joyce8/EMBER2024-capa huggingface dataset:
Function at 0x583f70
Capabilities:
Create process on windows
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x6c2da0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x104
lea eax, [ebp - 0x20c]
mov edi, edx
push eax
push 0
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push str.Trying_to_update_n
call fcn.00596cb0
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push str._s.new.exe
push eax
call fcn.0057e2a0
lea eax, [ebp - 0x108]
push 0x685c1c
push eax
call fcn.005bc76b
mov esi, eax
add esp, 0x18
test esi, esi
jne 0x583fee
lea eax, [ebp - 0x108]
push eax
push str.cant_open__s_for_writing_n
call fcn.005968d0
add esp, 8
push esi
push 1
push edi
push ebx
call fcn.005bd983
push esi
call fcn.005bc145
add esp, 0x14
push dword [0x883a3c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x108]
push eax
push str.executing__s_n
call fcn.00596cb0
add esp, 8
lea eax, [ebp - 0x108]
push 5
push 0
push 0x7df600
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
pop ebx
cmp eax, 0x20
jge 0x58405b
push eax
lea eax, [ebp - 0x108]
push eax
push str.failed_to_launch__s___d
call fcn.005968d0
add esp, 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
call fcn.005bba53
mov esp, ebp
pop ebp
ret

Function at 0x5842f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 4]
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, ecx
push eax
push 0xf003f
push 0
push str.SoftwareCodex_Development_GroupWarZ_Siam_MMO
mov byte [esi], 0
mov byte [esi + 0x80], 0
mov dword [esi + 0x180], 0
mov dword [esi + 0x184], 0
mov dword [esi + 0x188], 0
push SysReAllocString
mov dword [esi + 0x18c], 0
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x584377
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x80
push eax
push esi
push 0
push 0
push str.username
push dword [ebp - 4]
call ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push str.AppEventsEventLabelsSystemFool
push SysReAllocString
call edi
test eax, eax
jne 0x5843bb
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x80
push eax
lea eax, [esi + 0x80]
push eax
push 0
push 0
push str.password
push dword [ebp - 8]
call ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x585b30
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x6c2da0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x41c]
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
push eax
lea eax, [ebp - 0x418]
push eax
push edi
call fcn.00597c80
add esp, 0xc
test al, al
je 0x585b7b
mov eax, dword [ebp - 0x418]
cmp eax, dword [edi + 0x10e]
je 0x585c5d
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edi
call dword [sym.imp.dbghelp.dll_MakeSureDirectoryPathExists]
push 0x685c1c
push edi
call fcn.005bc76b
add esp, 8
mov dword [ebp - 0x410], eax
test eax, eax
je 0x585c70
lea eax, [ebp - 0x414]
mov ecx, esi
push eax
lea eax, [ebp - 0x40c]
push eax
call fcn.004011c0
push eax
mov ecx, esi
call fcn.004011f0
push eax
push edi
lea ecx, [ebx + 0x4c0]
call fcn.005a78b0
mov eax, dword [edi + 0x106]
cmp eax, dword [ebp - 0x414]
je 0x585bf6
push 0
push 0x18b
push str.Updater.cpp
push str.fe__size__out_size
call fcn.00597180
add esp, 0x10
lea esi, [ebx + 0x20d6c]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push dword [ebp - 0x410]
push 1
push dword [ebp - 0x414]
push dword [ebp - 0x40c]
call fcn.005bd983
push dword [ebp - 0x410]
call fcn.005bc145
add esp, 0x14
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push str.siamexe.exe
push edi
call fcn.005bfa7b
add esp, 8
test eax, eax
jne 0x585c4f
mov byte [ebx + 0x215ec], 1
call fcn.00585f10
push dword [ebp - 0x40c]
call fcn.00598e00
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005bba53
mov esp, ebp
pop ebp
ret 8
push edi
lea eax, [ebp - 0x408]
push str.Cant_replace_file__s_nPlease_delete_this_file_manually
push eax
call fcn.0057e2c0
add esp, 0xc
lea eax, [ebp - 0x408]
push eax
push ebx
call fcn.00584f60
int3
Function at 0x585d70
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5dda48
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x6c2da0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
push 0x400
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0
call fcn.00588410
mov eax, dword [esi + 0x5cc]
xor edi, edi
sub eax, dword [esi + 0x5c8]
mov ebx, dword [ebp - 0x20]
sar eax, 2
mov dword [ebp - 0x10], edi
test eax, eax
je 0x585e8c
lea esp, [esp]
mov eax, dword [esi + 0x5c8]
mov esi, dword [eax + edi*4]
test dword [esi + 0x116], 0x100000
jne 0x585e6e
cmp esi, ebx
jae 0x585e41
mov eax, dword [ebp - 0x24]
cmp eax, esi
ja 0x585e41
sub esi, eax
mov eax, 0xdd67c8a7
imul esi
add edx, esi
sar edx, 8
mov esi, edx
shr esi, 0x1f
add esi, edx
cmp ebx, dword [ebp - 0x1c]
jne 0x585e36
push ecx
lea ecx, [ebp - 0x24]
call fcn.005884b0
mov ebx, dword [ebp - 0x20]
imul esi, esi, 0x128
add esi, dword [ebp - 0x24]
jmp 0x585e52
cmp ebx, dword [ebp - 0x1c]
jne 0x585e52
push ecx
lea ecx, [ebp - 0x24]
call fcn.005884b0
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x585e62
mov ecx, 0x4a
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x10]
add ebx, 0x128
inc dword [ebp - 0x14]
mov dword [ebp - 0x20], ebx
mov esi, dword [ebp - 0x18]
inc edi
mov dword [ebp - 0x10], edi
mov eax, dword [esi + 0x5cc]
sub eax, dword [esi + 0x5c8]
sar eax, 2
cmp edi, eax
jb 0x585df0
mov edi, dword [ebp - 0x24]
mov eax, 0xdd67c8a7
sub ebx, edi
imul ebx
add edx, ebx
sar edx, 8
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
je 0x585ed8
add esi, 0x5c4
mov dword [ebp - 0x18], esi
mov esi, edi
mov edi, dword [ebp - 0x18]
push esi
mov ecx, edi
call fcn.005a74d0
test byte [esi + 0x116], 1
je 0x585ecc
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esi, 0x128
dec ebx
jne 0x585eb4
mov edi, dword [ebp - 0x24]
push dword [ebp - 0x14]
push str.removed__d_files_n
call fcn.00596cb0
add esp, 8
test edi, edi
je 0x585ef5
push edi
call fcn.00598e00
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x585f10
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x618
mov eax, dword [0x6c2da0]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push str.siamexe.exe
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x110]
push 0x68ae14
push eax
call fcn.0057e2a0
push str.WarZ_Siam_MMO__Survivor_Stories
lea eax, [ebp - 0x618]
push str.Allow_network_traffic_for__s
push eax
call fcn.0057e2c0
add esp, 0x1c
lea eax, [ebp - 0x618]
lea ecx, [ebp - 0x110]
push eax
call fcn.0057df50
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
call fcn.005bba53
mov esp, ebp
pop ebp
ret
Function at 0x586400
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x6c2da0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push str.Making_sure_extracted_files_exists_n
mov edi, ecx
call fcn.00596cb0
add esp, 4
lea ecx, [edi + 0x4c0]
push 1
push 1
call fcn.005a6cb0
mov eax, dword [edi + 0x5cc]
xor ebx, ebx
sub eax, dword [edi + 0x5c8]
sar eax, 2
test eax, eax
je 0x5864e3
push esi
lea ecx, [ecx]
mov eax, dword [edi + 0x5c8]
mov esi, dword [eax + ebx*4]
test byte [esi + 0x116], 1
je 0x5864ca
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x40c]
push eax
push esi
call fcn.00597c80
add esp, 0xc
test al, al
je 0x586499
mov eax, dword [ebp - 0x40c]
cmp eax, dword [esi + 0x10e]
jne 0x586499
mov eax, dword [ebp - 0x408]
cmp eax, dword [esi + 0x106]
je 0x5864ca
push esi
push str.restoring__s_n
call fcn.00596cb0
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
call dword [sym.imp.dbghelp.dll_MakeSureDirectoryPathExists]
push 0x68af94
push esi
lea ecx, [edi + 0x4c0]
call fcn.005a6290
test al, al
je 0x58650b
mov eax, dword [edi + 0x5cc]
inc ebx
sub eax, dword [edi + 0x5c8]
sar eax, 2
cmp ebx, eax
jb 0x586450
pop esi
lea ecx, [edi + 0x4c0]
call fcn.005a5f90
push str.Making_sure_extracted_files_exists___finished_n
call fcn.00596cb0
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop edi
pop ebx
call fcn.005bba53
mov esp, ebp
pop ebp
ret
push esi
lea eax, [ebp - 0x404]
push str.Cant_extract_file__s_nPlease_delete_this_file_manually
push eax
call fcn.0057e2c0
add esp, 0xc
lea eax, [ebp - 0x404]
push eax
push edi
call fcn.00584f60
int3
Function at 0x586ac0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ddb20
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x6c2da0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
cmp dword [esi + 0x20d84], 0
je 0x586b19
push 0
push 0x33b
push str.Updater.cpp
push str.status___STATUS_Checking
call fcn.00597180
add esp, 0x10
mov ecx, esi
call fcn.00584fc0
mov ecx, esi
call fcn.005851e0
test al, al
je 0x586b44
mov ecx, esi
call fcn.00585250
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov byte [esi + 0x84], 1
cmp dword [esi + 0x20d84], 5
push 0x68a48f
sete al
lea eax, [eax*2 + 3]
mov dword [esi + 0x20d84], eax
lea eax, [esi + 0x20d8d]
push eax
call fcn.0057e2c0
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 8
mov edi, edi
cmp dword [esi + 0x20d84], 5
jne 0x586c2f
mov eax, dword [esi + 0x21778]
mov dword [0x884360], eax
mov eax, dword [esi + 0x2177c]
mov dword [0x884364], eax
mov eax, dword [0x884370]
or eax, dword [0x884374]
je 0x586bd8
call fcn.0057ed10
test al, al
je 0x586bd8
push 0
push 0
push 0x884360
push 0x57e930
push 0
push 0
call fcn.005bc3de
add esp, 0x18
mov dword [0x884528], eax
mov ecx, esi
call fcn.00585500
mov ecx, esi
call fcn.005856b0
push dword [esi + 0x18]
push dword [esi + 0x5c4]
push str.current_build_version_d__updater_data_version_d_n
call fcn.00596cb0
mov eax, dword [esi + 0x5c4]
add esp, 0xc
mov ecx, esi
cmp eax, dword [esi + 0x18]
jne 0x586c0e
call fcn.005869f0
call fcn.00585910
mov ecx, esi
call fcn.005860c0
mov ecx, esi
call fcn.00586950
mov ecx, esi
call fcn.005868f0
mov ecx, esi
call fcn.005869f0
push 0x32
call edi
jmp 0x586b80

Function at 0x587880
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
lea ecx, [esi + 0x215f8]
call fcn.005843d0
push 0
push 0
push esi
push 0x5874e0
push 0
push 0
call fcn.005bc3de
add esp, 0x18
mov dword [esi + 0x215f0], eax
pop esi
ret

Function at 0x587a00
Capabilities:
Create thread

Disassembly:
push esi
push edi
mov edi, ecx
lea edx, [edi + 0x21990]
mov esi, edx
lea ecx, [esi + 1]
nop
mov al, byte [esi]
inc esi
test al, al
jne 0x587a10
sub esi, ecx
cmp esi, 0x13
je 0x587a46
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x587a21
sub edx, ecx
cmp edx, 0x1d
je 0x587a46
push 0
push str.Create_Account
push str.Please_enter_Serial_Key_in_following_format:_nXXXX_XXXX_XXXX_XXXX_or_XXXXX_XXXXX_XXXXX_XXXXX_XXXXX
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
ret
push 0
push 0
push edi
push 0x5878b0
push 0
push 0
call fcn.005bc3de
add esp, 0x18
mov dword [edi + 0x215f0], eax
pop edi
pop esi
ret
Function at 0x587d80
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
push edi
lea ecx, [esi + 0x2178c]
mov edx, ecx
lea edi, [edx + 1]
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x587d90
sub edx, edi
cmp edx, 4
jae 0x587dbf
push 0
push str.Create_Account
push str.email_address_is_too_short
push 0
mov dword [esi + 0x21788], 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
ret
call fcn.00587a90
test eax, eax
jne 0x587de3
push eax
push str.Create_Account
push str.email_address_is_not_valid
push eax
mov dword [esi + 0x21788], eax
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
ret
lea ecx, [esi + 0x2188c]
lea eax, [esi + 0x2180c]
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x587e10
test dl, dl
je 0x587e0c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x587e10
add eax, 2
add ecx, 2
test dl, dl
jne 0x587df0
xor eax, eax
jmp 0x587e15
sbb eax, eax
or eax, 1
push 0
test eax, eax
je 0x587e3a
push str.Create_Account
push str.Passwords_do_not_match
push 0
mov dword [esi + 0x21788], 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
ret
push 0
push esi
push 0x587a70
push 0
push 0
call fcn.005bc3de
add esp, 0x18
mov dword [esi + 0x215f0], eax
pop edi
pop esi
ret

Function at 0x588050
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x215d0], 0
je 0x588077
push 0
push 0x5b9
push str.Updater.cpp
push str.mainThread___NULL
call fcn.00597180
add esp, 0x10
cmp dword [edi + 0x215f0], 0
je 0x588099
push 0
push 0x5ba
push str.Updater.cpp
push str.loginThread___NULL
call fcn.00597180
add esp, 0x10
push 0
push 0
push edi
push 0x586cf0
push 0
push 0
call fcn.005bc3de
push 0
push 0
push edi
push 0x5874a0
push 0
push 0
mov dword [edi + 0x215d0], eax
call fcn.005bc3de
add esp, 0x30
mov dword [edi + 0x21c88], eax
lea esi, [edi + 0x215e0]
mov ebx, 3
lea esp, [esp]
push 0
push 0
push edi
push 0x5874c0
push 0
push 0
call fcn.005bc3de
add esp, 0x18
mov dword [esi], eax
lea esi, [esi + 4]
dec ebx
jne 0x5880e0
pop edi
pop esi
pop ebx
ret
Function at 0x588190
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
push edi
push str.CUpdater::Stop___n
mov ebx, ecx
call fcn.00596cb0
add esp, 4
cmp byte [ebx + 0x20d8c], 0
jne 0x5881b1
mov eax, dword [ebx + 0x215d8]
mov edi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x866bc4
call edi
lea esi, [ebx + 0x20d6c]
push esi
call edi
mov ecx, dword [ebx + 0x215d0]
mov edi, dword [sym.imp.KERNEL32.dll_TerminateThread]
test ecx, ecx
je 0x5881f2
push 0
push ecx
call edi
push dword [ebx + 0x215d0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 0x215d0], 0
mov eax, dword [ebx + 0x21c88]
test eax, eax
je 0x588217
push 0
push eax
call edi
push dword [ebx + 0x21c88]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 0x21c88], 0
mov eax, dword [ebx + 0x215f0]
test eax, eax
je 0x58823c
push 0
push eax
call edi
push dword [ebx + 0x215f0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 0x215f0], 0
lea edi, [ebx + 0x215e0]
mov ebx, 3
mov eax, dword [edi]
test eax, eax
je 0x588264
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], 0
add edi, 4
dec ebx
jne 0x588247
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call esi
push 0x866bc4
call esi
pop edi
pop esi
pop ebx
ret

Function at 0x589210
Capabilities:
Get local ipv4 addresses
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push 0x11
mov dword [ebp - 4], 4
call fcn.005bdacc
mov ebx, eax
push 0x288
mov dword [ebp - 8], ebx
call fcn.005bdacc
mov esi, eax
add esp, 8
test esi, esi
jne 0x58924b
push str.Error_allocating_memory_needed_to_call_GetAdaptersinfo_n
call fcn.005bdb73
add esp, 4
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x589279
push dword [ebp - 4]
call fcn.005bdacc
mov esi, eax
add esp, 4
test esi, esi
jne 0x589279
push str.Error_allocating_memory_needed_to_call_GetAdaptersinfo_n
call fcn.005bdb73
add esp, 4
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x5892e3
movzx eax, byte [esi + 0x199]
push eax
movzx eax, byte [esi + 0x198]
push eax
movzx eax, byte [esi + 0x197]
push eax
movzx eax, byte [esi + 0x196]
push eax
movzx eax, byte [esi + 0x195]
push eax
movzx eax, byte [esi + 0x194]
push eax
lea eax, [ebp - 8]
push str._02X:_02X:_02X:_02X:_02X:_02X
push eax
call fcn.00582f50
push ebx
lea eax, [esi + 0x1b0]
push eax
push str.Address:__s__mac:__s_n
call fcn.005bdb73
add esp, 0x2c
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call fcn.005bdc22
add esp, 4
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x589300
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ddee1
mov eax, dword fs:[0]
push eax
sub esp, 0xb4
push esi
mov eax, dword [0x6c2da0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetControlComputerNameComputerName
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x589377
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x80
push eax
lea eax, [esi + 0x100]
push eax
push 0
push 0
push str.ComputerName
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0xbc]
call fcn.00401cb0
lea ecx, [ebp - 0x78]
mov dword [ebp - 4], 0
call fcn.00401360
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.00401000
push str.api_Login.aspx
lea ecx, [ebp - 0xc0]
mov byte [ebp - 4], 2
call fcn.005888e0
push esi
push str.username
lea ecx, [ebp - 0x78]
mov dword [ebp - 4], 3
call fcn.00401700
lea eax, [esi + 0x80]
push eax
push str.password
lea ecx, [ebp - 0x78]
call fcn.00401700
call fcn.00589210
push eax
push 0x68bff8
lea ecx, [ebp - 0x78]
call fcn.00401700
lea eax, [esi + 0x100]
push eax
push str.ComputerName
lea ecx, [ebp - 0x78]
call fcn.00401700
mov ecx, dword [ebp - 0x38]
test ecx, ecx
je 0x589415
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [ebp - 0x38], 0
call fcn.00596bf0
lea eax, [ebp - 0x78]
fstp st(0)
push eax
push 1
push 0x229
push str.api.warzsiam.in.th
lea ecx, [ebp - 0xbc]
call fcn.00402050
push eax
lea ecx, [ebp - 0xc0]
mov dword [ebp - 0x38], eax
call fcn.00588b30
mov dword [ebp - 0x34], eax
test eax, eax
je 0x589467
push eax
push str.Login_FAILED__code:__d_n
call fcn.00596cb0
add esp, 8
mov dword [esi + 0x18c], 3
jmp 0x589475
lea eax, [ebp - 0xc0]
mov ecx, esi
push eax
call fcn.00589080
mov dword [ebp - 4], 6
mov ecx, dword [ebp - 0x38]
test ecx, ecx
je 0x589490
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [ebp - 0x38], 0
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 5
call fcn.004010b0
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 4
call fcn.00401440
lea ecx, [ebp - 0xbc]
mov dword [ebp - 4], 0xffffffff
call fcn.00401d70
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x5894d0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0
lea eax, [ebp - 4]
mov esi, ecx
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareCodex_Development_GroupWarZ_Siam_MMO
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x58952c
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x589503
sub ecx, edx
lea eax, [ecx + 1]
push eax
push esi
push 1
push 0
push str.username
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x589540
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0
lea eax, [ebp - 4]
mov esi, ecx
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.AppEventsEventLabelsSystemFool
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x58959f
sub esi, 0xffffff80
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x589576
sub ecx, edx
lea eax, [ecx + 1]
push eax
push esi
push 1
push 0
push str.password
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x589e50
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x8839a3], 0
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
jne 0x589ee9
jmp 0x589ecd
push 0
push 0
push 0
push 0x589e20
push 0
push 0
mov byte [0x8839a3], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x589f4f
mov esi, dword [ebp + 0x10]
mov edx, 0xa
mov ecx, esi
call fcn.00589da0
mov ecx, eax
call fcn.00589920
shr eax, 0x10
mov ecx, esi
mov dl, al
call fcn.00589b80
xor byte [ebx], al
jmp 0x589fd9
mov edx, 0x14
mov ecx, esi
call fcn.00589da0
mov ecx, eax
call fcn.00589920
mov dl, al
mov ecx, esi
call fcn.00589b80
mov ecx, dword [ebp + 8]
xor byte [ecx], al
jmp 0x58a060
mov edx, 0x1e
mov ecx, esi
call fcn.00589da0
mov ecx, eax
call fcn.00589920
shr eax, 8
mov ecx, esi
mov dl, al
call fcn.00589b80
xor byte [edi], al
jmp 0x58a0e7
mov edx, 0x28
mov ecx, esi
call fcn.00589da0
mov ecx, eax
call fcn.00589920
shr eax, 0x18
mov ecx, esi
mov dl, al
call fcn.00589b80
mov ecx, dword [ebp + 0xc]
xor byte [ecx], al
jmp 0x58a171
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x58a180
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x8839a3], 0
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
jne 0x58a219
jmp 0x58a1fd
push 0
push 0
push 0
push 0x589e20
push 0
push 0
mov byte [0x8839a3], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x58a27f
mov esi, dword [ebp + 0x10]
mov edx, 0xa
mov ecx, esi
call fcn.00589da0
mov ecx, eax
call fcn.00589920
shr eax, 0x10
mov ecx, esi
mov dl, al
call fcn.00589b80
xor byte [ebx], al
jmp 0x58a309
mov edx, 0x14
mov ecx, esi
call fcn.00589da0
mov ecx, eax
call fcn.00589920
mov dl, al
mov ecx, esi
call fcn.00589b80
mov ecx, dword [ebp + 8]
xor byte [ecx], al
jmp 0x58a390
mov edx, 0x1e
mov ecx, esi
call fcn.00589da0
mov ecx, eax
call fcn.00589920
shr eax, 8
mov ecx, esi
mov dl, al
call fcn.00589b80
xor byte [edi], al
jmp 0x58a417
mov edx, 0x28
mov ecx, esi
call fcn.00589da0
mov ecx, eax
call fcn.00589920
shr eax, 0x18
mov ecx, esi
mov dl, al
call fcn.00589b80
mov ecx, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
xor byte [ecx], al
pop ebp
ret