xor eax, eax
cmp byte [ebp + 0x10], al
sete al
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x1800cc36
call fcn.1800fc86
movzx ecx, byte [0x180fb8f9]
neg ecx
sbb ecx, ecx
and ecx, 0x180fbba0
mov ebx, eax
je 0x1800cc32
push 0xfffffffffffffffe
push 1
mov dword [ebp - 0x14], ecx
call fcn.18001d8a
mov dword [ebp - 0x10], eax
movzx eax, byte [ebp + 0x10]
push ebx
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x14]
push dword [ebp + 8]
mov dword [ebp - 0xc], 0xfffffffe
push str._File::Copy___CopyFile_failed__from_s__to_s__replace_u__0x_x_
push eax
mov dword [ebp - 8], 1
call fcn.18001000
add esp, 0x18
mov eax, ebx
jmp 0x1800cc38
xor eax, eax
pop ebx
leave
ret

Function at 0x1800cc3b
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push 0xb
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x1800cca9
call fcn.1800fc86
movzx ecx, byte [0x180fb8f9]
neg ecx
sbb ecx, ecx
and ecx, 0x180fbba0
mov ebx, eax
je 0x1800cca5
push 0xfffffffffffffffe
push 1
mov dword [ebp - 0x10], ecx
call fcn.18001d8a
push ebx
push 1
push dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push str._File::Move___MoveFileEx_failed__from_s__to_s__replace_u__0x_x_
push eax
mov dword [ebp - 8], 0xfffffffe
mov dword [ebp - 4], 1
call fcn.18001000
add esp, 0x18
mov eax, ebx
jmp 0x1800ccab
xor eax, eax
pop ebx
leave
ret

Function at 0x1800ceae
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push ebx
call fcn.1800c3b2
pop ecx
test al, al
jne 0x1800cf04
movzx ecx, byte [0x180fb8f9]
neg ecx
sbb ecx, ecx
and ecx, 0x180fbba0
je 0x1800cefd
xor esi, esi
push 0xffffffffffffffff
inc esi
push esi
mov dword [ebp - 0x14], ecx
call fcn.18001d8a
or dword [ebp - 0xc], 0xffffffff
push ebx
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push str._File::MoveAfterReboot__file_doesnt_exist__from__s_
push eax
mov dword [ebp - 8], esi
call fcn.18001000
add esp, 0xc
mov eax, 0x80070002
jmp 0x1800cf77
push 4
pop esi
push ebx
call fcn.1800c3df
pop ecx
test al, al
jne 0x1800cf15
push 5
pop esi
push esi
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x1800cf75
call fcn.1800fc86
movzx ecx, byte [0x180fb8f9]
neg ecx
sbb ecx, ecx
and ecx, 0x180fbba0
mov dword [ebp - 4], eax
je 0x1800cf70
xor esi, esi
push 0xfffffffffffffffe
inc esi
push esi
mov dword [ebp - 0x14], ecx
call fcn.18001d8a
push dword [ebp - 4]
mov dword [ebp - 0x10], eax
push 0
push ebx
lea eax, [ebp - 0x14]
push str._File::MoveAfterReboot__failed_to_MoveFileEx_from__s_to__s__0x_x_
push eax
mov dword [ebp - 0xc], 0xfffffffe
mov dword [ebp - 8], esi
call fcn.18001000
add esp, 0x14
mov eax, dword [ebp - 4]
jmp 0x1800cf77
xor eax, eax
pop esi
leave
ret