joyce8/EMBER2024-capa huggingface dataset:
Function at 0x572ac0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x418
push ebx
mov ebx, dword [esp + 0x430]
push ebp
push esi
mov esi, dword [esp + 0x428]
mov eax, dword [esi + 0x24]
xor ebp, ebp
cmp eax, 1
mov dword [esi + 0x1094], ebx
je 0x572c5c
cmp eax, 3
je 0x572c5c
push edi
mov edi, dword [esp + 0x430]
push ebx
push edi
push esi
call sym.vidcap60.exe_public:_long_int___stdcall_CArchive2::IsSpaceForAddEntry_unsigned_short_int_const___unsigned_long_int_
test eax, eax
jne 0x572c37
cmp dword [esi + 0x20], eax
je 0x572b87
push 0x104
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
lea eax, [esp + 0x1c]
push edi
push eax
call dword [0x5d2618]
lea ecx, [esp + 0x24]
add esp, 0xc
test ecx, ecx
mov word [esp + 0x21e], bp
je 0x572b49
mov edx, ecx
push edx
call dword [0x5d2620]
add esp, 4
test byte [esi + 0x1094], 2
je 0x572b61
mov ecx, dword [esi + 0x20]
lea eax, [esp + 0x18]
push eax
call fcn.00597b50
jmp 0x572b87
push ebx
lea ecx, [esp + 0x14]
push ecx
push edi
push esi
call sym.vidcap60.exe_public:_long_int___stdcall_CArchive2::GetSizeAddEntry_unsigned_short_int_const___long_long___int64____unsigned_long_int_
mov ecx, dword [esi + 0x20]
mov edx, dword [ecx]
mov ebp, eax
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [esp + 0x14]
push eax
lea eax, [esp + 0x20]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x434]
mov edx, dword [esp + 0x438]
push 0x104
lea eax, [esp + 0x224]
push eax
push edi
mov dword [esi + 0x1094], ebx
mov dword [esi + 0x28], ecx
mov dword [esi + 0x2c], edx
call sym.vidcap60.exe__SfGetPathNameFromFilePath_12
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
mov ebx, dword [esp + 0x440]
je 0x572be2
test al, 0x10
je 0x572be2
test ebx, ebx
jne 0x572be2
push ebx
lea ecx, [esp + 0x224]
push ecx
push edi
mov ecx, esi
call fcn.00570ab0
jmp 0x572c13
push edi
call sym.vidcap60.exe__SfDoesFileExist_4
test eax, eax
je 0x572bff
push ebx
lea edx, [esp + 0x224]
push edx
push edi
mov ecx, esi
call fcn.005703d0
jmp 0x572c13
test ebx, ebx
jne 0x572c15
lea eax, [esp + 0x220]
push eax
push edi
mov ecx, esi
call fcn.005720e0
mov ebp, eax
mov esi, dword [esi + 0x20]
test esi, esi
je 0x572c28
mov edx, dword [esi]
push 0xaaaaaaf
mov ecx, esi
call dword [edx + 0xc]
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x418
ret 0x18
push 0
push str.AddEntryToArchive
push 0xaaaaaaa8
mov ecx, esi
call fcn.0056a380
pop edi
pop esi
pop ebp
mov eax, 0x8004e0c8
pop ebx
add esp, 0x418
ret 0x18
push 0
push str.AddEntryToArchive
push 0xaaaaaaa1
mov ecx, esi
call fcn.0056a380
pop esi
pop ebp
mov eax, 0x80004005
pop ebx
add esp, 0x418
ret 0x18
Function at 0x5762e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xec
fld qword [0x5d6138]
push ebx
fld qword [0x5d8c90]
mov ebx, eax
push esi
fxch st(1)
push edi
xor eax, eax
mov ecx, 0xfa
mov edi, ebx
rep stosd dword es:[edi], eax
lea eax, [ebx + 0x1f8]
mov edx, eax
mov ecx, 2
push eax
fstp qword [edx]
lea esi, [esp + 0xbc]
mov dword [ebx], ecx
fstp qword [edx + 8]
lea edx, [ebx + 0x208]
fld qword [0x5d92f0]
mov dword [ebx + 4], ecx
fld qword [0x5d8c90]
fxch st(1)
fstp qword [edx]
fstp qword [edx + 8]
call fcn.005733f0
fld qword [ebp + 8]
fmul qword [0x5ef758]
fld qword [ebp + 0x10]
fadd st(0), st(0)
fdivr qword [0x5d92f0]
fmul st(1)
fldl2e
fmulp st(1)
fld st(0)
frndint
fxch st(1)
fsub st(1)
f2xm1
fld1
faddp st(1)
fscale
fstp st(1)
fstp qword [esp + 0x30]
fst qword [esp + 0x10]
fld qword [0x5d6138]
fdiv qword [ebp + 0x10]
fld st(1)
fsub st(1)
fstp qword [esp + 0x18]
fadd st(1)
fst qword [esp + 0x28]
fld qword [esp + 0x18]
fcomp qword [0x5d8c90]
fnstsw ax
test ah, 5
jp 0x5763ad
fld qword [0x5d8c90]
fstp qword [esp + 0x18]
fcomp qword [0x5eb140]
fnstsw ax
test ah, 0x41
jne 0x5763c4
fld qword [0x5eb140]
fstp qword [esp + 0x28]
fld st(0)
xor edi, edi
fcos
lea eax, [ebx + 0x18]
mov dword [esp + 0x24], edi
mov dword [esp + 0x20], eax
add ebx, 8
fstp qword [esp + 0x48]
fsin
fstp qword [esp + 0x50]
fld qword [esp + 0x10]
mov edx, dword [esp + 0x20]
fcos
mov ecx, ebx
push ebx
lea esi, [esp + 0x7c]
fld qword [esp + 0x14]
fsin
fxch st(1)
fstp qword [esp + 0x3c]
fstp qword [esp + 0x44]
fld qword [esp + 0x3c]
fmul qword [esp + 0x34]
fld qword [esp + 0x44]
fmul qword [esp + 0x34]
fld st(1)
fstp qword [ecx]
fst qword [ecx + 8]
mov ecx, 2
fxch st(1)
fstp qword [esp + 0x6c]
fchs
fld qword [esp + 0x6c]
fstp qword [edx]
fstp qword [edx + 8]
call fcn.005733f0
fld qword [esp + 0x48]
sub esp, 0x10
mov eax, esp
push ecx
fstp qword [eax]
fld qword [esp + 0x64]
mov ecx, esi
push ecx
fstp qword [eax + 8]
push 2
lea edx, [esp + 0xd4]
push edx
lea eax, [esp + 0x78]
push eax
call fcn.00576b60
fld qword [esp + 0x60]
fdiv qword [esp + 0x58]
fld st(0)
fabs
fcomp qword [0x5ef750]
fnstsw ax
test ah, 5
jnp 0x5764b5
fcomp qword [0x5d8c90]
fld qword [esp + 0x10]
fnstsw ax
test ah, 0x41
jne 0x57648f
fstp qword [esp + 0x28]
jmp 0x576493
fstp qword [esp + 0x18]
fld qword [esp + 0x28]
inc edi
cmp edi, 0x32
fadd qword [esp + 0x18]
fmul qword [0x5d8c68]
fstp qword [esp + 0x10]
jl 0x5763e2
mov eax, dword [esp + 0x24]
jmp 0x5764bc
fstp st(0)
mov eax, 1
xor ecx, ecx
test eax, eax
setne cl
pop edi
pop esi
pop ebx
dec ecx
and ecx, 0x80004005
mov eax, ecx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x580420
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x800
push esi
mov esi, dword [esp + 0x808]
cmp dword [esi + 4], 1
jne 0x580488
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x580488
mov ecx, dword [esi + 8]
push ebx
push ebp
push edi
push 0x400
lea eax, [esp + 0x14]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov edi, dword [esi + 0x40]
mov ebx, dword [esi + 0x3c]
lea edx, [esp + 0x10]
push edx
push 3
push edi
push ebx
lea eax, [esi + 0x1cc]
push eax
call dword [esi + 0x210]
mov ebp, eax
push ebp
push edi
push ebx
push esi
call fcn.0057fc20
pop edi
test ebp, ebp
pop ebp
pop ebx
je 0x580488
push 7
push esi
call fcn.0057f0e0
cmp dword [esi + 4], 3
jae 0x580496
push 0
push esi
call fcn.005800e0
pop esi
add esp, 0x800
ret 4

Function at 0x581d90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x30
push ebp
push esi
mov esi, dword [esp + 0x3c]
mov eax, dword [esi + 0x44]
mov ebp, dword [eax]
push edi
xor edi, edi
test ebp, ebp
jle 0x581ea3
push ebx
lea ebx, [ebx]
mov ecx, dword [esi + 0x44]
mov edx, dword [ecx + 8]
mov ebx, dword [edx + edi*4]
mov ecx, dword [ebx + 4]
lea eax, [esp + 0x20]
push eax
push ecx
push esi
call fcn.0057f210
test eax, eax
jne 0x581dd7
mov eax, dword [esi + 0x78]
mov dword [esp + 0x28], eax
mov dword [esp + 0x20], eax
mov eax, dword [ebx]
lea edx, [esp + 0x20]
push edx
push eax
push esi
call fcn.0057f2b0
test eax, eax
jne 0x581df2
mov eax, dword [esi + 0x7c]
mov dword [esp + 0x24], eax
jmp 0x581df6
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
dec edx
mov dword [esp + 0x20], edx
mov edx, dword [esp + 0x24]
inc ecx
dec edx
mov dword [esp + 0x28], ecx
inc eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], edx
mov dword [esp + 0x2c], eax
mov edx, dword [ebx + 0xc]
push ecx
push edx
push esi
call fcn.0057f210
test eax, eax
jne 0x581e34
mov eax, dword [esi + 0x78]
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], eax
mov ecx, dword [ebx + 8]
lea eax, [esp + 0x10]
push eax
push ecx
push esi
call fcn.0057f2b0
test eax, eax
jne 0x581e50
mov eax, dword [esi + 0x7c]
mov dword [esp + 0x14], eax
jmp 0x581e54
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
dec ecx
inc ebx
dec edx
inc eax
mov dword [esp + 0x14], edx
lea edx, [esp + 0x10]
mov dword [esp + 0x1c], eax
push edx
lea eax, [esp + 0x24]
mov dword [esp + 0x14], ecx
push eax
lea ecx, [esp + 0x38]
push ecx
mov dword [esp + 0x24], ebx
call dword [sym.imp.USER32.dll_UnionRect]
mov eax, dword [esi]
push 1
lea edx, [esp + 0x34]
push edx
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
inc edi
cmp edi, ebp
jl 0x581db0
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x30
ret 4
Function at 0x581eb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x50
push ebx
push esi
mov esi, dword [esp + 0x5c]
mov eax, dword [esi + 0x44]
mov eax, dword [eax]
xor ebx, ebx
test eax, eax
mov dword [esp + 0x5c], eax
jle 0x58201b
push ebp
push edi
mov edi, dword [sym.imp.USER32.dll_InvalidateRect]
mov ecx, dword [esi + 0x44]
mov edx, dword [ecx + 8]
mov ebp, dword [edx + ebx*4]
mov ecx, dword [ebp + 4]
lea eax, [esp + 0x20]
push eax
push ecx
push esi
call fcn.0057f210
test eax, eax
jne 0x581efb
mov eax, dword [esi + 0x78]
mov dword [esp + 0x28], eax
mov dword [esp + 0x20], eax
mov eax, dword [ebp]
lea edx, [esp + 0x20]
push edx
push eax
push esi
call fcn.0057f2b0
test eax, eax
jne 0x581f17
mov eax, dword [esi + 0x7c]
mov dword [esp + 0x24], eax
jmp 0x581f1b
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
dec edx
mov dword [esp + 0x20], edx
mov edx, dword [esp + 0x24]
inc ecx
dec edx
mov dword [esp + 0x28], ecx
inc eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], edx
mov dword [esp + 0x2c], eax
mov edx, dword [ebp + 0xc]
push ecx
push edx
push esi
call fcn.0057f210
test eax, eax
jne 0x581f59
mov eax, dword [esi + 0x78]
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], eax
mov ecx, dword [ebp + 8]
lea eax, [esp + 0x10]
push eax
push ecx
push esi
call fcn.0057f2b0
test eax, eax
jne 0x581f75
mov eax, dword [esi + 0x7c]
mov dword [esp + 0x14], eax
jmp 0x581f79
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
mov ebp, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
dec ecx
inc ebp
dec edx
inc eax
mov dword [esp + 0x14], edx
lea edx, [esp + 0x10]
mov dword [esp + 0x1c], eax
push edx
lea eax, [esp + 0x24]
mov dword [esp + 0x14], ecx
push eax
lea ecx, [esp + 0x38]
push ecx
mov dword [esp + 0x24], ebp
call dword [sym.imp.USER32.dll_UnionRect]
mov eax, dword [esi]
push 1
lea edx, [esp + 0x34]
push edx
push eax
call edi
mov ecx, dword [esi + 0x74]
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x38]
xor ebp, ebp
inc ecx
mov dword [esp + 0x4c], ecx
push 1
lea ecx, [esp + 0x44]
mov dword [esp + 0x44], edx
mov edx, dword [esi]
push ecx
push edx
mov dword [esp + 0x50], ebp
mov dword [esp + 0x54], eax
call edi
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x3c]
mov edx, dword [esi + 0x70]
mov dword [esp + 0x54], eax
push 1
lea eax, [esp + 0x54]
mov dword [esp + 0x60], ecx
mov ecx, dword [esi]
push eax
inc edx
push ecx
mov dword [esp + 0x5c], ebp
mov dword [esp + 0x64], edx
call edi
mov eax, dword [esp + 0x64]
inc ebx
cmp ebx, eax
jl 0x581ed4
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x50
ret 4
Function at 0x58c670
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x58c67d
xor eax, eax
ret 0xc
push ebp
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x18]
cmp edi, 8
not esi
jb 0x58c775
mov ebp, edi
shr ebp, 3
xor edx, edx
mov dl, byte [ecx]
mov eax, esi
shr eax, 8
sub edi, 8
xor edx, esi
and edx, 0xff
mov esi, dword [edx*4 + 0x5f0c90]
xor edx, edx
mov dl, byte [ecx + 1]
xor eax, esi
inc ecx
xor edx, eax
and edx, 0xff
mov esi, dword [edx*4 + 0x5f0c90]
xor edx, edx
mov dl, byte [ecx + 1]
shr eax, 8
xor eax, esi
inc ecx
xor edx, eax
and edx, 0xff
mov esi, dword [edx*4 + 0x5f0c90]
xor edx, edx
mov dl, byte [ecx + 1]
shr eax, 8
xor eax, esi
inc ecx
xor edx, eax
and edx, 0xff
mov esi, dword [edx*4 + 0x5f0c90]
xor edx, edx
mov dl, byte [ecx + 1]
shr eax, 8
xor eax, esi
inc ecx
xor edx, eax
and edx, 0xff
mov esi, dword [edx*4 + 0x5f0c90]
shr eax, 8
xor eax, esi
xor edx, edx
mov dl, byte [ecx + 1]
inc ecx
xor edx, eax
and edx, 0xff
mov esi, dword [edx*4 + 0x5f0c90]
shr eax, 8
xor eax, esi
xor edx, edx
mov dl, byte [ecx + 1]
inc ecx
xor edx, eax
and edx, 0xff
mov esi, dword [edx*4 + 0x5f0c90]
shr eax, 8
xor eax, esi
xor edx, edx
mov dl, byte [ecx + 1]
inc ecx
xor edx, eax
and edx, 0xff
mov esi, dword [edx*4 + 0x5f0c90]
shr eax, 8
xor eax, esi
inc ecx
dec ebp
mov esi, eax
jne 0x58c698
test edi, edi
je 0x58c79b
lea esp, [esp]
xor eax, eax
mov al, byte [ecx]
xor eax, esi
and eax, 0xff
mov ebp, dword [eax*4 + 0x5f0c90]
shr esi, 8
xor esi, ebp
inc ecx
dec edi
jne 0x58c780
pop edi
mov eax, esi
pop esi
not eax
pop ebp
ret 0xc
Function at 0x594380
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0xd], 0xca
jne 0x5943af
push esi
call fcn.005a5170
mov al, byte [esi + 0x79]
test al, al
je 0x5943a8
mov dword [esi + 0xd], 0xcf
mov al, 1
pop esi
ret 4
mov dword [esi + 0xd], 0xcb
mov eax, dword [esi + 0xd]
cmp eax, 0xcb
jne 0x594427
mov eax, dword [esi + 0x1b9]
mov cl, byte [eax + 0x10]
test cl, cl
je 0x594412
mov eax, dword [esi + 8]
test eax, eax
je 0x5943d0
push esi
call dword [eax]
mov ecx, dword [esi + 0x1b9]
push esi
call dword [ecx]
test eax, eax
je 0x59440c
cmp eax, 2
je 0x594412
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x5943c6
cmp eax, 3
je 0x5943f3
cmp eax, 1
jne 0x5943c6
inc dword [ecx + 4]
mov eax, dword [esi + 8]
mov edx, dword [eax + 4]
cmp edx, dword [eax + 8]
jl 0x5943c6
mov ecx, dword [esi + 0x145]
add dword [eax + 8], ecx
jmp 0x5943c6
xor al, al
pop esi
ret 4
mov edx, dword [esi + 0xae]
mov dword [esi + 0xb6], edx
call fcn.00594040
pop esi
ret 4
cmp eax, 0xcc
je 0x594444
mov eax, dword [esi]
mov dword [eax + 0x14], 0x12
mov ecx, dword [esi]
mov edx, dword [esi + 0xd]
mov dword [ecx + 0x18], edx
mov eax, dword [esi]
push esi
call dword [eax]
call fcn.00594040
pop esi
ret 4

Function at 0x596960
Capabilities:
Read file on windows

Disassembly:
mov ecx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
push 0
lea eax, [esp + 0x10]
push eax
push 8
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x596985
cmp dword [esp + 0xc], 8
je 0x59698e
mov eax, 0x8004e008
pop esi
ret 8
push 2
push esi
call sym.vidcap60.exe__iff_ByteSwap32_8
xor eax, eax
pop esi
ret 8

Function at 0x5969a0
Capabilities:
Read file on windows

Disassembly:
mov ecx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
push 0
lea eax, [esp + 0x10]
push eax
push 4
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x5969c5
cmp dword [esp + 0xc], 4
je 0x5969ce
mov eax, 0x8004e008
pop esi
ret 8
push 1
push esi
call sym.vidcap60.exe__iff_ByteSwap32_8
xor eax, eax
pop esi
ret 8

Function at 0x5969e0
Capabilities:
Read file on windows

Disassembly:
mov ecx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
push 0
lea eax, [esp + 0x10]
push eax
push 2
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x596a05
cmp dword [esp + 0xc], 2
je 0x596a0e
mov eax, 0x8004e008
pop esi
ret 8
push ebx
push edi
mov eax, esi
lea edi, [esi + 2]
mov dl, byte [eax + 1]
mov ecx, eax
mov bl, byte [ecx]
lea esi, [eax + 1]
add eax, 2
cmp eax, edi
mov byte [esi], bl
mov byte [ecx], dl
jb 0x596a15
pop edi
pop ebx
xor eax, eax
pop esi
ret 8
Function at 0x596a40
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
push ebx
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
lea ecx, [esp + 4]
push esi
lea ebx, [ebx]
mov dl, byte [ecx + 3]
mov eax, ecx
mov bl, byte [eax]
lea esi, [ecx + 3]
mov byte [eax], dl
mov dl, byte [eax + 2]
mov byte [esi], bl
mov bl, byte [eax + 1]
mov byte [eax + 2], bl
mov byte [eax + 1], dl
add ecx, 4
lea eax, [esp + 0x10]
cmp ecx, eax
jb 0x596a60
mov eax, dword [esp + 0x14]
push 0
lea ecx, [esp + 0x1c]
push ecx
push 8
lea edx, [esp + 0x14]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, dword [esp + 0x18]
xor eax, eax
cmp esi, 8
sete al
pop esi
pop ebx
dec eax
and eax, 0x8004e009
add esp, 8
ret 8

Function at 0x596ac0
Capabilities:
Write file on windows

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
mov dword [esp], eax
mov byte [esp + 3], al
shr eax, 0x18
mov byte [esp], al
mov eax, dword [esp]
mov ecx, dword [esp]
push 0
shr eax, 0x10
lea edx, [esp + 0x10]
push edx
shr ecx, 8
mov byte [esp + 9], al
push 4
lea eax, [esp + 0xc]
mov byte [esp + 0xe], cl
mov ecx, dword [esp + 0x14]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0xc]
xor eax, eax
cmp ecx, 4
sete al
dec eax
and eax, 0x8004e009
pop ecx
ret 8

Function at 0x596b20
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 8]
mov edx, dword [esp + 4]
mov dword [esp + 8], eax
push 0
mov byte [esp + 0xd], al
mov byte [esp + 0xc], ah
lea eax, [esp + 8]
push eax
push 2
lea ecx, [esp + 0x14]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 4]
xor eax, eax
cmp ecx, 2
sete al
dec eax
and eax, 0x8004e009
ret 8

Function at 0x596b60
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
push 0
lea eax, [esp + 0x14]
push eax
push 8
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x596ba0
cmp dword [esp + 0x10], 8
jne 0x596ba0
push 2
push esi
call sym.vidcap60.exe__iff_ByteSwap32_8
cmp dword [esi], 0x464f524d
je 0x596baa
pop edi
mov eax, 0x8004e00b
pop esi
ret 0xc
pop edi
mov eax, 0x8004e008
pop esi
ret 0xc
mov ecx, dword [esp + 0x14]
push ecx
push edi
call sym.vidcap60.exe__iff_ReadDWORD_8
pop edi
pop esi
ret 0xc
Function at 0x596bf0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0x14]
push ebx
push esi
push edi
xor edi, edi
test eax, eax
je 0x596c14
mov edi, dword [eax]
test eax, eax
je 0x596c14
cmp edi, 8
jb 0x596c9d
mov edx, dword [ebp + 8]
push 0
lea eax, [esp + 0x10]
push eax
push 8
lea ecx, [esp + 0x1c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x596cad
cmp dword [esp + 0xc], 8
jne 0x596cad
lea ecx, [esp + 0x10]
jmp 0x596c40
mov dl, byte [ecx + 3]
mov eax, ecx
mov bl, byte [eax]
lea esi, [ecx + 3]
mov byte [eax], dl
mov dl, byte [eax + 2]
mov byte [esi], bl
mov bl, byte [eax + 1]
mov byte [eax + 2], bl
mov byte [eax + 1], dl
add ecx, 4
lea eax, [esp + 0x18]
cmp ecx, eax
jb 0x596c40
mov ecx, dword [ebp + 0xc]
mov eax, dword [esp + 0x10]
sub edi, 8
cmp eax, ecx
je 0x596cbb
mov eax, dword [esp + 0x14]
test al, 1
mov esi, eax
je 0x596c80
lea esi, [eax + 1]
mov edx, dword [ebp + 8]
push 1
push 0
push esi
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x14], esi
sub edi, esi
jmp 0x596c07
mov dword [eax], edi
mov eax, 0x8004e00a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, 0x8004e008
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x596cc8
mov ecx, dword [esp + 0x14]
mov dword [eax], ecx
test edi, edi
je 0x596cd1
mov edx, dword [ebp + 0x14]
mov dword [edx], edi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x596f70
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x28
push ebx
push esi
push edi
mov edi, dword [esp + 0x40]
xor ebx, ebx
test edi, edi
je 0x596f82
mov dword [edi], ebx
mov esi, dword [esp + 0x38]
push 0
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x18]
push ecx
push esi
call sym.vidcap60.exe__iff_ReadFormType_12
test eax, eax
jge 0x596fb2
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x28
ret 0xc
mov eax, dword [esp + 0x40]
cmp eax, 0x41494646
je 0x597052
cmp eax, 0x41494643
jne 0x597065
test edi, edi
je 0x596fd6
mov dword [edi], 1
lea edx, [esp + 0xc]
push edx
push esi
call sym.vidcap60.exe__riff_SaveLocation_8
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x38]
push ecx
lea edx, [esp + 0x14]
push edx
push 0x434f4d4d
push esi
mov dword [esp + 0x48], eax
call sym.vidcap60.exe__iff_FindChunkHeader_16
test eax, eax
jl 0x597045
push 0
lea eax, [esp + 0x3c]
push eax
push 0x16
lea ecx, [esp + 0x28]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov al, byte [esp + 0x31]
mov dl, byte [esp + 0x2e]
mov cl, byte [esp + 0x2f]
mov byte [esp + 0x2e], al
mov al, byte [esp + 0x30]
mov byte [esp + 0x31], dl
mov byte [esp + 0x30], cl
mov byte [esp + 0x2f], al
mov eax, dword [esp + 0x2e]
xor ebx, ebx
cmp eax, 0x4e4f4e45
sete bl
mov edx, dword [esp + 0xc]
push edx
push esi
call sym.vidcap60.exe__riff_RestoreLocation_8
jmp 0x597057
mov ebx, 1
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x597065
mov ecx, dword [esp + 0x18]
mov dword [eax], ecx
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 0x28
ret 0xc
Function at 0x597390
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
nop
push 0
lea eax, [esp + 0x10]
push eax
push 8
lea ecx, [esp + 0x1c]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x59741c
cmp dword [esp + 0xc], 8
jne 0x59741c
lea ecx, [esp + 0x10]
mov dl, byte [ecx + 3]
mov eax, ecx
mov bl, byte [eax]
lea esi, [ecx + 3]
mov byte [eax], dl
mov dl, byte [eax + 2]
mov byte [esi], bl
mov bl, byte [eax + 1]
mov byte [eax + 1], dl
add ecx, 4
lea edx, [esp + 0x18]
cmp ecx, edx
mov byte [eax + 2], bl
jb 0x5973c4
mov eax, dword [ebp + 0xc]
cmp dword [esp + 0x10], eax
mov eax, dword [esp + 0x14]
je 0x59742a
test al, 1
je 0x5973ff
inc eax
mov dword [esp + 0x14], eax
push 1
lea ecx, [esp + 0x20]
push ecx
push eax
push edi
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x5973a0
mov eax, 0x8004e008
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [ebp + 0x10]
pop edi
pop esi
mov dword [edx], eax
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x597440
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x18
mov eax, dword [esp + 0x24]
push ebp
push esi
push edi
mov edi, dword [esp + 0x28]
xor esi, esi
push esi
lea ecx, [esp + 0x24]
push ecx
push esi
push edi
mov dword [esp + 0x1c], esi
mov dword [eax], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
lea edx, [esp + 0x2c]
push edx
push 8
lea eax, [esp + 0x20]
push eax
push edi
call ebp
test eax, eax
je 0x5974d0
cmp dword [esp + 0x28], 8
jne 0x5974d0
lea ecx, [esp + 0x14]
push ebx
mov dl, byte [ecx + 3]
mov eax, ecx
mov bl, byte [eax]
lea esi, [ecx + 3]
mov byte [eax], dl
mov dl, byte [eax + 2]
mov byte [esi], bl
mov bl, byte [eax + 1]
mov byte [eax + 1], dl
add ecx, 4
lea edx, [esp + 0x20]
cmp ecx, edx
mov byte [eax + 2], bl
jb 0x597492
cmp dword [esp + 0x18], 0x464f524d
pop ebx
je 0x5974de
pop edi
pop esi
mov eax, 0x8004e080
pop ebp
add esp, 0x18
ret 0xc
pop edi
pop esi
mov eax, 0x8004e008
pop ebp
add esp, 0x18
ret 0xc
push 0
lea eax, [esp + 0x14]
push eax
push 4
lea ecx, [esp + 0x18]
push ecx
push edi
call ebp
cmp dword [esp + 0x10], 4
jne 0x5974c2
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
push edx
push eax
push edi
call sym.vidcap60.exe__iff_SeekChunkHeader_12
xor ecx, ecx
test eax, eax
setge cl
pop edi
pop esi
pop ebp
dec ecx
and ecx, 0x8004e00a
mov eax, ecx
add esp, 0x18
ret 0xc