joyce8/EMBER2024-capa huggingface dataset:
Function at 0x460aa0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0xc
test eax, eax
je 0x460ab1
mov dword [eax], 0
push ebx
mov ebx, dword [esp + 0x14]
lea eax, [esp + 4]
push eax
push 0x6c726468
push ebx
mov dword [esp + 0x10], 0
call sym.vidcap60.exe__riff_FindListChunkFromStart_12
test eax, eax
jl 0x460b63
mov eax, dword [esp + 4]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
mov esi, eax
push 1
and esi, 1
push 0
add esi, eax
push esi
push ebx
call ebp
push 0
lea ecx, [esp + 0x20]
push ecx
push 8
lea edx, [esp + 0x1c]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x460bfe
cmp dword [esp + 0x1c], 8
jne 0x460bfe
cmp dword [esp + 0x10], 0x4b4e554a
push edi
lea edi, [esi + 0xc]
jne 0x460b36
mov eax, dword [esp + 0x18]
mov ecx, eax
and ecx, 1
add ecx, eax
lea edi, [edi + ecx + 8]
push 1
push 0
mov edx, 0xffffffec
sub edx, esi
push edx
push ebx
call ebp
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
test esi, esi
jne 0x460b6a
pop edi
pop esi
mov eax, 0x8007000e
pop ebp
pop ebx
add esp, 0xc
ret 0xc
push 0
lea eax, [esp + 0x24]
push eax
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x460bce
cmp dword [esp + 0x20], edi
jne 0x460bce
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push ecx
push edx
push esi
mov ecx, edi
call fcn.00460910
test eax, eax
mov dword [esp + 0x28], eax
jl 0x460bd6
push 1
push 0
mov eax, edi
neg eax
push eax
push ebx
call ebp
push 0
lea ecx, [esp + 0x24]
push ecx
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x460bc4
cmp dword [esp + 0x20], edi
je 0x460bd6
mov dword [esp + 0x28], 0x8004e009
jmp 0x460bd6
mov dword [esp + 0x28], 0x8004e008
mov edi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
push esi
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [esp + 0x28]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0xc
pop esi
pop ebp
mov eax, 0x8004e008
pop ebx
add esp, 0xc
ret 0xc

Function at 0x461a00
Capabilities:
Get disk size

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x10
push esi
xor esi, esi
push esi
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x14]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x461a30
mov dword [esp + 4], esi
mov dword [esp + 8], esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push eax
push ecx
push edx
call sym.vidcap60.exe__SfGetByteSizeText2_12
pop esi
add esp, 0x10
ret 8
Function at 0x461f80
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 4]
sub esp, 8
push ebx
push edi
xor edi, edi
xor ebx, ebx
test eax, eax
je 0x461fd7
cmp word [eax], bx
je 0x461fd7
push esi
push ebx
push ebx
push 3
push ebx
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x461fca
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, dword [esp + 0x10]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov eax, edi
pop edi
mov edx, ebx
pop ebx
add esp, 8
ret 4
mov eax, edi
pop edi
mov edx, ebx
pop ebx
add esp, 8
ret 4

Function at 0x462150
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push edi
mov edi, dword [esp + 0x1c]
test edi, edi
mov word [esp + 4], 0x5c
mov word [esp + 6], 0x2f
mov word [esp + 8], 0x3a
mov word [esp + 0xa], 0x2a
mov word [esp + 0xc], 0x7c
mov word [esp + 0xe], 0x22
mov word [esp + 0x10], 0x3f
mov word [esp + 0x12], 0x3c
mov word [esp + 0x14], 0x3e
mov word [esp + 0x16], 0xa
je 0x4621b0
push edi
call dword [0x5d2620]
add esp, 4
test eax, eax
jne 0x4621b9
xor eax, eax
pop edi
add esp, 0x14
ret 4
push esi
xor esi, esi
test eax, eax
jle 0x4621d8
mov dx, word [edi + esi*2]
xor ecx, ecx
cmp word [esp + ecx*2 + 8], dx
je 0x4621e5
inc ecx
cmp ecx, 0xa
jl 0x4621c6
inc esi
cmp esi, eax
jl 0x4621c0
pop esi
mov eax, 1
pop edi
add esp, 0x14
ret 4
pop esi
xor eax, eax
pop edi
add esp, 0x14
ret 4

Function at 0x4622f0
Capabilities:
Delete file

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x410
push esi
push eax
lea ecx, [esp + 8]
push ecx
xor esi, esi
call dword [0x5d2614]
add esp, 8
push 0x104
lea edx, [esp + 8]
push edx
call sym.vidcap60.exe__SfAddSlashToPathName_8
push 0x104
lea eax, [esp + 0x210]
push eax
push 0x5d49c0
lea ecx, [esp + 0x10]
push ecx
call sym.vidcap60.exe__SfCreateTempFileAndName_16
test eax, eax
jl 0x46234e
lea edx, [esp + 0x20c]
push edx
mov esi, 1
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, esi
pop esi
add esp, 0x410
ret 4

Function at 0x462780
Capabilities:
Check if file exists
Delete file

Disassembly:
push esi
push edi
call fcn.00479ff0
mov edi, dword [esp + 0xc]
mov esi, eax
cmp byte [esi], 0
mov dword [esp + 0xc], edi
je 0x4627b4
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.0044af00
test byte [eax + 0x18], 2
jne 0x4627b4
push 0
push 1
push edi
mov ecx, esi
call fcn.0047a840
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, eax
test esi, esi
jne 0x4627d1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
mov eax, 1
je 0x4627d3
mov eax, esi
pop edi
pop esi
ret 4
Function at 0x4627e0
Capabilities:
Move file

Disassembly:
push ebp
push esi
push edi
call fcn.00479ff0
mov ebp, dword [esp + 0x10]
mov esi, eax
cmp byte [esi], 0
mov dword [esp + 0x10], ebp
je 0x462815
lea eax, [esp + 0x10]
push eax
mov ecx, esi
call fcn.0044af00
test byte [eax + 0x18], 2
jne 0x462815
push 0
push 1
push ebp
mov ecx, esi
call fcn.0047a840
cmp byte [esi], 0
mov edi, dword [esp + 0x14]
mov dword [esp + 0x10], edi
je 0x462840
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call fcn.0044af00
test byte [eax + 0x18], 2
jne 0x462840
push 0
push 1
push edi
mov ecx, esi
call fcn.0047a840
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_MoveFileW]
pop edi
pop esi
pop ebp
ret 8
Function at 0x462df0
Capabilities:
Get disk information

Disassembly:
sub esp, 0x444
mov eax, dword [esp + 0x448]
push ebx
push ebp
push esi
push edi
push 0x4d1
xor esi, esi
push eax
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], esi
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
call sym.vidcap60.exe__SfErrorHandler_DetailsInit_0
mov ebp, dword [sym.imp.USER32.dll_SendMessageW]
push esi
push esi
push 0x1004
push edi
call ebp
xor ebx, ebx
test eax, eax
mov dword [esp + 0x18], eax
jle 0x462f91
lea esp, [esp]
push 0xf000
push ebx
push 0x102c
push edi
call ebp
shr eax, 0xc
dec eax
je 0x462f7c
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push edx
inc ecx
push ebx
mov dword [esp + 0x1c], ecx
push 0x1073
lea ecx, [esp + 0x50]
push edi
mov dword [esp + 0x34], 0
mov dword [esp + 0x44], 0x104
mov dword [esp + 0x40], ecx
call ebp
push 0x104
lea eax, [esp + 0x250]
push eax
lea ecx, [esp + 0x4c]
push ecx
call sym.vidcap60.exe__SfGetRootPathFromFilePath_12
test eax, eax
je 0x462f54
lea edx, [esp + 0x24c]
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
add eax, 0xfffffffe
cmp eax, 4
ja case.0x462ec0.5
jmp dword [eax*4 + 0x462fe4]
mov ecx, dword [0x613f28]
lea eax, [esp + 0x44]
push eax
push 0x62a
push ecx
jmp 0x462f64
mov eax, dword [0x613f28]
lea edx, [esp + 0x44]
push edx
push 0x62b
push eax
call sym.vidcap60.exe__SfGetString_8
push eax
push 0x80004005
call sym.vidcap60.exe_SfErrorHandler_DetailsAddString
add esp, 0xc
mov esi, 1
mov eax, dword [esp + 0x24c]
cmp ax, 0x41
jb 0x462f7c
cmp ax, 0x5a
ja 0x462f7c
lea ecx, [eax - 0x41]
mov eax, 1
shl eax, cl
test dword [esp + 0x10], eax
je 0x462f3b
mov edx, dword [0x613f28]
lea ecx, [esp + 0x44]
push ecx
push 0x62d
push edx
jmp 0x462f64
or dword [esp + 0x10], eax
jmp 0x462f7c
mov ecx, dword [0x613f28]
lea eax, [esp + 0x44]
push eax
push 0x62c
push ecx
jmp 0x462f64
mov eax, dword [0x613f28]
lea edx, [esp + 0x44]
push edx
push 0x62c
push eax
call sym.vidcap60.exe__SfGetString_8
push eax
push 0x80004005
call sym.vidcap60.exe_SfErrorHandler_DetailsAddString
add esp, 0xc
mov esi, 1
mov eax, dword [esp + 0x18]
inc ebx
cmp ebx, eax
jl 0x462e40
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x462fb5
mov ecx, dword [0x613f28]
push 0x62e
push ecx
call sym.vidcap60.exe__SfGetString_8
push eax
push 0x80004005
call sym.vidcap60.exe_SfErrorHandler_DetailsAddString
add esp, 8
mov esi, 1
pop edi
test esi, esi
pop esi
pop ebp
mov eax, 1
pop ebx
je 0x462fdb
mov edx, dword [esp + 0x448]
push eax
push 0
push 0x4e005
push 0x2b
push 0x31
push edx
call sym.vidcap60.exe__SfErrorHandler_MsgBox_24
add esp, 0x444
ret 4
Function at 0x4636d0
Capabilities:
Log keystrokes via polling

Disassembly:
movzx eax, word [esi + 0xc]
add eax, 0xffffffda
sub esp, 8
cmp eax, 0x53
ja case.0x4636ea.39
movzx eax, byte [eax + 0x46380c]
jmp dword [eax*4 + 0x4637f0]
push 0
push 0x4ba
push 0x111
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
add esp, 8
ret
push 0
push 0x4d4
push 0x111
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
add esp, 8
ret
push 0
push 0x4bb
push 0x111
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
add esp, 8
ret
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge case.0x4636ea.39
xor ecx, ecx
cmp word [esi + 0xc], 0x26
push 0
setne cl
add ecx, 0x4bc
push ecx
push 0x111
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
add esp, 8
ret
mov edx, dword [esi]
push 1
push edx
call fcn.00422f50
mov edx, dword [esi]
lea ecx, [esp]
push ecx
push eax
push edx
call fcn.00422f80
mov ecx, dword [esi]
push 1
lea eax, [esp + 4]
push eax
push 0
push ecx
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov edx, dword [esp + 4]
mov eax, dword [esp]
push edx
push eax
push edi
call fcn.004634e0
add esp, 8
ret
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge case.0x4636ea.39
mov ecx, dword [esi]
push 1
push ecx
call fcn.00422f50
lea edx, [esp]
push edx
push eax
mov eax, dword [esi]
push eax
call fcn.00422f80
mov edx, dword [esi]
push 1
lea ecx, [esp + 4]
push ecx
push 0
push edx
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov eax, dword [esp + 4]
mov ecx, dword [esp]
push eax
push ecx
push edi
call fcn.004634e0
add esp, 8
ret
Function at 0x464210
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xf8
push ebx
push ebp
push esi
mov esi, dword [esp + 0x108]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x1009
mov ebx, ecx
push esi
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x20], 1
call edi
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
lea eax, [ebx + 4]
push eax
mov dword [esp + 0x1c], 3
mov dword [esp + 0x38], 0x13
mov dword [esp + 0x44], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [ebx + 0x1c]
mov eax, dword [ecx]
xor ebp, ebp
test eax, eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x14], ebp
jle 0x4643a8
mov edx, dword [ebx + 0x1c]
mov eax, dword [edx + 8]
mov eax, dword [eax + ebp*4]
mov dword [esp + 0x44], eax
add eax, 4
mov dword [esp + 0x2c], eax
jne 0x4642c0
mov dword [esp + 0x30], 0
jmp 0x4642ce
push eax
call dword [0x5d2620]
add esp, 4
mov dword [esp + 0x30], eax
lea ecx, [esp + 0x18]
push ecx
push 0
push 0x104d
push esi
call edi
cmp eax, 0xffffffff
je 0x46438f
mov ebp, dword [esp + 0x2c]
mov ebx, dword [esp + 0x1c]
push ebp
call fcn.004622f0
test eax, eax
je 0x464320
lea edx, [esp + 0xc8]
push edx
push ebp
call fcn.00461a00
lea eax, [esp + 0xc8]
lea ecx, [esp + 0x50]
mov dword [esp + 0x58], 1
mov dword [esp + 0x64], eax
push ecx
jmp 0x46433e
lea edx, [esp + 0xa0]
mov dword [esp + 0xa8], 1
mov dword [esp + 0xb4], 0x5d49c0
push edx
push ebx
push 0x1074
push esi
call edi
mov ecx, dword [esp + 0x44]
mov ebx, dword [ecx]
xor eax, eax
test ebx, ebx
setne al
lea edx, [esp + 0x78]
push edx
mov dword [esp + 0x8c], 0xf000
inc eax
shl eax, 0xc
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0x20]
push eax
push 0x102b
push esi
call edi
mov eax, dword [esp + 0x1c]
mov ebx, dword [esp + 0x4c]
mov ebp, dword [esp + 0x14]
inc eax
mov dword [esp + 0x1c], eax
jmp 0x464397
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x48]
inc ebp
cmp ebp, eax
mov dword [esp + 0x14], ebp
jl 0x4642a0
mov eax, dword [esp + 0x40]
mov ecx, dword [ebx + 0x24]
mov edx, dword [esp + 0x110]
push eax
mov dword [edx + 0x14], ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf8
ret 8
Function at 0x4651b0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x84
push ebx
push ebp
movzx ebp, word [esp + 0x94]
push esi
mov esi, eax
mov eax, dword [esp + 0x9c]
mov ebx, dword [eax]
push edi
push esi
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
push 0
push 0
push 0x623
push esi
mov edi, eax
call dword [sym.imp.USER32.dll_SendMessageW]
cmp edi, 0x4d3
mov ecx, eax
mov dword [esp + 0x10], ecx
jne 0x4652c0
cmp ebp, 9
mov eax, dword [ebx + 0x16d4]
je 0x465208
cmp ebp, 8
jne 0x465222
push 0x40
lea edx, [esp + 0x18]
push edx
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0
lea eax, [esp + 0x18]
push eax
call sym.vidcap60.exe__SfTextToDWordToken_8
mov ecx, dword [esp + 0x9c]
push eax
push 1
push 1
push esi
push ecx
push 0x115
call sym.vidcap60.exe__Spinner_DefScrollProc_24
mov esi, eax
cmp esi, 5
jae 0x465248
mov esi, 5
jmp 0x465255
cmp esi, 0x400
jbe 0x465255
mov esi, 0x400
cmp esi, dword [ebx + 0x16d4]
je 0x4652a3
mov edx, dword [esp + 0x10]
push esi
push 0x5da4a0
push edx
mov dword [ebx + 0x16d4], esi
call sym.vidcap60.exe_SfSetWindowText
mov edi, dword [esp + 0xa4]
add esp, 0xc
push 0
push edi
push 0x468
push edi
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esp + 0xa0]
mov dword [eax + 0x10], 1
jmp 0x4652aa
mov edi, dword [esp + 0x98]
push 0x4d1
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ecx, eax
push edi
mov eax, esi
call fcn.00464160
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x84
ret 0xc
Function at 0x46a680
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
push 0
push 0
push 0x188
push esi
call ebx
push 0
push 0
push 0x18b
push esi
mov edi, eax
call ebx
mov ebp, eax
movzx eax, word [esp + 0x1c]
sub eax, 0x26
je 0x46a6f7
sub eax, 2
jne 0x46a6ee
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x46a6e6
dec ebp
cmp edi, ebp
jge 0x46a6d3
push 1
push esi
call fcn.0046a510
push 0
push 0
push 0x188
push esi
call ebx
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
inc edi
lea eax, [ebp - 1]
cmp edi, eax
jg 0x46a6f0
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x46a70c
test edi, edi
je 0x46a6d3
push 0xffffffffffffffff
jmp 0x46a6cd
dec edi
jns 0x46a6ee
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0xc
Function at 0x4707d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x4c
xor eax, eax
push ebx
mov dword [esp + 0xc], eax
push ebp
mov dword [esp + 0x14], eax
mov ebx, dword [esp + 0x68]
push esi
xor ecx, ecx
mov dword [esp + 0x1c], eax
push edi
mov edi, dword [esp + 0x74]
mov dword [esp + 0x24], eax
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x28], eax
mov dword [esp + 0x40], ecx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x44], ecx
mov dword [esp + 0x30], eax
xor ebp, ebp
mov dword [esp + 0x48], ecx
mov esi, edi
imul esi, esi, 0x2ee0
mov dword [esp + 0x34], eax
mov dword [esp + 0x4c], ecx
cmp edi, 6
sete al
mov dword [esp + 0x50], ecx
mov dword [esp + 0x54], ecx
lea edx, [esp + 0x70]
push edx
mov edx, dword [esp + 0x68]
mov dword [esp + 0x5c], ecx
mov ecx, dword [esp + 0x6c]
push eax
mov eax, dword [esp + 0x74]
push ecx
push edx
push eax
mov dword [esp + 0x28], ebp
mov dword [esp + 0x4c], ebp
mov dword [esp + 0x84], ebx
mov dword [esp + 0x24], esi
call fcn.004706f0
mov cl, byte [esp + 0x79]
mov al, byte [esp + 0x70]
and cl, 0xf
cmp cl, 0xf
je 0x470883
mov cl, byte [esp + 0x78]
mov dl, al
sub dl, bl
xor dl, cl
and dl, 0x3f
xor cl, dl
mov byte [esp + 0x78], cl
mov cl, byte [esp + 0x81]
and cl, 0xf
cmp cl, 0xf
je 0x4708a8
mov cl, byte [esp + 0x80]
sub al, bl
xor al, cl
and al, 0x3f
xor cl, al
mov byte [esp + 0x80], cl
cmp edi, ebp
mov dword [esp + 0x70], ebp
jle 0x4709ad
mov ebp, dword [esp + 0x60]
or ebx, 0xffffffff
mov eax, 4
sub ebx, esi
sub eax, esi
mov dword [esp + 0x6c], eax
jmp 0x4708d0
mov esi, dword [esp + 0x10]
mov edi, edi
add ebp, 0x1e0
lea edx, [esi + ebp + 4]
xor esi, esi
lea esp, [esp]
mov edi, dword [esp + 0x6c]
add edi, edx
mov byte [ebx + edx], 0xff
mov dword [ebp + 4], 0xffffffff
xor eax, eax
mov ecx, 0x12
rep stosd dword es:[edi], eax
lea eax, [edx - 4]
mov dword [esp + esi + 0x14], ebp
mov dword [esp + esi + 0x38], eax
mov byte [edx - 1], 0xff
mov dword [edx], 0xffffffff
lea edi, [edx + 4]
xor eax, eax
add esi, 4
mov ecx, 0x12
add ebp, 0x500
add edx, 0x500
cmp esi, 0x24
rep stosd dword es:[edi], eax
jl 0x4708e0
mov edx, dword [esp + 0x70]
test edx, 1
jne 0x470945
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
jmp 0x47094d
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0x78]
mov dword [eax + 4], esi
mov esi, dword [esp + 0x74]
mov byte [eax + 3], 0x50
mov eax, dword [esp + 0x7c]
mov byte [ecx + 3], 0x51
mov dword [ecx + 4], eax
lea ecx, [edx + esi]
test ecx, 1
jne 0x47097c
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
jmp 0x470984
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov edi, dword [esp + 0x80]
mov byte [eax + 3], 0x50
mov dword [eax + 4], edi
mov eax, dword [esp + 0x84]
inc edx
cmp edx, esi
mov byte [ecx + 3], 0x51
mov dword [ecx + 4], eax
mov dword [esp + 0x70], edx
jl 0x4708ca
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c
ret 0x28
Function at 0x473c90
Capabilities:
Check mutex on windows

Disassembly:
push esi
push 0xf8
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x473cd6
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push ecx
push edx
push str.sfwriter
mov ecx, eax
call fcn.004739e0
mov esi, eax
test esi, esi
jne 0x473ce9
mov ecx, dword [esp + 0xc]
mov eax, 0x8007000e
mov dword [ecx], eax
mov eax, esi
pop esi
ret 8
mov ecx, dword [esp + 0xc]
mov eax, 0x8007000e
xor esi, esi
mov dword [ecx], eax
mov eax, esi
pop esi
ret 8
push ebx
push edi
push str.sfwriter.mutex
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, eax
test edi, edi
je 0x473e25
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x2710
push edi
call ebx
cmp eax, 0x102
jne 0x473d25
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x473e25
push str.RenderEvent
push 0
push 0
mov dword [esi + 0xa4], edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
call edi
test eax, eax
mov dword [esi + 0xb0], eax
je 0x473e25
push str.NonRenderEvent
push 0
push 1
push 0
call edi
test eax, eax
mov dword [esi + 0xb4], eax
je 0x473e25
push 0x5e5f08
push 0
push 1
push 0
call edi
test eax, eax
mov dword [esi + 0xac], eax
je 0x473e25
push 0
push 0
push 0
push SysReAllocString
push 0xffffffffffffffff
push 0xffffffffffffffff
push 4
lea edx, [esi + 0xa0]
push edx
call sym.vidcap60.exe__SfList_CreateExZ_32
mov edi, eax
test edi, edi
jl 0x473e2a
lea eax, [esp + 0x10]
push eax
push 0
push esi
push 0x473680
push 0
push 0
mov dword [esi + 0xa8], 0
call dword [0x5d2520]
add esp, 0x18
cmp eax, 0xffffffff
je 0x473e25
mov ecx, dword [esi + 0xb4]
push 0x1d4c0
push ecx
call ebx
cmp eax, 0x102
je 0x473e25
mov edx, dword [esi + 0xb4]
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea ebx, [esi + 0x70]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, dword [esi + 0xa8]
xor eax, eax
cmp edx, 1
sete al
push ebx
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test ebp, ebp
pop ebp
jne 0x473e41
mov dword [esi + 0xa8], 4
mov edi, 0x80004005
mov edx, dword [esi]
push 1
mov ecx, esi
call dword [edx + 0xc]
mov ecx, dword [esp + 0x14]
mov dword [ecx], edi
pop edi
pop ebx
xor eax, eax
pop esi
ret 8
mov edx, dword [esp + 0x14]
mov dword [edx], edi
pop edi
pop ebx
mov eax, esi
pop esi
ret 8
Function at 0x4805d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
call sym.vidcap60.exe__SfGetLocale_0
xor ebx, ebx
xor edx, edx
xor ecx, ecx
mov edi, edi
cmp eax, dword [ecx + 0x61021c]
je 0x4805f3
add ecx, 0xc
inc edx
cmp ecx, 0x18
jb 0x4805e0
jmp 0x4805fd
lea eax, [edx + edx*2]
mov ebx, dword [eax*4 + 0x610220]
mov ecx, dword [esp + 0x14]
mov esi, dword [ecx + 0x1c]
mov edi, dword [esp + 0x10]
push esi
push 0xffffffffffffffeb
push edi
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov eax, dword [esi + 0x74]
test eax, eax
je 0x480636
push 0x8001
push 0
push 0
push edi
call dword [sym.imp.USER32.dll_GetParent]
push eax
call sym.vidcap60.exe__SfWndCenter_16
mov dword [esi + 0x74], 0
mov eax, dword [0x621c80]
push 0
movzx edx, bx
push 2
push edx
push eax
lea edi, [esi + 0x80]
call sym.vidcap60.exe__SfLoadResourceCustom_16
test eax, eax
je 0x480674
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test edi, edi
je 0x480687
mov ecx, dword [eax + 4]
mov dword [edi], ecx
mov edx, dword [eax + 8]
mov dword [edi + 4], edx
mov dword [esi + 0x7c], eax
pop edi
mov eax, esi
pop esi
pop ebx
ret 8
test edi, edi
je 0x480685
mov dword [edi + 4], 0
mov dword [edi], 0
xor eax, eax
mov dword [esi + 0x7c], eax
pop edi
mov eax, esi
pop esi
pop ebx
ret 8

Function at 0x4806a0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x18
push ebx
push ebp
push esi
push edi
push eax
call dword [sym.imp.USER32.dll_GetParent]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
push 1
push esi
call edi
push 2
push esi
mov ebx, eax
call edi
mov ebp, dword [sym.imp.USER32.dll_GetWindowLongW]
mov edi, eax
push 0xfffffffffffffff0
push edi
call ebp
test eax, 0x10000000
je 0x480738
push 0
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
lea ecx, [esp + 0x18]
push ecx
push edi
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x10]
push ecx
push esi
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
call dword [sym.imp.USER32.dll_ScreenToClient]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push 5
push 0
push 0
push edx
push eax
push 0
push ebx
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0xffffffffffffffec
push esi
call ebp
and eax, 0xfffffbff
push eax
push 0xffffffffffffffec
push esi
call dword [sym.imp.USER32.dll_SetWindowLongW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4