joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400f4679
Capabilities:
Capture webcam image

Disassembly:
test rdx, rdx
je 0x1400f48cd
mov r11, rsp
push rbp
push rsi
push r15
sub rsp, 0xc0
mov rax, qword [0x14044f8c0]
xor rax, rsp
mov qword [rsp + 0xa0], rax
cmp qword [rcx + 0x150], 0
mov r15d, r8d
mov rbp, rdx
mov rsi, rcx
je 0x1400f48b2
mov qword [r11 + 0x18], rbx
xorps xmm0, xmm0
mov qword [r11 + 0x20], rdi
xorps xmm1, xmm1
mov qword [r11 - 0x20], r12
mov qword [r11 - 0x28], r14
movdqu xmmword [r11 - 0x48], xmm0
movdqu xmmword [r11 - 0x58], xmm1
movdqu xmmword [rsp + 0x70], xmm0
movdqu xmmword [rsp + 0x60], xmm1
call fcn.14015ef10
mov rcx, qword [rsi + 0x40]
lea rdx, [rsp + 0x90]
xor r12d, r12d
mov r14d, eax
mov edi, r12d
call qword [sym.imp.USER32.dll_GetClientRect]
mov rcx, qword [rsi + 0x40]
lea r9, [rsp + 0x70]
xor r8d, r8d
mov edx, 0x419
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rsi + 0x40]
lea r9, [rsp + 0x60]
xor r8d, r8d
mov edx, 0x41a
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rsi + 0x40]
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
call fcn.1401583ac
mov rbx, rax
test rax, rax
je 0x1400f4768
mov rcx, qword [rsi + 0x40]
lea rdx, [rsp + 0x80]
call qword [sym.imp.USER32.dll_GetWindowRect]
lea rdx, [rsp + 0x80]
mov rcx, rbx
call fcn.140160bc4
mov eax, dword [rsp + 0x6c]
mov r10d, dword [rsi + 0x160]
sub eax, r10d
mov r11d, dword [rsp + 0x64]
sub eax, r11d
cdq
sub eax, edx
sar eax, 1
test r14b, 2
mov ebx, eax
mov r14, qword [rsp + 0xb0]
je 0x1400f47e1
mov r8d, dword [rsp + 0x7c]
mov ecx, r8d
mov r9d, dword [rsp + 0x74]
sub ecx, r9d
mov edx, dword [rsi + 0x10c]
cmp edx, ecx
jge 0x1400f47b5
mov edi, r8d
sub edi, edx
sub edi, r9d
mov r8d, dword [rsi + 0x1a0]
add r8d, r11d
mov r11d, dword [rsp + 0x68]
sub r11d, dword [rsi + 0x1ac]
add r8d, ebx
sub r11d, dword [rsp + 0x60]
mov ebx, r10d
sub ebx, dword [rsi + 0x1a8]
sub r11d, edi
jmp 0x1400f4830
mov edx, dword [rsp + 0x78]
mov eax, edx
mov r8d, dword [rsp + 0x70]
sub eax, r8d
mov ecx, dword [rsi + 0x108]
cmp ecx, eax
jge 0x1400f4800
mov edi, edx
sub edi, ecx
sub edi, r8d
mov r8d, dword [rsi + 0x1a0]
add r8d, dword [rsp + 0x74]
mov r11d, dword [rsp + 0x7c]
add r8d, ebx
mov ebx, dword [rsp + 0x68]
sub ebx, dword [rsi + 0x1a8]
sub ebx, dword [rsp + 0x60]
sub r11d, dword [rsi + 0x1ac]
sub ebx, edi
sub r11d, dword [rsp + 0x74]
mov eax, dword [rsi + 0x164]
mov edx, ebx
mov r9d, dword [rsi + reloc.OLEAUT32.dll_OleTranslateColor]
mov ecx, 0x64
add r9d, dword [rsp + 0x60]
mov byte [rsp + 0x58], r12b
cmp ebx, r10d
cmovg edx, r10d
cmp r11d, eax
mov r10d, r11d
cmovg r10d, eax
test r15d, r15d
mov eax, 0xff
cmovne eax, ecx
lea rcx, [rsi + 0x148]
mov byte [rsp + 0x50], al
mov dword [rsp + 0x48], r10d
mov dword [rsp + 0x40], edx
mov rdx, qword [rbp + 8]
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], r11d
mov dword [rsp + 0x20], ebx
call fcn.1400134c0
mov rdi, qword [rsp + 0xf8]
mov rbx, qword [rsp + 0xf0]
mov r12, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1402ecc20
add rsp, 0xc0
pop r15
pop rsi
pop rbp
ret
Function at 0x1400f48d0
Capabilities:
Capture webcam image

Disassembly:
test rdx, rdx
je 0x1400f49fd
mov r11, rsp
push rbp
push rsi
push r14
sub rsp, 0x80
mov rax, qword [0x14044f8c0]
xor rax, rsp
mov qword [rsp + 0x70], rax
cmp qword [rcx + 0xf8], 0
mov r14d, r8d
mov rbp, rdx
mov rsi, rcx
je 0x1400f49e5
mov rcx, qword [rcx + 0x40]
lea r9, [r11 - 0x38]
xorps xmm0, xmm0
mov qword [r11 + 0x18], rbx
xor r8d, r8d
mov qword [r11 + 0x20], rdi
mov edx, 0x419
movdqu xmmword [rsp + 0x60], xmm0
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [rsp + 0x60]
mov ebx, dword [rsi + 0x1b0]
mov r11d, dword [rsi + 0x1b4]
mov eax, dword [rsi + 0x108]
mov r10d, dword [rsi + 0x10c]
cdq
sub r10d, dword [rsi + 0x1bc]
sub eax, edx
sar eax, 1
sub r10d, r11d
mov r9d, eax
mov byte [rsp + 0x58], 0
sub r9d, dword [rsi + 0x1b8]
mov eax, dword [rsp + 0x68]
mov edi, r9d
sub eax, ecx
sub edi, ebx
sub eax, edi
cdq
sub eax, edx
mov rdx, qword [rbp + 8]
sar eax, 1
cmp dword [rsi + 0x1d0], 0
cmovne ebx, r9d
test r14d, r14d
mov r9d, dword [rsp + 0x64]
lea r8d, [rcx + rax]
mov eax, 0xff
mov ecx, 0x80
cmovne eax, ecx
lea rcx, [rsi + 0xf0]
mov byte [rsp + 0x50], al
mov dword [rsp + 0x48], r10d
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x38], r11d
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], r10d
mov dword [rsp + 0x20], edi
call fcn.1400134c0
mov rdi, qword [rsp + 0xb8]
mov rbx, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1402ecc20
add rsp, 0x80
pop r14
pop rsi
pop rbp
ret

Function at 0x1400f48d9
Capabilities:
Capture webcam image

Disassembly:
test rdx, rdx
je 0x1400f49fd
mov r11, rsp
push rbp
push rsi
push r14
sub rsp, 0x80
mov rax, qword [0x14044f8c0]
xor rax, rsp
mov qword [rsp + 0x70], rax
cmp qword [rcx + 0xf8], 0
mov r14d, r8d
mov rbp, rdx
mov rsi, rcx
je 0x1400f49e5
mov rcx, qword [rcx + 0x40]
lea r9, [r11 - 0x38]
xorps xmm0, xmm0
mov qword [r11 + 0x18], rbx
xor r8d, r8d
mov qword [r11 + 0x20], rdi
mov edx, 0x419
movdqu xmmword [rsp + 0x60], xmm0
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [rsp + 0x60]
mov ebx, dword [rsi + 0x1b0]
mov r11d, dword [rsi + 0x1b4]
mov eax, dword [rsi + 0x108]
mov r10d, dword [rsi + 0x10c]
cdq
sub r10d, dword [rsi + 0x1bc]
sub eax, edx
sar eax, 1
sub r10d, r11d
mov r9d, eax
mov byte [rsp + 0x58], 0
sub r9d, dword [rsi + 0x1b8]
mov eax, dword [rsp + 0x68]
mov edi, r9d
sub eax, ecx
sub edi, ebx
sub eax, edi
cdq
sub eax, edx
mov rdx, qword [rbp + 8]
sar eax, 1
cmp dword [rsi + 0x1d0], 0
cmovne ebx, r9d
test r14d, r14d
mov r9d, dword [rsp + 0x64]
lea r8d, [rcx + rax]
mov eax, 0xff
mov ecx, 0x80
cmovne eax, ecx
lea rcx, [rsi + 0xf0]
mov byte [rsp + 0x50], al
mov dword [rsp + 0x48], r10d
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x38], r11d
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], r10d
mov dword [rsp + 0x20], edi
call fcn.1400134c0
mov rdi, qword [rsp + 0xb8]
mov rbx, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1402ecc20
add rsp, 0x80
pop r14
pop rsi
pop rbp
ret
Function at 0x1400f5bc0
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov edi, edx
mov rbx, rcx
call fcn.14010dcb0
cmp qword [rbx + 0x3e0], 0
jle 0x1400f5c8e
cmp qword [rbx + 0x408], 0
jne 0x1400f5c03
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x408], rax
mov qword [rsp + 0x60], rsi
xor esi, esi
test edi, edi
je 0x1400f5c99
mov qword [rsp + 0x28], rsi
lea rcx, [0x1400f57e0]
xor r9d, r9d
mov dword [rsp + 0x20], 4
xor r8d, r8d
mov qword [rsp + 0x58], rbp
mov rdx, rbx
call fcn.140164718
mov rbp, rax
test rax, rax
je 0x1400f5c84
lea rdi, [rbx + 0x400]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, qword [rbp + 0x58]
mov r9, rdi
mov dword [rsp + 0x30], 2
mov rcx, rax
mov dword [rsp + 0x28], esi
mov r8, rbx
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
mov dword [rsp + 0x50], esi
cmp qword [rbx + 0x400], rsi
je 0x1400f5c89
mov rcx, qword [rbx + 0x408]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rbx + 0x400]
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x1400f5ce5
cmp dword [rsp + 0x50], 0x103
jne 0x1400f5ce5
mov rcx, qword [rbx + 0x400]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 0x400]
test rcx, rcx
je 0x1400f5c89
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x400], rsi
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x1400f9f40
Capabilities:
Capture webcam image

Disassembly:
test rdx, rdx
je 0x1400fa13f
mov r11, rsp
push rbp
push rsi
push r14
sub rsp, 0xa0
mov rax, qword [0x14044f8c0]
xor rax, rsp
mov qword [rsp + 0x90], rax
cmp qword [rcx + 0x150], 0
mov r14d, r8d
mov rbp, rdx
mov rsi, rcx
je 0x1400fa124
cmp qword [rcx + 0xf8], 0
je 0x1400fa124
xorps xmm0, xmm0
mov qword [r11 + 0x18], rbx
xorps xmm1, xmm1
mov qword [r11 + 0x20], rdi
movdqu xmmword [r11 - 0x38], xmm0
movdqu xmmword [rsp + 0x60], xmm1
movdqu xmmword [rsp + 0x70], xmm0
call fcn.14015ef10
mov rcx, qword [rsi + 0x40]
lea rdx, [rsp + 0x80]
mov ebx, eax
xor edi, edi
call qword [sym.imp.USER32.dll_GetClientRect]
mov rcx, qword [rsi + 0x40]
lea r9, [rsp + 0x60]
xor r8d, r8d
mov edx, 0x419
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rsi + 0x40]
lea r9, [rsp + 0x70]
xor r8d, r8d
mov edx, 0x41a
call qword [sym.imp.USER32.dll_SendMessageW]
test bl, 2
je 0x1400fa078
mov edx, dword [rsp + 0x6c]
mov eax, edx
mov r8d, dword [rsp + 0x64]
sub eax, r8d
mov ecx, dword [rsi + 0x10c]
cmp ecx, eax
jge 0x1400fa01b
mov edi, edx
sub edi, ecx
sub edi, r8d
mov r8d, dword [rsi + 0x160]
mov ebx, 0x64
mov eax, dword [rsp + 0x78]
mov r11d, 0xff
mov r9d, dword [rsp + 0x70]
sub eax, r9d
mov byte [rsp + 0x58], 0
sub eax, edi
test r14d, r14d
cmovne r11d, ebx
mov byte [rsp + 0x50], r11b
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x40], r8d
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r8d
mov r8d, dword [rsp + 0x60]
jmp 0x1400fa104
mov edx, dword [rsp + 0x68]
mov eax, edx
mov r8d, dword [rsp + 0x60]
sub eax, r8d
mov ecx, dword [rsi + 0x108]
cmp ecx, eax
jge 0x1400fa097
mov edi, edx
sub edi, ecx
sub edi, r8d
mov edx, dword [rsi + 0x164]
mov ebx, 0x64
mov eax, dword [rsp + 0x6c]
mov ecx, edx
mov r9d, dword [rsp + 0x64]
sub ecx, eax
mov r10d, dword [rsp + 0x78]
sub eax, r9d
mov r8d, dword [rsp + 0x70]
cmp edx, eax
mov byte [rsp + 0x58], 0
mov r11d, 0xff
cmovg edx, eax
sub r10d, r8d
sub r10d, edi
test r14d, r14d
cmovne r11d, ebx
xor eax, eax
mov byte [rsp + 0x50], r11b
add ecx, r9d
mov dword [rsp + 0x48], edx
mov dword [rsp + 0x40], r10d
cmovns eax, ecx
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], r10d
mov rdx, qword [rbp + 8]
lea rcx, [rsi + 0x148]
call fcn.1400134c0
mov rbx, qword [rsp + 0xd0]
mov rdi, qword [rsp + 0xd8]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1402ecc20
add rsp, 0xa0
pop r14
pop rsi
pop rbp
ret
Function at 0x1400f9f49
Capabilities:
Capture webcam image

Disassembly:
test rdx, rdx
je 0x1400fa13f
mov r11, rsp
push rbp
push rsi
push r14
sub rsp, 0xa0
mov rax, qword [0x14044f8c0]
xor rax, rsp
mov qword [rsp + 0x90], rax
cmp qword [rcx + 0x150], 0
mov r14d, r8d
mov rbp, rdx
mov rsi, rcx
je 0x1400fa124
cmp qword [rcx + 0xf8], 0
je 0x1400fa124
xorps xmm0, xmm0
mov qword [r11 + 0x18], rbx
xorps xmm1, xmm1
mov qword [r11 + 0x20], rdi
movdqu xmmword [r11 - 0x38], xmm0
movdqu xmmword [rsp + 0x60], xmm1
movdqu xmmword [rsp + 0x70], xmm0
call fcn.14015ef10
mov rcx, qword [rsi + 0x40]
lea rdx, [rsp + 0x80]
mov ebx, eax
xor edi, edi
call qword [sym.imp.USER32.dll_GetClientRect]
mov rcx, qword [rsi + 0x40]
lea r9, [rsp + 0x60]
xor r8d, r8d
mov edx, 0x419
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rsi + 0x40]
lea r9, [rsp + 0x70]
xor r8d, r8d
mov edx, 0x41a
call qword [sym.imp.USER32.dll_SendMessageW]
test bl, 2
je 0x1400fa078
mov edx, dword [rsp + 0x6c]
mov eax, edx
mov r8d, dword [rsp + 0x64]
sub eax, r8d
mov ecx, dword [rsi + 0x10c]
cmp ecx, eax
jge 0x1400fa01b
mov edi, edx
sub edi, ecx
sub edi, r8d
mov r8d, dword [rsi + 0x160]
mov ebx, 0x64
mov eax, dword [rsp + 0x78]
mov r11d, 0xff
mov r9d, dword [rsp + 0x70]
sub eax, r9d
mov byte [rsp + 0x58], 0
sub eax, edi
test r14d, r14d
cmovne r11d, ebx
mov byte [rsp + 0x50], r11b
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x40], r8d
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r8d
mov r8d, dword [rsp + 0x60]
jmp 0x1400fa104
mov edx, dword [rsp + 0x68]
mov eax, edx
mov r8d, dword [rsp + 0x60]
sub eax, r8d
mov ecx, dword [rsi + 0x108]
cmp ecx, eax
jge 0x1400fa097
mov edi, edx
sub edi, ecx
sub edi, r8d
mov edx, dword [rsi + 0x164]
mov ebx, 0x64
mov eax, dword [rsp + 0x6c]
mov ecx, edx
mov r9d, dword [rsp + 0x64]
sub ecx, eax
mov r10d, dword [rsp + 0x78]
sub eax, r9d
mov r8d, dword [rsp + 0x70]
cmp edx, eax
mov byte [rsp + 0x58], 0
mov r11d, 0xff
cmovg edx, eax
sub r10d, r8d
sub r10d, edi
test r14d, r14d
cmovne r11d, ebx
xor eax, eax
mov byte [rsp + 0x50], r11b
add ecx, r9d
mov dword [rsp + 0x48], edx
mov dword [rsp + 0x40], r10d
cmovns eax, ecx
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], r10d
mov rdx, qword [rbp + 8]
lea rcx, [rsi + 0x148]
call fcn.1400134c0
mov rbx, qword [rsp + 0xd0]
mov rdi, qword [rsp + 0xd8]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1402ecc20
add rsp, 0xa0
pop r14
pop rsi
pop rbp
ret
Function at 0x1400fa140
Capabilities:
Capture webcam image

Disassembly:
test rdx, rdx
je 0x1400fa21b
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x14044f8c0]
xor rax, rsp
mov qword [rsp + 0x70], rax
cmp qword [rcx + 0xf8], 0
mov esi, r8d
mov rdi, rdx
mov rbx, rcx
je 0x1400fa1fa
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
call fcn.14015ef10
mov rcx, qword [rbx + 0x40]
lea r9, [rsp + 0x60]
xor r8d, r8d
mov edx, 0x419
call qword [sym.imp.USER32.dll_SendMessageW]
mov byte [rsp + 0x58], 0
lea rcx, [rbx + 0xf0]
mov r8d, dword [rcx + 0x1c]
test esi, esi
mov r9d, dword [rcx + 0x18]
mov eax, 0xff
mov edx, 0x80
cmovne eax, edx
mov rdx, qword [rdi + 8]
mov byte [rsp + 0x50], al
xor eax, eax
mov dword [rsp + 0x48], r8d
mov dword [rsp + 0x40], r9d
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], r8d
mov r8d, dword [rsp + 0x60]
mov dword [rsp + 0x20], r9d
mov r9d, dword [rsp + 0x64]
call fcn.1400134c0
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1402ecc20
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x1400fa149
Capabilities:
Capture webcam image

Disassembly:
test rdx, rdx
je 0x1400fa21b
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x14044f8c0]
xor rax, rsp
mov qword [rsp + 0x70], rax
cmp qword [rcx + 0xf8], 0
mov esi, r8d
mov rdi, rdx
mov rbx, rcx
je 0x1400fa1fa
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
call fcn.14015ef10
mov rcx, qword [rbx + 0x40]
lea r9, [rsp + 0x60]
xor r8d, r8d
mov edx, 0x419
call qword [sym.imp.USER32.dll_SendMessageW]
mov byte [rsp + 0x58], 0
lea rcx, [rbx + 0xf0]
mov r8d, dword [rcx + 0x1c]
test esi, esi
mov r9d, dword [rcx + 0x18]
mov eax, 0xff
mov edx, 0x80
cmovne eax, edx
mov rdx, qword [rdi + 8]
mov byte [rsp + 0x50], al
xor eax, eax
mov dword [rsp + 0x48], r8d
mov dword [rsp + 0x40], r9d
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], r8d
mov r8d, dword [rsp + 0x60]
mov dword [rsp + 0x20], r9d
mov r9d, dword [rsp + 0x64]
call fcn.1400134c0
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1402ecc20
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400fa3a0
Capabilities:
Capture webcam image

Disassembly:
test rdx, rdx
je 0x1400fa605
mov r11, rsp
push rdi
push r14
sub rsp, 0xc8
mov rax, qword [0x14044f8c0]
xor rax, rsp
mov qword [rsp + 0x98], rax
cmp qword [rcx + 0x150], 0
mov r14, rdx
mov dword [rsp + 0x60], r8d
mov rdi, rcx
je 0x1400fa5eb
cmp qword [rcx + 0xf8], 0
je 0x1400fa5eb
mov qword [r11 + 0x18], rbx
xorps xmm0, xmm0
mov qword [r11 - 0x18], rbp
xorps xmm1, xmm1
mov qword [r11 - 0x20], rsi
mov qword [r11 - 0x28], r12
mov qword [r11 - 0x30], r13
mov qword [r11 - 0x38], r15
movdqu xmmword [r11 - 0x50], xmm0
movdqu xmmword [rsp + 0x78], xmm1
movdqu xmmword [rsp + 0x68], xmm0
call fcn.14015ef10
mov rcx, qword [rdi + 0x40]
lea rdx, [rsp + 0x88]
mov ebx, eax
call qword [sym.imp.USER32.dll_GetClientRect]
mov rcx, qword [rdi + 0x40]
lea r9, [rsp + 0x78]
xor r8d, r8d
mov edx, 0x419
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rdi + 0x40]
lea r9, [rsp + 0x68]
xor r8d, r8d
mov edx, 0x41a
call qword [sym.imp.USER32.dll_SendMessageW]
mov r15d, dword [rdi + 0x160]
xor ebp, ebp
mov esi, dword [rdi + reloc.OLEAUT32.dll_OleTranslateColor]
mov r12d, ebp
test bl, 2
je 0x1400fa510
mov r9d, dword [rsp + 0x6c]
mov ecx, r15d
mov r10d, dword [rsp + 0x74]
mov ebx, r15d
mov eax, dword [rsp + 0x84]
sub ecx, r10d
add ecx, r9d
mov r8d, ebp
cmovns r12d, ecx
sub eax, dword [rdi + 0x10c]
sub eax, dword [rsp + 0x7c]
mov ecx, dword [rsp + 0x68]
cmovns r8d, eax
sub ebx, dword [rdi + 0x1a8]
mov eax, r10d
sub ebx, r12d
sub eax, r15d
shr r12d, 1
sub eax, r9d
sub r10d, r9d
cdq
add esi, ecx
sub eax, edx
sar eax, 1
mov r13d, eax
mov eax, dword [rsp + 0x70]
add r13d, dword [rdi + 0x1a0]
mov r11d, eax
sub r11d, dword [rdi + 0x1ac]
add r13d, r9d
sub r11d, ecx
sub r11d, r8d
cmp r15d, r10d
cmovg r15d, r10d
mov r10d, dword [rdi + 0x164]
sub eax, ecx
cmp r10d, eax
cmovg r10d, eax
jmp 0x1400fa56e
mov r11d, dword [rdi + 0x164]
mov edx, ebp
mov r8d, dword [rsp + 0x7c]
mov r10d, r11d
mov r9d, dword [rsp + 0x84]
mov ecx, r11d
mov ebx, dword [rsp + 0x70]
sub ecx, r9d
mov r13d, dword [rdi + 0x1a0]
add ecx, r8d
cmovns edx, ecx
sub ebx, dword [rdi + 0x1a8]
sub r11d, dword [rdi + 0x1ac]
sub r9d, r8d
add r13d, dword [rsp + 0x68]
mov eax, edx
sub ebx, dword [rsp + 0x68]
sub r11d, edx
shr eax, 1
add esi, eax
mov ebp, eax
add esi, r8d
cmp r10d, r9d
cmovg r10d, r9d
cmp dword [rsp + 0x60], 0
mov eax, 0xff
mov rdx, qword [r14 + 8]
mov ecx, 0x64
mov byte [rsp + 0x58], 0
cmovne eax, ecx
mov byte [rsp + 0x50], al
lea rcx, [rdi + 0x148]
mov dword [rsp + 0x48], r10d
mov r9d, esi
mov dword [rsp + 0x40], r15d
mov r8d, r13d
mov dword [rsp + 0x38], ebp
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], r11d
mov dword [rsp + 0x20], ebx
call fcn.1400134c0
mov r15, qword [rsp + 0xa0]
mov r13, qword [rsp + 0xa8]
mov r12, qword [rsp + 0xb0]
mov rsi, qword [rsp + 0xb8]
mov rbp, qword [rsp + 0xc0]
mov rbx, qword [rsp + 0xf0]
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.1402ecc20
add rsp, 0xc8
pop r14
pop rdi
ret
Function at 0x1400fa3a9
Capabilities:
Capture webcam image

Disassembly:
test rdx, rdx
je 0x1400fa605
mov r11, rsp
push rdi
push r14
sub rsp, 0xc8
mov rax, qword [0x14044f8c0]
xor rax, rsp
mov qword [rsp + 0x98], rax
cmp qword [rcx + 0x150], 0
mov r14, rdx
mov dword [rsp + 0x60], r8d
mov rdi, rcx
je 0x1400fa5eb
cmp qword [rcx + 0xf8], 0
je 0x1400fa5eb
mov qword [r11 + 0x18], rbx
xorps xmm0, xmm0
mov qword [r11 - 0x18], rbp
xorps xmm1, xmm1
mov qword [r11 - 0x20], rsi
mov qword [r11 - 0x28], r12
mov qword [r11 - 0x30], r13
mov qword [r11 - 0x38], r15
movdqu xmmword [r11 - 0x50], xmm0
movdqu xmmword [rsp + 0x78], xmm1
movdqu xmmword [rsp + 0x68], xmm0
call fcn.14015ef10
mov rcx, qword [rdi + 0x40]
lea rdx, [rsp + 0x88]
mov ebx, eax
call qword [sym.imp.USER32.dll_GetClientRect]
mov rcx, qword [rdi + 0x40]
lea r9, [rsp + 0x78]
xor r8d, r8d
mov edx, 0x419
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rdi + 0x40]
lea r9, [rsp + 0x68]
xor r8d, r8d
mov edx, 0x41a
call qword [sym.imp.USER32.dll_SendMessageW]
mov r15d, dword [rdi + 0x160]
xor ebp, ebp
mov esi, dword [rdi + reloc.OLEAUT32.dll_OleTranslateColor]
mov r12d, ebp
test bl, 2
je 0x1400fa510
mov r9d, dword [rsp + 0x6c]
mov ecx, r15d
mov r10d, dword [rsp + 0x74]
mov ebx, r15d
mov eax, dword [rsp + 0x84]
sub ecx, r10d
add ecx, r9d
mov r8d, ebp
cmovns r12d, ecx
sub eax, dword [rdi + 0x10c]
sub eax, dword [rsp + 0x7c]
mov ecx, dword [rsp + 0x68]
cmovns r8d, eax
sub ebx, dword [rdi + 0x1a8]
mov eax, r10d
sub ebx, r12d
sub eax, r15d
shr r12d, 1
sub eax, r9d
sub r10d, r9d
cdq
add esi, ecx
sub eax, edx
sar eax, 1
mov r13d, eax
mov eax, dword [rsp + 0x70]
add r13d, dword [rdi + 0x1a0]
mov r11d, eax
sub r11d, dword [rdi + 0x1ac]
add r13d, r9d
sub r11d, ecx
sub r11d, r8d
cmp r15d, r10d
cmovg r15d, r10d
mov r10d, dword [rdi + 0x164]
sub eax, ecx
cmp r10d, eax
cmovg r10d, eax
jmp 0x1400fa56e
mov r11d, dword [rdi + 0x164]
mov edx, ebp
mov r8d, dword [rsp + 0x7c]
mov r10d, r11d
mov r9d, dword [rsp + 0x84]
mov ecx, r11d
mov ebx, dword [rsp + 0x70]
sub ecx, r9d
mov r13d, dword [rdi + 0x1a0]
add ecx, r8d
cmovns edx, ecx
sub ebx, dword [rdi + 0x1a8]
sub r11d, dword [rdi + 0x1ac]
sub r9d, r8d
add r13d, dword [rsp + 0x68]
mov eax, edx
sub ebx, dword [rsp + 0x68]
sub r11d, edx
shr eax, 1
add esi, eax
mov ebp, eax
add esi, r8d
cmp r10d, r9d
cmovg r10d, r9d
cmp dword [rsp + 0x60], 0
mov eax, 0xff
mov rdx, qword [r14 + 8]
mov ecx, 0x64
mov byte [rsp + 0x58], 0
cmovne eax, ecx
mov byte [rsp + 0x50], al
lea rcx, [rdi + 0x148]
mov dword [rsp + 0x48], r10d
mov r9d, esi
mov dword [rsp + 0x40], r15d
mov r8d, r13d
mov dword [rsp + 0x38], ebp
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], r11d
mov dword [rsp + 0x20], ebx
call fcn.1400134c0
mov r15, qword [rsp + 0xa0]
mov r13, qword [rsp + 0xa8]
mov r12, qword [rsp + 0xb0]
mov rsi, qword [rsp + 0xb8]
mov rbp, qword [rsp + 0xc0]
mov rbx, qword [rsp + 0xf0]
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.1402ecc20
add rsp, 0xc8
pop r14
pop rdi
ret
Function at 0x1400fa610
Capabilities:
Capture webcam image

Disassembly:
test rdx, rdx
je 0x1400fa78f
mov r11, rsp
push r12
push r13
push r15
sub rsp, 0xa0
mov rax, qword [0x14044f8c0]
xor rax, rsp
mov qword [rsp + 0x70], rax
cmp qword [rcx + 0xf8], 0
mov r12d, r8d
mov r13, rdx
mov r15, rcx
je 0x1400fa775
mov rcx, qword [rcx + 0x40]
lea r9, [r11 - 0x58]
mov qword [r11 + 0x18], rbx
xorps xmm0, xmm0
mov qword [r11 - 0x20], rbp
xor r8d, r8d
mov qword [r11 - 0x28], rsi
mov edx, 0x419
mov qword [r11 - 0x30], rdi
mov qword [r11 - 0x38], r14
movdqu xmmword [rsp + 0x60], xmm0
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [rsp + 0x60]
mov edx, dword [r15 + 0x1c4]
mov r8d, dword [rsp + 0x64]
mov eax, dword [r15 + 0x1c0]
mov r10d, dword [rsp + 0x6c]
mov r14d, dword [r15 + 0x1b0]
mov ebp, dword [r15 + 0x1b4]
lea r9d, [rdx + r8]
mov r11d, dword [rsp + 0x68]
lea edi, [rax + rcx]
sub r11d, dword [r15 + 0x1c8]
mov esi, dword [r15 + 0x108]
sub r11d, eax
mov eax, dword [r15 + 0x1cc]
sub r11d, ecx
sub esi, dword [r15 + 0x1b8]
mov ecx, r10d
mov ebx, dword [r15 + 0x10c]
sub ecx, eax
sub ebx, dword [r15 + 0x1bc]
sub r10d, eax
sub ecx, edx
mov byte [rsp + 0x58], 0
sub r10d, edx
sub ecx, r8d
mov rdx, qword [r13 + 8]
sub ebx, ebp
sub r10d, r8d
sub esi, r14d
cmp ebx, ecx
mov eax, 0xff
mov ecx, 0x80
mov r8d, edi
cmovle r10d, ebx
test r12d, r12d
cmovne eax, ecx
lea rcx, [r15 + 0xf0]
mov byte [rsp + 0x50], al
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x38], ebp
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], r10d
mov dword [rsp + 0x20], r11d
call fcn.1400134c0
mov r14, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x90]
mov rbp, qword [rsp + 0x98]
mov rbx, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1402ecc20
add rsp, 0xa0
pop r15
pop r13
pop r12
ret