joyce8/EMBER2024-capa huggingface dataset:
Function at 0xe30238
Capabilities:
Encode data using xor

Disassembly:
jmp 0xe30242
pushal
call 0xe30248
pop ebp
sub ebp, 0x10
sub ebp, 0xa30238
jmp 0xe3025e
mov eax, 0xa30238
add eax, ebp
add eax, 0x4c
mov ecx, 0x5c3
add byte [ebx], al
lds eax, [ecx + 0x4cc0]
add byte [ecx + 0x5c3], bh
mov edx, 0x664c9d
xor byte [eax], dl
inc eax
dec ecx
jne 0xe30275
jmp 0xe30288
push ss
push eax
push ss
adc al, 0xa1
popfd
popfd
popfd
sbb al, 0x5c
popfd
popfd
popfd
sahf
push eax
and eax, 0x9d9d9d98
daa
mov ch, 0x9d
popfd
popfd
push 0x7f
sahf
push ebp
push ss
sbb al, 0x91
popfd
popfd
popfd
sahf
pop eax
adc cl, bh
mov ecx, 0xb9991461
int 0xf5
mov ebp, 0xf59dbc06
test edx, edi
sbb al, 0x9d
pushfd
mov cl, 0xb9
cmc
rcr byte [edx + 0x7d], 1
popal
jne 0xe30262
popfd
popfd
popfd
je 0xe30278
popfd
popfd
popfd
adc cl, bh
mov ecx, 0xb9b11461
push ss
jno 0xe302f2
sbb byte [ebp + 0x169d9d9d], dl
or byte [ecx + 0x169d9d9d], dl
adc byte [ebp + 0x5c9d9d9d], cl
je 0xe3028f
lodsb al, byte [esi]
lahf
push ds
pop edi
cdq
aam 0x92
sbb byte [ecx + 0x62], ch
bound esp, qword [edx + 0x16]
mov cl, 0xb9
adc cl, bh
mov ecx, 0x9d915f99
push ss
adc dword [ecx - 0x62626267], edi
cmc
mov ebp, 0xf59dbc06
test edx, edi
sbb al, 0x9d
pushfd
mov cl, 0xb9
int3
Function at 0x445220
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
mov al, byte [ecx]
and dword [esp + 0x14], 0
push ebx
push ebp
mov byte [edx], al
lea eax, [edx + 1]
push esi
mov dword [esp + 0x18], eax
push edi
mov dword [esp + 0x14], edx
mov esi, dword [esp + 0x14]
lea eax, [ecx + 1]
xor edi, edi
xor ebp, ebp
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x18]
call fcn.004451c9
test eax, eax
je 0x445379
lea ecx, [esp + 0x18]
call fcn.004451c9
lea ecx, [esp + 0x18]
test eax, eax
je 0x4452e8
call fcn.004451c9
test eax, eax
je 0x4452aa
push 4
xor edi, edi
pop ebx
lea ecx, [esp + 0x18]
call fcn.004451c9
lea edi, [eax + edi*2]
dec ebx
jne 0x445280
mov edx, dword [esp + 0x1c]
test edi, edi
je 0x4452a1
mov eax, edx
sub eax, edi
mov al, byte [eax]
mov byte [edx], al
jmp 0x4452a4
mov byte [edx], 0
inc edx
jmp 0x44538b
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
movzx esi, byte [eax]
mov ecx, esi
and ecx, 1
inc eax
add ecx, 2
shr esi, 1
mov dword [esp + 0x18], eax
je 0x4452e0
test ecx, ecx
je 0x445374
mov edi, edx
sub edi, esi
mov al, byte [edi]
mov byte [edx], al
inc edx
inc edi
dec ecx
jne 0x4452d2
jmp 0x445370
xor ebp, ebp
inc ebp
jmp 0x445374
call fcn.004451ff
test edi, edi
jne 0x44531d
cmp eax, 2
jne 0x445318
lea ecx, [esp + 0x18]
call fcn.004451ff
mov edx, dword [esp + 0x1c]
mov edi, eax
test edi, edi
je 0x445374
mov ecx, edx
sub ecx, esi
mov al, byte [ecx]
mov byte [edx], al
inc edx
inc ecx
dec edi
jne 0x44530d
jmp 0x445370
sub eax, 3
jmp 0x445320
sub eax, 2
mov ecx, dword [esp + 0x18]
mov esi, eax
movzx eax, byte [ecx]
shl esi, 8
add esi, eax
inc ecx
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x18]
jmp section..htext
mov dword [esp + 0x1c], edx
xor edi, edi
inc edi
jmp 0x445391
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov al, byte [ecx]
mov byte [edx], al
inc edx
inc ecx
mov dword [esp + 0x18], ecx
xor edi, edi
mov dword [esp + 0x1c], edx
test ebp, ebp
je 0x445250
sub edx, dword [esp + 0x14]
pop edi
mov eax, edx
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x445516
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov ebx, edi
shr ebx, 2
and edi, 3
mov esi, ecx
test ebx, ebx
je 0x445548
mov al, byte [esp + 0x14]
mov edx, dword [esi]
add al, bl
movzx ecx, al
mov eax, dword [esp + 0x10]
ror edx, cl
xor edx, eax
sub edx, ebx
mov dword [esi], edx
add esi, 4
dec ebx
jne 0x445529
jmp 0x44554c
mov eax, dword [esp + 0x10]
test edi, edi
je 0x445556
xor byte [esi], al
inc esi
dec edi
jne 0x445550
pop edi
pop esi
pop ebx
ret 0xc
Function at 0x401110
Capabilities:
Access firewall settings via inetfwmgr

Disassembly:
push esi
push 2
push 0
mov esi, eax
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jge 0x401128
cmp eax, 0x80010106
jne 0x4011a6
push edi
push esi
push 0x66110c
push 1
push 0
push 0x6610fc
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
test edi, edi
jge 0x401157
push edi
push str.CoCreateInstance_NetFwMgr_failed:_0x_08lx_n
call fcn.0056a9f0
add esp, 8
mov eax, edi
pop edi
pop esi
ret
mov eax, dword [esi]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1c]
push ebx
lea edi, [esi + 4]
push edi
push eax
call edx
mov ebx, eax
test ebx, ebx
jge 0x401180
push ebx
push str.get_LocalPolicy_failed:_0x_08lx_n
call fcn.0056a9f0
add esp, 8
mov eax, ebx
pop ebx
pop edi
pop esi
ret
mov eax, dword [edi]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1c]
add esi, 8
push esi
push eax
call edx
mov esi, eax
test esi, esi
jge 0x4011a4
push esi
push str.get_CurrentProfile_failed:_0x_08lx_n
call fcn.0056a9f0
mov eax, esi
add esp, 8
pop ebx
pop edi
pop esi
ret

Function at 0x4014a0
Capabilities:
Access firewall policy via inetfwpolicy2

Disassembly:
push esi
push 2
push 0
mov esi, eax
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jge 0x4014b8
cmp eax, 0x80010106
jne 0x40150c
push edi
push esi
push 0x66114c
push 1
push 0
push 0x66113c
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
test edi, edi
jge 0x4014e7
push edi
push str.CoCreateInstance_NetFwPolicy2_failed:_0x_08lx_n
call fcn.0056a9f0
add esp, 8
mov eax, edi
pop edi
pop esi
ret
mov eax, dword [esi]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x48]
add esi, 4
push esi
push eax
call edx
mov esi, eax
test esi, esi
jge 0x40150b
push esi
push str.get_Rules_failed:_0x_08lx_n
call fcn.0056a9f0
mov eax, esi
add esp, 8
pop edi
pop esi
ret
Function at 0x401590
Capabilities:
Access firewall rule properties via inetfwrule

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
cmp dword [esi + 4], 0
jne 0x4015a6
mov eax, 0x80004001
pop esi
pop ecx
ret 0xc
push ebx
push ebp
push edi
push str.WarZ_Thailand
call fcn.00401050
mov edi, eax
mov eax, dword [esp + 0x20]
push eax
call fcn.00401050
mov ecx, dword [esp + 0x28]
push ecx
mov ebp, eax
call fcn.00401050
mov dword [esp + 0x28], eax
add esp, 0xc
lea ebx, [esp + 0x20]
mov eax, esi
mov dword [esp + 0x10], 0
call fcn.00401510
mov esi, eax
test esi, esi
jge 0x401603
push esi
push str.IsAppEnabled_failed:_0x_08lx_n
call fcn.0056a9f0
add esp, 8
pop edi
pop ebp
pop ebx
mov eax, esi
pop esi
pop ecx
ret 0xc
cmp dword [esp + 0x20], 0
je 0x401614
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
pop ecx
ret 0xc
lea edx, [esp + 0x10]
push edx
push 0x66116c
push 1
push 0
push 0x66115c
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
jge 0x40163e
push esi
push str.CoCreateInstance_NetFwRule_failed:_0x_08lx_n
jmp 0x4016cd
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x20]
push edi
push eax
call edx
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x1c]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x28]
call eax
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x30]
push ebp
push eax
call edx
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x40]
push 0x100
push eax
call edx
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x98]
push 6
push eax
call edx
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xa8]
push 1
push eax
call edx
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x88]
push 0xffffffffffffffff
push eax
call edx
mov eax, dword [esp + 0x18]
mov eax, dword [eax + 4]
mov edx, dword [esp + 0x10]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x20]
call eax
mov esi, eax
test esi, esi
jge 0x4016d5
push esi
push str.Firewall_Rule_Add_failed:_0x_08lx_n
call fcn.0056a9f0
add esp, 8
push edi
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call edi
push ebp
call edi
mov ecx, dword [esp + 0x1c]
push ecx
call edi
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4016f8
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
pop edi
pop ebp
pop ebx
mov eax, esi
pop esi
pop ecx
ret 0xc
Function at 0x401910
Capabilities:
Copy file

Disassembly:
sub esp, 0x614
mov eax, dword [0x68edec]
xor eax, esp
mov dword [esp + 0x610], eax
push esi
push edi
push 0x104
lea eax, [esp + 0x118]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x114]
push 0x5c
push ecx
call fcn.00590c70
mov esi, eax
inc esi
add esp, 8
cmp esi, 1
jne 0x40196b
push 0
push 0x14
push str..GenerateUpdaterXML.cpp
push str._DWORD_fname___1
call fcn.0056ad00
add esp, 0x10
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x11c]
push ecx
call fcn.0056b720
add esp, 0xc
test al, al
jne 0x40199e
lea edx, [esp + 0x114]
push edx
push str.failed_to_get_crc_for__s_n
call fcn.0056abc0
add esp, 8
push 0x6915e0
push esi
lea eax, [esp + 0x18]
push str._s__s.exe
push eax
call fcn.00401aa0
add esp, 0x10
push 0
lea ecx, [esp + 0x14]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x4019db
lea edx, [esp + 0x10]
push edx
push esi
push str.unable_to_copy__s___s_n
call fcn.0056abc0
add esp, 0xc
push 0x2f
push str.http:__141.11.159.163_wz_q_launcher_woupd.xml
call fcn.00590c70
mov esi, eax
add esp, 8
test esi, esi
jne 0x401a05
push eax
push 0x21
push str..GenerateUpdaterXML.cpp
push str.updater_file
call fcn.0056ad00
add esp, 0x10
lea edi, [esi + 1]
push 0x6611fc
push edi
call fcn.0056bc30
mov esi, eax
push str._p__n
push esi
call fcn.00590c9d
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
push eax
push 0x6915e0
push ecx
lea edx, [esp + 0x2c]
push edx
push str.http:__141.11.159.163_wz_q_launcher_
push str.__u_url__s_s__crc__u__ver__s__size__u____n
push esi
call fcn.00590c9d
push str.__p__n
push esi
call fcn.00590c9d
push esi
call fcn.00590e30
lea eax, [esp + 0x48]
push eax
push edi
lea ecx, [esp + 0x258]
push str.XML__s_generated_nnew_exe:_s
push ecx
call fcn.00401ac0
add esp, 0x48
push 0
push str.Updater_XML
lea edx, [esp + 0x220]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x618]
pop edi
pop esi
xor ecx, esp
call fcn.005909a7
add esp, 0x614
ret
Function at 0x4021c0
Capabilities:
Get cpu information
Get memory capacity
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c
push ebx
push esi
push edi
mov esi, eax
call fcn.00402290
mov eax, esi
call fcn.00402300
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402220
lea ecx, [esp + 0x10]
push ecx
lea edx, [esi + 0x88]
push edx
push eax
push eax
mov eax, dword [esp + 0x24]
push str.MHz
push eax
mov dword [esp + 0x28], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x1c], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
push 0
shrd edx, eax, 0xa
push 0
push 0
push str.DISPLAY
shr eax, 0xa
mov dword [esi + 0x8c], edx
call dword [sym.imp.GDI32.dll_CreateICA]
mov ebx, dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov edi, eax
push 8
push edi
call ebx
push 0xa
push edi
mov dword [esi + 0x90], eax
call ebx
push edi
mov dword [esi + 0x94], eax
call dword [sym.imp.GDI32.dll_DeleteDC]
call fcn.00402470
call fcn.00402610
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402a70
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
lea eax, [esp]
push eax
push 0xf003f
push 0
push str.Software_sKj_Studio_sKj
push bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x402a98
mov al, 1
add esp, 0x10
ret
mov eax, dword [esp]
push esi
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x10]
push edx
push 0
push 0
push str.UpdaterTime1
push eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x20], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 4]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x402b0a
push esi
call fcn.00591195
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
add esp, 4
add esi, 0x2a300
adc ecx, 0
cmp edx, ecx
jg 0x402b0a
jl 0x402b03
cmp eax, esi
jae 0x402b0a
xor al, al
pop esi
add esp, 0x10
ret
mov al, 1
pop esi
add esp, 0x10
ret
Function at 0x402c30
Capabilities:
Get common file path

Disassembly:
sub esp, 0xb14
mov eax, dword [0x68edec]
xor eax, esp
mov dword [esp + 0xb10], eax
push 0x104
lea eax, [esp + 0x210]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp]
push ecx
lea edx, [esp + 0x10c]
push edx
push 0x104
lea eax, [esp + 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
mov eax, dword [esp]
test eax, eax
je 0x402c83
mov byte [eax - 1], 0
lea ecx, [esp + 4]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea edx, [esp + 4]
push edx
lea eax, [esp + 0x10c]
push eax
call fcn.0059431c
add esp, 8
test eax, eax
je 0x402ce5
lea ecx, [esp + 0x108]
push ecx
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x318]
push str.Updater_current_directory___s__is_different_from_working_directory___s_
push eax
call fcn.004067f0
add esp, 0x10
push 0x30
push str.Warning
lea ecx, [esp + 0x318]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0xb10]
xor ecx, esp
mov al, 1
call fcn.005909a7
add esp, 0xb14
ret

Function at 0x402d80
Capabilities:
Inspect load icon resource
Terminate process

Disassembly:
mov eax, dword [0x69610c]
push 5
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
push str._generate
push 0x6958f0
mov dword [0x696114], eax
mov dword [0x68dc00], 0
call fcn.005915d0
add esp, 8
test eax, eax
je 0x402dc8
call fcn.00401910
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
ret
call fcn.00402ba0
test al, al
jne 0x402db8
call fcn.00402c30
call fcn.00402d00
test al, al
jne 0x402e03
push 0x40
push str.UAC_problem
push str.Updater_must_be_run_from_administrator
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
ret
call fcn.00407380
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0x73ac20
push 0x661578
push 0x17
push 0
push 0x63f83c
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jge 0x402e37
mov dword [0x73ac20], 0
push str._cmdLine
push 0x6958f0
call fcn.005915d0
add esp, 8
test eax, eax
je 0x402e54
mov byte [0x73ac1c], 1
push esi
mov esi, dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f00
push 0
call esi
push 0x7f89
push 0
mov dword [0x73ab80], eax
call esi
push 0x209
push 0x73acb8
push 0x12f
push 0
mov dword [0x73ab7c], eax
call dword [sym.imp.USER32.dll_LoadStringW]
pop esi
ret
Function at 0x403a20
Capabilities:
Hide graphical window
Inspect load icon resource

Disassembly:
push 0xffffffffffffffff
push 0x5bec9e
mov eax, dword fs:[0]
push eax
sub esp, 0x208
mov eax, dword [0x68edec]
xor eax, esp
mov dword [esp + 0x204], eax
push ebx
push esi
push edi
mov eax, dword [0x68edec]
xor eax, esp
push eax
lea eax, [esp + 0x218]
mov dword fs:[0], eax
cmp byte [0x73ac1c], 0
je 0x403aa8
call dword [sym.imp.KERNEL32.dll_AllocConsole]
call fcn.00591cb5
add eax, 0x20
push eax
push 0x661624
push str.CONOUT_
call fcn.00591c8f
call fcn.00591cb5
push eax
push 0x6619b4
push str.CONIN_
call fcn.00591c8f
add esp, 0x18
mov dword [0x696188], 1
jmp 0x403c22
mov eax, 0x73b338
call fcn.004021c0
mov eax, dword [0x69610c]
push 5
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov ecx, dword [0x696110]
push eax
push 0
push 0x80
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edx, dword [0x696110]
push 0x800000
push 0
push edx
call fcn.0056a1b0
mov eax, dword [0x696110]
push 0xc00000
push 0
push eax
call fcn.0056a1b0
mov ecx, dword [0x696110]
add esp, 0x18
push 0x403890
push 0xfffffffffffffffc
push ecx
call dword [sym.imp.USER32.dll_SetWindowLongA]
call fcn.005748c0
push 0
push 0
push 0
push str.DISPLAY
call dword [sym.imp.GDI32.dll_CreateICA]
mov edi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov esi, eax
push 8
push esi
call edi
push 0xa
push esi
mov ebx, eax
call edi
mov esi, eax
lea eax, [ebx - 0x311]
cdq
sub eax, edx
mov ecx, eax
push 0
lea eax, [esi - 0x28a]
cdq
push 0x28a
sub eax, edx
mov edx, dword [0x696110]
push 0x311
sar eax, 1
push eax
sar ecx, 1
push ecx
push 0
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0x102660
call fcn.0056c960
add esp, 4
mov dword [esp + 0x10], eax
mov dword [esp + 0x220], 0
test eax, eax
je 0x403b9b
mov ecx, eax
call fcn.00572260
jmp 0x403b9d
xor eax, eax
mov dword [esp + 0x220], 0xffffffff
mov ecx, dword [0x696110]
push 0
push ecx
mov ecx, eax
mov dword [0x696174], eax
call fcn.0056db20
call fcn.00402e90
push str.Mar__2_2024_19:53:54
push 0x6915e0
lea edx, [esp + 0x1c]
push str.Launcher__s___s_
push edx
call fcn.00406810
mov ecx, dword [0x696110]
add esp, 0x10
lea eax, [esp + 0x14]
push eax
push ecx
call dword [sym.imp.USER32.dll_SetWindowTextA]
call fcn.00403270
mov edx, dword [0x696110]
push 5
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
call dword [sym.imp.USER32.dll_ClipCursor]
mov ecx, dword [0x69617c]
call fcn.00578080
mov ecx, dword [0x696178]
call fcn.005782c0
mov ecx, dword [esp + 0x218]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x204]
xor ecx, esp
call fcn.005909a7
add esp, 0x214
ret
Function at 0x405c10
Capabilities:
Set registry value

Disassembly:
push ecx
push 0
lea eax, [esp + 4]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.Software_sKj_Studio_sKj
push bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x405c3d
xor al, al
pop ecx
ret
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x405c42
mov ecx, dword [esp]
sub eax, edx
inc eax
push eax
push esi
push 1
push 0
push str.LoginToken
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x405c39
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
pop ecx
ret

Function at 0x405c80
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x5be77b
mov eax, dword fs:[0]
push eax
sub esp, 0xc14
mov eax, dword [0x68edec]
xor eax, esp
mov dword [esp + 0xc10], eax
push ebx
push esi
push edi
mov eax, dword [0x68edec]
xor eax, esp
push eax
lea eax, [esp + 0xc24]
mov dword fs:[0], eax
push str.Starting_game_n
mov ebx, ecx
call fcn.0056a9f0
inc dword [0x6961b0]
add esp, 4
push 6
push 0
mov dword [esp + 0xc34], 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x20]
push ecx
push str.warz_patch.exe
call fcn.0056b720
add esp, 0xc
test al, al
jne 0x405d0e
push str.failed1_n
call fcn.0056a9f0
add esp, 4
jmp 0x405d25
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
push edx
push eax
push str._08x__d_n
call fcn.0056a9f0
add esp, 0xc
lea ecx, [ebx + 0x21714]
push ecx
lea edi, [esp + 0x24]
call fcn.0040e310
mov esi, edi
call fcn.00405c10
test al, al
je 0x405d66
push 0xffffffffffffffff
call fcn.00578a00
add esp, 4
push eax
push 0xffffffffffffffff
call fcn.00578a00
add esp, 4
push eax
mov edx, edi
push str._08X_08X
push edx
call fcn.00401ac0
add esp, 0x10
lea eax, [esp + 0x20]
push eax
push 0x6958f0
lea ecx, [esp + 0x428]
push str._WOUpdatedOk__s__WOLogin___s_
push ecx
call fcn.004067f0
add esp, 0x10
cmp dword [ebx + 0x21dcc], 0
jbe 0x405dd6
lea eax, [esp + 0x420]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x405d98
sub eax, edx
cmp dword [ebx + 0x21dd0], 0x10
lea edx, [esp + eax + 0x420]
mov dword [esp + 0x14], edx
jb 0x405dbd
mov ebx, dword [ebx + 0x21dbc]
jmp 0x405dc3
add ebx, 0x21dbc
push ebx
lea eax, [esp + 0x18]
push str.__survey___s_
push eax
call fcn.0040e450
add esp, 0xc
cmp dword [0x73c56c], 0
jl 0x405e1a
jg 0x405dea
cmp dword [0x73c568], 0
jbe 0x405e1a
lea eax, [esp + 0x420]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x405df4
sub eax, edx
lea edx, [esp + 0x14]
lea ecx, [esp + eax + 0x420]
push str.__steam
push edx
mov dword [esp + 0x1c], ecx
call fcn.0040e450
add esp, 8
push 5
push 0
lea eax, [esp + 0x428]
push eax
push str.warz_patch.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jge 0x405e4b
push eax
push str.failed:__d_n
call fcn.0056a9f0
add esp, 8
cmp dword [0x6961b0], 0
je 0x405e5a
dec dword [0x6961b0]
mov ecx, dword [esp + 0xc24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc10]
xor ecx, esp
call fcn.005909a7
add esp, 0xc20
ret
Function at 0x406dc0
Capabilities:
Set console window title

Disassembly:
sub esp, 0x218
mov eax, dword [0x68edec]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
push esi
push edi
mov esi, ecx
call fcn.0040b9e0
call fcn.0056a730
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
nop
call fcn.0056a780
call fcn.0056a730
push 0x64
call edi
cmp dword [esi + 0x20dec], 3
jne 0x406e11
mov dword [esi + 0x20dec], 5
cmp dword [esi + 0x20df0], 0
jne 0x406e98
mov eax, dword [esi + 0x215f8]
mov ecx, dword [esi + 0x215fc]
mov dword [esp + 0x10], eax
or eax, ecx
mov dword [esp + 0x14], ecx
jne 0x406e36
fldz
jmp 0x406e5f
fild qword [esi + 0x21600]
fild qword [esp + 0x10]
fdivp st(1)
fstp dword [esp + 0xc]
fld1
fcom dword [esp + 0xc]
fnstsw ax
test ah, 5
jp 0x406e59
fstp dword [esp + 0xc]
jmp 0x406e5b
fstp st(0)
fld dword [esp + 0xc]
fstp dword [esp + 0xc]
sub esp, 8
fld dword [esp + 0x14]
lea eax, [esi + 0x20df5]
fmul qword [0x663990]
lea ecx, [esp + 0x20]
fstp qword [esp]
push eax
push str._s:__.1f__
push ecx
call fcn.00406810
add esp, 0x14
lea edx, [esp + 0x18]
push edx
call ebx
jmp 0x406df0
mov eax, esi
call fcn.0040bb10
mov eax, dword [esi + 0x20df0]
sub eax, 1
je 0x406ee2
sub eax, 1
je 0x406ecc
sub eax, 1
je 0x406eef
push 0
push 0x37
push str..Main_CmdLine.cpp
push 0x6619a8
call fcn.0056ad00
add esp, 0x10
jmp 0x406eef
add esi, 0x211f5
push esi
push str.Update_error_n_s_n_nPlease_retry_later
call fcn.0056a9f0
add esp, 8
jmp 0x406eef
push str.Update_ok_n
call fcn.0056a9f0
add esp, 4
push str._nPress_enter_to_exit...
call fcn.0056a9f0
add esp, 4
call fcn.00591e77
mov ecx, dword [esp + 0x21c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005909a7
add esp, 0x218
ret