joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5273b0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esi + 0x8d0]
push 0x10
call ebx
xor ecx, ecx
test ax, ax
mov eax, dword [esi + 0x8d0]
setl cl
push 0x11
shl ecx, 6
xor ecx, eax
and ecx, 0x40
xor eax, ecx
mov dword [esi + 0x8d0], eax
call ebx
mov ecx, dword [esi + 0x8d0]
xor edx, edx
test ax, ax
setl dl
mov ebx, ecx
xor eax, eax
shl edx, 7
xor edx, ecx
and edx, 0x80
xor ebx, edx
mov dword [esi + 0x8d0], ebx
mov esi, ebx
cmp edi, esi
pop edi
pop esi
setne al
pop ebx
ret 4

Function at 0x5275f0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x48
mov ecx, dword [esi + 4]
mov edx, dword [esi + 0x48]
xor eax, eax
mov dword [esp], eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov eax, dword [esi + 0xd30]
test eax, eax
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], 0xa
mov dword [esp + 0x18], eax
je 0x5276e7
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x5276e7
mov dword [eax + 0xc], 1
xor eax, eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov eax, dword [esi + 0xd30]
mov dword [esp + 0x24], 2
mov ecx, dword [eax + 4]
mov edx, dword [ecx + 0x42c]
mov ecx, dword [esi + 0xd38]
mov dword [esp + 0x28], edx
add ecx, 0xd
lea edx, [esp + 0x24]
push edx
mov dword [esp + 0x30], 0
mov dword [esp + 0x44], ecx
mov eax, dword [eax + 4]
mov ecx, dword [eax + 0x428]
push 0
push 0x104c
push ecx
call edi
mov edx, dword [esi + 0xd30]
mov dword [edx + 0xc], 0
mov eax, dword [esi + 0xd30]
mov ecx, dword [eax + 4]
mov dword [ecx + 0x410], 1
mov edx, dword [esi + 0x10]
push 1
push 0x9c64
push 0x402
push edx
call edi
mov ecx, dword [esi + 0x48]
mov edx, dword [esi + 8]
lea eax, [esp + 4]
push eax
push ecx
push 0x4e
push edx
call edi
pop edi
add esp, 0x48
ret
Function at 0x52cf20
Capabilities:
Create thread

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x1278]
test eax, eax
jne 0x52cf60
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x127c], eax
lea eax, [esp + 8]
push eax
push 0
push esi
push 0x52ce70
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x1278], eax
mov ecx, dword [esi + 0x127c]
pop esi
mov dword [esp + 4], ecx
jmp dword [sym.imp.KERNEL32.dll_SetEvent]
Function at 0x553490
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x210
push ebx
mov ebx, dword [esp + 0x220]
push esi
push edi
mov edi, dword [esp + 0x220]
push edi
lea eax, [esp + 0x18]
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerCLSID_s
push eax
mov dword [esp + 0x1c], 0x208
mov word [ebx], 0
call sym.vidcap60.exe_SfPrintF
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
push 0x20019
push 0
lea edx, [esp + 0x20]
push edx
push SysReAllocString
call esi
test eax, eax
je 0x553534
push edi
lea eax, [esp + 0x18]
push str.SoftwareClassesCLSID_s
push eax
call sym.vidcap60.exe_SfPrintF
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
push 0x20019
push 0
lea edx, [esp + 0x20]
push edx
push SysReAllocString
call esi
test eax, eax
je 0x553534
lea eax, [esp + 0xc]
push eax
push 0x20019
push 0
lea ecx, [esp + 0x20]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x553552
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x10]
push edx
push ebx
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [ebx], 0
jne 0x55356a
mov edx, dword [esp + 0x224]
push edx
push ebx
call dword [0x5d2614]
add esp, 8
push ebx
call dword [0x5d2620]
add esp, 4
pop edi
pop esi
pop ebx
add esp, 0x210
ret 0xc

Function at 0x553670
Capabilities:
Get common file path
Get file system object information

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x4bc
push esi
push 0
push eax
lea ecx, [esp + 0xc]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x5536bc
push 0x200
push 0x2b4
lea edx, [esp + 0x214]
push edx
push 0
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
jbe 0x5536bc
lea ecx, [esp + 0x218]
push ecx
jmp 0x5536c4
mov edx, dword [esp + 0x4c8]
push edx
mov esi, dword [esp + 0x4d0]
push esi
call dword [0x5d2614]
add esp, 8
test esi, esi
jne 0x5536e5
xor eax, eax
pop esi
add esp, 0x4bc
ret 0xc
push esi
call dword [0x5d2620]
add esp, 4
pop esi
add esp, 0x4bc
ret 0xc
Function at 0x55ca50
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x14]
test eax, eax
mov dword [esp], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
je 0x55ca78
mov dword [eax], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
mov esi, dword [esp + 0x18]
push 0
push 0
push 0
push esi
call ebx
cmp eax, 0xffffffff
jne 0x55ca9f
pop esi
mov eax, 0x8004e008
pop ebx
add esp, 0xc
ret 8
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea eax, [esp + 0x14]
push eax
push 2
lea ecx, [esp + 0x18]
push ecx
push esi
call edi
test eax, eax
je 0x55cb5d
cmp word [esp + 0xc], 0xd8ff
je 0x55cad6
pop edi
pop esi
mov eax, 0x80004005
pop ebx
add esp, 0xc
ret 8
push 0
lea edx, [esp + 0x14]
push edx
push 2
lea eax, [esp + 0x18]
push eax
push esi
call edi
test eax, eax
je 0x55cb5d
jmp 0x55caf0
mov eax, dword [esp + 0xc]
cmp ax, 0xe0ff
je 0x55cb06
cmp ax, 0xe1ff
je 0x55cb06
cmp ax, 0xe2ff
jne 0x55cb6b
push 0
lea ecx, [esp + 0x14]
push ecx
push 2
lea edx, [esp + 0x20]
push edx
push esi
call edi
test eax, eax
je 0x55cb5d
mov eax, dword [esp + 0x14]
mov byte [esp + 0x1c], ah
mov byte [esp + 0x1d], al
mov eax, dword [esp + 0x1c]
cmp ax, 2
mov dword [esp + 0x14], eax
jbe 0x55cac8
push 1
movzx ecx, ax
push 0
sub ecx, 2
push ecx
push esi
call ebx
cmp eax, 0xffffffff
je 0x55cb5d
push 0
lea edx, [esp + 0x14]
push edx
push 2
lea eax, [esp + 0x18]
push eax
push esi
call edi
test eax, eax
jne 0x55caf0
pop edi
pop esi
mov eax, 0x8004e008
pop ebx
add esp, 0xc
ret 8
push 1
push 0
push 0xfffffffffffffffe
push esi
call ebx
cmp eax, 0xffffffff
je 0x55cb5d
mov ecx, dword [esp + 0x20]
test ecx, ecx
je 0x55cb83
mov dword [ecx], eax
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0xc
ret 8
Function at 0x55d620
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x18]
test eax, eax
push ebx
mov dword [esp + 4], 0
je 0x55d711
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x55d711
xor edx, edx
mov dword [esp + 8], edx
push esi
mov dword [esp + 0x10], edx
push edi
mov dword [esp + 0x18], edx
lea edx, [esp + 0x14]
push edx
lea edx, [esp + 0x16]
push edx
lea edx, [esp + 0x18]
push edx
lea edx, [esp + 0x30]
push edx
lea edx, [esp + 0x1c]
push edx
push eax
call sym.vidcap60.exe_private:_long_int___thiscall_CSfExifMetaDataHelper::CreateIFDEntryData_struct_SFMETA_SUM_TAG___unsigned_char____unsigned_long_int___unsigned_short_int___unsigned_short_int___unsigned_long_int__
mov edi, dword [esp + 0xc]
mov esi, eax
test esi, esi
jl 0x55d6e8
mov edx, dword [esp + 0x24]
cmp edx, 4
jbe 0x55d69d
mov eax, dword [ebx]
mov dword [esp + 0x18], eax
add eax, edx
test edx, 1
mov dword [ebx], eax
je 0x55d6bd
inc eax
mov dword [ebx], eax
jmp 0x55d6bd
xor eax, eax
test edx, edx
jbe 0x55d6bd
xor ecx, ecx
movzx esi, byte [eax + edi]
mov ebx, dword [esp + 0x18]
shl esi, cl
add ecx, 8
add ebx, esi
inc eax
cmp eax, edx
mov dword [esp + 0x18], ebx
jb 0x55d6a5
mov edx, dword [esp + 0x20]
push 0
lea eax, [esp + 0x2c]
push eax
push 0xc
lea ecx, [esp + 0x1c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, eax
neg esi
sbb esi, esi
and esi, 0x7ffb1ff7
add esi, 0x8004e009
test edi, edi
je 0x55d706
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalHandle]
push edi
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x10
ret 0xc
mov eax, 0x80070057
pop ebx
add esp, 0x10
ret 0xc
Function at 0x55dd00
Capabilities:
Get file size
Read file via mapping

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
push ebp
push edi
push 0
push 0
push 3
push 0
push 1
push SysReAllocString
push eax
mov dword [esp + 0x2c], ecx
mov edi, 0x80004005
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x14], ebp
je 0x55de26
push ebx
lea ecx, [esp + 0x24]
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push 0
push 0
push 2
push 0
mov ebx, eax
push ebp
mov dword [esp + 0x38], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
test eax, eax
mov dword [esp + 0x1c], eax
je 0x55de1e
push esi
push 0
push 0
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
mov dword [esp + 0x10], esi
je 0x55de12
add ebx, esi
lea eax, [esi + 2]
cmp eax, ebx
mov dword [esp + 0x14], 0
jae 0x55de07
cmp word [esi], 0xd8ff
jne 0x55de07
lea edx, [eax + 4]
cmp edx, ebx
jae 0x55de07
mov dx, word [eax]
mov cx, word [eax + 2]
add eax, 2
cmp dx, 0xe1ff
mov byte [esp + 0x30], ch
mov byte [esp + 0x31], cl
jne 0x55de30
add eax, 2
lea ebp, [eax + 6]
cmp ebp, ebx
jae 0x55ddfc
mov ecx, 6
mov edi, sym.vidcap60.exe_unsigned_char_const__const_const_CSfExifMetaDataHelper::JpegMarkerApp1ExifIdentifier
mov esi, eax
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x55ddde
sbb edx, edx
sbb edx, 0xffffffff
test edx, edx
jne 0x55ddf8
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x18]
push ebx
push ebp
push eax
call sym.vidcap60.exe_private:_long_int___thiscall_CSfExifMetaDataHelper::AddExifTagsToSummaryList_struct_tSFLIST___unsigned_char_const___unsigned_char_const__
mov dword [esp + 0x14], eax
mov eax, ebx
mov esi, dword [esp + 0x10]
lea edx, [eax + 4]
cmp edx, ebx
jb 0x55dda4
mov ebp, dword [esp + 0x1c]
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
mov eax, edi
pop edi
pop ebp
add esp, 0x1c
ret 8
movzx ecx, word [esp + 0x30]
add eax, ecx
jmp 0x55ddfc
Function at 0x55de40
Capabilities:
Get file size
Read file via mapping

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x14]
push esi
push edi
push 0
push 0
push 3
push 0
push 1
push SysReAllocString
mov esi, 0x80004005
push eax
mov dword [esp + 0x28], ecx
mov dword [esp + 0x24], esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x55dee0
push ebx
push ebp
lea ecx, [esp + 0x1c]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push 0
push 0
push 2
push 0
push edi
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebx, eax
test ebx, ebx
je 0x55ded7
push 0
push 0
push 0
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
je 0x55decc
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x14]
add ebp, esi
push ebp
push esi
push edx
call sym.vidcap60.exe_private:_long_int___thiscall_CSfExifMetaDataHelper::AddExifTagsToSummaryList_struct_tSFLIST___unsigned_char_const___unsigned_char_const__
push esi
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
pop ebx
pop edi
mov eax, esi
pop esi
add esp, 0x10
ret 8
Function at 0x55e1c0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x10
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [esp + 0x20]
push eax
push 2
push sym.vidcap60.exe_unsigned_short_int_const_CSfExifMetaDataHelper::JPEG_MARKER_APP1
push esi
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], 0
call edi
test eax, eax
jne 0x55e1fd
pop edi
mov eax, 0x8004e009
pop esi
add esp, 0x10
ret 8
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebp
push 1
push 0
push 0
push esi
call ebx
mov ebp, eax
cmp ebp, 0xffffffff
je 0x55e30d
push 0
lea ecx, [esp + 0x28]
push ecx
push 2
lea edx, [esp + 0x1c]
push edx
push esi
call edi
test eax, eax
je 0x55e277
push 0
lea eax, [esp + 0x28]
push eax
push 6
push sym.vidcap60.exe_unsigned_char_const__const_const_CSfExifMetaDataHelper::JpegMarkerApp1ExifIdentifier
push esi
call edi
test eax, eax
je 0x55e277
xor ecx, ecx
mov dword [esp + 0x18], ecx
push ecx
lea edx, [esp + 0x28]
push edx
push 8
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x2c], ecx
push esi
mov word [esp + 0x2c], 0x4949
mov word [esp + 0x2e], 0x2a
mov dword [esp + 0x30], 8
call edi
test eax, eax
jne 0x55e286
pop ebp
pop ebx
pop edi
mov eax, 0x8004e009
pop esi
add esp, 0x10
ret 8
mov edi, dword [esp + 0x28]
push 0x55cb90
push 0
push edi
call sym.vidcap60.exe__SfList_HeapSort_12
test eax, eax
jl 0x55e335
lea ecx, [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x18]
push edi
push esi
mov dword [esp + 0x34], 8
call sym.vidcap60.exe_private:_long_int___thiscall_CSfExifMetaDataHelper::Write0thIFD_void___struct_tSFLIST___unsigned_long_int__
test eax, eax
jl 0x55e335
push 1
push 0
push 0
push esi
call ebx
mov edi, eax
cmp edi, 0xffffffff
je 0x55e30d
push 0
push 0
mov edx, edi
push ebp
sub edx, ebp
push esi
mov dword [esp + 0x20], edx
call ebx
cmp eax, 0xffffffff
je 0x55e30d
mov eax, dword [esp + 0x10]
push 0
lea ecx, [esp + 0x28]
push ecx
push 2
lea edx, [esp + 0x1c]
mov byte [esp + 0x34], ah
mov byte [esp + 0x35], al
mov eax, dword [esp + 0x34]
push edx
push esi
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x55e31c
pop ebp
pop ebx
pop edi
mov eax, 0x80004005
pop esi
add esp, 0x10
ret 8
push 0
push 0
push edi
push esi
call ebx
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
dec ecx
and ecx, 0x80004005
mov eax, ecx
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x10
ret 8
Function at 0x55e340
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x14
mov eax, dword [esp + 0x18]
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push 2
push 0xc0000000
mov esi, ecx
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x55e37e
pop edi
pop esi
mov eax, 0x8004e007
pop ebx
add esp, 0x14
ret 8
push ebp
lea ecx, [esp + 0x20]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
cmp dword [esp + 0x20], ebx
jl 0x55e3a4
jg 0x55e39a
cmp ebp, 0xffffffff
jb 0x55e3a4
mov esi, 0x80004005
jmp 0x55e48f
lea edx, [esp + 0x10]
push edx
push edi
mov ecx, esi
call sym.vidcap60.exe_private:_long_int___thiscall_CSfExifMetaDataHelper::FindStartOfNonExifData_void___unsigned_long_int__
mov esi, eax
test esi, esi
jl 0x55e48f
sub ebp, dword [esp + 0x10]
push ebp
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
test ebx, ebx
jne 0x55e3df
mov esi, 0x8007000e
jmp 0x55e48f
push 0
lea eax, [esp + 0x2c]
push eax
push ebp
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x55e3fd
mov esi, 0x8004e008
jmp 0x55e48f
cmp ebp, dword [esp + 0x28]
je 0x55e40d
mov esi, 0x8004e008
jmp 0x55e48f
push 0
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x55e426
mov esi, 0x8004e008
jmp 0x55e48f
push 0
lea ecx, [esp + 0x1c]
push ecx
push 2
push sym.vidcap60.exe_unsigned_short_int_const_CSfExifMetaDataHelper::JPEG_MARKER_SOI
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x55e446
mov esi, 0x8004e009
jmp 0x55e48f
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x14]
push edx
push edi
call sym.vidcap60.exe_private:_long_int___thiscall_CSfExifMetaDataHelper::WriteExifTagsFromSummaryList_void___struct_tSFLIST__
mov esi, eax
test esi, esi
jl 0x55e48f
push 0
lea eax, [esp + 0x1c]
push eax
push ebp
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x55e476
mov esi, 0x8004e009
jmp 0x55e48f
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov esi, eax
neg esi
sbb esi, esi
and esi, 0x7ffb1ff7
add esi, 0x8004e009
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
pop ebp
je 0x55e4b5
mov edi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
push ebx
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x14
ret 8
Function at 0x55f130
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x55f1f8
mov edx, dword [esp + 0x10]
test edx, edx
je 0x55f1f8
push ebx
mov ebx, dword [esp + 0x18]
xor eax, eax
test ebx, ebx
je 0x55f1f3
mov ecx, dword [ebx]
sub ecx, eax
je 0x55f1db
dec ecx
je 0x55f197
dec ecx
jne 0x55f1f3
mov ecx, esi
imul ecx, edx
mov edx, dword [esp + 0xc]
push eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
mov eax, dword [ebx + 4]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x10]
xor edx, edx
div esi
pop ebx
imul eax, esi
pop esi
ret 0x10
mov eax, dword [ebx + 8]
mov ecx, esi
imul ecx, edx
push edi
mov edi, dword [ebx + 4]
sub eax, edi
cmp ecx, eax
jge 0x55f1ab
mov eax, ecx
cdq
idiv esi
test eax, eax
jle 0x55f1d5
mov edx, eax
imul edx, esi
mov esi, dword [ebx + 0xc]
push ebp
mov ecx, edx
mov ebp, ecx
shr ecx, 2
add esi, edi
mov edi, dword [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
add dword [ebx + 4], edx
pop ebp
pop edi
pop ebx
pop esi
ret 0x10
mov ebx, dword [ebx + 4]
test ebx, ebx
je 0x55f1f3
mov ecx, dword [esp + 0xc]
push ebx
push edx
push esi
push ecx
call dword [0x5d25ec]
add esp, 0x10
pop ebx
pop esi
ret 0x10
xor eax, eax
pop esi
ret 0x10

Function at 0x55f200
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esp + 0x10]
xor eax, eax
cmp ecx, eax
je 0x55f26b
mov edx, dword [ecx]
sub edx, eax
je 0x55f24b
dec edx
je 0x55f26b
dec edx
jne 0x55f26b
mov ecx, dword [ecx + 4]
push esi
mov esi, dword [esp + 0xc]
mov edx, esi
imul edx, dword [esp + 0x10]
push eax
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x10]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x14]
xor edx, edx
div esi
imul eax, esi
pop esi
ret 0x10
mov ecx, dword [ecx + 4]
cmp ecx, eax
je 0x55f26b
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 8]
push ecx
mov ecx, dword [esp + 8]
push edx
push eax
push ecx
call dword [0x5d24e8]
add esp, 0x10
ret 0x10
Function at 0x560e40
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x18
push esi
mov esi, dword [esp + 0x20]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
push 0
push esi
call edi
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0xc]
push ecx
push esi
call sym.vidcap60.exe__riff_ReadFileID_12
test eax, eax
jl 0x560f70
push ebx
push ebp
lea edx, [esp + 0x18]
push edx
push esi
call sym.vidcap60.exe__riff_SaveLocation_8
mov ebx, dword [esp + 0x30]
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x28]
push edx
push ebx
push esi
mov dword [esp + 0x30], eax
call sym.vidcap60.exe__riff_FindChunkHeader_16
test eax, eax
mov ebp, dword [esp + 0x38]
jge 0x560f0f
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
push 0
push 0
add ecx, eax
push ecx
push esi
call edi
push ebp
push ebx
push esi
call sym.vidcap60.exe__riff_WriteChunkHeader_12
test eax, eax
jl 0x560f6e
lea ebx, [ebp + 8]
mov ecx, dword [esp + 0x34]
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [esp + 0x20]
push eax
push ebp
push ecx
push esi
call edi
test eax, eax
je 0x560f00
test bl, 1
je 0x560f5b
push 0
lea edx, [esp + 0x20]
push edx
push 1
lea eax, [esp + 0x38]
push eax
push esi
mov byte [esp + 0x40], 0
call edi
test eax, eax
jne 0x560f5a
pop ebp
pop ebx
pop edi
mov eax, 0x8004e009
pop esi
add esp, 0x18
ret 0x14
cmp dword [esp + 0x24], ebp
jae 0x560f53
push 1
push 0
push 0xfffffffffffffff8
push esi
call edi
push 0
lea edx, [esp + 0x20]
push edx
push 4
lea eax, [esp + 0x20]
push eax
push esi
mov dword [esp + 0x28], 0x4b4e554a
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x560f00
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
push 0
push 0
add edx, ecx
push edx
jmp 0x560eb1
xor ebx, ebx
jmp 0x560ec7
inc ebx
test ebx, ebx
mov ecx, dword [esp + 0x3c]
mov dword [ecx], ebx
je 0x560f6c
push ebx
push esi
call sym.vidcap60.exe__riff_UpdateRIFFSize_8
xor eax, eax
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x18
ret 0x14
Function at 0x562b50
Capabilities:
Read file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
push 4
push esi
call edi
push 0
lea eax, [esp + 0x14]
push eax
push 4
lea ecx, [esp + 0x14]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x562b9d
cmp dword [esp + 0x10], 4
jne 0x562b9d
mov edx, dword [esp + 8]
push 0
push 0
add edx, 8
push edx
push esi
call edi
pop edi
xor eax, eax
pop esi
pop ecx
ret 4
pop edi
mov eax, 0x8004e008
pop esi
pop ecx
ret 4

Function at 0x562c00
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
mov esi, dword [esp + 0x18]
and esi, 1
push edi
mov edi, dword [esp + 0x14]
mov byte [esp + 0xf], 0
jbe 0x562c3c
push 0
lea eax, [esp + 0x18]
push eax
push 1
lea ecx, [esp + 0x1b]
push ecx
push edi
call ebx
test eax, eax
je 0x562c81
cmp dword [esp + 0x14], 1
jne 0x562c81
add dword [esp + 0x1c], esi
mov edx, dword [esp + 0x18]
push 0
push 0
push edx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [esp + 0x18]
push eax
push 4
lea ecx, [esp + 0x28]
push ecx
push edi
call ebx
test eax, eax
je 0x562c81
cmp dword [esp + 0x14], 4
jne 0x562c81
mov eax, dword [esp + 0x1c]
add eax, 8
push eax
push edi
mov dword [esp + 0x24], eax
call sym.vidcap60.exe__riff_UpdateRIFFSize_8
pop edi
pop esi
pop ebx
pop ecx
ret 0xc
pop edi
pop esi
mov eax, 0x8004e009
pop ebx
pop ecx
ret 0xc

Function at 0x562db0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x14
push ebx
mov ebx, dword [esp + 0x28]
mov eax, dword [ebx]
push esi
xor esi, esi
cmp eax, esi
jne 0x562dce
pop esi
mov eax, 0x80070057
pop ebx
add esp, 0x14
ret 0x10
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
xor eax, eax
mov dword [esp + 8], eax
push edi
mov edi, dword [esp + 0x24]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
push 0x14
mov dword [esp + 0x1c], eax
push 0x7478746c
mov dword [esp + 0x24], eax
push edi
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], 0x206e6772
mov word [esp + 0x24], si
mov word [esp + 0x26], si
mov word [esp + 0x28], si
mov word [esp + 0x2a], si
call sym.vidcap60.exe__riff_WriteChunkHeader_12
cmp eax, esi
jl 0x562e51
push esi
lea eax, [esp + 0x34]
push eax
push 0x14
lea ecx, [esp + 0x18]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x562e4c
pop edi
pop esi
mov eax, 0x8004e009
pop ebx
add esp, 0x14
ret 0x10
add dword [ebx], 0x1c
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x14
ret 0x10