joyce8/EMBER2024-capa huggingface dataset:
Function at 0x581cbe
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x6b8c10]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x204]
add ecx, 0x21600
push eax
mov esi, edx
call fcn.0058bf90
cmp esi, 8
ja case.default.0x581c51
jmp dword [esi*4 + 0x581ce8]
lea eax, [ebp - 0x404]
push str.http:__WarZombie.com.br_
push eax
call fcn.0057de50
add esp, 8
lea eax, [ebp - 0x404]
push 5
push 0
push 0x67a7bc
push eax
jmp 0x581ccc
push 5
push 0
push 0x67a7bc
push str.https:__www.facebook.com_groups_WarZombie_
jmp 0x581ccc
push 5
push 0
push 0x67a7bc
push str.https:__www.youtube.com_
jmp 0x581ccc
push 5
push 0
push 0x67a7bc
push str.https:__discord.gg_tNaASyFKdX
jmp 0x581ccc
push 5
push 0
push 0x67a7bc
push 0x67a51c
jmp 0x581ccc
push 5
push 0
push 0x67a7bc
push str.http:__WarZombie.com.br_
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.005b2af3
mov esp, ebp
pop ebp
ret
Function at 0x582510
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d14c8
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x6b8c10]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x21d68], 2
jne 0x5825bc
lea esi, [edi + 0x21d50]
push esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 0
cmp dword [edi + 0x21d94], 0
je 0x58259a
cmp byte [0x6baeec], 0
je 0x58259a
cmp dword [edi + 0x21d98], 0x10
lea eax, [edi + 0x21d84]
mov byte [0x6baeec], 0
jb 0x582583
mov eax, dword [eax]
push 5
push 0
push 0x67a7bc
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
movss xmm1, dword [0x67c8ac]
lea ecx, [edi + 0x21d44]
movss xmm0, dword [0x67c8b0]
call fcn.005822a0
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x582d70
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0
lea eax, [ebp - 4]
mov esi, ecx
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareArktos_Entertainment_GroupWarZ
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x582da5
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, esi
lea edx, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x582db0
sub ecx, edx
lea eax, [ecx + 1]
push eax
push esi
push 1
push 0
push str.LoginToken
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x582d9e
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x582df0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d14fb
mov eax, dword fs:[0]
push eax
sub esp, 0xc14
mov eax, dword [0x6b8c10]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x20d70], 0
je 0x582e47
xor ecx, ecx
call fcn.0057d1c0
cmp eax, 1
jne 0x582ffa
mov ecx, eax
call fcn.0057d1c0
cmp eax, 1
jne 0x582ffa
push str.Starting_game_n
call fcn.0058e160
inc dword [0x6bfb40]
add esp, 4
push 6
push 0
mov dword [ebp - 4], 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
lea eax, [ebp - 0xc1c]
push eax
lea eax, [ebp - 0xc18]
push eax
push str.GameClient.exe
call fcn.0058e9b0
add esp, 0xc
test al, al
jne 0x582e99
push str.failed1_n
call fcn.0058e160
add esp, 4
jmp 0x582eb2
push dword [ebp - 0xc1c]
push dword [ebp - 0xc18]
push str._08x__d_n
call fcn.0058e160
add esp, 0xc
lea eax, [ebp - 0x410]
push eax
lea ecx, [esi + 0x21600]
call fcn.0058bf90
lea ecx, [ebp - 0x410]
call fcn.00582d70
test al, al
je 0x582efd
push 0xffffffffffffffff
call fcn.0059fad0
add esp, 4
push eax
push 0xffffffffffffffff
call fcn.0059fad0
add esp, 4
push eax
lea eax, [ebp - 0x410]
push str._08X_08X
push eax
call fcn.0057de50
add esp, 0x10
lea eax, [ebp - 0x410]
push eax
push 0x6bf588
lea eax, [ebp - 0xc10]
push str._WOUpdatedOk__s__WOLogin___s_
push eax
call fcn.00583c50
add esp, 0x10
cmp dword [esi + 0x21dac], 0
jbe 0x582f6d
lea ecx, [ebp - 0xc10]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x582f30
sub ecx, edx
lea eax, [ebp - 0xc10]
add eax, ecx
cmp dword [esi + 0x21db0], 0x10
mov dword [ebp - 0xc14], eax
lea eax, [esi + 0x21d9c]
jb 0x582f58
mov eax, dword [eax]
push eax
lea eax, [ebp - 0xc14]
push str.__survey___s_
push eax
call fcn.00583c90
add esp, 0xc
cmp dword [0x76620c], 0
jl 0x582fbb
jg 0x582f81
cmp dword [0x766208], 0
jbe 0x582fbb
lea ecx, [ebp - 0xc10]
lea edx, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x582f90
sub ecx, edx
lea eax, [ebp - 0xc10]
add eax, ecx
mov dword [ebp - 0xc14], eax
lea eax, [ebp - 0xc14]
push str.__steam
push eax
call fcn.00583c90
add esp, 8
push 5
push 0
lea eax, [ebp - 0xc10]
push eax
push str.GameClient.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jge 0x582feb
push eax
push str.failed:__d_n
call fcn.0058e160
add esp, 8
mov eax, dword [0x6bfb40]
test eax, eax
je 0x582ffa
dec eax
mov dword [0x6bfb40], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005b2af3
mov esp, ebp
pop ebp
ret
Function at 0x584270
Capabilities:
Set console window title

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x6b8c10]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
call fcn.00589eb0
call fcn.0058e570
call fcn.0058dbb0
call fcn.0058e570
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esi + 0x20d8c], 3
jne 0x5842b7
mov dword [esi + 0x20d8c], 5
cmp dword [esi + 0x20d90], 0
jne 0x584361
mov edi, dword [esi + 0x21598]
mov eax, edi
mov ebx, dword [esi + 0x2159c]
or eax, ebx
jne 0x5842db
xorps xmm1, xmm1
jmp 0x584321
mov edx, dword [esi + 0x215a4]
mov ecx, dword [esi + 0x215a0]
call fcn.005bad2d
cvtsd2ss xmm0, xmm0
mov edx, ebx
mov ecx, edi
movss dword [ebp - 0x20c], xmm0
call fcn.005bad2d
movss xmm1, dword [ebp - 0x20c]
cvtsd2ss xmm0, xmm0
divss xmm1, xmm0
movss xmm0, dword [0x67c88c]
comiss xmm1, xmm0
jbe 0x584321
movaps xmm1, xmm0
mulss xmm1, dword [0x67c8a8]
lea eax, [esi + 0x20d95]
sub esp, 8
cvtps2pd xmm0, xmm1
movsd qword [esp], xmm0
push eax
lea eax, [ebp - 0x208]
push str._s:__.1f__
push eax
call fcn.00583c70
add esp, 0x14
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
jmp 0x584292
mov ecx, esi
call fcn.00589f70
mov eax, dword [esi + 0x20d90]
dec eax
je 0x5843a5
dec eax
je 0x58438f
dec eax
je 0x5843b2
push 0
push 0x3a
push str.Main_CmdLine.cpp
push 0x67a744
call fcn.0058e630
add esp, 0x10
jmp 0x5843b2
lea eax, [esi + 0x21195]
push eax
push str.Update_error_n_s_n_nPlease_retry_later
call fcn.0058e160
add esp, 8
jmp 0x5843b2
push str.Update_ok_n
call fcn.0058e160
add esp, 4
push str._nPress_enter_to_exit...
call fcn.0058e160
add esp, 4
call fcn.005b4962
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005b2af3
mov esp, ebp
pop ebp
ret
Function at 0x584a70
Capabilities:
Copy file
Create process on windows
Delete file
Move file
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60c
mov eax, dword [0x6b8c10]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x108]
push str..new.exe
push eax
call fcn.005b3f80
add esp, 8
test eax, eax
jne 0x584ae7
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push str._s.new.exe
push eax
call fcn.0057de30
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005b2af3
mov esp, ebp
pop ebp
ret
push edi
push str..exe_updated__moving_back_n
mov byte [0x764be2], 1
call fcn.0058e160
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 4
push 0x1f4
call edi
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.005b3397
lea ecx, [ebp - 0x108]
add esp, 0xc
lea edx, [ecx + 1]
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x584b30
sub ecx, edx
cmp ecx, 8
ja 0x584b54
push 0
push 0x31
push str.SelfUpdateEXE.cpp
push str.strlen_exeMain____8
call fcn.0058e630
add esp, 0x10
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x584b60
sub ecx, edx
add ecx, 0xfffffff8
cmp ecx, 0x104
jae 0x584c71
push ebx
mov byte [ebp + ecx - 0x108], al
lea eax, [ebp - 0x108]
push esi
push eax
push str.exeMain:__s_n
call fcn.0058e160
mov ebx, dword [sym.imp.KERNEL32.dll_CopyFileA]
add esp, 8
xor esi, esi
lea ecx, [ecx]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x584c5e
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
call ebx
test eax, eax
jne 0x584c5e
push 0x64
call edi
inc esi
cmp esi, 0xa
jl 0x584ba0
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x60c]
push str.Failed_to_replace_updater_file_n_nPlease_manually_rename__s_to__s
push eax
call fcn.0057de50
add esp, 0x10
lea eax, [ebp - 0x60c]
push 0x30
push str.Updater
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 5
push 0
push 0
push 0x67a760
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
pop ebx
xor al, al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005b2af3
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop esi
pop ebx
xor ecx, ebp
pop edi
call fcn.005b2af3
mov esp, ebp
pop ebp
ret
call fcn.005b45a7
int3
Function at 0x584c80
Capabilities:
Create process on windows
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x6b8c10]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x104
lea eax, [ebp - 0x20c]
mov edi, edx
push eax
push 0
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push str.Trying_to_update_n
call fcn.0058e160
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push str._s.new.exe
push eax
call fcn.0057de30
lea eax, [ebp - 0x108]
push 0x67a34c
push eax
call fcn.005b3f18
mov esi, eax
add esp, 0x18
test esi, esi
jne 0x584cfe
lea eax, [ebp - 0x108]
push eax
push str.cant_open__s_for_writing_n
call fcn.0058dd80
add esp, 8
push esi
push 1
push edi
push ebx
call fcn.005b4ae2
push esi
call fcn.005b3095
add esp, 0x14
push dword [0x764ca0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x108]
push eax
push str.executing__s_n
call fcn.0058e160
add esp, 8
lea eax, [ebp - 0x108]
push 5
push 0
push 0x6bf588
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
pop ebx
cmp eax, 0x20
jge 0x584d6b
push eax
lea eax, [ebp - 0x108]
push eax
push str.failed_to_launch__s___d
call fcn.0058dd80
add esp, 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
call fcn.005b2af3
mov esp, ebp
pop ebp
ret
Function at 0x5850d0
Capabilities:
Extract resource via kernel32 functions
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d1628
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x6b8c10]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x28]
call fcn.00401000
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
call fcn.00401230
push 0x67abd8
push 0xc8
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x5851f4
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x5851f4
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.004013f0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], 0
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 0
push eax
push 0x67aa60
call fcn.0058e9b0
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.00401260
push eax
lea ecx, [ebp - 0x28]
call fcn.00401290
push eax
call fcn.0058e980
add esp, 8
cmp dword [ebp - 0x10], eax
je 0x585208
push 0x80
push 0x67aa60
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x67a34c
push 0x67aa60
call fcn.005b3f18
mov esi, eax
add esp, 8
test esi, esi
jne 0x5851cf
push 0x10
push str.Warning
push str.Can_not_update_steam_api.dll
jmp 0x585200
push esi
lea ecx, [ebp - 0x28]
call fcn.00401260
push eax
push 1
lea ecx, [ebp - 0x28]
call fcn.00401290
push eax
call fcn.005b4ae2
push esi
call fcn.005b3095
add esp, 0x14
jmp 0x585208
push 0x10
push str.Warning
push str.No_steam_api.dll_resource
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0xffffffff
call fcn.004010b0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x585630
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.VMProtectSDK32.dll_VMProtectBeginUltra]
push str.LoadCheckBoxStatus
mov byte [esi], 0
mov byte [esi + 0x80], 0
mov dword [esi + 0x284], 0
mov dword [esi + 0x288], 0
mov dword [esi + 0x28c], 0
mov dword [esi + 0x290], 0
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push str.SoftwareArktos_Entertainment_GroupWarZ
push SysReAllocString
call ebx
test eax, eax
jne 0x5856c2
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x80
push eax
push esi
push 0
push 0
push str.username
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.LoadCheckBoxStatus
call edi
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push str.SoftwareArktos_Entertainment_GroupWarZ
push SysReAllocString
call ebx
test eax, eax
jne 0x585711
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x80
push eax
lea eax, [esi + 0x204]
push eax
push 0
push 0
push str.CheckBoxEnable
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.LoadPassword
call edi
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
push str.SoftwareArktos_Entertainment_GroupWarZ
push SysReAllocString
call ebx
test eax, eax
jne 0x585760
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0x80
push eax
lea eax, [esi + 0x80]
push eax
push 0
push 0
push str.password
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5870e0
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x6b8c10]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x41c]
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
push eax
lea eax, [ebp - 0x418]
push eax
push edi
call fcn.0058e9b0
add esp, 0xc
test al, al
je 0x58712b
mov eax, dword [ebp - 0x418]
cmp eax, dword [edi + 0x112]
je 0x58720d
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edi
call dword [sym.imp.dbghelp.dll_MakeSureDirectoryPathExists]
push 0x67a34c
push edi
call fcn.005b3f18
add esp, 8
mov dword [ebp - 0x410], eax
test eax, eax
je 0x587220
lea eax, [ebp - 0x414]
mov ecx, esi
push eax
lea eax, [ebp - 0x40c]
push eax
call fcn.00401260
push eax
mov ecx, esi
call fcn.00401290
push eax
push edi
lea ecx, [ebx + 0x4c0]
call fcn.005a24a0
mov eax, dword [edi + 0x10a]
cmp eax, dword [ebp - 0x414]
je 0x5871a6
push 0
push 0x1b0
push str.Updater.cpp
push str.fe__size__out_size
call fcn.0058e630
add esp, 0x10
lea esi, [ebx + 0x20d74]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push dword [ebp - 0x410]
push 1
push dword [ebp - 0x414]
push dword [ebp - 0x40c]
call fcn.005b4ae2
push dword [ebp - 0x410]
call fcn.005b3095
add esp, 0x14
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push str.GameClient.exe
push edi
call fcn.005b6ceb
add esp, 8
test eax, eax
jne 0x5871ff
mov byte [ebx + 0x215f4], 1
call fcn.005874c0
push dword [ebp - 0x40c]
call fcn.0058fad0
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005b2af3
mov esp, ebp
pop ebp
ret 8
push edi
lea eax, [ebp - 0x408]
push str.Cant_replace_file__s_nPlease_delete_this_file_manually
push eax
call fcn.0057de50
add esp, 0xc
lea eax, [ebp - 0x408]
push eax
push ebx
call fcn.005864b0
int3
Function at 0x587320
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d1a18
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x6b8c10]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
push 0x400
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0
call fcn.0058a300
mov eax, dword [esi + 0x5cc]
xor edi, edi
sub eax, dword [esi + 0x5c8]
mov ebx, dword [ebp - 0x20]
sar eax, 2
mov dword [ebp - 0x10], edi
test eax, eax
je 0x58743c
lea esp, [esp]
mov eax, dword [esi + 0x5c8]
mov esi, dword [eax + edi*4]
test dword [esi + 0x116], 0x100000
jne 0x58741e
cmp esi, ebx
jae 0x5873f1
mov eax, dword [ebp - 0x24]
cmp eax, esi
ja 0x5873f1
sub esi, eax
mov eax, 0xdd67c8a7
imul esi
add edx, esi
sar edx, 8
mov esi, edx
shr esi, 0x1f
add esi, edx
cmp ebx, dword [ebp - 0x1c]
jne 0x5873e6
push ecx
lea ecx, [ebp - 0x24]
call fcn.0058a3a0
mov ebx, dword [ebp - 0x20]
imul esi, esi, 0x128
add esi, dword [ebp - 0x24]
jmp 0x587402
cmp ebx, dword [ebp - 0x1c]
jne 0x587402
push ecx
lea ecx, [ebp - 0x24]
call fcn.0058a3a0
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x587412
mov ecx, 0x4a
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x10]
add ebx, 0x128
inc dword [ebp - 0x14]
mov dword [ebp - 0x20], ebx
mov esi, dword [ebp - 0x18]
inc edi
mov dword [ebp - 0x10], edi
mov eax, dword [esi + 0x5cc]
sub eax, dword [esi + 0x5c8]
sar eax, 2
cmp edi, eax
jb 0x5873a0
mov edi, dword [ebp - 0x24]
mov eax, 0xdd67c8a7
sub ebx, edi
imul ebx
add edx, ebx
sar edx, 8
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
je 0x587488
add esi, 0x5c4
mov dword [ebp - 0x18], esi
mov esi, edi
mov edi, dword [ebp - 0x18]
push esi
mov ecx, edi
call fcn.005a20c0
test byte [esi + 0x116], 1
je 0x58747c
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esi, 0x128
dec ebx
jne 0x587464
mov edi, dword [ebp - 0x24]
push dword [ebp - 0x14]
push str.removed__d_files_n
call fcn.0058e160
add esp, 8
test edi, edi
je 0x5874a5
push edi
call fcn.0058fad0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5874c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x618
mov eax, dword [0x6b8c10]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push str.GameClient.exe
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x110]
push 0x67b40c
push eax
call fcn.0057de30
push str.InfectZMMO
lea eax, [ebp - 0x618]
push str.Allow_network_traffic_for__s
push eax
call fcn.0057de50
add esp, 0x1c
lea eax, [ebp - 0x618]
lea ecx, [ebp - 0x110]
push eax
call fcn.0057dae0
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
call fcn.005b2af3
mov esp, ebp
pop ebp
ret
Function at 0x5879b0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x6b8c10]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push str.Making_sure_extracted_files_exists_n
mov edi, ecx
call fcn.0058e160
add esp, 4
lea ecx, [edi + 0x4c0]
push 1
push 1
call fcn.005a18a0
mov eax, dword [edi + 0x5cc]
xor ebx, ebx
sub eax, dword [edi + 0x5c8]
sar eax, 2
test eax, eax
je 0x587a93
push esi
lea ecx, [ecx]
mov eax, dword [edi + 0x5c8]
mov esi, dword [eax + ebx*4]
test byte [esi + 0x116], 1
je 0x587a7a
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x40c]
push eax
push esi
call fcn.0058e9b0
add esp, 0xc
test al, al
je 0x587a49
mov eax, dword [ebp - 0x40c]
cmp eax, dword [esi + 0x112]
jne 0x587a49
mov eax, dword [ebp - 0x408]
cmp eax, dword [esi + 0x10a]
je 0x587a7a
push esi
push str.restoring__s_n
call fcn.0058e160
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
call dword [sym.imp.dbghelp.dll_MakeSureDirectoryPathExists]
push 0x67b58c
push esi
lea ecx, [edi + 0x4c0]
call fcn.005a0e80
test al, al
je 0x587abb
mov eax, dword [edi + 0x5cc]
inc ebx
sub eax, dword [edi + 0x5c8]
sar eax, 2
cmp ebx, eax
jb 0x587a00
pop esi
lea ecx, [edi + 0x4c0]
call fcn.005a0b70
push str.Making_sure_extracted_files_exists___finished_n
call fcn.0058e160
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop edi
pop ebx
call fcn.005b2af3
mov esp, ebp
pop ebp
ret
push esi
lea eax, [ebp - 0x404]
push str.Cant_extract_file__s_nPlease_delete_this_file_manually
push eax
call fcn.0057de50
add esp, 0xc
lea eax, [ebp - 0x404]
push eax
push edi
call fcn.005864b0
int3
Function at 0x588070
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d1af0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x6b8c10]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
cmp dword [esi + 0x20d8c], 0
je 0x5880c9
push 0
push 0x360
push str.Updater.cpp
push str.status___STATUS_Checking
call fcn.0058e630
add esp, 0x10
mov ecx, esi
call fcn.00586510
mov ecx, esi
call fcn.00586730
test al, al
je 0x5880f4
mov ecx, esi
call fcn.005867a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [0x764be3], 0
mov byte [esi + 0x84], 1
jne 0x58810b
mov eax, 3
jmp 0x588163
mov eax, dword [0x766208]
or eax, dword [0x76620c]
jne 0x58811f
mov eax, 3
jmp 0x588163
lea eax, [esi + 0x20d95]
push str.Checking_for_linked_steam_account
push eax
call fcn.0057de50
add esp, 8
lea ecx, [esi + 0x21600]
call fcn.0058bc80
test al, al
jne 0x588149
mov eax, 3
jmp 0x588163
mov ecx, esi
call fcn.005893e0
xor eax, eax
cmp dword [esi + 0x20d8c], 5
sete al
lea eax, [eax*2 + 3]
mov dword [esi + 0x20d8c], eax
lea eax, [esi + 0x20d95]
push 0x67a7bc
push eax
call fcn.0057de50
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 8
cmp dword [esi + 0x20d8c], 5
jne 0x588232
mov eax, dword [esi + 0x21884]
mov dword [0x764f90], eax
mov eax, dword [esi + 0x21888]
mov dword [0x764f94], eax
mov eax, dword [0x764fa0]
or eax, dword [0x764fa4]
je 0x5881db
call fcn.0057ef70
test al, al
je 0x5881db
push 0
push 0
push 0x764f90
push 0x57eb90
push 0
push 0
call fcn.005b35db
add esp, 0x18
mov dword [0x7651a0], eax
mov ecx, esi
call fcn.00586ab0
mov ecx, esi
call fcn.00586c60
push dword [esi + 0x18]
push dword [esi + 0x5c4]
push str.current_build_version_d__updater_data_version_d_n
call fcn.0058e160
mov eax, dword [esi + 0x5c4]
add esp, 0xc
mov ecx, esi
cmp eax, dword [esi + 0x18]
jne 0x588211
call fcn.00587fa0
call fcn.00586ec0
mov ecx, esi
call fcn.00587670
mov ecx, esi
call fcn.00587f00
mov ecx, esi
call fcn.00587ea0
mov ecx, esi
call fcn.00587fa0
push 0x32
call edi
jmp 0x588183