joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4202b0
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x4c07e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x14]
mov eax, 0x10624dd3
imul ecx
push esi
sar edx, 6
mov eax, edx
mov esi, dword [ebp + 8]
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0x104], esi
mov dword [ebp - 0x110], eax
imul eax, eax, 0x3e8
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x108], 1
sub ecx, eax
imul eax, ecx, 0x3e8
mov dword [ebp - 0x10c], eax
lea eax, [ebp - 0x110]
push eax
push 0
push 0
lea eax, [ebp - 0x108]
push eax
push 0x40
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jns 0x420353
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.select
push str.Socket_error:__s___d_n
call fcn.0041e0d0
add esp, 0xc
or eax, 0xffffffff
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464e2f
mov esp, ebp
pop ebp
ret
jne 0x420367
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464e2f
mov esp, ebp
pop ebp
ret
push 0
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
test esi, esi
jns 0x420393
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.recv
push str.Socket_error:__s___d_n
call fcn.0041e0d0
add esp, 0xc
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00464e2f
mov esp, ebp
pop ebp
ret
Function at 0x422a70
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push esi
push 5
mov esi, ecx
call fcn.004225c0
mov ecx, eax
call fcn.00422950
cmp byte [ebp + 8], 0
je 0x422aa5
mov ecx, esi
call fcn.004233f0
call dword [sym.imp.WS2_32.dll_WSACleanup]
push 0
push dword [0x4c23fc]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
pop esi
pop ebp
ret 4

Function at 0x422fa0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push dword [0x4c23fc]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [ebp - 4], 0x103
jne 0x422fe0
push 0x103
push str.dwExitCode:__X_n
call fcn.0041e0d0
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 0x422e00
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x4c23fc], eax
mov esp, ebp
pop ebp
ret
Function at 0x423000
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1ac
mov eax, dword [0x4c07e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp - 0x1a4]
mov byte [ebp - 0x14], 0
push eax
xorps xmm0, xmm0
mov dword [ebp - 0xb], 0
push 0x202
mov ebx, ecx
movq qword [ebp - 0x13], xmm0
mov word [ebp - 7], 0
mov byte [ebp - 5], 0
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0
push 0
mov ecx, ebx
call fcn.00423500
push eax
push 0x7d0
call fcn.0041fa40
mov edx, eax
add esp, 0x10
mov dword [ebp - 0x1a8], edx
test edx, edx
jne 0x42307c
lea eax, [edx + 1]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464e2f
mov esp, ebp
pop ebp
ret
push esi
lea esi, [ebx + 0x914]
mov ecx, esi
push edi
lea edi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x423090
sub ecx, edi
lea eax, [ebx + 0x10]
push ecx
push esi
push eax
lea edi, [ebx + 4]
push edi
push edx
call fcn.0041ff10
add esp, 0x14
mov esi, eax
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [0x4c2400]
call fcn.004225a0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4230c4
sub eax, edx
je 0x42313d
mov eax, dword [0x4c2400]
test eax, eax
je 0x42313d
cmp dword [eax], 0
je 0x42313d
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edi, [ebx + 0x924]
xorps xmm0, xmm0
push edi
lea eax, [ebx + 0x494]
push eax
movups xmmword [edi], xmm0
push dword [ebx + 4]
call sym.WASTE_1.8.0.build_344.exe_UPNP_GetExternalIPAddress
mov esi, eax
add esp, 0xc
cmp esi, 1
je 0x42312e
cmp esi, 2
je 0x42312e
push edi
lea eax, [ebp - 0x14]
push 0x10
push eax
call fcn.0046b5c5
mov ecx, dword [0x4c2400]
add esp, 0xc
mov ecx, dword [ecx]
call fcn.00422ab0
jmp 0x42313d
lea eax, [ebp - 0x14]
push eax
push 0x10
push edi
call fcn.0046b5c5
add esp, 0xc
push dword [ebp - 0x1a8]
call fcn.0041fe90
mov eax, dword [0x4c2400]
add esp, 4
cmp esi, 1
je 0x423191
cmp esi, 2
je 0x423174
pop edi
pop esi
mov dword [eax + 0x14], 0
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464e2f
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov dword [eax + 0x14], 2
mov eax, 2
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464e2f
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov dword [eax + 0x14], 1
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.00464e2f
mov esp, ebp
pop ebp
ret
Function at 0x4231b0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov eax, dword [0x4c07e0]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
lea eax, [ebp - 0x194]
mov edi, ecx
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x4231ed
mov eax, 3
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464e2f
mov esp, ebp
pop ebp
ret
push ebx
push esi
lea eax, [ebp - 0x198]
xor ebx, ebx
push eax
lea eax, [ebp - 0x1a4]
push eax
call fcn.004225c0
mov ecx, eax
call fcn.004226c0
lea eax, [ebp - 0x19c]
push eax
lea eax, [ebp - 0x1a0]
push eax
call fcn.004225c0
mov ecx, eax
call fcn.004226f0
xor esi, esi
cmp dword [ebp - 0x19c], ebx
jle 0x423249
nop
mov eax, dword [ebp - 0x1a0]
mov ecx, edi
add eax, esi
push eax
call fcn.00422ae0
inc esi
cmp esi, dword [ebp - 0x19c]
jl 0x423230
xor esi, esi
cmp dword [ebp - 0x198], ebx
jle 0x423285
mov eax, dword [ebp - 0x1a4]
mov ecx, edi
test eax, eax
je 0x42326e
add eax, esi
push eax
call fcn.00422bd0
test eax, eax
je 0x42327c
inc ebx
jmp 0x42327c
mov eax, dword [ebp - 0x1a0]
add eax, esi
push eax
call fcn.00422ae0
inc esi
cmp esi, dword [ebp - 0x198]
jl 0x423253
call dword [sym.imp.WS2_32.dll_WSACleanup]
pop esi
test ebx, ebx
pop ebx
jle 0x4232a5
mov eax, 4
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464e2f
mov esp, ebp
pop ebp
ret
push 4
call fcn.004225c0
mov ecx, eax
call fcn.00422950
mov ecx, dword [0x4c2400]
mov eax, dword [ebp - 0x1a4]
pop edi
mov dword [ecx + 0x10], eax
mov eax, dword [ebp - 0x198]
mov dword [ecx + 0xc], eax
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464e2f
mov esp, ebp
pop ebp
ret

Function at 0x4233f0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a0
mov eax, dword [0x4c07e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
call fcn.004225c0
mov ecx, eax
call fcn.00422580
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x423415
sub eax, edx
jne 0x423440
mov eax, dword [0x4c2400]
pop ebx
mov dword [eax + 0x14], 2
mov eax, 2
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464e2f
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x4c2400]
lea eax, [ebp - 0x198]
push eax
lea eax, [ebp - 0x19c]
push eax
call fcn.004226c0
lea eax, [ebp - 0x194]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x423483
mov eax, 3
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464e2f
mov esp, ebp
pop ebp
ret
push esi
push edi
xor esi, esi
xor edi, edi
cmp dword [ebp - 0x198], esi
jle 0x4234b3
mov eax, dword [ebp - 0x19c]
test eax, eax
je 0x4234aa
add eax, esi
mov ecx, ebx
push eax
call fcn.00422ae0
test eax, eax
je 0x4234aa
inc edi
inc esi
cmp esi, dword [ebp - 0x198]
jl 0x423491
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, dword [0x4c2400]
test edi, edi
pop edi
pop esi
jle 0x4234df
mov dword [eax + 0x14], 6
mov eax, 6
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464e2f
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov dword [eax + 0x14], 0
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00464e2f
mov esp, ebp
pop ebp
ret
Function at 0x423500
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2bc
mov eax, dword [0x4c07e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp - 0x294]
mov ebx, ecx
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0x100
lea eax, [ebp - 0x104]
push 0
push eax
call fcn.00466b60
add esp, 0xc
mov dword [ebp - 0x298], 0
lea eax, [ebp - 0x298]
xorps xmm0, xmm0
movups xmmword [ebp - 0x2bc], xmm0
mov dword [ebp - 0x2b4], 1
push eax
lea eax, [ebp - 0x2bc]
mov dword [ebp - 0x2b8], 2
push eax
push 0
lea eax, [ebp - 0x104]
push eax
movups xmmword [ebp - 0x2ac], xmm0
call fcn.0041e310
test eax, eax
jne 0x423640
push esi
mov esi, dword [ebp - 0x298]
test esi, esi
je 0x42362a
push edi
mov eax, dword [esi + 0x18]
push dword [eax + 4]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov edi, eax
mov ecx, edi
lea eax, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x4235b4
sub ecx, eax
je 0x42360c
call fcn.004225c0
push 0x10
push edi
mov eax, dword [eax]
add eax, 0x914
push eax
call fcn.0046b3d0
mov ecx, 0x4c2410
add esp, 0xc
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4235e0
sub ecx, edx
push ecx
push 0x4c2410
push edi
call fcn.0046b620
add esp, 0xc
test eax, eax
je 0x42360c
push edi
push 0x10
push 0x4c2410
call fcn.0046b5c5
add esp, 0xc
mov esi, dword [esi + 0x1c]
test esi, esi
jne 0x4235a1
pop edi
pop esi
lea eax, [ebx + 0x914]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464e2f
mov esp, ebp
pop ebp
ret
pop esi
lea eax, [ebx + 0x914]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464e2f
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
lea eax, [ebx + 0x914]
xor ecx, ebp
pop ebx
call fcn.00464e2f
mov esp, ebp
pop ebp
ret
Function at 0x427b30
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x184
mov eax, dword [0x4c07e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0x4c6c88]
push esi
mov esi, dword [eax + ecx*4]
mov eax, dword [0x4c2470]
cmp eax, dword [esi + 4]
jle 0x427b93
push 0x4c2470
call fcn.00464d2b
add esp, 4
cmp dword [0x4c2470], 0xffffffff
jne 0x427b93
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 0x7d0
push 0x4c2470
mov dword [0x4c246c], eax
call fcn.00464cec
add esp, 4
push 0x1388
push 0x4c246c
call fcn.004510e0
add esp, 8
test eax, eax
jne 0x427d00
mov eax, dword [0x4c2478]
cmp eax, dword [esi + 4]
jle 0x427bed
push 0x4c2478
call fcn.00464d2b
add esp, 4
cmp dword [0x4c2478], 0xffffffff
jne 0x427bed
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 0xea60
push 0x4c2478
mov dword [0x4c2474], eax
call fcn.00464cec
add esp, 4
push 0xea60
push 0x4c2474
call fcn.004510e0
add esp, 8
test eax, eax
jne 0x427c1e
mov ecx, dword [0x4c3114]
call fcn.00407330
mov esi, eax
call fcn.00427660
add esi, eax
jne 0x427c1e
call fcn.00429070
cmp dword [0x4c3da4], 0
je 0x427d00
mov ecx, dword [0x4c3114]
call fcn.004258e0
mov esi, eax
call fcn.00429600
add esi, eax
cmp esi, dword [0x4c3da4]
jge 0x427d00
call fcn.00428ac0
mov esi, eax
test esi, esi
je 0x427d00
cmp dword [0x4c3db0], 0
je 0x427cd5
mov ecx, esi
call fcn.0042e7c0
movzx ecx, ax
lea eax, [esi + 0x257]
push ecx
push eax
lea eax, [ebp - 0xc4]
push str._s:_d
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0xc4]
push eax
push 0x4c3e68
call fcn.00403a10
add esp, 0x18
test eax, eax
je 0x427d00
lea eax, [ebp - 0xc4]
push eax
push str._connect
lea eax, [ebp - 0x184]
push 0x491630
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x184]
push eax
push 0x4c3e68
call fcn.00403a10
add esp, 0x18
test eax, eax
jne 0x427d00
lea eax, [esi + 0x257]
push eax
call fcn.00429930
add esp, 4
test eax, eax
je 0x427d00
push 1
call fcn.00427660
push eax
push esi
call fcn.00429760
add esp, 0xc
mov ecx, esi
call fcn.004052b0
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00464e2f
mov esp, ebp
pop ebp
ret
Function at 0x429070
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48d0eb
mov eax, dword fs:[0]
push eax
sub esp, 0x198
mov eax, dword [0x4c07e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0x4c2438
xor esi, esi
call fcn.0042d8d0
test eax, eax
jle 0x429106
nop dword [eax]
push esi
mov ecx, 0x4c2438
call fcn.0042d890
push esi
mov ecx, 0x4c2438
mov edi, eax
call fcn.00407200
test edi, edi
je 0x4290f8
push 1
mov ecx, edi
call fcn.00405380
push 0
push 0
mov ecx, edi
call fcn.00404970
cmp byte [edi + 0x2d7], 0
jne 0x4290f8
push edi
call fcn.00428650
push eax
call fcn.00429040
add esp, 8
mov ecx, 0x4c2438
call fcn.0042d8d0
cmp esi, eax
jl 0x4290b0
mov esi, dword [0x4c3114]
xor edi, edi
mov ecx, esi
call fcn.00407330
test eax, eax
jle 0x42918b
nop dword [eax]
push edi
mov ecx, esi
call fcn.00407350
test eax, eax
je 0x42917f
mov ecx, eax
call fcn.004073f0
mov esi, eax
mov ecx, esi
call fcn.00405ee0
mov ecx, dword [0x4c3114]
push edi
call fcn.00424fe0
dec edi
test esi, esi
je 0x429179
push 1
mov ecx, esi
call fcn.00405380
push 0
push 0
mov ecx, esi
call fcn.00404970
cmp byte [esi + 0x2d7], 0
jne 0x429179
push esi
call fcn.00428650
push eax
call fcn.00429040
add esp, 8
mov esi, dword [0x4c3114]
mov ecx, esi
inc edi
call fcn.00407330
cmp edi, eax
jl 0x429120
call dword [sym.imp.WS2_32.dll_WSACleanup]
lea eax, [ebp - 0x1a0]
mov dword [0x4c0330], 0
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov ecx, dword [0x4c310c]
test ecx, ecx
je 0x4291cd
call fcn.00401810
mov ecx, dword [0x4c310c]
test ecx, ecx
je 0x4291cd
push 1
call fcn.0041d4f0
push 0x14
call fcn.0046506d
add esp, 4
mov dword [ebp - 0x1a4], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x4291f3
push 0x40
mov ecx, eax
call fcn.004015f0
jmp 0x4291f5
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x4c310c], eax
call fcn.00444220
call fcn.0044d940
test al, al
jne 0x42922e
call fcn.004225c0
test eax, eax
je 0x42922e
movzx eax, word [0x4c4e78]
push 1
push eax
call fcn.004225c0
mov ecx, eax
call fcn.00422720
cmp byte [0x4c4e7a], 0
je 0x42923c
call fcn.00428380
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00464e2f
mov esp, ebp
pop ebp
ret

Function at 0x42ffc0
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x42fb10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x4329c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3c0c
call fcn.00465040
mov eax, dword [0x4c07e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x3c0c], eax
call fcn.00431c70
mov esi, dword [ebp + 0xc]
lea edi, [ebp - 0x1e08]
movss xmm1, dword [0x498210]
lea edx, [ebp - 0xf0c]
mov ecx, 0x3c2
rep movsd dword es:[edi], dword [esi]
pop edi
mov ecx, 0x1e1
pop esi
nop dword [eax]
mov eax, dword [edx - 4]
lea edx, [edx - 0x20]
mov dword [ebp + ecx*8 - 0x1e08], eax
movss xmm0, dword [edx + 0x20]
xorps xmm0, xmm1
movss dword [ebp + ecx*8 - 0x1e04], xmm0
mov eax, dword [edx + 0x14]
mov dword [ebp + ecx*8 - 0x1e00], eax
movss xmm0, dword [edx + 0x18]
xorps xmm0, xmm1
movss dword [ebp + ecx*8 - 0x1dfc], xmm0
mov eax, dword [edx + 0xc]
mov dword [ebp + ecx*8 - 0x1df8], eax
movss xmm0, dword [edx + 0x10]
xorps xmm0, xmm1
movss dword [ebp + ecx*8 - 0x1df4], xmm0
mov eax, dword [edx + 4]
mov dword [ebp + ecx*8 - 0x1df0], eax
movss xmm0, dword [edx + 8]
xorps xmm0, xmm1
movss dword [ebp + ecx*8 - 0x1dec], xmm0
add ecx, 4
cmp ecx, 0x3bd
jl 0x432a10
cmp ecx, 0x3c0
jge 0x432ac7
lea eax, [ecx*8]
lea edx, [ebp - 4]
sub edx, eax
nop
mov eax, dword [edx - 4]
lea edx, [edx - 8]
mov dword [ebp + ecx*8 - 0x1e08], eax
movss xmm0, dword [edx + 8]
xorps xmm0, xmm1
movss dword [ebp + ecx*8 - 0x1e04], xmm0
inc ecx
cmp ecx, 0x3c0
jl 0x432aa0
lea eax, [ebp - 0x3c08]
push eax
lea eax, [ebp - 0x1e08]
push eax
push dword [0x4c7784]
call fcn.00432cc0
movss xmm0, dword [ebp - 0x3c08]
lea ecx, [ebp - 0x1e18]
movss xmm1, dword [0x4982dc]
add esp, 0xc
mov eax, dword [ebp - 0x3c0c]
mov edx, 0x89
mulss xmm0, xmm1
movss dword [eax], xmm0
add eax, 0xc
nop
movss xmm0, dword [ecx + 8]
lea eax, [eax + 0x1c]
mulss xmm0, xmm1
lea ecx, [ecx - 0x38]
movss dword [eax - 0x24], xmm0
movss xmm0, dword [ecx + 0x38]
mulss xmm0, xmm1
movss dword [eax - 0x20], xmm0
movss xmm0, dword [ecx + 0x30]
mulss xmm0, xmm1
movss dword [eax - 0x1c], xmm0
movss xmm0, dword [ecx + 0x28]
mulss xmm0, xmm1
movss dword [eax - 0x18], xmm0
movss xmm0, dword [ecx + 0x20]
mulss xmm0, xmm1
movss dword [eax - 0x14], xmm0
movss xmm0, dword [ecx + 0x18]
mulss xmm0, xmm1
movss dword [eax - 0x10], xmm0
movss xmm0, dword [ecx + 0x10]
mulss xmm0, xmm1
movss dword [eax - 0xc], xmm0
sub edx, 1
jne 0x432b10
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464e2f
mov esp, ebp
pop ebp
ret
Function at 0x433120
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
sub esp, 8
cmp dword [ebp + 0xc], 1
jne 0x43318f
test edx, edx
jle 0x4332e5
mov ecx, dword [ebp + 8]
add ecx, 4
nop dword [eax]
mov eax, dword [ecx + 4]
movss xmm0, dword [ecx - 4]
mov dword [ebp - 8], eax
movss xmm2, dword [ebp - 8]
mov eax, dword [ecx + 8]
subss xmm0, xmm2
mov dword [ebp - 4], eax
movss xmm1, dword [ebp - 4]
movss dword [ecx + 4], xmm0
movss xmm0, dword [ecx]
subss xmm0, xmm1
movss dword [ecx + 8], xmm0
addss xmm2, dword [ecx - 4]
addss xmm1, dword [ecx]
movss dword [ecx - 4], xmm2
movss dword [ecx], xmm1
add ecx, 0x10
sub edx, 1
jne 0x433140
mov esp, ebp
pop ebp
ret
test edx, edx
jle 0x4332e5
mov ecx, dword [ebp + 8]
movss xmm4, dword [0x498210]
add ecx, 0x28
movss xmm3, dword [0x49826c]
nop dword [eax]
mov eax, dword [ecx - 8]
movss xmm0, dword [ecx - 0x28]
mov dword [ebp - 8], eax
subss xmm0, dword [ebp - 8]
mov eax, dword [ecx - 4]
mov dword [ebp - 4], eax
movss dword [ecx - 8], xmm0
movss xmm0, dword [ecx - 0x24]
subss xmm0, dword [ebp - 4]
movss dword [ecx - 4], xmm0
movss xmm0, dword [ecx - 0x28]
addss xmm0, dword [ebp - 8]
movss dword [ecx - 0x28], xmm0
movss xmm0, dword [ecx - 0x24]
addss xmm0, dword [ebp - 4]
movss dword [ecx - 0x24], xmm0
movss xmm2, dword [ecx + 4]
movss xmm0, dword [ecx - 0x20]
movaps xmm1, xmm2
addss xmm1, dword [ecx]
subss xmm2, dword [ecx]
mulss xmm1, xmm3
mulss xmm2, xmm3
subss xmm0, xmm1
movss dword [ecx], xmm0
movss xmm0, dword [ecx - 0x1c]
subss xmm0, xmm2
movss dword [ecx + 4], xmm0
addss xmm2, dword [ecx - 0x1c]
movss xmm0, dword [ecx - 0x20]
addss xmm0, xmm1
movss dword [ecx - 0x1c], xmm2
movss dword [ecx - 0x20], xmm0
movss xmm1, dword [ecx + 0xc]
movss xmm0, dword [ecx - 0x18]
movss xmm2, dword [ecx + 8]
subss xmm0, xmm1
xorps xmm2, xmm4
movss dword [ecx + 8], xmm0
movss xmm0, dword [ecx - 0x14]
subss xmm0, xmm2
movss dword [ecx + 0xc], xmm0
movss xmm0, dword [ecx - 0x18]
addss xmm0, xmm1
movss dword [ecx - 0x18], xmm0
movss xmm0, dword [ecx - 0x14]
addss xmm0, xmm2
movss dword [ecx - 0x14], xmm0
movss xmm2, dword [ecx + 0x14]
movss xmm0, dword [ecx - 0x10]
movaps xmm1, xmm2
subss xmm1, dword [ecx + 0x10]
addss xmm2, dword [ecx + 0x10]
mulss xmm1, xmm3
xorps xmm2, xmm4
mulss xmm2, xmm3
subss xmm0, xmm1
movss dword [ecx + 0x10], xmm0
movss xmm0, dword [ecx - 0xc]
subss xmm0, xmm2
movss dword [ecx + 0x14], xmm0
movss xmm0, dword [ecx - 0x10]
addss xmm2, dword [ecx - 0xc]
addss xmm0, xmm1
movss dword [ecx - 0xc], xmm2
movss dword [ecx - 0x10], xmm0
add ecx, 0x40
sub edx, 1
jne 0x4331b0
mov esp, ebp
pop ebp
ret
Function at 0x4367d0
Capabilities:
Enumerate files on windows
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1144
call fcn.00465040
mov eax, dword [0x4c07e0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x4c3d20], 0
jne 0x436988
cmp dword [ebp + 8], 0
jne 0x436998
push 0x4c3920
push 0
push str.showprofiles
push str.config
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
test eax, eax
jne 0x436998
push str.Default
push 8
push 0x4c3d20
call fcn.0046b5c5
push 0x1000
lea eax, [ebp - 0x1004]
push 0
push eax
call fcn.00466b60
push 0x4c3d20
push 0x4c3520
lea eax, [ebp - 0x1004]
push 0x4af058
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x28
lea eax, [ebp - 0x1004]
push eax
push 0
push str.valid
push str.profile
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
test eax, eax
jne 0x436988
push esi
push 0x4c3520
lea eax, [ebp - 0x1004]
push 0x4af06c
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x1144]
push eax
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x436987
nop dword [eax + eax]
lea eax, [ebp - 0x1118]
push eax
push 0x4c3520
lea eax, [ebp - 0x1004]
push 0x4920ac
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x1004]
push eax
push 0
push str.valid
push str.profile
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
test eax, eax
je 0x436936
cmp byte [ebp - 0x1118], 0
lea eax, [ebp - 0x1118]
je 0x436936
nop dword [eax]
inc eax
cmp byte [eax], 0
jne 0x436910
lea ecx, [ebp - 0x1118]
cmp eax, ecx
jbe 0x436936
cmp byte [eax], 0x2e
lea ecx, [ebp - 0x1118]
je 0x436932
dec eax
cmp eax, ecx
ja 0x436920
jmp 0x436936
cmp eax, ecx
ja 0x436964
lea eax, [ebp - 0x1144]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4368c0
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop esi
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464e2f
mov esp, ebp
pop ebp
ret
mov byte [eax], 0
lea eax, [ebp - 0x1118]
push 0x80
push eax
push 0x4c3d20
call fcn.00401ae0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop esi
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464e2f
mov esp, ebp
pop ebp
ret
push ebx
push 0x4c3920
push 0x80
push 0x4c3d20
push str.Default
push str.lastprofile
push str.config
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0
push 0x440120
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0x98
push dword [0x4c512c]
call dword [sym.imp.USER32.dll_DialogBoxParamA]
cmp byte [0x4c3d20], 0
mov ebx, eax
jne 0x4369fb
push str.Default
push 8
push 0x4c3d20
call fcn.0046b5c5
add esp, 0xc
push 0x4c3920
test bl, 2
mov ecx, 0x497430
mov eax, 0x4973ec
cmove eax, ecx
push eax
push str.showprofiles
push str.config
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push 0x4c3920
push 0x4c3d20
push str.lastprofile
push str.config
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov ecx, dword [ebp - 4]
not ebx
and ebx, 1
xor ecx, ebp
mov eax, ebx
pop ebx
call fcn.00464e2f
mov esp, ebp
pop ebp
ret