joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49ffc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x30
mov edx, ecx
mov ecx, dword [edx + 8]
mov eax, dword [edx + 4]
push esi
push edi
lea edi, [edx + 4]
add eax, ecx
add ecx, 2
mov dword [edi + 4], ecx
xor ecx, ecx
mov ch, byte [eax + 1]
mov dword [esp + 0x10], edx
mov cl, byte [eax]
push ecx
mov ecx, dword [edx + 0x2c]
call fcn.0049d9e0
mov esi, eax
test esi, esi
je 0x4a01a6
cmp dword [esi + 0x78], 3
jne 0x4a01a6
mov eax, dword [edi + 4]
mov edx, dword [edi]
mov cl, byte [eax + edx]
inc eax
mov dword [edi + 4], eax
movzx eax, cl
shr eax, 6
mov dword [esi + 0x2c], eax
mov eax, dword [esi + 0x24]
test eax, eax
jne 0x4a01a6
cmp word [esi + 0x36], 0
je 0x4a01a6
push ebx
push ebp
mov ecx, esi
call fcn.0049d180
mov ebp, dword [esi + 0x74]
mov ebx, eax
cmp ebx, ebp
ja 0x4a0178
lea ecx, [esp + 0x1c]
call fcn.004015f0
mov ecx, dword [esi + 0x70]
push ebp
push ebx
push ecx
lea ecx, [esp + 0x28]
call fcn.0049c9d0
xor ebx, ebx
cmp word [esi + 0x36], bx
jbe 0x4a0136
push 0x14
call fcn.005dd330
add esp, 4
cmp eax, ebx
je 0x4a0083
movzx edx, word [esi + 0x36]
push 1
push edx
mov ecx, eax
call fcn.00440740
jmp 0x4a0085
xor eax, eax
cmp word [esi + 0x36], bx
mov dword [esi + 0x24], eax
mov dword [esp + 0x14], ebx
jbe 0x4a0136
test byte [esi + 0x38], 4
lea ecx, [esp + 0x1c]
je 0x4a00ab
call fcn.00425310
mov dword [esp + 0x10], eax
jmp 0x4a00b9
call fcn.004252e0
movzx ax, al
mov word [esp + 0x10], ax
push 0xc
call fcn.005dd330
add esp, 4
mov ecx, edi
mov ebp, eax
call fcn.004252e0
mov bl, al
cmp bl, 1
jbe 0x4a00ea
mov ecx, edi
call fcn.00405c60
mov ecx, edi
mov dword [ebp], eax
call fcn.00405c60
mov dword [ebp + 4], eax
add bl, 0xfe
movzx ecx, bl
mov ebx, dword [esp + 0x18]
mov eax, dword [ebx + 8]
shl ecx, 2
add eax, ecx
mov ecx, edi
mov dword [ebx + 8], eax
call fcn.004252e0
movzx edx, al
movzx eax, word [esp + 0x10]
push ebp
mov dword [ebp + 8], edx
mov ecx, dword [esi + 0x24]
push eax
call fcn.00440b20
mov al, byte [ebx + 0x24]
test al, al
jne 0x4a0134
mov eax, dword [esp + 0x14]
movzx ecx, word [esi + 0x36]
inc eax
cmp eax, ecx
mov dword [esp + 0x14], eax
jl 0x4a0096
xor ebx, ebx
mov edi, dword [esp + 0x18]
mov al, byte [edi + 0x24]
test al, al
jne 0x4a0149
mov al, byte [esp + 0x3c]
test al, al
je 0x4a01a4
mov ecx, dword [esi + 0x24]
cmp ecx, ebx
je 0x4a0156
mov edx, dword [ecx]
push 1
call dword [edx]
mov dword [esi + 0x24], ebx
mov dword [esi + 0x70], ebx
mov word [esi + 0x36], bx
mov eax, dword [edi + 0x2c]
mov ecx, dword [eax + 0xd4]
push 1
call fcn.004b5010
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x30
ret
mov ecx, dword [esi + 0x68]
mov ecx, dword [ecx + 0xd4]
push 1
call fcn.004b5010
mov edx, dword [esi + 0x68]
mov eax, dword [edx + 0xd4]
mov ecx, dword [eax]
push 0x8e
push 3
push eax
call dword [ecx + 0xe0]
add esp, 0xc
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x30
ret
Function at 0x4b4560
Capabilities:
Parse credit card information

Disassembly:
sub esp, 8
push ebx
mov bl, byte [eax]
test bl, bl
push esi
mov byte [esp + 0xb], 0
mov esi, eax
je 0x4b45bc
cmp bl, 0x3d
mov byte [esp + 0xc], bl
je 0x4b45bc
cmp bl, 0x3b
je 0x4b45bc
cmp bl, 0x2f
je 0x4b45bc
cmp bl, 0x23
je 0x4b45bc
cmp bl, 0x3f
je 0x4b45bc
cmp bl, 0x20
je 0x4b45bc
cmp bl, 0x3a
je 0x4b45c4
mov eax, dword [esp + 0xc]
push eax
call fcn.004b4390
add esp, 4
test al, al
jne 0x4b45b4
cmp bl, 0x2d
je 0x4b45b4
mov byte [esp + 0xb], 1
mov bl, byte [esi + 1]
inc esi
test bl, bl
jne 0x4b4572
pop esi
xor al, al
pop ebx
add esp, 8
ret
mov al, byte [esp + 0xb]
test al, al
pop esi
setne al
pop ebx
add esp, 8
ret

Function at 0x4b5330
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
xor ecx, ecx
mov cx, word [edx]
xor eax, eax
test cx, cx
je 0x4b535e
push esi
mov esi, eax
shl eax, 4
sar esi, 0x1c
xor esi, eax
movzx eax, cx
add edx, 2
xor ecx, ecx
mov cx, word [edx]
xor eax, esi
test cx, cx
jne 0x4b5341
pop esi
ret 4

Function at 0x4b5370
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
mov ebx, ecx
mov eax, dword [ebx + 0xdc4]
mov ecx, dword [ebx + 0xdc8]
push edi
lea edi, [esi*4]
push edi
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
call fcn.005dd330
mov edx, eax
mov ecx, edi
mov dword [ebx + 0xdc4], edx
mov edi, edx
mov edx, ecx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [esp + 0x14]
xor eax, eax
add esp, 4
cmp ecx, eax
mov dword [ebx + 0xdc8], esi
mov dword [ebx + 0xdd0], eax
lea ebp, [esi - 1]
mov dword [esp + 0x1c], eax
jle 0x4b5479
mov edi, edi
mov ecx, dword [esp + 0x14]
mov edi, dword [ecx + eax*4]
and edi, 0xfffffff8
cmp edi, 1
jbe 0x4b5468
mov ecx, edi
xor esi, esi
call fcn.0043c6d0
mov cx, word [eax]
test cx, cx
je 0x4b541e
mov edx, esi
sar edx, 0x1c
shl esi, 4
movzx ecx, cx
xor edx, esi
xor edx, ecx
add eax, 2
xor ecx, ecx
mov cx, word [eax]
test cx, cx
mov esi, edx
jne 0x4b5400
mov edx, dword [ebx + 0xdc4]
and esi, ebp
and esi, 0x7fffffff
cmp dword [edx + esi*4], 0
mov eax, 7
je 0x4b544c
mov ecx, edx
lea esp, [esp]
add esi, eax
and esi, ebp
mov edx, dword [ecx + esi*4]
inc eax
test edx, edx
jne 0x4b5440
mov ecx, edi
call fcn.0043c6d0
movzx eax, byte [eax]
mov ecx, dword [ebx + 0xdc4]
and eax, 7
or eax, edi
mov dword [ecx + esi*4], eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
inc eax
cmp eax, ecx
mov dword [esp + 0x1c], eax
jl 0x4b53e0
mov edx, dword [esp + 0x14]
push edx
call fcn.005dd350
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
Function at 0x4bd860
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
push edi
mov edi, ecx
mov ecx, ebx
call fcn.0043c6d0
mov ecx, ebx
mov ebp, eax
xor esi, esi
call fcn.0043c6d0
mov cx, word [eax]
test cx, cx
je 0x4bd8a2
mov edx, esi
sar edx, 0x1c
shl esi, 4
movzx ecx, cx
xor edx, esi
xor edx, ecx
add eax, 2
xor ecx, ecx
mov cx, word [eax]
test cx, cx
mov esi, edx
jne 0x4bd884
push esi
push ebp
mov ecx, edi
call fcn.004b9e30
mov edx, dword [edi + 0xdc4]
mov ecx, dword [edx + eax*4]
cmp ecx, 1
ja 0x4bd8d1
push esi
mov esi, dword [esp + 0x18]
push eax
push ebx
push esi
mov ecx, edi
call fcn.004b9d90
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret 8
mov eax, dword [esp + 0x14]
pop edi
pop esi
and ecx, 0xfffffffd
or ecx, 5
pop ebp
mov dword [eax], ecx
pop ebx
ret 8
Function at 0x4bfcf0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov edi, ecx
push edi
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0
call fcn.00486930
mov ebp, dword [esp + 0x34]
mov esi, dword [ebp + 0x54]
test esi, esi
mov byte [esp + 0x13], 0
je 0x4bff14
mov ebx, dword [esi + 0x18]
test ebx, ebx
mov dword [esp + 0x18], ebx
je 0x4bff14
mov eax, dword [ebp + 0xb4]
mov ecx, dword [eax + 0x2c]
push ecx
lea ecx, [esp + 0x20]
call fcn.00487380
mov eax, dword [ebx + 0x78]
add eax, 0xfffffffe
cmp eax, 0x5f
ja case.0x4bfd57.3
movzx edx, byte [eax + 0x4bff58]
jmp dword [edx*4 + 0x4bff44]
mov ecx, dword [edi + 0x860]
test ecx, ecx
jne 0x4bfd6c
xor esi, esi
jmp 0x4bfd73
call fcn.004879b0
mov esi, eax
mov eax, dword [ebx + 0x6c]
test eax, eax
je 0x4bfdbf
test esi, esi
je 0x4bfdbf
mov ecx, dword [edi + 0xc70]
mov dl, byte [ecx + 0x215]
push eax
lea eax, [esp + 0x1c]
push eax
mov ecx, edi
mov byte [esp + 0x3c], dl
call fcn.004bf3e0
mov ecx, dword [esp + 0x34]
mov eax, dword [eax]
push ecx
lea edx, [esp + 0x18]
push edx
push eax
mov ecx, esi
call fcn.004a74f0
test eax, eax
mov dword [esp + 0x18], 0
jne case.0x4bfd57.3
mov ecx, dword [ebp + 0xb4]
push 0
push str.MovieClip
push ecx
mov ecx, edi
call fcn.004bf7a0
jmp 0x4bff14
mov ebx, str.Button
jmp 0x4bfdec
mov ebx, str.TextField
jmp 0x4bfdec
mov ebx, str.Video
mov edx, dword [esi + 0x14]
lea ecx, [esp + 0x34]
mov dword [esp + 0x34], edx
call fcn.0040dd00
test al, al
je 0x4bff14
mov esi, dword [edi + 0x860]
test esi, esi
je 0x4bff14
mov ecx, esi
call fcn.00487980
test eax, eax
jne 0x4bfe24
mov ecx, edi
call fcn.004beec0
mov ecx, esi
call fcn.00487980
test eax, eax
je 0x4bff14
push ebx
mov ecx, eax
call fcn.004a9e10
mov esi, eax
test esi, esi
je 0x4bff14
mov ecx, esi
call fcn.00457470
test al, al
je 0x4bff14
mov ecx, esi
call fcn.00426650
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4bff14
mov ecx, ebp
call fcn.0040c950
push 0
mov esi, eax
mov edx, dword [esi + 4]
push 1
push 0
inc edx
mov dword [esi + 4], edx
mov eax, dword [esp + 0x20]
mov ecx, dword [edi + 0xcc4]
mov edx, dword [ebp + 0xb4]
push eax
push 1
push 0
push ecx
push ebp
push edx
mov ecx, edi
mov byte [esp + 0x37], 1
call fcn.004b7f90
mov ecx, edi
call fcn.0040dfc0
cmp ebp, dword [esi]
je 0x4bfeb6
xor ebp, ebp
mov ecx, dword [esi + 4]
dec ecx
mov eax, ecx
test eax, eax
mov dword [esi + 4], ecx
jg 0x4bfecc
push esi
call fcn.005dd350
add esp, 4
mov eax, dword [ebx + 0x78]
cmp eax, 6
je 0x4bfed9
cmp eax, 0x61
jne 0x4bff14
test ebp, ebp
je 0x4bff2e
mov eax, dword [ebp + 0x5c]
test eax, eax
je 0x4bfee9
cmp dword [eax], 0
jne 0x4bff14
mov ecx, dword [ebp + 0xb4]
call fcn.004ab7b0
test al, 1
je 0x4bff14
mov ecx, dword [edi + 0x554]
push 0x7fffffff
push 0
push 0
push 0
push ebp
push 0
push 0
push edi
call fcn.0047a900
test ebp, ebp
je 0x4bff2e
mov al, byte [esp + 0x13]
test al, al
jne 0x4bff2e
mov ecx, ebp
call fcn.004a49b0
mov ecx, ebp
call fcn.004ab9b0
lea ecx, [esp + 0x1c]
call fcn.00486950
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4
Function at 0x4de810
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x1c], 0xca
jne 0x4de84b
push esi
call fcn.004e3170
add esp, 4
test eax, eax
jl 0x4de8c5
mov al, byte [esi + 0x48]
test al, al
je 0x4de844
mov dword [esi + 0x1c], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x1c], 0xcb
mov eax, dword [esi + 0x1c]
cmp eax, 0xcb
jne 0x4de8c7
mov eax, dword [esi + 0x198]
mov cl, byte [eax + 0x10]
test cl, cl
je 0x4de8b4
mov eax, dword [esi + 8]
test eax, eax
je 0x4de86f
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x198]
push esi
call dword [ecx]
add esp, 4
test eax, eax
jl 0x4de8c5
je 0x4de8b0
cmp eax, 2
je 0x4de8b4
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4de862
cmp eax, 3
je 0x4de897
cmp eax, 1
jne 0x4de862
inc dword [ecx + 4]
mov eax, dword [esi + 8]
mov edx, dword [eax + 4]
cmp edx, dword [eax + 8]
jl 0x4de862
mov ecx, dword [esi + 0x124]
add dword [eax + 8], ecx
jmp 0x4de862
xor eax, eax
pop esi
ret
mov edx, dword [esi + 0x84]
mov dword [esi + 0x8c], edx
call fcn.004de6f0
pop esi
ret
cmp eax, 0xcc
je 0x4de8c0
mov eax, dword [esi]
mov dword [eax + 0x14], 0x14
mov ecx, dword [esi]
mov edx, dword [esi + 0x1c]
mov dword [ecx + 0x18], edx
mov eax, 0xffffffec
pop esi
ret
Function at 0x4f45f0
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x210
push esi
mov esi, ecx
mov eax, dword [esi + 0xa0]
test eax, eax
push edi
jne 0x4f46fe
mov eax, dword [esi + 0x80]
test eax, eax
je 0x4f464e
lea ecx, [esp + 0x10]
push ecx
push 0
push 0
push 0x1a
push 0
call eax
cmp eax, 0x80070057
je 0x4f46cf
push 0x5f9d4c
lea edx, [esp + 0x14]
push edx
mov ecx, esi
call fcn.004f3d00
mov dword [esi + 0xa0], eax
jmp 0x4f46cf
lea eax, [esp + 8]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
mov dword [esp + 0x1c], 0
call dword [0x5f6004]
test eax, eax
jne 0x4f46cf
mov byte [esp + 0x10], al
mov ecx, 0x40
lea edi, [esp + 0x11]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x14]
push edx
stosw word es:[edi], ax
push 0
push 0
stosb byte es:[edi], al
mov eax, dword [esp + 0x18]
push str.AppData
push eax
mov dword [esp + 0x24], 0x104
call dword [0x5f6008]
test eax, eax
jne 0x4f46c4
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call fcn.004f4190
mov dword [esi + 0xa0], eax
mov edx, dword [esp + 8]
push edx
call dword [0x5f600c]
mov edi, dword [esi + 0xa0]
test edi, edi
je 0x4f46fe
push edi
call fcn.005f019d
add esp, 4
test eax, eax
jbe 0x4f46fe
mov cx, word [edi + eax*2 - 2]
cmp cx, 0x2f
je 0x4f46f7
cmp cx, 0x5c
jne 0x4f46fe
mov word [edi + eax*2 - 2], 0
mov eax, dword [esi + 0xa0]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4fee80
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x30
push edi
lea eax, [esp + 0x44]
mov edi, ecx
mov ecx, dword [esp + 0x44]
push eax
push ecx
call fcn.0045e060
add esp, 8
test al, al
je 0x4ff02a
mov edx, dword [esp + 0x38]
push ebx
push ebp
mov ebp, dword [esp + 0x48]
push esi
push 1
push ebp
push edx
call fcn.0045e0e0
mov esi, eax
xor ebx, ebx
add esp, 0xc
cmp esi, ebx
jne 0x4feed6
mov eax, dword [esp + 0x48]
push ebp
push eax
mov ecx, edi
call fcn.004fede0
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x30
ret 0x10
mov ecx, dword [edi + 0x48]
mov edx, dword [ecx + 0x24]
push edx
call dword [0x5f60ec]
xor ecx, ecx
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x50]
mov ch, al
movzx edx, ah
movzx eax, byte [esp + 0x52]
or ecx, edx
shl ecx, 8
or ecx, eax
push ecx
call dword [0x5f60c0]
mov ecx, dword [edi + 0x48]
mov edx, dword [ecx + 0x24]
mov ebp, eax
push ebp
push edx
call dword [0x5f603c]
mov dword [esp + 0x4c], eax
mov eax, dword [edi + 0x48]
mov ecx, dword [eax + 0x24]
push 1
push ecx
call dword [0x5f60f0]
mov dword [esp + 0x10], 0x28
mov edx, dword [esi + 0x10]
mov dword [esp + 0x14], edx
mov eax, dword [esi + 0x14]
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov eax, 1
mov word [esp + 0x1c], ax
mov word [esp + 0x1e], ax
mov eax, dword [esi + 8]
mov ecx, 2
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], ecx
mov cl, byte [eax + 6]
mov byte [esp + 0x3a], cl
mov dl, byte [eax + 5]
mov byte [esp + 0x39], dl
mov cl, byte [eax + 4]
mov byte [esp + 0x38], cl
mov byte [esp + 0x3b], bl
mov dl, byte [eax + 0xa]
mov byte [esp + 0x3e], dl
mov cl, byte [eax + 9]
mov byte [esp + 0x3d], cl
mov dl, byte [eax + 8]
mov ecx, esi
mov byte [esp + 0x3c], dl
mov byte [esp + 0x3f], bl
call fcn.00475c90
mov eax, dword [esp + 0x48]
mov ecx, dword [eax + 8]
mov edx, dword [eax]
push 0xb8074a
push ebx
lea ebx, [esp + 0x18]
push ebx
mov ebx, dword [esi + 4]
push ebx
mov ebx, dword [esi + 0x14]
push ebx
mov ebx, dword [esi + 0x10]
push ebx
mov ebx, dword [eax + 0xc]
mov eax, dword [eax + 4]
push 0
push 0
sub ebx, ecx
push ebx
sub eax, edx
push eax
push ecx
mov ecx, dword [edi + 0x48]
push edx
mov edx, dword [ecx + 0x24]
push edx
call dword [0x5f60e0]
mov ecx, esi
call fcn.00475cb0
mov ecx, esi
call fcn.00475e00
push esi
call fcn.005dd350
mov eax, dword [esp + 0x50]
mov ecx, dword [edi + 0x48]
mov edx, dword [ecx + 0x24]
add esp, 4
push eax
push edx
call dword [0x5f603c]
push ebp
call dword [0x5f6124]
mov eax, dword [esp + 0x44]
mov ecx, dword [edi + 0x48]
mov edx, dword [ecx + 0x24]
push eax
push edx
call dword [0x5f60e8]
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x30
ret 0x10
Function at 0x507cc0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
mov ebp, ecx
mov eax, dword [ebp]
push edi
xor ebx, ebx
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], ebx
call fcn.0043c300
mov edx, dword [ebp]
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [edx + 0xc20]
push str.defaultcamera
call fcn.00513760
mov dword [esp + 0x18], ebx
push 0xa
push ebx
call fcn.004b2680
mov esi, eax
mov eax, dword [ebp]
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0x820]
add esp, 8
push esi
call fcn.005270c0
mov edx, dword [ebp]
mov eax, dword [edx + 0x18]
mov ecx, dword [eax + 0x820]
push esi
call fcn.005272a0
push esi
mov edi, eax
call fcn.005dd350
add esp, 4
test edi, edi
je 0x507e47
mov ecx, dword [ebp]
lea eax, [esp + 0x10]
push eax
push ecx
mov ecx, dword [edi + 0xa0]
mov dword [esp + 0x18], 2
call fcn.00527c10
mov edx, dword [esp + 0x14]
mov eax, dword [edx + 0x10]
test eax, eax
je 0x507d8e
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x18]
call fcn.00476940
mov ecx, eax
call fcn.0043ca20
test al, al
je 0x507e14
mov dword [esp + 0x1c], ebx
jmp 0x507e47
lea ecx, [esp + 0x10]
call fcn.00476a40
mov edi, eax
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x507da0
sub eax, edx
mov esi, eax
xor eax, eax
test esi, esi
jle 0x507dc7
mov cl, byte [eax + edi]
movzx edx, cl
mov dl, byte [edx + 0x5f93d8]
xor dl, cl
mov byte [eax + edi], dl
inc eax
cmp eax, esi
jl 0x507db1
mov eax, dword [0x604090]
xor ebx, ebx
test eax, eax
je 0x507e03
mov eax, 0x604090
mov esi, eax
lea esp, [esp]
mov eax, dword [eax]
push eax
push edi
call fcn.0043bc40
add esp, 8
test eax, eax
jne 0x507dfe
mov ecx, dword [esi + 4]
add esi, 4
test ecx, ecx
mov eax, esi
jne 0x507de0
jmp 0x507e03
mov ebx, 1
push edi
call fcn.005dd350
add esp, 4
test ebx, ebx
je 0x507e27
mov ebx, dword [esp + 0x18]
inc ebx
cmp ebx, 0x270f
mov dword [esp + 0x18], ebx
jl 0x507cf8
jmp 0x507e47
mov ecx, dword [ebp]
mov ecx, dword [ecx + 0xc20]
lea eax, [esp + 0x10]
push eax
push str.defaultcamera
call fcn.00512840
mov edx, dword [esp + 0x18]
mov dword [esp + 0x1c], edx
mov eax, dword [esp + 0x1c]
push 0xa
push eax
call fcn.004b2680
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x515530
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov al, byte [edi]
xor ebx, ebx
xor ecx, ecx
xor edx, edx
cmp al, bl
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
je 0x515588
nop
movzx esi, al
movzx eax, byte [esi + 0x5f93d8]
xor eax, esi
mov esi, ecx
shr esi, 0x1b
shl ecx, 5
or esi, ecx
add esi, eax
mov ecx, esi
mov esi, edx
shr esi, 0x1a
shl edx, 6
or esi, edx
add esi, eax
mov al, byte [edi + 1]
inc edi
cmp al, bl
mov edx, esi
jne 0x515550
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], ecx
mov ebp, dword [esp + 0x20]
mov eax, dword [ebp]
push eax
call fcn.005dd350
add esp, 4
push 0x604824
mov ecx, ebp
mov dword [ebp], ebx
mov dword [ebp + 4], ebx
mov dword [ebp + 8], ebx
call fcn.0043b6e0
lea ecx, [ecx]
mov esi, dword [esp + ebx*4 + 0x10]
mov edi, 8
lea esp, [esp]
mov ecx, esi
shr ecx, 0x1c
push ecx
call fcn.0043b1b0
add esp, 4
push eax
mov ecx, ebp
call fcn.0043b320
shl esi, 4
dec edi
jne 0x5155c0
inc ebx
cmp ebx, 2
jl 0x5155b0
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x5270c0
Capabilities:
Enumerate devices by category

Disassembly:
sub esp, 0xe8
push ebx
push ebp
push esi
push edi
mov ebx, ecx
push ebx
call dword [0x5f62b4]
lea ecx, [esp + 0x20]
call fcn.004b1ee0
mov eax, dword [esp + 0xfc]
push eax
call fcn.0043ba30
mov ebp, eax
mov eax, dword [ebx + 0x2c]
xor esi, esi
add esp, 4
cmp eax, esi
mov dword [esp + 0x1c], ebp
jne 0x52716b
mov eax, dword [ebx + 0x18]
cmp eax, esi
lea edi, [ebx + 0x18]
je 0x52710d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [edi], esi
push esi
call dword [0x5f65e8]
lea edx, [esp + 0x10]
push edx
push 0x62270c
push 1
push esi
push 0x604f8c
mov dword [esp + 0x24], esi
call dword [0x5f65f4]
test eax, eax
jne 0x52714f
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
push esi
push edi
push 0x604f7c
push eax
call dword [ecx + 0xc]
mov eax, dword [esp + 0x10]
mov edx, dword [eax]
push eax
call dword [edx + 8]
push esi
push 0x6040b8
call fcn.0043ba30
add esp, 4
push eax
mov ecx, ebx
call fcn.00527020
mov dword [ebx + 0x1c], eax
mov dword [ebx + 0x20], esi
mov edi, dword [ebx + 0x20]
cmp edi, dword [ebx + 0x1c]
jge 0x527272
mov eax, dword [ebx + 0x2c]
dec eax
cmp ebp, eax
jle 0x527272
mov dword [esp + 0x14], edi
inc dword [ebx + 0x20]
lea ecx, [esp + 0x18]
push ecx
push edi
mov ecx, ebx
mov dword [esp + 0x18], esi
mov dword [esp + 0x20], esi
call fcn.00527020
cmp eax, edi
jne 0x5271b9
mov eax, dword [esp + 0x18]
mov edx, dword [eax]
lea ecx, [esp + 0x10]
push ecx
push 0x6226bc
push esi
push esi
push eax
call dword [edx + 0x20]
cmp dword [esp + 0x10], esi
je 0x52724f
mov eax, dword [ebx + 0x28]
cmp eax, esi
lea ebp, [ebx + 0x28]
je 0x5271d8
lea ecx, [ecx]
mov ebp, dword [ebp]
cmp dword [ebp], esi
jne 0x5271d0
mov edx, dword [ebx + 0x2c]
push 0xa
push edx
call fcn.004b2680
push 0xa8
mov edi, eax
call fcn.005dd330
add esp, 0xc
cmp eax, esi
je 0x527200
push edi
mov ecx, eax
call fcn.00507590
mov esi, eax
push edi
call fcn.005dd350
push 0x40
call fcn.005dd330
add esp, 8
test eax, eax
je 0x527227
mov ecx, dword [esp + 0x14]
mov edx, dword [ebx + 0x24]
push ecx
push esi
push edx
mov ecx, eax
call fcn.00526bd0
jmp 0x527229
xor eax, eax
push eax
mov ecx, esi
mov dword [ebp], eax
call fcn.00507e90
mov esi, dword [ebx + 0x2c]
mov eax, dword [esp + 0x10]
inc esi
mov dword [ebx + 0x2c], esi
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov edi, dword [esp + 0x14]
mov ebp, dword [esp + 0x1c]
xor esi, esi
mov eax, dword [esp + 0x18]
cmp eax, esi
je 0x52725d
mov edx, dword [eax]
push eax
call dword [edx + 8]
cmp ebp, dword [ebx + 0x2c]
jl 0x527272
mov eax, dword [ebx + 0x1c]
inc edi
cmp edi, eax
mov dword [esp + 0x14], edi
jl 0x527187
mov ecx, 0x1b
lea esi, [esp + 0x20]
lea edi, [esp + 0x8c]
rep movsd dword es:[edi], dword [esi]
frstor dword [esp + 0x8c]
push ebx
call dword [0x5f62b0]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xe8
ret 4
Function at 0x5291c0
Capabilities:
Check http status code

Disassembly:
sub esp, 0x18
push esi
mov esi, ecx
mov eax, dword [esi + 0x28]
push edi
xor edi, edi
cmp eax, edi
mov dword [esp + 0x1c], esi
mov dword [esp + 0xc], edi
jne 0x5291e0
pop edi
xor eax, eax
pop esi
add esp, 0x18
ret
lea edx, [esp + 0x14]
push edx
lea edx, [esp + 0x1c]
push edx
lea ecx, [esi + 0xc]
push ecx
push 0x20000013
push eax
mov dword [esp + 0x2c], 4
mov dword [esp + 0x28], edi
call dword [0x5f64f8]
test eax, eax
je 0x52933b
mov ecx, dword [esi + 0x28]
push ebx
push edi
push edi
lea eax, [esp + 0x14]
push eax
push ecx
mov dword [esp + 0x1c], edi
xor ebx, ebx
call dword [0x681ae8]
test eax, eax
je 0x5292c8
push ebp
nop
mov eax, dword [esp + 0x10]
cmp eax, edi
je 0x5292c7
lea edx, [ebx + eax + 1]
push edx
mov dword [esp + 0x1c], edi
call fcn.005dd330
mov ebp, eax
add esp, 4
cmp ebp, edi
je 0x5292c7
cmp ebx, edi
jbe 0x529270
mov esi, dword [esi + 0x10]
mov ecx, ebx
mov eax, ecx
shr ecx, 2
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x24]
mov edx, dword [esp + 0x10]
mov eax, dword [esi + 0x28]
lea ecx, [esp + 0x18]
push ecx
push edx
lea edi, [ebx + ebp]
push edi
push eax
call dword [0x681aec]
test eax, eax
je 0x5292a1
mov ecx, dword [esp + 0x10]
mov byte [edi + ecx], 0
push ebp
lea ecx, [esi + 0x10]
call fcn.0043b210
add ebx, dword [esp + 0x18]
push ebp
call fcn.005dd350
mov eax, dword [esi + 0x28]
add esp, 4
push 0
push 0
lea edx, [esp + 0x18]
push edx
push eax
call dword [0x681ae8]
xor edi, edi
test eax, eax
jne 0x529230
pop ebp
mov eax, dword [esi + 0xc]
cmp eax, 0x197
pop ebx
je 0x529313
cmp eax, 0x191
je 0x529313
cmp eax, 0x12c
jb 0x5292fa
cmp eax, 0x190
jae 0x5292ff
mov dword [esp + 0xc], 2
mov eax, dword [esp + 0xc]
pop edi
pop esi
add esp, 0x18
ret
cmp eax, 0x190
jbe 0x52933b
mov dword [esp + 0xc], 1
mov eax, dword [esp + 0xc]
pop edi
pop esi
add esp, 0x18
ret
mov ecx, dword [esi + 0x28]
push edi
push 7
push 0x2eee
push ecx
call dword [0x5f6450]
push eax
call dword [0x681af4]
xor edx, edx
cmp eax, 0x2f00
sete dl
inc edx
mov dword [esp + 0xc], edx
mov eax, dword [esp + 0xc]
pop edi
pop esi
add esp, 0x18
ret