joyce8/EMBER2024-capa huggingface dataset:
Function at 0x474876
Capabilities:
Check if file exists

Disassembly:
push 0xb0
mov eax, 0x4c32cc
call fcn.00435efd
mov edi, dword [ebp + 8]
xor ebx, ebx
mov esi, dword [ebp + 0xc]
xor eax, eax
mov dword [ebp - 0xbc], ebx
mov dword [ebp - 0x44], 7
mov dword [ebp - 0x48], ebx
mov word [ebp - 0x58], ax
cmp dword [esi + 0x14], 8
mov dword [ebp - 4], ebx
jb 0x4748b0
mov eax, dword [esi]
jmp 0x4748b2
mov eax, esi
push eax
lea eax, [ebp - 0xa0]
push eax
call fcn.004746f3
pop ecx
pop ecx
cmp dword [esi + 0x14], 8
mov byte [ebp - 4], 1
jb 0x4748cd
mov esi, dword [esi]
lea eax, [ebp - 0x40]
push esi
push eax
call fcn.0047457b
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 2
cmovae eax, dword [ebp - 0x40]
push eax
lea eax, [ebp - 0x88]
push eax
call fcn.0047438f
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 3
cmovae eax, dword [ebp - 0x40]
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.0047448c
add esp, 0x18
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x28], ax
xor esi, esi
mov byte [ebp - 4], 5
inc esi
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0xa0]
push eax
lea ecx, [ebp - 0x28]
call fcn.004023ea
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x88]
push eax
lea ecx, [ebp - 0x28]
call fcn.00427288
push 0x4d5100
call fcn.0047e053
pop ecx
push eax
push 0x4d5100
lea ecx, [ebp - 0x28]
call fcn.00427327
mov eax, esi
cdq
push edx
push eax
lea eax, [ebp - 0xb8]
push eax
call fcn.00475e87
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 6
call fcn.00427288
push ebx
push 1
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 5
call fcn.00402353
push 0x4d5104
call fcn.0047e053
pop ecx
push eax
push 0x4d5104
lea ecx, [ebp - 0x28]
call fcn.00427327
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x28]
call fcn.00427288
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4749e9
inc esi
cmp esi, 0x3e8
jl 0x474926
lea eax, [ebp - 0x58]
jmp 0x4749ec
lea eax, [ebp - 0x28]
push eax
mov ecx, edi
call fcn.00427449
xor esi, esi
lea ecx, [ebp - 0x28]
push ebx
inc esi
push esi
call fcn.00402353
push ebx
push esi
lea ecx, [ebp - 0x70]
call fcn.00402353
push ebx
push esi
lea ecx, [ebp - 0x88]
call fcn.00402353
push ebx
push esi
lea ecx, [ebp - 0x40]
call fcn.00402353
push ebx
push esi
lea ecx, [ebp - 0xa0]
call fcn.00402353
push ebx
push esi
lea ecx, [ebp - 0x58]
call fcn.00402353
mov eax, edi
call fcn.00435ea7
ret
Function at 0x4762d8
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.0047e053
mov dword [ebp - 8], eax
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0043688a
push dword [ebp + 8]
mov dword [ebp - 4], eax
push eax
call fcn.0047e031
add esp, 0x10
call fcn.004782ee
test al, al
je 0x47632f
push eax
pop edx
pop edi
pop edi
push ebp
pop ecx
push ecx
push edi
push esp
push edi
push esi
push ebp
pop esi
pop ecx
pop esp
push esi
pop esp
push ecx
push esp
push eax
pop ecx
pop ecx
call fcn.004783bd
test al, al
je 0x476354
pop ebx
push ecx
pop edx
push ebp
push edx
pop edi
pop edi
pop esp
push ebp
pop esi
pop edx
pop ebp
pop esi
pop edx
push edi
pop ebp
push ebp
push edi
push ebp
pop edx
push ebp
push esi
pop esi
pop esi
pop ebp
push edx
push ebp
pop esp
call fcn.004782ee
test al, al
je 0x476374
pop esi
push ebp
pop edx
pop edx
push ebp
push edi
pop eax
push ebp
pop edx
pop ecx
pop esp
push esp
pop edi
push esp
pop edx
push ebp
push esi
push edi
push edi
pop ebx
pop ebp
pop ebx
push esp
mov edi, dword [ebp - 8]
xor esi, esi
xor ebx, ebx
inc esi
test edi, edi
js 0x4763e9
mov esi, dword [ebp - 4]
cmp word [esi + ebx*2], 0x5c
jne 0x4763e1
call fcn.0047821f
test al, al
je 0x4763b6
push edi
pop ecx
push esi
push ebx
push edi
push ebp
push ebp
push esp
pop eax
pop edi
pop ecx
pop ebp
pop ecx
pop esp
push esi
pop eax
pop ebp
push ebp
push ebp
push eax
pop edi
push edx
push eax
push eax
pop ebp
push ebx
pop edx
push ebp
pop esi
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
movzx eax, word [esi + ebx*2]
mov dword [ebp - 0xc], eax
xor eax, eax
push esi
mov word [esi + ebx*2], ax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4763da
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x4763fb
mov eax, dword [ebp - 0xc]
mov word [esi + ebx*2], ax
inc ebx
cmp ebx, edi
jle 0x476383
xor esi, esi
inc esi
push dword [ebp - 4]
call fcn.00435fa5
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor esi, esi
jmp 0x4763e9

Function at 0x4763ff
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4f230c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push esi
push edi
xor esi, esi
push 0x208
push esi
push eax
mov dword [ebp - 0x210], esi
call fcn.0047a540
add esp, 0xc
lea eax, [ebp - 0x20c]
push esi
push 0x1a
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
call fcn.0047821f
test al, al
je 0x47646c
push edi
pop ecx
push esi
push ebx
push edi
push ebp
push ebp
push esp
pop eax
pop edi
pop ecx
pop ebp
pop ecx
pop esp
push esi
pop eax
pop ebp
push ebp
push ebp
push eax
pop edi
push edx
push eax
push eax
pop ebp
push ebx
pop edx
push ebp
pop esi
lea eax, [ebp - 0x20c]
mov ecx, ebx
push eax
call fcn.00401e2f
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00435e81
mov esp, ebp
pop ebp
ret
Function at 0x476583
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4f230c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x210], eax
push 0x208
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x214], esi
push esi
push eax
call fcn.0047a540
add esp, 0xc
lea eax, [ebp - 0x20c]
push esi
push 0x26
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
call fcn.00478195
test al, al
je 0x4765f0
push esi
push edx
push edx
push ecx
pop eax
push ebp
push esp
pop edx
pop edi
push eax
push edx
pop ecx
pop ecx
push edi
push ebx
pop edx
pop esi
push esi
push edi
pop edx
pop eax
push eax
push eax
call fcn.004781da
test al, al
je 0x476610
pop esi
push ebp
pop ebx
push ecx
pop esp
pop ebx
push esi
push ecx
pop ebp
pop esi
pop edi
pop ebp
push esp
pop esi
pop edx
push ebp
push esp
push ecx
pop edx
pop esi
pop esp
pop eax
pop ebx
call fcn.004785a0
test al, al
je 0x47662c
pop esi
push eax
pop edx
pop esp
push edi
push ebp
push eax
push esp
pop edx
push esp
pop esi
pop esi
pop ebp
pop ebx
pop eax
pop eax
pop edi
pop ebx
push esi
mov ecx, dword [ebp - 0x210]
lea eax, [ebp - 0x20c]
push eax
call fcn.00401e2f
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x210]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00435e81
mov esp, ebp
pop ebp
ret

Function at 0x476655
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4f230c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
and dword [ebp - 0x214], 0
push ebx
push esi
push edi
push 0x208
mov dword [ebp - 0x210], eax
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0047a540
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call fcn.00478195
test al, al
je 0x4766c3
push esi
push edx
push edx
push ecx
pop eax
push ebp
push esp
pop edx
pop edi
push eax
push edx
pop ecx
pop ecx
push edi
push ebx
pop edx
pop esi
push esi
push edi
pop edx
pop eax
push eax
push eax
call fcn.004781da
test al, al
je 0x4766e3
pop esi
push ebp
pop ebx
push ecx
pop esp
pop ebx
push esi
push ecx
pop ebp
pop esi
pop edi
pop ebp
push esp
pop esi
pop edx
push ebp
push esp
push ecx
pop edx
pop esi
pop esp
pop eax
pop ebx
call fcn.004785a0
test al, al
je 0x4766ff
pop esi
push eax
pop edx
pop esp
push edi
push ebp
push eax
push esp
pop edx
push esp
pop esi
pop esi
pop ebp
pop ebx
pop eax
pop eax
pop edi
pop ebx
push esi
mov ecx, dword [ebp - 0x210]
lea eax, [ebp - 0x20c]
push eax
call fcn.00401e2f
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x210]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00435e81
mov esp, ebp
pop ebp
ret
Function at 0x476728
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0x4f230c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
mov dword [ebp - 0x210], esi
call fcn.0047e053
pop ecx
test eax, eax
je 0x476877
call fcn.004785e5
test al, al
je 0x476774
pop edx
pop eax
pop eax
push ebp
push edx
pop ebx
push esi
pop ecx
push esp
push eax
push esp
pop ebp
push ebx
pop ebp
pop ecx
pop ebp
push eax
pop edx
push ebx
pop ebp
push ebp
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x200]
push str.Program_FilesInternet_Exploreriexplore.exe
push eax
call fcn.0047e031
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00481b0b
push 0x3c
lea eax, [ebp - 0x24c]
push 0
push eax
call fcn.0047a540
add esp, 0x1c
mov dword [ebp - 0x240], str.open
mov dword [ebp - 0x248], 0x200
mov dword [ebp - 0x238], esi
mov dword [ebp - 0x230], 1
call fcn.00478150
test al, al
je 0x476801
push esi
push ebp
push edi
push ebx
pop edx
push esi
pop ebp
pop edx
pop edx
pop ebp
push ecx
pop esp
push esp
pop ecx
pop eax
push edx
push edx
pop ebp
pop ebp
pop ebx
push ebx
pop edx
push eax
pop ecx
push eax
push esp
push ebp
push ecx
pop esp
call fcn.004786f9
test al, al
je 0x47682e
push edi
pop esi
pop ebp
pop esp
pop eax
pop ecx
push esi
pop esp
push ebp
push esp
push esp
pop edi
push esi
push ebp
pop ebx
push ecx
push eax
pop edx
pop edx
pop esi
push esp
push eax
push edx
push esi
pop ebp
push esp
push ebx
push ebx
push edi
push esi
mov esi, dword [ebp - 0x210]
call fcn.0047803c
test al, al
je 0x476849
pop edx
pop esp
pop edi
push edx
pop esp
push esi
push ebp
pop esp
pop eax
push eax
pop eax
pop ecx
pop ebp
pop ebp
pop eax
push edx
pop ebx
pop esp
push 1
xor ebx, ebx
push ebx
push ebx
push esi
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x476874
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x20c]
push ebx
push ecx
call fcn.00475fce
add esp, 0x14
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00435e81
mov esp, ebp
pop ebp
ret
Function at 0x478ab9
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4f230c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0047a540
push 0x4c5c48
lea eax, [ebp - 0x20c]
push str.C:log_s.log
push eax
call fcn.00427ad1
add esp, 0x18
call fcn.004785e5
test al, al
je 0x478b1e
push edi
pop esp
push esp
pop edi
push esi
pop edx
push ecx
pop edx
push esi
pop edx
push esi
push eax
push esp
pop ebx
pop ebp
push ebx
pop ebx
push edx
push esp
pop ebp
push ebp
push edi
push ebp
pop esi
push ebx
pop ebx
call fcn.00478516
test al, al
je 0x478b38
pop ebp
push esi
pop eax
pop esp
push ecx
pop ebp
push ebx
pop ebp
pop ecx
pop edi
push edi
pop ecx
push ecx
pop eax
pop ebx
push esp
pop edx
call fcn.0047821f
test al, al
je 0x478b53
pop ecx
push esp
pop ebp
push esi
pop esp
pop eax
pop edi
push ebp
push esp
pop edi
push ecx
pop ecx
push edx
push ecx
pop ecx
push eax
push esp
push ecx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [ebp - 4]
neg eax
pop edi
sbb eax, eax
xor ecx, ebp
pop esi
neg eax
pop ebx
call fcn.00435e81
mov esp, ebp
pop ebp
ret
Function at 0x48e2ae
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0048df6e

Function at 0x4a5f80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0
push ebx
mov ebx, dword [ebp + 0x14]
mov eax, dword [ebx - 4]
jle 0x4a5fea
mov ecx, dword [ebp + 8]
sub ecx, ebx
push esi
mov dword [ebp + 8], ecx
push edi
nop word [eax + eax]
mov esi, dword [ecx + ebx]
lea ebx, [ebx + 4]
mov ecx, eax
mov edi, esi
and edi, 0xffff00ff
and ecx, 0xffff00ff
add edi, ecx
mov edx, esi
movzx ecx, ax
and edx, 0xff00
add edx, ecx
and eax, 0xff00ffff
mov ecx, dword [ebp + 8]
xor edi, edx
and esi, 0xff00ff00
and edi, 0xff00ff
add eax, esi
xor eax, edi
sub dword [ebp + 0x10], 1
mov dword [ebx - 4], eax
jne 0x4a5fa0
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4a5ff0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0
jle 0x4a6063
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
sub ecx, eax
sub dword [ebp + 0x14], eax
push ebx
push esi
mov dword [ebp + 0xc], ecx
push edi
nop word [eax + eax]
mov ebx, dword [ecx + eax]
lea eax, [eax + 4]
mov esi, dword [eax - 4]
mov ecx, ebx
and ecx, 0xffff00ff
mov edi, esi
and edi, 0xffff00ff
mov edx, esi
add edi, ecx
and edx, 0xff00
movzx ecx, bx
and esi, 0xff00ff00
add edx, ecx
and ebx, 0xff00ffff
mov ecx, dword [ebp + 0x14]
xor edi, edx
and edi, 0xff00ff
add ebx, esi
xor edi, ebx
sub dword [ebp + 0x10], 1
mov dword [ecx + eax - 4], edi
mov ecx, dword [ebp + 0xc]
jne 0x4a6010
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4a6860
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor ecx, ecx
push ebx
mov ebx, dword [ebp + 8]
push edi
mov dword [ebp + 8], 0
lea eax, [ebx + eax*4]
mov edi, eax
sub edi, ebx
add edi, 3
shr edi, 2
cmp ebx, eax
cmova edi, ecx
test edi, edi
je 0x4a68d4
push esi
mov esi, dword [ebp + 0x10]
nop
mov edx, dword [ebx]
lea esi, [esi + 2]
mov ecx, edx
lea ebx, [ebx + 4]
shr ecx, 0x10
mov eax, edx
shr eax, 0xd
xor cl, al
mov eax, edx
and cl, 7
shr eax, 0x10
xor cl, al
mov eax, edx
mov byte [esi - 2], cl
mov ecx, edx
shr ecx, 5
shr eax, 3
xor cl, al
shr edx, 5
mov eax, dword [ebp + 8]
and cl, 0x1f
xor cl, dl
inc eax
mov byte [esi - 1], cl
mov dword [ebp + 8], eax
cmp eax, edi
jb 0x4a6890
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4a68e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor ecx, ecx
push ebx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp + 8], 0
lea eax, [edi + eax*4]
mov ebx, eax
sub ebx, edi
add ebx, 3
shr ebx, 2
cmp edi, eax
cmova ebx, ecx
test ebx, ebx
je 0x4a694b
push esi
mov esi, dword [ebp + 0x10]
nop
mov edx, dword [edi]
lea esi, [esi + 2]
mov ecx, edx
lea edi, [edi + 4]
shr ecx, 0x10
mov eax, edx
shr eax, 0xc
xor cl, al
mov eax, edx
shr eax, 0x10
and cl, 0xf
xor cl, al
mov eax, edx
shr eax, 0x1c
xor al, dl
mov byte [esi - 2], cl
and al, 0xf
xor al, dl
mov byte [esi - 1], al
mov eax, dword [ebp + 8]
inc eax
mov dword [ebp + 8], eax
cmp eax, ebx
jb 0x4a6910
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x406b50
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x2c
mov al, byte [0xb15a18]
mov dword [esp + 0x14], ecx
push ebx
push ebp
push esi
push edi
test al, al
jne 0x406b8d
mov eax, dword [ecx]
push ecx
mov ecx, dword [eax*4 + 0x471960]
call fcn.00454240
add esp, 4
test al, al
je 0x406ccf
mov byte [0xb15a18], 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
cmp al, 1
jne 0x406ccf
push ecx
mov ecx, 0x4708d0
call fcn.00454240
add esp, 4
lea ecx, [esp + 0x18]
call fcn.00402540
mov ebp, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
cmp ebp, 0xfbd3e27f
jne 0x406bc4
cmp ebx, 0x7fffffff
je 0x406be1
cmp ebx, 0x7fffffff
jg 0x406be1
jl 0x406bd6
cmp ebp, 0xfbd3e27f
jae 0x406be1
add ebp, 0x42c1d80
adc ebx, 0
jmp 0x406be9
or ebp, 0xffffffff
mov ebx, Ordinal_2
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
lea ecx, [esp + 0x28]
call fcn.00402540
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
cmp ebp, ecx
jne 0x406c0e
cmp ebx, eax
je 0x406ca1
cmp ebx, eax
jl 0x406ca1
jg 0x406c20
cmp ebp, ecx
jb 0x406ca1
mov edi, ebp
mov esi, ebx
sub edi, ecx
sbb esi, eax
cmp edi, 0x914f0000
jne 0x406c38
cmp esi, 0x4e94
je 0x406c92
cmp esi, 0x4e94
jg 0x406c92
jl 0x406c4a
cmp edi, 0x914f0000
jae 0x406c92
push 0
push 0xf4240
push esi
push edi
call fcn.0046c350
push 0
push 0xf4240
mov ebp, edx
mov ebx, eax
push ebp
push ebx
call fcn.0046c4e0
cmp eax, edi
jne 0x406c72
cmp edx, esi
je 0x406c7f
cmp edx, esi
jg 0x406c7f
jl 0x406c7c
cmp eax, edi
jae 0x406c7f
add ebx, 1
push ebx
call sub.KERNEL32.dll_Sleep
mov ebx, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
jmp 0x406bf1
push 0x5265c00
call sub.KERNEL32.dll_Sleep
jmp 0x406bf1
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov esi, 0x4716c0
mov ebx, dword [esp + 0x24]
push dword [esi]
call edi
test ax, ax
je 0x406cc4
mov eax, dword [esi]
mov dword [ebx], eax
mov byte [0xb15a18], 0
add esi, 4
cmp esi, 0x471958
jne 0x406cb0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
Function at 0x406ce0
Capabilities:
Execute command

Disassembly:
sub esp, 0x28
push esi
mov esi, dword [0xb15720]
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x18], 0x15
movups xmm0, xmmword [esi + 0x39b4]
lea ecx, [esi + 0x4758]
movups xmmword [esp + 0x1c], xmm0
call fcn.0043db20
mov dword [esi + 0x39b4], 0
lea eax, [esp + 0x14]
mov dword [esi + 0x39b8], 0
mov dword [esi + 0x39bc], 0
mov dword [esi + 0x39c0], 0
mov esi, dword [0xb15720]
push eax
mov dword [esp + 0x18], 0x16
movups xmm0, xmmword [esi + 0x39c4]
lea ecx, [esi + 0x4758]
movups xmmword [esp + 0x1c], xmm0
call fcn.0043db20
mov dword [esi + 0x39c4], 0x3e7ced91
lea eax, [esp + 0x14]
mov dword [esi + 0x39c8], 0x3c83126f
mov dword [esi + 0x39cc], 0x3f39999a
mov dword [esi + 0x39d0], 0x3f598b89
mov esi, dword [0xb15720]
push eax
mov dword [esp + 0x18], 0x17
movups xmm0, xmmword [esi + 0x39d4]
lea ecx, [esi + 0x4758]
movups xmmword [esp + 0x1c], xmm0
call fcn.0043db20
mov dword [esi + 0x39d4], 0
lea eax, [esp + 0x14]
mov dword [esi + 0x39d8], 0
mov dword [esi + 0x39dc], 0
mov dword [esi + 0x39e0], 0
mov esi, dword [0xb15720]
push eax
mov dword [esp + 0x18], 5
movups xmm0, xmmword [esi + 0x38b4]
lea ecx, [esi + 0x4758]
movups xmmword [esp + 0x1c], xmm0
call fcn.0043db20
mov dword [esi + 0x38b4], 0
lea eax, [esp + 0x14]
mov dword [esi + 0x38b8], 0
mov dword [esi + 0x38bc], 0
mov dword [esi + 0x38c0], 0
mov esi, dword [0xb15720]
push eax
mov dword [esp + 0x18], 6
movups xmm0, xmmword [esi + 0x38c4]
lea ecx, [esi + 0x4758]
movups xmmword [esp + 0x1c], xmm0
call fcn.0043db20
mov dword [esi + 0x38c4], 0
lea eax, [esp + 0x14]
mov dword [esi + 0x38c8], 0
mov dword [esi + 0x38cc], 0
mov dword [esi + 0x38d0], 0
mov esi, dword [0xb15720]
push eax
mov dword [esp + 0x18], 0
movups xmm0, xmmword [esi + 0x3864]
lea ecx, [esi + 0x4758]
movups xmmword [esp + 0x1c], xmm0
call fcn.0043db20
mov dword [esi + 0x3864], 0x3f760419
mov dword [esi + 0x3868], 0x3ea4dd2f
mov dword [esi + 0x386c], 0x3e6872b0
mov dword [esi + 0x3870], 0x3f800000
mov esi, dword [0xb15720]
push 0
push 0
push 0x4708e8
mov eax, dword [esi + 0x3e48]
push ecx
movss xmm0, dword [eax + 0x1c]
movss dword [esp + 0x14], xmm0
movss xmm3, dword [0xa8c5c8]
lea eax, [esp + 0x1c]
movss xmm2, dword [esi + 0x3bb8]
mov ecx, dword [esi + 0x3bb4]
mov dword [esp], 0xbf800000
push eax
call fcn.0044d630
mov eax, dword [esi + 0x3e48]
lea edx, [esp + 4]
movss xmm0, dword [esp + 0xc]
addss xmm0, dword [0xa8c470]
movss xmm1, dword [esp + 4]
mov byte [eax + 0xac], 1
mov ecx, dword [esi + 0x3e48]
push ecx
cvttss2si eax, xmm0
mov dword [esp + 8], 0
mov byte [ecx + 0x131], 1
mov dword [esp + 0xc], 0
movd xmm0, eax
cvtdq2ps xmm0, xmm0
subss xmm1, xmm0
movss xmm0, dword [ecx + 0x14]
subss xmm0, dword [ecx + 0x78]
mulss xmm1, dword [0xa8c438]
addss xmm1, xmm0
movss dword [ecx + 0xf0], xmm1
mov ecx, str.Discord
call fcn.00454240
add esp, 4
test al, al
je 0x406fb3
mov esi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
push str.start_https:__discord.gg_Sjs7juRCem
call esi
add esp, 4
push str.start_https:__www.youtube.com__Forbidden453_videos
call esi
add esp, 4
mov ecx, 4
pop esi
add esp, 0x28
jmp fcn.00427ba0
Function at 0x406fd0
Capabilities:
Execute command

Disassembly:
sub esp, 0x28
push esi
mov esi, dword [0xb15720]
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x18], 0x15
movups xmm0, xmmword [esi + 0x39b4]
lea ecx, [esi + 0x4758]
movups xmmword [esp + 0x1c], xmm0
call fcn.0043db20
mov dword [esi + 0x39b4], 0
lea eax, [esp + 0x14]
mov dword [esi + 0x39b8], 0
mov dword [esi + 0x39bc], 0
mov dword [esi + 0x39c0], 0
mov esi, dword [0xb15720]
push eax
mov dword [esp + 0x18], 0x16
movups xmm0, xmmword [esi + 0x39c4]
lea ecx, [esi + 0x4758]
movups xmmword [esp + 0x1c], xmm0
call fcn.0043db20
mov dword [esi + 0x39c4], 0x3edf0952
lea eax, [esp + 0x14]
mov dword [esi + 0x39c8], 0
mov dword [esi + 0x39cc], 0x3c455662
mov dword [esi + 0x39d0], 0x3f598b89
mov esi, dword [0xb15720]
push eax
mov dword [esp + 0x18], 0x17
movups xmm0, xmmword [esi + 0x39d4]
lea ecx, [esi + 0x4758]
movups xmmword [esp + 0x1c], xmm0
call fcn.0043db20
mov dword [esi + 0x39d4], 0
lea eax, [esp + 0x14]
mov dword [esi + 0x39d8], 0
mov dword [esi + 0x39dc], 0
mov dword [esi + 0x39e0], 0
mov esi, dword [0xb15720]
push eax
mov dword [esp + 0x18], 5
movups xmm0, xmmword [esi + 0x38b4]
lea ecx, [esi + 0x4758]
movups xmmword [esp + 0x1c], xmm0
call fcn.0043db20
mov dword [esi + 0x38b4], 0
lea eax, [esp + 0x14]
mov dword [esi + 0x38b8], 0
mov dword [esi + 0x38bc], 0
mov dword [esi + 0x38c0], 0
mov esi, dword [0xb15720]
push eax
mov dword [esp + 0x18], 6
movups xmm0, xmmword [esi + 0x38c4]
lea ecx, [esi + 0x4758]
movups xmmword [esp + 0x1c], xmm0
call fcn.0043db20
mov dword [esi + 0x38c4], 0
lea eax, [esp + 0x14]
mov dword [esi + 0x38c8], 0
mov dword [esi + 0x38cc], 0
mov dword [esi + 0x38d0], 0
mov esi, dword [0xb15720]
push eax
mov dword [esp + 0x18], 0
movups xmm0, xmmword [esi + 0x3864]
lea ecx, [esi + 0x4758]
movups xmmword [esp + 0x1c], xmm0
call fcn.0043db20
mov dword [esi + 0x3864], 0x3f760419
mov dword [esi + 0x3868], 0x3ea4dd2f
mov dword [esi + 0x386c], 0x3e6872b0
mov dword [esi + 0x3870], 0x3f800000
mov esi, dword [0xb15720]
push 0
push 0
push 0x4708e8
mov eax, dword [esi + 0x3e48]
push ecx
movss xmm0, dword [eax + 0x1c]
movss dword [esp + 0x14], xmm0
movss xmm3, dword [0xa8c5c8]
lea eax, [esp + 0x1c]
movss xmm2, dword [esi + 0x3bb8]
mov ecx, dword [esi + 0x3bb4]
mov dword [esp], 0xbf800000
push eax
call fcn.0044d630
mov eax, dword [esi + 0x3e48]
lea edx, [esp + 4]
movss xmm0, dword [esp + 0xc]
addss xmm0, dword [0xa8c470]
movss xmm1, dword [esp + 4]
mov byte [eax + 0xac], 1
mov ecx, dword [esi + 0x3e48]
push ecx
cvttss2si eax, xmm0
mov dword [esp + 8], 0
mov byte [ecx + 0x131], 1
mov dword [esp + 0xc], 0
movd xmm0, eax
cvtdq2ps xmm0, xmm0
subss xmm1, xmm0
movss xmm0, dword [ecx + 0x14]
subss xmm0, dword [ecx + 0x78]
mulss xmm1, dword [0xa8c438]
addss xmm1, xmm0
movss dword [ecx + 0xf0], xmm1
mov ecx, str.Discord
call fcn.00454240
add esp, 4
test al, al
je 0x4072a3
mov esi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
push str.start_https:__discord.gg_Sjs7juRCem
call esi
add esp, 4
push str.start_https:__www.youtube.com__Forbidden453_videos
call esi
add esp, 4
mov ecx, 4
pop esi
add esp, 0x28
jmp fcn.00427ba0