joyce8/EMBER2024-capa huggingface dataset:
Function at 0x567880
Capabilities:
Delete file

Disassembly:
mov eax, dword [esp + 0x10]
sub esp, 0x208
push ebx
mov ebx, dword [esp + 0x224]
push ebp
push edi
push 0
push eax
call fcn.005652f0
mov edi, dword [esp + 0x218]
push 0
push 0x104
lea ecx, [esp + 0x14]
push ecx
mov ebp, eax
push edi
mov dword [esp + 0x23c], ebp
call sym.vidcap60.exe_long_int___stdcall_SfFMMeta_CreateMetaName_unsigned_short_int_const___unsigned_short_int___long_int__int_
test eax, eax
jl 0x567a36
lea edx, [esp + 0xc]
push edx
push edi
call sym.vidcap60.exe_int___stdcall_SfFMMeta_IsMetaFile_unsigned_short_int_const___unsigned_short_int_const__
test eax, eax
je 0x5678e0
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test edi, edi
mov ebx, dword [0x5d2620]
push esi
jne 0x5678ef
xor esi, esi
jmp 0x5678f7
push edi
call ebx
add esp, 4
mov esi, eax
xor ecx, ecx
cmp ecx, str..sfl
jne 0x567905
xor eax, eax
jmp 0x56790f
push str..sfl
call ebx
add esp, 4
lea edx, [eax + esi + 1]
cmp edx, 0x104
ja 0x567a13
lea eax, [esp + 0x10]
push edi
push eax
call dword [0x5d2614]
lea ecx, [esp + 0x18]
push str..sfl
push ecx
call dword [0x5d24cc]
add esp, 0x10
lea edx, [esp + 0x10]
push edx
push edi
xor esi, esi
call sym.vidcap60.exe_int___stdcall_SfFMMeta_IsMetaFile_unsigned_short_int_const___unsigned_short_int_const__
test eax, eax
je 0x56795a
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test ebp, ebp
mov ebp, dword [esp + 0x224]
je 0x56798b
mov ecx, dword [esp + 0x230]
mov edx, dword [esp + 0x228]
push ecx
push edx
push ebp
lea eax, [esp + 0x1c]
push eax
push edi
call fcn.005677f0
mov esi, eax
test esi, esi
jl 0x567a33
mov ebx, dword [esp + 0x22c]
test ebx, ebx
je 0x567a33
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x567a25
mov eax, dword [esp + 0x220]
test eax, eax
jne 0x5679e7
push ebx
push edi
call fcn.00564df0
mov esi, eax
test esi, esi
jl 0x5679fd
test bh, 4
je 0x5679e7
mov ecx, dword [esp + 0x228]
push ecx
push edi
call fcn.00564bd0
mov esi, eax
test esi, esi
jl 0x5679fd
mov edx, dword [esp + 0x228]
push ebx
push edx
push ebp
push edi
call fcn.00567670
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x208
ret 0x18
pop esi
pop edi
pop ebp
mov eax, 0x80070057
pop ebx
add esp, 0x208
ret 0x18
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.vidcap60.exe__SfErrorHandler_TranslateWin32Error_4
mov esi, eax
mov eax, esi
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x208
ret 0x18
Function at 0x567dc0
Capabilities:
Delete file

Disassembly:
sub esp, 0x208
push ebx
push esi
mov esi, dword [0x5d2620]
push edi
mov edi, dword [esp + 0x218]
test edi, edi
jne 0x567dde
xor ebx, ebx
jmp 0x567de6
push edi
call esi
add esp, 4
mov ebx, eax
xor eax, eax
cmp eax, str..sfl
je 0x567df9
push str..sfl
call esi
add esp, 4
lea ecx, [eax + ebx + 1]
cmp ecx, 0x104
ja 0x567ed2
lea edx, [esp + 0xc]
push edi
push edx
call dword [0x5d2614]
lea eax, [esp + 0x14]
push str..sfl
push eax
call dword [0x5d24cc]
add esp, 0x10
push ebp
lea ecx, [esp + 0x10]
push ecx
xor esi, esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esp + 0x230]
test eax, eax
mov ebp, dword [esp + 0x228]
je 0x567e67
mov edx, dword [esp + 0x224]
push eax
push ebp
push edx
lea eax, [esp + 0x1c]
push eax
push edi
call fcn.005677f0
mov esi, eax
test esi, esi
jl 0x567ef1
mov ebx, dword [esp + 0x22c]
test ebx, ebx
je 0x567ef1
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x567ee3
mov eax, dword [esp + 0x220]
test eax, eax
jne 0x567ea6
push ebx
push edi
call fcn.00564e90
mov esi, eax
test esi, esi
jl 0x567ebc
mov ecx, dword [esp + 0x224]
push ebx
push ebp
push ecx
push edi
call fcn.00567730
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x208
ret 0x18
pop edi
pop esi
mov eax, 0x80070057
pop ebx
add esp, 0x208
ret 0x18
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.vidcap60.exe__SfErrorHandler_TranslateWin32Error_4
mov esi, eax
pop ebp
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x208
ret 0x18
Function at 0x568da0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push 0x18
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
test esi, esi
je 0x568e28
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x14]
push edi
push esi
push 0x5eeff8
push eax
push ecx
call sym.vidcap60.exe__SfLoadResourceCustom_16
test eax, eax
mov dword [esi + 0x14], eax
je 0x568dfa
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
mov dword [esi + 0xc], eax
je 0x568dfa
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push edx
push eax
push 0x6128b4
push esi
call fcn.0056a030
jmp 0x568dff
call sym.vidcap60.exe__SfErrorHandler_GetLastError_0
mov edi, eax
test edi, edi
jge 0x568e21
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalHandle]
push esi
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop ebx
mov eax, edi
pop edi
pop esi
ret 0x10
mov eax, 0x8007000e
pop esi
ret 0x10
Function at 0x5695c0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x24c
push ebp
push esi
mov esi, dword [esp + 0x260]
push 0x104
lea eax, [esp + 0x50]
push eax
push esi
xor ebp, ebp
call sym.vidcap60.exe__SfGetPathNameFromFilePath_12
lea ecx, [esp + 0x4c]
test ecx, ecx
je 0x56960c
mov edx, ecx
push edx
call dword [0x5d2620]
add esp, 4
test eax, eax
je 0x56960c
push ebp
lea eax, [esp + 0x50]
push eax
call sym.vidcap60.exe__SfCreateDirectory_8
test eax, eax
je 0x569736
push ebx
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x569725
push edi
mov edi, dword [esp + 0x264]
xor edx, edx
mov dx, word [edi + 6]
xor eax, eax
mov ax, word [edi + 8]
lea ecx, [esp + 0x2c]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x24], eax
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x24]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
mov esi, dword [esp + 0x260]
mov ecx, dword [edi + 0x20]
mov edx, dword [esi + 8]
mov eax, dword [esi + 0xc]
push 0
push 0
push ecx
push edx
call dword [eax + 4]
mov eax, dword [esi + 0xc]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esi + 8]
push 0x1e
lea edx, [esp + 0x3c]
push edx
push ecx
call dword [eax]
test eax, eax
je 0x56970f
cmp dword [esp + 0x10], 0x1e
jne 0x56970f
mov eax, dword [esp + 0x34]
cmp eax, 0x4034b50
je 0x5696db
cmp eax, 0x30304b50
jne 0x56970f
movzx ecx, word [esp + 0x4e]
movzx eax, word [esp + 0x50]
mov edx, dword [esi + 0xc]
add eax, ecx
mov ecx, dword [edi + 0x20]
push 0
push 0
lea eax, [eax + ecx + 0x1e]
mov ecx, dword [esi + 8]
push eax
push ecx
call dword [edx + 4]
mov edx, dword [esp + 0x26c]
push edx
push edi
push ebx
push esi
call fcn.00568700
mov ebp, eax
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
pop esi
mov eax, ebp
pop ebp
add esp, 0x24c
ret 0x10
pop ebx
pop esi
mov eax, 0x8004e006
pop ebp
add esp, 0x24c
ret 0x10
pop esi
mov eax, 0x8004e006
pop ebp
add esp, 0x24c
ret 0x10

Function at 0x56a490
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x208
push eax
lea ecx, [esp + 4]
push ecx
call dword [0x5d2614]
add esp, 8
push 0x104
lea edx, [esp + 4]
push edx
call sym.vidcap60.exe__SfAddSlashToPathName_8
mov eax, dword [esp + 0x20c]
add eax, 0x54
push eax
lea ecx, [esp + 4]
push ecx
call dword [0x5d24cc]
add esp, 8
lea edx, [esp]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x56a4e4
test al, 0x10
jne 0x56a4f0
push 0
lea eax, [esp + 4]
push eax
call sym.vidcap60.exe__SfCreateDirectory_8
xor eax, eax
add esp, 0x208
ret 8
Function at 0x56a500
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x80c
mov eax, dword [esp + 0x814]
push ebx
push ebp
mov ebp, ecx
xor ebx, ebx
push ebx
mov ecx, eax
lea edx, [esp + 0x14]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x81c]
push edx
sar ecx, 0x1f
mov ecx, dword [ebp + 8]
push eax
push ecx
mov dword [esp + 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x56a6b0
mov eax, dword [ebp + 8]
push esi
mov esi, dword [esp + 0x824]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
lea edx, [esp + 0x14]
push edx
push 0x54
push esi
push eax
call edi
test eax, eax
je 0x56a6ae
cmp dword [esi], 0xb014d55
jne 0x56a6ae
mov eax, dword [esi + 0x34]
cmp eax, ebx
mov dword [esp + 0x14], 1
jle 0x56a6ae
push ebx
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [ebp + 8]
lea edx, [eax + eax]
push edx
lea eax, [esp + 0x28]
push eax
push ecx
call edi
cmp eax, ebx
je 0x56a6ae
mov edx, dword [esi + 0x34]
push 0x104
lea eax, [esp + 0x20]
push eax
lea edi, [esi + 0x54]
push edi
mov word [esp + edx*2 + 0x28], bx
call dword [0x5d2618]
add esp, 0xc
cmp edi, ebx
mov word [edi + 0x206], bx
je 0x56a5d7
push edi
call dword [0x5d2620]
add esp, 4
mov ecx, dword [esi + 0x34]
mov word [esi + ecx*2 + 0x54], bx
mov eax, dword [esi + 0x3c]
cmp eax, ebx
jle 0x56a648
push ebx
lea edx, [esp + 0x14]
push edx
mov edx, dword [ebp + 8]
add eax, eax
push eax
lea ecx, [esp + 0x28]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, ebx
je 0x56a6ae
mov eax, dword [esi + 0x3c]
push 0x104
lea ecx, [esp + 0x20]
push ecx
lea edi, [esi + 0x25c]
push edi
mov word [esp + eax*2 + 0x28], bx
call dword [0x5d2618]
add esp, 0xc
cmp edi, ebx
mov word [edi + 0x206], bx
je 0x56a63d
push edi
call dword [0x5d2620]
add esp, 4
mov edx, dword [esi + 0x3c]
mov word [esi + edx*2 + 0x25c], bx
cmp dword [esi + 0x3c], ebx
jle 0x56a6ae
mov ecx, dword [esi + 0x38]
push ebx
lea eax, [esp + 0x14]
push eax
mov eax, dword [ebp + 8]
shl ecx, 1
push ecx
lea edx, [esp + 0x28]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x56a6ae
mov ecx, dword [esi + 0x38]
push 0x104
lea edx, [esp + 0x20]
push edx
lea edi, [esi + 0x464]
push edi
mov word [esp + ecx*2 + 0x28], bx
call dword [0x5d2618]
add esp, 0xc
cmp edi, ebx
mov word [edi + 0x206], bx
je 0x56a6a3
push edi
call dword [0x5d2620]
add esp, 4
mov eax, dword [esi + 0x38]
mov word [esi + eax*2 + 0x464], bx
pop edi
pop esi
mov eax, dword [esp + 0xc]
pop ebp
pop ebx
add esp, 0x80c
ret 0xc
Function at 0x56abe0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x28
push ebx
mov ebx, dword [esp + 0x3c]
push ebp
push esi
mov esi, dword [esp + 0x48]
push edi
xor ebp, ebp
push 0x40000
push 0x42
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x24], ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ebp
mov dword [esp + 0x3c], esi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
cmp edi, ebp
push ebp
je 0x56adb6
mov eax, dword [esp + 0x48]
mov ebp, dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, eax
lea edx, [esp + 0x1c]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x44]
push edx
sar ecx, 0x1f
mov ecx, dword [esp + 0x44]
push eax
push ecx
call ebp
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x54]
mov edx, eax
push 0
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
push eax
sar edx, 0x1f
mov edx, dword [esp + 0x58]
push ecx
push edx
call ebp
test esi, esi
jl 0x56ad8e
jg 0x56ac90
mov eax, ebx
test eax, eax
jbe 0x56ad8e
jmp 0x56ac90
mov eax, dword [esp + 0x1c]
test eax, eax
jl 0x56ad63
mov ebp, dword [esp + 0x34]
test ebp, ebp
jg 0x56acb2
jl 0x56acae
cmp ebx, 0x40000
jae 0x56acb2
mov esi, ebx
jmp 0x56acb7
mov esi, 0x40000
mov ecx, dword [esp + 0x3c]
push 0
lea eax, [esp + 0x14]
push eax
push esi
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x56ad51
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x20]
xor ecx, ecx
sub ebx, eax
sbb ebp, ecx
add edx, eax
mov eax, dword [esp + 0x24]
push ecx
mov dword [esp + 0x24], edx
lea edx, [esp + 0x14]
push edx
adc eax, ecx
push esi
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x5c]
push edi
push eax
mov dword [esp + 0x48], ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x56ad51
mov esi, dword [esp + 0x14]
mov eax, dword [esi + 0x20]
test eax, eax
je 0x56ad38
mov ecx, eax
mov eax, dword [esp + 0x10]
mov edx, dword [ecx]
push 0
push eax
call dword [edx + 0x10]
mov ecx, dword [esi + 0x20]
call fcn.005979b0
cmp eax, 0x8004e00c
mov dword [esp + 0x1c], eax
je 0x56ad67
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x2c]
add edx, ecx
adc eax, 0
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], eax
test ebp, ebp
jg 0x56ac90
jl 0x56ad63
test ebx, ebx
ja 0x56ac90
mov esi, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
cmp edx, dword [esp + 0x28]
jne 0x56ad7b
mov eax, dword [esp + 0x24]
cmp eax, dword [esp + 0x2c]
je 0x56ad8e
push 0
push str.Block_Copy
push 0xaaaaaaa6
mov ecx, esi
call fcn.0056a380
mov esi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 0x20
mov ecx, dword [esp + 0x18]
push str.Block_Copy
push 0xaaaaaaa3
call fcn.0056a380
pop edi
pop esi
pop ebp
mov eax, 0x8007000e
pop ebx
add esp, 0x28
ret 0x20
Function at 0x56ade0
Capabilities:
Check if file exists
Get file attributes
Get file size
Set file attributes
Timestomp file

Disassembly:
sub esp, 0x20
push ebx
push esi
mov esi, dword [esp + 0x2c]
push edi
push esi
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
push 0
push 3
push 0
push 1
push SysReAllocString
push esi
mov dword [esp + 0x4c], eax
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x56af18
push ebp
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x30]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
mov ebp, dword [esp + 0x38]
push 0
push 0
push 2
push 0
push 3
push 0x40000000
push ebp
call edi
mov edi, eax
cmp edi, 0xffffffff
je 0x56aeed
lea eax, [esp + 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esp + 0x14]
mov edx, eax
or edx, ecx
push 0
je 0x56aebd
push 0
push edi
push ecx
push eax
push 0
push 0
push esi
mov ecx, ebx
call fcn.0056abe0
mov ebx, eax
test ebx, ebx
jl 0x56aed3
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x30]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
mov eax, dword [esp + 0x34]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 0x20
ret 8
push str.FileCopy
push 0xaaaaaaa6
mov ecx, ebx
call fcn.0056a380
mov ebx, 0x8004e00b
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 0x20
ret 8
push 0
push str.FileCopy
push 0xaaaaaaa2
mov ecx, ebx
call fcn.0056a380
push esi
mov ebx, 0x8004e006
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 0x20
ret 8
push 0
push str.FileCopy
push 0xaaaaaaa4
mov ecx, ebx
call fcn.0056a380
pop edi
pop esi
mov eax, 0x8004e006
pop ebx
add esp, 0x20
ret 8
Function at 0x56bef0
Capabilities:
Check if file exists
Enumerate files on windows
Enumerate files recursively
Get file attributes

Disassembly:
sub esp, 0x870
push ebx
mov ebx, dword [esp + 0x87c]
push ebp
push esi
xor ebp, ebp
test ebx, ebx
push edi
mov dword [esp + 0x10], ecx
mov edi, 1
je 0x56c07c
mov ecx, dword [esp + 0x884]
push 0x104
lea eax, [esp + 0x67c]
push eax
push ecx
call sym.vidcap60.exe__SfGetPathNameFromFilePath_12
lea edx, [esp + 0x678]
push edx
lea eax, [esp + 0x474]
push eax
call dword [0x5d2614]
add esp, 8
push 0x104
lea ecx, [esp + 0x474]
push ecx
call sym.vidcap60.exe__SfAddSlashToPathName_8
lea edx, [esp + 0x470]
push ebx
push edx
call dword [0x5d24cc]
add esp, 8
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x474]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [esp + 0x14], eax
je 0x56c066
mov esi, dword [esp + 0x88c]
test edi, edi
je 0x56c062
mov edi, dword [0x5d24c4]
lea edx, [esp + 0x44]
push 0x5d8fd8
push edx
call edi
add esp, 8
test eax, eax
je 0x56c04b
lea eax, [esp + 0x44]
push 0x5e86f8
push eax
call edi
add esp, 8
test eax, eax
je 0x56c04b
lea ecx, [esp + 0x678]
push ecx
lea edx, [esp + 0x26c]
push edx
call dword [0x5d2614]
add esp, 8
push 0x104
lea eax, [esp + 0x26c]
push eax
call sym.vidcap60.exe__SfAddSlashToPathName_8
lea ecx, [esp + 0x44]
push ecx
lea edx, [esp + 0x26c]
push edx
call dword [0x5d24cc]
add esp, 8
test esi, esi
je 0x56c04a
test byte [esp + 0x18], 0x10
je 0x56c04a
push 0x104
lea eax, [esp + 0x26c]
push eax
call sym.vidcap60.exe__SfAddSlashToPathName_8
mov ecx, dword [esp + 0x890]
inc ecx
push ecx
mov ecx, dword [esp + 0x14]
push esi
push ebx
lea edx, [esp + 0x274]
push edx
call fcn.0056bef0
add ebp, eax
inc ebp
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov edi, eax
jmp 0x56bf92
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x870
ret 0x10
mov esi, dword [esp + 0x884]
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push esi
call edi
cmp eax, 0xffffffff
je 0x56c0a7
test al, 0x10
jne 0x56c0a7
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x870
ret 0x10
push esi
call edi
cmp eax, 0xffffffff
je 0x56c06d
test al, 0x10
je 0x56c06d
mov ecx, dword [esp + 0x10]
push 0
push 1
push 0x5e8700
push esi
call fcn.0056bef0
pop edi
pop esi
pop ebp
inc eax
pop ebx
add esp, 0x870
ret 0x10
Function at 0x56c520
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xa44
push ebx
push ebp
xor eax, eax
push esi
mov esi, ecx
mov edx, dword [esi + 0x18]
push edi
mov ecx, 0xe
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
mov eax, dword [esi + 0x10a8]
mov ecx, dword [esp + 0xa5c]
mov edi, dword [esi + 0x1c]
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x10ac]
xor ebx, ebx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0xa58]
sub edx, eax
sbb edi, ecx
mov dword [esp + 0x2c], edi
lea edi, [esi + 0x68]
cmp edi, ebx
mov dword [esp + 0x14], 0xc054d55
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x28], edx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
jne 0x56c594
mov dword [esp + 0x40], ebx
jmp 0x56c5a2
push edi
call dword [0x5d2620]
add esp, 4
mov dword [esp + 0x40], eax
lea eax, [esi + 0x868]
cmp eax, ebx
jne 0x56c5b2
mov dword [esp + 0x44], ebx
jmp 0x56c5c0
push eax
call dword [0x5d2620]
add esp, 4
mov dword [esp + 0x44], eax
mov eax, dword [esi + 0x10a0]
mov ecx, dword [esi + 0x10a4]
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x40], eax
push 0x38
lea eax, [esp + 0x20]
mov dword [esp + 0x48], ecx
mov ecx, dword [esi + 0xc]
push eax
push ecx
mov dword [esp + 0x24], ebx
call ebp
mov edx, dword [esp + 0x10]
mov ecx, dword [esi + 0x18]
add ecx, edx
mov edx, dword [esi + 0x1c]
adc edx, ebx
cmp eax, ebx
mov dword [esi + 0x18], ecx
mov dword [esi + 0x1c], edx
je 0x56c6ee
cmp dword [esp + 0x40], ebx
jle 0x56c681
push 0x400
lea eax, [esp + 0x258]
push edi
push eax
call dword [0x5d2618]
lea ecx, [esp + 0x260]
add esp, 0xc
test ecx, ecx
mov word [esp + 0xa52], bx
je 0x56c649
mov edx, ecx
push edx
call dword [0x5d2620]
add esp, 4
mov ecx, dword [esp + 0x40]
push ebx
lea eax, [esp + 0x14]
push eax
lea edx, [ecx + ecx]
mov ecx, dword [esi + 0xc]
push edx
lea eax, [esp + 0x260]
push eax
push ecx
call ebp
cmp eax, ebx
je 0x56c6fd
mov ecx, dword [esi + 0x18]
mov edx, dword [esp + 0x10]
mov eax, dword [esi + 0x1c]
add ecx, edx
adc eax, ebx
mov dword [esi + 0x18], ecx
mov dword [esi + 0x1c], eax
cmp dword [esp + 0x44], ebx
jle 0x56c6ee
push 0x104
lea eax, [esi + 0x868]
push eax
lea eax, [esp + 0x54]
push eax
call dword [0x5d2618]
lea ecx, [esp + 0x58]
add esp, 0xc
test ecx, ecx
mov word [esp + 0x252], bx
je 0x56c6bd
mov edx, ecx
push edx
call dword [0x5d2620]
add esp, 4
mov ecx, dword [esp + 0x44]
push ebx
lea eax, [esp + 0x14]
push eax
lea edx, [ecx + ecx]
mov ecx, dword [esi + 0xc]
push edx
lea eax, [esp + 0x58]
push eax
push ecx
call ebp
test eax, eax
je 0x56c6fd
mov ecx, dword [esi + 0x18]
mov edx, dword [esp + 0x10]
mov eax, dword [esi + 0x1c]
add ecx, edx
adc eax, ebx
mov dword [esi + 0x18], ecx
mov dword [esi + 0x1c], eax
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xa44
ret 8
push ebx
push str.AddEndOfCentralDir
push 0xaaaaaaa9
mov ecx, esi
call fcn.0056a380
pop edi
pop esi
pop ebp
mov eax, 0x8004e009
pop ebx
add esp, 0xa44
ret 8
Function at 0x56c9e0
Capabilities:
Get file size

Disassembly:
sub esp, 0x218
push ebx
mov ebx, dword [esp + 0x220]
mov eax, dword [ebx + 0x24]
push ebp
or ebp, 0xffffffff
test eax, eax
mov dword [esp + 0x14], ebp
je 0x56cad2
mov eax, dword [ebx + 8]
test eax, eax
je 0x56ca1e
lea ecx, [esp + 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [esp + 0xc]
mov ebp, eax
mov dword [esp + 0x14], edx
mov eax, dword [ebx + 0x10a8]
cmp eax, 1
jbe 0x56cad2
push edi
mov edi, 2
cmp eax, edi
jb 0x56cad1
push esi
lea esp, [esp]
lea eax, [esp + 0x20]
push eax
push edi
lea eax, [ebx + 0x868]
push eax
mov ecx, ebx
call fcn.0056a300
push 0
push 0
push 3
push 0
push 0
push SysReAllocString
lea ecx, [esp + 0x38]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x56caba
lea edx, [esp + 0x14]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esp + 0x1c]
add ebp, eax
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x14]
adc ecx, eax
push esi
mov dword [esp + 0x20], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebx + 0x10a8]
inc edi
cmp edi, eax
jbe 0x56ca40
mov edx, dword [esp + 0x1c]
pop esi
pop edi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x218
ret 4
lea ecx, [esp + 0x20]
push ecx
push str.GetArchiveSize
push 0xaaaaaaad
mov ecx, ebx
call fcn.0056a380
pop esi
pop edi
mov edx, dword [esp + 0x14]
mov eax, ebp
pop ebp
pop ebx
add esp, 0x218
ret 4

Function at 0x56ceb0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x88
push edi
mov edi, dword [esp + 0x90]
mov eax, dword [edi + 0x24]
test eax, eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0
je 0x56cf7f
push esi
mov esi, dword [esp + 0x98]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x56cf4c
test al, 0x10
je 0x56cf4c
lea eax, [esp + 8]
push eax
push edi
call sym.vidcap60.exe_public:_long_int___stdcall_CArchive2::GetSizeExtractAll_long_long___int64___
test eax, eax
jl 0x56cf31
push 0x400
push esi
call sym.vidcap60.exe__SfGetDiskFreeSpace_8
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push 0
push 0x400
push ecx
push edx
mov esi, eax
call fcn.005c4520
xor ecx, ecx
cmp edx, ecx
jg 0x56cf3c
jl 0x56cf2f
cmp eax, esi
ja 0x56cf3c
xor eax, eax
pop esi
pop edi
add esp, 0x88
ret 0xc
pop esi
mov eax, 1
pop edi
add esp, 0x88
ret 0xc
push 0x40
lea eax, [esp + 0x14]
push eax
push esi
call sym.vidcap60.exe__SfGetRootPathFromFilePath_12
lea ecx, [esp + 0x10]
push ecx
push str.IsSpaceForExtractAll
push 0xaaaaaaa8
mov ecx, edi
call fcn.0056a380
pop esi
mov eax, 0x8004e00d
pop edi
add esp, 0x88
ret 0xc
mov eax, 0x80004005
pop edi
add esp, 0x88
ret 0xc