joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cf5d0
Capabilities:
Get file system object information

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x304
test eax, eax
je 0x4cf62a
mov ecx, dword [eax]
push 1
push 0x104
lea edx, [esp + 0x58]
push edx
push eax
call dword [ecx + 0x10]
test eax, eax
jl 0x4cf69c
cmp word [esp + 0x50], 0
je 0x4cf69c
mov ecx, dword [0x621c80]
push 0x28
lea eax, [esp + 4]
push eax
push 0x16
push 0xbd72
push ecx
call sym.vidcap60.exe__SfGetString_8
push eax
call sym.vidcap60.exe__SfFormatPropLabel_16
lea edx, [esp + 0x50]
jmp 0x4cf681
mov eax, dword [esp + 0x310]
cmp word [eax], 0
je 0x4cf69c
push 0x400
push 0x2b4
lea edx, [esp + 0x58]
push edx
push 0
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
cmp word [esp + 0x264], 0
je 0x4cf69c
mov ecx, dword [0x621c80]
push 0x28
lea eax, [esp + 4]
push eax
push 0x16
push 0xbd72
push ecx
call sym.vidcap60.exe__SfGetString_8
push eax
call sym.vidcap60.exe__SfFormatPropLabel_16
lea edx, [esp + 0x264]
mov ecx, dword [esp + 0x308]
push edx
lea eax, [esp + 4]
push eax
push 0x5d4ee8
push ecx
call sym.vidcap60.exe_SfMEditPrintF
add esp, 0x10
add esp, 0x304
ret 0xc

Function at 0x4cfc60
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x444
mov eax, dword [esp + 0x448]
test eax, eax
push ebx
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0
je 0x4cfd7d
mov ebx, dword [esp + 0x450]
test ebx, ebx
je 0x4cfd7d
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push edi
lea ecx, [esp + 0x14]
push ecx
push 0x20019
push 0
push eax
push SysReAllocString
call esi
test eax, eax
jne 0x4cfd45
mov ecx, dword [esp + 0x14]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x1c]
push eax
push 0
push 0
push 0
push ecx
mov dword [esp + 0x28], 0x208
call edi
test eax, eax
jne 0x4cfd45
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x224]
push str._s_shellopencommand
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
push 0x20019
push 0
lea edx, [esp + 0x22c]
push edx
push SysReAllocString
call esi
test eax, eax
jne 0x4cfd45
mov eax, dword [esp + 0x45c]
lea edx, [esp + 0x10]
push edx
push ebx
push 0
push 0
lea ecx, [eax + eax]
mov eax, dword [esp + 0x1c]
push 0
push eax
mov dword [esp + 0x28], ecx
call edi
test eax, eax
jne 0x4cfd45
xor esi, esi
jmp 0x4cfd53
jle 0x4cfd51
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
mov eax, dword [esp + 0x14]
test eax, eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x4cfd64
push eax
call edi
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4cfd6f
push eax
call edi
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x444
ret 0xc
mov eax, 0x80070057
pop ebx
add esp, 0x444
ret 0xc
Function at 0x4cfe80
Capabilities:
Get common file path

Disassembly:
sub esp, 0x24
push ebx
mov ebx, dword [esp + 0x34]
push ebp
mov ebp, dword [esp + 0x3c]
push esi
push edi
push ebp
xor edi, edi
push ebx
mov esi, 0x80070057
mov dword [esp + 0x18], edi
call sym.vidcap60.exe__SfRemoveSlashFromPathNameEnd_8
cmp ebp, 0x104
jb 0x4d0023
push edi
call dword [sym.imp.ole32.dll_CoInitialize]
cmp eax, edi
jl 0x4d0025
lea eax, [esp + 0x40]
push eax
mov dword [esp + 0x44], edi
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
mov esi, eax
cmp esi, edi
jl 0x4d001d
mov eax, dword [esp + 0x4c]
xor ecx, ecx
cmp eax, edi
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], ecx
mov dword [esp + 0x44], edi
je 0x4cff0b
lea edx, [esp + 0x44]
push edx
push edi
jmp 0x4cff12
lea eax, [esp + 0x44]
push eax
push 0x11
mov edi, dword [esp + 0x40]
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov esi, eax
test esi, esi
jl 0x4cfffd
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x3c]
neg eax
sbb eax, eax
and eax, ebx
mov esi, 1
push 0x5eacd4
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x24], edx
mov dword [esp + 0x2c], 0x4cc820
mov dword [esp + 0x28], esi
mov dword [esp + 0x30], eax
call sym.vidcap60.exe_long_long___int64____stdcall_SfGetDllVersion_unsigned_short_int_const__
cmp edx, 0x50000
jb 0x4cff8b
ja 0x4cff72
test eax, eax
jb 0x4cff8b
push 0
call dword [sym.imp.ole32.dll_OleInitialize]
test eax, eax
jl 0x4cffa4
mov eax, dword [esp + 0x24]
or eax, 0x40
mov dword [esp + 0x10], esi
jmp 0x4cffa0
cmp edx, 0x40047
jb 0x4cffa4
ja 0x4cff99
test eax, eax
jb 0x4cffa4
mov eax, dword [esp + 0x24]
or eax, 0x30
mov dword [esp + 0x24], eax
lea ecx, [esp + 0x14]
push ecx
mov esi, 0x8004e00c
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
mov edi, eax
test edi, edi
je 0x4cffe6
push ebx
push edi
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x4cffd1
push ebp
push ebx
call sym.vidcap60.exe__SfAddSlashToPathName_8
xor esi, esi
jmp 0x4cffdb
mov esi, 0x80004005
mov word [ebx], 0
mov eax, dword [esp + 0x40]
mov edx, dword [eax]
push edi
push eax
call dword [edx + 0x14]
mov edx, dword [esp + 0x44]
mov eax, dword [esp + 0x40]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x14]
mov dword [esp + 0x44], 0
mov eax, dword [esp + 0x40]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x10]
test eax, eax
mov dword [esp + 0x40], 0
je 0x4d001d
call dword [sym.imp.ole32.dll_OleUninitialize]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 0x18
Function at 0x4d3ac0
Capabilities:
Delete file

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x4d3af0
lea eax, [esi + 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 1
push 0
lea ecx, [esi + 0x618]
push ecx
call sym.vidcap60.exe__SfDeleteDirectory_12
push esi
call dword [0x5d25a4]
add esp, 4
xor eax, eax
pop esi
ret 4

Function at 0x4d3b40
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x618
push ebp
push esi
mov esi, ecx
test esi, esi
mov ebp, 0x80004005
jne 0x4d3b60
pop esi
mov eax, ebp
pop ebp
add esp, 0x618
ret 0xc
test eax, eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
je 0x4d3b7c
cmp word [eax], 0
je 0x4d3b7c
push eax
lea eax, [esp + 0x420]
push eax
jmp 0x4d3bcf
lea ecx, [esp + 0x214]
push 0x623518
push ecx
call dword [0x5d2614]
add esp, 8
cmp word [esp + 0x214], 0
je 0x4d3bc2
lea edx, [esi + 0x410]
push edx
push 0x104
lea eax, [esp + 0x14]
push eax
push 0x5d49c0
push ebx
lea ecx, [esp + 0x228]
push ecx
call edi
test eax, eax
jne 0x4d3c01
push 0x5ead80
lea edx, [esp + 0x420]
push edx
call dword [0x5d2614]
add esp, 8
add esi, 0x410
push esi
push 0x104
lea eax, [esp + 0x14]
push eax
push 0x5d49c0
push ebx
lea ecx, [esp + 0x430]
push ecx
call edi
test eax, eax
je 0x4d3cb6
mov eax, dword [esp + 0x628]
cmp eax, 2
je 0x4d3c83
jle 0x4d3c70
cmp eax, 5
jg 0x4d3c70
lea edx, [esp + 0xc]
push edx
call fcn.00404a80
push 2
mov esi, eax
push 0x5e8e0c
push esi
call fcn.0049cba0
test eax, eax
push 0
push esi
jne 0x4d3c52
call sym.vidcap60.exe__SfHexToDWordToken_8
mov ecx, dword [esp + 0x62c]
pop edi
xor ebp, ebp
mov dword [ecx], eax
pop esi
mov eax, ebp
pop ebp
add esp, 0x618
ret 0xc
call sym.vidcap60.exe__SfTextToDWordToken_8
mov ecx, dword [esp + 0x62c]
pop edi
xor ebp, ebp
mov dword [ecx], eax
pop esi
mov eax, ebp
pop ebp
add esp, 0x618
ret 0xc
pop edi
mov ebp, 0x80004001
pop esi
mov eax, ebp
pop ebp
add esp, 0x618
ret 0xc
mov eax, dword [esp + 0x630]
test eax, eax
jle 0x4d3cb1
push eax
mov eax, dword [esp + 0x630]
lea edx, [esp + 0x10]
push edx
push eax
call fcn.004049b0
pop edi
xor ebp, ebp
pop esi
mov eax, ebp
pop ebp
add esp, 0x618
ret 0xc
mov ebp, 0x8004e03c
pop edi
pop esi
mov eax, ebp
pop ebp
add esp, 0x618
ret 0xc
Function at 0x4d3cd0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x61c
push esi
mov esi, eax
test esi, esi
mov dword [esp + 4], 0
jne 0x4d3cf2
mov eax, 0x80070057
pop esi
add esp, 0x61c
ret
push ebx
push ebp
push edi
lea eax, [esp + 0x424]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push esi
call sym.vidcap60.exe__SfGetFileNamePtrW_4
push eax
lea ecx, [esp + 0x428]
push ecx
lea edx, [esp + 0x1c]
push 0x5d4ee8
push edx
call sym.vidcap60.exe_SfPrintF
add esp, 0x10
push 0x104
lea eax, [esp + 0x18]
push eax
call sym.vidcap60.exe__SfAddSlashToPathName_8
mov ebp, dword [0x5d2614]
lea ecx, [esp + 0x14]
push ecx
lea ebx, [esi + 0x618]
push ebx
call ebp
add esp, 8
lea edx, [esp + 0x10]
push edx
push 2
push esi
call sym.vidcap60.exe__SfZip_Open_12
mov edi, eax
test edi, edi
jl 0x4d3dbc
push 0
lea eax, [esp + 0x18]
push eax
call sym.vidcap60.exe__SfCreateDirectory_8
lea edi, [esi + 0x208]
push edi
push ebx
lea ecx, [esp + 0x224]
push 0x5d4ee8
push ecx
call sym.vidcap60.exe_SfPrintF
mov eax, dword [esp + 0x20]
add esp, 0x10
push 0
push 0
lea edx, [esp + 0x224]
push edx
push edi
push eax
call sym.vidcap60.exe__SfZip_ExtractFile_20
mov edi, eax
test edi, edi
jl 0x4d3dbc
lea ecx, [esp + 0x21c]
push ecx
add esi, 0x410
push esi
call ebp
add esp, 8
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4d3dcc
push eax
call sym.vidcap60.exe__SfZip_Close_4
mov edi, eax
test edi, edi
jge 0x4d3dde
push 1
push 0
lea edx, [esp + 0x1c]
push edx
call sym.vidcap60.exe__SfDeleteDirectory_12
mov eax, edi
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x61c
ret
Function at 0x4d3df0
Capabilities:
Get common file path

Disassembly:
mov eax, 0x17e8
call fcn.005c4400
push esi
mov esi, ecx
test esi, esi
jne 0x4d3e0e
mov eax, 0x80070057
pop esi
add esp, 0x17e8
ret
push ebx
push ebp
push edi
lea eax, [esp + 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push esi
call sym.vidcap60.exe__SfGetFileNamePtrW_4
push eax
lea ecx, [esp + 0x21c]
push ecx
lea edx, [esp + 0x18]
push 0x5d4ee8
push edx
call sym.vidcap60.exe_SfPrintF
add esp, 0x10
push 0x104
lea eax, [esp + 0x14]
push eax
call sym.vidcap60.exe__SfAddSlashToPathName_8
mov ebp, dword [0x5d2614]
lea ecx, [esp + 0x10]
push ecx
lea ebx, [esi + 0x618]
push ebx
call ebp
add esp, 8
lea ecx, [esp + 0x628]
call sym.vidcap60.exe_public:_void___thiscall_CArchive2::constructor_void_
push 0
push 1
push esi
lea edx, [esp + 0x634]
push edx
call sym.vidcap60.exe_public:_long_int___stdcall_CArchive2::Open_unsigned_short_int_const___unsigned_long_int__class_CSfArchiveProgress__
mov edi, eax
test edi, edi
jl 0x4d3ef0
push 0
lea eax, [esp + 0x14]
push eax
call sym.vidcap60.exe__SfCreateDirectory_8
lea edi, [esi + 0x208]
push edi
push ebx
lea ecx, [esp + 0x428]
push 0x5d4ee8
push ecx
call sym.vidcap60.exe_SfPrintF
add esp, 0x10
push 4
push ebx
push edi
lea edx, [esp + 0x634]
push edx
call sym.vidcap60.exe_public:_long_int___stdcall_CArchive2::ExtractEntry_unsigned_short_int_const___unsigned_short_int_const___unsigned_long_int_
mov edi, eax
test edi, edi
jl 0x4d3ee3
lea eax, [esp + 0x420]
push eax
add esi, 0x410
push esi
call ebp
add esp, 8
lea ecx, [esp + 0x628]
push ecx
call sym.vidcap60.exe_public:_long_int___stdcall_CArchive2::Close_void_
lea ecx, [esp + 0x628]
call sym.vidcap60.exe_public_virtual:_void___thiscall_CArchive2::destructor_void_
mov eax, edi
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x17e8
ret

Function at 0x4d4200
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x820
test eax, eax
push edi
je 0x4d430c
mov edi, dword [esp + 0x828]
test edi, edi
je 0x4d430c
push ebx
mov ebx, dword [0x5d2614]
push ebp
push esi
lea eax, [esp + 0x218]
push 0x623518
push eax
mov ebp, 0x80004005
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
add esp, 8
cmp word [esp + 0x218], 0
je 0x4d427c
lea ecx, [edi + 0x410]
push ecx
push 0x104
lea edx, [esp + 0x18]
push edx
push 0x5d49c0
push 0x5eadec
lea eax, [esp + 0x22c]
push eax
call esi
test eax, eax
jne 0x4d42b7
lea ecx, [esp + 0x420]
push 0x5ead80
push ecx
call ebx
add esp, 8
add edi, 0x410
push edi
push 0x104
lea edx, [esp + 0x18]
push edx
push 0x5d49c0
push 0x5eadec
lea eax, [esp + 0x434]
push eax
call esi
test eax, eax
je 0x4d42f0
push 0x104
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x630]
push edx
call dword [0x5d2618]
mov eax, dword [esp + 0x844]
add esp, 0xc
xor ebp, ebp
pop esi
mov dword [eax], 1
mov eax, ebp
pop ebp
pop ebx
pop edi
add esp, 0x820
ret 8
mov ecx, dword [esp + 0x838]
pop esi
mov eax, ebp
pop ebp
pop ebx
mov dword [ecx], 0
pop edi
add esp, 0x820
ret 8
mov eax, 0x80070057
pop edi
add esp, 0x820
ret 8
Function at 0x4d44d0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x820
push ebx
mov ebx, dword [esp + 0x828]
test ebx, ebx
jne 0x4d44f1
mov eax, 0x80070057
pop ebx
add esp, 0x820
ret 8
push ebp
push esi
push edi
mov edi, dword [0x5d2614]
lea eax, [esp + 0x10]
push 0x623518
push eax
mov ebp, 0x80004005
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
add esp, 8
cmp word [esp + 0x10], 0
je 0x4d4545
lea ecx, [ebx + 0x410]
push ecx
push 0x104
lea edx, [esp + 0x428]
push edx
push 0x5d49c0
push str.splash
lea eax, [esp + 0x24]
push eax
call esi
test eax, eax
jne 0x4d4583
lea ecx, [esp + 0x628]
push 0x5ead80
push ecx
call edi
add esp, 8
lea edx, [ebx + 0x410]
push edx
push 0x104
lea eax, [esp + 0x428]
push eax
push 0x5d49c0
push str.splash
lea ecx, [esp + 0x63c]
push ecx
call esi
test eax, eax
je 0x4d45ab
push 0x104
lea edx, [esp + 0x424]
push edx
lea eax, [esp + 0x220]
push eax
call dword [0x5d2618]
add esp, 0xc
xor ebp, ebp
mov word [esp + 0x41e], bp
test ebp, ebp
mov esi, ebp
jl 0x4d465b
cmp word [esp + 0x218], 0
je 0x4d465b
lea ecx, [esp + 0x218]
lea edi, [ebx + 0x618]
push ecx
call fcn.004d3a60
mov esi, eax
test esi, esi
jl 0x4d465b
lea edx, [esp + 0x218]
push edx
push edi
lea eax, [esp + 0x18]
push 0x5d4ee8
push eax
call sym.vidcap60.exe_SfPrintF
add esp, 0x10
lea ecx, [esp + 0x10]
push ecx
call sym.vidcap60.exe__SfGetFileNameExtensionPtrW_4
mov edi, eax
push str..jpg
push edi
call dword [0x5d25ac]
add esp, 8
test eax, eax
jne 0x4d4639
lea edx, [esp + 0x10]
push edx
call sym.vidcap60.exe_struct_tagBITMAPINFOHEADER____stdcall_SfLoadDiskJpegDib_unsigned_short_int_const__
mov ecx, dword [esp + 0x838]
pop edi
mov dword [ecx], eax
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x820
ret 8
push str..png
push edi
call fcn.00404a10
test eax, eax
jne 0x4d465b
lea edx, [esp + 0x10]
push edx
call sym.vidcap60.exe_struct_tagBITMAPINFOHEADER____stdcall_SfLoadDiskPngDib_unsigned_short_int_const__
mov ecx, dword [esp + 0x838]
mov dword [ecx], eax
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x820
ret 8
Function at 0x4d4850
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x820
test eax, eax
push ebx
je 0x4d49ad
mov ebx, dword [esp + 0x828]
test ebx, ebx
je 0x4d49ad
mov eax, dword [esp + 0x830]
test eax, eax
je 0x4d49ad
push ebp
push esi
mov esi, dword [0x5d2614]
push edi
lea eax, [esp + 0x420]
push 0x623518
push eax
mov ebp, 0x80004005
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
add esp, 8
cmp word [esp + 0x420], 0
je 0x4d48db
lea ecx, [ebx + 0x410]
push ecx
push 0x104
lea edx, [esp + 0x18]
push edx
push 0x5d49c0
push str.exitpage
lea eax, [esp + 0x434]
push eax
call edi
test eax, eax
jne 0x4d4916
lea ecx, [esp + 0x628]
push 0x5ead80
push ecx
call esi
add esp, 8
add ebx, 0x410
push ebx
push 0x104
lea edx, [esp + 0x18]
push edx
push 0x5d49c0
push str.exitpage
lea eax, [esp + 0x63c]
push eax
call edi
test eax, eax
je 0x4d495c
push 0x104
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x220]
push edx
call dword [0x5d2618]
mov ecx, dword [esp + 0x844]
lea eax, [esp + 0x224]
push eax
xor ebp, ebp
push ecx
mov word [esp + 0x432], bp
call esi
add esp, 0x14
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x820
ret 0x10
mov eax, dword [esp + 0x840]
test eax, eax
je 0x4d498c
mov edx, dword [esp + 0x83c]
push edx
push eax
mov eax, dword [esp + 0x840]
push eax
call fcn.004049b0
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x820
ret 0x10
mov ecx, dword [esp + 0x838]
push 0x5d49c0
push ecx
call fcn.00404990
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x820
ret 0x10
mov eax, 0x80070057
pop ebx
add esp, 0x820
ret 0x10

Function at 0x4d49c0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x618
push ebp
push esi
mov esi, dword [esp + 0x624]
test esi, esi
mov ebp, 0x80004005
jne 0x4d49f5
mov ecx, dword [esp + 0x62c]
mov edx, dword [esp + 0x628]
pop esi
mov eax, ebp
mov dword [edx], ecx
pop ebp
add esp, 0x618
ret 0xc
push ebx
mov ebx, dword [0x5d2614]
push edi
lea eax, [esp + 0x218]
push 0x623518
push eax
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
add esp, 8
cmp word [esp + 0x218], 0
je 0x4d4a49
lea ecx, [esi + 0x410]
push ecx
push 0x104
lea edx, [esp + 0x18]
push edx
push 0x5d49c0
push str.exitpagewidth
lea eax, [esp + 0x22c]
push eax
call edi
test eax, eax
jne 0x4d4a84
lea ecx, [esp + 0x420]
push 0x5ead80
push ecx
call ebx
add esp, 8
add esi, 0x410
push esi
push 0x104
lea edx, [esp + 0x18]
push edx
push 0x5d49c0
push str.exitpagewidth
lea eax, [esp + 0x434]
push eax
call edi
test eax, eax
je 0x4d4abb
lea ecx, [esp + 0x10]
push ecx
call fcn.00404a80
push 2
mov esi, eax
push 0x5e8e0c
push esi
call fcn.0049cba0
test eax, eax
push 0
push esi
jne 0x4d4aab
call sym.vidcap60.exe__SfHexToDWordToken_8
jmp 0x4d4ab0
call sym.vidcap60.exe__SfTextToDWordToken_8
mov edx, dword [esp + 0x630]
mov dword [edx], eax
xor ebp, ebp
test ebp, ebp
pop edi
mov eax, ebp
pop ebx
jge 0x4d4ad3
mov ecx, dword [esp + 0x62c]
mov edx, dword [esp + 0x628]
mov dword [edx], ecx
pop esi
pop ebp
add esp, 0x618
ret 0xc
Function at 0x4d4ae0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x618
push ebp
push esi
mov esi, dword [esp + 0x624]
test esi, esi
mov ebp, 0x80004005
jne 0x4d4b15
mov ecx, dword [esp + 0x62c]
mov edx, dword [esp + 0x628]
pop esi
mov eax, ebp
mov dword [edx], ecx
pop ebp
add esp, 0x618
ret 0xc
push ebx
mov ebx, dword [0x5d2614]
push edi
lea eax, [esp + 0x218]
push 0x623518
push eax
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
add esp, 8
cmp word [esp + 0x218], 0
je 0x4d4b69
lea ecx, [esi + 0x410]
push ecx
push 0x104
lea edx, [esp + 0x18]
push edx
push 0x5d49c0
push str.exitpageheight
lea eax, [esp + 0x22c]
push eax
call edi
test eax, eax
jne 0x4d4ba4
lea ecx, [esp + 0x420]
push 0x5ead80
push ecx
call ebx
add esp, 8
add esi, 0x410
push esi
push 0x104
lea edx, [esp + 0x18]
push edx
push 0x5d49c0
push str.exitpageheight
lea eax, [esp + 0x434]
push eax
call edi
test eax, eax
je 0x4d4bdb
lea ecx, [esp + 0x10]
push ecx
call fcn.00404a80
push 2
mov esi, eax
push 0x5e8e0c
push esi
call fcn.0049cba0
test eax, eax
push 0
push esi
jne 0x4d4bcb
call sym.vidcap60.exe__SfHexToDWordToken_8
jmp 0x4d4bd0
call sym.vidcap60.exe__SfTextToDWordToken_8
mov edx, dword [esp + 0x630]
mov dword [edx], eax
xor ebp, ebp
test ebp, ebp
pop edi
mov eax, ebp
pop ebx
jge 0x4d4bf3
mov ecx, dword [esp + 0x62c]
mov edx, dword [esp + 0x628]
mov dword [edx], ecx
pop esi
pop ebp
add esp, 0x618
ret 0xc

Function at 0x4d4c00
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x618
push ebp
push esi
mov esi, dword [esp + 0x624]
test esi, esi
mov ebp, 0x80004005
jne 0x4d4c35
mov ecx, dword [esp + 0x62c]
mov edx, dword [esp + 0x628]
pop esi
mov eax, ebp
mov dword [edx], ecx
pop ebp
add esp, 0x618
ret 0xc
push ebx
mov ebx, dword [0x5d2614]
push edi
lea eax, [esp + 0x218]
push 0x623518
push eax
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
add esp, 8
cmp word [esp + 0x218], 0
je 0x4d4c89
lea ecx, [esi + 0x410]
push ecx
push 0x104
lea edx, [esp + 0x18]
push edx
push 0x5d49c0
push str.exitpagetimer
lea eax, [esp + 0x22c]
push eax
call edi
test eax, eax
jne 0x4d4cc4
lea ecx, [esp + 0x420]
push 0x5ead80
push ecx
call ebx
add esp, 8
add esi, 0x410
push esi
push 0x104
lea edx, [esp + 0x18]
push edx
push 0x5d49c0
push str.exitpagetimer
lea eax, [esp + 0x434]
push eax
call edi
test eax, eax
je 0x4d4cfb
lea ecx, [esp + 0x10]
push ecx
call fcn.00404a80
push 2
mov esi, eax
push 0x5e8e0c
push esi
call fcn.0049cba0
test eax, eax
push 0
push esi
jne 0x4d4ceb
call sym.vidcap60.exe__SfHexToDWordToken_8
jmp 0x4d4cf0
call sym.vidcap60.exe__SfTextToDWordToken_8
mov edx, dword [esp + 0x630]
mov dword [edx], eax
xor ebp, ebp
test ebp, ebp
pop edi
mov eax, ebp
pop ebx
jge 0x4d4d13
mov ecx, dword [esp + 0x62c]
mov edx, dword [esp + 0x628]
mov dword [edx], ecx
pop esi
pop ebp
add esp, 0x618
ret 0xc
Function at 0x4d4d20
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x618
push ebp
push esi
mov esi, dword [esp + 0x624]
test esi, esi
mov ebp, 0x80004005
jne 0x4d4d55
mov ecx, dword [esp + 0x62c]
mov edx, dword [esp + 0x628]
pop esi
mov eax, ebp
mov dword [edx], ecx
pop ebp
add esp, 0x618
ret 0xc
push ebx
mov ebx, dword [0x5d2614]
push edi
lea eax, [esp + 0x218]
push 0x623518
push eax
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
add esp, 8
cmp word [esp + 0x218], 0
je 0x4d4da9
lea ecx, [esi + 0x410]
push ecx
push 0x104
lea edx, [esp + 0x18]
push edx
push 0x5d49c0
push str.globalpagewidth
lea eax, [esp + 0x22c]
push eax
call edi
test eax, eax
jne 0x4d4de4
lea ecx, [esp + 0x420]
push 0x5ead80
push ecx
call ebx
add esp, 8
add esi, 0x410
push esi
push 0x104
lea edx, [esp + 0x18]
push edx
push 0x5d49c0
push str.globalpagewidth
lea eax, [esp + 0x434]
push eax
call edi
test eax, eax
je 0x4d4e1b
lea ecx, [esp + 0x10]
push ecx
call fcn.00404a80
push 2
mov esi, eax
push 0x5e8e0c
push esi
call fcn.0049cba0
test eax, eax
push 0
push esi
jne 0x4d4e0b
call sym.vidcap60.exe__SfHexToDWordToken_8
jmp 0x4d4e10
call sym.vidcap60.exe__SfTextToDWordToken_8
mov edx, dword [esp + 0x630]
mov dword [edx], eax
xor ebp, ebp
test ebp, ebp
pop edi
mov eax, ebp
pop ebx
jge 0x4d4e33
mov ecx, dword [esp + 0x62c]
mov edx, dword [esp + 0x628]
mov dword [edx], ecx
pop esi
pop ebp
add esp, 0x618
ret 0xc

Function at 0x4d4e40
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x618
push ebp
push esi
mov esi, dword [esp + 0x624]
test esi, esi
mov ebp, 0x80004005
jne 0x4d4e75
mov ecx, dword [esp + 0x62c]
mov edx, dword [esp + 0x628]
pop esi
mov eax, ebp
mov dword [edx], ecx
pop ebp
add esp, 0x618
ret 0xc
push ebx
mov ebx, dword [0x5d2614]
push edi
lea eax, [esp + 0x218]
push 0x623518
push eax
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
add esp, 8
cmp word [esp + 0x218], 0
je 0x4d4ec9
lea ecx, [esi + 0x410]
push ecx
push 0x104
lea edx, [esp + 0x18]
push edx
push 0x5d49c0
push str.globalpageheight
lea eax, [esp + 0x22c]
push eax
call edi
test eax, eax
jne 0x4d4f04
lea ecx, [esp + 0x420]
push 0x5ead80
push ecx
call ebx
add esp, 8
add esi, 0x410
push esi
push 0x104
lea edx, [esp + 0x18]
push edx
push 0x5d49c0
push str.globalpageheight
lea eax, [esp + 0x434]
push eax
call edi
test eax, eax
je 0x4d4f3b
lea ecx, [esp + 0x10]
push ecx
call fcn.00404a80
push 2
mov esi, eax
push 0x5e8e0c
push esi
call fcn.0049cba0
test eax, eax
push 0
push esi
jne 0x4d4f2b
call sym.vidcap60.exe__SfHexToDWordToken_8
jmp 0x4d4f30
call sym.vidcap60.exe__SfTextToDWordToken_8
mov edx, dword [esp + 0x630]
mov dword [edx], eax
xor ebp, ebp
test ebp, ebp
pop edi
mov eax, ebp
pop ebx
jge 0x4d4f53
mov ecx, dword [esp + 0x62c]
mov edx, dword [esp + 0x628]
mov dword [edx], ecx
pop esi
pop ebp
add esp, 0x618
ret 0xc