joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1d00cc
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x1d028c
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov eax, esi
xor edx, edx
call fcn.00016c5c
lea eax, [ebp - 0x1c]
xor ecx, ecx
mov edx, 0x10
call fcn.0001487c
lea eax, [ebp - 0x2c]
xor ecx, ecx
mov edx, 0x10
call fcn.0001487c
lea eax, [ebp - 0x3c]
xor ecx, ecx
mov edx, 0x10
call fcn.0001487c
lea edx, [ebp - 8]
mov eax, edi
call fcn.001d1da8
test al, al
je 0x1d0271
push dword [edi + 0x24]
push 0x1d02ac
push 0x1d02f4
lea eax, [ebp - 4]
mov edx, 3
call fcn.00017214
mov dword [ebp - 0x1c], 0x77f555af
mov dword [ebp - 0x18], 0xd0f3b597
mov dword [ebp - 0x14], 0x2112c8c0
mov dword [ebp - 0x10], 0x7f0bfcea
mov eax, esi
mov ecx, 0x1d032c
mov edx, dword [ebp - 8]
call fcn.00017130
lea edx, [ebp - 0x3c]
mov eax, dword [ebp - 4]
call fcn.0012931c
lea edx, [ebp - 0x3c]
lea eax, [ebp - 0x1c]
call fcn.00129454
test al, al
jne 0x1d01ad
mov edx, 0xe
mov eax, edi
call fcn.001d2018
jmp 0x1d0271
push 0
push 0x1062a
mov ecx, dword [esi]
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.001d1f50
test al, al
je 0x1d0271
push 4
push 0
mov eax, dword [esi]
call fcn.00016ce8
push eax
call sub.kernel32.dll_MoveFileExW
push 4
push 0
mov eax, dword [ebp - 8]
call fcn.00016ce8
push eax
call sub.kernel32.dll_MoveFileExW
mov dword [ebp - 0x2c], 0x8ec5136a
mov dword [ebp - 0x28], 0x35f95b79
mov dword [ebp - 0x24], 0x5bbc9a7
mov dword [ebp - 0x20], 0x928cc992
mov eax, ebx
and al, 3
cmp al, 1
jne 0x1d021c
mov eax, dword [ebp + 8]
mov edx, 0x1d0360
call fcn.00016c5c
mov eax, ebx
and al, 3
cmp al, 2
jne 0x1d0231
mov eax, dword [ebp + 8]
mov edx, 0x1d0360
call fcn.00016c5c
and bl, 3
cmp bl, 3
jne 0x1d0246
mov eax, dword [ebp + 8]
mov edx, 0x1d0360
call fcn.00016c5c
lea edx, [ebp - 0x3c]
mov eax, dword [esi]
call fcn.0012931c
lea edx, [ebp - 0x2c]
lea eax, [ebp - 0x3c]
call fcn.00129454
test al, al
jne 0x1d026d
mov edx, 0xf
mov eax, edi
call fcn.001d2018
jmp 0x1d0271
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1d0293
lea eax, [ebp - 8]
mov edx, 2
call fcn.00016c54
ret
Function at 0x1d0374
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x1d0534
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov eax, esi
xor edx, edx
call fcn.00016c5c
lea eax, [ebp - 0x1c]
xor ecx, ecx
mov edx, 0x10
call fcn.0001487c
lea eax, [ebp - 0x2c]
xor ecx, ecx
mov edx, 0x10
call fcn.0001487c
lea eax, [ebp - 0x3c]
xor ecx, ecx
mov edx, 0x10
call fcn.0001487c
lea edx, [ebp - 8]
mov eax, edi
call fcn.001d1da8
test al, al
je 0x1d0519
push dword [edi + 0x24]
push 0x1d0554
push 0x1d05a4
lea eax, [ebp - 4]
mov edx, 3
call fcn.00017214
mov dword [ebp - 0x1c], 0x137172a6
mov dword [ebp - 0x18], 0xbafaeab2
mov dword [ebp - 0x14], 0x5684c334
mov dword [ebp - 0x10], 0xd619c100
mov eax, esi
mov ecx, 0x1d05e4
mov edx, dword [ebp - 8]
call fcn.00017130
lea edx, [ebp - 0x3c]
mov eax, dword [ebp - 4]
call fcn.0012931c
lea edx, [ebp - 0x3c]
lea eax, [ebp - 0x1c]
call fcn.00129454
test al, al
jne 0x1d0455
mov edx, 0xe
mov eax, edi
call fcn.001d2018
jmp 0x1d0519
push 0
push 0x2483
mov ecx, dword [esi]
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.001d1f50
test al, al
je 0x1d0519
push 4
push 0
mov eax, dword [esi]
call fcn.00016ce8
push eax
call sub.kernel32.dll_MoveFileExW
push 4
push 0
mov eax, dword [ebp - 8]
call fcn.00016ce8
push eax
call sub.kernel32.dll_MoveFileExW
mov dword [ebp - 0x2c], 0xf7b07583
mov dword [ebp - 0x28], 0xa847a329
mov dword [ebp - 0x24], 0xf9f8cdc2
mov dword [ebp - 0x20], 0xaeee7b0b
mov eax, ebx
and al, 3
cmp al, 1
jne 0x1d04c4
mov eax, dword [ebp + 8]
mov edx, 0x1d061c
call fcn.00016c5c
mov eax, ebx
and al, 3
cmp al, 2
jne 0x1d04d9
mov eax, dword [ebp + 8]
mov edx, 0x1d061c
call fcn.00016c5c
and bl, 3
cmp bl, 3
jne 0x1d04ee
mov eax, dword [ebp + 8]
mov edx, 0x1d061c
call fcn.00016c5c
lea edx, [ebp - 0x3c]
mov eax, dword [esi]
call fcn.0012931c
lea edx, [ebp - 0x2c]
lea eax, [ebp - 0x3c]
call fcn.00129454
test al, al
jne 0x1d0515
mov edx, 0xf
mov eax, edi
call fcn.001d2018
jmp 0x1d0519
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1d053b
lea eax, [ebp - 8]
mov edx, 2
call fcn.00016c54
ret
Function at 0x1d0644
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x1d0804
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov eax, esi
xor edx, edx
call fcn.00016c5c
lea eax, [ebp - 0x1c]
xor ecx, ecx
mov edx, 0x10
call fcn.0001487c
lea eax, [ebp - 0x2c]
xor ecx, ecx
mov edx, 0x10
call fcn.0001487c
lea eax, [ebp - 0x3c]
xor ecx, ecx
mov edx, 0x10
call fcn.0001487c
lea edx, [ebp - 8]
mov eax, edi
call fcn.001d1da8
test al, al
je 0x1d07e9
push dword [edi + 0x24]
push 0x1d0824
push 0x1d0874
lea eax, [ebp - 4]
mov edx, 3
call fcn.00017214
mov dword [ebp - 0x1c], 0xf567e54
mov dword [ebp - 0x18], 0x873a72e5
mov dword [ebp - 0x14], 0x9aca70ce
mov dword [ebp - 0x10], 0x26fce0b4
mov eax, esi
mov ecx, 0x1d08b4
mov edx, dword [ebp - 8]
call fcn.00017130
lea edx, [ebp - 0x3c]
mov eax, dword [ebp - 4]
call fcn.0012931c
lea edx, [ebp - 0x3c]
lea eax, [ebp - 0x1c]
call fcn.00129454
test al, al
jne 0x1d0725
mov edx, 0xe
mov eax, edi
call fcn.001d2018
jmp 0x1d07e9
push 0
push 0x2466
mov ecx, dword [esi]
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.001d1f50
test al, al
je 0x1d07e9
push 4
push 0
mov eax, dword [esi]
call fcn.00016ce8
push eax
call sub.kernel32.dll_MoveFileExW
push 4
push 0
mov eax, dword [ebp - 8]
call fcn.00016ce8
push eax
call sub.kernel32.dll_MoveFileExW
mov dword [ebp - 0x2c], 0x9b9c54b8
mov dword [ebp - 0x28], 0xce6ec3dc
mov dword [ebp - 0x24], 0x774b91b1
mov dword [ebp - 0x20], 0x8564aaa6
mov eax, ebx
and al, 3
cmp al, 1
jne 0x1d0794
mov eax, dword [ebp + 8]
mov edx, 0x1d08ec
call fcn.00016c5c
mov eax, ebx
and al, 3
cmp al, 2
jne 0x1d07a9
mov eax, dword [ebp + 8]
mov edx, 0x1d08ec
call fcn.00016c5c
and bl, 3
cmp bl, 3
jne 0x1d07be
mov eax, dword [ebp + 8]
mov edx, 0x1d08ec
call fcn.00016c5c
lea edx, [ebp - 0x3c]
mov eax, dword [esi]
call fcn.0012931c
lea edx, [ebp - 0x2c]
lea eax, [ebp - 0x3c]
call fcn.00129454
test al, al
jne 0x1d07e5
mov edx, 0xf
mov eax, edi
call fcn.001d2018
jmp 0x1d07e9
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1d080b
lea eax, [ebp - 8]
mov edx, 2
call fcn.00016c54
ret
Function at 0x1d0914
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x1d0a83
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov eax, esi
xor edx, edx
call fcn.00016c5c
lea eax, [ebp - 0x1c]
xor ecx, ecx
mov edx, 0x10
call fcn.0001487c
lea edx, [ebp - 8]
mov eax, edi
call fcn.001d1da8
test al, al
je 0x1d0a68
push dword [edi + 0x24]
push 0x1d0aa4
push 0x1d0af4
lea eax, [ebp - 4]
mov edx, 3
call fcn.00017214
mov eax, esi
mov ecx, 0x1d0b3c
mov edx, dword [ebp - 8]
call fcn.00017130
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.0012931c
lea edx, [ebp - 0x1c]
mov eax, dword [0x225ed0]
call fcn.00129454
test al, al
jne 0x1d09bd
mov edx, 0xe
mov eax, edi
call fcn.001d2018
jmp 0x1d0a68
push 0
push 0x23ef
mov ecx, dword [esi]
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.001d1f50
test al, al
je 0x1d0a68
push 4
push 0
mov eax, dword [esi]
call fcn.00016ce8
push eax
call sub.kernel32.dll_MoveFileExW
push 4
push 0
mov eax, dword [ebp - 8]
call fcn.00016ce8
push eax
call sub.kernel32.dll_MoveFileExW
mov eax, ebx
and al, 3
cmp al, 1
jne 0x1d0a10
mov eax, dword [ebp + 8]
mov edx, 0x1d0b74
call fcn.00016c5c
mov eax, ebx
and al, 3
cmp al, 2
jne 0x1d0a25
mov eax, dword [ebp + 8]
mov edx, 0x1d0b74
call fcn.00016c5c
and bl, 3
cmp bl, 3
jne 0x1d0a3a
mov eax, dword [ebp + 8]
mov edx, 0x1d0b74
call fcn.00016c5c
lea edx, [ebp - 0x1c]
mov eax, dword [esi]
call fcn.0012931c
mov edx, dword [0x226290]
lea eax, [ebp - 0x1c]
call fcn.00129454
test al, al
jne 0x1d0a64
mov edx, 0xf
mov eax, edi
call fcn.001d2018
jmp 0x1d0a68
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1d0a8a
lea eax, [ebp - 8]
mov edx, 2
call fcn.00016c54
ret
Function at 0x1d0b9c
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x1d0d15
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov eax, esi
xor edx, edx
call fcn.00016c5c
mov eax, dword [ebp + 8]
xor edx, edx
call fcn.00016c5c
lea eax, [ebp - 0x1c]
xor ecx, ecx
mov edx, 0x10
call fcn.0001487c
lea edx, [ebp - 8]
mov eax, edi
call fcn.001d1da8
test al, al
je 0x1d0cfa
push dword [edi + 0x24]
push 0x1d0d38
push 0x1d0d88
lea eax, [ebp - 4]
mov edx, 3
call fcn.00017214
mov eax, esi
mov ecx, 0x1d0dd0
mov edx, dword [ebp - 8]
call fcn.00017130
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.0012931c
lea edx, [ebp - 0x1c]
mov eax, dword [0x226324]
call fcn.00129454
test al, al
jne 0x1d0c4f
mov edx, 0xe
mov eax, edi
call fcn.001d2018
jmp 0x1d0cfa
push 0
push 0x2350
mov ecx, dword [esi]
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.001d1f50
test al, al
je 0x1d0cfa
push 4
push 0
mov eax, dword [esi]
call fcn.00016ce8
push eax
call sub.kernel32.dll_MoveFileExW
push 4
push 0
mov eax, dword [ebp - 8]
call fcn.00016ce8
push eax
call sub.kernel32.dll_MoveFileExW
mov eax, ebx
and al, 3
cmp al, 1
jne 0x1d0ca2
mov eax, dword [ebp + 8]
mov edx, 0x1d0e08
call fcn.00016c5c
mov eax, ebx
and al, 3
cmp al, 2
jne 0x1d0cb7
mov eax, dword [ebp + 8]
mov edx, 0x1d0e08
call fcn.00016c5c
and bl, 3
cmp bl, 3
jne 0x1d0ccc
mov eax, dword [ebp + 8]
mov edx, 0x1d0e08
call fcn.00016c5c
lea edx, [ebp - 0x1c]
mov eax, dword [esi]
call fcn.0012931c
mov edx, dword [0x225cac]
lea eax, [ebp - 0x1c]
call fcn.00129454
test al, al
jne 0x1d0cf6
mov edx, 0xf
mov eax, edi
call fcn.001d2018
jmp 0x1d0cfa
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1d0d1c
lea eax, [ebp - 8]
mov edx, 2
call fcn.00016c54
ret
Function at 0x1d0e30
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x1d0fa9
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov eax, esi
xor edx, edx
call fcn.00016c5c
mov eax, dword [ebp + 8]
xor edx, edx
call fcn.00016c5c
lea eax, [ebp - 0x1c]
xor ecx, ecx
mov edx, 0x10
call fcn.0001487c
lea edx, [ebp - 8]
mov eax, edi
call fcn.001d1da8
test al, al
je 0x1d0f8e
push dword [edi + 0x24]
push 0x1d0fcc
push 0x1d101c
lea eax, [ebp - 4]
mov edx, 3
call fcn.00017214
mov eax, esi
mov ecx, 0x1d1064
mov edx, dword [ebp - 8]
call fcn.00017130
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.0012931c
lea edx, [ebp - 0x1c]
mov eax, dword [0x226228]
call fcn.00129454
test al, al
jne 0x1d0ee3
mov edx, 0xe
mov eax, edi
call fcn.001d2018
jmp 0x1d0f8e
push 0
push 0x58e
mov ecx, dword [esi]
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.001d1f50
test al, al
je 0x1d0f8e
push 4
push 0
mov eax, dword [esi]
call fcn.00016ce8
push eax
call sub.kernel32.dll_MoveFileExW
push 4
push 0
mov eax, dword [ebp - 8]
call fcn.00016ce8
push eax
call sub.kernel32.dll_MoveFileExW
mov eax, ebx
and al, 3
cmp al, 1
jne 0x1d0f36
mov eax, dword [ebp + 8]
mov edx, 0x1d109c
call fcn.00016c5c
mov eax, ebx
and al, 3
cmp al, 2
jne 0x1d0f4b
mov eax, dword [ebp + 8]
mov edx, 0x1d109c
call fcn.00016c5c
and bl, 3
cmp bl, 3
jne 0x1d0f60
mov eax, dword [ebp + 8]
mov edx, 0x1d109c
call fcn.00016c5c
lea edx, [ebp - 0x1c]
mov eax, dword [esi]
call fcn.0012931c
mov edx, dword [0x225b98]
lea eax, [ebp - 0x1c]
call fcn.00129454
test al, al
jne 0x1d0f8a
mov edx, 0xf
mov eax, edi
call fcn.001d2018
jmp 0x1d0f8e
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1d0fb0
lea eax, [ebp - 8]
mov edx, 2
call fcn.00016c54
ret
Function at 0x1d10c4
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x1d123d
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov eax, esi
xor edx, edx
call fcn.00016c5c
mov eax, dword [ebp + 8]
xor edx, edx
call fcn.00016c5c
lea eax, [ebp - 0x1c]
xor ecx, ecx
mov edx, 0x10
call fcn.0001487c
lea edx, [ebp - 8]
mov eax, edi
call fcn.001d1da8
test al, al
je 0x1d1222
push dword [edi + 0x24]
push 0x1d1260
push 0x1d12b0
lea eax, [ebp - 4]
mov edx, 3
call fcn.00017214
mov eax, esi
mov ecx, 0x1d12f8
mov edx, dword [ebp - 8]
call fcn.00017130
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.0012931c
lea edx, [ebp - 0x1c]
mov eax, dword [0x225d40]
call fcn.00129454
test al, al
jne 0x1d1177
mov edx, 0xe
mov eax, edi
call fcn.001d2018
jmp 0x1d1222
push 0
push 0x5d1
mov ecx, dword [esi]
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.001d1f50
test al, al
je 0x1d1222
push 4
push 0
mov eax, dword [esi]
call fcn.00016ce8
push eax
call sub.kernel32.dll_MoveFileExW
push 4
push 0
mov eax, dword [ebp - 8]
call fcn.00016ce8
push eax
call sub.kernel32.dll_MoveFileExW
mov eax, ebx
and al, 3
cmp al, 1
jne 0x1d11ca
mov eax, dword [ebp + 8]
mov edx, 0x1d1330
call fcn.00016c5c
mov eax, ebx
and al, 3
cmp al, 2
jne 0x1d11df
mov eax, dword [ebp + 8]
mov edx, 0x1d1330
call fcn.00016c5c
and bl, 3
cmp bl, 3
jne 0x1d11f4
mov eax, dword [ebp + 8]
mov edx, 0x1d1330
call fcn.00016c5c
lea edx, [ebp - 0x1c]
mov eax, dword [esi]
call fcn.0012931c
mov edx, dword [0x226130]
lea eax, [ebp - 0x1c]
call fcn.00129454
test al, al
jne 0x1d121e
mov edx, 0xf
mov eax, edi
call fcn.001d2018
jmp 0x1d1222
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1d1244
lea eax, [ebp - 8]
mov edx, 2
call fcn.00016c54
ret
Function at 0x1d1358
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x1d14d1
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov eax, esi
xor edx, edx
call fcn.00016c5c
mov eax, dword [ebp + 8]
xor edx, edx
call fcn.00016c5c
lea eax, [ebp - 0x1c]
xor ecx, ecx
mov edx, 0x10
call fcn.0001487c
lea edx, [ebp - 8]
mov eax, edi
call fcn.001d1da8
test al, al
je 0x1d14b6
push dword [edi + 0x24]
push 0x1d14f4
push 0x1d1544
lea eax, [ebp - 4]
mov edx, 3
call fcn.00017214
mov eax, esi
mov ecx, 0x1d158c
mov edx, dword [ebp - 8]
call fcn.00017130
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.0012931c
lea edx, [ebp - 0x1c]
mov eax, dword [0x225dec]
call fcn.00129454
test al, al
jne 0x1d140b
mov edx, 0xe
mov eax, edi
call fcn.001d2018
jmp 0x1d14b6
push 0
push 0x5c8
mov ecx, dword [esi]
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.001d1f50
test al, al
je 0x1d14b6
push 4
push 0
mov eax, dword [esi]
call fcn.00016ce8
push eax
call sub.kernel32.dll_MoveFileExW
push 4
push 0
mov eax, dword [ebp - 8]
call fcn.00016ce8
push eax
call sub.kernel32.dll_MoveFileExW
mov eax, ebx
and al, 3
cmp al, 1
jne 0x1d145e
mov eax, dword [ebp + 8]
mov edx, 0x1d15c4
call fcn.00016c5c
mov eax, ebx
and al, 3
cmp al, 2
jne 0x1d1473
mov eax, dword [ebp + 8]
mov edx, 0x1d15c4
call fcn.00016c5c
and bl, 3
cmp bl, 3
jne 0x1d1488
mov eax, dword [ebp + 8]
mov edx, 0x1d15c4
call fcn.00016c5c
lea edx, [ebp - 0x1c]
mov eax, dword [esi]
call fcn.0012931c
mov edx, dword [0x2261a0]
lea eax, [ebp - 0x1c]
call fcn.00129454
test al, al
jne 0x1d14b2
mov edx, 0xf
mov eax, edi
call fcn.001d2018
jmp 0x1d14b6
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1d14d8
lea eax, [ebp - 8]
mov edx, 2
call fcn.00016c54
ret
Function at 0x1d15ec
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x1d1765
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov eax, esi
xor edx, edx
call fcn.00016c5c
mov eax, dword [ebp + 8]
xor edx, edx
call fcn.00016c5c
lea eax, [ebp - 0x1c]
xor ecx, ecx
mov edx, 0x10
call fcn.0001487c
lea edx, [ebp - 8]
mov eax, edi
call fcn.001d1da8
test al, al
je 0x1d174a
push dword [edi + 0x24]
push 0x1d1788
push 0x1d17d8
lea eax, [ebp - 4]
mov edx, 3
call fcn.00017214
mov eax, esi
mov ecx, 0x1d1820
mov edx, dword [ebp - 8]
call fcn.00017130
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.0012931c
lea edx, [ebp - 0x1c]
mov eax, dword [0x226260]
call fcn.00129454
test al, al
jne 0x1d169f
mov edx, 0xe
mov eax, edi
call fcn.001d2018
jmp 0x1d174a
push 0
push 0x5f3
mov ecx, dword [esi]
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.001d1f50
test al, al
je 0x1d174a
push 4
push 0
mov eax, dword [esi]
call fcn.00016ce8
push eax
call sub.kernel32.dll_MoveFileExW
push 4
push 0
mov eax, dword [ebp - 8]
call fcn.00016ce8
push eax
call sub.kernel32.dll_MoveFileExW
mov eax, ebx
and al, 3
cmp al, 1
jne 0x1d16f2
mov eax, dword [ebp + 8]
mov edx, 0x1d1858
call fcn.00016c5c
mov eax, ebx
and al, 3
cmp al, 2
jne 0x1d1707
mov eax, dword [ebp + 8]
mov edx, 0x1d1858
call fcn.00016c5c
and bl, 3
cmp bl, 3
jne 0x1d171c
mov eax, dword [ebp + 8]
mov edx, 0x1d1858
call fcn.00016c5c
lea edx, [ebp - 0x1c]
mov eax, dword [esi]
call fcn.0012931c
mov edx, dword [0x225bd0]
lea eax, [ebp - 0x1c]
call fcn.00129454
test al, al
jne 0x1d1746
mov edx, 0xf
mov eax, edi
call fcn.001d2018
jmp 0x1d174a
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1d176c
lea eax, [ebp - 8]
mov edx, 2
call fcn.00016c54
ret
Function at 0x1d1880
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x1d19f9
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov eax, esi
xor edx, edx
call fcn.00016c5c
mov eax, dword [ebp + 8]
xor edx, edx
call fcn.00016c5c
lea eax, [ebp - 0x1c]
xor ecx, ecx
mov edx, 0x10
call fcn.0001487c
lea edx, [ebp - 8]
mov eax, edi
call fcn.001d1da8
test al, al
je 0x1d19de
push dword [edi + 0x24]
push 0x1d1a1c
push 0x1d1a6c
lea eax, [ebp - 4]
mov edx, 3
call fcn.00017214
mov eax, esi
mov ecx, 0x1d1ab4
mov edx, dword [ebp - 8]
call fcn.00017130
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.0012931c
lea edx, [ebp - 0x1c]
mov eax, dword [0x225dd4]
call fcn.00129454
test al, al
jne 0x1d1933
mov edx, 0xe
mov eax, edi
call fcn.001d2018
jmp 0x1d19de
push 0
push 0x1846
mov ecx, dword [esi]
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.001d1f50
test al, al
je 0x1d19de
push 4
push 0
mov eax, dword [esi]
call fcn.00016ce8
push eax
call sub.kernel32.dll_MoveFileExW
push 4
push 0
mov eax, dword [ebp - 8]
call fcn.00016ce8
push eax
call sub.kernel32.dll_MoveFileExW
mov eax, ebx
and al, 3
cmp al, 1
jne 0x1d1986
mov eax, dword [ebp + 8]
mov edx, 0x1d1aec
call fcn.00016c5c
mov eax, ebx
and al, 3
cmp al, 2
jne 0x1d199b
mov eax, dword [ebp + 8]
mov edx, 0x1d1aec
call fcn.00016c5c
and bl, 3
cmp bl, 3
jne 0x1d19b0
mov eax, dword [ebp + 8]
mov edx, 0x1d1aec
call fcn.00016c5c
lea edx, [ebp - 0x1c]
mov eax, dword [esi]
call fcn.0012931c
mov edx, dword [0x22618c]
lea eax, [ebp - 0x1c]
call fcn.00129454
test al, al
jne 0x1d19da
mov edx, 0xf
mov eax, edi
call fcn.001d2018
jmp 0x1d19de
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1d1a00
lea eax, [ebp - 8]
mov edx, 2
call fcn.00016c54
ret
Function at 0x1d1b14
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x1d1c8d
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov eax, esi
xor edx, edx
call fcn.00016c5c
mov eax, dword [ebp + 8]
xor edx, edx
call fcn.00016c5c
lea eax, [ebp - 0x1c]
xor ecx, ecx
mov edx, 0x10
call fcn.0001487c
lea edx, [ebp - 8]
mov eax, edi
call fcn.001d1da8
test al, al
je 0x1d1c72
push dword [edi + 0x24]
push 0x1d1cb0
push 0x1d1d00
lea eax, [ebp - 4]
mov edx, 3
call fcn.00017214
mov eax, esi
mov ecx, 0x1d1d48
mov edx, dword [ebp - 8]
call fcn.00017130
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.0012931c
lea edx, [ebp - 0x1c]
mov eax, dword [0x225a50]
call fcn.00129454
test al, al
jne 0x1d1bc7
mov edx, 0xe
mov eax, edi
call fcn.001d2018
jmp 0x1d1c72
push 0
push 0x25a5
mov ecx, dword [esi]
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.001d1f50
test al, al
je 0x1d1c72
push 4
push 0
mov eax, dword [esi]
call fcn.00016ce8
push eax
call sub.kernel32.dll_MoveFileExW
push 4
push 0
mov eax, dword [ebp - 8]
call fcn.00016ce8
push eax
call sub.kernel32.dll_MoveFileExW
mov eax, ebx
and al, 3
cmp al, 1
jne 0x1d1c1a
mov eax, dword [ebp + 8]
mov edx, 0x1d1d80
call fcn.00016c5c
mov eax, ebx
and al, 3
cmp al, 2
jne 0x1d1c2f
mov eax, dword [ebp + 8]
mov edx, 0x1d1d80
call fcn.00016c5c
and bl, 3
cmp bl, 3
jne 0x1d1c44
mov eax, dword [ebp + 8]
mov edx, 0x1d1d80
call fcn.00016c5c
lea edx, [ebp - 0x1c]
mov eax, dword [esi]
call fcn.0012931c
mov edx, dword [0x225e6c]
lea eax, [ebp - 0x1c]
call fcn.00129454
test al, al
jne 0x1d1c6e
mov edx, 0xf
mov eax, edi
call fcn.001d2018
jmp 0x1d1c72
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1d1c94
lea eax, [ebp - 8]
mov edx, 2
call fcn.00016c54
ret