joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401c20
Capabilities:
Copy file

Disassembly:
sub esp, 0x614
mov eax, dword [0x6ade1c]
xor eax, esp
mov dword [esp + 0x610], eax
push esi
push edi
push 0x104
lea eax, [esp + 0x118]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x114]
push 0x5c
push ecx
call fcn.0058e710
mov esi, eax
inc esi
add esp, 8
cmp esi, 1
jne 0x401c7b
push 0
push 0x14
push str..GenerateUpdaterXML.cpp
push str._DWORD_fname___1
call fcn.00568720
add esp, 0x10
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x11c]
push ecx
call fcn.00569130
add esp, 0xc
test al, al
jne 0x401cae
lea edx, [esp + 0x114]
push edx
push str.failed_to_get_crc_for__s_n
call fcn.005685e0
add esp, 8
push str.1.0.8
push esi
lea eax, [esp + 0x18]
push str._s__s.exe
push eax
call fcn.00401db0
add esp, 0x10
push 0
lea ecx, [esp + 0x14]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x401ceb
lea edx, [esp + 0x10]
push edx
push esi
push str.unable_to_copy__s___s_n
call fcn.005685e0
add esp, 0xc
push 0x2f
push str.http:__103.253.73.36_GHO_API_CBT_updater_gho_lc.xml
call fcn.0058e710
mov esi, eax
add esp, 8
test esi, esi
jne 0x401d15
push eax
push 0x21
push str..GenerateUpdaterXML.cpp
push str.updater_file
call fcn.00568720
add esp, 0x10
lea edi, [esi + 1]
push 0x680394
push edi
call fcn.00569640
mov esi, eax
push str._p__n
push esi
call fcn.0058e73d
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
push eax
push str.1.0.8
push ecx
lea edx, [esp + 0x2c]
push edx
push str.http:__103.253.73.36_GHO_API_CBT_updater_
push str.__u_url__s_s__crc__u__ver__s__size__u____n
push esi
call fcn.0058e73d
push str.__p__n
push esi
call fcn.0058e73d
push esi
call fcn.0058e8d0
lea eax, [esp + 0x48]
push eax
push edi
lea ecx, [esp + 0x258]
push str.XML__s_generated_nnew_exe:_s
push ecx
call fcn.00401dd0
add esp, 0x48
push 0
push str.Updater_XML
lea edx, [esp + 0x220]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x618]
pop edi
pop esi
xor ecx, esp
call fcn.0058e447
add esp, 0x614
ret
Function at 0x402e50
Capabilities:
Get common file path

Disassembly:
sub esp, 0xb14
mov eax, dword [0x6ade1c]
xor eax, esp
mov dword [esp + 0xb10], eax
push 0x104
lea eax, [esp + 0x210]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp]
push ecx
lea edx, [esp + 0x10c]
push edx
push 0x104
lea eax, [esp + 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
mov eax, dword [esp]
test eax, eax
je 0x402ea3
mov byte [eax - 1], 0
lea ecx, [esp + 4]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea edx, [esp + 4]
push edx
lea eax, [esp + 0x10c]
push eax
call fcn.00591e0c
add esp, 8
test eax, eax
je 0x402f05
lea ecx, [esp + 0x108]
push ecx
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x318]
push str.Updater_current_directory___s__is_different_from_working_directory___s_
push eax
call fcn.00405a80
add esp, 0x10
push 0x30
push str.Warning
lea ecx, [esp + 0x318]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0xb10]
xor ecx, esp
mov al, 1
call fcn.0058e447
add esp, 0xb14
ret

Function at 0x402fa0
Capabilities:
Inspect load icon resource
Terminate process

Disassembly:
mov eax, dword [0x6b4bd8]
push 5
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
push str._generate
push 0x6b47b0
mov dword [0x6b4be0], eax
mov dword [0x6acc00], 0
call fcn.0058f070
add esp, 8
test eax, eax
je 0x402fe8
call fcn.00401c20
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
ret
call fcn.00402dc0
test al, al
jne 0x402fd8
call fcn.00402e50
call fcn.00402f20
test al, al
jne 0x403023
push 0x40
push str.UAC_problem
push str.Updater_must_be_run_from_administrator
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
ret
call fcn.004066b0
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0x759ce0
push 0x6806d8
push 0x17
push 0
push 0x65e85c
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jge 0x403057
mov dword [0x759ce0], 0
push str._cmdLine
push 0x6b47b0
call fcn.0058f070
add esp, 8
test eax, eax
je 0x403074
mov byte [0x759cdc], 1
push esi
mov esi, dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f00
push 0
call esi
push 0x7f89
push 0
mov dword [0x759c3c], eax
call esi
push 0x209
push 0x759d80
push 0x12f
push 0
mov dword [0x759c38], eax
call dword [sym.imp.USER32.dll_LoadStringW]
pop esi
ret
Function at 0x403c40
Capabilities:
Hide graphical window
Inspect load icon resource

Disassembly:
push 0xffffffffffffffff
push 0x5dd3fe
mov eax, dword fs:[0]
push eax
sub esp, 0x208
mov eax, dword [0x6ade1c]
xor eax, esp
mov dword [esp + 0x204], eax
push ebx
push esi
push edi
mov eax, dword [0x6ade1c]
xor eax, esp
push eax
lea eax, [esp + 0x218]
mov dword fs:[0], eax
cmp byte [0x759cdc], 0
je 0x403cc8
call dword [sym.imp.KERNEL32.dll_AllocConsole]
call fcn.0058fa12
add eax, 0x20
push eax
push 0x680784
push 0x680a4c
call fcn.0058f9ec
call fcn.0058fa12
push eax
push 0x680a54
push str.CONIN_
call fcn.0058f9ec
add esp, 0x18
mov dword [0x6b4c58], 1
jmp 0x403e3d
call fcn.004025a0
mov eax, dword [0x6b4bd8]
push 5
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov ecx, dword [0x6b4bdc]
push eax
push 0
push 0x80
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edx, dword [0x6b4bdc]
push 0x800000
push 0
push edx
call fcn.00567bb0
mov eax, dword [0x6b4bdc]
push 0xc00000
push 0
push eax
call fcn.00567bb0
mov ecx, dword [0x6b4bdc]
add esp, 0x18
push 0x403ab0
push 0xfffffffffffffffc
push ecx
call dword [sym.imp.USER32.dll_SetWindowLongA]
call fcn.005722a0
push 0
push 0
push 0
push str.DISPLAY
call dword [sym.imp.GDI32.dll_CreateICA]
mov edi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov esi, eax
push 8
push esi
call edi
push 0xa
push esi
mov ebx, eax
call edi
mov esi, eax
lea eax, [ebx - 0x400]
cdq
sub eax, edx
mov ecx, eax
push 0
lea eax, [esi - 0x294]
cdq
push 0x294
sub eax, edx
mov edx, dword [0x6b4bdc]
push 0x400
sar eax, 1
push eax
sar ecx, 1
push ecx
push 0
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0x102660
call fcn.0056a340
add esp, 4
mov dword [esp + 0x10], eax
mov dword [esp + 0x220], 0
test eax, eax
je 0x403db6
mov ecx, eax
call fcn.0056fc00
jmp 0x403db8
xor eax, eax
mov dword [esp + 0x220], 0xffffffff
mov ecx, dword [0x6b4bdc]
push 0
push ecx
mov ecx, eax
mov dword [0x6b4c44], eax
call fcn.0056b4b0
call fcn.004030b0
push str.Oct__4_2024_22:25:06
push str.1.0.8
lea edx, [esp + 0x1c]
push str.GhostOnlineTH_MMO_RPG_Launcher__s___s_
push edx
call fcn.00405aa0
mov ecx, dword [0x6b4bdc]
add esp, 0x10
lea eax, [esp + 0x14]
push eax
push ecx
call dword [sym.imp.USER32.dll_SetWindowTextA]
call fcn.00403450
mov edx, dword [0x6b4bdc]
push 5
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
call dword [sym.imp.USER32.dll_ClipCursor]
mov ecx, dword [0x6b4c4c]
call fcn.00575ac0
mov ecx, dword [0x6b4c48]
call fcn.00575d00
mov ecx, dword [esp + 0x218]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x204]
xor ecx, esp
call fcn.0058e447
add esp, 0x214
ret
Function at 0x404940
Capabilities:
Create process on windows

Disassembly:
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
mov eax, 0x30c30c31
imul ecx
sub esp, 0x24
sar edx, 4
push ebx
mov eax, edx
shr eax, 0x1f
push ebp
xor ebx, ebx
add eax, edx
push edi
je 0x404afd
xor ebp, ebp
jmp 0x404970
cmp ebp, 0x2f4
jae 0x404afd
cmp ebx, eax
jb 0x404985
call fcn.0058f903
mov eax, dword [esi + 0xc]
add eax, ebp
cmp dword [eax + 0x18], 0x10
jb 0x404995
mov eax, dword [eax + 4]
jmp 0x404998
add eax, 4
mov edi, dword [0x759d68]
mov ecx, eax
push ecx
mov dword [esp + 0x14], eax
call fcn.00403ee0
fld dword [esp + 0x38]
fsub qword [0x682350]
add esp, 4
mov dword [esp + 0x14], 0xffffffff
fstp dword [esp + 0x18]
fld dword [esp + 0x18]
fstp dword [esp + 0x24]
fild dword [0x759d70]
fstp dword [esp + 0x1c]
fld dword [0x682348]
fld dword [esp + 0x1c]
fcom st(1)
fnstsw ax
fstp st(1)
test ah, 1
jne 0x404a8b
fcomp qword [0x682340]
fnstsw ax
test ah, 0x41
jp 0x404a8d
fild dword [0x759d74]
fstp dword [esp + 0x1c]
fld dword [esp + 0x1c]
fld dword [esp + 0x24]
fcom st(1)
fnstsw ax
test ah, 0x41
jp 0x404a89
fadd qword [0x682338]
fcompp
fnstsw ax
test ah, 1
jne 0x404a8d
cmp dword [0x759d78], 0
mov dword [esp + 0x14], 0xfffad800
je 0x404a8d
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
mov eax, 0x30c30c31
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebx, eax
jb 0x404a5a
call fcn.0058f903
mov ecx, dword [esi + 0xc]
cmp dword [ecx + ebp + 0x34], 0x10
lea eax, [ecx + ebp + 0x1c]
jb 0x404a6d
mov eax, dword [eax + 4]
jmp 0x404a70
add eax, 4
push 5
push 0
push 0x680a4a
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x404a8d
fstp st(1)
fstp st(0)
mov edx, dword [esp + 0x10]
fld dword [0x682320]
mov ecx, dword [0x759d68]
push 1
push edx
lea eax, [esp + 0x1c]
push eax
sub esp, 0x10
fstp dword [esp + 0xc]
fld dword [0x68231c]
fstp dword [esp + 8]
fld dword [esp + 0x34]
fstp dword [esp + 4]
fld dword [0x682330]
fstp dword [esp]
call fcn.00571150
mov ecx, dword [esi + 0x10]
fld dword [esp + 0x34]
sub ecx, dword [esi + 0xc]
fadd qword [0x682328]
mov eax, 0x30c30c31
imul ecx
fstp dword [esp + 0x34]
sar edx, 4
mov eax, edx
shr eax, 0x1f
inc ebx
add eax, edx
add ebp, 0x54
cmp ebx, eax
jb 0x404970
pop edi
pop ebp
pop ebx
add esp, 0x24
ret
Function at 0x404de0
Capabilities:
Hash data using crc32b

Disassembly:
push 0x400
push 0
push 0x759620
call fcn.00591e60
add esp, 0xc
push esi
xor edx, edx
push edi
xor eax, eax
test dl, 1
je 0x404e04
mov eax, 0x80
mov ecx, edx
shr ecx, 1
test cl, 1
je 0x404e10
or eax, 0x40
shr ecx, 1
test cl, 1
je 0x404e1a
or eax, 0x20
shr ecx, 1
test cl, 1
je 0x404e24
or eax, 0x10
shr ecx, 1
test cl, 1
je 0x404e2e
or eax, 8
shr ecx, 1
test cl, 1
je 0x404e38
or eax, 4
shr ecx, 1
test cl, 1
je 0x404e42
or eax, 2
test cl, 2
je 0x404e4a
or eax, 1
shl eax, 0x18
mov ecx, eax
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
xor esi, esi
mov dword [edx*4 + 0x759620], ecx
mov eax, ecx
lea ecx, [esi + 0x1f]
test al, 1
je 0x404f10
mov edi, 1
shl edi, cl
or esi, edi
dec ecx
shr eax, 1
cmp ecx, 0xffffffff
jg 0x404f03
mov dword [edx*4 + 0x759620], esi
inc edx
cmp edx, 0xff
jle 0x404df8
pop edi
pop esi
ret

Function at 0x404f30
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
sub esp, 0x404
mov eax, dword [0x6ade1c]
xor eax, esp
mov dword [esp + 0x400], eax
mov eax, dword [esp + 0x408]
push esi
push edi
push 0x6809ac
push eax
or esi, 0xffffffff
call fcn.0058f010
mov edi, eax
add esp, 8
test edi, edi
jne 0x404f69
or eax, 0xffffffff
jmp 0x404fc3
push ebx
push ebp
jmp 0x404f70
push edi
push 0x400
lea eax, [esp + 0x18]
push 1
push eax
call fcn.0058f789
add esp, 0x10
mov ecx, eax
lea edx, [esp + 0x10]
test eax, eax
je 0x404fad
nop
movzx ebp, byte [edx]
mov ebx, esi
and ebx, 0xff
xor ebx, ebp
shr esi, 8
xor esi, dword [ebx*4 + 0x759620]
dec ecx
inc edx
test ecx, ecx
jne 0x404f90
cmp eax, 0x400
je 0x404f70
push edi
call fcn.0058e8d0
add esp, 4
mov eax, esi
pop ebp
not eax
pop ebx
mov ecx, dword [esp + 0x408]
pop edi
pop esi
xor ecx, esp
call fcn.0058e447
add esp, 0x404
ret 4
Function at 0x405050
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x5dd3bb
mov eax, dword fs:[0]
push eax
sub esp, 0x848
mov eax, dword [0x6ade1c]
xor eax, esp
mov dword [esp + 0x840], eax
push esi
push edi
mov eax, dword [0x6ade1c]
xor eax, esp
push eax
lea eax, [esp + 0x854]
mov dword fs:[0], eax
mov dword [0x759a20], 1
mov dword [0x759a2c], 0x73be2c58
call fcn.00404de0
mov edi, 0x148cf71b
lea esi, [esp + 0x1f]
call fcn.00405b80
push eax
call fcn.00404f30
cmp eax, dword [0x759a2c]
je 0x4050c3
call fcn.00404fe0
mov eax, dword [esp + 0x864]
cmp dword [eax + 0x20dd0], 0
je 0x4050e1
call fcn.004012e0
cmp eax, 1
jne 0x405190
push str.Starting_game_n
call fcn.00568410
inc dword [0x6b4c80]
add esp, 4
push 6
push 0
mov dword [esp + 0x864], 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x1c]
push edx
push str.Game.exe
call fcn.00569130
add esp, 0xc
test al, al
jne 0x405133
push str.failed1_n
call fcn.00568410
add esp, 4
jmp 0x40514a
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
push eax
push ecx
push str._08x__d_n
call fcn.00568410
add esp, 0xc
mov edi, 0x148cf753
lea esi, [esp + 0x2c]
call fcn.00405bc0
push eax
lea edx, [esp + 0x50]
push edx
call fcn.00405a80
add esp, 8
push 5
push 0
lea eax, [esp + 0x54]
push eax
push str.Game.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp dword [0x6b4c80], 0
je 0x405190
dec dword [0x6b4c80]
mov ecx, dword [esp + 0x854]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x840]
xor ecx, esp
call fcn.0058e447
add esp, 0x854
ret
Function at 0x405b80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, 0x9d
xor ecx, ecx
jmp 0x405b90
mov al, byte [edi + ecx - 0x1424ed6b]
xor al, dl
inc edx
and edx, 0x800000ff
mov byte [ecx + esi], al
jns 0x405bad
dec edx
or edx, 0xffffff00
inc edx
inc ecx
cmp ecx, 0xc
jl 0x405b90
mov byte [esi + 0xc], 0
mov eax, esi
ret

Function at 0x4060f0
Capabilities:
Set console window title

Disassembly:
sub esp, 0x218
mov eax, dword [0x6ade1c]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
push esi
push edi
mov esi, ecx
call fcn.0040a8f0
call fcn.00568150
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
nop
call fcn.005681a0
call fcn.00568150
push 0x64
call edi
cmp dword [esi + 0x20dec], 3
jne 0x406141
mov dword [esi + 0x20dec], 5
cmp dword [esi + 0x20df0], 0
jne 0x4061c8
mov eax, dword [esi + 0x215f8]
mov ecx, dword [esi + 0x215fc]
mov dword [esp + 0x10], eax
or eax, ecx
mov dword [esp + 0x14], ecx
jne 0x406166
fldz
jmp 0x40618f
fild qword [esi + 0x21600]
fild qword [esp + 0x10]
fdivp st(1)
fstp dword [esp + 0xc]
fld1
fcom dword [esp + 0xc]
fnstsw ax
test ah, 5
jp 0x406189
fstp dword [esp + 0xc]
jmp 0x40618b
fstp st(0)
fld dword [esp + 0xc]
fstp dword [esp + 0xc]
sub esp, 8
fld dword [esp + 0x14]
lea eax, [esi + 0x20df5]
fmul qword [0x6823a8]
lea ecx, [esp + 0x20]
fstp qword [esp]
push eax
push str._s:__.1f__
push ecx
call fcn.00405aa0
add esp, 0x14
lea edx, [esp + 0x18]
push edx
call ebx
jmp 0x406120
mov eax, esi
call fcn.0040aa20
mov eax, dword [esi + 0x20df0]
sub eax, 1
je 0x406212
sub eax, 1
je 0x4061fc
sub eax, 1
je 0x40621f
push 0
push 0x37
push str..Main_CmdLine.cpp
push 0x680a48
call fcn.00568720
add esp, 0x10
jmp 0x40621f
add esi, 0x211f5
push esi
push str.Update_error_n_s_n_nPlease_retry_later
call fcn.00568410
add esp, 8
jmp 0x40621f
push str.Update_ok_n
call fcn.00568410
add esp, 4
push str._nPress_enter_to_exit...
call fcn.00568410
add esp, 4
call fcn.0058fbd4
mov ecx, dword [esp + 0x21c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0058e447
add esp, 0x218
ret
Function at 0x4066b0
Capabilities:
Copy file
Create process on windows
Delete file
Move file
Terminate process

Disassembly:
sub esp, 0x60c
mov eax, dword [0x6ade1c]
xor eax, esp
mov dword [esp + 0x608], eax
push 0x104
lea eax, [esp + 4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp]
push str..new.exe
push ecx
call fcn.0058f070
add esp, 8
test eax, eax
jne 0x406729
lea edx, [esp]
push edx
lea eax, [esp + 0x108]
push str._s.new.exe
push eax
call fcn.00401db0
add esp, 0xc
lea ecx, [esp + 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor al, al
mov ecx, dword [esp + 0x608]
xor ecx, esp
call fcn.0058e447
add esp, 0x60c
ret
push str..exe_updated__moving_back_n
mov byte [0x75a192], 1
call fcn.00568410
add esp, 4
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
lea ebx, [ebx]
mov cl, byte [esp + eax]
mov byte [esp + eax + 0x104], cl
inc eax
test cl, cl
jne 0x406750
lea eax, [esp]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x406765
sub eax, edx
cmp eax, 8
ja 0x406789
push 0
push 0x31
push str..SelfUpdateEXE.cpp
push str.strlen_exeMain____8
call fcn.00568720
add esp, 0x10
lea eax, [esp]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x406790
push ebx
push ebp
push esi
sub eax, edx
push edi
lea edx, [esp + 0x10]
push edx
push str.exeMain:__s_n
mov byte [esp + eax + 0x10], cl
call fcn.00568410
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileA]
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
add esp, 8
xor esi, esi
lea eax, [esp + 0x10]
push eax
call edi
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x118]
push edx
call ebx
test eax, eax
jne 0x40686b
push eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x11c]
push ecx
call ebp
test eax, eax
jne 0x40686b
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0xa
jl 0x4067c7
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x118]
push eax
lea ecx, [esp + 0x220]
push str.Failed_to_replace_updater_file_n_nPlease_manually_rename__s_to__s
push ecx
call fcn.00401dd0
add esp, 0x10
push 0x30
push str.Updater
lea edx, [esp + 0x220]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 5
push 0
push 0
push 0x680884
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor al, al
jmp 0x40686d
mov al, 1
mov ecx, dword [esp + 0x618]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0058e447
add esp, 0x60c
ret
Function at 0x406890
Capabilities:
Create process on windows
Terminate process
Write and execute a file
Write file on windows

Disassembly:
sub esp, 0x20c
mov eax, dword [0x6ade1c]
xor eax, esp
mov dword [esp + 0x208], eax
push esi
push 0x104
lea eax, [esp + 0x10c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push str.Trying_to_update_n
call fcn.00568410
lea ecx, [esp + 0x10c]
push ecx
lea edx, [esp + 0xc]
push str._s.new.exe
push edx
call fcn.00401db0
lea eax, [esp + 0x14]
push 0x680784
push eax
call fcn.0058f010
mov esi, eax
add esp, 0x18
test esi, esi
jne 0x406905
lea ecx, [esp + 4]
push ecx
push str.cant_open__s_for_writing_n
call fcn.005685e0
add esp, 8
mov edx, dword [esp + 0x214]
push esi
push 1
push edx
push edi
call fcn.0058fd3b
push esi
call fcn.0058e8d0
mov eax, dword [0x759ce4]
add esp, 0x14
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 4]
push ecx
push str.executing__s_n
call fcn.00568410
add esp, 8
push 5
push 0
push 0x6b47b0
lea edx, [esp + 0x10]
push edx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
pop esi
jge 0x406971
push eax
lea eax, [esp + 4]
push eax
push str.failed_to_launch__s___d
call fcn.005685e0
add esp, 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [esp + 0x208]
xor ecx, esp
mov al, 1
call fcn.0058e447
add esp, 0x20c
ret
Function at 0x406e00
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x5dce98
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push ebx
push edi
mov eax, dword [0x6ade1c]
xor eax, esp
push eax
lea eax, [esp + 0x4c]
mov dword fs:[0], eax
fldz
lea ecx, [esp + 0x14]
fst dword [esi]
mov dword [esi + 8], 0
fstp dword [esi + 4]
call fcn.0040d440
lea ecx, [esp + 0x14]
mov dword [esp + 0x54], 0
call fcn.0040d6b0
movzx eax, word [esp + 0x5c]
push 0x680f08
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x406f3d
push edi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x406f3d
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push ebx
lea ecx, [esp + 0x1c]
call fcn.0040d830
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x18]
call fcn.0040d6e0
push eax
lea ecx, [esp + 0x1c]
call fcn.0040d710
mov ecx, dword [0x6b4c44]
push eax
add ecx, 0x50
call fcn.0056af60
push eax
call sub.d3dx9_43.dll_D3DXCreateTextureFromFileInMemory
test eax, eax
jne 0x406f3d
mov ecx, dword [0x6b4c44]
call fcn.0057a570
push 1
push 1
push 0x16
push 4
push 4
mov ecx, eax
mov dword [esi + 8], eax
call fcn.0057c190
mov edx, dword [esp + 0x10]
mov ecx, dword [esi + 8]
push edx
call fcn.0057c000
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
lea edx, [esp + 0x28]
push edx
push 0
push eax
mov eax, dword [ecx + 0x44]
call eax
fild dword [esp + 0x60]
mov ecx, dword [esp + 0x40]
fild dword [esp + 0x40]
test ecx, ecx
jge 0x406f1e
fadd dword [0x6822ec]
fdivp st(1)
mov edx, dword [esp + 0x44]
fstp dword [esi]
fild dword [esp + 0x64]
fild dword [esp + 0x44]
test edx, edx
jge 0x406f38
fadd dword [0x6822ec]
fdivp st(1)
fstp dword [esi + 4]
lea ecx, [esp + 0x14]
mov dword [esp + 0x54], 0xffffffff
call fcn.0040d4f0
mov eax, esi
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x4c
ret 0xc
Function at 0x408680
Capabilities:
Delete file
Write file on windows

Disassembly:
sub esp, 0x41c
mov eax, dword [0x6ade1c]
xor eax, esp
mov dword [esp + 0x414], eax
push ebx
push ebp
lea eax, [esp + 0x14]
mov ebx, ecx
push eax
lea ecx, [esp + 0x14]
push ecx
push esi
call fcn.00569130
add esp, 0xc
test al, al
je 0x4086bf
mov edx, dword [esp + 0x10]
cmp edx, dword [esi + 0x10a]
je 0x4087a5
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
call dword [sym.imp.dbghelp.dll_MakeSureDirectoryPathExists]
push 0x680784
push esi
call fcn.0058f010
mov ebp, eax
add esp, 8
test ebp, ebp
jne 0x408700
push esi
lea eax, [esp + 0x1c]
push str.Cant_replace_file__s_nPlease_delete_this_file_manually
push eax
call fcn.00401dd0
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
mov eax, edi
call fcn.00407ac0
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x10]
push eax
mov ecx, ebx
call fcn.0040d6e0
push eax
mov ecx, ebx
call fcn.0040d710
push eax
push esi
lea ecx, [edi + 0x4e0]
call fcn.00576770
mov ecx, dword [esi + 0x106]
cmp ecx, dword [esp + 8]
je 0x40874b
push 0
push 0x1a1
push str..Updater.cpp
push str.fe__size__out_size
call fcn.00568720
add esp, 0x10
lea ebx, [edi + 0x20dd4]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, dword [esp + 8]
mov eax, dword [esp + 0xc]
push ebp
push 1
push edx
push eax
call fcn.0058fd3b
push ebp
call fcn.0058e8d0
add esp, 0x14
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push str.Game.exe
push esi
call fcn.00591e0c
add esp, 8
test eax, eax
jne 0x408798
mov byte [edi + 0x21898], 1
call fcn.00408a10
mov ecx, dword [esp + 0xc]
push ecx
call fcn.0056a360
add esp, 4
mov ecx, dword [esp + 0x41c]
pop ebp
pop ebx
xor ecx, esp
call fcn.0058e447
add esp, 0x41c
ret