Function at 0x5601b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x394
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp ebx, edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x10], edi
je 0x56056d
mov eax, dword [ebp + 0x10]
cmp eax, edi
je 0x56056d
mov esi, dword [ebp + 8]
push edi
push edi
push edi
push esi
mov dword [eax], edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x2c]
push ecx
push esi
call sym.vidcap60.exe__riff_ReadFileID_12
cmp eax, edi
jl 0x560572
lea edx, [esp + 0x2c]
push edx
push esi
call sym.vidcap60.exe__riff_SaveLocation_8
cmp dword [esp + 0x34], 0x45564157
je 0x560231
mov edi, 0x8004e00a
jmp 0x56051b
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x18]
push edx
push 0x20746d66
push esi
mov dword [esp + 0x2c], eax
call sym.vidcap60.exe__riff_FindChunkHeader_16
mov edi, eax
test edi, edi
jl 0x56051b
mov eax, dword [esp + 0x14]
cmp eax, 0x12
ja 0x560266
mov eax, 0x12
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
test esi, esi
mov dword [esp + 0x20], esi
jne 0x56028a
mov edi, 0x8007000e
jmp 0x56051b
mov ecx, dword [esp + 0x14]
mov edx, dword [ebp + 8]
push 0
lea eax, [esp + 0x28]
push eax
push ecx
push esi
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x5602af
mov edi, 0x8004e008
jmp 0x56051b
mov eax, dword [esp + 0x24]
cmp eax, dword [esp + 0x14]
je 0x5602c3
mov edi, 0x8004e008
jmp 0x56051b
cmp word [esi], 1
je 0x5602d3
mov edi, 0x8004e00a
jmp 0x56051b
xor eax, eax
mov ecx, 0xf4
mov edi, ebx
rep stosd dword es:[edi], eax
mov edx, dword [ebx]
mov ecx, dword [esi + 4]
mov eax, dword [esp + 0x2c]
mov esi, dword [ebp + 8]
or edx, 8
mov dword [ebx], edx
mov edx, dword [esp + 0x28]
push eax
push esi
mov dword [ebx + 0x2c0], ecx
mov dword [esp + 0x24], edx
call sym.vidcap60.exe__riff_RestoreLocation_8
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x18]
push edx
push 0x74786562
push esi
call sym.vidcap60.exe__riff_FindChunkHeader_16
test eax, eax
jge 0x560332
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x18]
push ecx
push 0x54584542
push esi
call sym.vidcap60.exe__riff_FindChunkHeader_16
cmp eax, 0x8004e00a
jne 0x560340
xor edi, edi
jmp 0x560522
test eax, eax
jl 0x560516
mov edx, dword [esp + 0x14]
cmp edx, 4
jb 0x560516
mov eax, dword [ebp + 0x14]
test eax, eax
mov dword [esp + 0x30], edx
je 0x560384
xor eax, eax
mov ecx, 0x96
lea edi, [esp + 0x140]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edi, [esp + 0x140]
mov dword [esp + 0x10], edi
mov eax, 0x25a
jmp 0x5603b3
inc edx
push edx
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
mov dword [esp + 0x10], eax
jne 0x5603a7
mov edi, 0x8007000e
jmp 0x56051b
mov edx, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x30]
push edx
push eax
push edi
push esi
call sym.vidcap60.exe__riff_ReadDataBounded_16
test eax, eax
je 0x5603ca
mov edi, 0x8004e008
jmp 0x56051b
add edi, 0x140
push edi
mov ecx, ebx
call fcn.00560760
mov edi, eax
test edi, edi
jl 0x56051b
mov edx, dword [esp + 0x10]
add edx, 0x14a
push edx
mov ecx, ebx
call fcn.00560860
mov edi, eax
test edi, edi
jl 0x56051b
mov edx, dword [esp + 0x10]
mov eax, dword [edx + 0x156]
mov ecx, dword [edx + 0x152]
mov dword [ebx + 0x2b8], ecx
mov ecx, dword [ebx]
mov dword [ebx + 0x2bc], eax
mov ax, word [edx + 0x15a]
mov word [ebx + 8], ax
mov eax, dword [ebp + 0x14]
or ecx, 4
xor edi, edi
test eax, eax
mov dword [ebx], ecx
je 0x560447
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 1
mov dword [esp + 0x10], edi
jmp 0x560522
xor eax, eax
mov ecx, 0x40
lea edi, [esp + 0x38]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov esi, edx
push 0x101
mov ecx, 0x40
lea edi, [esp + 0x3c]
rep movsd dword es:[edi], dword [esi]
lea esi, [ebx + 0xa]
push esi
push 0xffffffffffffffff
lea edx, [esp + 0x44]
push edx
push 1
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [esp + 0x10]
add eax, 0x100
push eax
mov ecx, ebx
mov word [esi + 0x200], 0
call fcn.00560680
mov edi, eax
test edi, edi
jl 0x56051b
mov ecx, dword [esp + 0x10]
add ecx, 0x120
push ecx
mov ecx, ebx
call fcn.005606f0
mov edi, eax
test edi, edi
jl 0x56051b
mov eax, dword [esp + 0x10]
lea esi, [eax + 0x15c]
lea edi, [ebx + 0x2c4]
mov ecx, 0x10
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x2f
lea esi, [eax + 0x19c]
lea edi, [ebx + 0x304]
rep movsd dword es:[edi], dword [esi]
cmp dword [esp + 0x14], 4
movsw word es:[edi], word [esi]
mov ecx, ebx
jbe 0x5604f1
add eax, 0x25a
push eax
jmp 0x5604fb
lea edx, [esp + 0x1b]
mov byte [esp + 0x1b], 0
push edx
call fcn.00560bb0
mov edi, eax
test edi, edi
jl 0x56051b
or dword [ebx], 1
mov eax, dword [ebp + 0x10]
xor edi, edi
mov dword [eax], 1
jmp 0x560522
mov edi, 0x8004e00b
mov ecx, ebx
call fcn.004cc400
mov eax, dword [esp + 0x20]
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
je 0x560546
mov ebx, eax
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ebx, dword [esp + 0x10]
test ebx, ebx
je 0x560562
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, 0x80070057
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10