joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003b1b0
Capabilities:
Get disk size
Get file attributes
Get file size
Set file attributes

Disassembly:
sub esp, 0x7ec
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x7e8], eax
push ebx
push ebp
mov ebp, dword [esp + 0x7f8]
push edi
push 0x7ce
xor ebx, ebx
lea ecx, [esp + 0x26]
xor eax, eax
push ebx
push ecx
mov word [esp + 0x2c], ax
call fcn.100d4cc0
add esp, 0xc
push ebx
push ebx
lea edx, [esp + 0x20]
push edx
push 0x101dd568
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1003b23d
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x1c]
cmp ecx, dword [esp + 0x14]
ja 0x1003b273
jb 0x1003b253
mov edx, dword [esp + 0x18]
cmp edx, dword [esp + 0x10]
jae 0x1003b273
push 6
push esi
call ebp
or eax, 0xffffffff
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x7e8]
xor ecx, esp
call fcn.100d0738
add esp, 0x7ec
ret
push esi
lea eax, [esp + 0x24]
call fcn.10039f60
mov edi, eax
add esp, 4
cmp edi, ebx
je 0x1003b2f3
push 0x10129ee0
push ebx
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_StrRStrIW]
cmp eax, ebx
je 0x1003b2a1
xor ecx, ecx
mov word [eax + 2], cx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0x80
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0x101e0680
push 3
push 0x1012a0c8
call fcn.10072400
add esp, 0xc
lea edx, [esp + 0x20]
mov ecx, esi
mov byte [0x101e0690], 1
call fcn.10018300
push ebx
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, edi
neg edx
sbb edx, edx
add edx, 5
push edx
push esi
call ebp
mov ecx, dword [esp + 0x7f4]
mov eax, edi
neg eax
pop edi
sbb eax, eax
pop ebp
neg eax
pop ebx
xor ecx, esp
dec eax
call fcn.100d0738
add esp, 0x7ec
ret
Function at 0x1003b320
Capabilities:
Get disk size
Get file attributes
Get file size
Set file attributes

Disassembly:
sub esp, 0x7ec
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x7e8], eax
push ebx
push ebp
mov ebp, dword [esp + 0x7f8]
push edi
push 0x7ce
xor ebx, ebx
lea ecx, [esp + 0x26]
xor eax, eax
push ebx
push ecx
mov word [esp + 0x2c], ax
call fcn.100d4cc0
add esp, 0xc
push ebx
push ebx
lea edx, [esp + 0x20]
push edx
push 0x101dd568
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1003b3ad
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x1c]
cmp ecx, dword [esp + 0x14]
ja 0x1003b3e3
jb 0x1003b3c3
mov edx, dword [esp + 0x18]
cmp edx, dword [esp + 0x10]
jae 0x1003b3e3
push 6
push esi
call ebp
or eax, 0xffffffff
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x7e8]
xor ecx, esp
call fcn.100d0738
add esp, 0x7ec
ret
push esi
lea eax, [esp + 0x24]
call fcn.10039f60
mov edi, eax
add esp, 4
cmp edi, ebx
je 0x1003b466
push 0x10129ee0
push ebx
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_StrRStrIW]
cmp eax, ebx
je 0x1003b411
xor ecx, ecx
mov word [eax + 2], cx
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
mov eax, 0x200
lea edi, [esp + 0x24]
call fcn.100044f0
mov edx, edi
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0x80
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, edi
push eax
mov eax, esi
call fcn.1000a060
push ebx
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, edi
neg ecx
sbb ecx, ecx
add ecx, 5
push ecx
push esi
call ebp
mov ecx, dword [esp + 0x7f4]
mov eax, edi
neg eax
pop edi
sbb eax, eax
pop ebp
neg eax
pop ebx
xor ecx, esp
dec eax
call fcn.100d0738
add esp, 0x7ec
ret
Function at 0x1003b490
Capabilities:
Get disk size
Get file attributes
Get file size
Set file attributes

Disassembly:
sub esp, 0x7f4
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x7f0], eax
push ebx
push ebp
mov ebp, dword [esp + 0x800]
push edi
xor ebx, ebx
push 0x7ce
lea ecx, [esp + 0x2e]
xor eax, eax
push ebx
push ecx
mov dword [esp + 0x30], ebp
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov word [esp + 0x34], ax
call fcn.100d4cc0
add esp, 0xc
push ebx
push ebx
lea edx, [esp + 0x18]
push edx
push 0x101dd568
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1003b521
lea eax, [esp + 0x18]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x14]
cmp ecx, dword [esp + 0x1c]
ja 0x1003b557
jb 0x1003b537
mov edx, dword [esp + 0x10]
cmp edx, dword [esp + 0x18]
jae 0x1003b557
push 6
push esi
call ebp
or eax, 0xffffffff
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x7f0]
xor ecx, esp
call fcn.100d0738
add esp, 0x7f4
ret
push esi
lea eax, [esp + 0x2c]
call fcn.10039f60
mov edi, eax
add esp, 4
cmp edi, ebx
je 0x1003b5f3
push 0x10129ee0
push ebx
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.SHLWAPI.dll_StrRStrIW]
cmp eax, ebx
je 0x1003b589
xor ecx, ecx
mov word [eax + 2], cx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0x80
push esi
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
push 0x101ded5c
mov ecx, esi
call fcn.100293a0
test eax, eax
je 0x1003b5da
cmp dword [0x101ded5c], ebx
je 0x1003b5da
mov eax, esi
call fcn.100290c0
cmp eax, 0xffffffff
je 0x1003b5da
mov ecx, dword [0x101ded5c]
mov edx, dword [ecx]
mov edx, dword [edx + 0xc]
lea eax, [esp + 0x28]
push eax
push esi
call edx
mov edi, eax
jmp 0x1003b5dc
xor edi, edi
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, edi
neg eax
sbb eax, eax
add eax, 5
push eax
push esi
call dword [esp + 0x2c]
mov ecx, dword [esp + 0x7fc]
mov eax, edi
neg eax
pop edi
sbb eax, eax
pop ebp
neg eax
pop ebx
xor ecx, esp
dec eax
call fcn.100d0738
add esp, 0x7f4
ret
Function at 0x1003b620
Capabilities:
Get disk size
Get file attributes
Get file size
Set file attributes

Disassembly:
sub esp, 0x7f4
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x7f0], eax
push ebx
push ebp
mov ebp, dword [esp + 0x800]
push edi
xor ebx, ebx
push 0x7ce
lea ecx, [esp + 0x2e]
xor eax, eax
push ebx
push ecx
mov dword [esp + 0x30], ebp
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov word [esp + 0x34], ax
call fcn.100d4cc0
add esp, 0xc
push ebx
push ebx
lea edx, [esp + 0x18]
push edx
push 0x101dd568
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1003b6b1
lea eax, [esp + 0x18]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x14]
cmp ecx, dword [esp + 0x1c]
ja 0x1003b6e7
jb 0x1003b6c7
mov edx, dword [esp + 0x10]
cmp edx, dword [esp + 0x18]
jae 0x1003b6e7
push 6
push esi
call ebp
or eax, 0xffffffff
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x7f0]
xor ecx, esp
call fcn.100d0738
add esp, 0x7f4
ret
push esi
lea eax, [esp + 0x2c]
call fcn.10039f60
mov edi, eax
add esp, 4
cmp edi, ebx
je 0x1003b765
push 0x10129ee0
push ebx
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.SHLWAPI.dll_StrRStrIW]
cmp eax, ebx
je 0x1003b715
xor ecx, ecx
mov word [eax + 2], cx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0x80
push esi
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
call fcn.1002a7e0
test eax, eax
setne al
mov byte [0x101e0628], al
cmp al, bl
je 0x1003b74c
lea edx, [esp + 0x28]
mov ecx, esi
call fcn.1002aad0
mov edi, eax
jmp 0x1003b74e
xor edi, edi
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, edi
neg edx
sbb edx, edx
add edx, 5
push edx
push esi
call dword [esp + 0x2c]
mov ecx, dword [esp + 0x7fc]
mov eax, edi
neg eax
pop edi
sbb eax, eax
pop ebp
neg eax
pop ebx
xor ecx, esp
dec eax
call fcn.100d0738
add esp, 0x7f4
ret
Function at 0x1003b790
Capabilities:
Get disk size
Get file attributes
Get file size
Set file attributes

Disassembly:
sub esp, 0x7ec
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x7e8], eax
push ebx
push ebp
mov ebp, dword [esp + 0x7f8]
push edi
xor ebx, ebx
push 0x7ce
lea ecx, [esp + 0x26]
xor eax, eax
push ebx
push ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov word [esp + 0x2c], ax
call fcn.100d4cc0
add esp, 0xc
push ebx
push ebx
lea edx, [esp + 0x20]
push edx
push 0x101dd568
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1003b81d
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x1c]
cmp ecx, dword [esp + 0x14]
ja 0x1003b853
jb 0x1003b833
mov edx, dword [esp + 0x18]
cmp edx, dword [esp + 0x10]
jae 0x1003b853
push 6
push esi
call ebp
or eax, 0xffffffff
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x7e8]
xor ecx, esp
call fcn.100d0738
add esp, 0x7ec
ret
push esi
lea eax, [esp + 0x24]
call fcn.10039f60
mov edi, eax
add esp, 4
cmp edi, ebx
je 0x1003b8a0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
lea ecx, [esp + 0x20]
push ecx
push esi
call fcn.1002b2a0
add esp, 8
push ebx
push esi
movzx edi, al
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, edi
neg edx
sbb edx, edx
add edx, 5
push edx
push esi
call ebp
mov ecx, dword [esp + 0x7f4]
mov eax, edi
neg eax
pop edi
sbb eax, eax
pop ebp
neg eax
pop ebx
xor ecx, esp
dec eax
call fcn.100d0738
add esp, 0x7ec
ret
Function at 0x1003b8d0
Capabilities:
Get disk size
Get file attributes
Get file size
Set file attributes

Disassembly:
sub esp, 0x7f4
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x7f0], eax
push ebx
push ebp
mov ebp, dword [esp + 0x800]
push edi
xor ebx, ebx
push 0x7ce
lea ecx, [esp + 0x2e]
xor eax, eax
push ebx
push ecx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov word [esp + 0x34], ax
call fcn.100d4cc0
add esp, 0xc
push ebx
push ebx
lea edx, [esp + 0x18]
push edx
push 0x101dd568
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1003b95d
lea eax, [esp + 0x18]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x14]
cmp ecx, dword [esp + 0x1c]
ja 0x1003b993
jb 0x1003b973
mov edx, dword [esp + 0x10]
cmp edx, dword [esp + 0x18]
jae 0x1003b993
push 6
push esi
call ebp
or eax, 0xffffffff
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x7f0]
xor ecx, esp
call fcn.100d0738
add esp, 0x7f4
ret
push esi
lea eax, [esp + 0x2c]
call fcn.10039f60
mov edi, eax
add esp, 4
cmp edi, ebx
je 0x1003b9fe
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
lea ecx, [esp + 0x28]
push ecx
mov ecx, esi
call fcn.10003d70
mov edx, dword [esp + 0x24]
push edx
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp edi, ebx
jne 0x1003b9f1
cmp dword [0x101e2d00], ebx
jne 0x1003b9f1
push 0x17
push esi
call ebp
mov dword [0x101e2d00], 1
mov eax, edi
neg eax
sbb eax, eax
add eax, 5
push eax
push esi
call ebp
mov ecx, dword [esp + 0x7fc]
mov eax, edi
neg eax
pop edi
sbb eax, eax
pop ebp
neg eax
pop ebx
xor ecx, esp
dec eax
call fcn.100d0738
add esp, 0x7f4
ret
Function at 0x1003ba20
Capabilities:
Get disk size
Get file attributes
Get file size
Set file attributes

Disassembly:
sub esp, 0x7ec
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x7e8], eax
push ebx
push ebp
mov ebp, dword [esp + 0x7f8]
push edi
xor ebx, ebx
push 0x7ce
lea ecx, [esp + 0x26]
xor eax, eax
push ebx
push ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov word [esp + 0x2c], ax
call fcn.100d4cc0
add esp, 0xc
push ebx
push ebx
lea edx, [esp + 0x20]
push edx
push 0x101dd568
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1003baad
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x1c]
cmp ecx, dword [esp + 0x14]
ja 0x1003bae3
jb 0x1003bac3
mov edx, dword [esp + 0x18]
cmp edx, dword [esp + 0x10]
jae 0x1003bae3
push 6
push esi
call ebp
or eax, 0xffffffff
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x7e8]
xor ecx, esp
call fcn.100d0738
add esp, 0x7ec
ret
push esi
lea eax, [esp + 0x24]
call fcn.10039f60
mov edi, eax
add esp, 4
cmp edi, ebx
je 0x1003bb4a
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIW]
mov ebx, eax
push 0x10128660
lea eax, [esp + 0x24]
push eax
call edi
test eax, eax
je 0x1003bb26
push 0x10128660
lea ecx, [esp + 0x24]
push ecx
call edi
xor edx, edx
mov word [eax], dx
lea eax, [esp + 0x20]
push eax
mov ecx, esi
call fcn.10005970
push ebx
push esi
movzx edi, al
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, edi
neg ecx
sbb ecx, ecx
add ecx, 5
push ecx
push esi
call ebp
mov ecx, dword [esp + 0x7f4]
mov eax, edi
neg eax
pop edi
sbb eax, eax
pop ebp
neg eax
pop ebx
xor ecx, esp
dec eax
call fcn.100d0738
add esp, 0x7ec
ret
Function at 0x1003bb70
Capabilities:
Get disk size
Get file attributes
Get file size
Set file attributes

Disassembly:
sub esp, 0x7ec
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x7e8], eax
push ebx
push ebp
mov ebp, dword [esp + 0x7f8]
push edi
xor ebx, ebx
push 0x7ce
lea ecx, [esp + 0x26]
xor eax, eax
push ebx
push ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov word [esp + 0x2c], ax
call fcn.100d4cc0
add esp, 0xc
push ebx
push ebx
lea edx, [esp + 0x20]
push edx
push 0x101dd568
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1003bbfd
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x1c]
cmp ecx, dword [esp + 0x14]
ja 0x1003bc33
jb 0x1003bc13
mov edx, dword [esp + 0x18]
cmp edx, dword [esp + 0x10]
jae 0x1003bc33
push 6
push esi
call ebp
or eax, 0xffffffff
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x7e8]
xor ecx, esp
call fcn.100d0738
add esp, 0x7ec
ret
push esi
lea eax, [esp + 0x24]
call fcn.10039f60
mov edi, eax
add esp, 4
cmp edi, ebx
je 0x1003bca6
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov ebx, eax
call fcn.1001f820
lea ecx, [esp + 0x20]
push ecx
mov edi, eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
mov edx, dword [edi*4 + 0x101b0058]
push edx
mov eax, 0x3e8
lea edi, [esp + 0x24]
call fcn.100044f0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
mov eax, edi
push eax
mov ecx, esi
call fcn.1001f6b0
push ebx
push esi
movzx edi, al
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, edi
neg ecx
sbb ecx, ecx
add ecx, 5
push ecx
push esi
call ebp
mov ecx, dword [esp + 0x7f4]
mov eax, edi
neg eax
pop edi
sbb eax, eax
pop ebp
neg eax
pop ebx
xor ecx, esp
dec eax
call fcn.100d0738
add esp, 0x7ec
ret
Function at 0x1003bcd0
Capabilities:
Get disk size
Get file attributes
Get file size
Set file attributes

Disassembly:
sub esp, 0x7ec
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x7e8], eax
push ebx
push ebp
mov ebp, dword [esp + 0x7f8]
push edi
xor ebx, ebx
push 0x7ce
lea ecx, [esp + 0x26]
xor eax, eax
push ebx
push ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov word [esp + 0x2c], ax
call fcn.100d4cc0
add esp, 0xc
push ebx
push ebx
lea edx, [esp + 0x20]
push edx
push 0x101dd568
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1003bd5d
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x1c]
cmp ecx, dword [esp + 0x14]
ja 0x1003bd93
jb 0x1003bd73
mov edx, dword [esp + 0x18]
cmp edx, dword [esp + 0x10]
jae 0x1003bd93
push 6
push esi
call ebp
or eax, 0xffffffff
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x7e8]
xor ecx, esp
call fcn.100d0738
add esp, 0x7ec
ret
push esi
lea eax, [esp + 0x24]
call fcn.10039f60
mov edi, eax
add esp, 4
cmp edi, ebx
je 0x1003bddd
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea edx, [esp + 0x20]
mov ecx, esi
mov ebx, eax
call fcn.1000b1d0
push ebx
push esi
movzx edi, al
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, edi
neg ecx
sbb ecx, ecx
add ecx, 5
push ecx
push esi
call ebp
mov ecx, dword [esp + 0x7f4]
mov eax, edi
neg eax
pop edi
sbb eax, eax
pop ebp
neg eax
pop ebx
xor ecx, esp
dec eax
call fcn.100d0738
add esp, 0x7ec
ret
Function at 0x1003be00
Capabilities:
Get disk size
Get file attributes
Get file size
Set file attributes

Disassembly:
sub esp, 0x86c
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x864], eax
push ebp
push edi
xor ebp, ebp
push 0x7ce
lea ecx, [esp + 0x9e]
xor eax, eax
push ebp
push ecx
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
mov word [esp + 0xa4], ax
call fcn.100d4cc0
add esp, 0xc
push ebp
push ebp
lea edx, [esp + 0x18]
push edx
push 0x101dd568
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push ebp
push 0x80
push 3
push ebp
push 1
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1003be8b
lea eax, [esp + 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x14]
cmp ecx, dword [esp + 0xc]
ja 0x1003bec0
jb 0x1003bea1
mov edx, dword [esp + 0x10]
cmp edx, dword [esp + 8]
jae 0x1003bec0
push 6
push esi
call ebx
or eax, 0xffffffff
pop edi
pop ebp
mov ecx, dword [esp + 0x864]
xor ecx, esp
call fcn.100d0738
add esp, 0x86c
ret
push esi
lea eax, [esp + 0x9c]
call fcn.10039f60
mov edi, eax
add esp, 4
cmp edi, ebp
je 0x1003bf4d
lea eax, [esp + 0x98]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov ecx, 0x40
lea edx, [esp + 0x18]
call fcn.10003cf0
mov edi, dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
lea ecx, [esp + 0x98]
push ecx
call edi
lea edx, [esp + 0x98]
push edx
call edi
lea eax, [esp + 0x18]
push eax
mov eax, 0x7d0
lea edi, [esp + 0x9c]
call fcn.100044f0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, edi
mov ebp, eax
push ecx
mov eax, esi
call fcn.10004250
push ebp
push esi
movzx edi, al
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, edi
neg edx
sbb edx, edx
add edx, 5
push edx
push esi
call ebx
mov ecx, dword [esp + 0x86c]
mov eax, edi
neg eax
sbb eax, eax
pop edi
neg eax
pop ebp
xor ecx, esp
dec eax
call fcn.100d0738
add esp, 0x86c
ret
Function at 0x1003bf70
Capabilities:
Get disk size
Get file attributes
Get file size
Set file attributes

Disassembly:
sub esp, 0x7ec
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x7e8], eax
push ebx
push ebp
mov ebp, dword [esp + 0x7f8]
push edi
xor ebx, ebx
push 0x7ce
lea ecx, [esp + 0x26]
xor eax, eax
push ebx
push ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov word [esp + 0x2c], ax
call fcn.100d4cc0
add esp, 0xc
push ebx
push ebx
lea edx, [esp + 0x20]
push edx
push 0x101dd568
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1003bffd
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x1c]
cmp ecx, dword [esp + 0x14]
ja 0x1003c033
jb 0x1003c013
mov edx, dword [esp + 0x18]
cmp edx, dword [esp + 0x10]
jae 0x1003c033
push 6
push esi
call ebp
or eax, 0xffffffff
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x7e8]
xor ecx, esp
call fcn.100d0738
add esp, 0x7ec
ret
push esi
lea eax, [esp + 0x24]
call fcn.10039f60
mov edi, eax
add esp, 4
cmp edi, ebx
je 0x1003c08f
push str._V.0.0.0.1yourencrypter_protonmail.ch.dp
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
xor ecx, ecx
push esi
mov word [eax], cx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea edx, [esp + 0x20]
push edx
mov ecx, esi
mov ebx, eax
call fcn.1000ddf0
push ebx
push esi
movzx edi, al
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, edi
neg eax
sbb eax, eax
add eax, 5
push eax
push esi
call ebp
mov ecx, dword [esp + 0x7f4]
mov eax, edi
neg eax
pop edi
sbb eax, eax
pop ebp
neg eax
pop ebx
xor ecx, esp
dec eax
call fcn.100d0738
add esp, 0x7ec
ret