joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407300
Capabilities:
Encode data using base64

Disassembly:
sub esp, 0x10
mov ecx, dword [esp + 0x18]
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
push esi
mov esi, 3
lea eax, [ecx + ebp - 1]
push edi
mov dword [esp + 0x28], eax
mov eax, ecx
cdq
idiv esi
mov eax, 0x55555556
mov byte [esp + 0x10], 0
mov byte [esp + 0x11], 0
mov byte [esp + 0x12], 0
mov esi, edx
neg esi
sbb esi, esi
imul ecx
mov ecx, edx
and esi, 4
shr ecx, 0x1f
add edx, ecx
lea edx, [esi + edx*4 + 1]
push edx
mov dword [esp + 0x18], edx
call dword [sym.imp.MSVCRT.dll_malloc]
mov edi, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
add esp, 4
xor esi, esi
cmp ebp, ecx
mov dword [edi], eax
mov dword [esp + 0x24], esi
mov ebx, ebp
ja 0x40745f
mov eax, dword [esp + 0x24]
mov ebp, 3
cdq
idiv ebp
mov ebp, edx
mov dl, byte [ebx]
cmp ebp, 2
mov byte [esp + ebp + 0x10], dl
je 0x407394
cmp ebx, ecx
jne 0x40744d
mov al, byte [esp + 0x10]
mov cl, al
and al, 3
shr cl, 2
mov byte [esp + 0x18], cl
mov cl, byte [esp + 0x11]
mov dl, cl
and cl, 0xf
shl al, 4
shr dl, 4
or al, dl
mov byte [esp + 0x19], al
mov al, byte [esp + 0x12]
mov dl, al
and al, 0x3f
shl cl, 2
shr dl, 6
or cl, dl
mov byte [esp + 0x1b], al
mov byte [esp + 0x1a], cl
mov ecx, dword [edi]
mov eax, dword [esp + 0x18]
and eax, 0xff
inc esi
mov dl, byte [eax + 0x4410e8]
mov eax, dword [esp + 0x19]
and eax, 0xff
mov byte [ecx + esi - 1], dl
mov ecx, dword [edi]
inc esi
mov dl, byte [eax + 0x4410e8]
mov byte [ecx + esi - 1], dl
test ebp, ebp
jne 0x407404
mov al, 0x3d
jmp 0x407413
mov eax, dword [esp + 0x1a]
and eax, 0xff
mov al, byte [eax + 0x4410e8]
mov ecx, dword [edi]
inc esi
cmp ebp, 2
mov byte [ecx + esi - 1], al
jge 0x407423
mov al, 0x3d
jmp 0x407433
mov edx, dword [esp + 0x1b]
and edx, 0xff
mov al, byte [edx + 0x4410e8]
mov ecx, dword [edi]
inc esi
mov byte [esp + 0x12], 0
mov byte [esp + 0x11], 0
mov byte [ecx + esi - 1], al
mov ecx, dword [esp + 0x28]
mov byte [esp + 0x10], 0
mov ebp, dword [esp + 0x24]
inc ebp
inc ebx
cmp ebx, ecx
mov dword [esp + 0x24], ebp
jbe 0x407373
mov edx, dword [edi]
mov eax, dword [esp + 0x14]
pop edi
mov byte [edx + esi], 0
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0xc
Function at 0x407d50
Capabilities:
Create process on windows
Get common file path
Get program files directory

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x432a87
push eax
mov dword fs:[0], esp
sub esp, 0x2d4
push esi
mov esi, ecx
call fcn.00408fc0
cmp eax, 1
jne 0x407e0b
lea ecx, [esp + 4]
call sub.MFC42.DLL_CString::CString_1
test esi, esi
mov dword [esp + 0x2e0], 0
je 0x407d97
mov esi, dword [esi + 0x20]
push 0
lea eax, [esp + 0x1d8]
push 0x26
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea ecx, [esp + 0x1d4]
push str.AHNSOFT_ancamera3_ancameraup.exe
push ecx
lea edx, [esp + 0xc]
push str._s_s
push edx
call sub.MFC42.DLL_CString::Format
mov eax, dword [esp + 0x14]
add esp, 0x10
push 5
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp + 4]
mov dword [esp + 0x2e0], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop esi
mov ecx, dword [esp + 0x2d4]
mov dword fs:[0], ecx
add esp, 0x2e0
ret
push 0
lea ecx, [esp + 0xc]
call fcn.0040ca90
lea ecx, [esp + 8]
mov dword [esp + 0x2e0], 1
call sub.MFC42.DLL_CDialog::DoModal
cmp eax, 1
jne 0x407e6c
mov ecx, dword [esi + 0x68]
push 0
push 0
push 0
push 0
push 0
push str.http:__app.ancamera.co.kr_download_ancamera.php
call sub.MFC42.DLL_CHtmlView::Navigate2
cmp dword [esi + 0x1720], 1
jne 0x407e6c
lea eax, [esi + 0xf60]
test eax, eax
je 0x407e5c
mov eax, dword [eax + 0x20]
push 0
push 0
push 0xf5
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [esp + 0x70]
mov dword [esp + 0x2e0], 3
call fcn.0041d7c0
lea ecx, [esp + 0x68]
mov dword [esp + 0x68], 0x436b98
mov dword [esp + 4], ecx
lea ecx, [esp + 0x68]
mov byte [esp + 0x2e0], 4
call sub.MFC42.DLL_CGdiObject::DeleteObject
lea ecx, [esp + 8]
mov dword [esp + 0x68], 0x436b84
mov dword [esp + 0x2e0], 0xffffffff
call sub.MFC42.DLL_CDialog::CDialog
mov ecx, dword [esp + 0x2d8]
pop esi
mov dword fs:[0], ecx
add esp, 0x2e0
ret
Function at 0x40a7a0
Capabilities:
Read .ini file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4330f1
push eax
mov dword fs:[0], esp
sub esp, 0x110
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x16ec], 1
jne 0x40a7d0
mov dword [esi + 0x16ec], ebx
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], bl
mov dword [esi + 0x2230], ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0xc]
stosb byte es:[edi], al
call sub.MFC42.DLL_CString::CString_1
lea eax, [esp + 0x14]
mov ecx, 0x442af0
push eax
mov dword [esp + 0x128], ebx
call fcn.004022f0
push str.ancamcorder.ini
lea ecx, [esp + 0x14]
push eax
push ecx
mov byte [esp + 0x130], 1
call sub.MFC42.DLL_operator_2
mov edx, dword [eax]
lea eax, [esp + 0xc]
push edx
push 0x441c04
push eax
mov byte [esp + 0x130], 2
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea ecx, [esp + 0x10]
mov byte [esp + 0x124], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0x124], bl
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x18]
push ecx
push 0x104
push edx
push str.HIGH
push str.RECORD_SELECT
push str.OPTION
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp eax, 0xffffffff
pop edi
je 0x40a8b8
lea eax, [esp + 0x14]
push 0x441e94
push eax
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 8
test eax, eax
jne 0x40a8ae
mov ecx, dword [esi + 0x20]
push ebx
push ecx
call dword [sym.imp.USER32.dll_KillTimer]
jmp 0x40a8b8
mov edx, dword [esi + 0x64]
mov dword [edx + 0x3c], 1
mov eax, dword [esi + 0x16f4]
mov dword [esi + 0x16f0], ebx
cmp eax, ebx
jne 0x40a8d4
push ebx
push ebx
push 0x441eb0
call sub.MFC42.DLL_AfxMessageBox
lea ecx, [esp + 8]
mov dword [esp + 0x120], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x118]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x11c
ret
Function at 0x40b870
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4332b7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
xor ebx, ebx
push esi
mov dword [esp + 0x14], ebx
push 0x442bbc
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 1
mov dword [esp + 0xc], ebx
mov dword [esp + 0x14], ebx
call sub.MFC42.DLL_CString::CString_3
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 0x10]
lea edx, [esp + 8]
push ecx
mov eax, dword [eax - 8]
push edx
push eax
push ebx
lea ecx, [esp + 0x3c]
mov byte [esp + 0x30], 2
call sub.MFC42.DLL_CString::GetBuffer
push eax
call fcn.0040e330
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
add esp, 0x10
mov byte [ecx + eax], bl
mov edx, dword [esp + 8]
push edx
lea ecx, [esp + 0x10]
call fcn.00430d8a
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.MSVCRT.dll_free]
mov esi, dword [esp + 0x2c]
add esp, 4
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call sub.MFC42.DLL_CString::CString_2
mov dword [esp + 0x14], 1
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x2c]
mov byte [esp + 0x20], bl
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x18]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 8

Function at 0x40b950
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4332f7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
xor ebx, ebx
push esi
mov dword [esp + 0x14], ebx
push 0x442bbc
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 1
mov dword [esp + 0xc], ebx
mov dword [esp + 0x14], ebx
call sub.MFC42.DLL_CString::CString_3
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 0x10]
lea edx, [esp + 8]
push ecx
mov eax, dword [eax - 8]
push edx
push eax
push ebx
lea ecx, [esp + 0x3c]
mov byte [esp + 0x30], 2
call sub.MFC42.DLL_CString::GetBuffer
push eax
call fcn.0040e2b0
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
add esp, 0x10
mov byte [ecx + eax], bl
mov edx, dword [esp + 8]
push edx
lea ecx, [esp + 0x10]
call fcn.00430d8a
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.MSVCRT.dll_free]
mov esi, dword [esp + 0x2c]
add esp, 4
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call sub.MFC42.DLL_CString::CString_2
mov dword [esp + 0x14], 1
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x2c]
mov byte [esp + 0x20], bl
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x18]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 8
Function at 0x40c8b0
Capabilities:
Encode data using base64

Disassembly:
push 0xffffffffffffffff
push 0x43352f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
xor esi, esi
lea ecx, [esp + 4]
mov dword [esp + 8], esi
call sub.MFC42.DLL_CString::CString_1
mov eax, dword [esp + 0x24]
mov dword [esp + 0x14], 1
mov ecx, eax
dec eax
test ecx, ecx
je 0x40ca2a
push ebx
push ebp
push edi
mov edi, dword [esp + 0x2c]
lea ebp, [eax + 1]
mov dl, byte [edi]
mov byte [esp + esi + 0x30], dl
mov bl, byte [esp + 0x31]
inc esi
inc edi
cmp esi, 3
jne 0x40c973
mov al, byte [esp + 0x30]
mov dl, bl
mov cl, al
and al, 3
shl al, 4
shr dl, 4
shr cl, 2
add al, dl
mov byte [esp + 0x2c], cl
mov byte [esp + 0x2d], al
mov al, byte [esp + 0x32]
mov cl, bl
mov dl, al
and cl, 0xf
and al, 0x3f
shl cl, 2
shr dl, 6
add cl, dl
mov byte [esp + 0x2f], al
mov byte [esp + 0x2e], cl
xor esi, esi
mov ecx, dword [0x442c04]
test ecx, ecx
jne 0x40c957
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
jmp 0x40c95f
xor eax, eax
mov al, byte [esp + esi + 0x2c]
add eax, ecx
mov al, byte [eax]
lea ecx, [esp + 0x10]
push eax
call fcn.00430f40
inc esi
cmp esi, 4
jl 0x40c946
xor esi, esi
dec ebp
jne 0x40c8f9
test esi, esi
je 0x40ca27
cmp esi, 3
jge 0x40c9a2
mov ecx, 3
lea edi, [esp + esi + 0x30]
sub ecx, esi
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov bl, byte [esp + 0x31]
mov al, byte [esp + 0x30]
mov dl, bl
mov cl, al
and al, 3
shl al, 4
shr dl, 4
add al, dl
and bl, 0xf
shr cl, 2
mov byte [esp + 0x2d], al
mov al, byte [esp + 0x32]
mov byte [esp + 0x2c], cl
mov cl, al
shl bl, 2
shr cl, 6
add bl, cl
and al, 0x3f
mov byte [esp + 0x2e], bl
lea ebx, [esi + 1]
xor edi, edi
mov byte [esp + 0x2f], al
test ebx, ebx
jle 0x40ca0d
mov ecx, dword [0x442c04]
test ecx, ecx
jne 0x40c9f4
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
jmp 0x40c9fc
xor eax, eax
mov al, byte [esp + edi + 0x2c]
add eax, ecx
mov dl, byte [eax]
lea ecx, [esp + 0x10]
push edx
call fcn.00430f40
inc edi
cmp edi, ebx
jl 0x40c9e3
cmp esi, 3
jge 0x40ca27
mov esi, 4
sub esi, ebx
push 0x3d
lea ecx, [esp + 0x14]
call fcn.00430f40
dec esi
jne 0x40ca19
pop edi
pop ebp
pop ebx
mov esi, dword [esp + 0x1c]
lea eax, [esp + 4]
push eax
mov ecx, esi
call sub.MFC42.DLL_CString::CString_2
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x14], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret 0xc
Function at 0x40cc40
Capabilities:
Access peb ldr_data
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x433580
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
lea eax, [esp + 0x10]
push edi
push eax
mov ecx, 0x442af0
call fcn.004022f0
push str.ancamcorder.ini
lea ecx, [esp + 0x14]
push eax
push ecx
mov dword [esp + 0x34], 0
call sub.MFC42.DLL_operator_2
mov eax, dword [eax]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push eax
push 0
push str.LEFT
push str.AUTOPOS_HISTORY
call esi
lea ecx, [esp + 0x10]
mov edi, eax
call sub.MFC42.DLL_CString::CString
or ebp, 0xffffffff
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], ebp
call sub.MFC42.DLL_CString::CString
lea edx, [esp + 0x10]
mov ecx, 0x442af0
push edx
call fcn.004022f0
push str.ancamcorder.ini
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x30], 1
push eax
call sub.MFC42.DLL_operator_2
mov eax, dword [eax]
push eax
push 0
push 0x4410b8
push str.AUTOPOS_HISTORY
call esi
lea ecx, [esp + 0x14]
mov ebx, eax
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], ebp
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
push ecx
mov ecx, 0x442af0
call fcn.004022f0
push str.ancamcorder.ini
lea edx, [esp + 0x18]
push eax
push edx
mov dword [esp + 0x34], 2
call sub.MFC42.DLL_operator_2
mov eax, dword [eax]
push eax
push 0x3b4
push str.WIDTH
push str.AUTOPOS_HISTORY
call esi
lea ecx, [esp + 0x14]
mov ebp, eax
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 0xffffffff
call sub.MFC42.DLL_CString::CString
lea eax, [esp + 0x1c]
mov ecx, 0x442af0
push eax
call fcn.004022f0
mov dword [esp + 0x28], 3
push str.ancamcorder.ini
lea ecx, [esp + 0x1c]
push eax
push ecx
call sub.MFC42.DLL_operator_2
mov eax, dword [eax]
push eax
push 0x2ac
push str.HEIGHT
push str.AUTOPOS_HISTORY
call esi
lea ecx, [esp + 0x18]
mov esi, eax
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x1c]
mov dword [esp + 0x28], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x20]
add ebp, edi
add esi, ebx
mov dword [eax], edi
mov dword [eax + 0xc], esi
pop edi
mov dword [eax + 8], ebp
pop esi
mov dword [eax + 4], ebx
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 4
Function at 0x40d410
Capabilities:
Create thread

Disassembly:
push esi
push edi
push 0
push 0
push 0
mov esi, ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x442da8], eax
mov ecx, 0x22
xor eax, eax
mov edi, 0x442db0
rep stosd dword es:[edi], eax
push eax
mov dword [0x442d64], eax
mov dword [0x442d5c], eax
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jge 0x40d460
push str.CoInitialize
mov ecx, esi
call fcn.0040d710
pop edi
mov eax, 0x80004005
pop esi
ret 4
mov eax, dword [esp + 0xc]
push 0
push 0x442e68
push eax
call sub.DSOUND.dll_DirectSoundCaptureCreate
test eax, eax
jge 0x40d48b
push str.DirectSoundCaptureCreate
mov ecx, esi
call fcn.0040d710
pop edi
mov eax, 0x80004005
pop esi
ret 4
xor ecx, ecx
push 0x442e38
mov dword [0x442e38], ecx
push 0xf
mov dword [0x442e3c], ecx
mov word [0x442e38], 1
mov dword [0x442e40], ecx
mov dword [0x442e44], ecx
mov word [0x442e48], cx
call fcn.0040d340
push 0x442e38
call fcn.0040cf80
add esp, 0xc
test eax, eax
jge 0x40d4dc
pop edi
mov eax, 0x80004005
pop esi
ret 4
push 0x442d58
push 0
push esi
push 0x40d2d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x442e64], eax
pop edi
neg eax
sbb eax, eax
pop esi
and eax, 0x7fffbffb
add eax, 0x80004005
ret 4
Function at 0x40de40
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, ecx
mov ebx, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [esi + 0x384]
push edi
mov eax, dword [esi + 0x380]
lea edi, [esi + 0x380]
or eax, ecx
jne 0x40de74
lea ecx, [esi + 0x388]
push ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
push edi
call ebx
lea edx, [esp + 0xc]
push edx
call ebx
mov eax, dword [esp + 0xc]
mov ebx, dword [edi]
mov ecx, dword [esp + 0x10]
mov edx, dword [edi + 4]
sub eax, ebx
sbb ecx, edx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
fild qword [esp + 0xc]
fild qword [esi + 0x388]
fdivp st(1)
fdiv dword [esi + 0x164]
fmul qword [0x437668]
call sub.MSVCRT.dll__ftol
cmp eax, 5
jbe 0x40decc
mov ecx, dword [esi + 0xc]
sub eax, 5
cmp ecx, eax
ja 0x40decc
mov dword [esi + 0xc], eax
pop edi
pop esi
mov al, 1
pop ebx
add esp, 8
ret
pop edi
pop esi
xor al, al
pop ebx
add esp, 8
ret

Function at 0x40e130
Capabilities:
Encode data using base64

Disassembly:
sub esp, 0x10
xor ecx, ecx
lea edx, [esp]
push esi
mov esi, dword [esp + 0x18]
push edi
mov al, byte [ecx + esi]
cmp al, 0x41
jl 0x40e152
cmp al, 0x5a
jg 0x40e152
movsx eax, al
sub eax, 0x41
jmp 0x40e18f
cmp al, 0x61
jl 0x40e162
cmp al, 0x7a
jg 0x40e162
movsx eax, al
sub eax, 0x47
jmp 0x40e18f
cmp al, 0x30
jl 0x40e172
cmp al, 0x39
jg 0x40e172
movsx eax, al
add eax, 4
jmp 0x40e18f
cmp al, 0x2b
jne 0x40e17d
mov eax, 0x3e
jmp 0x40e18f
cmp al, 0x2f
jne 0x40e188
mov eax, 0x3f
jmp 0x40e18f
cmp al, 0x3d
jne 0x40e1bd
or eax, 0xffffffff
mov dword [edx], eax
inc ecx
add edx, 4
cmp ecx, 4
jl 0x40e13f
mov ecx, dword [esp + 8]
cmp ecx, 0xffffffff
je 0x40e1bd
mov edi, dword [esp + 0xc]
cmp edi, 0xffffffff
je 0x40e1bd
mov esi, dword [esp + 0x10]
cmp esi, 0xffffffff
jne 0x40e1c5
mov edx, dword [esp + 0x14]
cmp edx, esi
je 0x40e1d6
xor eax, eax
pop edi
pop esi
add esp, 0x10
ret
mov edx, dword [esp + 0x14]
xor eax, eax
cmp edx, 0xffffffff
setne al
add eax, 2
jmp 0x40e1db
mov eax, 1
shl ecx, 6
or ecx, edi
and esi, 0x3f
shl ecx, 6
or ecx, esi
mov esi, dword [esp + 0x20]
shl ecx, 6
and edx, 0x3f
or ecx, edx
mov edx, ecx
shr edx, 0x10
cmp eax, 1
mov byte [esi], dl
jle 0x40e208
mov edx, ecx
shr edx, 8
mov byte [esi + 1], dl
cmp eax, 2
jle 0x40e1bf
mov byte [esi + 2], cl
pop edi
pop esi
add esp, 0x10
ret
Function at 0x40f4f0
Capabilities:
Access peb ldr_data
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x433730
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
lea eax, [esp + 0x10]
push edi
push eax
mov ecx, 0x442af0
call fcn.004022f0
push str.ancamcorder.ini
lea ecx, [esp + 0x14]
push eax
push ecx
mov dword [esp + 0x34], 0
call sub.MFC42.DLL_operator_2
mov eax, dword [eax]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push eax
push 0
push str.LEFT
push str.AUTOPOS_HISTORY
call esi
lea ecx, [esp + 0x10]
mov edi, eax
call sub.MFC42.DLL_CString::CString
or ebp, 0xffffffff
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], ebp
call sub.MFC42.DLL_CString::CString
lea edx, [esp + 0x10]
mov ecx, 0x442af0
push edx
call fcn.004022f0
push str.ancamcorder.ini
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x30], 1
push eax
call sub.MFC42.DLL_operator_2
mov eax, dword [eax]
push eax
push 0
push 0x4410b8
push str.AUTOPOS_HISTORY
call esi
lea ecx, [esp + 0x14]
mov ebx, eax
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], ebp
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
push ecx
mov ecx, 0x442af0
call fcn.004022f0
push str.ancamcorder.ini
lea edx, [esp + 0x18]
push eax
push edx
mov dword [esp + 0x34], 2
call sub.MFC42.DLL_operator_2
mov eax, dword [eax]
push eax
push 0x3b4
push str.WIDTH
push str.AUTOPOS_HISTORY
call esi
lea ecx, [esp + 0x14]
mov ebp, eax
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 0xffffffff
call sub.MFC42.DLL_CString::CString
lea eax, [esp + 0x1c]
mov ecx, 0x442af0
push eax
call fcn.004022f0
mov dword [esp + 0x28], 3
push str.ancamcorder.ini
lea ecx, [esp + 0x1c]
push eax
push ecx
call sub.MFC42.DLL_operator_2
mov eax, dword [eax]
push eax
push 0x2ac
push str.HEIGHT
push str.AUTOPOS_HISTORY
call esi
lea ecx, [esp + 0x18]
mov esi, eax
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x1c]
mov dword [esp + 0x28], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x20]
add ebp, edi
add esi, ebx
mov dword [eax], edi
mov dword [eax + 0xc], esi
pop edi
mov dword [eax + 8], ebp
pop esi
mov dword [eax + 4], ebx
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 4
Function at 0x410590
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x50
push ebx
mov ebx, dword [esp + 0x58]
push ebp
push esi
lea eax, [esp + 0x1c]
push edi
push eax
push 0x18
push ebx
call dword [sym.imp.GDI32.dll_GetObjectA]
mov edx, dword [esp + 0x28]
mov ebp, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov ecx, 0xa
xor eax, eax
lea edi, [esp + 0x38]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x38], 0x28
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], edx
mov word [esp + 0x44], 1
mov word [esp + 0x46], 0x18
mov dword [esp + 0x48], eax
call ebp
push eax
call dword [sym.imp.USER32.dll_GetDC]
mov ecx, dword [esp + 0x28]
mov esi, eax
lea eax, [esp + 0x38]
push 0
push eax
push 0
push ecx
push 0
push ebx
push esi
call dword [sym.imp.GDI32.dll_GetDIBits]
mov edx, dword [esp + 0x4c]
push edx
call sub.MFC42.DLL_operatornew
mov ecx, dword [esp + 0x2c]
add esp, 4
mov edi, eax
lea eax, [esp + 0x38]
push 0
push eax
push edi
push ecx
push 0
push ebx
push esi
call dword [sym.imp.GDI32.dll_GetDIBits]
push esi
call ebp
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov edx, dword [esp + 0x68]
xor ebp, ebp
push ebp
push 0x80
push 2
push ebp
push ebp
push 0x40000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x410671
push edi
call sub.MFC42.DLL_operatordelete
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret 8
mov eax, dword [esp + 0x4c]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
lea ecx, [esp + 0x64]
push ebp
push ecx
lea edx, [esp + 0x18]
push 0xe
add eax, 0x36
push edx
push esi
mov word [esp + 0x24], 0x4d42
mov dword [esp + 0x2e], 0x36
mov dword [esp + 0x26], eax
mov word [esp + 0x2c], bp
mov word [esp + 0x2a], bp
call ebx
lea eax, [esp + 0x64]
push ebp
push eax
lea ecx, [esp + 0x40]
push 0x28
push ecx
push esi
call ebx
mov eax, dword [esp + 0x4c]
lea edx, [esp + 0x64]
push ebp
push edx
push eax
push edi
push esi
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call sub.MFC42.DLL_operatordelete
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret 8
Function at 0x4121c0
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x433ad9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x110
mov eax, dword [esp + 0x120]
push esi
push edi
mov esi, ecx
push eax
push 0x10e
mov dword [esp + 0x18], esi
call fcn.00430da2
lea edi, [esi + 0x60]
mov dword [esp + 0x120], 0
mov ecx, edi
call fcn.00430d9c
mov dword [edi], 0x437e70
lea edi, [esi + 0xa0]
mov byte [esp + 0x120], 1
mov ecx, edi
call fcn.00430d9c
mov dword [edi], 0x437e70
lea ecx, [esi + 0xe0]
mov byte [esp + 0x120], 2
call fcn.0041ec50
lea ecx, [esi + 0x140]
mov byte [esp + 0x120], 3
call fcn.0041d6c0
lea ecx, [esi + 0x2a4]
mov byte [esp + 0x120], 4
call fcn.0041d6c0
mov dword [esi + 0x40c], 0
mov dword [esi + 0x408], 0x4374fc
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 8]
mov byte [esp + 0x120], 6
push ecx
mov ecx, 0x442af0
mov dword [esi], 0x437d98
stosb byte es:[edi], al
call fcn.004022f0
push str.ancamcorder.ini
lea edx, [esp + 0x10]
push eax
push edx
mov byte [esp + 0x12c], 7
call sub.MFC42.DLL_operator_2
mov eax, dword [eax]
push eax
lea eax, [esp + 0x18]
push 0x104
push eax
push 0x441e08
push str.CAPTURE_TIME
push str.OPTION
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 8]
mov byte [esp + 0x120], 6
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.MSVCRT.dll_atol]
mov ecx, dword [esp + 0x11c]
add esp, 4
mov dword [esi + 0x410], eax
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x11c
ret 4