joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001e50
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x100a1f4b
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x100cc020]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
xor eax, eax
mov dword [esi], vtable.SpeedBit::Chrome::BrowserInfo::Implementation.0
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
lea ecx, [esi + 0x14]
mov dword [esi + 0x10], eax
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
mov dword [esp + 0x14], 0
lea ecx, [esi + 0x34]
mov dword [esi + 0x30], 0
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
lea ecx, [esi + 0x50]
mov byte [esp + 0x14], 1
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
mov byte [esp + 0x14], 2
lea ecx, [esi + 0x74]
mov dword [esi + 0x6c], 0xffffffff
mov dword [esi + 0x70], 0
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
lea ecx, [esi + 0x90]
mov byte [esp + 0x14], 3
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
lea ecx, [esi + 0xac]
mov byte [esp + 0x14], 4
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
lea ecx, [esi + 0xc8]
mov byte [esp + 0x14], 5
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
lea ecx, [esi + 0xe4]
mov byte [esp + 0x14], 6
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
lea ecx, [esi + 0x100]
mov byte [esp + 0x14], 7
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
lea eax, [esi + 0x11c]
push eax
mov byte [esp + 0x18], 8
call fcn.10014430
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4
Function at 0x100045c0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x100a5b08
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x100cc020]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 8], vtable.SpeedBit::Utils::Std::StringValueW_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___.0
mov dword [esp + 0xc], eax
lea eax, [esp + 8]
mov dword [esp + 0x18], 0
mov edx, dword [ecx]
mov edx, dword [edx + 0x30]
push eax
mov eax, dword [esp + 0x24]
push eax
call edx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
add esp, 0x18
ret
Function at 0x1000a110
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100a4399
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
mov eax, dword [0x100cc020]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x38]
push eax
lea ecx, [esp + 0x10]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
lea ecx, [esp + 0xc]
push ecx
lea ebx, [esi + 0xd8]
mov dword [esp + 0x34], 0
call fcn.10007af0
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x28
ret 4

Function at 0x1000c680
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100a1d52
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebp
push esi
mov eax, dword [0x100cc020]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x44]
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x10], 0
call fcn.10008740
mov esi, eax
mov dword [esp + 0x38], 1
cmp dword [edi + 0x18], 8
mov ecx, dword [edi + 0x14]
jb 0x1000c6d3
mov edx, dword [edi + 4]
jmp 0x1000c6d6
lea edx, [edi + 4]
mov eax, dword [esp + 0x40]
add eax, 8
push eax
call fcn.10096fd0
add esi, 4
push esi
mov ecx, ebp
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 1
mov byte [esp + 0x38], 0
call fcn.100087a0
mov eax, ebp
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
add esp, 0x30
ret 8

Function at 0x1000c7c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100a62b1
mov eax, dword fs:[0]
push eax
sub esp, 0x48
push esi
mov eax, dword [0x100cc020]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
lea eax, [esp + 0x30]
push eax
push ecx
call fcn.1000c680
lea esi, [esp + 0x1c]
mov dword [esp + 0x58], 0
call fcn.1001f330
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x5c], 1
call fcn.1001f3a0
mov edx, dword [ebp + 8]
lea ecx, [esp + 0xc]
call fcn.1001f640
mov eax, ecx
call fcn.1001f510
mov eax, esi
mov byte [esp + 0x58], 0
call fcn.1001f510
lea ecx, [esp + 0x30]
mov dword [esp + 0x58], 0xffffffff
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x1000c930
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100a6648
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
push edi
mov eax, dword [0x100cc020]
xor eax, esp
push eax
lea eax, [esp + 0xb0]
mov dword fs:[0], eax
push 1
push 2
lea ecx, [esp + 0x34]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_int_]
mov dword [esp + 0xb8], 0
call dword [sym.imp.MSVCP90.dll_public:_static_class_std::locale_const____cdecl_std::locale::classic_void_]
mov ecx, dword [esp + 0x2c]
mov ecx, dword [ecx + 4]
push eax
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + ecx + 0x34]
call dword [sym.imp.MSVCP90.dll_public:_class_std::locale___thiscall_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::imbue_class_std::locale_const__]
lea ecx, [esp + 0xc]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::locale::destructor_void_]
mov edx, dword [ebp + 0x10]
push edx
lea ecx, [esp + 0x30]
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___int_]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x30]
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____thiscall_std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::str_void_]
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 8]
mov edi, eax
mov byte [esp + 0xbc], 1
call fcn.1000c7c0
lea ecx, [esp + 0x10]
mov byte [esp + 0xb8], 0
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [esp + 0x2c]
mov dword [esp + 0xb8], 0xffffffff
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::vbase_dtor_void_]
mov ecx, dword [esp + 0xb0]
mov dword fs:[0], ecx
pop ecx
pop edi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1000eea0
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x100a2928
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100cc020]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
lea ebx, [esi + 0x14]
push ebx
mov dword [esp + 0x18], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor edi, edi
mov dword [esp + 0x20], edi
cmp dword [esi + 0x3b8], edi
je 0x1000efe7
cmp dword [esi + 0x3c8], edi
je 0x1000eefa
call fcn.1001d490
mov dword [esi + 0x3c8], edi
cmp dword [esi + 0x3c4], edi
je 0x1000ef0d
call fcn.1001dff0
mov dword [esi + 0x3c4], edi
cmp dword [esi + 0x3c0], edi
je 0x1000ef20
call fcn.1001d750
mov dword [esi + 0x3c0], edi
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebx, 8
cmp dword [esi + 0x300], edi
je 0x1000ef4c
cmp dword [esi + 0x304], ebx
jb 0x1000ef43
mov eax, dword [esi + 0x2f0]
jmp 0x1000ef49
lea eax, [esi + 0x2f0]
push eax
call ebp
cmp dword [esi + 0x370], edi
je 0x1000ef6d
cmp dword [esi + 0x374], ebx
jb 0x1000ef64
mov eax, dword [esi + 0x360]
jmp 0x1000ef6a
lea eax, [esi + 0x360]
push eax
call ebp
lea ecx, [esi + 0x2d0]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::clear_void_]
lea ecx, [esi + 0x2ec]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::clear_void_]
lea ecx, [esi + 0x308]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::clear_void_]
lea ecx, [esi + 0x324]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::clear_void_]
lea ecx, [esi + 0x340]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::clear_void_]
lea ecx, [esi + 0x35c]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::clear_void_]
lea ecx, [esi + 0x378]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::clear_void_]
lea ecx, [esi + 0x394]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::clear_void_]
mov ebx, dword [esp + 0x14]
mov dword [esi + 0x3b4], 0xffffffff
mov dword [esi + 0x3b0], edi
mov dword [esi + 0x3b8], edi
push ebx
mov dword [esp + 0x24], 0xffffffff
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x10014be0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100a28ca
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100cc020]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, edx
mov dword [esp + 0x38], 0
mov edi, dword [ebx + 0x10]
mov ebp, dword [ebx + 0xc]
mov ecx, edi
sub ecx, ebp
mov eax, 0x30c30c31
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp esi, eax
jbe 0x10014c68
cmp ebp, edi
jbe 0x10014c3c
call dword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
mov eax, dword [ebx]
mov ecx, dword [ebx + 0x10]
sub ecx, dword [ebx + 0xc]
push edi
push eax
lea eax, [esp + 0x48]
push eax
mov eax, 0x30c30c31
imul ecx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
push esi
mov ecx, ebx
call fcn.10014e80
jmp 0x10014cb9
jae 0x10014cb9
cmp ebp, edi
jbe 0x10014c74
call dword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
mov ebp, dword [ebx + 0xc]
mov edx, dword [ebx]
mov dword [esp + 0x18], edx
cmp ebp, dword [ebx + 0x10]
jbe 0x10014c88
call dword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
mov eax, dword [ebx]
lea ecx, [esp + 0x28]
mov dword [esp + 0x20], eax
push ecx
mov ecx, esi
lea eax, [esp + 0x24]
mov dword [esp + 0x28], ebp
call fcn.100152f0
mov edx, dword [esp + 0x18]
mov ecx, dword [eax + 4]
push edi
push edx
mov edx, dword [eax]
push ecx
push edx
lea eax, [esp + 0x28]
push eax
call fcn.10014de0
lea ecx, [esp + 0x40]
push ecx
mov dword [esp + 0x3c], 0xffffffff
call fcn.10014b40
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 0xa8
Function at 0x100166f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100a76f8
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
push esi
mov eax, dword [0x100cc020]
xor eax, esp
push eax
lea eax, [esp + 0xb0]
mov dword fs:[0], eax
push 1
push 2
lea ecx, [esp + 0x34]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_ostringstream_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_int_]
mov dword [esp + 0xb8], 0
call dword [sym.imp.MSVCP90.dll_public:_static_class_std::locale_const____cdecl_std::locale::classic_void_]
mov ecx, dword [esp + 0x2c]
mov ecx, dword [ecx + 4]
push eax
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + ecx + 0x34]
call dword [sym.imp.MSVCP90.dll_public:_class_std::locale___thiscall_std::basic_ios_char__struct_std::char_traits_char__::imbue_class_std::locale_const__]
lea ecx, [esp + 0xc]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::locale::destructor_void_]
mov edx, dword [ebp + 0xc]
push edx
push ecx
lea eax, [esp + 0x34]
push str.id_
push eax
call fcn.10019a70
add esp, 0xc
mov ecx, eax
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___int_]
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x30]
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____thiscall_std::basic_ostringstream_char__struct_std::char_traits_char___class_std::allocator_char__::str_void_]
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
push eax
mov byte [esp + 0xbc], 1
call fcn.100165c0
lea ecx, [esp + 0x10]
mov esi, eax
mov byte [esp + 0xb8], 0
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [esp + 0x2c]
mov dword [esp + 0xb8], 0xffffffff
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_ostringstream_char__struct_std::char_traits_char___class_std::allocator_char__::vbase_dtor_void_]
mov eax, esi
mov ecx, dword [esp + 0xb0]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1001c970
Capabilities:
Copy file

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x40]
push edi
call edx
mov edi, eax
mov eax, dword [esi]
mov edx, dword [eax + 0x38]
mov ecx, esi
call edx
mov ebp, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov dword [esp + 0x10], eax
test edi, edi
je 0x1001ca0f
mov ebx, dword [sym.imp.MSVCR90.dll__stricmp]
test esi, esi
je 0x1001c9d8
push esi
push edi
call ebx
add esp, 8
neg eax
sbb eax, eax
inc eax
test al, al
je 0x1001c9d8
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
push eax
mov ecx, ebp
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
test ebp, ebp
je 0x1001ca0f
push ebp
push edi
call ebx
add esp, 8
neg eax
sbb eax, eax
inc eax
test al, al
je 0x1001ca0f
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x20]
push edx
push ebp
push esi
call dword [0x100ceec8]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc

Function at 0x1001ca30
Capabilities:
Copy file

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x44]
push edi
call edx
mov edi, eax
mov eax, dword [esi]
mov edx, dword [eax + 0x3c]
mov ecx, esi
call edx
mov ebp, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov dword [esp + 0x10], eax
test edi, edi
je 0x1001cacf
mov ebx, dword [sym.imp.MSVCR90.dll__wcsicmp]
test esi, esi
je 0x1001ca98
push esi
push edi
call ebx
add esp, 8
neg eax
sbb eax, eax
inc eax
test al, al
je 0x1001ca98
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
push eax
mov ecx, ebp
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
test ebp, ebp
je 0x1001cacf
push ebp
push edi
call ebx
add esp, 8
neg eax
sbb eax, eax
inc eax
test al, al
je 0x1001cacf
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x20]
push edx
push ebp
push esi
call dword [0x100ceef0]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
Function at 0x1001caf0
Capabilities:
Move file

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x40]
push edi
call edx
mov edi, eax
mov eax, dword [esi]
mov edx, dword [eax + 0x38]
mov ecx, esi
call edx
mov ebp, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov dword [esp + 0x10], eax
test edi, edi
je 0x1001cb85
mov ebx, dword [sym.imp.MSVCR90.dll__stricmp]
test esi, esi
je 0x1001cb53
push esi
push edi
call ebx
add esp, 8
neg eax
sbb eax, eax
inc eax
test al, al
je 0x1001cb53
mov ecx, dword [esp + 0x10]
mov eax, ebp
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
test ebp, ebp
je 0x1001cb85
push ebp
push edi
call ebx
add esp, 8
neg eax
sbb eax, eax
inc eax
test al, al
je 0x1001cb85
mov edx, dword [esp + 0x10]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
push ebp
push esi
call dword [0x100ceed0]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8

Function at 0x1001cba0
Capabilities:
Move file

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x44]
push edi
call edx
mov edi, eax
mov eax, dword [esi]
mov edx, dword [eax + 0x3c]
mov ecx, esi
call edx
mov ebp, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov dword [esp + 0x10], eax
test edi, edi
je 0x1001cc35
mov ebx, dword [sym.imp.MSVCR90.dll__wcsicmp]
test esi, esi
je 0x1001cc03
push esi
push edi
call ebx
add esp, 8
neg eax
sbb eax, eax
inc eax
test al, al
je 0x1001cc03
mov ecx, dword [esp + 0x10]
mov eax, ebp
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
test ebp, ebp
je 0x1001cc35
push ebp
push edi
call ebx
add esp, 8
neg eax
sbb eax, eax
inc eax
test al, al
je 0x1001cc35
mov edx, dword [esp + 0x10]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
push ebp
push esi
call dword [0x100ceed4]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x1001cc50
Capabilities:
Move file

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x40]
push edi
call edx
mov edi, eax
mov eax, dword [esi]
mov edx, dword [eax + 0x38]
mov ecx, esi
call edx
mov ebp, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov dword [esp + 0x10], eax
test edi, edi
je 0x1001ccef
mov ebx, dword [sym.imp.MSVCR90.dll__stricmp]
test esi, esi
je 0x1001ccb8
push esi
push edi
call ebx
add esp, 8
neg eax
sbb eax, eax
inc eax
test al, al
je 0x1001ccb8
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
push eax
mov ecx, ebp
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
test ebp, ebp
je 0x1001ccef
push ebp
push edi
call ebx
add esp, 8
neg eax
sbb eax, eax
inc eax
test al, al
je 0x1001ccef
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x20]
push edx
push ebp
push esi
call dword [0x100ceed8]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc

Function at 0x1001cd10
Capabilities:
Move file

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x44]
push edi
call edx
mov edi, eax
mov eax, dword [esi]
mov edx, dword [eax + 0x3c]
mov ecx, esi
call edx
mov ebp, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov dword [esp + 0x10], eax
test edi, edi
je 0x1001cdaf
mov ebx, dword [sym.imp.MSVCR90.dll__wcsicmp]
test esi, esi
je 0x1001cd78
push esi
push edi
call ebx
add esp, 8
neg eax
sbb eax, eax
inc eax
test al, al
je 0x1001cd78
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
push eax
mov ecx, ebp
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
test ebp, ebp
je 0x1001cdaf
push ebp
push edi
call ebx
add esp, 8
neg eax
sbb eax, eax
inc eax
test al, al
je 0x1001cdaf
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x20]
push edx
push ebp
push esi
call dword [0x100ceee4]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc