joyce8/EMBER2024-capa huggingface dataset:
Function at 0x56d090
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 8
push edi
mov edi, dword [esp + 0x10]
mov eax, dword [edi + 0x24]
test eax, eax
je 0x56d147
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
push eax
lea ecx, [esp + 8]
push ecx
push edx
push edi
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call sym.vidcap60.exe_public:_long_int___stdcall_CArchive2::GetSizeExtractEntry_unsigned_short_int_const___long_long___int64____unsigned_long_int_
test eax, eax
jl 0x56d113
push esi
mov esi, dword [esp + 0x1c]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x56d127
test al, 0x10
je 0x56d127
push 0x400
push esi
call sym.vidcap60.exe__SfGetDiskFreeSpace_8
mov ecx, dword [esp + 8]
push 0
mov esi, eax
mov eax, dword [esp + 0x10]
push 0x400
push eax
push ecx
call fcn.005c4520
xor ecx, ecx
cmp edx, ecx
jg 0x56d11a
jl 0x56d110
cmp eax, esi
ja 0x56d11a
xor eax, eax
pop esi
pop edi
add esp, 8
ret 0x10
pop esi
mov eax, 1
pop edi
add esp, 8
ret 0x10
push 0
push str.IsSpaceForExtractEntry
push 0xaaaaaaa0
mov ecx, edi
call fcn.0056a380
pop esi
mov eax, 0x80070057
pop edi
add esp, 8
ret 0x10
mov eax, 0x80004005
pop edi
add esp, 8
ret 0x10

Function at 0x56d2a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 8
push edi
mov edi, dword [esp + 0x10]
mov eax, dword [edi + 0x24]
test eax, eax
je 0x56d35c
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x18]
lea ecx, [esp + 8]
push ecx
push edx
push eax
push edi
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
call sym.vidcap60.exe_public:_long_int___stdcall_CArchive2::GetSizeExtractEntry_int__int___long_long___int64____unsigned_long_int_
test eax, eax
jl 0x56d328
push esi
mov esi, dword [esp + 0x20]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x56d33c
test al, 0x10
je 0x56d33c
push 0x400
push esi
call sym.vidcap60.exe__SfGetDiskFreeSpace_8
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push 0
push 0x400
push ecx
push edx
mov esi, eax
call fcn.005c4520
xor ecx, ecx
cmp edx, ecx
jg 0x56d32f
jl 0x56d325
cmp eax, esi
ja 0x56d32f
xor eax, eax
pop esi
pop edi
add esp, 8
ret 0x14
pop esi
mov eax, 1
pop edi
add esp, 8
ret 0x14
push 0
push str.IsSpaceForExtractEntry
push 0xaaaaaaa0
mov ecx, edi
call fcn.0056a380
pop esi
mov eax, 0x80070057
pop edi
add esp, 8
ret 0x14
mov eax, 0x80004005
pop edi
add esp, 8
ret 0x14
Function at 0x56d370
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 8]
sub esp, 8
push ebx
push ebp
push esi
push edi
xor edi, edi
push edi
push edi
push 3
push edi
push edi
push SysReAllocString
push eax
xor ebp, ebp
xor esi, esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x56d3e0
lea ecx, [esp + 0x14]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [esp + 0x1c]
push edx
mov dword [esp + 0x14], eax
call sym.vidcap60.exe_public:_long_long___int64____stdcall_CArchive2::GetArchiveSize_void_
mov ecx, dword [esp + 0x14]
mov edi, edx
mov edx, dword [esp + 0x10]
mov esi, eax
add esi, edx
push ebx
adc edi, ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x24]
mov dword [eax + 4], edi
pop edi
mov dword [eax], esi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 8
ret 0xc
mov ecx, dword [esp + 0x1c]
push 0
push str.GetSizeCreateSEA
push 0xaaaaaaa4
call fcn.0056a380
mov eax, dword [esp + 0x24]
mov dword [eax + 4], edi
pop edi
mov ebp, 0x8004e006
mov dword [eax], esi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 8
ret 0xc
Function at 0x56d410
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x214
push esi
mov esi, dword [esp + 0x21c]
mov eax, dword [esi + 0x24]
push edi
xor edi, edi
cmp eax, 4
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], edi
jne 0x56d592
mov ecx, dword [esp + 0x224]
push 0x104
lea eax, [esp + 0x18]
push eax
push ecx
call sym.vidcap60.exe__SfGetPathNameFromFilePath_12
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x56d56c
test al, 0x10
je 0x56d56c
mov ecx, dword [esp + 0x228]
lea eax, [esp + 0xc]
push eax
push ecx
push esi
call sym.vidcap60.exe_public:_long_int___stdcall_CArchive2::GetSizeCreateSEA_unsigned_short_int_const___long_long___int64___
cmp eax, edi
jl 0x56d54f
push ebx
push ebp
push 0x400
lea edx, [esp + 0x20]
push edx
call sym.vidcap60.exe__SfGetDiskFreeSpace_8
mov ebp, dword [0x5d25ac]
add esi, 0x10c8
push str.FAT32
push esi
mov ebx, eax
call ebp
add esp, 8
test eax, eax
jne 0x56d4d8
mov edx, 1
mov ecx, 2
mov eax, 0x20
mov dword [esp + 0x10], edx
test al, 1
je 0x56d4cb
imul edx, ecx
shr eax, 1
test eax, eax
je 0x56d514
mov esi, ecx
imul ecx, esi
jmp 0x56d4c4
push 0x5da3ac
push esi
call ebp
add esp, 8
test eax, eax
jne 0x56d52b
mov edx, 1
mov ecx, 2
mov eax, 0x20
mov dword [esp + 0x10], edx
lea ebx, [ebx]
test al, 1
je 0x56d507
imul edx, ecx
shr eax, 1
test eax, eax
je 0x56d514
mov esi, ecx
imul ecx, esi
jmp 0x56d500
mov dword [esp + 0x10], edx
fild dword [esp + 0x10]
fmul qword [0x5e9040]
call fcn.005c4484
mov ebx, eax
mov edi, edx
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push 0
push 0x400
push eax
push ecx
call fcn.005c4520
cmp edx, edi
jg 0x56d55a
jl 0x56d54b
cmp eax, ebx
ja 0x56d55a
pop ebp
xor eax, eax
pop ebx
pop edi
pop esi
add esp, 0x214
ret 0xc
pop ebp
pop ebx
pop edi
mov eax, 1
pop esi
add esp, 0x214
ret 0xc
lea edx, [esp + 0x14]
push edx
push str.IsSpaceForSEA
push 0xaaaaaaae
mov ecx, esi
call fcn.0056a380
pop edi
mov eax, 0x8004e00d
pop esi
add esp, 0x214
ret 0xc
pop edi
mov eax, 0x80004005
pop esi
add esp, 0x214
ret 0xc
Function at 0x56f6a0
Capabilities:
Get file size

Disassembly:
sub esp, 0x218
push ebx
mov ebx, ecx
mov ecx, dword [esp + 0x220]
mov edx, dword [ecx]
mov ecx, dword [ecx + 4]
push esi
mov esi, dword [ebx + 0x50]
xor eax, eax
cmp ecx, esi
push edi
mov edi, dword [ebx + 0x4c]
jl 0x56f7b9
jg 0x56f6d1
cmp edx, edi
jb 0x56f7b9
sub edx, edi
mov edi, dword [esp + 0x22c]
sbb ecx, esi
mov esi, dword [edi]
push ebp
mov dword [esp + 0x14], ecx
inc esi
lea ecx, [esp + 0x20]
push ecx
mov eax, esi
push eax
lea ebp, [ebx + 0x868]
push ebp
mov ecx, ebx
mov dword [esp + 0x1c], edx
mov dword [edi], esi
call fcn.0056a300
push 0
push 0
push 3
push 0
push 0
push SysReAllocString
lea edx, [esp + 0x38]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x56f7a2
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esp + 0x1c]
cmp dword [esp + 0x14], ecx
jl 0x56f7a2
jg 0x56f743
cmp dword [esp + 0x10], eax
jb 0x56f7a2
sub dword [esp + 0x10], eax
mov edx, dword [esp + 0x14]
sbb edx, ecx
push esi
mov dword [esp + 0x18], edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [edi]
inc esi
lea ecx, [esp + 0x20]
push ecx
mov eax, esi
push eax
push ebp
mov ecx, ebx
mov dword [edi], esi
call fcn.0056a300
push 0
push 0
push 3
push 0
push 0
push SysReAllocString
lea edx, [esp + 0x38]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp esi, 0xffffffff
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x18], eax
jne 0x56f735
mov eax, dword [esp + 0x22c]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x218
ret 8
Function at 0x56fb50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x68c
push ebx
push esi
mov esi, ecx
push edi
xor eax, eax
mov ecx, 0x19b
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
mov ecx, dword [esi + 0x1c]
mov eax, dword [esi + 0x18]
xor ebx, ebx
lea edx, [esp + 0x28]
mov dword [esp + 0x1c], ecx
push edx
mov ecx, esi
mov word [esp + 0x80], bx
mov word [esp + 0x288], bx
mov word [esp + 0x490], bx
mov dword [esp + 0x1c], eax
call fcn.0056a6c0
cmp eax, ebx
jne 0x56fcd8
mov dword [esp + 0x10], ebx
mov edi, edi
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
mov ecx, dword [esp + 0x10]
mov ecx, dword [ecx + edx]
cmp ecx, ebx
mov dword [esp + 0x24], ecx
je 0x56fcd6
cmp dword [ecx], ebx
jne 0x56fcb7
mov edx, dword [esp + 0x5c]
mov ecx, dword [esp + 0x60]
mov eax, dword [esi + 0xc78]
lea edi, [edx + ecx*2 + 0x2a]
mov ecx, dword [esi + 0x18]
mov edx, dword [esi + 0x10a0]
shl edi, 1
add edx, ecx
mov ecx, dword [esi + 0x10a4]
adc ecx, dword [esi + 0x1c]
push ecx
mov ecx, dword [esi + 0xc7c]
push edx
mov edx, dword [esi + 0xc]
push edx
push ebx
push edi
push ecx
push eax
mov eax, dword [esi + 8]
push eax
mov ecx, esi
call fcn.0056abe0
test eax, eax
jl 0x56fceb
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x10a0]
mov edx, dword [esi + 0x1c]
add ecx, eax
mov eax, dword [esi + 0x10a4]
adc eax, edx
add ecx, 0x4c
adc eax, 0
mov edx, eax
push 0
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
push ecx
mov ecx, dword [esi + 0xc]
push ecx
mov dword [esp + 0x24], 0
sar edx, 0x1f
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x24]
mov ecx, dword [esi + 0xc]
push 0
lea edx, [esp + 0x18]
push edx
push 8
add eax, 8
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [esi + 0x18]
mov ecx, dword [esi + 0x1c]
add edx, edi
adc ecx, ebx
mov dword [esi + 0x1c], ecx
mov ecx, dword [esi + 0x10a0]
mov ebx, dword [esi + 0x1c]
mov eax, edx
add ecx, eax
mov eax, dword [esi + 0x10a4]
adc eax, ebx
mov dword [esi + 0x18], edx
mov edx, eax
xor ebx, ebx
push ebx
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
push ecx
mov ecx, dword [esi + 0xc]
push ecx
sar edx, 0x1f
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea edx, [esp + 0x28]
push edx
mov ecx, esi
call fcn.0056a780
mov edx, dword [esp + 0x10]
add edx, 4
cmp eax, ebx
mov dword [esp + 0x10], edx
je 0x56fbb0
cmp eax, ebx
jl 0x56fceb
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push eax
push ecx
mov ecx, esi
call fcn.0056c520
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x570000
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x414
push ebx
push esi
mov esi, dword [esp + 0x428]
push edi
mov edi, dword [esp + 0x428]
push 0x104
lea eax, [esp + 0x21c]
push eax
xor ebx, ebx
push edi
mov dword [esi], ebx
mov dword [esi + 4], ebx
call sym.vidcap60.exe__SfGetPathNameFromFilePath_12
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x57008f
test al, 0x10
je 0x57008f
lea ecx, [esp + 0x10]
push edi
push ecx
call dword [0x5d2614]
add esp, 8
push 0x104
lea edx, [esp + 0x14]
push edx
call sym.vidcap60.exe__SfAddSlashToPathName_8
push ebx
push ebx
push ebx
lea eax, [esp + 0x1c]
push eax
mov ecx, dword [esp + 0x434]
call fcn.0056bc80
mov ecx, dword [esi]
add ecx, eax
mov eax, dword [esi + 4]
adc eax, edx
pop edi
mov dword [esi + 4], eax
mov dword [esi], ecx
pop esi
mov eax, ebx
pop ebx
add esp, 0x414
ret 0x10
push edi
call sym.vidcap60.exe__SfDoesFileExist_4
test eax, eax
je 0x57009f
push ebx
push ebx
push ebx
push edi
jmp 0x570067
push ebp
mov ebp, dword [esp + 0x428]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push edx
push edi
mov ecx, ebp
call fcn.0056af40
mov ebx, eax
test ebx, ebx
jl 0x5700fe
mov eax, dword [esp + 0x10]
test eax, eax
je 0x5700fe
mov eax, dword [esp + 0x434]
push 0
and eax, 1
push eax
lea ecx, [esp + 0x1c]
push ecx
push edi
mov ecx, ebp
call fcn.0056bc80
mov ecx, dword [esi]
add ecx, eax
mov eax, dword [esi + 4]
pop ebp
adc eax, edx
pop edi
mov dword [esi + 4], eax
mov dword [esi], ecx
pop esi
mov eax, ebx
pop ebx
add esp, 0x414
ret 0x10
push 0
push str.GetSizeAddEntry
push 0xaaaaaaac
mov ecx, ebp
call fcn.0056a380
pop ebp
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x414
ret 0x10
Function at 0x570130
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x414
push ebx
push esi
mov esi, dword [esp + 0x428]
push edi
mov edi, dword [esp + 0x428]
push 0x104
lea eax, [esp + 0x21c]
push eax
xor ebx, ebx
push edi
mov dword [esi], ebx
call sym.vidcap60.exe__SfGetPathNameFromFilePath_12
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x5701b4
test al, 0x10
je 0x5701b4
lea ecx, [esp + 0x10]
push edi
push ecx
call dword [0x5d2614]
add esp, 8
push 0x104
lea edx, [esp + 0x14]
push edx
call sym.vidcap60.exe__SfAddSlashToPathName_8
push ebx
push ebx
push ebx
lea eax, [esp + 0x1c]
push eax
mov ecx, dword [esp + 0x434]
call fcn.0056bef0
mov ecx, dword [esi]
add ecx, eax
pop edi
mov dword [esi], ecx
pop esi
mov eax, ebx
pop ebx
add esp, 0x414
ret 0x10
push edi
call sym.vidcap60.exe__SfDoesFileExist_4
test eax, eax
je 0x5701c7
push 0
push 0
push 0
push edi
jmp 0x570194
push ebp
mov ebp, dword [esp + 0x428]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push edx
push edi
mov ecx, ebp
call fcn.0056af40
mov ebx, eax
test ebx, ebx
jl 0x57021e
mov eax, dword [esp + 0x10]
test eax, eax
je 0x57021e
mov eax, dword [esp + 0x434]
push 0
and eax, 1
push eax
lea ecx, [esp + 0x1c]
push ecx
push edi
mov ecx, ebp
call fcn.0056bef0
mov ecx, dword [esi]
pop ebp
add ecx, eax
pop edi
mov dword [esi], ecx
pop esi
mov eax, ebx
pop ebx
add esp, 0x414
ret 0x10
push 0
push str.GetSizeAddEntry
push 0xaaaaaaac
mov ecx, ebp
call fcn.0056a380
pop ebp
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x414
ret 0x10
Function at 0x570ab0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x664
push ebx
mov ebx, dword [esp + 0x670]
push ebp
push esi
push ebx
push eax
mov ebp, ecx
call fcn.00570830
mov esi, eax
test esi, esi
jl 0x570c1b
mov ecx, dword [esp + 0x674]
push edi
push ecx
lea edx, [esp + 0x470]
push edx
mov edi, 1
call dword [0x5d2614]
add esp, 8
push 0x104
lea eax, [esp + 0x470]
push eax
call sym.vidcap60.exe__SfAddSlashToPathName_8
lea ecx, [esp + 0x46c]
push 0x5e8700
push ecx
call dword [0x5d24cc]
add esp, 8
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x470]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
je 0x570c13
mov edi, edi
test edi, edi
je 0x570c0f
test esi, esi
jl 0x570c0f
mov edi, dword [0x5d24c4]
lea ecx, [esp + 0x40]
push 0x5d8fd8
push ecx
call edi
add esp, 8
test eax, eax
je 0x570bf8
lea edx, [esp + 0x40]
push 0x5e86f8
push edx
call edi
add esp, 8
test eax, eax
je 0x570bf8
mov eax, dword [esp + 0x678]
push eax
lea ecx, [esp + 0x268]
push ecx
call dword [0x5d2614]
add esp, 8
push 0x104
lea edx, [esp + 0x268]
push edx
call sym.vidcap60.exe__SfAddSlashToPathName_8
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x268]
push ecx
call dword [0x5d24cc]
mov al, byte [esp + 0x1c]
add esp, 8
test al, 0x10
je 0x570be4
mov edx, dword [esp + 0x680]
inc edx
push edx
push ebx
lea eax, [esp + 0x26c]
push eax
mov ecx, ebp
call fcn.00570ab0
jmp 0x570bf6
push 0
push ebx
lea ecx, [esp + 0x26c]
push ecx
mov ecx, ebp
call fcn.005703d0
mov esi, eax
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov edi, eax
jmp 0x570b40
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x664
ret 0xc
Function at 0x571780
Capabilities:
Delete file
Get file attributes
Set file attributes
Timestomp file

Disassembly:
sub esp, 0x18
push ebp
push esi
mov esi, dword [esp + 0x24]
mov eax, dword [esi + 0x24]
push edi
xor ebp, ebp
or edi, 0xffffffff
cmp eax, 2
je 0x5717b7
test eax, eax
je 0x5717b7
cmp eax, 3
jne 0x5717a9
mov ecx, esi
call fcn.00571490
jmp 0x5717be
cmp eax, 4
jne 0x5717c0
mov ecx, esi
call fcn.0056fda0
jmp 0x5717be
mov ecx, esi
call fcn.00570c30
mov ebp, eax
mov eax, dword [esi + 8]
test eax, eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x571800
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x28]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileTime]
lea edx, [esi + 0xc80]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
mov eax, dword [esi + 8]
push eax
call ebx
mov dword [esi + 8], 0
mov eax, dword [esi + 0x24]
cmp eax, 2
je 0x57181e
cmp eax, 3
je 0x57181e
cmp eax, 4
je 0x57181e
cmp eax, 5
jne 0x571852
mov eax, dword [esi + 0xc]
test eax, eax
je 0x571852
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esi + 8]
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x28]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push edi
lea edx, [esi + 0xe88]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, dword [esi + 0xc]
push eax
call ebx
mov dword [esi + 0xc], 0
test ebp, ebp
pop ebx
jl 0x5718a5
mov eax, dword [esi + 0x24]
cmp eax, 2
je 0x571869
cmp eax, 5
je 0x571869
cmp eax, 3
jne 0x5718a5
mov eax, dword [esi + 0x10b8]
test eax, eax
je 0x571893
lea edi, [esi + 0xc80]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [esi + 0xe88]
push edi
push ecx
call dword [0x5d25b0]
add esp, 8
jmp 0x5718a5
lea edx, [esi + 0xe88]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebp, 1
mov eax, dword [esi + 0x10]
xor ecx, ecx
cmp eax, ecx
mov dword [esi + 0x10b0], ecx
mov dword [esi + 0x10b4], ecx
je 0x5718d4
push ecx
push 0xffffffffffffffff
push ecx
push eax
call sym.vidcap60.exe__SfList_DeleteList_16
mov eax, dword [esi + 0x10]
push eax
call sym.vidcap60.exe__SfList_Destroy_4
mov dword [esi + 0x10], 0
mov eax, dword [esi + 0x11c8]
test eax, eax
je 0x571908
mov edi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ecx, dword [esi + 0x11c8]
push ecx
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [esi + 0x11c8], 0
pop edi
pop esi
mov eax, ebp
pop ebp
add esp, 0x18
ret 4
Function at 0x5720e0
Capabilities:
Enumerate files on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x870
push esi
push edi
push eax
mov esi, ecx
xor edi, edi
call sym.vidcap60.exe__SfGetFileNamePtrW_4
test eax, eax
je 0x5722e5
push ebx
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x678]
push edx
push eax
mov ecx, esi
call fcn.0056af40
mov ebx, eax
test ebx, ebx
jl 0x5722d7
mov eax, dword [esp + 0xc]
test eax, eax
je 0x5722b3
push ebp
mov ebp, dword [esp + 0x888]
lea eax, [esp + 0x470]
push ebp
push eax
mov edi, 1
call dword [0x5d2614]
add esp, 8
push 0x104
lea ecx, [esp + 0x474]
push ecx
call sym.vidcap60.exe__SfAddSlashToPathName_8
lea edx, [esp + 0x470]
push 0x5e8700
push edx
call dword [0x5d24cc]
add esp, 8
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x474]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [esp + 0x14], eax
je 0x57229d
test edi, edi
je 0x572299
test ebx, ebx
jl 0x572299
mov edi, dword [0x5d24c4]
lea edx, [esp + 0x44]
push 0x5d8fd8
push edx
call edi
add esp, 8
test eax, eax
je 0x572282
lea eax, [esp + 0x44]
push 0x5e86f8
push eax
call edi
add esp, 8
test eax, eax
je 0x572282
lea ecx, [esp + 0x268]
push ebp
push ecx
call dword [0x5d2614]
add esp, 8
push 0x104
lea edx, [esp + 0x26c]
push edx
call sym.vidcap60.exe__SfAddSlashToPathName_8
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x26c]
push ecx
call dword [0x5d24cc]
mov al, byte [esp + 0x20]
add esp, 8
test al, 0x10
je 0x572251
test byte [esi + 0x1094], 1
je 0x572282
mov edx, dword [esp + 0x10]
push edx
lea eax, [esp + 0x67c]
push eax
lea ecx, [esp + 0x4c]
push ecx
mov ecx, esi
call fcn.0056b060
test eax, eax
je 0x572282
push 0
push ebp
lea edx, [esp + 0x270]
push edx
mov ecx, esi
call fcn.00570ab0
jmp 0x572280
mov eax, dword [esp + 0x10]
push eax
lea ecx, [esp + 0x67c]
push ecx
lea edx, [esp + 0x4c]
push edx
mov ecx, esi
call fcn.0056b060
test eax, eax
je 0x572282
push 0
push ebp
lea eax, [esp + 0x270]
push eax
mov ecx, esi
call fcn.005703d0
mov ebx, eax
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov edi, eax
jmp 0x572191
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebp
mov eax, ebx
pop ebx
pop edi
pop esi
add esp, 0x870
ret 8
push 0
push str.AddWildcard
push 0xaaaaaaac
mov ecx, esi
call fcn.0056a380
pop ebx
pop edi
mov eax, 1
pop esi
add esp, 0x870
ret 8
mov eax, ebx
pop ebx
pop edi
pop esi
add esp, 0x870
ret 8
mov eax, edi
pop edi
pop esi
add esp, 0x870
ret 8
Function at 0x572930
Capabilities:
Get disk information

Disassembly:
mov edx, dword [esp + 8]
sub esp, 0x414
push ebx
push esi
push edi
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0x104
push edx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push 0x104
lea eax, [esp + 0x21c]
push eax
lea ecx, [esp + 0x18]
push ecx
call sym.vidcap60.exe__SfGetRootPathFromFilePath_12
mov esi, dword [esp + 0x424]
push 0x80
lea edx, [esi + 0x10c8]
push edx
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov ecx, dword [esp + 0x430]
mov ebx, dword [esp + 0x42c]
mov dword [esi + 0x20], ecx
xor eax, eax
mov dword [esi + 0x10b0], 0
mov dword [esi + 0x10b4], 0
mov dword [esi + 0x24], ebx
mov ecx, 0x312
lea edi, [esi + 0x30]
rep stosd dword es:[edi], eax
lea edx, [esp + 0x10]
mov word [esi + 0x68], ax
push edx
lea eax, [esi + 0xc80]
push eax
call dword [0x5d2614]
add esp, 8
cmp ebx, 5
ja case.default.0x5729eb
jmp dword [ebx*4 + 0x572aa8]
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call fcn.0056ab60
pop edi
pop esi
pop ebx
add esp, 0x414
ret 0x10
lea edx, [esp + 0x10]
push edx
mov ecx, esi
call fcn.00571920
pop edi
pop esi
pop ebx
add esp, 0x414
ret 0x10
lea eax, [esp + 0x10]
push eax
mov ecx, esi
call fcn.005719d0
pop edi
pop esi
pop ebx
add esp, 0x414
ret 0x10
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call fcn.00571b90
pop edi
pop esi
pop ebx
add esp, 0x414
ret 0x10
lea edx, [esp + 0x10]
push edx
mov ecx, esi
call fcn.00571d50
pop edi
pop esi
pop ebx
add esp, 0x414
ret 0x10
lea eax, [esp + 0x10]
push eax
mov ecx, esi
call fcn.00571de0
pop edi
pop esi
pop ebx
add esp, 0x414
ret 0x10
push 0
push str.Open_Main
push 0xaaaaaaa1
mov ecx, esi
call fcn.0056a380
pop edi
pop esi
mov eax, 0x80004001
pop ebx
add esp, 0x414
ret 0x10