joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ca1b0
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20]
push edi
mov edi, dword [esp + 0x18]
push esi
lea eax, [esp + 0x28]
push eax
push 0x5453494c
push edi
call sym.vidcap60.exe__riff_FindChunkHeader_16
test eax, eax
jl 0x4ca283
mov ebp, dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea esp, [esp]
test esi, esi
je 0x4ca1e9
cmp dword [esi], 4
jl 0x4ca256
push 0
lea ecx, [esp + 0x1c]
push ecx
push 4
lea edx, [esp + 0x1c]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4ca263
cmp dword [esp + 0x18], 4
jne 0x4ca263
test esi, esi
je 0x4ca210
add dword [esi], 0xfffffffc
mov eax, dword [esp + 0x1c]
cmp dword [esp + 0x10], eax
je 0x4ca270
mov ebx, dword [esp + 0x24]
test bl, 1
je 0x4ca228
inc ebx
mov dword [esp + 0x24], ebx
push 1
push 0
lea ecx, [ebx - 4]
push ecx
push edi
call ebp
test esi, esi
je 0x4ca239
sub dword [esi], ebx
push esi
lea edx, [esp + 0x28]
push edx
push 0x5453494c
push edi
call sym.vidcap60.exe__riff_FindChunkHeader_16
test eax, eax
jge 0x4ca1e0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
pop edi
pop esi
pop ebp
mov eax, 0x8004e00a
pop ebx
pop ecx
ret 0x10
pop edi
pop esi
pop ebp
mov eax, 0x8004e008
pop ebx
pop ecx
ret 0x10
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4ca281
mov ecx, dword [esp + 0x24]
add ecx, 0xfffffffc
mov dword [eax], ecx
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10

Function at 0x4ca2f0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x14]
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
push edi
push 1
push 0
push 0
push ebx
mov dword [eax], 0
call ebp
mov edi, dword [esp + 0x28]
mov dword [esp + 0x14], eax
lea esp, [esp]
test edi, edi
je 0x4ca32d
cmp dword [edi], 8
jl 0x4ca3c3
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea ecx, [esp + 0x24]
push ecx
push 4
lea edx, [esp + 0x24]
push edx
push ebx
call esi
test eax, eax
jne 0x4ca34f
mov esi, 0x8004e008
jmp 0x4ca38e
cmp dword [esp + 0x20], 4
je 0x4ca35d
mov esi, 0x8004e008
jmp 0x4ca38e
push 0
lea eax, [esp + 0x24]
push eax
push 4
lea ecx, [esp + 0x1c]
push ecx
push ebx
call esi
test eax, eax
jne 0x4ca379
mov esi, 0x8004e008
jmp 0x4ca38e
mov esi, dword [esp + 0x20]
xor edx, edx
cmp esi, 4
sete dl
dec edx
and edx, 0x8004e008
mov esi, edx
test edi, edi
je 0x4ca395
add dword [edi], 0xfffffff8
test esi, esi
jne 0x4ca3db
mov eax, dword [esp + 0x10]
test al, 1
mov esi, eax
je 0x4ca3a6
lea esi, [eax + 1]
push 1
push 0
push esi
push ebx
call ebp
test edi, edi
mov dword [esp + 0x10], esi
je 0x4ca3b8
sub dword [edi], esi
mov eax, dword [esp + 0x24]
inc dword [eax]
jmp 0x4ca320
mov eax, dword [esp + 0x14]
push 0
push 0
push eax
push ebx
call ebp
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret 0xc
mov ecx, dword [esp + 0x14]
push 0
push 0
push ecx
push ebx
call ebp
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0xc
Function at 0x4ca400
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
test eax, eax
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], 0
je 0x4ca4d9
mov edi, dword [esp + 0x24]
mov ebx, dword [esp + 0x1c]
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
lea esp, [esp]
test edi, edi
je 0x4ca43d
cmp dword [edi], 8
jl 0x4ca4e5
push 0
lea eax, [esp + 0x28]
push eax
mov esi, 4
push esi
lea ecx, [esp + 0x20]
push ecx
push ebx
call ebp
test eax, eax
jne 0x4ca45d
mov eax, 0x8004e008
jmp 0x4ca496
cmp dword [esp + 0x24], esi
je 0x4ca46a
mov eax, 0x8004e008
jmp 0x4ca496
push 0
lea edx, [esp + 0x28]
push edx
push esi
lea eax, [esp + 0x28]
push eax
push ebx
call ebp
test eax, eax
jne 0x4ca485
mov eax, 0x8004e008
jmp 0x4ca496
mov ecx, dword [esp + 0x24]
xor eax, eax
cmp ecx, esi
sete al
dec eax
and eax, 0x8004e008
test edi, edi
je 0x4ca49d
add dword [edi], 0xfffffff8
test eax, eax
jne 0x4ca4ea
mov eax, dword [esp + 0x1c]
test al, 1
mov esi, eax
je 0x4ca4ae
lea esi, [eax + 1]
push 1
push 0
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test edi, edi
mov dword [esp + 0x1c], esi
je 0x4ca4c4
sub dword [edi], esi
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
inc eax
cmp ecx, eax
mov dword [esp + 0x10], eax
jne 0x4ca430
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 0xc
mov eax, 0x8004e00a
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
Function at 0x4ca500
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov eax, 0x1010
call fcn.005c4400
mov eax, dword [esp + 0x101c]
test eax, eax
je 0x4ca51b
mov dword [eax], 0
push ebx
push esi
mov esi, dword [esp + 0x101c]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
push 0
push esi
call edi
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
push esi
call sym.vidcap60.exe__riff_ReadFileID_12
mov edx, dword [esp + 0x10]
mov ebx, dword [esp + 0x102c]
test ebx, ebx
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x1028]
push ecx
push edx
push esi
je 0x4ca571
call sym.vidcap60.exe__riff_FindListChunk_16
jmp 0x4ca576
call sym.vidcap60.exe__riff_FindChunkHeader_16
test eax, eax
jl 0x4ca692
mov eax, dword [esp + 0xc]
test al, 1
je 0x4ca587
inc eax
add eax, 8
test ebx, ebx
mov dword [esp + 0xc], eax
je 0x4ca599
add eax, 4
mov dword [esp + 0xc], eax
push ebp
push 1
push 0
push 0
push esi
call edi
mov ebp, eax
sub ebp, 8
test ebx, ebx
je 0x4ca5af
sub ebp, 4
mov eax, dword [esp + 0x10]
push 0
push 0
lea ecx, [eax + ebp]
push ecx
push esi
call edi
push 0
lea edx, [esp + 0x1c]
push edx
push 0x1000
lea eax, [esp + 0x2c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4ca648
lea ebx, [ebx]
push 1
push 0
push 0
push esi
call edi
push 0
push 0
push ebp
push esi
mov ebx, eax
call edi
mov edx, dword [esp + 0x18]
push 0
lea ecx, [esp + 0x20]
push ecx
push edx
lea eax, [esp + 0x2c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4ca65a
push 1
push 0
push 0
push esi
call edi
mov ebp, eax
cmp dword [esp + 0x18], 0x1000
jb 0x4ca66c
push 0
push 0
push ebx
push esi
call edi
push 0
lea ecx, [esp + 0x1c]
push ecx
push 0x1000
lea edx, [esp + 0x2c]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4ca5e0
pop ebp
pop edi
pop esi
mov eax, 0x8004e008
pop ebx
add esp, 0x1010
ret 0x10
pop ebp
pop edi
pop esi
mov eax, 0x8004e009
pop ebx
add esp, 0x1010
ret 0x10
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov edi, dword [esp + 0x10]
mov eax, edi
neg eax
push eax
push esi
call sym.vidcap60.exe__riff_UpdateRIFFSize_8
mov eax, dword [esp + 0x102c]
test eax, eax
je 0x4ca68f
mov dword [eax], edi
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1010
ret 0x10
Function at 0x4ca850
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
mov eax, dword [esp + 0x1c]
push esi
mov esi, dword [eax]
test esi, esi
mov dword [esp + 8], esi
jne 0x4ca86b
xor eax, eax
pop esi
add esp, 0x14
ret 0xc
push ebx
mov ebx, dword [esp + 0x20]
push ebp
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 1
push 0
push 0
push ebx
call edi
mov ebp, dword [esp + 0x30]
mov dword [esp + 0x10], eax
cmp dword [ebp], 8
jl 0x4ca944
jmp 0x4ca8a0
mov esi, dword [esp + 0x14]
lea esp, [esp]
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x1c]
push edx
push ebx
call sym.vidcap60.exe__riff_ReadChunkHeader_12
mov edx, dword [ebp]
add edx, 0xfffffff8
test eax, eax
mov dword [ebp], edx
jne 0x4ca9f4
cmp dword [esp + 0x18], 0x50534944
jne 0x4ca919
push 0
lea eax, [esp + 0x20]
push eax
push 4
lea ecx, [esp + 0x2c]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4ca9ca
cmp dword [esp + 0x1c], 4
jne 0x4ca9ca
xor eax, eax
test esi, esi
jle 0x4ca910
mov edx, dword [esp + 0x2c]
mov ecx, dword [edx + 4]
mov edx, dword [esp + 0x20]
cmp edx, dword [ecx]
je 0x4ca95c
inc eax
add ecx, 0xc
cmp eax, esi
jl 0x4ca904
push 1
push 0
push 0xfffffffffffffffc
push ebx
call edi
mov eax, dword [esp + 0x28]
test al, 1
mov esi, eax
je 0x4ca926
lea esi, [eax + 1]
push 1
push 0
push esi
push ebx
call edi
mov eax, dword [ebp]
sub eax, esi
mov dword [esp + 0x28], esi
mov dword [ebp], eax
cmp dword [ebp], 8
jge 0x4ca895
mov edx, dword [esp + 0x10]
push 0
push 0
push edx
push ebx
call edi
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
add esp, 0x14
ret 0xc
mov edi, dword [esp + 0x28]
add edi, 0xfffffffc
push edi
lea esi, [eax + eax*2]
push 0x42
shl esi, 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword [esp + 0x2c]
mov edx, dword [ecx + 4]
mov dword [edx + esi + 8], eax
mov eax, dword [ecx + 4]
mov edx, dword [eax + esi + 8]
test edx, edx
je 0x4ca9d1
mov edx, eax
mov dword [edx + esi + 4], edi
mov eax, dword [ecx + 4]
mov ecx, dword [eax + esi + 8]
push edi
push ecx
push ebx
call sym.vidcap60.exe__riff_ReadData_12
mov esi, eax
test esi, esi
jne 0x4ca9d6
mov eax, dword [esp + 0x28]
test al, 1
je 0x4ca9b7
inc eax
mov dword [esp + 0x28], eax
mov ecx, dword [ebp]
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
sub ecx, eax
mov dword [ebp], ecx
jmp 0x4ca93a
mov esi, 0x8004e008
jmp 0x4ca9dc
mov esi, 0x8007000e
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x2c]
push eax
call sym.vidcap60.exe__displist_Free_4
mov ecx, dword [esp + 0x10]
push 0
push 0
push ecx
push ebx
call edi
mov eax, esi
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x14
ret 0xc
Function at 0x4cac00
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0xc
test eax, eax
je 0x4cac11
mov dword [eax], 0
mov eax, dword [esp + 0x14]
cmp dword [eax], 0
jne 0x4cac22
xor eax, eax
add esp, 0xc
ret 0xc
push ebp
mov ebp, dword [eax + 4]
push esi
mov esi, dword [esp + 0x18]
push 0
push 0x4f464e55
push esi
mov dword [esp + 0x14], 4
call sym.vidcap60.exe__riff_WriteListHeader_12
test eax, eax
jne 0x4cad86
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
push 1
push eax
push eax
push esi
call ebx
mov ecx, dword [esp + 0x24]
mov edx, dword [ecx]
mov edi, eax
sub edi, 8
xor eax, eax
test edx, edx
mov dword [esp + 0x18], edi
mov dword [esp + 0x20], eax
jbe 0x4cad3d
mov ecx, dword [ebp + eax*8 + 4]
test ecx, ecx
je 0x4cad2a
mov edi, dword [ebp + eax*8]
push ecx
call dword [0x5d2620]
add esp, 4
lea ebx, [eax + eax + 2]
push ebx
push edi
push esi
call sym.vidcap60.exe__riff_WriteChunkHeader_12
test eax, eax
jl 0x4cad84
push ebx
push 1
call dword [0x5d24c0]
mov edi, eax
add esp, 8
test edi, edi
je 0x4cad8e
mov edx, dword [esp + 0x20]
mov eax, dword [ebp + edx*8 + 4]
push eax
push edi
call dword [0x5d2614]
add esp, 8
push 0
lea ecx, [esp + 0x18]
push ecx
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
push edi
je 0x4cad9d
call dword [0x5d25a4]
add esp, 4
test bl, 1
je 0x4cad10
push 0
lea edx, [esp + 0x18]
push edx
push 1
lea eax, [esp + 0x2c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4cada6
inc ebx
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x20]
mov edi, dword [esp + 0x18]
lea edx, [ecx + ebx + 8]
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [esp + 0x10], edx
mov ecx, dword [esp + 0x24]
mov edx, dword [ecx]
inc eax
cmp eax, edx
mov dword [esp + 0x20], eax
jb 0x4cac74
push 1
push 0
push 0
push esi
call ebx
push 0
push 0
push edi
push esi
mov ebp, eax
call ebx
push 0
lea edx, [esp + 0x18]
push edx
push 4
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4cada6
push 0
push 0
push ebp
push esi
call ebx
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x28]
add eax, 8
test ecx, ecx
je 0x4cad82
mov dword [ecx], eax
xor eax, eax
pop edi
pop ebx
pop esi
pop ebp
add esp, 0xc
ret 0xc
pop edi
pop ebx
pop esi
mov eax, 0x8007000e
pop ebp
add esp, 0xc
ret 0xc
call dword [0x5d25a4]
add esp, 4
pop edi
pop ebx
pop esi
mov eax, 0x8004e009
pop ebp
add esp, 0xc
ret 0xc
Function at 0x4cadc0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0xc
test eax, eax
je 0x4cadd1
mov dword [eax], 0
mov eax, dword [esp + 0x14]
cmp dword [eax], 0
jne 0x4cade2
xor eax, eax
add esp, 0xc
ret 0xc
push ebp
mov ebp, dword [eax + 4]
push esi
mov esi, dword [esp + 0x18]
push 0
push 0x4f464e49
push esi
mov dword [esp + 0x14], 4
call sym.vidcap60.exe__riff_WriteListHeader_12
test eax, eax
jne 0x4caf42
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
push 1
push eax
push eax
push esi
call ebx
mov ecx, dword [esp + 0x24]
mov edx, dword [ecx]
mov edi, eax
sub edi, 8
xor eax, eax
test edx, edx
mov dword [esp + 0x18], edi
mov dword [esp + 0x20], eax
jbe 0x4caef9
mov ecx, dword [ebp + eax*8 + 4]
test ecx, ecx
je 0x4caee6
mov edi, dword [ebp + eax*8]
push ecx
call dword [0x5d2620]
add esp, 4
lea ebx, [eax + 1]
push ebx
push edi
push esi
call sym.vidcap60.exe__riff_WriteChunkHeader_12
test eax, eax
jl 0x4caf40
push ebx
push 1
call dword [0x5d24c0]
mov edi, eax
add esp, 8
test edi, edi
je 0x4caf4a
mov edx, dword [esp + 0x20]
mov eax, dword [ebp + edx*8 + 4]
push ebx
push eax
push edi
call fcn.00461300
push 0
lea ecx, [esp + 0x18]
push ecx
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
push edi
je 0x4caf59
call dword [0x5d25a4]
add esp, 4
test bl, 1
je 0x4caecc
push 0
lea edx, [esp + 0x18]
push edx
push 1
lea eax, [esp + 0x2c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4caf62
inc ebx
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x20]
mov edi, dword [esp + 0x18]
lea edx, [ecx + ebx + 8]
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [esp + 0x10], edx
mov ecx, dword [esp + 0x24]
mov edx, dword [ecx]
inc eax
cmp eax, edx
mov dword [esp + 0x20], eax
jb 0x4cae34
push 1
push 0
push 0
push esi
call ebx
push 0
push 0
push edi
push esi
mov ebp, eax
call ebx
push 0
lea edx, [esp + 0x18]
push edx
push 4
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4caf62
push 0
push 0
push ebp
push esi
call ebx
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x28]
add eax, 8
test ecx, ecx
je 0x4caf3e
mov dword [ecx], eax
xor eax, eax
pop edi
pop ebx
pop esi
pop ebp
add esp, 0xc
ret 0xc
pop edi
pop ebx
pop esi
mov eax, 0x8007000e
pop ebp
add esp, 0xc
ret 0xc
call dword [0x5d25a4]
add esp, 4
pop edi
pop ebx
pop esi
mov eax, 0x8004e009
pop ebp
add esp, 0xc
ret 0xc
Function at 0x4cb140
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x18]
xor eax, eax
cmp esi, eax
je 0x4cb150
mov dword [esi], eax
mov edx, dword [esp + 0x14]
mov ecx, dword [edx]
cmp ecx, eax
jne 0x4cb163
xor eax, eax
pop esi
add esp, 8
ret 0xc
cmp ecx, eax
push ebx
push ebp
push edi
mov edi, dword [edx + 4]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
jbe 0x4cb22b
mov esi, dword [esp + 0x1c]
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
lea ecx, [eax + eax*2]
mov ebx, dword [edi + ecx*4 + 8]
test ebx, ebx
lea ecx, [edi + ecx*4]
je 0x4cb218
mov ebx, dword [ecx + 4]
test ebx, ebx
je 0x4cb218
lea edx, [ebx + 4]
push edx
push 0x50534944
push esi
call sym.vidcap60.exe__riff_WriteChunkHeader_12
test eax, eax
jl 0x4cb237
push 0
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x18]
lea ecx, [eax + eax*2]
push 4
lea edx, [edi + ecx*4]
push edx
push esi
call ebp
test eax, eax
je 0x4cb241
push 0
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x18]
lea ecx, [eax + eax*2]
mov edx, dword [edi + ecx*4 + 8]
push ebx
push edx
push esi
call ebp
test eax, eax
je 0x4cb241
test bl, 1
je 0x4cb204
push 0
lea eax, [esp + 0x20]
push eax
push 1
lea ecx, [esp + 0x1c]
push ecx
push esi
call ebp
test eax, eax
je 0x4cb241
inc ebx
mov edx, dword [esp + 0x14]
lea eax, [edx + ebx + 0xc]
mov edx, dword [esp + 0x20]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
mov ecx, dword [edx]
inc eax
cmp eax, ecx
mov dword [esp + 0x10], eax
jb 0x4cb183
mov esi, dword [esp + 0x24]
test esi, esi
je 0x4cb235
mov ecx, dword [esp + 0x14]
mov dword [esi], ecx
xor eax, eax
pop edi
pop ebp
pop ebx
pop esi
add esp, 8
ret 0xc
pop edi
pop ebp
pop ebx
mov eax, 0x8004e009
pop esi
add esp, 8
ret 0xc

Function at 0x4cb400
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
test edi, edi
mov dword [esp + 0xc], 0
jne 0x4cb418
xor eax, eax
jmp 0x4cb422
push edi
call dword [0x5d2620]
add esp, 4
lea ebx, [eax + 1]
push ebx
push 1
call dword [0x5d24c0]
mov esi, eax
add esp, 8
test esi, esi
jne 0x4cb443
pop edi
pop esi
mov eax, 0x8007000e
pop ebx
pop ecx
ret 0xc
cmp word [edi], 0
jne 0x4cb44e
mov byte [esi], 0
jmp 0x4cb461
push 0
push 0
push ebx
push esi
push 0xffffffffffffffff
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, dword [esp + 0x14]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [esp + 0x20]
push eax
push ebx
push esi
push edi
mov byte [esi + ebx - 1], 0
call ebp
test eax, eax
push esi
jne 0x4cb498
call dword [0x5d25a4]
add esp, 4
pop ebp
pop edi
pop esi
mov eax, 0x8004e009
pop ebx
pop ecx
ret 0xc
call dword [0x5d25a4]
add esp, 4
test bl, 1
je 0x4cb4bc
push 0
lea ecx, [esp + 0x20]
push ecx
push 1
lea edx, [esp + 0x1c]
push edx
push edi
call ebp
test eax, eax
je 0x4cb48b
inc ebx
mov eax, dword [esp + 0x20]
pop ebp
pop edi
mov dword [eax], ebx
pop esi
xor eax, eax
pop ebx
pop ecx
ret 0xc
Function at 0x4cbcb0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov edx, dword [esp + 0x10]
push ebx
push ebp
push esi
push edi
push 1
xor eax, eax
lea ecx, [esp + 0x1c]
push ecx
push eax
push edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebp, dword [esp + 0x2c]
mov ebx, dword [esp + 0x28]
mov ecx, eax
mov eax, dword [ebp]
add ecx, eax
cmp eax, ebx
mov dword [esp + 0x2c], ecx
mov edi, eax
jb 0x4cbcef
mov edi, ebx
push edi
push 1
call dword [0x5d24c0]
mov esi, eax
add esp, 8
test esi, esi
jne 0x4cbd10
pop edi
pop esi
pop ebp
mov eax, 0x8007000e
pop ebx
add esp, 0xc
ret 0x10
mov ecx, dword [esp + 0x20]
push 0
lea eax, [esp + 0x14]
push eax
push edi
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp edi, dword [esp + 0x10]
je 0x4cbd43
push esi
call dword [0x5d25a4]
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 0x8004e008
pop ebx
add esp, 0xc
ret 0x10
push ebx
mov byte [esi + edi - 1], 0
mov edi, dword [esp + 0x28]
push edi
push 0xffffffffffffffff
push esi
push 1
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push esi
mov word [edi + ebx*2 - 2], 0
call dword [0x5d25a4]
mov al, byte [ebp]
add esp, 4
test al, 1
je 0x4cbd77
inc dword [esp + 0x2c]
mov eax, dword [esp + 0x2c]
push 0
lea edx, [esp + 0x1c]
push edx
push eax
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x2c]
push eax
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [ebp]
pop edi
inc eax
pop esi
mov dword [ebp], eax
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret 0x10
Function at 0x4cc4c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x410
push ebx
push ebp
mov ebp, dword [esp + 0x41c]
push esi
push edi
mov edi, dword [esp + 0x428]
mov eax, dword [edi + 0xc]
mov esi, dword [eax + 0x40]
push ebp
call dword [sym.imp.USER32.dll_GetParent]
mov ebx, eax
mov eax, dword [edi + 8]
cmp eax, 0xfffffda3
je 0x4cc5d9
cmp eax, 0xfffffda5
je 0x4cc525
cmp eax, 0xfffffda7
jne 0x4cc5ca
push 0x8001
push 0
push 0
push ebx
call sym.vidcap60.exe__SfWndCenter_16
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x410
ret 8
lea ecx, [esp + 0x10]
push ecx
push 0x104
push 0x465
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jl 0x4cc58b
cmp eax, 0x104
ja 0x4cc58b
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4cc572
test al, 0x10
je 0x4cc572
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x21c]
push ecx
call dword [0x5d2614]
add esp, 8
jmp 0x4cc595
push 0x104
lea edx, [esp + 0x21c]
push edx
lea eax, [esp + 0x18]
push eax
call sym.vidcap60.exe__SfGetPathNameFromFilePath_12
jmp 0x4cc595
mov word [esp + 0x218], 0
mov esi, dword [sym.imp.USER32.dll_SetDlgItemTextW]
lea ecx, [esp + 0x218]
push ecx
push 0x148
push ebx
call esi
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x21c]
push eax
call sym.vidcap60.exe__SfFormatDiskFreeSpace_8
lea ecx, [esp + 0x10]
push ecx
push 0x14e
push ebp
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x410
ret 8
mov edx, dword [esi + 0x210]
mov eax, dword [esi]
push edx
push 1
push eax
push ebp
push 0
call sym.vidcap60.exe__SfHelp_ContextHelp_20
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x410
ret 8

Function at 0x4cd650
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x18
push ebx
push ebp
push esi
push edi
push eax
call dword [sym.imp.USER32.dll_GetParent]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
push 1
push esi
call edi
push 2
push esi
mov ebx, eax
call edi
mov ebp, dword [sym.imp.USER32.dll_GetWindowLongW]
mov edi, eax
push 0xfffffffffffffff0
push edi
call ebp
test eax, 0x10000000
je 0x4cd6e8
push 0
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
lea ecx, [esp + 0x18]
push ecx
push edi
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x10]
push ecx
push esi
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
call dword [sym.imp.USER32.dll_ScreenToClient]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push 5
push 0
push 0
push edx
push eax
push 0
push ebx
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0xffffffffffffffec
push esi
call ebp
and eax, 0xfffffbff
push eax
push 0xffffffffffffffec
push esi
call dword [sym.imp.USER32.dll_SetWindowLongW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4
Function at 0x4cef90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x118
push esi
mov esi, dword [esp + 0x124]
cmp word [esi], 0
je 0x4cf12b
mov ecx, dword [0x621c80]
push ebx
push 0x28
lea eax, [esp + 0xd4]
push eax
push 0x16
push 0xbd6c
push ecx
mov word [esp + 0x1c], 0
call sym.vidcap60.exe__SfGetString_8
push eax
call sym.vidcap60.exe__SfFormatPropLabel_16
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4cf12a
test ebx, ebx
jne 0x4cf005
mov eax, dword [0x621c80]
push 0x64
lea edx, [esp + 0xc]
push edx
push 0xbd68
push eax
call sym.vidcap60.exe__SfLoadString_16
jmp 0x4cf108
mov esi, dword [0x5d24cc]
mov eax, 1
test al, bl
je 0x4cf032
mov ecx, dword [0x621c80]
push 0xbd69
push ecx
call sym.vidcap60.exe__SfGetString_8
push eax
lea edx, [esp + 0xc]
push edx
call esi
add esp, 8
xor eax, eax
test bl, 2
je 0x4cf068
test eax, eax
jne 0x4cf04a
lea eax, [esp + 8]
push 0x5eac70
push eax
call esi
add esp, 8
mov ecx, dword [0x621c80]
push 0xbd6a
push ecx
call sym.vidcap60.exe__SfGetString_8
push eax
lea edx, [esp + 0xc]
push edx
call esi
add esp, 8
xor eax, eax
test bl, 0x20
je 0x4cf09e
test eax, eax
jne 0x4cf080
lea eax, [esp + 8]
push 0x5eac70
push eax
call esi
add esp, 8
mov ecx, dword [0x621c80]
push 0xbd6b
push ecx
call sym.vidcap60.exe__SfGetString_8
push eax
lea edx, [esp + 0xc]
push edx
call esi
add esp, 8
xor eax, eax
test bl, 4
je 0x4cf0d4
test eax, eax
jne 0x4cf0b6
lea eax, [esp + 8]
push 0x5eac70
push eax
call esi
add esp, 8
mov ecx, dword [0x621c80]
push 0xbd74
push ecx
call sym.vidcap60.exe__SfGetString_8
push eax
lea edx, [esp + 0xc]
push edx
call esi
add esp, 8
xor eax, eax
test bl, 0x10
je 0x4cf108
test eax, eax
jne 0x4cf0ec
lea eax, [esp + 8]
push 0x5eac70
push eax
call esi
add esp, 8
mov ecx, dword [0x621c80]
push 0xbd75
push ecx
call sym.vidcap60.exe__SfGetString_8
push eax
lea edx, [esp + 0xc]
push edx
call esi
add esp, 8
mov edx, dword [esp + 0x124]
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0xd4]
push ecx
push 0x5d4ee8
push edx
call sym.vidcap60.exe_SfMEditPrintF
add esp, 0x10
pop ebx
pop esi
add esp, 0x118
ret 8