joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b5f10
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x40
push esi
push edi
xor eax, eax
mov ecx, 0xc
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
test byte [esp + 0x54], 1
mov dword [esp + 8], 0
je 0x4b5ffa
mov eax, dword [esp + 0x50]
test eax, eax
jne 0x4b5f4a
pop edi
mov eax, 0x80070057
pop esi
add esp, 0x40
ret 0x10
push 0x5ea5c0
push eax
mov esi, 0x8004e007
call dword [0x5d25f0]
add esp, 8
test eax, eax
mov dword [esp + 0x18], eax
je 0x4b60e1
lea eax, [esp + 0x18]
push eax
call fcn.004b5a00
mov esi, eax
test esi, esi
jl 0x4b60e1
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
push ecx
push edx
call fcn.0055b070
mov eax, dword [esp + 0x18]
push eax
push 8
lea ecx, [esp + 0x14]
push 1
push ecx
mov esi, 0x8004e00b
call dword [0x5d25ec]
add esp, 0x10
cmp eax, 8
jne 0x4b5fce
push eax
lea edx, [esp + 0x10]
push edx
call fcn.0055aec0
test eax, eax
je 0x4b5fce
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x1c]
push ecx
call fcn.004b5a50
mov esi, eax
lea edx, [esp + 0x18]
push edx
call fcn.004b5320
mov eax, dword [esp + 0x18]
push eax
call dword [0x5d25e8]
mov ecx, dword [esp + 0x5c]
mov edx, dword [esp + 0xc]
add esp, 4
pop edi
mov eax, esi
mov dword [ecx], edx
pop esi
add esp, 0x40
ret 0x10
mov edi, dword [esp + 0x50]
push ebx
mov ebx, dword [esp + 0x50]
lea ecx, [esp + 0x58]
push ecx
push 0x20
push edi
push ebx
mov esi, 0x8004e00e
mov dword [esp + 0x68], 0
call sym.vidcap60.exe__SfLoadResourceCustom_16
test eax, eax
jne 0x4b603b
lea edx, [esp + 0x58]
push edx
push str.BINARY
push edi
push ebx
call sym.vidcap60.exe__SfLoadResourceCustom_16
test eax, eax
je 0x4b60da
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x4b60da
mov eax, dword [esp + 0x58]
test eax, eax
je 0x4b60e0
cmp eax, 8
mov esi, 0x8004e00b
jbe 0x4b6067
mov eax, 8
push eax
push edi
call fcn.0055aec0
test eax, eax
je 0x4b60e0
lea eax, [esp + 0x1c]
push eax
call fcn.004b5a00
mov esi, eax
test esi, esi
jl 0x4b60e0
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x58]
push 0x4b5df0
lea edx, [esp + 0x14]
push edx
push eax
mov dword [esp + 0x1c], 8
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], edi
call fcn.0055b1e0
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x20]
push edx
call fcn.004b5a50
mov esi, eax
lea eax, [esp + 0x1c]
push eax
call fcn.004b5320
mov ecx, dword [esp + 0x5c]
mov edx, dword [esp + 0xc]
pop ebx
pop edi
mov eax, esi
mov dword [ecx], edx
pop esi
add esp, 0x40
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop ebx
mov ecx, dword [esp + 0x58]
mov edx, dword [esp + 8]
pop edi
mov eax, esi
mov dword [ecx], edx
pop esi
add esp, 0x40
ret 0x10
Function at 0x4bbef0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x210
push ebx
mov ebx, dword [esp + 0x218]
push edi
mov edi, dword [esp + 0x220]
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x4bbf22
pop edi
mov eax, 1
pop ebx
add esp, 0x210
ret 8
lea eax, [esp + 8]
push eax
push 0x20019
push 0
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 2
je 0x4bbf12
test eax, eax
je 0x4bbf4c
pop edi
xor eax, eax
pop ebx
add esp, 0x210
ret 8
mov eax, dword [esp + 8]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x28]
push edx
push 0
push eax
mov dword [esp + 0x30], 0x104
call esi
test eax, eax
jne 0x4bbfba
lea ebx, [ebx]
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x14]
push ecx
push edx
call sym.vidcap60.exe__SfRegDeleteKey_8
test eax, eax
je 0x4bbfba
mov edx, dword [esp + 0xc]
push 0
push 0
push 0
push 0
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x28]
push ecx
push 0
push edx
mov dword [esp + 0x30], 0x104
call esi
test eax, eax
je 0x4bbf80
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
neg eax
pop esi
sbb eax, eax
pop edi
inc eax
pop ebx
add esp, 0x210
ret 8

Function at 0x4bbfe0
Capabilities:
Delete registry key

Disassembly:
sub esp, 0x20c
push esi
xor esi, esi
call sym.vidcap60.exe__SfIsWin95_0
test eax, eax
mov eax, str.Windows
jne 0x4bbffc
mov eax, 0x5e8f30
push eax
lea eax, [esp + 0xc]
push str.SOFTWAREMicrosoft_sCurrentVersionSfTestLoginPrivilege
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0xc]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x4bc051
lea eax, [esp + 8]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop esi
add esp, 0x20c
ret
mov eax, esi
pop esi
add esp, 0x20c
ret

Function at 0x4bc2b0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x210
mov eax, dword [esp + 0x214]
push esi
push str.Shared_Information
push str.SoftwareSony_Creative_Software
lea ecx, [esp + 0x14]
push 0x5e8684
push ecx
mov esi, 0x80004005
mov dword [esp + 0x18], eax
call sym.vidcap60.exe_SfPrintF
add esp, 0x10
push 0
lea edx, [esp + 8]
push edx
push 0
push 0x20006
push 0
push 0
push 0
lea eax, [esp + 0x28]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4bc336
mov edx, dword [esp + 4]
push 4
lea ecx, [esp + 0xc]
push ecx
push 4
push eax
push str.Locale
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x4bc32b
xor esi, esi
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x210
ret 4
Function at 0x4bc350
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push esi
lea eax, [esp + 4]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
push SysReAllocString
mov esi, 1
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4bc3ca
lea ecx, [esp + 8]
push ecx
mov ecx, dword [esp + 8]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push eax
push 0
push str.HideFileExt
push ecx
mov dword [esp + 0x20], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4bc3bf
cmp dword [esp + 0xc], 4
jne 0x4bc3bf
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x4bc3bf
xor esi, esi
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10
ret
Function at 0x4bc3e0
Capabilities:
Persist via com hijack
Set registry value

Disassembly:
sub esp, 0x264
push ebx
mov ecx, dword [esp + 0x26c]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push esi
push edi
xor edi, edi
push edi
lea eax, [esp + 0x10]
push eax
push edi
push 0x20006
push edi
push edi
push edi
push str.SoftwareClassesCLSID
push ecx
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
call ebx
mov esi, eax
cmp esi, edi
jne 0x4bc54c
mov eax, dword [esp + 0x27c]
push 0x28
lea edx, [esp + 0x1c]
push edx
push eax
call dword [sym.imp.ole32.dll_StringFromGUID2]
cmp dword [esp + 0x284], edi
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x18]
jne 0x4bc457
push ecx
push edx
call sym.vidcap60.exe__SfRegDeleteKey_8
jmp 0x4bc54c
push edi
lea eax, [esp + 0x14]
push eax
push edi
push 0x20006
push edi
push edi
push edi
push ecx
push edx
call ebx
mov esi, eax
cmp esi, edi
jne 0x4bc54c
mov esi, dword [esp + 0x280]
cmp esi, edi
push ebp
mov ebp, dword [0x5d2620]
jne 0x4bc48a
xor eax, eax
jmp 0x4bc494
push esi
call ebp
add esp, 4
lea eax, [eax + eax + 2]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push eax
mov eax, dword [esp + 0x18]
push esi
push 1
push 0
push 0
push eax
call edi
mov esi, eax
test esi, esi
jne 0x4bc54b
mov edx, dword [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
push ecx
push eax
push 0x20006
push eax
push eax
push eax
push 0x5ea804
push edx
call ebx
mov esi, eax
test esi, esi
jne 0x4bc54b
mov ecx, dword [esp + 0x27c]
push 0x104
lea eax, [esp + 0x70]
push eax
push ecx
call sym.vidcap60.exe__SfGetModuleFileName_12
lea edx, [esp + 0x6c]
test edx, edx
jne 0x4bc4f7
xor eax, eax
jmp 0x4bc505
lea eax, [esp + 0x6c]
push eax
call ebp
add esp, 4
lea eax, [eax + eax + 2]
mov edx, dword [esp + 0x18]
push eax
lea ecx, [esp + 0x70]
push ecx
push 1
push 0
push 0
push edx
call edi
mov esi, eax
test esi, esi
jne 0x4bc54b
cmp eax, 0x5ea7f8
je 0x4bc533
push 0x5ea7f8
call ebp
add esp, 4
lea eax, [eax + eax + 2]
mov ecx, dword [esp + 0x18]
push eax
push 0x5ea7f8
push 1
push 0
push 0x5ea7d8
push ecx
call edi
mov esi, eax
pop ebp
mov eax, dword [esp + 0x14]
test eax, eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x4bc55d
push eax
call edi
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4bc568
push eax
call edi
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4bc591
test esi, esi
je 0x4bc58e
mov ecx, dword [esp + 0x284]
test ecx, ecx
je 0x4bc58e
lea edx, [esp + 0x18]
push edx
push eax
call sym.vidcap60.exe__SfRegDeleteKey_8
mov eax, dword [esp + 0xc]
push eax
call edi
test esi, esi
jle 0x4bc5a1
and esi, 0xffff
or esi, 0x80070000
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x264
ret 0x14
Function at 0x4bcc50
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x24]
test esi, esi
push edi
jne 0x4bcc83
mov ecx, ebp
sub ecx, ebx
add ecx, 5
mov eax, 0x66666667
imul ecx
sar edx, 2
mov esi, edx
shr esi, 0x1f
add esi, edx
jne 0x4bcc83
mov esi, 1
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call edi
test ax, ax
jge 0x4bcc97
lea esi, [esi + esi*4]
shl esi, 1
mov eax, dword [esp + 0x2c]
test eax, eax
mov eax, dword [esp + 0x14]
je 0x4bccde
cmp eax, 7
ja case.0x4bcce3.4
jmp dword [eax*4 + 0x4bcd18]
mov eax, dword [esp + 0x18]
add eax, esi
jmp 0x4bcd0b
mov eax, dword [esp + 0x18]
sub eax, esi
jmp 0x4bcd0b
mov eax, dword [esp + 0x18]
sub eax, dword [esp + 0x24]
jmp 0x4bcd0b
push 0x11
call edi
test ax, ax
jl case.0x4bcce3.7
test ebp, ebp
jle case.0x4bcce3.7
test ebx, ebx
jge case.0x4bcce3.7
xor eax, eax
jmp 0x4bcd0b
cmp eax, 7
ja case.0x4bcce3.4
jmp dword [eax*4 + 0x4bcd38]
mov eax, dword [esp + 0x18]
add eax, dword [esp + 0x24]
jmp 0x4bcd0b
mov eax, ebx
cmp eax, ebp
jle 0x4bccfc
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
ret 0x1c
mov eax, ebp
jmp 0x4bcd0b
mov eax, dword [esp + 0x18]
cmp eax, ebx
jge 0x4bccf6
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
ret 0x1c

Function at 0x4c0ae0
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x1c
push ebx
push esi
mov esi, dword [esp + 0x28]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 1
or eax, 0xffffffff
push 0x438
push esi
mov dword [esp + 0x1c], 2
mov dword [esp + 0x20], 0xff00
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
call edi
mov ebx, dword [esp + 0x34]
test ebx, ebx
mov eax, 0x611114
jne 0x4c0b41
mov eax, 0x611100
push eax
push 0
push 0x40b
push esi
call edi
push 0x10000004
push 0
push 0x42e
push esi
call edi
lea eax, [esp + 0xc]
push eax
push 0
push 0x437
push esi
call edi
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
push 0x611070
push 0
push 0x419
push esi
mov dword [0x61107c], ecx
mov dword [0x611094], edx
mov dword [0x611070], eax
mov dword [0x611098], ebx
call edi
push 0
push 0x64
call sym.vidcap60.exe__SfGetUIFont_4
push eax
push 0x30
push esi
call edi
push 0
push 0
push 0x438
push esi
call edi
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x1c
ret 0x14
Function at 0x4c1110
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x30
mov ecx, dword [esp + 0x44]
push ebx
mov ebx, dword [esp + 0x4c]
push ebp
mov ebp, dword [esp + 0x48]
push esi
mov esi, dword [esp + 0x40]
or eax, 0xffffffff
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
xor eax, eax
push eax
push 1
push 0x438
push esi
mov dword [esp + 0x34], 1
mov dword [esp + 0x38], 0xff00
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], ecx
call edi
lea edx, [esp + 0x10]
push edx
push 0
push 0x40b
push esi
call edi
push 0
push 0x64
call sym.vidcap60.exe__SfGetUIFont_4
push eax
push 0x30
push esi
call edi
push 0x10000004
push 0
push 0x42e
push esi
call edi
mov eax, dword [esp + 0x48]
mov ecx, dword [eax]
mov edx, dword [esp + 0x4c]
push 0x611128
push 0
push 0x419
push esi
mov dword [0x611134], ecx
mov dword [0x611128], ebp
mov dword [0x61114c], eax
mov dword [0x611150], edx
mov dword [0x611154], ebx
call edi
lea eax, [esp + 0x24]
push eax
push 0
push 0x42d
push esi
call edi
push 0
push 0
push 0x438
push esi
call edi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x30
ret 0x18

Function at 0x4c13c0
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x1c
push esi
mov esi, dword [esp + 0x24]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 1
or eax, 0xffffffff
push 0x438
push esi
mov dword [esp + 0x18], 9
mov dword [esp + 0x1c], 0xff00
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
call edi
push 0x611258
push 0
push 0x40b
push esi
call edi
push 0
push 0x64
call sym.vidcap60.exe__SfGetUIFont_4
push eax
push 0x30
push esi
call edi
push 0x10000001
push 0
push 0x42e
push esi
call edi
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
push 0x6111c8
push 0
push 0x419
push esi
mov dword [0x6111d4], eax
mov dword [0x6111ec], ecx
mov dword [0x6111c8], edx
call edi
lea eax, [esp + 8]
push eax
push 0
push 0x42d
push esi
call edi
push 0
push 0
push 0x438
push esi
call edi
pop edi
mov eax, 1
pop esi
add esp, 0x1c
ret 0x10
Function at 0x4c1770
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x26c
test byte [esp + 0x278], 1
push esi
push edi
mov dword [esp + 8], 0
je 0x4c17e2
mov eax, dword [esp + 0x27c]
push 0
push 0
push 3
push 0
push 1
push SysReAllocString
push eax
mov esi, 0x8004e007
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4c1861
push edi
call fcn.0055f000
test eax, eax
mov dword [esp + 0x1e8], eax
je 0x4c17d9
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x14]
push edx
call fcn.004c16b0
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4c1861
mov edi, dword [esp + 0x27c]
push ebx
mov ebx, dword [esp + 0x27c]
lea eax, [esp + 0x10]
push eax
push 0x1f
push edi
push ebx
mov esi, 0x8004e00e
call sym.vidcap60.exe__SfLoadResourceCustom_16
test eax, eax
jne 0x4c181d
lea ecx, [esp + 0x10]
push ecx
push str.BINARY
push edi
push ebx
call sym.vidcap60.exe__SfLoadResourceCustom_16
test eax, eax
je 0x4c185a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x4c185a
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x4c1860
push ecx
push eax
mov esi, 0x8007000e
call fcn.0055ef10
test eax, eax
mov dword [esp + 0x1ec], eax
je 0x4c1860
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x18]
push eax
call fcn.004c16b0
mov esi, eax
jmp 0x4c1860
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop ebx
mov ecx, dword [esp + 0x284]
mov edx, dword [esp + 8]
pop edi
mov eax, esi
mov dword [ecx], edx
pop esi
add esp, 0x26c
ret 0x10

Function at 0x4c2650
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x20]
test esi, esi
push edi
mov edi, dword [esp + 0x18]
jne 0x4c2682
mov ecx, ebx
sub ecx, edi
add ecx, 5
mov eax, 0x66666667
imul ecx
sar edx, 2
mov esi, edx
shr esi, 0x1f
add esi, edx
jne 0x4c2682
mov esi, 1
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x4c2694
lea esi, [esi + esi*4]
shl esi, 1
mov eax, dword [esp + 0x28]
test eax, eax
mov eax, dword [esp + 0x10]
je 0x4c26c8
cmp eax, 7
ja case.0x4c26cd.4
jmp dword [eax*4 + 0x4c2700]
mov eax, dword [esp + 0x14]
sub eax, esi
jmp 0x4c26f2
mov eax, dword [esp + 0x14]
sub eax, dword [esp + 0x20]
jmp 0x4c26f2
mov eax, dword [esp + 0x14]
add eax, dword [esp + 0x20]
jmp 0x4c26f2
cmp eax, 7
ja case.0x4c26cd.4
jmp dword [eax*4 + 0x4c2720]
mov eax, dword [esp + 0x14]
add eax, esi
jmp 0x4c26f2
mov eax, edi
cmp eax, ebx
jle 0x4c26e4
mov eax, ebx
pop edi
pop esi
pop ebx
ret 0x1c
mov eax, ebx
jmp 0x4c26f2
mov eax, dword [esp + 0x14]
cmp eax, edi
jge 0x4c26de
mov eax, edi
pop edi
pop esi
pop ebx
ret 0x1c
Function at 0x4c8050
Capabilities:
Read file on windows

Disassembly:
mov ecx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0xc]
push 0
lea eax, [esp + 0x14]
push eax
push esi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4c8078
cmp esi, dword [esp + 0x10]
je 0x4c8082
pop edi
mov eax, 0x8004e008
pop esi
ret 0x10
and esi, 7
xor eax, eax
mov edx, esi
or edx, eax
je 0x4c809f
push 1
push eax
mov eax, 8
sub eax, esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
pop edi
xor eax, eax
pop esi
ret 0x10

Function at 0x4c80b0
Capabilities:
Write file on windows

Disassembly:
push ecx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push ebp
mov ebp, dword [esp + 0x10]
push 0
lea eax, [esp + 0x18]
push eax
push ecx
push edx
push ebp
mov byte [esp + 0x1f], 0
call ebx
test eax, eax
jne 0x4c80e5
pop ebp
mov eax, 0x8004e009
pop ebx
pop ecx
ret 0x14
mov eax, dword [esp + 0x14]
and eax, 7
push esi
push edi
je 0x4c8123
mov esi, 8
sub esi, eax
xor edi, edi
test esi, esi
jle 0x4c8123
lea ecx, [ecx]
push 0
lea eax, [esp + 0x1c]
push eax
push 1
lea ecx, [esp + 0x1f]
push ecx
push ebp
call ebx
test eax, eax
je 0x4c8142
mov edx, dword [esp + 0x1c]
inc edx
inc edi
cmp edi, esi
mov dword [esp + 0x1c], edx
jl 0x4c8100
mov eax, dword [esp + 0x28]
test eax, eax
je 0x4c8138
mov edx, dword [esp + 0x1c]
mov dword [eax], edx
mov dword [eax + 4], 0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 0x14
pop edi
pop esi
pop ebp
mov eax, 0x8004e009
pop ebx
pop ecx
ret 0x14

Function at 0x4c8150
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
cmp ecx, eax
push ebx
push esi
push edi
mov esi, eax
ja 0x4c8163
mov esi, ecx
mov ebx, dword [esp + 0x10]
and eax, 7
sub eax, esi
add eax, ecx
mov ecx, dword [esp + 0x14]
push 0
mov edi, eax
lea eax, [esp + 0x1c]
push eax
push esi
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4c818e
cmp esi, dword [esp + 0x18]
je 0x4c8199
pop edi
pop esi
mov eax, 0x8004e008
pop ebx
ret 0x10
test edi, edi
je 0x4c81a9
push 1
push 0
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
pop edi
pop esi
xor eax, eax
pop ebx
ret 0x10

Function at 0x4c8250
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [esp + 0x10]
push eax
push 0x10
lea ecx, [esp + 0x1c]
push ecx
push esi
call edi
test eax, eax
jne 0x4c827b
pop edi
mov eax, 0x8004e009
pop esi
ret 0x1c
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
add eax, 0x18
adc edx, 0
push 0
mov dword [esp + 0x28], edx
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x28], eax
push 8
lea eax, [esp + 0x2c]
push eax
push esi
call edi
neg eax
sbb eax, eax
and eax, 0x7ffb1ff7
pop edi
add eax, 0x8004e009
pop esi
ret 0x1c
Function at 0x4c8340
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push esi
mov esi, dword [esp + 8]
push eax
mov eax, dword [str.list_]
push ecx
mov ecx, dword [0x5eab40]
sub esp, 0x10
mov edx, esp
mov dword [edx], eax
mov eax, dword [0x5eab44]
mov dword [edx + 4], ecx
mov ecx, dword [0x5eab48]
mov dword [edx + 8], eax
push esi
mov dword [edx + 0xc], ecx
call sym.vidcap60.exe__riff64_WriteChunkHeader_28
test eax, eax
jl 0x4c83a2
push 0
lea edx, [esp + 0xc]
push edx
push 0x10
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
and eax, 0x7ffb1ff7
add eax, 0x8004e009
pop esi
ret 0x1c

Function at 0x4c83b0
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push 0
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
and eax, 0x7ffb1ff7
add eax, 0x8004e009
ret 0x10

Function at 0x4c83e0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push esi
mov esi, dword [esp + 8]
push eax
mov eax, dword [0x5eab2c]
push ecx
mov ecx, dword [0x5eab30]
sub esp, 0x10
mov edx, esp
mov dword [edx], eax
mov eax, dword [0x5eab34]
mov dword [edx + 4], ecx
mov ecx, dword [0x5eab38]
mov dword [edx + 8], eax
push esi
mov dword [edx + 0xc], ecx
call sym.vidcap60.exe__riff64_WriteChunkHeader_28
push 0
lea edx, [esp + 0xc]
push edx
push 0x10
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
and eax, 0x7ffb1ff7
add eax, 0x8004e009
pop esi
ret 0x1c

Function at 0x4c8450
Capabilities:
Read file on windows

Disassembly:
mov ecx, dword [esp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
mov edi, dword [esp + 0xc]
push 0
lea eax, [esp + 0x14]
push eax
push 0x10
push ecx
push edi
call ebx
test eax, eax
je 0x4c8478
cmp dword [esp + 0x10], 0x10
je 0x4c8482
pop edi
mov eax, 0x8004e008
pop ebx
ret 0xc
push esi
mov esi, dword [esp + 0x18]
push 0
lea edx, [esp + 0x18]
push edx
push 8
push esi
push edi
call ebx
test eax, eax
jne 0x4c84a3
pop esi
pop edi
mov eax, 0x8004e008
pop ebx
ret 0xc
cmp dword [esp + 0x14], 8
jne 0x4c8498
mov edx, dword [esi]
mov ecx, dword [esi + 4]
add edx, 0xffffffe8
adc ecx, 0xffffffff
mov eax, ecx
test eax, eax
mov dword [esi], edx
mov dword [esi + 4], ecx
jg 0x4c84d5
jl 0x4c84c8
mov eax, edx
test eax, eax
jae 0x4c84d5
mov dword [esi], 0
mov dword [esi + 4], 0
pop esi
pop edi
xor eax, eax
pop ebx
ret 0xc