joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003d060
Capabilities:
Get disk size
Get file attributes
Get file size
Set file attributes

Disassembly:
sub esp, 0x7ec
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x7e8], eax
push ebx
push ebp
mov ebp, dword [esp + 0x7f8]
push edi
xor ebx, ebx
push 0x7ce
lea ecx, [esp + 0x26]
xor eax, eax
push ebx
push ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov word [esp + 0x2c], ax
call fcn.100d4cc0
add esp, 0xc
push ebx
push ebx
lea edx, [esp + 0x20]
push edx
push 0x101dd568
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1003d0ed
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x1c]
cmp ecx, dword [esp + 0x14]
ja 0x1003d123
jb 0x1003d103
mov edx, dword [esp + 0x18]
cmp edx, dword [esp + 0x10]
jae 0x1003d123
push 6
push esi
call ebp
or eax, 0xffffffff
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x7e8]
xor ecx, esp
call fcn.100d0738
add esp, 0x7ec
ret
push esi
lea eax, [esp + 0x24]
call fcn.10039f60
mov edi, eax
add esp, 4
cmp edi, ebx
je 0x1003d1da
mov edi, dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push str..CerBerSystemLocked2019
lea eax, [esp + 0x24]
push eax
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push eax
call ebx
test eax, eax
jne 0x1003d17d
mov edi, dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
lea ecx, [esp + 0x20]
push ecx
call edi
lea edx, [esp + 0x20]
push edx
call edi
lea eax, [esp + 0x20]
push eax
call edi
lea ecx, [esp + 0x20]
push ecx
call edi
jmp 0x1003d1ae
push str..EnCiPhErEd
lea edx, [esp + 0x24]
push edx
call edi
push eax
call ebx
test eax, eax
je 0x1003d1a3
push str..Ejei
lea eax, [esp + 0x24]
push eax
call edi
push eax
call ebx
test eax, eax
jne 0x1003d1ae
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea edx, [esp + 0x20]
push edx
mov ecx, esi
mov ebx, eax
call fcn.10007910
push ebx
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, edi
neg eax
sbb eax, eax
add eax, 5
push eax
push esi
call ebp
mov ecx, dword [esp + 0x7f4]
mov eax, edi
neg eax
pop edi
sbb eax, eax
pop ebp
neg eax
pop ebx
xor ecx, esp
dec eax
call fcn.100d0738
add esp, 0x7ec
ret
Function at 0x1003d200
Capabilities:
Get disk size
Get file attributes
Get file size
Set file attributes

Disassembly:
sub esp, 0x7ec
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x7e8], eax
push ebx
push ebp
mov ebp, dword [esp + 0x7f8]
push edi
xor ebx, ebx
push 0x7ce
lea ecx, [esp + 0x26]
xor eax, eax
push ebx
push ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov word [esp + 0x2c], ax
call fcn.100d4cc0
add esp, 0xc
push ebx
push ebx
lea edx, [esp + 0x20]
push edx
push 0x101dd568
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1003d28d
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x1c]
cmp ecx, dword [esp + 0x14]
ja 0x1003d2c3
jb 0x1003d2a3
mov edx, dword [esp + 0x18]
cmp edx, dword [esp + 0x10]
jae 0x1003d2c3
push 6
push esi
call ebp
or eax, 0xffffffff
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x7e8]
xor ecx, esp
call fcn.100d0738
add esp, 0x7ec
ret
push esi
lea eax, [esp + 0x24]
call fcn.10039f60
mov edi, eax
add esp, 4
cmp edi, ebx
je 0x1003d338
mov edi, dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
lea eax, [esp + 0x20]
push eax
call edi
lea ecx, [esp + 0x20]
push ecx
call edi
lea edx, [esp + 0x20]
push edx
call edi
lea eax, [esp + 0x20]
push eax
call edi
lea ecx, [esp + 0x20]
push ecx
call edi
lea edx, [esp + 0x20]
push edx
call edi
lea eax, [esp + 0x20]
push eax
call edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push esi
lea ecx, [esp + 0x24]
mov ebx, eax
call fcn.1000a3d0
push ebx
push esi
movzx edi, al
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, edi
neg ecx
sbb ecx, ecx
add ecx, 5
push ecx
push esi
call ebp
mov ecx, dword [esp + 0x7f4]
mov eax, edi
neg eax
pop edi
sbb eax, eax
pop ebp
neg eax
pop ebx
xor ecx, esp
dec eax
call fcn.100d0738
add esp, 0x7ec
ret
Function at 0x1003d360
Capabilities:
Get disk size
Get file attributes
Get file size
Set file attributes

Disassembly:
sub esp, 0x7ec
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x7e8], eax
push ebx
push ebp
mov ebp, dword [esp + 0x7f8]
push edi
xor ebx, ebx
push 0x7ce
lea ecx, [esp + 0x26]
xor eax, eax
push ebx
push ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov word [esp + 0x2c], ax
call fcn.100d4cc0
add esp, 0xc
push ebx
push ebx
lea edx, [esp + 0x20]
push edx
push 0x101dd568
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1003d3ed
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x1c]
cmp ecx, dword [esp + 0x14]
ja 0x1003d423
jb 0x1003d403
mov edx, dword [esp + 0x18]
cmp edx, dword [esp + 0x10]
jae 0x1003d423
push 6
push esi
call ebp
or eax, 0xffffffff
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x7e8]
xor ecx, esp
call fcn.100d0738
add esp, 0x7ec
ret
push esi
lea eax, [esp + 0x24]
call fcn.10039f60
mov edi, eax
add esp, 4
cmp edi, ebx
je 0x1003d475
mov edi, dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
lea eax, [esp + 0x20]
push eax
call edi
lea ecx, [esp + 0x20]
push ecx
call edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea edx, [esp + 0x20]
mov ecx, esi
mov ebx, eax
call fcn.10009510
push ebx
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, edi
neg edx
sbb edx, edx
add edx, 5
push edx
push esi
call ebp
mov ecx, dword [esp + 0x7f4]
mov eax, edi
neg eax
pop edi
sbb eax, eax
pop ebp
neg eax
pop ebx
xor ecx, esp
dec eax
call fcn.100d0738
add esp, 0x7ec
ret
Function at 0x1003d4a0
Capabilities:
Get disk size
Get file attributes
Get file size
Set file attributes

Disassembly:
sub esp, 0x7ec
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x7e8], eax
push ebx
push ebp
mov ebp, dword [esp + 0x7f8]
push edi
xor ebx, ebx
push 0x7ce
lea ecx, [esp + 0x26]
xor eax, eax
push ebx
push ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov word [esp + 0x2c], ax
call fcn.100d4cc0
add esp, 0xc
push ebx
push ebx
lea edx, [esp + 0x20]
push edx
push 0x101dd568
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1003d52d
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x1c]
cmp ecx, dword [esp + 0x14]
ja 0x1003d563
jb 0x1003d543
mov edx, dword [esp + 0x18]
cmp edx, dword [esp + 0x10]
jae 0x1003d563
push 6
push esi
call ebp
or eax, 0xffffffff
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x7e8]
xor ecx, esp
call fcn.100d0738
add esp, 0x7ec
ret
push esi
lea eax, [esp + 0x24]
call fcn.10039f60
mov edi, eax
add esp, 4
cmp edi, ebx
je 0x1003d5a6
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push esi
push 0x101e2b88
lea ecx, [esp + 0x28]
mov ebx, eax
call fcn.10003600
push ebx
push esi
movzx edi, al
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, edi
neg eax
sbb eax, eax
add eax, 5
push eax
push esi
call ebp
mov ecx, dword [esp + 0x7f4]
mov eax, edi
neg eax
pop edi
sbb eax, eax
pop ebp
neg eax
pop ebx
xor ecx, esp
dec eax
call fcn.100d0738
add esp, 0x7ec
ret
Function at 0x1003d5d0
Capabilities:
Get disk size
Get file attributes
Get file size
Set file attributes

Disassembly:
sub esp, 0x7f4
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x7f0], eax
push ebx
push ebp
mov ebp, dword [esp + 0x800]
push edi
xor ebx, ebx
push 0x7ce
lea ecx, [esp + 0x2e]
xor eax, eax
push ebx
push ecx
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov word [esp + 0x34], ax
call fcn.100d4cc0
add esp, 0xc
push ebx
push ebx
lea edx, [esp + 0x18]
push edx
push 0x101dd568
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1003d661
lea eax, [esp + 0x18]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x14]
cmp ecx, dword [esp + 0x1c]
ja 0x1003d697
jb 0x1003d677
mov edx, dword [esp + 0x10]
cmp edx, dword [esp + 0x18]
jae 0x1003d697
push 6
push esi
call ebp
or eax, 0xffffffff
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x7f0]
xor ecx, esp
call fcn.100d0738
add esp, 0x7f4
ret
push esi
lea eax, [esp + 0x2c]
call fcn.10039f60
mov edi, eax
add esp, 4
cmp edi, ebx
je 0x1003d72d
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x28]
push eax
call edi
test eax, eax
je 0x1003d6fe
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push str..eoeo
lea ecx, [esp + 0x2c]
push ecx
call edi
push eax
call ebp
test eax, eax
jne 0x1003d6fa
lea edx, [esp + 0x28]
push edx
call edi
lea edx, [esp + 0x28]
xor ecx, ecx
push edx
mov word [eax], cx
call edi
test eax, eax
jne 0x1003d6d0
mov ebp, dword [esp + 0x20]
cmp esi, ebx
je 0x1003d70f
lea eax, [esp + 0x28]
push eax
push esi
call fcn.10008680
jmp 0x1003d711
xor al, al
mov ecx, dword [esp + 0x24]
push ecx
push esi
movzx edi, al
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, edi
neg edx
sbb edx, edx
add edx, 5
push edx
push esi
call ebp
mov ecx, dword [esp + 0x7fc]
mov eax, edi
neg eax
pop edi
sbb eax, eax
pop ebp
neg eax
pop ebx
xor ecx, esp
dec eax
call fcn.100d0738
add esp, 0x7f4
ret
Function at 0x1003d750
Capabilities:
Get disk size
Get file attributes
Get file size
Set file attributes

Disassembly:
sub esp, 0x7f4
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x7f0], eax
push ebx
push ebp
mov ebp, dword [esp + 0x800]
push edi
xor ebx, ebx
push 0x7ce
lea ecx, [esp + 0x2e]
xor eax, eax
push ebx
push ecx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov word [esp + 0x34], ax
call fcn.100d4cc0
add esp, 0xc
push ebx
push ebx
lea edx, [esp + 0x18]
push edx
push 0x101dd568
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1003d7dd
lea eax, [esp + 0x18]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x14]
cmp ecx, dword [esp + 0x1c]
ja 0x1003d813
jb 0x1003d7f3
mov edx, dword [esp + 0x10]
cmp edx, dword [esp + 0x18]
jae 0x1003d813
push 6
push esi
call ebp
or eax, 0xffffffff
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x7f0]
xor ecx, esp
call fcn.100d0738
add esp, 0x7f4
ret
push esi
lea eax, [esp + 0x2c]
call fcn.10039f60
mov edi, eax
add esp, 4
cmp edi, ebx
je 0x1003d86b
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [esp + 0x24], eax
cmp esi, ebx
je 0x1003d850
lea ecx, [esp + 0x28]
push ecx
mov ecx, esi
call fcn.1000a5f0
mov edi, eax
jmp 0x1003d852
xor edi, edi
mov edx, dword [esp + 0x24]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, edi
neg eax
sbb eax, eax
add eax, 5
push eax
push esi
call ebp
mov ecx, dword [esp + 0x7fc]
mov eax, edi
neg eax
pop edi
sbb eax, eax
pop ebp
neg eax
pop ebx
xor ecx, esp
dec eax
call fcn.100d0738
add esp, 0x7f4
ret
Function at 0x1003d890
Capabilities:
Get disk size
Get file attributes
Get file size
Set file attributes

Disassembly:
sub esp, 0x7f4
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x7f0], eax
push ebx
push ebp
mov ebp, dword [esp + 0x800]
push edi
xor ebx, ebx
push 0x7ce
lea ecx, [esp + 0x2e]
xor eax, eax
push ebx
push ecx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov word [esp + 0x34], ax
call fcn.100d4cc0
add esp, 0xc
push ebx
push ebx
lea edx, [esp + 0x18]
push edx
push 0x101dd568
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1003d91d
lea eax, [esp + 0x18]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x14]
cmp ecx, dword [esp + 0x1c]
ja 0x1003d953
jb 0x1003d933
mov edx, dword [esp + 0x10]
cmp edx, dword [esp + 0x18]
jae 0x1003d953
push 6
push esi
call ebp
or eax, 0xffffffff
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x7f0]
xor ecx, esp
call fcn.100d0738
add esp, 0x7f4
ret
push esi
lea eax, [esp + 0x2c]
call fcn.10039f60
mov edi, eax
add esp, 4
cmp edi, ebx
je 0x1003d9ac
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [esp + 0x24], eax
cmp esi, ebx
je 0x1003d98e
lea ecx, [esp + 0x28]
push ecx
mov ecx, esi
call fcn.100049c0
jmp 0x1003d990
xor al, al
mov edx, dword [esp + 0x24]
push edx
push esi
movzx edi, al
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, edi
neg eax
sbb eax, eax
add eax, 5
push eax
push esi
call ebp
mov ecx, dword [esp + 0x7fc]
mov eax, edi
neg eax
pop edi
sbb eax, eax
pop ebp
neg eax
pop ebx
xor ecx, esp
dec eax
call fcn.100d0738
add esp, 0x7f4
ret
Function at 0x1003d9d0
Capabilities:
Get disk size
Get file attributes
Get file size
Set file attributes

Disassembly:
sub esp, 0x7ec
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x7e8], eax
push ebx
push ebp
mov ebp, dword [esp + 0x7f8]
push edi
xor ebx, ebx
push 0x7ce
lea ecx, [esp + 0x26]
xor eax, eax
push ebx
push ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov word [esp + 0x2c], ax
call fcn.100d4cc0
add esp, 0xc
push ebx
push ebx
lea edx, [esp + 0x20]
push edx
push 0x101dd568
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1003da5d
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x1c]
cmp ecx, dword [esp + 0x14]
ja 0x1003da93
jb 0x1003da73
mov edx, dword [esp + 0x18]
cmp edx, dword [esp + 0x10]
jae 0x1003da93
push 6
push esi
call ebp
or eax, 0xffffffff
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x7e8]
xor ecx, esp
call fcn.100d0738
add esp, 0x7ec
ret
push esi
lea eax, [esp + 0x24]
call fcn.10039f60
mov edi, eax
add esp, 4
cmp edi, ebx
je 0x1003dade
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea ecx, [esp + 0x20]
mov ebx, eax
push ecx
mov eax, esi
call fcn.1001b720
push ebx
push esi
movzx edi, al
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, edi
neg edx
sbb edx, edx
add edx, 5
push edx
push esi
call ebp
mov ecx, dword [esp + 0x7f4]
mov eax, edi
neg eax
pop edi
sbb eax, eax
pop ebp
neg eax
pop ebx
xor ecx, esp
dec eax
call fcn.100d0738
add esp, 0x7ec
ret
Function at 0x1003db00
Capabilities:
Get disk size
Get file attributes
Get file size
Set file attributes

Disassembly:
sub esp, 0x7ec
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x7e8], eax
push ebx
push ebp
mov ebp, dword [esp + 0x7f8]
push edi
xor ebx, ebx
push 0x7ce
lea ecx, [esp + 0x26]
xor eax, eax
push ebx
push ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov word [esp + 0x2c], ax
call fcn.100d4cc0
add esp, 0xc
push ebx
push ebx
lea edx, [esp + 0x20]
push edx
push 0x101dd568
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1003db8d
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x1c]
cmp ecx, dword [esp + 0x14]
ja 0x1003dbc3
jb 0x1003dba3
mov edx, dword [esp + 0x18]
cmp edx, dword [esp + 0x10]
jae 0x1003dbc3
push 6
push esi
call ebp
or eax, 0xffffffff
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x7e8]
xor ecx, esp
call fcn.100d0738
add esp, 0x7ec
ret
push esi
lea eax, [esp + 0x24]
call fcn.10039f60
mov edi, eax
add esp, 4
cmp edi, ebx
je 0x1003dc0e
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea ecx, [esp + 0x20]
push ecx
mov ecx, esi
mov ebx, eax
call fcn.1001d510
push ebx
push esi
movzx edi, al
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, edi
neg edx
sbb edx, edx
add edx, 5
push edx
push esi
call ebp
mov ecx, dword [esp + 0x7f4]
mov eax, edi
neg eax
pop edi
sbb eax, eax
pop ebp
neg eax
pop ebx
xor ecx, esp
dec eax
call fcn.100d0738
add esp, 0x7ec
ret
Function at 0x1003dc30
Capabilities:
Get disk size
Get file attributes
Get file size
Set file attributes

Disassembly:
sub esp, 0x7ec
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x7e8], eax
push ebx
push ebp
mov ebp, dword [esp + 0x7f8]
push edi
xor ebx, ebx
push 0x7ce
lea ecx, [esp + 0x26]
xor eax, eax
push ebx
push ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov word [esp + 0x2c], ax
call fcn.100d4cc0
add esp, 0xc
push ebx
push ebx
lea edx, [esp + 0x20]
push edx
push 0x101dd568
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1003dcbd
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x1c]
cmp ecx, dword [esp + 0x14]
ja 0x1003dcf3
jb 0x1003dcd3
mov edx, dword [esp + 0x18]
cmp edx, dword [esp + 0x10]
jae 0x1003dcf3
push 6
push esi
call ebp
or eax, 0xffffffff
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x7e8]
xor ecx, esp
call fcn.100d0738
add esp, 0x7ec
ret
push esi
lea eax, [esp + 0x24]
call fcn.10039f60
mov edi, eax
add esp, 4
cmp edi, ebx
je 0x1003dd50
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
xor edx, edx
push esi
mov word [esp + eax*2 + 0x16], dx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
lea eax, [esp + 0x20]
push eax
mov ecx, esi
call fcn.1000b830
push ebx
push esi
movzx edi, al
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, edi
neg ecx
sbb ecx, ecx
add ecx, 5
push ecx
push esi
call ebp
mov ecx, dword [esp + 0x7f4]
mov eax, edi
neg eax
pop edi
sbb eax, eax
pop ebp
neg eax
pop ebx
xor ecx, esp
dec eax
call fcn.100d0738
add esp, 0x7ec
ret
Function at 0x1003dd80
Capabilities:
Get disk size
Get file attributes
Get file size
Set file attributes

Disassembly:
sub esp, 0x7f4
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x7f0], eax
push ebx
push ebp
mov ebp, dword [esp + 0x800]
push edi
xor ebx, ebx
push 0x7ce
lea ecx, [esp + 0x2e]
xor eax, eax
push ebx
push ecx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov word [esp + 0x34], ax
call fcn.100d4cc0
add esp, 0xc
push ebx
push ebx
lea edx, [esp + 0x18]
push edx
push 0x101dd568
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1003de0d
lea eax, [esp + 0x18]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x14]
cmp ecx, dword [esp + 0x1c]
ja 0x1003de43
jb 0x1003de23
mov edx, dword [esp + 0x10]
cmp edx, dword [esp + 0x18]
jae 0x1003de43
push 6
push esi
call ebp
or eax, 0xffffffff
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x7f0]
xor ecx, esp
call fcn.100d0738
add esp, 0x7f4
ret
push esi
lea eax, [esp + 0x2c]
call fcn.10039f60
mov edi, eax
add esp, 4
cmp edi, ebx
je 0x1003de9b
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [esp + 0x24], eax
cmp esi, ebx
je 0x1003de7d
lea edx, [esp + 0x28]
mov ecx, esi
call fcn.10017450
jmp 0x1003de7f
xor al, al
mov ecx, dword [esp + 0x24]
push ecx
push esi
movzx edi, al
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, edi
neg edx
sbb edx, edx
add edx, 5
push edx
push esi
call ebp
mov ecx, dword [esp + 0x7fc]
mov eax, edi
neg eax
pop edi
sbb eax, eax
pop ebp
neg eax
pop ebx
xor ecx, esp
dec eax
call fcn.100d0738
add esp, 0x7f4
ret
Function at 0x1003dec0
Capabilities:
Get disk size
Get file attributes
Get file size
Set file attributes

Disassembly:
sub esp, 0x7ec
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x7e8], eax
push ebx
push ebp
mov ebp, dword [esp + 0x7f8]
push edi
xor ebx, ebx
push 0x7ce
lea ecx, [esp + 0x26]
xor eax, eax
push ebx
push ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov word [esp + 0x2c], ax
call fcn.100d4cc0
add esp, 0xc
push ebx
push ebx
lea edx, [esp + 0x20]
push edx
push 0x101dd568
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1003df4d
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x1c]
cmp ecx, dword [esp + 0x14]
ja 0x1003df83
jb 0x1003df63
mov edx, dword [esp + 0x18]
cmp edx, dword [esp + 0x10]
jae 0x1003df83
push 6
push esi
call ebp
or eax, 0xffffffff
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x7e8]
xor ecx, esp
call fcn.100d0738
add esp, 0x7ec
ret
push esi
lea eax, [esp + 0x24]
call fcn.10039f60
mov edi, eax
add esp, 4
cmp edi, ebx
je 0x1003dfcd
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea ecx, [esp + 0x20]
push ecx
push esi
mov ebx, eax
call fcn.1001dd50
push ebx
push esi
movzx edi, al
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, edi
neg edx
sbb edx, edx
add edx, 5
push edx
push esi
call ebp
mov ecx, dword [esp + 0x7f4]
mov eax, edi
neg eax
pop edi
sbb eax, eax
pop ebp
neg eax
pop ebx
xor ecx, esp
dec eax
call fcn.100d0738
add esp, 0x7ec
ret