joyce8/EMBER2024-capa huggingface dataset:
Function at 0x448220
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x518f38
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x55b098]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x24], eax
cmp dword [eax + 0x40058], 0
mov edx, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x20], ebx
je 0x4483be
cmp dword [eax + 4], 0xffffffff
je 0x4483be
cmp dword [eax + 0x40028], 0
je 0x4483be
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0
xor ecx, ecx
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x1c], vtable.DataPack.0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], ecx
cmp dword [0x56e26c], ecx
je 0x44831e
mov eax, dword [0x56e268]
push ebx
inc eax
push edx
push 0x56e86c
mov dword [0x56e268], eax
mov dword [0x56e868], eax
call fcn.004f0d70
add esp, 8
lea edx, [ebx + 4]
mov ecx, 0x56e868
call fcn.00447790
add esp, 4
mov dword [ebx + 0x56e86c], eax
add ebx, 8
mov dword [ebp - 0x20], ebx
push 0x56e868
push 0x56e868
push ebx
call fcn.0047df60
push ebx
mov dword [ebp - 0x18], ebx
call fcn.004d7d8f
push ebx
mov esi, eax
push 0x56e868
push esi
mov dword [ebp - 0x2c], esi
call fcn.004f0d70
mov eax, dword [ebp - 0x24]
add esp, 0x10
mov dword [ebp - 0x28], esi
add ebx, 6
cmp ebx, 0xc8
jg 0x4483b3
mov esi, dword [sym.imp.WS2_32.dll_htons]
lea edi, [eax + 0x28]
push 0xaa55
call esi
mov word [edi], ax
mov eax, dword [ebp - 0x20]
push eax
push dword [ebp - 0x28]
mov word [edi + 2], ax
add edi, 4
push edi
call fcn.004f0d70
add esp, 0xc
push 0x55aa
call esi
mov ecx, dword [ebp - 0x20]
xor esi, esi
mov word [ecx + edi], ax
mov edi, dword [ebp - 0x24]
test ebx, ebx
jle 0x4483ad
nop
push 0
push ebx
lea eax, [edi + 0x28]
push eax
push dword [edi + 4]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x448391
test eax, eax
je 0x44838b
add esi, eax
cmp esi, ebx
jl 0x448370
jmp 0x4483ad
push 0x152
push str.APISocket.cpp
push str.socket_send_error_
push str.ERROR____s_n_s:__d_n_n
call fcn.004474f0
add esp, 0x10
add dword [edi + 0x40040], ebx
push dword [ebp - 0x2c]
call fcn.004d7d44
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d7d33
mov esp, ebp
pop ebp
ret 8
Function at 0x449140
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x518fca
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x55b098]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x28], esi
mov edi, dword [ebp + 8]
push 0
mov dword [ebp - 0x2c], esi
call fcn.004d61a0
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
test edi, edi
jne 0x449200
lea eax, [ebp - 0x20]
mov dword [ebp - 0x24], vtable.std::exception.0
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], str.bad_locale_name
xorps xmm0, xmm0
mov byte [ebp - 0x14], 1
push eax
movq qword [ebp - 0x20], xmm0
call fcn.004f0588
add esp, 8
mov dword [ebp - 0x24], vtable.std::runtime_error.0
lea eax, [ebp - 0x24]
push 0x558f5c
push eax
call fcn.004f12e4
push edi
push esi
call fcn.004d64e8
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d7d33
mov esp, ebp
pop ebp
ret 4
Function at 0x44de10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x519638
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x55b098]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x44df3e
cmp byte [ebx + 0x3d], 0
je 0x44df3e
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
sete al
test al, al
je 0x44de69
xor al, al
jmp 0x44df40
push 0
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.0044da20
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
lea eax, [ebp - 0x2c]
mov ecx, dword [ebx + 0x38]
lea edi, [ebp - 0x28]
cmovae edi, dword [ebp - 0x28]
lea esi, [ebp - 0x28]
cmovae esi, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x44decf
sub eax, 1
je 0x44ded3
mov ecx, dword [ebp - 0x14]
sub eax, 2
je 0x44df26
xor bl, bl
jmp 0x44df28
mov byte [ebx + 0x3d], 0
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
cmp ecx, 0x10
mov esi, dword [ebp - 0x2c]
cmovae eax, edx
sub esi, eax
je 0x44df08
push dword [ebx + 0x4c]
cmp ecx, 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, edx
push 1
push eax
call fcn.004f82c1
mov ecx, dword [ebp - 0x14]
add esp, 0x10
cmp esi, eax
jne 0x44decb
cmp byte [ebx + 0x3d], 0
je 0x44df26
test esi, esi
jne 0x44de91
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.0044daf0
jmp 0x44de8e
mov bl, 1
cmp ecx, 0x10
jb 0x44df3a
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.00448ce0
mov al, bl
jmp 0x44df40
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d7d33
mov esp, ebp
pop ebp
ret
Function at 0x44f2f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5190f6
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x55b098]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.004d7d49
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.004d63e5
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4519f0
Capabilities:
Create directory
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x519cf3
mov eax, dword fs:[0]
push eax
sub esp, 0xbc
mov eax, dword [0x55b098]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
mov dword [ebp - 4], 0
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0x550a7c
call esi
push 0
push str.Object
call esi
push 0
push str.Item
call esi
push 0
push str.Data
call esi
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp + 8]
cmovae ecx, dword [ebp + 8]
call fcn.00487380
test al, al
jne 0x451b27
push 0xb0
lea eax, [ebp - 0xc8]
push 0
push eax
call fcn.004f0ad0
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
lea ecx, [ebp - 0xc8]
cmovae eax, dword [ebp + 8]
add esp, 4
push 2
push eax
call fcn.00454270
lea ecx, [ebp - 0xc4]
mov byte [ebp - 4], 1
call fcn.0044e060
test eax, eax
jne 0x451ad2
mov eax, dword [ebp - 0xc8]
lea ecx, [ebp - 0xc8]
push 0
mov eax, dword [eax + 4]
add ecx, eax
mov edx, dword [ecx + 0xc]
or edx, 2
mov eax, edx
or eax, 4
cmp dword [ecx + 0x38], 0
cmovne eax, edx
push eax
call fcn.00449aa0
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
push 0x550a98
cmovae eax, dword [ebp + 8]
push eax
call fcn.004f8d38
mov esi, eax
add esp, 8
test esi, esi
je 0x451b1c
push 0
push 0
push esi
call fcn.004f8b79
add esp, 0xc
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push esi
push 1
push 4
push eax
call fcn.004f82c1
push esi
call fcn.004f6fed
add esp, 0x14
lea ecx, [ebp - 0xc8]
call fcn.0044aba0
mov eax, dword [ebp + 0x1c]
cmp eax, 0x10
jb 0x451b3c
inc eax
lea ecx, [ebp + 8]
push eax
push dword [ebp + 8]
call fcn.00448ce0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d7d33
mov esp, ebp
pop ebp
ret 0x18
Function at 0x456c70
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x456cbc
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x456c9f
cmp edi, 2
jb 0x456c9f
cmp byte [esi], cl
jne 0x456c9f
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x54bd50]
test edi, edi
jne 0x456c85
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x456ceb
cmp cl, 0x23
jne 0x456cd2
cmp byte [esi], cl
jne 0x456cd2
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x54bd50]
test cl, cl
jne 0x456cc3
pop edi
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x456e30
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x456e43
mov dword [edi], 0
call fcn.00456d00
mov esi, eax
test esi, esi
je 0x456e66
mov ecx, esi
call fcn.00456dd0
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
jne 0x456e6d
push esi
call fcn.004f6fed
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
mov ecx, dword [0x56e280]
test ecx, ecx
je 0x456e7d
inc dword [ecx + 0x374]
push eax
call fcn.004f8de7
add esp, 4
mov ebx, eax
push esi
test ebx, ebx
je 0x456e5e
push dword [ebp + 8]
push 1
push ebx
call fcn.004f9b50
add esp, 0x10
push esi
cmp eax, dword [ebp + 8]
je 0x456ec8
call fcn.004f6fed
mov eax, dword [0x56e280]
add esp, 4
test eax, eax
je 0x456eb8
dec dword [eax + 0x374]
push ebx
call fcn.004f85bc
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
call fcn.004f6fed
add esp, 4
test edi, edi
je 0x456ed9
mov eax, dword [ebp + 8]
mov dword [edi], eax
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret
Function at 0x45aa20
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
xorps xmm0, xmm0
mov dword [ebp - 4], ecx
push edi
movups xmmword [ebp - 0x28], xmm0
or eax, 0xffffffff
mov dword [ebp - 0x28], str.Window
movups xmmword [ebp - 0x18], xmm0
mov bl, 0x57
mov esi, 0x550b41
or edi, 0xffffffff
nop dword [eax + eax]
cmp bl, 0x23
jne 0x45aa5f
cmp byte [esi], bl
jne 0x45aa5f
cmp byte [esi + 1], bl
cmove eax, edi
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
xor eax, dword [edx*4 + 0x54bd50]
test bl, bl
jne 0x45aa50
mov esi, dword [ebp - 4]
not eax
add esi, 0x2e2c
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 0x465bb0
mov dword [ebp - 0x18], 0x465c20
mov dword [ebp - 0x14], 0x465c60
mov ecx, dword [esi]
mov edi, dword [esi + 4]
mov dword [ebp - 0x10], 0x465d30
mov dword [ebp - 0xc], 0x465da0
cmp ecx, edi
jne 0x45aad4
inc ecx
test edi, edi
je 0x45aac2
mov eax, edi
cdq
sub eax, edx
sar eax, 1
add eax, edi
jmp 0x45aac7
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
push ecx
mov ecx, esi
call fcn.00466710
mov eax, dword [esi]
movups xmm0, xmmword [ebp - 0x28]
pop edi
lea ecx, [eax + eax*8]
mov eax, dword [esi + 8]
movups xmmword [eax + ecx*4], xmm0
movups xmm0, xmmword [ebp - 0x18]
movups xmmword [eax + ecx*4 + 0x10], xmm0
mov dword [eax + ecx*4 + 0x20], 0
mov eax, dword [ebp - 4]
inc dword [esi]
pop esi
pop ebx
mov byte [eax], 1
mov esp, ebp
pop ebp
ret
Function at 0x4656e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
mov esi, dword [0x56e280]
push edi
cmp byte [esi + 0x2e44], 0
je 0x465790
cmp dword [esi + 0x2e4c], 0
je 0x46577e
mov ebx, dword [esi + 0x2e54]
lea edi, [esi + 0x2e50]
test ebx, ebx
jns 0x465739
je 0x465725
mov eax, ebx
cdq
sub eax, edx
mov ecx, eax
sar ecx, 1
add ecx, ebx
jmp 0x46572a
mov ecx, 8
xor eax, eax
test ecx, ecx
cmovg eax, ecx
mov ecx, edi
push eax
call fcn.004664f0
lea eax, [ebp + 0xc]
mov dword [edi], 0
push eax
push dword [ebp + 8]
mov ecx, edi
call fcn.00457300
mov edx, dword [edi]
test edx, edx
je 0x465756
dec edx
jmp 0x465758
xor edx, edx
push dword [esi + 0x2e4c]
mov eax, dword [edi + 8]
mov ecx, 0x56e27c
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call fcn.004f82c1
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea ecx, [esi + 0x2e50]
call fcn.00457300
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x465b50
Capabilities:
Hash data with crc32

Disassembly:
push esi
push edi
mov edi, ecx
or ecx, 0xffffffff
mov al, byte [edi]
lea esi, [edi + 1]
test al, al
je 0x465b8c
push ebx
or ebx, 0xffffffff
cmp al, 0x23
jne 0x465b72
cmp byte [esi], al
jne 0x465b72
cmp byte [esi + 1], al
cmove ecx, ebx
movzx edx, cl
movzx eax, al
xor edx, eax
shr ecx, 8
mov al, byte [esi]
inc esi
xor ecx, dword [edx*4 + 0x54bd50]
test al, al
jne 0x465b64
pop ebx
not ecx
call fcn.00465b00
test eax, eax
jne 0x465ba0
mov ecx, edi
pop edi
pop esi
jmp fcn.00465a20
pop edi
pop esi
ret
Function at 0x474fb0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 8]
mov eax, 0x5e6ea9af
push esi
mov esi, edx
mov ecx, 1
mul ebx
push edi
shr edx, 0xb
xor edi, edi
imul eax, edx, 0x15b0
mov edx, ebx
mov dword [ebp - 0x10], edi
sub edx, eax
mov dword [ebp - 4], edx
test ebx, ebx
je 0x4750ea
xor ebx, ebx
cmp edx, 7
jbe 0x475049
mov eax, 7
sub eax, esi
mov dword [ebp - 0x10], eax
movzx eax, byte [esi]
add ebx, 8
add ecx, eax
movzx eax, byte [esi + 1]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 2]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 3]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 4]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 5]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 6]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 7]
add edi, ecx
add esi, 8
add ecx, eax
mov eax, dword [ebp - 0x10]
add eax, esi
add edi, ecx
cmp eax, edx
jb 0x474ff8
mov dword [ebp - 0x10], edi
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
cmp ebx, eax
jae 0x4750af
sub eax, ebx
cmp eax, 2
jb 0x47509b
mov edx, dword [ebp - 4]
sub edx, ebx
sub edx, 2
shr edx, 1
inc edx
lea ebx, [ebx + edx*2]
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 8]
mov edi, ebx
movzx eax, byte [esi]
add ecx, eax
movzx eax, byte [esi + 1]
add ebx, ecx
add esi, 2
add ecx, eax
add edi, ecx
sub edx, 1
jne 0x475075
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
mov dword [ebp - 0xc], edi
mov edi, dword [ebp - 0x10]
cmp ebx, dword [ebp - 4]
jae 0x4750a8
movzx eax, byte [esi]
add ecx, eax
add edi, ecx
inc esi
mov eax, dword [ebp - 0xc]
add eax, edx
add edi, eax
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
mov eax, 0x80078071
mul edi
shr edx, 0xf
imul eax, edx, 0xffff000f
mov edx, dword [ebp - 4]
add edi, eax
sub dword [ebp + 8], edx
mov edx, 0x15b0
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], edx
jne 0x474fe7
shl edi, 0x10
lea eax, [ecx + edi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x476580
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x55b098]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [0x56e280]
lea eax, [ebp - 0x20]
push esi
push edi
push eax
push dword [0x56e294]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x20]
movd xmm0, eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x1c]
cvtdq2ps xmm0, xmm0
movss dword [ebp - 0x28], xmm0
movd xmm0, eax
mov eax, dword [ebp - 0x28]
cvtdq2ps xmm0, xmm0
mov dword [ebx + 0x10], eax
movss dword [ebp - 0x24], xmm0
mov eax, dword [ebp - 0x24]
mov dword [ebx + 0x14], eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edi, dword [ebp - 0x10]
mov ecx, edi
sub ecx, dword [0x56e2a0]
mov esi, dword [ebp - 0xc]
mov edx, esi
sbb edx, dword [0x56e2a4]
call fcn.004d8c10
mov edx, dword [0x56e29c]
mov ecx, dword [0x56e298]
cvtsd2ss xmm0, xmm0
movss dword [ebp - 0x24], xmm0
call fcn.004d8c10
movss xmm1, dword [ebp - 0x24]
cvtsd2ss xmm0, xmm0
push 0x11
divss xmm1, xmm0
movss dword [ebx + 0x18], xmm1
mov dword [0x56e2a4], esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
mov dword [0x56e2a0], edi
call esi
shr eax, 0xf
and al, 1
push 0x10
mov byte [ebx + 0x100], al
call esi
shr eax, 0xf
and al, 1
push 0x12
mov byte [ebx + 0x101], al
call esi
shr eax, 0xf
and al, 1
mov byte [ebx + 0x103], 0
mov byte [ebx + 0x102], al
call fcn.00476210
cmp byte [ebx + 0xb0], 0
je 0x476683
or eax, 0xffffffff
jmp 0x47668e
mov eax, dword [0x56e280]
mov eax, dword [eax + 0x1e0c]
cmp dword [0x567b78], eax
je 0x4766a0
mov dword [0x567b78], eax
call fcn.004760e0
call fcn.00476300
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d7d33
mov esp, ebp
pop ebp
ret
Function at 0x47df60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
movzx eax, cl
imul eax, eax, 0x9d
push edi
mov edi, 0x86d
mov dword [ebp - 4], eax
xor eax, eax
test ecx, ecx
jle 0x47dfbe
mov ecx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
sub ebx, ecx
nop dword [eax]
lea esi, [eax + ecx]
mov ecx, eax
and ecx, 7
inc eax
mov dl, byte [ecx + 0x56e500]
mov ecx, edi
xor dl, byte [ebx + esi]
sar ecx, 8
xor dl, cl
imul edi, edi, 0x87b
xor dl, byte [ebp - 4]
mov ecx, dword [ebp + 0x10]
mov byte [esi], dl
cmp eax, dword [ebp + 8]
jl 0x47df90
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x484d00
Capabilities:
Create process on windows
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x55b098]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x56e45c], 2
push ebx
jne 0x484ec6
mov ecx, dword [0x56e460]
mov al, byte [ecx + 0x249]
test al, al
je 0x484ec6
cmp byte [ecx + 0x17c], 0
je 0x484ec6
cmp dword [ecx + 0x178], 0x10
lea eax, [ecx + 0x164]
push dword [ecx + 0x24c]
mov dword [0x56e498], 1
mov dword [0x56e45c], 1
jb 0x484d6a
mov eax, dword [eax]
add ecx, 0x14c
push eax
cmp dword [ecx + 0x14], 0x10
jb 0x484d79
mov ecx, dword [ecx]
movaps xmm0, xmmword [0x551ad0]
push ecx
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x30], 0x7e7f7b7f
xor ecx, ecx
mov word [ebp - 0x2c], 0x7e
mov al, byte [ebp - 0x40]
xor byte [ebp + ecx - 0x3f], al
inc ecx
cmp ecx, 0x14
jb 0x484d94
sub esp, 0x18
mov byte [ebp - 0x2b], 0
lea eax, [ebp - 0x3f]
mov ecx, esp
push eax
call fcn.0044b480
lea eax, [ebp - 0x1c]
push eax
call fcn.0047e0b0
movaps xmm0, xmmword [0x551ac0]
lea edx, [ebp - 0x1c]
add esp, 0x28
mov word [ebp - 0x2c], 0x70
cmp dword [ebp - 8], 0x10
movups xmmword [ebp - 0x3c], xmm0
cmovae edx, dword [ebp - 0x1c]
xor ecx, ecx
nop dword [eax]
mov al, byte [ebp - 0x3c]
xor byte [ebp + ecx - 0x3b], al
inc ecx
cmp ecx, 0x10
jb 0x484de0
push 9
push 0
push edx
lea eax, [ebp - 0x3b]
mov byte [ebp - 0x2b], 0
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 2
jne 0x484ea9
movaps xmm0, xmmword [0x551a00]
mov al, 0x67
mov byte [ebp - 0x28], 0x2b
mov cl, 0x4a
xor al, byte [ebp - 0x28]
mov ch, 0x43
mov byte [ebp - 0x27], al
mov dl, 0x5e
mov al, byte [ebp - 0x28]
mov bl, 0x45
mov ah, 0x48
mov byte [ebp - 0x1f], 0
mov dh, 0x4e
mov byte [ebp - 0x1f], 0
mov bh, 0x59
mov dword [ebp - 0x50], 0x4a4b0540
xor cl, al
mov dword [ebp - 0x4c], 0x4a430551
xor ch, al
mov byte [ebp - 0x26], cl
xor dl, al
mov byte [ebp - 0x22], ch
xor bl, al
mov byte [ebp - 0x25], dl
xor ah, al
mov byte [ebp - 0x24], bl
xor dh, al
mov byte [ebp - 0x23], ah
xor bh, al
mov byte [ebp - 0x21], dh
mov byte [ebp - 0x20], bh
xor ecx, ecx
movups xmmword [ebp - 0x60], xmm0
mov dword [ebp - 0x48], 0xb414b50
mov byte [ebp - 0x44], 0
nop dword [eax + eax]
mov al, byte [ebp - 0x60]
xor byte [ebp + ecx - 0x5f], al
inc ecx
cmp ecx, 0x1b
jb 0x484e80
push 0x40
lea eax, [ebp - 0x27]
mov byte [ebp - 0x44], 0
push eax
lea eax, [ebp - 0x5f]
push eax
push dword [0x56e488]
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x484eb1
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov eax, dword [ebp - 8]
cmp eax, 0x10
jb 0x484ec6
inc eax
lea ecx, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
call fcn.00448ce0
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004d7d33
mov esp, ebp
pop ebp
ret

Function at 0x484ee0
Capabilities:
Create process on windows

Disassembly:
cmp dword [0x56e4ec], 2
jne 0x484f20
mov eax, dword [0x56e460]
cmp byte [eax + 0x249], 0
je 0x484f20
push 5
push 0
push 0
push str.https:__ioniaonline.com_
push 0
push 0
mov dword [0x56e49c], 1
mov dword [0x56e4ec], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
ret
Function at 0x484f30
Capabilities:
Create process on windows
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
cmp dword [0x56e3ac], 2
jne 0x485085
mov eax, dword [0x56e460]
cmp byte [eax + 0x249], 0
je 0x485085
push ebx
mov byte [ebp - 0x1c], 0x4b
mov al, 4
xor al, byte [ebp - 0x1c]
mov cl, 0x3b
xor cl, byte [ebp - 0x1c]
mov bh, 0x2e
mov byte [ebp - 0x1b], al
mov ah, 0x24
mov byte [ebp - 0x1a], cl
mov dl, 0x3f
mov cl, byte [ebp - 0x1c]
mov ch, 0x25
mov byte [ebp - 1], 0x33
xor ah, cl
mov al, byte [ebp - 1]
mov dh, 0x65
xor al, cl
mov byte [ebp - 2], bh
mov byte [ebp - 0x13], al
mov bl, 0x22
mov al, byte [ebp - 2]
xor dl, cl
push 9
push 0
xor al, cl
mov byte [ebp - 0x17], ah
push 0
mov byte [ebp - 0x12], al
xor bl, cl
lea eax, [ebp - 0x1b]
mov byte [ebp - 0x11], 0
push eax
push 0
xor ch, cl
mov dword [0x56e4a0], 1
xor dh, cl
mov dword [0x56e3ac], 1
xor bh, cl
mov byte [ebp - 0x19], dl
push 0
mov byte [ebp - 0x18], bl
mov byte [ebp - 0x16], ch
mov byte [ebp - 0x15], dh
mov byte [ebp - 0x14], bh
mov byte [ebp - 0x11], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 2
jne 0x48507c
movaps xmm0, xmmword [0x551a60]
mov al, 0x35
mov byte [ebp - 0x10], 0x79
mov cl, 0x18
xor al, byte [ebp - 0x10]
mov ch, 0x11
mov byte [ebp - 0xf], al
mov dl, 0xc
mov al, byte [ebp - 0x10]
mov bl, 0x17
mov ah, 0x1a
mov byte [ebp - 7], 0
mov dh, 0x1c
mov byte [ebp - 7], 0
mov bh, 0xb
mov dword [ebp - 0x24], 0x273c262f
xor cl, al
mov word [ebp - 0x20], 0x672d
xor ch, al
mov byte [ebp - 0xe], cl
xor dl, al
mov byte [ebp - 0xa], ch
xor bl, al
mov byte [ebp - 0xd], dl
xor ah, al
mov byte [ebp - 0xc], bl
xor dh, al
mov byte [ebp - 0xb], ah
xor bh, al
mov byte [ebp - 9], dh
mov byte [ebp - 8], bh
xor ecx, ecx
movups xmmword [ebp - 0x34], xmm0
mov byte [ebp - 0x1e], 0
nop dword [eax]
mov al, byte [ebp - 0x34]
xor byte [ebp + ecx - 0x33], al
inc ecx
cmp ecx, 0x15
jb 0x485050
push 0x40
lea eax, [ebp - 0xf]
mov byte [ebp - 0x1e], 0
push eax
lea eax, [ebp - 0x33]
push eax
push dword [0x56e488]
call dword [sym.imp.USER32.dll_MessageBoxA]
pop ebx
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
pop ebx
mov esp, ebp
pop ebp
ret