joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408db3
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x14], 0
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
lea eax, [ebp - 0x14]
mov dword [esp], eax
call fcn.00416612
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x408def
mov dword [esp], str.Could_not_connect_to_device__
call fcn.004088f4
mov eax, 0xffffffff
jmp 0x408f82
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x14]
mov dword [esp + 8], 0
lea edx, [ebp - 0x18]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00418ca3
mov word [ebp - 0xe], ax
cmp word [ebp - 0xe], 0
je 0x408e44
movsx eax, word [ebp - 0xe]
mov dword [esp + 4], eax
mov dword [esp], str.Could_not_connect_to_lockdown___d_
call fcn.004088f4
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call fcn.0041666b
mov eax, 0xffffffff
jmp 0x408f82
mov byte [ebp - 0x19], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x20]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x6554a3
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00417600
test ax, ax
je 0x408eaa
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x46
mov dword [esp + 4], 1
mov dword [esp], str.hm_could_not_get_PasswordProtected_value__assuming_device_is_unlocked_n
call sub.msvcrt.dll_fwrite
jmp 0x408f4d
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call fcn.00421a0c
test eax, eax
je 0x408eee
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call fcn.004212c0
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x4f
mov dword [esp + 4], 1
mov dword [esp], str.hm_PasswordProtected_value_is_not_of_type_boolean__assuming_device_is_unlocked_n
call sub.msvcrt.dll_fwrite
jmp 0x408f4d
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x19]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00421b7c
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call fcn.004212c0
mov al, byte [ebp - 0x19]
test al, al
je 0x408f33
cmp dword [ebp - 0xc], 0
jne 0x408f33
mov dword [esp + 4], str.Device_is_locked_with_a_passcode._Please_enter_it_NOW__the_procedure_will_then_continue.
mov dword [esp], 0xffffffff
call fcn.004089bc
mov dword [ebp - 0xc], 1
mov dword [esp], 0x3e8
call sub.KERNEL32.dll_Sleep
sub esp, 4
mov al, byte [ebp - 0x19]
test al, al
jne 0x408e4f
cmp dword [ebp - 0xc], 0
je 0x408f67
mov dword [esp + 4], str.Continuing...
mov dword [esp], 0xffffffff
call fcn.004089bc
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call fcn.00417e3f
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call fcn.0041666b
mov eax, 0
leave
ret
Function at 0x40922c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x14], 0
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
lea eax, [ebp - 0x14]
mov dword [esp], eax
call fcn.00416612
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x409284
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x2e
mov dword [esp + 4], 1
mov dword [esp], str.ERROR:_Could_not_connect_to_device._Aborting._n
call sub.msvcrt.dll_fwrite
mov eax, 0xfffffffe
jmp 0x4093f6
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x14]
mov dword [esp + 8], 0
lea edx, [ebp - 0x18]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00418ca3
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x4092e9
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call fcn.0041666b
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x2f
mov dword [esp + 4], 1
mov dword [esp], str.ERROR:_Could_not_connect_to_lockdown._Aborting_n
call sub.msvcrt.dll_fwrite
mov eax, 0xfffffffc
jmp 0x4093f6
mov dword [ebp - 0xc], 0x12c
mov dword [ebp - 0x10], 0
mov word [ebp - 0x1a], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
jmp 0x4093c6
mov word [ebp - 0x1a], 0
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x1a]
mov dword [esp + 8], edx
mov dword [esp + 4], str.com.apple.springboardservices
mov dword [esp], eax
call fcn.00418ec9
mov ax, word [ebp - 0x1a]
test ax, ax
je 0x4093c2
mov dword [ebp - 0x20], 0
mov ax, word [ebp - 0x1a]
movzx edx, ax
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x20]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0041b842
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x4093c5
mov eax, dword [ebp - 0x20]
mov dword [esp + 8], 0x65569a
lea edx, [ebp - 0x24]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0041b8f4
test ax, ax
jne 0x4093a0
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call fcn.004212c0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call fcn.0041b8ae
cmp dword [ebp - 0x10], 0
jne 0x4093e0
mov dword [esp], 0xbb8
call sub.KERNEL32.dll_Sleep
sub esp, 4
jmp 0x4093c6
nop
jmp 0x4093c6
nop
cmp dword [ebp - 0x10], 0
jne 0x4093e1
cmp dword [ebp - 0xc], 0
setg al
dec dword [ebp - 0xc]
test al, al
jne 0x409310
jmp 0x4093e1
nop
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call fcn.00417e3f
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x10]
leave
ret
Function at 0x4093f8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [ebp + 8]
mov byte [eax], 0
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], 0x200
call sub.KERNEL32.dll_GetTempPathA
sub esp, 8
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
lea edx, [eax - 1]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x2f
je 0x40945c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], 0xffffffff
mov edx, eax
mov al, 0
mov ecx, dword [ebp - 0x1c]
mov edi, edx
repne scasb al, byte es:[edi]
mov eax, ecx
not eax
lea edx, [eax - 1]
mov eax, dword [ebp + 8]
add eax, edx
mov word [eax], 0x2f
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], 0xffffffff
mov edx, eax
mov al, 0
mov ecx, dword [ebp - 0x1c]
mov edi, edx
repne scasb al, byte es:[edi]
mov eax, ecx
not eax
lea edx, [eax - 1]
mov eax, dword [ebp + 8]
add eax, edx
mov edx, eax
mov ebx, str.evasi0n_
mov eax, 9
mov edi, edx
mov esi, ebx
mov ecx, eax
rep movsb byte es:[edi], byte [esi]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x409499
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push edi
push ebx
sub esp, 0x50
cmp dword [ebp + 8], 0
je 0x40967d
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00597490
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40962e
jmp 0x40960b
mov eax, dword [ebp - 0x10]
add eax, 8
mov dword [esp + 4], 0x6556a5
mov dword [esp], eax
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x40960a
mov eax, dword [ebp - 0x10]
add eax, 8
mov dword [esp + 4], 0x6556a7
mov dword [esp], eax
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x40960a
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov ebx, eax
mov eax, dword [ebp - 0x10]
add eax, 8
mov dword [esp], eax
call sub.msvcrt.dll_strlen
add eax, ebx
add eax, 2
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x40960b
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x3c], 0xffffffff
mov edx, eax
mov al, 0
mov ecx, dword [ebp - 0x3c]
mov edi, edx
repne scasb al, byte es:[edi]
mov eax, ecx
not eax
lea edx, [eax - 1]
mov eax, dword [ebp - 0x14]
add eax, edx
mov word [eax], 0x2f
mov eax, dword [ebp - 0x10]
add eax, 8
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call fcn.0059fc30
lea eax, [ebp - 0x38]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.msvcrt.dll__stat
test eax, eax
jne 0x4095bc
mov ax, word [ebp - 0x32]
movzx eax, ax
and eax, 0xf000
cmp eax, 0x4000
jne 0x4095bc
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call fcn.00409499
jmp 0x4095fd
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.msvcrt.dll_remove
test eax, eax
je 0x4095fd
call sub.msvcrt.dll__errno
mov eax, dword [eax]
mov dword [esp], eax
call sub.msvcrt.dll_strerror
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 8], eax
mov dword [esp + 4], str.could_not_remove_file__s:__s_n
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call fcn.0059fbf8
jmp 0x40960b
nop
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.005976a0
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4094c8
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.005977b0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll__rmdir
test eax, eax
je 0x40967e
call sub.msvcrt.dll__errno
mov eax, dword [eax]
cmp eax, 2
je 0x40967e
call sub.msvcrt.dll__errno
mov eax, dword [eax]
mov dword [esp], eax
call sub.msvcrt.dll_strerror
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], str.could_not_remove_directory__s:__s_n
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
jmp 0x40967e
nop
add esp, 0x50
pop ebx
pop edi
pop ebp
ret
Function at 0x409d47
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
cmp dword [ebp + 8], 0
je 0x409d5c
mov eax, dword [ebp + 8]
mov eax, dword [eax]
test eax, eax
jne 0x409d66
mov eax, 0xffffffff
jmp 0x409e59
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp + 0xc], str.com.apple.DemoApp
mov dword [esp + 8], str.System
mov dword [esp + 4], 2
mov dword [esp], eax
call fcn.0042197c
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x409dc6
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x30
mov dword [esp + 4], 1
mov dword [esp], str.could_not_find_com.apple.DemoApp_entry_in_plist_n
call sub.msvcrt.dll_fwrite
mov eax, 0xffffffff
jmp 0x409e59
mov dword [esp + 4], str.ApplicationType
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.004218ac
mov dword [esp + 4], str.SBAppTags
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.004218ac
mov dword [esp], str._var_mobile_DemoApp.app
call fcn.004210ac
mov dword [esp + 8], eax
mov dword [esp + 4], str.Path
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.00409cf9
call fcn.00421044
mov dword [ebp - 0x10], eax
mov dword [esp], str._private_var_tmp_launchd_sock
call fcn.004210ac
mov dword [esp + 8], eax
mov dword [esp + 4], str.LAUNCHD_SOCKET
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.00421810
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], str.EnvironmentVariables
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.00409cf9
mov eax, 0
leave
ret
Function at 0x40afab
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], 0
mov dword [esp + 8], 0xa
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], 0
call sub.KERNEL32.dll_FindResourceA
sub esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x40b02a
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov dword [esp], 0
call sub.KERNEL32.dll_LoadResource
sub esp, 8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.KERNEL32.dll_LockResource
sub esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov dword [esp], 0
call sub.KERNEL32.dll_SizeofResource
sub esp, 8
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x40e4da
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [esp + 4], 0x65714b
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40e5a4
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_fseek
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_ftell
cdq
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_rewind
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
or eax, edx
test eax, eax
je 0x40e5a7
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov edx, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], 1
mov dword [esp], eax
call sub.msvcrt.dll_fread
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.0059fc68
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov dword [ecx], eax
mov dword [ecx + 4], edx
jmp 0x40e5a8
nop
jmp 0x40e5a8
nop
leave
ret

Function at 0x40e5aa
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov dword [esp + 4], 0x65714e
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x40e5ee
mov dword [esp + 4], 0x657151
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40e620
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0xc]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.0059fc68
leave
ret
Function at 0x410067
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov dword [esp + 4], 0x65714b
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4100a4
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], str.Cannot_open_source_path__s._n
call sub.msvcrt.dll_printf
jmp 0x410162
mov dword [esp + 4], 0x657151
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4100fc
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov dword [esp], str.Cannot_open_destination_file__s._n
call sub.msvcrt.dll_printf
jmp 0x410162
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 8], eax
mov dword [esp + 4], 1
lea eax, [ebp - 0x214]
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [ebp - 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x200
mov dword [esp + 4], 1
lea eax, [ebp - 0x214]
mov dword [esp], eax
call sub.msvcrt.dll_fread
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4100d8
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.0059fc68
cmp eax, 0xffffffff
jne 0x410146
mov dword [esp], str.Error_closing_source_file.
call sub.msvcrt.dll_puts
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.0059fc68
cmp eax, 0xffffffff
jne 0x410162
mov dword [esp], str.Error_closing_destination_file.
call sub.msvcrt.dll_puts
leave
ret

Function at 0x410349
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], 0
jmp 0x4103e8
cmp dword [ebp - 0x10], 0xd
je 0x4103fa
cmp dword [ebp - 0x10], 0xa
je 0x4103fa
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.msvcrt.dll_isprint
test eax, eax
je 0x4103b1
mov eax, dword [ebp + 0xc]
dec eax
cmp eax, dword [ebp - 0xc]
jle 0x410397
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
add edx, eax
mov eax, dword [ebp - 0x10]
mov byte [edx], al
inc dword [ebp - 0xc]
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 4], eax
mov dword [esp], 0x2a
call fcn.0059fd00
jmp 0x4103e8
cmp dword [ebp - 0x10], 8
jne 0x4103e8
cmp dword [ebp - 0xc], 0
jle 0x4103e8
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 3
mov dword [esp + 4], 1
mov dword [esp], 0x6576a9
call sub.msvcrt.dll_fwrite
dec dword [ebp - 0xc]
call sub.msvcrt.dll__getch
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x41035b
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
add eax, edx
mov byte [eax], 0
leave
ret
Function at 0x410559
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [ebp + 8], 0
jne 0x410571
mov dword [0x6d9098], 0
jmp 0x4105ba
mov eax, dword [0x6d9098]
cmp eax, 0x10
jne 0x4105a5
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x2e
mov dword [esp + 4], 1
mov dword [esp], str.Sorry__cant_ignore_more_than_16_error_codes._n
call sub.msvcrt.dll_fwrite
jmp 0x4105ba
mov eax, dword [0x6d9098]
mov edx, dword [ebp + 8]
mov dword [eax*4 + 0x6d90a0], edx
inc eax
mov dword [0x6d9098], eax
leave
ret
Function at 0x4197e1
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov esi, eax
or ebx, 0xffffffff
test eax, eax
je 0x41983e
mov dword [esp], eax
call sub.msvcrt.dll__mkdir
xor ebx, ebx
test eax, eax
je 0x41983e
call sub.msvcrt.dll__errno
cmp dword [eax], 0x11
je 0x41983e
mov dword [esp], esi
call sub.msvcrt.dll__strdup
mov dword [esp], eax
call fcn.00596c40
mov edi, eax
or ebx, 0xffffffff
test eax, eax
je 0x41982b
call fcn.004197e1
mov ebx, eax
mov dword [esp], edi
call fcn.0059fbf8
test ebx, ebx
jne 0x41983e
mov eax, esi
call fcn.004197e1
mov eax, ebx
add esp, 0x1c
pop ebx
pop esi
pop edi
leave
ret

Function at 0x419848
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x24c
cmp byte [0x6d90e8], 0
jne 0x4199cf
mov dword [ebp - 0x1c], 0
lea eax, [ebp - 0x1c]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x1c
mov dword [esp], 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
sub esp, 0xc
test eax, eax
jne 0x41997f
lea ebx, [ebp - 0x226]
mov dword [esp + 4], ebx
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sub.SHELL32.DLL_SHGetPathFromIDListW
push edx
push edx
test eax, eax
je 0x41997f
mov dword [esp], ebx
call sub.msvcrt.dll_wcslen
mov ebx, eax
xor edi, edi
test eax, eax
jle 0x41995b
lea eax, [eax + 1]
lea eax, [eax + eax*2]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov edi, eax
xor edx, edx
xor esi, esi
mov dword [ebp - 0x23c], ebx
mov cx, word [ebp + esi*2 - 0x226]
inc esi
cmp cx, 0x7ff
jbe 0x419916
mov ebx, ecx
shr bx, 0xc
sub ebx, 0x20
mov byte [eax + edx], bl
mov ebx, ecx
shr bx, 6
and ebx, 0x3f
add ebx, 0xffffff80
mov byte [eax + edx + 1], bl
and ecx, 0x3f
add ecx, 0xffffff80
mov byte [eax + edx + 2], cl
add edx, 3
jmp 0x41994f
cmp cx, 0x7f
lea ebx, [edx + 1]
mov dword [ebp - 0x22c], ebx
jbe 0x419943
mov ebx, ecx
shr bx, 6
and ebx, 0x1f
sub ebx, 0x40
mov byte [eax + edx], bl
and ecx, 0x3f
add ecx, 0xffffff80
mov byte [eax + edx + 1], cl
add edx, 2
jmp 0x41994f
and ecx, 0x7f
mov byte [eax + edx], cl
mov edx, dword [ebp - 0x22c]
cmp esi, dword [ebp - 0x23c]
jne 0x4198db
mov byte [eax + edx], 0
mov dword [esp + 4], edi
mov dword [esp], 0x6d90e8
call sub.msvcrt.dll_strcpy
mov dword [esp], edi
call fcn.0059fbf8
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sub.OLE32.dll_CoTaskMemFree
push eax
mov dword [esp + 4], 0x659a1a
mov dword [esp], 0x6d90e8
call fcn.0059fc30
mov dword [esp + 4], str.libimobiledevice
mov dword [esp], 0x6d90e8
call fcn.0059fc30
mov edi, 0x6d90e8
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub ecx, 2
jmp 0x4199c2
mov byte [ecx + 0x6d90e8], 0
dec ecx
test ecx, ecx
jle 0x4199cf
cmp byte [ecx + 0x6d90e8], 0x5c
je 0x4199ba
mov eax, 0x6d90e8
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
Function at 0x419a0a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, eax
mov dword [ebp - 0x24], edx
test edx, edx
je 0x419b9b
test eax, eax
sete byte [ebp - 0x20]
je 0x419b9b
call fcn.00419848
mov esi, eax
or edx, 0xffffffff
mov ecx, edx
mov edi, eax
mov al, byte [ebp - 0x20]
repne scasb al, byte es:[edi]
not ecx
mov dword [ebp - 0x1c], ecx
mov ecx, edx
mov edi, ebx
repne scasb al, byte es:[edi]
mov edx, ecx
not edx
add edx, dword [ebp - 0x1c]
mov dword [esp], edx
call sub.msvcrt.dll_malloc
mov edi, eax
mov dword [esp + 4], esi
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
mov dword [esp + 4], 0x659a1a
mov dword [esp], edi
call fcn.0059fc30
mov dword [esp + 4], ebx
mov dword [esp], edi
call fcn.0059fc30
mov dword [esp + 4], 0x6599cc
mov dword [esp], edi
call sub.msvcrt.dll_fopen
mov esi, eax
test eax, eax
je 0x419b6a
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.msvcrt.dll_fseek
mov dword [esp], esi
call sub.msvcrt.dll_ftell
mov dword [ebp - 0x1c], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], esi
call sub.msvcrt.dll_fseek
cmp dword [ebp - 0x1c], 0xffffff
jbe 0x419b0a
mov dword [esp + 8], str.userpref_get_file_contents
mov dword [esp + 4], str._s:_file_is_too_big____16MB_._Refusing_to_read_the_contents_to_memory_
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov dword [ebp - 0x20], 0
jmp 0x419b57
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov edx, eax
mov dword [ebp - 0x20], eax
xor ebx, ebx
jmp 0x419b51
mov dword [esp + 0xc], esi
mov eax, dword [ebp - 0x1c]
sub eax, ebx
mov dword [esp + 8], eax
mov dword [esp + 4], 1
lea eax, [edx + ebx]
mov dword [esp], eax
mov dword [ebp - 0x28], edx
call sub.msvcrt.dll_fread
test byte [esi + 0xc], 0x20
mov edx, dword [ebp - 0x28]
jne 0x419b57
add ebx, eax
cmp ebx, dword [ebp - 0x1c]
jae 0x419b5b
test byte [esi + 0xc], 0x10
je 0x419b1e
xor ebx, ebx
jmp 0x419b60
mov ebx, 1
mov dword [esp], esi
call fcn.0059fc68
jmp 0x419b7a
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
xor ebx, ebx
mov dword [esp], edi
call fcn.0059fbf8
test ebx, ebx
je 0x419b9d
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
mov dword [edx], ecx
mov eax, dword [ebp - 0x1c]
mov dword [edx + 4], eax
mov ebx, 1
jmp 0x419b9d
xor ebx, ebx
mov eax, ebx
add esp, 0x2c
pop ebx
pop esi
pop edi
leave
ret