joyce8/EMBER2024-capa huggingface dataset:
Function at 0x583850
Capabilities:
Copy file
Create process on windows
Delete file
Move file
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60c
mov eax, dword [0x6a1da0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x108]
push str..new.exe
push eax
call fcn.005affe0
add esp, 8
test eax, eax
jne 0x5838c7
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push str._s.new.exe
push eax
call fcn.0057de20
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005af263
mov esp, ebp
pop ebp
ret
push edi
push str..exe_updated__moving_back_n
mov byte [0x74db42], 1
call fcn.0058a180
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 4
push 0x1f4
call edi
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.005afafd
lea ecx, [ebp - 0x108]
add esp, 0xc
lea edx, [ecx + 1]
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x583910
sub ecx, edx
cmp ecx, 8
ja 0x583934
push 0
push 0x31
push str.SelfUpdateEXE.cpp
push str.strlen_exeMain____8
call fcn.0058a650
add esp, 0x10
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x583940
sub ecx, edx
add ecx, 0xfffffff8
cmp ecx, 0x104
jae 0x583a51
push ebx
mov byte [ebp + ecx - 0x108], al
lea eax, [ebp - 0x108]
push esi
push eax
push str.exeMain:__s_n
call fcn.0058a180
mov ebx, dword [sym.imp.KERNEL32.dll_CopyFileA]
add esp, 8
xor esi, esi
lea ecx, [ecx]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x583a3e
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
call ebx
test eax, eax
jne 0x583a3e
push 0x64
call edi
inc esi
cmp esi, 0xa
jl 0x583980
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x60c]
push str.Failed_to_replace_updater_file_n_nPlease_manually_rename__s_to__s
push eax
call fcn.0057de40
add esp, 0x10
lea eax, [ebp - 0x60c]
push 0x30
push str.Updater
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 5
push 0
push 0
push 0x674df0
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
pop ebx
xor al, al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005af263
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop esi
pop ebx
xor ecx, ebp
pop edi
call fcn.005af263
mov esp, ebp
pop ebp
ret
call fcn.005b0c58
int3
Function at 0x583a60
Capabilities:
Create process on windows
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x6a1da0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x104
lea eax, [ebp - 0x20c]
mov edi, edx
push eax
push 0
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push str.Trying_to_update_n
call fcn.0058a180
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push str._s.new.exe
push eax
call fcn.0057de20
lea eax, [ebp - 0x108]
push 0x6749dc
push eax
call fcn.005aff7b
mov esi, eax
add esp, 0x18
test esi, esi
jne 0x583ade
lea eax, [ebp - 0x108]
push eax
push str.cant_open__s_for_writing_n
call fcn.00589da0
add esp, 8
push esi
push 1
push edi
push ebx
call fcn.005b1193
push esi
call fcn.005af955
add esp, 0x14
push dword [0x74dbe0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x108]
push eax
push str.executing__s_n
call fcn.0058a180
add esp, 8
lea eax, [ebp - 0x108]
push 5
push 0
push 0x6a9960
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
pop ebx
cmp eax, 0x20
jge 0x583b4b
push eax
lea eax, [ebp - 0x108]
push eax
push str.failed_to_launch__s___d
call fcn.00589da0
add esp, 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
call fcn.005af263
mov esp, ebp
pop ebp
ret

Function at 0x583de0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
push esi
push eax
mov esi, ecx
push 0xf003f
push 0
push str.SoftwareCodex_Development_GroupWarZ_Siam_MMO
mov byte [esi], 0
mov byte [esi + 0x64], 0
mov dword [esi + 0x168], 0
mov dword [esi + 0x16c], 0
mov dword [esi + 0x170], 0
push bind
mov dword [esi + 0x174], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x583e5e
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x64
push eax
push esi
push 0
push 0
push str.username
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, esi
call fcn.00589090
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x585570
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x6a1da0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x41c]
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
push eax
lea eax, [ebp - 0x418]
push eax
push edi
call fcn.0058b150
add esp, 0xc
test al, al
je 0x5855bb
mov eax, dword [ebp - 0x418]
cmp eax, dword [edi + 0x10e]
je 0x58569d
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edi
call dword [sym.imp.dbghelp.dll_MakeSureDirectoryPathExists]
push 0x6749dc
push edi
call fcn.005aff7b
add esp, 8
mov dword [ebp - 0x410], eax
test eax, eax
je 0x5856b0
lea eax, [ebp - 0x414]
mov ecx, esi
push eax
lea eax, [ebp - 0x40c]
push eax
call fcn.004011c0
push eax
mov ecx, esi
call fcn.004011f0
push eax
push edi
lea ecx, [ebx + 0x4c0]
call fcn.0059ade0
mov eax, dword [edi + 0x106]
cmp eax, dword [ebp - 0x414]
je 0x585636
push 0
push 0x18b
push str.Updater.cpp
push str.fe__size__out_size
call fcn.0058a650
add esp, 0x10
lea esi, [ebx + 0x20d6c]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push dword [ebp - 0x410]
push 1
push dword [ebp - 0x414]
push dword [ebp - 0x40c]
call fcn.005b1193
push dword [ebp - 0x410]
call fcn.005af955
add esp, 0x14
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push str.siamexe.exe
push edi
call fcn.005b322b
add esp, 8
test eax, eax
jne 0x58568f
mov byte [ebx + 0x215ec], 1
call fcn.00585950
push dword [ebp - 0x40c]
call fcn.0058c2e0
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005af263
mov esp, ebp
pop ebp
ret 8
push edi
lea eax, [ebp - 0x408]
push str.Cant_replace_file__s_nPlease_delete_this_file_manually
push eax
call fcn.0057de40
add esp, 0xc
lea eax, [ebp - 0x408]
push eax
push ebx
call fcn.005849a0
int3
Function at 0x5857b0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ccfb8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x6a1da0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
push 0x400
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0
call fcn.00587f80
mov eax, dword [esi + 0x5cc]
xor edi, edi
sub eax, dword [esi + 0x5c8]
mov ebx, dword [ebp - 0x20]
sar eax, 2
mov dword [ebp - 0x10], edi
test eax, eax
je 0x5858cc
lea esp, [esp]
mov eax, dword [esi + 0x5c8]
mov esi, dword [eax + edi*4]
test dword [esi + 0x116], 0x100000
jne 0x5858ae
cmp esi, ebx
jae 0x585881
mov eax, dword [ebp - 0x24]
cmp eax, esi
ja 0x585881
sub esi, eax
mov eax, 0xdd67c8a7
imul esi
add edx, esi
sar edx, 8
mov esi, edx
shr esi, 0x1f
add esi, edx
cmp ebx, dword [ebp - 0x1c]
jne 0x585876
push ecx
lea ecx, [ebp - 0x24]
call fcn.00588020
mov ebx, dword [ebp - 0x20]
imul esi, esi, 0x128
add esi, dword [ebp - 0x24]
jmp 0x585892
cmp ebx, dword [ebp - 0x1c]
jne 0x585892
push ecx
lea ecx, [ebp - 0x24]
call fcn.00588020
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x5858a2
mov ecx, 0x4a
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x10]
add ebx, 0x128
inc dword [ebp - 0x14]
mov dword [ebp - 0x20], ebx
mov esi, dword [ebp - 0x18]
inc edi
mov dword [ebp - 0x10], edi
mov eax, dword [esi + 0x5cc]
sub eax, dword [esi + 0x5c8]
sar eax, 2
cmp edi, eax
jb 0x585830
mov edi, dword [ebp - 0x24]
mov eax, 0xdd67c8a7
sub ebx, edi
imul ebx
add edx, ebx
sar edx, 8
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
je 0x585918
add esi, 0x5c4
mov dword [ebp - 0x18], esi
mov esi, edi
mov edi, dword [ebp - 0x18]
push esi
mov ecx, edi
call fcn.0059aa00
test byte [esi + 0x116], 1
je 0x58590c
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esi, 0x128
dec ebx
jne 0x5858f4
mov edi, dword [ebp - 0x24]
push dword [ebp - 0x14]
push str.removed__d_files_n
call fcn.0058a180
add esp, 8
test edi, edi
je 0x585935
push edi
call fcn.0058c2e0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x585950
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x618
mov eax, dword [0x6a1da0]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push str.siamexe.exe
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x110]
push 0x6757cc
push eax
call fcn.0057de20
push str.WarZ_Siam_MMO__Survivor_Stories
lea eax, [ebp - 0x618]
push str.Allow_network_traffic_for__s
push eax
call fcn.0057de40
add esp, 0x1c
lea eax, [ebp - 0x618]
lea ecx, [ebp - 0x110]
push eax
call fcn.0057dad0
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
call fcn.005af263
mov esp, ebp
pop ebp
ret
Function at 0x585e30
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x6a1da0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push str.Making_sure_extracted_files_exists_n
mov edi, ecx
call fcn.0058a180
add esp, 4
lea ecx, [edi + 0x4c0]
push 1
push 1
call fcn.0059a1e0
mov eax, dword [edi + 0x5cc]
xor ebx, ebx
sub eax, dword [edi + 0x5c8]
sar eax, 2
test eax, eax
je 0x585f13
push esi
lea ecx, [ecx]
mov eax, dword [edi + 0x5c8]
mov esi, dword [eax + ebx*4]
test byte [esi + 0x116], 1
je 0x585efa
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x40c]
push eax
push esi
call fcn.0058b150
add esp, 0xc
test al, al
je 0x585ec9
mov eax, dword [ebp - 0x40c]
cmp eax, dword [esi + 0x10e]
jne 0x585ec9
mov eax, dword [ebp - 0x408]
cmp eax, dword [esi + 0x106]
je 0x585efa
push esi
push str.restoring__s_n
call fcn.0058a180
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
call dword [sym.imp.dbghelp.dll_MakeSureDirectoryPathExists]
push 0x67594c
push esi
lea ecx, [edi + 0x4c0]
call fcn.005997c0
test al, al
je 0x585f3b
mov eax, dword [edi + 0x5cc]
inc ebx
sub eax, dword [edi + 0x5c8]
sar eax, 2
cmp ebx, eax
jb 0x585e80
pop esi
lea ecx, [edi + 0x4c0]
call fcn.005994c0
push str.Making_sure_extracted_files_exists___finished_n
call fcn.0058a180
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop edi
pop ebx
call fcn.005af263
mov esp, ebp
pop ebp
ret
push esi
lea eax, [ebp - 0x404]
push str.Cant_extract_file__s_nPlease_delete_this_file_manually
push eax
call fcn.0057de40
add esp, 0xc
lea eax, [ebp - 0x404]
push eax
push edi
call fcn.005849a0
int3
Function at 0x586590
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5cd090
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x6a1da0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
cmp dword [esi + 0x20d84], 0
je 0x5865e9
push 0
push 0x33b
push str.Updater.cpp
push str.status___STATUS_Checking
call fcn.0058a650
add esp, 0x10
mov ecx, esi
call fcn.00584a00
mov ecx, esi
call fcn.00584c20
test al, al
je 0x586614
mov ecx, esi
call fcn.00584c90
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov byte [esi + 0x84], 1
cmp dword [esi + 0x20d84], 5
push 0x674e48
sete al
lea eax, [eax*2 + 3]
mov dword [esi + 0x20d84], eax
lea eax, [esi + 0x20d8d]
push eax
call fcn.0057de40
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 8
mov edi, edi
cmp dword [esi + 0x20d84], 5
jne 0x5866ff
mov eax, dword [esi + 0x21760]
mov dword [0x74e290], eax
mov eax, dword [esi + 0x21764]
mov dword [0x74e294], eax
mov eax, dword [0x74e2a0]
or eax, dword [0x74e2a4]
je 0x5866a8
call fcn.0057e890
test al, al
je 0x5866a8
push 0
push 0
push 0x74e290
push 0x57e4b0
push 0
push 0
call fcn.005afbee
add esp, 0x18
mov dword [0x74e458], eax
mov ecx, esi
call fcn.00584f40
mov ecx, esi
call fcn.005850f0
push dword [esi + 0x18]
push dword [esi + 0x5c4]
push str.current_build_version_d__updater_data_version_d_n
call fcn.0058a180
mov eax, dword [esi + 0x5c4]
add esp, 0xc
mov ecx, esi
cmp eax, dword [esi + 0x18]
jne 0x5866de
call fcn.005864c0
call fcn.00585350
mov ecx, esi
call fcn.00585b00
mov ecx, esi
call fcn.00586420
mov ecx, esi
call fcn.005863c0
mov ecx, esi
call fcn.005864c0
push 0x32
call edi
jmp 0x586650

Function at 0x587350
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x2176c], 1
jne 0x587372
push 0
push 0x3c
push str.c:warz2_src_rsupdateWOLoginHelper.h
push str.loginAnswerCode___ANS_Processing
call fcn.0058a650
add esp, 0x10
cmp byte [esi + 0x215f8], 0
jne 0x587391
push 0
push 0x3d
push str.c:warz2_src_rsupdateWOLoginHelper.h
push 0x675144
call fcn.0058a650
add esp, 0x10
cmp byte [esi + 0x2165c], 0
jne 0x5873b0
push 0
push 0x3e
push str.c:warz2_src_rsupdateWOLoginHelper.h
push str.passwd
call fcn.0058a650
add esp, 0x10
push 0
push 0
push esi
push 0x586fb0
push 0
push 0
mov dword [esi + 0x2176c], 1
call fcn.005afbee
add esp, 0x18
mov dword [esi + 0x215f0], eax
pop esi
ret
Function at 0x587530
Capabilities:
Create thread

Disassembly:
push esi
push edi
mov edi, ecx
lea edx, [edi + 0x21978]
mov esi, edx
lea ecx, [esi + 1]
nop
mov al, byte [esi]
inc esi
test al, al
jne 0x587540
sub esi, ecx
cmp esi, 0x13
je 0x587576
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x587551
sub edx, ecx
cmp edx, 0x1d
je 0x587576
push 0
push str.Create_Account
push str.Please_enter_Serial_Key_in_following_format:_nXXXX_XXXX_XXXX_XXXX_or_XXXXX_XXXXX_XXXXX_XXXXX_XXXXX
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
ret
push 0
push 0
push edi
push 0x5873e0
push 0
push 0
call fcn.005afbee
add esp, 0x18
mov dword [edi + 0x215f0], eax
pop edi
pop esi
ret

Function at 0x5878f0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
push edi
lea ecx, [esi + 0x21774]
mov edx, ecx
lea edi, [edx + 1]
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x587900
sub edx, edi
cmp edx, 4
jae 0x58792f
push 0
push str.Create_Account
push str.email_address_is_too_short
push 0
mov dword [esi + 0x21770], 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
ret
call fcn.005875c0
test eax, eax
jne 0x587953
push eax
push str.Create_Account
push str.email_address_is_not_valid
push eax
mov dword [esi + 0x21770], eax
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
ret
lea ecx, [esi + 0x21874]
lea eax, [esi + 0x217f4]
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x587980
test dl, dl
je 0x58797c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x587980
add eax, 2
add ecx, 2
test dl, dl
jne 0x587960
xor eax, eax
jmp 0x587985
sbb eax, eax
or eax, 1
push 0
test eax, eax
je 0x5879aa
push str.Create_Account
push str.Passwords_do_not_match
push 0
mov dword [esi + 0x21770], 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
ret
push 0
push esi
push 0x5875a0
push 0
push 0
call fcn.005afbee
add esp, 0x18
mov dword [esi + 0x215f0], eax
pop edi
pop esi
ret

Function at 0x587bc0
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x215d0], 0
je 0x587be7
push 0
push 0x5b9
push str.Updater.cpp
push str.mainThread___NULL
call fcn.0058a650
add esp, 0x10
cmp dword [edi + 0x215f0], 0
je 0x587c09
push 0
push 0x5ba
push str.Updater.cpp
push str.loginThread___NULL
call fcn.0058a650
add esp, 0x10
push 0
push 0
push edi
push 0x5867c0
push 0
push 0
call fcn.005afbee
push 0
push 0
push edi
push 0x586f70
push 0
push 0
mov dword [edi + 0x215d0], eax
call fcn.005afbee
add esp, 0x30
mov dword [edi + 0x21c70], eax
lea esi, [edi + 0x215e0]
mov ebx, 3
lea esp, [esp]
push 0
push 0
push edi
push 0x586f90
push 0
push 0
call fcn.005afbee
add esp, 0x18
mov dword [esi], eax
lea esi, [esi + 4]
dec ebx
jne 0x587c50
pop edi
pop esi
pop ebx
ret
Function at 0x587d00
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
push edi
push str.CUpdater::Stop___n
mov ebx, ecx
call fcn.0058a180
add esp, 4
cmp byte [ebx + 0x20d8c], 0
jne 0x587d21
mov eax, dword [ebx + 0x215d8]
mov edi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x730f24
call edi
lea esi, [ebx + 0x20d6c]
push esi
call edi
mov ecx, dword [ebx + 0x215d0]
mov edi, dword [sym.imp.KERNEL32.dll_TerminateThread]
test ecx, ecx
je 0x587d62
push 0
push ecx
call edi
push dword [ebx + 0x215d0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 0x215d0], 0
mov eax, dword [ebx + 0x21c70]
test eax, eax
je 0x587d87
push 0
push eax
call edi
push dword [ebx + 0x21c70]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 0x21c70], 0
mov eax, dword [ebx + 0x215f0]
test eax, eax
je 0x587dac
push 0
push eax
call edi
push dword [ebx + 0x215f0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 0x215f0], 0
lea edi, [ebx + 0x215e0]
mov ebx, 3
mov eax, dword [edi]
test eax, eax
je 0x587dd4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], 0
add edi, 4
dec ebx
jne 0x587db7
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call esi
push 0x730f24
call esi
pop edi
pop esi
pop ebx
ret
Function at 0x588d40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5cd451
mov eax, dword fs:[0]
push eax
sub esp, 0xc0
push ebx
push esi
push edi
mov eax, dword [0x6a1da0]
xor eax, esp
push eax
lea eax, [esp + 0xd0]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetControlComputerNameComputerName
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x588dc5
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x80
push eax
lea eax, [edi + 0xc8]
push eax
push 0
push 0
push str.ComputerName
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.005891b0
mov bl, al
call fcn.00589240
lea ecx, [esp + 0x20]
mov bh, al
call fcn.00401cb0
lea ecx, [esp + 0x64]
mov dword [esp + 0xd8], 0
call fcn.00401360
lea ecx, [esp + 0xac]
mov byte [esp + 0xd8], 1
call fcn.00401000
push str.api_Login.aspx
lea ecx, [esp + 0x20]
mov byte [esp + 0xdc], 2
call fcn.00588400
push edi
push str.username
lea ecx, [esp + 0x6c]
mov dword [esp + 0xe0], 3
call fcn.00401700
lea eax, [edi + 0x64]
push eax
push str.password
lea ecx, [esp + 0x6c]
call fcn.00401700
lea eax, [edi + 0xc8]
push eax
push str.ComputerName
lea ecx, [esp + 0x6c]
call fcn.00401700
mov esi, str.File_found
mov ecx, str.File_not_found
test bl, bl
mov eax, esi
cmove eax, ecx
lea ecx, [esp + 0x64]
push eax
push str.GetFileTemp
call fcn.00401700
test bh, bh
lea ecx, [esp + 0x64]
mov eax, str.File_not_found
cmove esi, eax
push esi
push str.GetFileIE
call fcn.00401700
mov ecx, dword [esp + 0xa4]
test ecx, ecx
je 0x588eb0
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esp + 0xa4], 0
call fcn.0058a0c0
lea eax, [esp + 0x64]
fstp st(0)
push eax
push 1
push 0x229
push str.api.warzsiam.in.th
lea ecx, [esp + 0x30]
call fcn.00402050
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0xa8], eax
call fcn.00588650
mov dword [esp + 0xa8], eax
test eax, eax
je 0x588f07
push eax
push str.Login_FAILED__code:__d_n
call fcn.0058a180
add esp, 8
mov dword [edi + 0x174], 3
jmp 0x588f13
lea eax, [esp + 0x1c]
mov ecx, edi
push eax
call fcn.00588bb0
mov dword [esp + 0xd8], 6
mov ecx, dword [esp + 0xa4]
test ecx, ecx
je 0x588f3a
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esp + 0xa4], 0
lea ecx, [esp + 0xac]
mov byte [esp + 0xd8], 5
call fcn.004010b0
lea ecx, [esp + 0x64]
mov byte [esp + 0xd8], 4
call fcn.00401440
lea ecx, [esp + 0x20]
mov dword [esp + 0xd8], 0xffffffff
call fcn.00401d70
mov ecx, dword [esp + 0xd0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x588f90
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0
lea eax, [ebp - 4]
mov esi, ecx
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareCodex_Development_GroupWarZ_Siam_MMO
push bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x588fec
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x588fc3
sub ecx, edx
lea eax, [ecx + 1]
push eax
push esi
push 1
push 0
push str.username
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x589000
Capabilities:
Encrypt data using dpapi
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 4]
push esi
push 0
push eax
push 0
push 2
push 0
push 0
push 0
push str.AppEventsEventLabelsSystemFool
push bind
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x58908b
lea ecx, [esi + 0x64]
mov dword [ebp - 0x10], ecx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x589036
sub ecx, edx
lea eax, [ecx + 1]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.CRYPT32.dll_CryptProtectData]
test eax, eax
je 0x589082
push dword [ebp - 0xc]
push dword [ebp - 8]
push 3
push 0
push str.password
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x589090
Capabilities:
Encrypt data using dpapi
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x6a1da0]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
lea eax, [ebp - 0x20c]
mov edi, ecx
push eax
push 1
push 0
push str.AppEventsEventLabelsSystemFool
push bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x589190
push esi
lea eax, [ebp - 0x208]
mov dword [ebp - 0x208], 0x200
push eax
lea eax, [ebp - 0x204]
push eax
push 0
push 0
push str.password
push dword [ebp - 0x20c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x20c]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x589190
lea eax, [ebp - 0x204]
mov dword [ebp - 0x218], eax
mov eax, dword [ebp - 0x208]
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
je 0x589190
mov eax, dword [ebp - 0x214]
mov ecx, 0x63
cmp eax, 0x64
cmova eax, ecx
push eax
push dword [ebp - 0x210]
lea eax, [edi + 0x64]
push eax
call fcn.005b12e0
add esp, 0xc
mov byte [edi + 0xc7], 0
push dword [ebp - 0x210]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov al, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005af263
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
pop edi
call fcn.005af263
mov esp, ebp
pop ebp
ret