joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402bb0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
lea eax, [esp]
push eax
push 0xf003f
push 0
push str.SoftwareArktos_Entertainment_GroupWarZ
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x402bd8
mov al, 1
add esp, 0x10
ret
mov eax, dword [esp]
push esi
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x10]
push edx
push 0
push 0
push str.UpdaterTime1
push eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x20], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 4]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x402c4a
push esi
call fcn.005e16b5
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
add esp, 4
add esi, 0x2a300
adc ecx, 0
cmp edx, ecx
jg 0x402c4a
jl 0x402c43
cmp eax, esi
jae 0x402c4a
xor al, al
pop esi
add esp, 0x10
ret
mov al, 1
pop esi
add esp, 0x10
ret

Function at 0x402dc0
Capabilities:
Get common file path

Disassembly:
sub esp, 0xb14
mov eax, dword [0x6fadcc]
xor eax, esp
mov dword [esp + 0xb10], eax
push 0x104
lea eax, [esp + 0x210]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp]
push ecx
lea edx, [esp + 0x10c]
push edx
push 0x104
lea eax, [esp + 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
mov eax, dword [esp]
test eax, eax
je 0x402e13
mov byte [eax - 1], 0
lea ecx, [esp + 4]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea edx, [esp + 4]
push edx
lea eax, [esp + 0x10c]
push eax
call fcn.005e49cd
add esp, 8
test eax, eax
je 0x402e75
lea ecx, [esp + 0x108]
push ecx
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x318]
push str.Updater_current_directory___s__is_different_from_working_directory___s_
push eax
call fcn.00406cd0
add esp, 0x10
push 0x30
push 0x6c9400
lea ecx, [esp + 0x318]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0xb10]
xor ecx, esp
mov al, 1
call fcn.005e0ec7
add esp, 0xb14
ret
Function at 0x402f10
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x134
mov eax, dword [0x6fadcc]
xor eax, esp
mov dword [esp + 0x130], eax
push ebx
push esi
push edi
push 0
push 0xf
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [esp + 0x10]
push eax
push esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x402fc8
mov edi, dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, dword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
mov ecx, str.ExEWarZ.exe
lea eax, [esp + 0x34]
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x402f90
test dl, dl
je 0x402f8c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x402f90
add eax, 2
add ecx, 2
test dl, dl
jne 0x402f70
xor eax, eax
jmp 0x402f95
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x402fb5
mov ecx, dword [esp + 0x18]
push ecx
push eax
push 1
call edi
mov esi, eax
test esi, esi
je 0x402fb5
push 9
push esi
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0xc]
lea edx, [esp + 0x10]
push edx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x402f60
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x13c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005e0ec7
mov esp, ebp
pop ebp
ret

Function at 0x402ff0
Capabilities:
Inspect load icon resource
Terminate process

Disassembly:
call fcn.00402f10
push str.ExEWarZ.exe
call fcn.005e1aa7
mov eax, dword [0x83cacc]
add esp, 4
push 5
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
push str._generate
push 0x83c2b0
mov dword [0x83cad4], eax
mov dword [0x6f9bfc], 0
call fcn.005e1af0
add esp, 8
test eax, eax
je 0x40304a
call fcn.00401910
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
ret
call fcn.00402d30
test al, al
jne 0x40303a
call fcn.00402dc0
call fcn.00402e90
test al, al
jne 0x403085
push 0x40
push 0x6c94b0
push 0x6c94b8
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
ret
call fcn.004078e0
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0x8e1eb8
push 0x6c93e8
push 0x17
push 0
push 0x69bbc4
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jge 0x4030b9
mov dword [0x8e1eb8], 0
push str._cmdLine
push 0x83c2b0
call fcn.005e1af0
add esp, 8
test eax, eax
je 0x4030d6
mov byte [0x8e1eb4], 1
push esi
mov esi, dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f00
push 0
call esi
push 0x7f89
push 0
mov dword [0x8e19c8], eax
call esi
push 0x209
push 0x8e1f50
push 0x12f
push 0
mov dword [0x8e19c4], eax
call dword [sym.imp.USER32.dll_LoadStringW]
pop esi
ret
Function at 0x403c40
Capabilities:
Hide graphical window
Inspect load icon resource

Disassembly:
push 0xffffffffffffffff
push 0x61a0fe
mov eax, dword fs:[0]
push eax
sub esp, 0x208
mov eax, dword [0x6fadcc]
xor eax, esp
mov dword [esp + 0x204], eax
push ebx
push esi
push edi
mov eax, dword [0x6fadcc]
xor eax, esp
push eax
lea eax, [esp + 0x218]
mov dword fs:[0], eax
call fcn.004154b0
cmp byte [0x8e1eb4], 0
je 0x403ccd
call dword [sym.imp.KERNEL32.dll_AllocConsole]
call fcn.005e23c9
add eax, 0x20
push eax
push 0x6c9494
push 0x6c97ac
call fcn.005e23a3
call fcn.005e23c9
push eax
push 0x6c97b4
push str.CONIN_
call fcn.005e23a3
add esp, 0x18
mov dword [0x83cb48], 1
jmp 0x403e54
mov eax, 0x8e2a30
call fcn.004021a0
mov eax, dword [0x83cacc]
push 5
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov ecx, dword [0x83cad0]
push eax
push 0
push 0x80
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edx, dword [0x83cad0]
push 0x800000
push 0
push edx
call fcn.005ba4a0
mov eax, dword [0x83cad0]
push 0xc00000
push 0
push eax
call fcn.005ba4a0
mov ecx, dword [0x83cad0]
add esp, 0x18
push 0x403ab0
push 0xfffffffffffffffc
push ecx
call dword [sym.imp.USER32.dll_SetWindowLongA]
call fcn.005c5190
push 0
push 0
push 0
push str.DISPLAY
call dword [sym.imp.GDI32.dll_CreateICA]
mov edi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov esi, eax
push 8
push esi
call edi
push 0xa
push esi
mov ebx, eax
call edi
mov esi, eax
lea eax, [ebx - 0x311]
cdq
sub eax, edx
mov ecx, eax
push 0
lea eax, [esi - 0x28a]
cdq
push 0x28a
sub eax, edx
mov edx, dword [0x83cad0]
push 0x311
sar eax, 1
push eax
sar ecx, 1
push ecx
push 0
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0x102660
call fcn.005bd2e0
add esp, 4
mov dword [esp + 0x10], eax
mov dword [esp + 0x220], 0
test eax, eax
je 0x403dc0
mov ecx, eax
call fcn.005c2ae0
jmp 0x403dc2
xor eax, eax
mov dword [esp + 0x220], 0xffffffff
mov ecx, dword [0x83cad0]
push 0
push ecx
mov ecx, eax
mov dword [0x83cb34], eax
call fcn.005be500
call fcn.00403120
push str.Jul__5_2024_00:13:55
push str.0.1.9
lea edx, [esp + 0x1c]
push str.Launcher__s___s_
push edx
call fcn.00406cf0
mov ecx, dword [0x83cad0]
add esp, 0x10
lea eax, [esp + 0x14]
push eax
push ecx
call dword [sym.imp.USER32.dll_SetWindowTextA]
call fcn.004034c0
mov edx, dword [0x83cad0]
push 5
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x5ba150
call fcn.005b9c90
add esp, 4
push 0
call dword [sym.imp.USER32.dll_ClipCursor]
mov ecx, dword [0x83cb3c]
call fcn.005c8a00
mov ecx, dword [0x83cb38]
call fcn.005c8c40
mov ecx, dword [esp + 0x218]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x204]
xor ecx, esp
call fcn.005e0ec7
add esp, 0x214
ret
Function at 0x405790
Capabilities:
Create process on windows

Disassembly:
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
mov eax, 0x30c30c31
imul ecx
sub esp, 0x30
sar edx, 4
push ebx
mov eax, edx
shr eax, 0x1f
push ebp
xor ebx, ebx
add eax, edx
push edi
je 0x4059bf
xor edi, edi
mov dword [esp + 0xc], edi
jmp 0x4057c4
mov edi, dword [esp + 0xc]
cmp edi, 0x1a4
jae 0x4059bf
cmp ebx, eax
jb 0x4057d9
call fcn.005e22ba
mov eax, dword [esi + 0xc]
lea eax, [edi + eax + 0x38]
mov ebp, 0x10
cmp dword [eax + 0x18], ebp
jb 0x4057ef
mov eax, dword [eax + 4]
jmp 0x4057f2
add eax, 4
fld dword [esp + 0x44]
mov edx, dword [0x8e1f34]
push eax
lea ecx, [esp + 0x20]
push ecx
sub esp, 8
fstp dword [esp + 4]
mov dword [esp + 0x2c], 0xfff3b656
fld dword [esp + 0x50]
fadd qword [0x6cc228]
fstp dword [esp + 0x28]
fld dword [esp + 0x28]
fstp dword [esp]
push edx
call fcn.005c4b40
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
mov eax, 0x30c30c31
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
add esp, 0x14
cmp ebx, eax
jb 0x40584f
call fcn.005e22ba
mov eax, dword [esi + 0xc]
add eax, edi
cmp dword [eax + 0x18], ebp
jb 0x40585e
mov ebp, dword [eax + 4]
jmp 0x405861
lea ebp, [eax + 4]
mov edi, dword [0x8e1f34]
push ebp
call fcn.00403ef0
fld dword [esp + 0x44]
fstp dword [esp + 0x2c]
mov dword [esp + 0x24], eax
fld dword [esp + 0x48]
mov dword [esp + 0x28], edx
fstp dword [esp + 0x30]
add esp, 4
fild dword [esp + 0x20]
lea ecx, [esp + 0x28]
mov dword [esp + 0x10], 0xffffffff
fstp dword [esp + 0x14]
fld dword [esp + 0x14]
fstp dword [esp + 0x30]
fild dword [esp + 0x24]
fstp dword [esp + 0x18]
fld dword [esp + 0x18]
fstp dword [esp + 0x34]
call fcn.00402cc0
test al, al
je 0x405960
fld1
push 0
push 0
lea ecx, [esp + 0x18]
push ecx
sub esp, 0x10
fstp dword [esp + 0xc]
mov dword [esp + 0x2c], 0xffffd800
fld dword [esp + 0x30]
fstp dword [esp + 8]
fld dword [esp + 0x34]
fadd dword [esp + 0x60]
fstp dword [esp + 0x34]
fld dword [esp + 0x34]
fstp dword [esp + 4]
fld dword [esp + 0x5c]
fstp dword [esp]
call fcn.005c8da0
add esp, 0x1c
cmp dword [0x8e1f44], 0
je 0x405960
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
mov eax, 0x30c30c31
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebx, eax
jb 0x40592f
call fcn.005e22ba
mov ecx, dword [esi + 0xc]
mov edx, dword [esp + 0xc]
cmp dword [edx + ecx + 0x34], 0x10
lea eax, [edx + ecx + 0x1c]
jb 0x405946
mov eax, dword [eax + 4]
jmp 0x405949
add eax, 4
push 5
push 0
push 0x6c97aa
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
fld dword [esp + 0x44]
mov ecx, dword [0x8e1f34]
push ebp
push 0x6bf53c
lea eax, [esp + 0x18]
push eax
sub esp, 8
fstp dword [esp + 4]
fld dword [esp + 0x54]
fstp dword [esp]
push ecx
call fcn.005c4b40
fld dword [esp + 0x5c]
mov ecx, dword [esi + 0x10]
fadd qword [0x6cc220]
sub ecx, dword [esi + 0xc]
add dword [esp + 0x24], 0x54
mov eax, 0x30c30c31
fstp dword [esp + 0x5c]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
inc ebx
add eax, edx
add esp, 0x18
cmp ebx, eax
jb 0x4057c0
pop edi
pop ebp
pop ebx
add esp, 0x30
ret
Function at 0x407320
Capabilities:
Set console window title

Disassembly:
sub esp, 0x218
mov eax, dword [0x6fadcc]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
push esi
push edi
mov esi, ecx
call fcn.0040bd80
call fcn.005bb110
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
nop
call fcn.005bb160
call fcn.005bb110
push 0x64
call edi
cmp dword [esi + 0x20dec], 3
jne 0x407371
mov dword [esi + 0x20dec], 5
cmp dword [esi + 0x20df0], 0
jne 0x4073f8
mov eax, dword [esi + 0x215f8]
mov ecx, dword [esi + 0x215fc]
mov dword [esp + 0x10], eax
or eax, ecx
mov dword [esp + 0x14], ecx
jne 0x407396
fldz
jmp 0x4073bf
fild qword [esi + 0x21600]
fild qword [esp + 0x10]
fdivp st(1)
fstp dword [esp + 0xc]
fld1
fcom dword [esp + 0xc]
fnstsw ax
test ah, 5
jp 0x4073b9
fstp dword [esp + 0xc]
jmp 0x4073bb
fstp st(0)
fld dword [esp + 0xc]
fstp dword [esp + 0xc]
sub esp, 8
fld dword [esp + 0x14]
lea eax, [esi + 0x20df5]
fmul qword [0x6cc250]
lea ecx, [esp + 0x20]
fstp qword [esp]
push eax
push str._s:__.1f__
push ecx
call fcn.00406cf0
add esp, 0x14
lea edx, [esp + 0x18]
push edx
call ebx
jmp 0x407350
mov eax, esi
call fcn.0040beb0
mov eax, dword [esi + 0x20df0]
sub eax, 1
je 0x407442
sub eax, 1
je 0x40742c
sub eax, 1
je 0x40744f
push 0
push 0x37
push str..Main_CmdLine.cpp
push 0x6c97a8
call fcn.005bb6e0
add esp, 0x10
jmp 0x40744f
add esi, 0x211f5
push esi
push str.Update_error_n_s_n_nPlease_retry_later
call fcn.005bb3d0
add esp, 8
jmp 0x40744f
push str.Update_ok_n
call fcn.005bb3d0
add esp, 4
push str._nPress_enter_to_exit...
call fcn.005bb3d0
add esp, 4
call fcn.005e258b
mov ecx, dword [esp + 0x21c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005e0ec7
add esp, 0x218
ret
Function at 0x4078e0
Capabilities:
Copy file
Create process on windows
Delete file
Move file
Terminate process

Disassembly:
sub esp, 0x60c
mov eax, dword [0x6fadcc]
xor eax, esp
mov dword [esp + 0x608], eax
push 0x104
lea eax, [esp + 4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp]
push str..new.exe
push ecx
call fcn.005e1af0
add esp, 8
test eax, eax
jne 0x407959
lea edx, [esp]
push edx
lea eax, [esp + 0x108]
push str._s.new.exe
push eax
call fcn.00401aa0
add esp, 0xc
lea ecx, [esp + 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor al, al
mov ecx, dword [esp + 0x608]
xor ecx, esp
call fcn.005e0ec7
add esp, 0x60c
ret
push str..exe_updated__moving_back_n
mov byte [0x8e2362], 1
call fcn.005bb3d0
add esp, 4
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
lea ebx, [ebx]
mov cl, byte [esp + eax]
mov byte [esp + eax + 0x104], cl
inc eax
test cl, cl
jne 0x407980
lea eax, [esp]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407995
sub eax, edx
cmp eax, 8
ja 0x4079b9
push 0
push 0x31
push str..SelfUpdateEXE.cpp
push str.strlen_exeMain____8
call fcn.005bb6e0
add esp, 0x10
lea eax, [esp]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4079c0
push ebx
push ebp
push esi
sub eax, edx
push edi
lea edx, [esp + 0x10]
push edx
push str.exeMain:__s_n
mov byte [esp + eax + 0x10], cl
call fcn.005bb3d0
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileA]
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
add esp, 8
xor esi, esi
lea eax, [esp + 0x10]
push eax
call edi
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x118]
push edx
call ebx
test eax, eax
jne 0x407a9b
push eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x11c]
push ecx
call ebp
test eax, eax
jne 0x407a9b
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0xa
jl 0x4079f7
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x118]
push eax
lea ecx, [esp + 0x220]
push str.Failed_to_replace_updater_file_n_nPlease_manually_rename__s_to__s
push ecx
call fcn.00401ac0
add esp, 0x10
push 0x30
push str.Updater
lea edx, [esp + 0x220]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 5
push 0
push 0
push 0x6c9594
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor al, al
jmp 0x407a9d
mov al, 1
mov ecx, dword [esp + 0x618]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005e0ec7
add esp, 0x60c
ret
Function at 0x407ac0
Capabilities:
Create process on windows
Terminate process
Write and execute a file
Write file on windows

Disassembly:
sub esp, 0x20c
mov eax, dword [0x6fadcc]
xor eax, esp
mov dword [esp + 0x208], eax
push esi
push 0x104
lea eax, [esp + 0x10c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push str.Trying_to_update_n
call fcn.005bb3d0
lea ecx, [esp + 0x10c]
push ecx
lea edx, [esp + 0xc]
push str._s.new.exe
push edx
call fcn.00401aa0
lea eax, [esp + 0x14]
push 0x6c9494
push eax
call fcn.005e1a90
mov esi, eax
add esp, 0x18
test esi, esi
jne 0x407b35
lea ecx, [esp + 4]
push ecx
push str.cant_open__s_for_writing_n
call fcn.005bb5a0
add esp, 8
mov edx, dword [esp + 0x214]
push esi
push 1
push edx
push edi
call fcn.005e26f2
push esi
call fcn.005e1350
mov eax, dword [0x8e1ebc]
add esp, 0x14
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 4]
push ecx
push str.executing__s_n
call fcn.005bb3d0
add esp, 8
push 5
push 0
push 0x83c2b0
lea edx, [esp + 0x10]
push edx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
pop esi
jge 0x407ba1
push eax
lea eax, [esp + 4]
push eax
push str.failed_to_launch__s___d
call fcn.005bb5a0
add esp, 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [esp + 0x208]
xor ecx, esp
mov al, 1
call fcn.005e0ec7
add esp, 0x20c
ret
Function at 0x407ed0
Capabilities:
Extract resource via kernel32 functions
Set file attributes
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x618da8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x6fadcc]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
lea ecx, [esp + 0x14]
call fcn.0045f7f0
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], 0
call fcn.0045f980
push 0x6c9b90
push 0xc8
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x407fdf
push edi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x407fdf
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push esi
lea ecx, [esp + 0x1c]
call fcn.0045fb40
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
push 0x6c9a18
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
call fcn.005bc120
add esp, 0xc
lea ecx, [esp + 0x14]
call fcn.0045f9b0
push eax
lea ecx, [esp + 0x18]
call fcn.0045f9e0
push eax
call fcn.005bbdd0
add esp, 8
cmp dword [esp + 0xc], eax
je 0x40801a
push 0x80
push 0x6c9a18
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x6c9494
push 0x6c9a18
call fcn.005e1a90
mov esi, eax
add esp, 8
test esi, esi
jne 0x407ff5
push 0x10
push str.Warning
push str.Can_not_update_steam_api.dll
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40801a
push 0x10
push str.Warning
push str.No_steam_api.dll_resource
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40801a
push esi
lea ecx, [esp + 0x18]
call fcn.0045f9b0
push eax
push 1
lea ecx, [esp + 0x20]
call fcn.0045f9e0
push eax
call fcn.005e26f2
push esi
call fcn.005e1350
add esp, 0x14
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], 0xffffffff
call fcn.0045f8a0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x28
ret
Function at 0x4081c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x618f18
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push ebx
push edi
mov eax, dword [0x6fadcc]
xor eax, esp
push eax
lea eax, [esp + 0x4c]
mov dword fs:[0], eax
fldz
lea ecx, [esp + 0x14]
fst dword [esi]
mov dword [esi + 8], 0
fstp dword [esi + 4]
call fcn.0045f7f0
lea ecx, [esp + 0x14]
mov dword [esp + 0x54], 0
call fcn.0045f980
movzx eax, word [esp + 0x5c]
push 0x6c9cb4
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x4082fd
push edi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x4082fd
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push ebx
lea ecx, [esp + 0x1c]
call fcn.0045fb40
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x18]
call fcn.0045f9b0
push eax
lea ecx, [esp + 0x1c]
call fcn.0045f9e0
mov ecx, dword [0x83cb34]
push eax
add ecx, 0x50
call fcn.005bdf60
push eax
call sub.d3dx9_43.dll_D3DXCreateTextureFromFileInMemory
test eax, eax
jne 0x4082fd
mov ecx, dword [0x83cb34]
call fcn.005cd780
push 1
push 1
push 0x16
push 4
push 4
mov ecx, eax
mov dword [esi + 8], eax
call fcn.005cf370
mov edx, dword [esp + 0x10]
mov ecx, dword [esi + 8]
push edx
call fcn.005cf1a0
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
lea edx, [esp + 0x28]
push edx
push 0
push eax
mov eax, dword [ecx + 0x44]
call eax
fild dword [esp + 0x60]
mov ecx, dword [esp + 0x40]
fild dword [esp + 0x40]
test ecx, ecx
jge 0x4082de
fadd dword [0x6cc170]
fdivp st(1)
mov edx, dword [esp + 0x44]
fstp dword [esi]
fild dword [esp + 0x64]
fild dword [esp + 0x44]
test edx, edx
jge 0x4082f8
fadd dword [0x6cc170]
fdivp st(1)
fstp dword [esi + 4]
lea ecx, [esp + 0x14]
mov dword [esp + 0x54], 0xffffffff
call fcn.0045f8a0
mov eax, esi
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x4c
ret 0xc
Function at 0x409930
Capabilities:
Delete file
Write file on windows

Disassembly:
sub esp, 0x41c
mov eax, dword [0x6fadcc]
xor eax, esp
mov dword [esp + 0x414], eax
push ebx
push ebp
lea eax, [esp + 0x14]
mov ebx, ecx
push eax
lea ecx, [esp + 0x14]
push ecx
push esi
call fcn.005bc120
add esp, 0xc
test al, al
je 0x40996f
mov edx, dword [esp + 0x10]
cmp edx, dword [esi + 0x112]
je 0x409a55
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
call dword [sym.imp.dbghelp.dll_MakeSureDirectoryPathExists]
push 0x6c9494
push esi
call fcn.005e1a90
mov ebp, eax
add esp, 8
test ebp, ebp
jne 0x4099b0
push esi
lea eax, [esp + 0x1c]
push str.Cant_replace_file__s_nPlease_delete_this_file_manually
push eax
call fcn.00401ac0
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
mov eax, edi
call fcn.00408df0
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x10]
push eax
mov ecx, ebx
call fcn.0045f9b0
push eax
mov ecx, ebx
call fcn.0045f9e0
push eax
push esi
lea ecx, [edi + 0x4e0]
call fcn.005c9a00
mov ecx, dword [esi + 0x10a]
cmp ecx, dword [esp + 8]
je 0x4099fb
push 0
push 0x19f
push str..Updater.cpp
push str.fe__size__out_size
call fcn.005bb6e0
add esp, 0x10
lea ebx, [edi + 0x20dd4]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, dword [esp + 8]
mov eax, dword [esp + 0xc]
push ebp
push 1
push edx
push eax
call fcn.005e26f2
push ebp
call fcn.005e1350
add esp, 0x14
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push str.ExEWarZ.exe
push esi
call fcn.005e49cd
add esp, 8
test eax, eax
jne 0x409a48
mov byte [edi + 0x21690], 1
call fcn.00409cc0
mov ecx, dword [esp + 0xc]
push ecx
call fcn.005bd360
add esp, 4
mov ecx, dword [esp + 0x41c]
pop ebp
pop ebx
xor ecx, esp
call fcn.005e0ec7
add esp, 0x41c
ret