joyce8/EMBER2024-capa huggingface dataset:
Function at 0x516164
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x6cbdfd
call fcn.006b9c3c
sub esp, 0xa8
push ebx
push esi
push edi
mov eax, edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], ecx
and dword [ebp - 4], 0
cmp dword [eax + 0x14], 0x10
jb 0x51618d
mov ecx, dword [eax]
jmp 0x51618f
mov ecx, eax
mov esi, dword [eax + 0x10]
add esi, ecx
cmp dword [eax + 0x14], 0x10
jb 0x51619f
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
push dword [ebp + 0x14]
lea eax, [ebp + 8]
sub esp, 0x38
mov ebx, esp
mov dword [ebp - 0x24], esp
sub esp, 0x10
mov edi, esp
mov dword [ebp - 0x18], esp
mov ecx, edi
mov dword [ebp - 0x14], edi
push eax
call fcn.004b3a8d
mov byte [ebp - 4], 1
mov eax, dword [ebp + 0x14]
mov dword [edi + 0xc], eax
mov byte [ebp - 4], 2
push esi
push dword [ebp - 0x1c]
mov byte [ebp - 4], 0
mov ecx, ebx
call fcn.0051672e
mov byte [ebp - 4], 3
xor ebx, ebx
mov byte [ebp - 4], bl
lea ecx, [ebp - 0xb4]
call fcn.004b8d08
add esp, 0x3c
mov byte [ebp - 4], 4
push dword [ebp + 0x14]
sub esp, 0x38
mov eax, esp
mov dword [ebp - 0x14], esp
mov dword [ebp - 0x18], eax
mov dword [eax], ebx
mov byte [ebp - 4], 6
mov dword [eax + 0x20], ebx
mov dword [eax + 0x24], ebx
mov dword [eax + 0x28], ebx
mov dword [eax + 0x2c], ebx
mov byte [eax + 0x30], 1
mov byte [ebp - 4], 7
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x74]
call fcn.004b8d08
mov byte [ebp - 4], 8
lea eax, [ebp - 0x74]
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
mov dword [ebp - 0x18], ecx
call fcn.004b6a02
mov byte [ebp - 4], 0xb
sub esp, 0x40
mov ecx, esp
mov dword [ebp - 0x18], esp
lea eax, [ebp - 0xb4]
mov dword [ebp - 0x24], ecx
push eax
call fcn.004b6a02
mov byte [ebp - 4], 0xe
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x30]
call fcn.00516815
mov byte [ebp - 4], 0xf
lea eax, [ebp - 0x30]
mov ecx, dword [ebp - 0x20]
push eax
call fcn.004b6edd
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x30]
call fcn.004aa208
mov byte [ebp - 4], 4
lea eax, [ebp - 0x74]
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 4
mov ecx, eax
call fcn.004b70ae
mov byte [ebp - 4], bl
lea eax, [ebp - 0xb4]
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], bl
mov ecx, eax
call fcn.004b70ae
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004a0015
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x20]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x520a90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
xor edi, edi
bts edi, eax
cmp eax, 0x20
cmovae edx, edi
xor edi, edx
cmp eax, 0x40
mov eax, dword [ebp + 0xc]
cmovae edx, edi
test eax, eax
js 0x520ae2
lea ebx, [ebp + 0xc]
nop dword [eax]
xor ecx, ecx
lea ebx, [ebx + 4]
bts ecx, eax
xor esi, esi
cmp eax, 0x20
cmovae esi, ecx
xor ecx, esi
cmp eax, 0x40
mov eax, dword [ebx]
cmovae esi, ecx
or edi, ecx
or edx, esi
test eax, eax
jns 0x520ac0
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x522a10
Capabilities:
Hash data using djb2

Disassembly:
push esi
push edi
xor edi, edi
mov esi, 0x1505
test ecx, ecx
jne 0x522a22
xor eax, eax
pop edi
pop esi
ret
mov dl, byte [ecx]
test dl, dl
je 0x522a4c
nop dword [eax + eax]
mov eax, esi
lea ecx, [ecx + 1]
shld edi, esi, 5
xor edi, edi
shl esi, 5
add esi, eax
movzx eax, dl
cdq
mov dl, byte [ecx]
add esi, eax
test dl, dl
jne 0x522a30
pop edi
mov eax, esi
pop esi
ret

Function at 0x523df0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 0x10], 0
xorps xmm0, xmm0
push ebx
push esi
push edi
mov ebx, edx
movlpd qword [ebp - 0x10], xmm0
mov edi, ecx
jb 0x523eb7
mov eax, dword [ebp + 0xc]
ja 0x523e1c
test eax, eax
je 0x523eb7
mov eax, dword [ebp - 0xc]
mov esi, dword [ebp - 0x10]
mov dword [ebp - 8], eax
cmp dword [ebp + 0x14], 0
mov eax, dword [ebp + 8]
mov dl, byte [esi + eax]
mov byte [ebp - 1], dl
jne 0x523e4f
mov ax, word [edi + 0x14]
or ax, 2
movzx eax, ax
mov ecx, eax
xor ecx, 1
imul ecx, eax
shr ecx, 8
xor dl, cl
mov byte [ebp - 1], dl
test ebx, ebx
je 0x523e56
mov byte [esi + ebx], dl
mov ecx, dword [edi + 0xc]
lea edx, [ebp - 1]
not ecx
push 1
call fcn.0057b0a0
mov ecx, dword [edi + 0x14]
lea edx, [ebp - 1]
not eax
not ecx
mov dword [edi + 0xc], eax
movzx eax, al
add eax, dword [edi + 0x10]
imul eax, eax, 0x8088405
push 1
inc eax
mov dword [edi + 0x10], eax
shr eax, 0x18
mov byte [ebp - 1], al
call fcn.0057b0a0
mov ecx, dword [ebp - 8]
add esp, 8
add esi, 1
not eax
mov dword [edi + 0x14], eax
adc ecx, 0
mov dword [ebp - 8], ecx
cmp ecx, dword [ebp + 0x10]
jb 0x523e25
ja 0x523eb7
cmp esi, dword [ebp + 0xc]
jb 0x523e25
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x524880
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, edx
mov eax, 0x101
push edi
movzx ecx, word [esi + 4]
cmp cx, ax
jne 0x52489e
mov ebx, 8
jmp 0x5248b5
xor eax, eax
mov edx, 0x102
cmp cx, dx
setne al
lea eax, [eax*4 + 0xc]
movzx ebx, ax
push 2
movzx ecx, bx
lea eax, [esi + 6]
push ecx
push eax
push 0
mov dword [ebp - 4], ecx
call dword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
jns 0x5248ea
add esi, 0x28
je 0x5248e0
mov dword [esi], 0x14
mov dword [esi + 4], 0
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x5248f0
mov eax, dword [ebp - 4]
lea edi, [esi + 0x28]
add eax, 6
sub ecx, edx
push edi
add eax, esi
lea edx, [esi + 6]
push eax
movzx eax, word [esi + 4]
push eax
push 0
push ecx
mov ecx, dword [esi]
call fcn.00526130
add esp, 0x14
mov dword [esi + 0x20], eax
test eax, eax
je 0x5248e0
movzx eax, bx
lea ecx, [esi + 6]
cdq
add eax, 2
adc edx, 0
push edx
push eax
call fcn.00522720
add esp, 8
mov dword [esi + 0x1c], eax
test eax, eax
jne 0x52496a
mov ecx, dword [esi + 0x20]
call fcn.00526390
mov dword [esi + 0x20], 0
test edi, edi
je 0x524960
mov dword [edi], 0xe
mov dword [edi + 4], 0
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x525f60
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
lea eax, [ebp - 0x14]
push ebx
push esi
push edi
push eax
push 0
mov edi, ecx
mov esi, edx
push 0
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileTime]
test eax, eax
jne 0x525fa7
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, eax
call fcn.00525e80
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x525f9d
mov dword [ecx], 5
mov dword [ecx + 4], eax
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0x989680
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call fcn.0068a6d0
sub eax, 0xb6109100
mov ecx, edx
push edi
sbb ecx, 2
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], ecx
xor ebx, ebx
call dword [sym.imp.KERNEL32.DLL_GetFileType]
mov ecx, 1
cmp eax, ecx
lea eax, [ebp - 0x1c]
push eax
push edi
cmove ebx, ecx
call dword [sym.imp.KERNEL32.DLL_GetFileSizeEx]
test eax, eax
je 0x525f80
mov ecx, esi
call fcn.00523220
mov eax, dword [ebp - 8]
mov edi, dword [ebp + 8]
or dword [esi], 0x10
mov dword [esi + 0x28], eax
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x2c], eax
mov eax, dword [esi + 4]
mov dword [esi + 4], eax
mov ecx, dword [edi + 0x70]
mov eax, ecx
mov edx, dword [edi + 0x74]
or eax, edx
je 0x526034
sub ecx, dword [edi + 0x68]
mov eax, dword [esi + 4]
sbb edx, dword [edi + 0x6c]
or dword [esi], 4
mov dword [esi + 4], eax
xor eax, eax
mov dword [esi + 0x18], ecx
mov dword [esi + 0x1c], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x52604d
mov eax, dword [ebp - 0x1c]
or dword [esi], 4
mov dword [esi + 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 4]
mov dword [esi + 4], eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x526060
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [ebp + 0xc], 0
xorps xmm0, xmm0
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov esi, ecx
movlpd qword [ebp - 0x10], xmm0
jb 0x526112
mov ecx, dword [ebp + 8]
ja 0x52608d
test ecx, ecx
je 0x526112
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
cmp dword [esi + 0x28], 0x10
jne 0x5260f4
xorps xmm0, xmm0
lea edx, [esi + 8]
movlpd qword [ebp - 0x18], xmm0
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
nop word [eax + eax]
add byte [edx + eax], 1
jne 0x5260c3
add eax, 1
adc ecx, 0
jne 0x5260c3
cmp eax, 8
jb 0x5260b0
mov ecx, dword [esi]
lea eax, [ebp - 0xc]
push 0
push eax
push 0x10
lea eax, [esi + 0x18]
push eax
push 0
push 0
push 0
push 0x10
push edx
push dword [ecx + 4]
call dword [sym.imp.bcrypt.dll_BCryptEncrypt]
test eax, eax
js 0x52611b
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 4]
mov dword [esi + 0x28], 0
mov eax, dword [esi + 0x28]
mov al, byte [eax + esi + 0x18]
xor byte [edi + edx], al
inc dword [esi + 0x28]
add edi, 1
adc ebx, 0
cmp ebx, dword [ebp + 0xc]
ja 0x526112
jb 0x526093
cmp edi, ecx
jb 0x526093
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5262b0
Capabilities:
Hash data via bcrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov eax, edx
push esi
mov dword [ebp - 4], eax
mov ebx, ecx
call fcn.00526060
add esp, 8
test al, al
je 0x526306
mov eax, dword [ebx + 4]
test eax, eax
je 0x526306
cmp dword [ebp + 0xc], 0
ja 0x526306
jb 0x5262e6
cmp esi, 0xffffffff
ja 0x526306
push 0
push esi
push dword [ebp - 4]
push dword [eax + 4]
call dword [sym.imp.bcrypt.dll_BCryptHashData]
test eax, eax
setns al
test al, al
je 0x526306
mov al, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x526310
Capabilities:
Hash data via bcrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, ecx
mov dword [ebp - 4], edx
push esi
mov eax, dword [ebx + 4]
test eax, eax
je 0x526367
cmp dword [ebp + 0xc], 0
ja 0x526367
mov esi, dword [ebp + 8]
jb 0x526334
cmp esi, 0xffffffff
ja 0x526367
push 0
push esi
push edx
push dword [eax + 4]
call dword [sym.imp.bcrypt.dll_BCryptHashData]
test eax, eax
setns al
test al, al
je 0x526367
push dword [ebp + 0xc]
mov edx, dword [ebp - 4]
mov ecx, ebx
push esi
call fcn.00526060
add esp, 8
test al, al
je 0x526367
mov al, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x55768c
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x18
push esi
mov esi, dword [ebx + 0x1c]
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], ecx
push edi
test esi, esi
je 0x5577f0
mov edx, dword [ebx + 0x18]
mov edi, dword [ebx + 0x10]
add edx, 0xfffffffc
mov dword [ebp - 0xc], edx
dec esi
xor edx, edx
cmp byte [0x7a41d1], dl
mov dword [ebx + 0x1c], esi
mov esi, dword [ebx + 0x18]
mov dword [ebp - 0x10], esi
je 0x557768
lea eax, [esi - 0x20]
mov dword [ebp - 0x14], eax
test eax, eax
js 0x557721
movaps xmm2, xmmword [0x749280]
lea eax, [edi + 0x10]
mov esi, ecx
sub esi, edi
mov dword [ebp - 8], esi
mov esi, dword [ebp - 0x10]
mov edi, dword [ebp - 8]
movups xmm0, xmmword [edx + ecx]
add edx, 0x20
movups xmm1, xmmword [edi + eax]
pxor xmm0, xmm2
pxor xmm1, xmm2
movups xmmword [eax - 0x10], xmm0
movups xmmword [eax], xmm1
lea eax, [eax + 0x20]
cmp edx, dword [ebp - 0x14]
jle 0x5576fc
mov edi, dword [ebx + 0x10]
lea eax, [esi - 8]
cmp edx, eax
jg 0x557768
lea edi, [edx + ecx]
sub eax, edx
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x14], edi
mov edi, dword [ebx + 0x10]
mov dword [ebp - 8], edi
sub dword [ebp - 8], ecx
mov edi, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
shr eax, 3
inc eax
lea edx, [edx + eax*8]
movq xmm0, qword [edi]
pxor xmm0, xmmword [0x749280]
movq qword [ecx + edi], xmm0
lea edi, [edi + 8]
sub eax, 1
jne 0x557749
mov edi, dword [ebx + 0x10]
mov ecx, dword [ebp - 4]
cmp edx, dword [ebp - 0xc]
jg 0x5577b0
mov eax, edi
lea esi, [edx + ecx]
sub eax, ecx
mov dword [ebp - 0x14], eax
mov al, byte [esi]
mov cl, byte [esi + 1]
not al
mov edi, dword [ebp - 0x14]
not cl
mov byte [esi + edi], al
lea esi, [esi + 4]
mov edi, dword [ebx + 0x10]
mov byte [edi + edx + 1], cl
mov cl, byte [esi - 1]
mov al, byte [esi - 2]
not cl
not al
mov byte [edi + edx + 3], cl
mov byte [edi + edx + 2], al
add edx, 4
cmp edx, dword [ebp - 0xc]
jle 0x557777
mov ecx, dword [ebp - 4]
mov esi, dword [ebp - 0x10]
cmp edx, esi
jge 0x5577d9
sub ecx, edi
lea eax, [edx + edi]
mov dword [ebp - 0x10], ecx
sub esi, edx
mov edi, dword [ebp - 0x10]
mov ecx, eax
mov dword [ebp - 0x14], eax
mov al, byte [ecx + edi]
not al
mov byte [ecx], al
inc ecx
sub esi, 1
jne 0x5577c6
mov edi, dword [ebx + 0x10]
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x18]
add edi, dword [ebx + 0x14]
mov esi, dword [ebx + 0x1c]
mov dword [ebp - 4], ecx
mov dword [ebx + 0x10], edi
test esi, esi
jne 0x5576c3
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x5717f8
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x6da4f2
call fcn.006b9c3c
push ecx
xor eax, eax
push ebx
mov ebx, ecx
push esi
push edi
push 0x38
mov dword [ebx + 0x24], eax
mov dword [ebx + 0x28], eax
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x40], eax
mov dword [ebx + 0x38], eax
mov dword [ebx + 0x34], eax
mov dword [ebx + 0x48], eax
mov dword [ebx + 0x3c], eax
mov dword [ebx + 0x44], eax
call fcn.00689e2f
mov esi, eax
pop ecx
mov dword [ebp - 0x10], esi
and dword [ebp - 4], 0
mov dword [esi], vtable.ISampleGrabberCB.0
mov byte [ebp - 4], 1
lea ecx, [esi + 0x1c]
push ecx
mov dword [esi], vtable.SampleGrabberCallback.0
call dword [sym.imp.KERNEL32.DLL_InitializeCriticalSection]
xor eax, eax
push eax
push eax
push 1
push eax
mov dword [esi + 4], eax
mov word [esi + 0x10], ax
mov dword [esi + 8], eax
call dword [sym.imp.KERNEL32.DLL_CreateEventA]
mov dword [esi + 0x34], eax
or dword [ebp - 4], 0xffffffff
xor ecx, ecx
mov dword [ebx + 0x60], esi
lea edi, [ebx + 0x4c]
mov byte [esi + 0x10], cl
mov eax, 0x744174
mov esi, eax
push 0x1fe
push ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, eax
mov dword [ebx + 0x74], 2
mov dword [ebx + 0x78], ecx
lea edi, [ebx + 0x14]
mov dword [ebx], ecx
lea eax, [ebx + 0x184]
mov dword [ebx + 4], ecx
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], 0x280
mov dword [ebx + 0x10], 0x1e0
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
or dword [ebx + 0x7c], 0xffffffff
or dword [ebx + 0x80], 0xffffffff
mov dword [ebx + 0x6c], 0x2710
mov dword [ebx + 0x70], ecx
mov dword [ebx + 0x64], 1
mov word [ebx + 0x68], cx
mov byte [ebx + 0x6a], cl
call fcn.005077d5
push 0xff
lea eax, [ebx + 0x84]
push 0
push eax
call fcn.005077d5
add esp, 0x18
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x5721ed
Capabilities:
Enumerate devices by category

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
push esi
push edi
lea eax, [esp + 0x18]
xor ebx, ebx
push eax
push 0x73eaa8
push 1
push ebx
push 0x743324
mov dword [esp + 0x2c], ebx
mov edi, ebx
mov dword [esp + 0x30], ebx
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x57235d
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x1c]
push ebx
push edx
push 0x743314
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
test eax, eax
jne 0x57235d
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x10]
push ebx
push edx
mov dword [esp + 0x18], ebx
mov ecx, dword [eax]
push 1
push eax
call dword [ecx + 0xc]
test eax, eax
jne 0x572345
mov esi, ebx
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
push 0x728704
push ebx
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0x24]
test eax, eax
jns 0x57228b
mov eax, dword [esp + 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
jmp 0x57232b
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x20]
push ebx
push edx
push str.Description
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
test eax, eax
jns 0x5722c8
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x20]
push ebx
push edx
push str.FriendlyName
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
test eax, eax
js 0x572308
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x20]
push ebx
push edx
push str.FriendlyName
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov edx, dword [esp + 0x28]
mov ecx, ebx
cmp word [edx], bx
je 0x572301
cmp ecx, 0xfd
jge 0x572301
mov al, byte [edx + ecx*2]
mov byte [esi + ecx + 0x7a10b0], al
inc ecx
cmp word [edx + ecx*2], bx
jne 0x5722e8
mov byte [esi + ecx + 0x7a10b0], bl
mov eax, dword [esp + 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x14], ebx
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
inc edi
mov dword [esp + 0x10], ebx
add esi, 0xff
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x10]
push ebx
push edx
push 1
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
test eax, eax
je 0x572262
mov ecx, dword [esp + 0x18]
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x18], ebx
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x572566
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
push edx
call fcn.00572516
test al, al
je 0x5725ab
lea esi, [edx*4 + 0x7a4460]
mov ecx, dword [esi]
lea eax, [ecx + 0x84]
push eax
lea eax, [ecx + 0x184]
push eax
push edx
lea eax, [ecx + 0x30]
push eax
call fcn.00573ca1
test eax, eax
jne 0x5725ab
push esi
push eax
push 0x57253b
call fcn.00694e79
add esp, 0xc
pop esi
pop ebp
ret 4
Function at 0x573bee
Capabilities:
Enumerate devices by category

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
lea eax, [ebp - 0xc]
xor edi, edi
push eax
push 0x73eaa8
push 1
push edi
push 0x743324
mov dword [ebp - 0xc], edi
mov esi, edi
mov dword [ebp - 8], edi
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x573c99
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
push edi
push edx
push 0x743314
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
test eax, eax
jne 0x573c90
jmp 0x573c6d
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x10]
push edx
push 0x728704
push edi
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0x24]
test eax, eax
jns 0x573c57
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
jmp 0x573c70
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], edi
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
inc esi
mov dword [ebp - 4], edi
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
push edi
push edx
push 1
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
test eax, eax
je 0x573c34
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov dword [ebp - 8], edi
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x573ca1
Capabilities:
Enumerate devices by category

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push ebx
push esi
push edi
lea eax, [esp + 0x1c]
xor esi, esi
push eax
push 0x73eaa8
push 1
push esi
push 0x743324
mov edi, esi
mov dword [esp + 0x34], esi
mov ebx, esi
mov dword [esp + 0x30], esi
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x573e3a
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x14]
push esi
push edx
mov dword [esp + 0x1c], esi
mov ecx, dword [eax]
push 0x743314
push eax
call dword [ecx + 0xc]
mov esi, eax
test esi, esi
jne 0x573e26
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x24]
and dword [esp + 0x10], ebx
push eax
lea eax, [esp + 0x14]
mov edx, dword [ecx]
push eax
push 1
push ecx
call dword [edx + 0xc]
jmp 0x573e0e
test edi, edi
jne 0x573e16
cmp ebx, dword [ebp + 0xc]
jne 0x573df3
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x18]
push edx
push 0x728704
xor edx, edx
mov ecx, dword [eax]
push edx
push edx
push eax
call dword [ecx + 0x24]
mov esi, eax
test esi, esi
js 0x573df3
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x28]
push edi
push edx
push str.FriendlyName
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov esi, eax
test esi, esi
js 0x573dc8
mov ecx, dword [esp + 0x30]
xor esi, esi
mov edx, esi
cmp word [ecx], si
je 0x573daf
movzx eax, word [ecx]
mov edi, ecx
mov ebx, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov word [esi + ecx], ax
mov al, byte [edi]
mov edi, dword [esp + 0x30]
mov byte [edx + ebx], al
inc edx
lea esi, [edx + edx]
add edi, esi
movzx eax, word [edi]
test ax, ax
jne 0x573d8b
mov ebx, dword [esp + 0x20]
xor esi, esi
push dword [ebp + 8]
mov eax, dword [esp + 0x14]
push 0x73ea88
push esi
push esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
xor edi, edi
mov esi, eax
inc edi
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [esp + 0x18]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x24]
push edx
lea edx, [esp + 0x14]
inc ebx
push edx
mov ecx, dword [eax]
push 1
push eax
mov dword [esp + 0x30], ebx
call dword [ecx + 0xc]
test eax, eax
je 0x573d1d
mov eax, dword [esp + 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
test edi, edi
mov eax, 0x80040216
cmovne eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x57997d
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x6d70c7
call fcn.006b9c3c
sub esp, 0xbc
push esi
mov esi, ecx
call fcn.00579d41
push eax
mov ecx, esi
call fcn.00579c8a
cmp dword [esi + 0x14], 0
jne 0x579a2a
cmp dword [esi + 0x1c], 0
jne 0x5799b9
mov eax, dword [esi + 0x10]
cmp eax, dword [esi + 0xc]
jb 0x579ac3
push 0x744aa4
lea ecx, [ebp - 0x24]
call fcn.00411aae
and dword [ebp - 4], 0
lea ecx, [ebp - 0x3c]
push str.cv::RBaseStream::readBlock
call fcn.00411aae
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x54]
push str.Unexpected_end_of_input_stream
call fcn.00411aae
mov byte [ebp - 4], 2
lea eax, [ebp - 0x24]
push 0x65
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x54]
push eax
push 0xfffffffffffffffe
lea ecx, [ebp - 0xc8]
call fcn.00526747
mov byte [ebp - 4], 3
mov dword [ebp - 0xc8], vtable.cv::RBS_THROW_EOS_Exception.0
mov byte [ebp - 4], 2
push 0x7886a0
lea eax, [ebp - 0xc8]
push eax
call fcn.0068e3de
push 0
push dword [esi + 0x1c]
push dword [esi + 0x14]
call fcn.0069f669
push dword [esi + 0x14]
push dword [esi + 0x18]
push 1
push dword [esi + 8]
call fcn.006a355a
mov ecx, dword [esi + 8]
add esp, 0x1c
add ecx, eax
mov dword [esi + 0xc], ecx
test eax, eax
je 0x579a5b
cmp dword [esi + 0x10], ecx
jb 0x579ac3
push 0x744aa4
lea ecx, [ebp - 0x54]
call fcn.00411aae
mov dword [ebp - 4], 4
lea ecx, [ebp - 0x3c]
push str.cv::RBaseStream::readBlock
call fcn.00411aae
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x24]
push str.Unexpected_end_of_input_stream
call fcn.00411aae
mov byte [ebp - 4], 6
lea eax, [ebp - 0x54]
push 0x6d
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x24]
push eax
push 0xfffffffffffffffe
lea ecx, [ebp - 0xc8]
call fcn.00526747
mov byte [ebp - 4], 7
mov dword [ebp - 0xc8], vtable.cv::RBS_THROW_EOS_Exception.0
mov byte [ebp - 4], 6
jmp 0x579a19
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret