joyce8/EMBER2024-capa huggingface dataset:
Function at 0x562e60
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x828
push esi
mov esi, dword [esp + 0x838]
mov eax, dword [esi + 4]
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [esp + 0x1c], eax
mov eax, dword [esi + 0x18]
test eax, eax
mov dword [esp + 0x14], ecx
mov ecx, dword [esi + 0x14]
mov dword [esp + 0x18], edx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
je 0x562ed3
mov eax, dword [esp + 0x834]
mov edx, dword [eax]
lea ecx, [esp + 8]
push ecx
mov ecx, dword [esi + 0x18]
push ecx
lea ecx, [esp + 0x34]
push ecx
push eax
call dword [edx + 0xc]
test eax, eax
jl 0x562ec4
mov edx, dword [esi + 0x18]
cmp edx, dword [esp + 8]
je 0x562ee2
mov eax, 0x8004e008
pop esi
add esp, 0x828
ret 0x10
mov word [esp + 0x2c], 0
mov dword [esp + 0x24], 2
mov esi, dword [esp + 0x830]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [esp + 0xc]
push eax
push 0x20
lea ecx, [esp + 0x1c]
push ecx
push esi
call edi
test eax, eax
je 0x562f4b
cmp dword [esp + 8], 0x20
jne 0x562f4b
mov eax, dword [esp + 0x28]
push 0
lea edx, [esp + 0xc]
push edx
push eax
lea ecx, [esp + 0x3c]
push ecx
push esi
call edi
test eax, eax
je 0x562f4b
mov ecx, dword [esp + 8]
cmp dword [esp + 0x28], ecx
jne 0x562f4b
mov eax, dword [esp + 0x840]
test eax, eax
je 0x562f3e
add ecx, 0x20
mov dword [eax], ecx
pop edi
xor eax, eax
pop esi
add esp, 0x828
ret 0x10
pop edi
mov eax, 0x8004e009
pop esi
add esp, 0x828
ret 0x10
Function at 0x562f60
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x40
push esi
push edi
xor edi, edi
push edi
lea eax, [esp + 0xc]
push eax
mov esi, 4
push esi
lea ecx, [esp + 0x60]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x56307e
cmp dword [esp + 8], esi
jne 0x56307e
mov eax, dword [esp + 0x54]
push ebx
xor ebx, ebx
test eax, eax
push ebp
mov dword [esp + 0x14], esi
jbe 0x56303f
mov esi, dword [esp + 0x58]
mov ebp, 0x18
mov eax, dword [esi]
lea ecx, [esp + 0x58]
push ecx
push 0x1c
lea edx, [esp + 0x3c]
push edx
push esi
call dword [eax + 0xc]
test eax, eax
jl 0x563056
cmp dword [esp + 0x38], 0x64
jne 0x56306f
mov ecx, dword [esp + 0x58]
cmp ecx, dword [esp + 0x34]
jne 0x56306f
test eax, eax
jl 0x563056
mov edx, dword [esi]
lea eax, [esp + 0x18]
push eax
push ebp
lea ecx, [esp + 0x24]
push ecx
push esi
call dword [edx + 0xc]
mov edi, eax
test edi, edi
jl 0x56306f
cmp dword [esp + 0x18], ebp
jne 0x56306f
mov ecx, dword [esp + 0x54]
push 0
lea edx, [esp + 0x14]
push edx
push ebp
lea eax, [esp + 0x28]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x563060
cmp dword [esp + 0x10], ebp
jne 0x563060
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x5c]
add edx, ebp
inc ebx
cmp ebx, eax
mov dword [esp + 0x14], edx
jb 0x562fb2
mov eax, dword [esp + 0x60]
test eax, eax
je 0x563054
mov edx, dword [esp + 0x14]
mov dword [eax], edx
mov dword [eax + 4], 0
mov eax, edi
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x40
ret 0x10
pop ebp
pop ebx
pop edi
mov eax, 0x8004e009
pop esi
add esp, 0x40
ret 0x10
pop ebp
pop ebx
pop edi
mov eax, 0x8004e008
pop esi
add esp, 0x40
ret 0x10
pop edi
mov eax, 0x8004e009
pop esi
add esp, 0x40
ret 0x10
Function at 0x5637a0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1d0
xor eax, eax
test esi, esi
je 0x56386f
mov edx, dword [esi]
xor ecx, ecx
push ecx
push ecx
push ecx
push eax
push esi
call dword [edx + 0x14]
mov eax, dword [esi]
lea ecx, [esp]
push ecx
push 0x1c
lea edx, [esp + 0x14]
push edx
push esi
call dword [eax + 0xc]
test eax, eax
jl 0x5637dc
lea ecx, [esp]
test ecx, ecx
mov ecx, dword [esp + 0x14]
jne 0x5637df
mov ecx, dword [esp]
test eax, eax
jl 0x56386f
test ecx, ecx
jbe 0x56386f
push 0
push esi
call fcn.00562d50
test eax, eax
jl 0x56386f
mov edx, dword [esi]
lea eax, [esp + 4]
push eax
push 0x1a8
lea ecx, [esp + 0x30]
push ecx
push esi
call dword [edx + 0xc]
test eax, eax
jl 0x56386f
cmp dword [esp + 4], 0x1a8
ja 0x56386f
lea edx, [esp]
push edx
push 0x746f6373
push edi
call fcn.00562bb0
test eax, eax
jl 0x56386f
mov ecx, dword [esp + 4]
push 0
lea eax, [esp + 0xc]
push eax
push ecx
lea edx, [esp + 0x34]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x56386a
mov eax, dword [esp + 4]
cmp dword [esp + 8], eax
jne 0x56386a
push eax
mov eax, dword [esp + 4]
push eax
push edi
call fcn.00562c00
add esp, 0x1d0
ret
mov eax, 0x8004e008
add esp, 0x1d0
ret
Function at 0x563960
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x5c
xor eax, eax
test esi, esi
mov dword [esp + 0x10], 0
je 0x563b3b
mov edx, dword [esi]
xor ecx, ecx
push ecx
push ecx
push ecx
push eax
push esi
call dword [edx + 0x14]
mov eax, dword [esi]
lea ecx, [esp + 0xc]
push ecx
push 0x1c
lea edx, [esp + 0x48]
push edx
push esi
call dword [eax + 0xc]
test eax, eax
jl 0x563b3b
lea ecx, [esp]
test ecx, ecx
je 0x5639a9
mov edx, dword [esp + 0x48]
mov dword [esp], edx
mov ecx, dword [esp]
test ecx, ecx
je 0x563b3b
lea eax, [esp + 8]
push eax
push 0x74736c70
push edi
call fcn.00562bb0
test eax, eax
jl 0x563b3b
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push ebp
push 0
lea ecx, [esp + 0x10]
push ecx
mov ebp, 4
push ebp
lea edx, [esp + 0x14]
push edx
push edi
call ebx
test eax, eax
je 0x563b34
cmp dword [esp + 0xc], ebp
jne 0x563b34
mov eax, dword [esp + 8]
test eax, eax
mov dword [esp + 0x14], 0
jbe 0x563ab2
nop
push 0
push esi
call fcn.00562d50
test eax, eax
jl 0x563b39
mov eax, dword [esi]
lea ecx, [esp + 0x20]
push ecx
push 0x18
lea edx, [esp + 0x38]
push edx
push esi
call dword [eax + 0xc]
test eax, eax
jl 0x563b29
cmp dword [esp + 0x20], 0x18
jne 0x563b29
mov eax, dword [esp + 0x3c]
test eax, eax
mov eax, dword [esp + 0x38]
jl 0x563a62
jg 0x563a58
cmp eax, 0xffffffff
jbe 0x563a62
mov dword [esp + 0x18], 1
jmp 0x563a9d
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x40]
push 0
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x2c], ecx
push 0xc
lea ecx, [esp + 0x30]
push ecx
push edi
mov dword [esp + 0x40], edx
call ebx
test eax, eax
je 0x563b34
cmp dword [esp + 0xc], 0xc
jne 0x563b34
add ebp, 0xc
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 8]
inc eax
cmp eax, ecx
mov dword [esp + 0x14], eax
jb 0x563a10
mov edx, dword [esp + 0x10]
push ebp
push edx
push edi
call fcn.00562c00
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x563b39
mov edx, dword [esi]
xor ecx, ecx
push ecx
push ecx
push ecx
xor eax, eax
push eax
push esi
call dword [edx + 0x14]
mov eax, dword [esi]
lea ecx, [esp + 0x18]
push ecx
push 0x1c
lea edx, [esp + 0x50]
push edx
push esi
call dword [eax + 0xc]
test eax, eax
jl 0x563b39
lea eax, [esp + 0x10]
push eax
push 0x32306673
push edi
call fcn.00562bb0
test eax, eax
jl 0x563b39
mov edx, dword [esp + 8]
lea ecx, [esp + 0x18]
push ecx
push edx
push esi
push edi
call fcn.00562f60
test eax, eax
jl 0x563b39
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
push eax
push ecx
push edi
call fcn.00562c00
pop ebp
pop ebx
add esp, 0x5c
ret
pop ebp
mov eax, 0x8004e008
pop ebx
add esp, 0x5c
ret
mov eax, 0x8004e009
pop ebp
pop ebx
add esp, 0x5c
ret
Function at 0x563b40
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x44
xor eax, eax
test esi, esi
je 0x563c4c
mov edx, dword [esi]
xor ecx, ecx
push ecx
push ecx
push ecx
push eax
push esi
call dword [edx + 0x14]
mov eax, dword [esi]
lea ecx, [esp + 0xc]
push ecx
push 0x1c
lea edx, [esp + 0x30]
push edx
push esi
call dword [eax + 0xc]
test eax, eax
jl 0x563c4c
lea ecx, [esp]
test ecx, ecx
je 0x563b81
mov edx, dword [esp + 0x30]
mov dword [esp], edx
mov ecx, dword [esp]
test ecx, ecx
je 0x563c4c
push ebx
mov ebx, dword [esp + 0x4c]
lea eax, [esp + 0x10]
push eax
push 0x74736c74
push ebx
call fcn.00562bb0
test eax, eax
jl 0x563c4b
push ebp
push 0
lea ecx, [esp + 0x10]
push ecx
mov ebp, 4
push ebp
lea edx, [esp + 0x14]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x563c6e
cmp dword [esp + 0xc], ebp
jne 0x563c6e
mov eax, dword [esp + 8]
push edi
xor edi, edi
test eax, eax
jbe 0x563c3d
mov ebx, 0x18
push 0
push esi
call fcn.00562d50
test eax, eax
jl 0x563c49
mov eax, dword [esi]
lea ecx, [esp + 0x14]
push ecx
push ebx
lea edx, [esp + 0x24]
push edx
push esi
call dword [eax + 0xc]
test eax, eax
jl 0x563c49
cmp dword [esp + 0x14], ebx
jne 0x563c52
mov edx, dword [esp + 0x54]
push 0
lea eax, [esp + 0x14]
push eax
push ebx
lea ecx, [esp + 0x28]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x563c60
cmp dword [esp + 0x10], ebx
jne 0x563c60
mov eax, dword [esp + 0xc]
add ebp, ebx
inc edi
cmp edi, eax
jb 0x563be5
mov ebx, dword [esp + 0x54]
mov eax, dword [esp + 0x18]
push ebp
push eax
push ebx
call fcn.00562c00
pop edi
pop ebp
pop ebx
add esp, 0x44
ret 4
pop edi
pop ebp
mov eax, 0x8004e008
pop ebx
add esp, 0x44
ret 4
pop edi
pop ebp
mov eax, 0x8004e009
pop ebx
add esp, 0x44
ret 4
pop ebp
mov eax, 0x8004e009
pop ebx
add esp, 0x44
ret 4
Function at 0x564430
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x38
xor eax, eax
test ebx, ebx
mov dword [esp], 0
je 0x5645fe
mov edx, dword [ebx]
push esi
xor ecx, ecx
push ecx
push ecx
push ecx
push eax
push ebx
call dword [edx + 0x14]
mov eax, dword [ebx]
lea ecx, [esp + 0x10]
push ecx
push 0x1c
lea edx, [esp + 0x28]
push edx
push ebx
call dword [eax + 0xc]
test eax, eax
jl 0x5645fd
lea ecx, [esp + 0xc]
test ecx, ecx
je 0x56447b
mov edx, dword [esp + 0x28]
mov dword [esp + 0xc], edx
mov esi, dword [esp + 0xc]
test esi, esi
je 0x5645fd
mov eax, dword [esp + 0x40]
push edi
push eax
call fcn.00562b50
mov edi, eax
test edi, edi
jge 0x5644a0
pop edi
pop esi
add esp, 0x38
ret 4
push ebp
push 0x4000
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebp, eax
test ebp, ebp
jne 0x5644c9
pop ebp
pop edi
mov eax, 0x8007000e
pop esi
add esp, 0x38
ret 4
test esi, esi
mov dword [esp + 0x18], 0
jbe 0x5645d2
lea esp, [esp]
test edi, edi
jl 0x5645d2
push 0
push ebx
call fcn.00562d50
test eax, eax
jl 0x5645fb
mov ecx, dword [ebx]
lea edx, [esp + 0x10]
push edx
mov esi, 8
push esi
lea eax, [esp + 0x28]
push eax
push ebx
call dword [ecx + 0xc]
test eax, eax
jl 0x5645d2
cmp dword [esp + 0x10], esi
jne 0x5645d2
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x48]
push ecx
push edx
push eax
call sym.vidcap60.exe__riff_WriteChunkHeader_12
mov edi, eax
test edi, edi
jl 0x5645d2
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x24]
add edx, esi
test eax, eax
mov dword [esp + 0xc], edx
je 0x5645bd
cmp eax, 0x4000
mov esi, eax
jb 0x56455e
mov esi, 0x4000
mov ecx, dword [ebx]
lea edx, [esp + 0x10]
push edx
push esi
push ebp
push ebx
call dword [ecx + 0xc]
mov edi, eax
test edi, edi
jl 0x5645b8
mov eax, dword [esp + 0x10]
cmp esi, eax
jne 0x5645b8
mov edx, dword [esp + 0x48]
push 0
lea ecx, [esp + 0x20]
push ecx
push eax
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x1c]
cmp dword [esp + 0x10], ecx
jne 0x5645b1
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0xc]
sub eax, ecx
add edx, ecx
test eax, eax
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], edx
jne 0x564550
jmp 0x5645bd
mov edi, 0x8004e009
jmp 0x5645bd
mov edi, 0x8004e008
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
inc eax
cmp eax, ecx
mov dword [esp + 0x18], eax
jb 0x5644e0
mov esi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
push ebp
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebp
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x48]
push eax
push ecx
call sym.vidcap60.exe__riff_UpdateRIFFSize_8
pop ebp
pop edi
pop esi
add esp, 0x38
ret 4
Function at 0x564610
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x28
xor eax, eax
test esi, esi
je 0x5646c9
mov edx, dword [esi]
xor ecx, ecx
push ecx
push ecx
push ecx
push eax
push esi
call dword [edx + 0x14]
mov eax, dword [esi]
lea ecx, [esp + 8]
push ecx
push 0x1c
lea edx, [esp + 0x14]
push edx
push esi
call dword [eax + 0xc]
test eax, eax
jl 0x56464a
lea ecx, [esp]
test ecx, ecx
mov ecx, dword [esp + 0x14]
jne 0x56464d
mov ecx, dword [esp]
test eax, eax
jl 0x5646c9
test ecx, ecx
jbe 0x5646c9
push 0
push esi
call fcn.00562d50
test eax, eax
jl 0x5646c9
mov edx, dword [esi]
lea eax, [esp]
push eax
push 0x14
lea ecx, [esp + 0x14]
push ecx
push esi
call dword [edx + 0xc]
test eax, eax
jl 0x5646c9
cmp dword [esp], 0x14
ja 0x5646c9
lea edx, [esp + 8]
push edx
push 0x32727473
push edi
call fcn.00562bb0
test eax, eax
jl 0x5646c9
mov ecx, dword [esp]
push 0
lea eax, [esp + 8]
push eax
push ecx
lea edx, [esp + 0x18]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x5646c4
mov eax, dword [esp]
cmp dword [esp + 4], eax
jne 0x5646c4
push eax
mov eax, dword [esp + 0xc]
push eax
push edi
call fcn.00562c00
add esp, 0x28
ret
mov eax, 0x8004e008
add esp, 0x28
ret

Function at 0x5646d0
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x5c
push esi
push edi
xor edi, edi
push edi
lea eax, [esp + 0xc]
push eax
mov esi, 4
push esi
lea ecx, [esp + 0x7c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x5647ee
cmp dword [esp + 8], esi
jne 0x5647ee
mov eax, dword [esp + 0x70]
push ebx
xor ebx, ebx
test eax, eax
push ebp
mov dword [esp + 0x14], esi
jbe 0x5647af
mov esi, dword [esp + 0x74]
mov ebp, 0x34
mov eax, dword [esi]
lea ecx, [esp + 0x74]
push ecx
push 0x1c
lea edx, [esp + 0x24]
push edx
push esi
call dword [eax + 0xc]
test eax, eax
jl 0x5647c6
cmp dword [esp + 0x20], 0x64
jne 0x5647df
mov ecx, dword [esp + 0x74]
cmp ecx, dword [esp + 0x1c]
jne 0x5647df
test eax, eax
jl 0x5647c6
mov edx, dword [esi]
lea eax, [esp + 0x18]
push eax
push ebp
lea ecx, [esp + 0x40]
push ecx
push esi
call dword [edx + 0xc]
mov edi, eax
test edi, edi
jl 0x5647df
cmp dword [esp + 0x18], ebp
jne 0x5647df
mov ecx, dword [esp + 0x70]
push 0
lea edx, [esp + 0x14]
push edx
push ebp
lea eax, [esp + 0x44]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x5647d0
cmp dword [esp + 0x10], ebp
jne 0x5647d0
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x78]
add edx, ebp
inc ebx
cmp ebx, eax
mov dword [esp + 0x14], edx
jb 0x564722
mov eax, dword [esp + 0x7c]
test eax, eax
je 0x5647c4
mov edx, dword [esp + 0x14]
mov dword [eax], edx
mov dword [eax + 4], 0
mov eax, edi
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x5c
ret 0x10
pop ebp
pop ebx
pop edi
mov eax, 0x8004e009
pop esi
add esp, 0x5c
ret 0x10
pop ebp
pop ebx
pop edi
mov eax, 0x8004e008
pop esi
add esp, 0x5c
ret 0x10
pop edi
mov eax, 0x8004e009
pop esi
add esp, 0x5c
ret 0x10
Function at 0x564880
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x34
push esi
push edi
xor edi, edi
push edi
lea eax, [esp + 0xc]
push eax
mov esi, 4
push esi
lea ecx, [esp + 0x54]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x56499e
cmp dword [esp + 8], esi
jne 0x56499e
mov eax, dword [esp + 0x48]
push ebx
xor ebx, ebx
test eax, eax
push ebp
mov dword [esp + 0x14], esi
jbe 0x56495f
mov esi, dword [esp + 0x4c]
mov ebp, 0xc
mov eax, dword [esi]
lea ecx, [esp + 0x4c]
push ecx
push 0x1c
lea edx, [esp + 0x30]
push edx
push esi
call dword [eax + 0xc]
test eax, eax
jl 0x564976
cmp dword [esp + 0x2c], 0x64
jne 0x56498f
mov ecx, dword [esp + 0x4c]
cmp ecx, dword [esp + 0x28]
jne 0x56498f
test eax, eax
jl 0x564976
mov edx, dword [esi]
lea eax, [esp + 0x18]
push eax
push ebp
lea ecx, [esp + 0x24]
push ecx
push esi
call dword [edx + 0xc]
mov edi, eax
test edi, edi
jl 0x56498f
cmp dword [esp + 0x18], ebp
jne 0x56498f
mov ecx, dword [esp + 0x48]
push 0
lea edx, [esp + 0x14]
push edx
push ebp
lea eax, [esp + 0x28]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x564980
cmp dword [esp + 0x10], ebp
jne 0x564980
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x50]
add edx, ebp
inc ebx
cmp ebx, eax
mov dword [esp + 0x14], edx
jb 0x5648d2
mov eax, dword [esp + 0x54]
test eax, eax
je 0x564974
mov edx, dword [esp + 0x14]
mov dword [eax], edx
mov dword [eax + 4], 0
mov eax, edi
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x34
ret 0x10
pop ebp
pop ebx
pop edi
mov eax, 0x8004e009
pop esi
add esp, 0x34
ret 0x10
pop ebp
pop ebx
pop edi
mov eax, 0x8004e008
pop esi
add esp, 0x34
ret 0x10
pop edi
mov eax, 0x8004e009
pop esi
add esp, 0x34
ret 0x10
Function at 0x564a30
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x114
push esi
mov esi, dword [esp + 0x11c]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
push 0
push esi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
call edi
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
push esi
call sym.vidcap60.exe__riff_ReadFileID_12
test eax, eax
jl 0x564b32
mov edx, dword [esp + 0xc]
push 1
push 0
push edx
push esi
call edi
mov eax, dword [esp + 0x124]
test eax, eax
jne 0x564a9d
pop edi
mov eax, 0x80004005
pop esi
add esp, 0x114
ret 8
push ebx
push eax
call sym.vidcap60.exe__SfGetFileNamePtrW_4
push 0x104
push eax
lea eax, [esp + 0x24]
push eax
call fcn.00461300
mov al, byte [esp + 0x1c]
xor ebx, ebx
test al, al
je 0x564ac9
mov edi, edi
mov al, byte [esp + ebx + 0x1d]
inc ebx
test al, al
jne 0x564ac0
inc ebx
push ebx
push 0x49504653
push esi
call sym.vidcap60.exe__riff_WriteChunkHeader_12
test eax, eax
jl 0x564b31
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ecx, [esp + 0x1c]
push ecx
push ebx
lea edx, [esp + 0x28]
push edx
push esi
call edi
test eax, eax
jne 0x564b05
pop ebx
pop edi
mov eax, 0x8004e009
pop esi
add esp, 0x114
ret 8
test bl, 1
je 0x564b25
push 0
lea eax, [esp + 0x1c]
push eax
push 1
lea ecx, [esp + 0x1b]
push ecx
push esi
mov byte [esp + 0x23], 0
call edi
test eax, eax
je 0x564af4
inc ebx
add ebx, 8
push ebx
push esi
call sym.vidcap60.exe__riff_UpdateRIFFSize_8
xor eax, eax
pop ebx
pop edi
pop esi
add esp, 0x114
ret 8

Function at 0x565550
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x318
push esi
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x565639
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 8]
push edx
push 0x49504653
push esi
call sym.vidcap60.exe__riff_FindChunkHeaderInRIFF_16
test eax, eax
jl 0x565632
mov eax, dword [esp + 4]
cmp eax, 0x104
jb 0x5655ac
mov eax, 0x104
push 0
lea ecx, [esp + 0xc]
push ecx
push eax
lea edx, [esp + 0x1c]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x565632
mov eax, dword [esp + 0x320]
push edi
push eax
call sym.vidcap60.exe__SfGetFileNamePtrW_4
mov ecx, dword [esp + 8]
push 0x104
lea edx, [esp + 0x11c]
push edx
push 0xffffffffffffffff
mov edi, eax
lea eax, [esp + 0x20]
push eax
push 1
push 0
mov byte [esp + ecx + 0x2b], 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea ecx, [esp + 0x118]
push edi
push ecx
mov word [esp + 0x326], 0
call dword [0x5d24c4]
add esp, 8
test eax, eax
pop edi
jne 0x565632
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop esi
add esp, 0x318
ret 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
add esp, 0x318
ret 8
Function at 0x5658a0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
push 0x10
push esi
call edi
push 0
lea eax, [esp + 0x20]
push eax
push 8
lea ecx, [esp + 0x14]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x5658fd
cmp dword [esp + 0x1c], 8
jne 0x5658fd
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
push 0
lea ecx, [esp + 0x18]
push ecx
push eax
push esi
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], edx
call edi
pop edi
xor eax, eax
pop esi
add esp, 0x10
ret 4
pop edi
mov eax, 0x8004e008
pop esi
add esp, 0x10
ret 4

Function at 0x565990
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x20]
push ebx
xor ebx, ebx
and eax, 7
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
push edi
mov edi, dword [esp + 0x24]
mov byte [esp + 0x10], bl
mov byte [esp + 0x11], bl
mov byte [esp + 0x12], bl
mov byte [esp + 0x13], bl
mov byte [esp + 0x14], bl
mov byte [esp + 0x15], bl
mov byte [esp + 0x16], bl
mov byte [esp + 0x17], bl
jbe 0x565a04
push ebx
mov esi, 8
sub esi, eax
lea eax, [esp + 0x28]
push eax
push esi
lea ecx, [esp + 0x1c]
push ecx
push edi
call ebp
test eax, eax
je 0x565a6c
cmp esi, dword [esp + 0x24]
jne 0x565a6c
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
add ecx, esi
adc eax, ebx
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
push ebx
lea ecx, [esp + 0x20]
push ecx
push eax
push edi
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov esi, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
add esi, 0x18
adc edx, ebx
push ebx
mov dword [esp + 0x38], edx
lea edx, [esp + 0x28]
push edx
push 8
lea eax, [esp + 0x3c]
push eax
push edi
mov dword [esp + 0x44], esi
call ebp
test eax, eax
je 0x565a6c
cmp dword [esp + 0x24], 8
jne 0x565a6c
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
push ecx
push edx
push edi
call sym.vidcap60.exe__riff64_UpdateRIFFSize_12
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0x14
pop edi
pop esi
pop ebp
mov eax, 0x8004e009
pop ebx
add esp, 0x10
ret 0x14
Function at 0x565a80
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
push edi
mov edi, dword [esp + 0x20]
test edi, edi
jne 0x565a95
xor eax, eax
pop edi
add esp, 0xc
ret 0x14
mov eax, dword [esp + 0x24]
cmp dword [eax], 0
jne 0x565aaa
mov eax, 0x80070057
pop edi
add esp, 0xc
ret 0x14
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push edi
push 0x42
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
test ebx, ebx
mov dword [esp + 0x14], ebx
je 0x565be5
mov eax, dword [esp + 0x24]
mov ecx, dword [eax]
lea edx, [esp + 0x18]
push edx
push edi
push ebx
push eax
call dword [ecx + 0xc]
mov ebp, eax
test ebp, ebp
jne 0x565bbf
push edi
push 0x42
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
test esi, esi
je 0x565bba
push edi
push ebx
push esi
call fcn.00461300
mov al, byte [esi]
xor edi, edi
test al, al
je 0x565b19
mov edi, edi
mov al, byte [edi + esi + 1]
inc edi
test al, al
jne 0x565b10
mov eax, dword [esp + 0x20]
inc edi
lea ebx, [edi + 4]
push ebx
push 0x6c62616c
push eax
call sym.vidcap60.exe__riff_WriteChunkHeader_12
mov ebp, eax
test ebp, ebp
jl 0x565b95
mov eax, dword [esp + 0x20]
push 0
lea ecx, [esp + 0x14]
push ecx
push 4
lea edx, [esp + 0x34]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x565b95
mov edx, dword [esp + 0x20]
push 0
lea ecx, [esp + 0x14]
push ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
push edx
call edi
test eax, eax
je 0x565b95
add ebx, 8
test bl, 1
je 0x565b8d
mov edx, dword [esp + 0x20]
push 0
lea eax, [esp + 0x14]
push eax
push 1
lea ecx, [esp + 0x38]
push ecx
push edx
inc ebx
mov byte [esp + 0x40], 0
call edi
mov eax, dword [esp + 0x30]
add dword [eax], ebx
jmp 0x565b9a
mov ebp, 0x8004e009
mov edi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
push esi
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ebx, dword [esp + 0x14]
jmp 0x565bc5
mov ebp, 0x8007000e
mov edi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
push ebx
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop esi
mov eax, ebp
pop ebp
pop ebx
pop edi
add esp, 0xc
ret 0x14
mov ebp, 0x8007000e
pop esi
mov eax, ebp
pop ebp
pop ebx
pop edi
add esp, 0xc
ret 0x14