joyce8/EMBER2024-capa huggingface dataset:
Function at 0x580a90
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push 0x70
mov esi, ecx
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp dword [esi + 0x21788], 1
je 0x580c80
cmp byte [0x74f6c8], 0
je 0x580b45
movd xmm2, dword [0x74db58]
movss xmm1, dword [0x6a4170]
cvtdq2ps xmm2, xmm2
comiss xmm2, xmm1
jb 0x580b45
movss xmm3, dword [0x6a4178]
movaps xmm0, xmm1
addss xmm0, xmm3
comiss xmm0, xmm2
jb 0x580b45
movd xmm4, dword [0x74db54]
movss xmm2, dword [0x6a4174]
cvtdq2ps xmm4, xmm4
comiss xmm4, xmm2
jb 0x580b45
movss xmm5, dword [0x6a417c]
movaps xmm0, xmm2
addss xmm0, xmm5
comiss xmm0, xmm4
jb 0x580b45
lea eax, [ebp - 4]
push eax
push ecx
mov ecx, dword [0x74db6c]
movss dword [esp], xmm5
call fcn.00583a90
cmp dword [0x74db50], 0
je 0x580b45
push ecx
mov ecx, esi
call fcn.00587760
pop esi
mov esp, ebp
pop ebp
ret
movd xmm2, dword [0x74db58]
movss xmm1, dword [0x6a4160]
cvtdq2ps xmm2, xmm2
comiss xmm2, xmm1
jb 0x580bc0
movss xmm3, dword [0x6a4168]
movaps xmm0, xmm1
addss xmm0, xmm3
comiss xmm0, xmm2
jb 0x580bc0
movd xmm4, dword [0x74db54]
movss xmm2, dword [0x6a4164]
cvtdq2ps xmm4, xmm4
comiss xmm4, xmm2
jb 0x580bc0
movss xmm5, dword [0x6a416c]
movaps xmm0, xmm2
addss xmm0, xmm5
comiss xmm0, xmm4
jb 0x580bc0
lea eax, [ebp - 4]
push eax
push ecx
mov ecx, dword [0x74db70]
movss dword [esp], xmm5
call fcn.00583a90
jmp 0x580bc0
cmp dword [0x74db50], 0
movss xmm1, dword [0x6a4184]
movss xmm2, dword [0x6a4180]
je 0x580c53
movd xmm3, dword [0x74db58]
cvtdq2ps xmm3, xmm3
comiss xmm3, xmm2
jb 0x580c53
movss xmm0, dword [0x6a4188]
addss xmm0, xmm2
comiss xmm0, xmm3
jb 0x580c53
movd xmm3, dword [0x74db54]
cvtdq2ps xmm3, xmm3
comiss xmm3, xmm1
jb 0x580c53
movss xmm0, dword [0x6a418c]
addss xmm0, xmm1
comiss xmm0, xmm3
jb 0x580c53
xor eax, eax
movaps xmm0, xmm2
test eax, eax
mov dword [0x74f6c0], eax
push 0x40
mov dword [0x6a53e4], 0x74e1e8
sete dl
push eax
mov ecx, 0x74f6c8
mov dword [0x6a53e0], 0x74e1e8
call fcn.0057fd60
add esp, 8
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [0x74f6c0]
movaps xmm0, xmm2
test eax, eax
mov ecx, 0x74f6c8
push 0x40
sete dl
push 0
call fcn.0057fd60
add esp, 8
pop esi
mov esp, ebp
pop ebp
ret
movss xmm0, dword [0x6a418c]
lea eax, [ebp - 8]
addss xmm0, dword [0x6769e8]
push 0
push 0
push eax
sub esp, 0x10
mov dword [ebp - 8], 0x64000000
movss dword [esp + 0xc], xmm0
movss xmm0, dword [0x6a4188]
addss xmm0, dword [0x6769e8]
movss dword [esp + 8], xmm0
movss xmm0, dword [0x6a4184]
subss xmm0, dword [0x6769e4]
movss dword [esp + 4], xmm0
movss xmm0, dword [0x6a4180]
subss xmm0, dword [0x6769e4]
movss dword [esp], xmm0
call fcn.00597870
movss xmm1, dword [0x6a4184]
add esp, 0x1c
movss xmm0, dword [0x6a4180]
xor dl, dl
mov ecx, 0x74f6c8
push 0x20
push 0
call fcn.0057fd60
add esp, 8
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x58157a
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x6a1da0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x204]
add ecx, 0x215f8
push eax
mov esi, edx
call fcn.00588fc0
cmp esi, 5
ja case.default.0x58151d
jmp dword [esi*4 + 0x5815a4]
lea eax, [ebp - 0x404]
push str.https:__www.google.com_
push eax
call fcn.0057df00
add esp, 8
lea eax, [ebp - 0x404]
push 5
push 0
push 0x674dcc
push eax
jmp 0x581588
push 5
push 0
push 0x674dcc
push str.https:__www.google.com_
jmp 0x581588
push 5
push 0
push 0x674dcc
push str.https:__www.youtube.com_
jmp 0x581588
push 5
push 0
push 0x674dcc
push str.https:__www.facebook.com_
jmp 0x581588
push 5
push 0
push 0x674dcc
push str.https:__www.twitter.com_
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.005aed03
mov esp, ebp
pop ebp
ret
Function at 0x581ad0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5cc5c8
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x6a1da0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x21c3c], 2
jne 0x581b7c
lea esi, [edi + 0x21c24]
push esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 0
cmp dword [edi + 0x21c68], 0
je 0x581b5a
cmp byte [0x6a4060], 0
je 0x581b5a
cmp dword [edi + 0x21c6c], 0x10
lea eax, [edi + 0x21c58]
mov byte [0x6a4060], 0
jb 0x581b43
mov eax, dword [eax]
push 5
push 0
push 0x674dcc
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
movss xmm1, dword [0x676a08]
lea ecx, [edi + 0x21c18]
movss xmm0, dword [0x6769f8]
call fcn.00581860
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x581ce0
Capabilities:
Create process on windows
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5cc5fb
mov eax, dword fs:[0]
push eax
sub esp, 0xc14
mov eax, dword [0x6a1da0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push str.Starting_game_n
call fcn.00589be0
inc dword [0x6a82f8]
add esp, 4
push 6
push 0
mov dword [ebp - 4], 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
lea eax, [ebp - 0xc1c]
push eax
lea eax, [ebp - 0xc18]
push eax
push str.siamexe.exe
call fcn.0058abb0
add esp, 0xc
test al, al
jne 0x581d60
push str.failed1_n
call fcn.00589be0
add esp, 4
jmp 0x581d79
push dword [ebp - 0xc1c]
push dword [ebp - 0xc18]
push str._08x__d_n
call fcn.00589be0
add esp, 0xc
lea eax, [ebp - 0x410]
push eax
lea ecx, [esi + 0x215f8]
call fcn.00588fc0
push 0
lea eax, [ebp - 0xc14]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareCodex_Development_GroupWarZ_Siam_MMO
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x581e23
lea ecx, [ebp - 0x410]
lea edx, [ecx + 1]
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x581dc0
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x410]
push eax
push 1
push 0
push str.LoginToken
push dword [ebp - 0xc14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x581e23
push dword [ebp - 0xc14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xffffffffffffffff
call fcn.00597e40
add esp, 4
push eax
push 0xffffffffffffffff
call fcn.00597e40
add esp, 4
push eax
lea eax, [ebp - 0x410]
push str._08X_08X
push eax
call fcn.0057df00
add esp, 0x10
lea eax, [ebp - 0x410]
push eax
push 0x6a9960
lea eax, [ebp - 0xc10]
push str._WOUpdatedOk__s__WOLogin___s_
push eax
call fcn.005827a0
add esp, 0x10
cmp dword [esi + 0x21c80], 0
jbe 0x581e92
lea ecx, [ebp - 0xc10]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x581e55
sub ecx, edx
lea eax, [ebp - 0xc10]
add eax, ecx
cmp dword [esi + 0x21c84], 0x10
mov dword [ebp - 0xc14], eax
lea eax, [esi + 0x21c70]
jb 0x581e7d
mov eax, dword [eax]
push eax
lea eax, [ebp - 0xc14]
push str.__survey___s_
push eax
call fcn.005827e0
add esp, 0xc
push 5
push 0
lea eax, [ebp - 0xc10]
push eax
push str.siamexe.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jge 0x581ec2
push eax
push str.failed:__d_n
call fcn.00589be0
add esp, 8
mov eax, dword [0x6a82f8]
test eax, eax
je 0x581ed1
dec eax
mov dword [0x6a82f8], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005aed03
mov esp, ebp
pop ebp
ret
Function at 0x582dc0
Capabilities:
Set console window title

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x6a1da0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
call fcn.00587950
call fcn.00589ff0
call fcn.00589630
call fcn.00589ff0
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esi + 0x20d84], 3
jne 0x582e07
mov dword [esi + 0x20d84], 5
cmp dword [esi + 0x20d88], 0
jne 0x582eb1
mov edi, dword [esi + 0x21590]
mov eax, edi
mov ebx, dword [esi + 0x21594]
or eax, ebx
jne 0x582e2b
xorps xmm1, xmm1
jmp 0x582e71
mov edx, dword [esi + 0x2159c]
mov ecx, dword [esi + 0x21598]
call fcn.005b6d6d
cvtsd2ss xmm0, xmm0
mov edx, ebx
mov ecx, edi
movss dword [ebp - 0x20c], xmm0
call fcn.005b6d6d
movss xmm1, dword [ebp - 0x20c]
cvtsd2ss xmm0, xmm0
divss xmm1, xmm0
movss xmm0, dword [0x6769e0]
comiss xmm1, xmm0
jbe 0x582e71
movaps xmm1, xmm0
mulss xmm1, dword [0x6769fc]
lea eax, [esi + 0x20d8d]
sub esp, 8
cvtps2pd xmm0, xmm1
movsd qword [esp], xmm0
push eax
lea eax, [ebp - 0x208]
push str._s:__.1f__
push eax
call fcn.005827c0
add esp, 0x14
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
jmp 0x582de2
mov ecx, esi
call fcn.00587a90
mov eax, dword [esi + 0x20d88]
dec eax
je 0x582ef5
dec eax
je 0x582edf
dec eax
je 0x582f02
push 0
push 0x37
push str.Main_CmdLine.cpp
push 0x674d64
call fcn.0058a0b0
add esp, 0x10
jmp 0x582f02
lea eax, [esi + 0x2118d]
push eax
push str.Update_error_n_s_n_nPlease_retry_later
call fcn.00589be0
add esp, 8
jmp 0x582f02
push str.Update_ok_n
call fcn.00589be0
add esp, 4
push str._nPress_enter_to_exit...
call fcn.00589be0
add esp, 4
call fcn.005b0ab3
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005aed03
mov esp, ebp
pop ebp
ret
Function at 0x5835d0
Capabilities:
Copy file
Create process on windows
Delete file
Move file
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60c
mov eax, dword [0x6a1da0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x108]
push str..new.exe
push eax
call fcn.005afa80
add esp, 8
test eax, eax
jne 0x583647
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push str._s.new.exe
push eax
call fcn.0057dee0
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005aed03
mov esp, ebp
pop ebp
ret
push edi
push str..exe_updated__moving_back_n
mov byte [0x74db42], 1
call fcn.00589be0
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 4
push 0x1f4
call edi
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.005af59d
lea ecx, [ebp - 0x108]
add esp, 0xc
lea edx, [ecx + 1]
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x583690
sub ecx, edx
cmp ecx, 8
ja 0x5836b4
push 0
push 0x31
push str.SelfUpdateEXE.cpp
push str.strlen_exeMain____8
call fcn.0058a0b0
add esp, 0x10
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x5836c0
sub ecx, edx
add ecx, 0xfffffff8
cmp ecx, 0x104
jae 0x5837d1
push ebx
mov byte [ebp + ecx - 0x108], al
lea eax, [ebp - 0x108]
push esi
push eax
push str.exeMain:__s_n
call fcn.00589be0
mov ebx, dword [sym.imp.KERNEL32.dll_CopyFileA]
add esp, 8
xor esi, esi
lea ecx, [ecx]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x5837be
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
call ebx
test eax, eax
jne 0x5837be
push 0x64
call edi
inc esi
cmp esi, 0xa
jl 0x583700
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x60c]
push str.Failed_to_replace_updater_file_n_nPlease_manually_rename__s_to__s
push eax
call fcn.0057df00
add esp, 0x10
lea eax, [ebp - 0x60c]
push 0x30
push str.Updater
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 5
push 0
push 0
push 0x674d9c
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
pop ebx
xor al, al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005aed03
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop esi
pop ebx
xor ecx, ebp
pop edi
call fcn.005aed03
mov esp, ebp
pop ebp
ret
call fcn.005b00a7
int3
Function at 0x5837e0
Capabilities:
Create process on windows
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x6a1da0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x104
lea eax, [ebp - 0x20c]
mov edi, edx
push eax
push 0
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push str.Trying_to_update_n
call fcn.00589be0
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push str._s.new.exe
push eax
call fcn.0057dee0
lea eax, [ebp - 0x108]
push 0x6749dc
push eax
call fcn.005afa1b
mov esi, eax
add esp, 0x18
test esi, esi
jne 0x58385e
lea eax, [ebp - 0x108]
push eax
push str.cant_open__s_for_writing_n
call fcn.00589800
add esp, 8
push esi
push 1
push edi
push ebx
call fcn.005b0c33
push esi
call fcn.005af3f5
add esp, 0x14
push dword [0x74dbe0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x108]
push eax
push str.executing__s_n
call fcn.00589be0
add esp, 8
lea eax, [ebp - 0x108]
push 5
push 0
push 0x6a9960
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
pop ebx
cmp eax, 0x20
jge 0x5838cb
push eax
lea eax, [ebp - 0x108]
push eax
push str.failed_to_launch__s___d
call fcn.00589800
add esp, 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
call fcn.005aed03
mov esp, ebp
pop ebp
ret

Function at 0x583b60
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
push esi
push eax
mov esi, ecx
push 0xf003f
push 0
push str.SoftwareCodex_Development_GroupWarZ_Siam_MMO
mov byte [esi], 0
mov byte [esi + 0x80], 0
mov dword [esi + 0x180], 0
mov dword [esi + 0x184], 0
mov dword [esi + 0x188], 0
push SysReAllocString
mov dword [esi + 0x18c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x583be1
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x80
push eax
push esi
push 0
push 0
push str.username
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, esi
call fcn.00588ea0
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x585350
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x6a1da0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x41c]
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
push eax
lea eax, [ebp - 0x418]
push eax
push edi
call fcn.0058abb0
add esp, 0xc
test al, al
je 0x58539b
mov eax, dword [ebp - 0x418]
cmp eax, dword [edi + 0x10e]
je 0x58547d
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edi
call dword [sym.imp.dbghelp.dll_MakeSureDirectoryPathExists]
push 0x6749dc
push edi
call fcn.005afa1b
add esp, 8
mov dword [ebp - 0x410], eax
test eax, eax
je 0x585490
lea eax, [ebp - 0x414]
mov ecx, esi
push eax
lea eax, [ebp - 0x40c]
push eax
call fcn.004011c0
push eax
mov ecx, esi
call fcn.004011f0
push eax
push edi
lea ecx, [ebx + 0x4c0]
call fcn.0059a790
mov eax, dword [edi + 0x106]
cmp eax, dword [ebp - 0x414]
je 0x585416
push 0
push 0x18b
push str.Updater.cpp
push str.fe__size__out_size
call fcn.0058a0b0
add esp, 0x10
lea esi, [ebx + 0x20d6c]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push dword [ebp - 0x410]
push 1
push dword [ebp - 0x414]
push dword [ebp - 0x40c]
call fcn.005b0c33
push dword [ebp - 0x410]
call fcn.005af3f5
add esp, 0x14
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push str.siamexe.exe
push edi
call fcn.005b2e5b
add esp, 8
test eax, eax
jne 0x58546f
mov byte [ebx + 0x215ec], 1
call fcn.00585730
push dword [ebp - 0x40c]
call fcn.0058bcf0
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005aed03
mov esp, ebp
pop ebp
ret 8
push edi
lea eax, [ebp - 0x408]
push str.Cant_replace_file__s_nPlease_delete_this_file_manually
push eax
call fcn.0057df00
add esp, 0xc
lea eax, [ebp - 0x408]
push eax
push ebx
call fcn.00584780
int3
Function at 0x585590
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5cca38
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x6a1da0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
push 0x400
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0
call fcn.00587d10
mov eax, dword [esi + 0x5cc]
xor edi, edi
sub eax, dword [esi + 0x5c8]
mov ebx, dword [ebp - 0x20]
sar eax, 2
mov dword [ebp - 0x10], edi
test eax, eax
je 0x5856ac
lea esp, [esp]
mov eax, dword [esi + 0x5c8]
mov esi, dword [eax + edi*4]
test dword [esi + 0x116], 0x100000
jne 0x58568e
cmp esi, ebx
jae 0x585661
mov eax, dword [ebp - 0x24]
cmp eax, esi
ja 0x585661
sub esi, eax
mov eax, 0xdd67c8a7
imul esi
add edx, esi
sar edx, 8
mov esi, edx
shr esi, 0x1f
add esi, edx
cmp ebx, dword [ebp - 0x1c]
jne 0x585656
push ecx
lea ecx, [ebp - 0x24]
call fcn.00587db0
mov ebx, dword [ebp - 0x20]
imul esi, esi, 0x128
add esi, dword [ebp - 0x24]
jmp 0x585672
cmp ebx, dword [ebp - 0x1c]
jne 0x585672
push ecx
lea ecx, [ebp - 0x24]
call fcn.00587db0
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x585682
mov ecx, 0x4a
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x10]
add ebx, 0x128
inc dword [ebp - 0x14]
mov dword [ebp - 0x20], ebx
mov esi, dword [ebp - 0x18]
inc edi
mov dword [ebp - 0x10], edi
mov eax, dword [esi + 0x5cc]
sub eax, dword [esi + 0x5c8]
sar eax, 2
cmp edi, eax
jb 0x585610
mov edi, dword [ebp - 0x24]
mov eax, 0xdd67c8a7
sub ebx, edi
imul ebx
add edx, ebx
sar edx, 8
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
je 0x5856f8
add esi, 0x5c4
mov dword [ebp - 0x18], esi
mov esi, edi
mov edi, dword [ebp - 0x18]
push esi
mov ecx, edi
call fcn.0059a3b0
test byte [esi + 0x116], 1
je 0x5856ec
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esi, 0x128
dec ebx
jne 0x5856d4
mov edi, dword [ebp - 0x24]
push dword [ebp - 0x14]
push str.removed__d_files_n
call fcn.00589be0
add esp, 8
test edi, edi
je 0x585715
push edi
call fcn.0058bcf0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x585730
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x618
mov eax, dword [0x6a1da0]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push str.siamexe.exe
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x110]
push 0x675754
push eax
call fcn.0057dee0
push str.WarZ_Siam_MMO__Survivor_Stories
lea eax, [ebp - 0x618]
push str.Allow_network_traffic_for__s
push eax
call fcn.0057df00
add esp, 0x1c
lea eax, [ebp - 0x618]
lea ecx, [ebp - 0x110]
push eax
call fcn.0057db90
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
call fcn.005aed03
mov esp, ebp
pop ebp
ret
Function at 0x585c20
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x6a1da0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push str.Making_sure_extracted_files_exists_n
mov edi, ecx
call fcn.00589be0
add esp, 4
lea ecx, [edi + 0x4c0]
push 1
push 1
call fcn.00599b90
mov eax, dword [edi + 0x5cc]
xor ebx, ebx
sub eax, dword [edi + 0x5c8]
sar eax, 2
test eax, eax
je 0x585d03
push esi
lea ecx, [ecx]
mov eax, dword [edi + 0x5c8]
mov esi, dword [eax + ebx*4]
test byte [esi + 0x116], 1
je 0x585cea
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x40c]
push eax
push esi
call fcn.0058abb0
add esp, 0xc
test al, al
je 0x585cb9
mov eax, dword [ebp - 0x40c]
cmp eax, dword [esi + 0x10e]
jne 0x585cb9
mov eax, dword [ebp - 0x408]
cmp eax, dword [esi + 0x106]
je 0x585cea
push esi
push str.restoring__s_n
call fcn.00589be0
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
call dword [sym.imp.dbghelp.dll_MakeSureDirectoryPathExists]
push 0x6758d4
push esi
lea ecx, [edi + 0x4c0]
call fcn.00599170
test al, al
je 0x585d2b
mov eax, dword [edi + 0x5cc]
inc ebx
sub eax, dword [edi + 0x5c8]
sar eax, 2
cmp ebx, eax
jb 0x585c70
pop esi
lea ecx, [edi + 0x4c0]
call fcn.00598e70
push str.Making_sure_extracted_files_exists___finished_n
call fcn.00589be0
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop edi
pop ebx
call fcn.005aed03
mov esp, ebp
pop ebp
ret
push esi
lea eax, [ebp - 0x404]
push str.Cant_extract_file__s_nPlease_delete_this_file_manually
push eax
call fcn.0057df00
add esp, 0xc
lea eax, [ebp - 0x404]
push eax
push edi
call fcn.00584780
int3
Function at 0x586380
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ccb10
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x6a1da0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
cmp dword [esi + 0x20d84], 0
je 0x5863d9
push 0
push 0x33b
push str.Updater.cpp
push str.status___STATUS_Checking
call fcn.0058a0b0
add esp, 0x10
mov ecx, esi
call fcn.005847e0
mov ecx, esi
call fcn.00584a00
test al, al
je 0x586404
mov ecx, esi
call fcn.00584a70
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov byte [esi + 0x84], 1
cmp dword [esi + 0x20d84], 5
push 0x674dcc
sete al
lea eax, [eax*2 + 3]
mov dword [esi + 0x20d84], eax
lea eax, [esi + 0x20d8d]
push eax
call fcn.0057df00
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 8
mov edi, edi
cmp dword [esi + 0x20d84], 5
jne 0x5864ef
mov eax, dword [esi + 0x21778]
mov dword [0x74e290], eax
mov eax, dword [esi + 0x2177c]
mov dword [0x74e294], eax
mov eax, dword [0x74e2a0]
or eax, dword [0x74e2a4]
je 0x586498
call fcn.0057e950
test al, al
je 0x586498
push 0
push 0
push 0x74e290
push 0x57e570
push 0
push 0
call fcn.005af68e
add esp, 0x18
mov dword [0x74e458], eax
mov ecx, esi
call fcn.00584d20
mov ecx, esi
call fcn.00584ed0
push dword [esi + 0x18]
push dword [esi + 0x5c4]
push str.current_build_version_d__updater_data_version_d_n
call fcn.00589be0
mov eax, dword [esi + 0x5c4]
add esp, 0xc
mov ecx, esi
cmp eax, dword [esi + 0x18]
jne 0x5864ce
call fcn.005862b0
call fcn.00585130
mov ecx, esi
call fcn.005858e0
mov ecx, esi
call fcn.00586210
mov ecx, esi
call fcn.005861b0
mov ecx, esi
call fcn.005862b0
push 0x32
call edi
jmp 0x586440

Function at 0x587140
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
lea ecx, [esi + 0x215f8]
call fcn.00583bf0
push 0
push 0
push esi
push 0x586da0
push 0
push 0
call fcn.005af68e
add esp, 0x18
mov dword [esi + 0x215f0], eax
pop esi
ret

Function at 0x5872c0
Capabilities:
Create thread

Disassembly:
push esi
push edi
mov edi, ecx
lea edx, [edi + 0x21990]
mov esi, edx
lea ecx, [esi + 1]
nop
mov al, byte [esi]
inc esi
test al, al
jne 0x5872d0
sub esi, ecx
cmp esi, 0x13
je 0x587306
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x5872e1
sub edx, ecx
cmp edx, 0x1d
je 0x587306
push 0
push str.Create_Account
push str.Please_enter_Serial_Key_in_following_format:_nXXXX_XXXX_XXXX_XXXX_or_XXXXX_XXXXX_XXXXX_XXXXX_XXXXX
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
ret
push 0
push 0
push edi
push 0x587170
push 0
push 0
call fcn.005af68e
add esp, 0x18
mov dword [edi + 0x215f0], eax
pop edi
pop esi
ret