joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5925b0
Capabilities:
Set console window title

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x79b5e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
call fcn.00597710
call fcn.005f24c0
call fcn.005f1b00
call fcn.005f24c0
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esi + 0x20d84], 3
jne 0x5925f7
mov dword [esi + 0x20d84], 5
cmp dword [esi + 0x20d88], 0
jne 0x5926a1
mov edi, dword [esi + 0x21590]
mov eax, edi
mov ebx, dword [esi + 0x21594]
or eax, ebx
jne 0x59261b
xorps xmm1, xmm1
jmp 0x592661
mov edx, dword [esi + 0x2159c]
mov ecx, dword [esi + 0x21598]
call fcn.0062419f
cvtsd2ss xmm0, xmm0
mov edx, ebx
mov ecx, edi
movss dword [ebp - 0x20c], xmm0
call fcn.0062419f
movss xmm1, dword [ebp - 0x20c]
cvtsd2ss xmm0, xmm0
divss xmm1, xmm0
movss xmm0, dword [0x6eee34]
comiss xmm1, xmm0
jbe 0x592661
movaps xmm1, xmm0
mulss xmm1, dword [0x6eee58]
lea eax, [esi + 0x20d8d]
sub esp, 8
cvtps2pd xmm0, xmm1
movsd qword [esp], xmm0
push eax
lea eax, [ebp - 0x208]
push str._s:__.1f__
push eax
call fcn.00592550
add esp, 0x14
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
jmp 0x5925d2
mov ecx, esi
call fcn.005977d0
mov eax, dword [esi + 0x20d88]
dec eax
je 0x5926e5
dec eax
je 0x5926cf
dec eax
je 0x5926f2
push 0
push 0x37
push str.Main_CmdLine.cpp
push 0x6e9524
call fcn.005f2580
add esp, 0x10
jmp 0x5926f2
lea eax, [esi + 0x2118d]
push eax
push str.Update_error_n_s_n_nPlease_retry_later
call fcn.005f20b0
add esp, 8
jmp 0x5926f2
push str.Update_ok_n
call fcn.005f20b0
add esp, 4
push str._nPress_enter_to_exit...
call fcn.005f20b0
add esp, 4
call fcn.0061d896
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0061b9b8
mov esp, ebp
pop ebp
ret
Function at 0x592b60
Capabilities:
Copy file
Create process on windows
Delete file
Move file
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60c
mov eax, dword [0x79b5e0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x108]
push str..new.exe
push eax
call fcn.0061cf80
add esp, 8
test eax, eax
jne 0x592bd7
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push str._s.new.exe
push eax
call fcn.0058d780
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0061b9b8
mov esp, ebp
pop ebp
ret
push edi
push str..exe_updated__moving_back_n
mov byte [0x8477b2], 1
call fcn.005f20b0
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 4
push 0x1f4
call edi
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0061c91b
lea ecx, [ebp - 0x108]
add esp, 0xc
lea edx, [ecx + 1]
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x592c20
sub ecx, edx
cmp ecx, 8
ja 0x592c44
push 0
push 0x31
push str.SelfUpdateEXE.cpp
push str.strlen_exeMain____8
call fcn.005f2580
add esp, 0x10
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x592c50
sub ecx, edx
add ecx, 0xfffffff8
cmp ecx, 0x104
jae 0x592d61
push ebx
mov byte [ebp + ecx - 0x108], al
lea eax, [ebp - 0x108]
push esi
push eax
push str.exeMain:__s_n
call fcn.005f20b0
mov ebx, dword [sym.imp.KERNEL32.dll_CopyFileA]
add esp, 8
xor esi, esi
lea ecx, [ecx]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x592d4e
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
call ebx
test eax, eax
jne 0x592d4e
push 0x64
call edi
inc esi
cmp esi, 0xa
jl 0x592c90
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x60c]
push str.Failed_to_replace_updater_file_n_nPlease_manually_rename__s_to__s
push eax
call fcn.0058d7a0
add esp, 0x10
lea eax, [ebp - 0x60c]
push 0x30
push str.Updater
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 5
push 0
push 0
push 0x6e92dc
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
pop ebx
xor al, al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0061b9b8
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop esi
pop ebx
xor ecx, ebp
pop edi
call fcn.0061b9b8
mov esp, ebp
pop ebp
ret
call fcn.0061d3f4
int3
Function at 0x592d70
Capabilities:
Create process on windows
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x79b5e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x104
lea eax, [ebp - 0x20c]
mov edi, edx
push eax
push 0
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push str.Trying_to_update_n
call fcn.005f20b0
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push str._s.new.exe
push eax
call fcn.0058d780
lea eax, [ebp - 0x108]
push 0x6e91e4
push eax
call fcn.0061d2a7
mov esi, eax
add esp, 0x18
test esi, esi
jne 0x592dee
lea eax, [ebp - 0x108]
push eax
push str.cant_open__s_for_writing_n
call fcn.005f1cd0
add esp, 8
push esi
push 1
push edi
push ebx
call fcn.0061d9f4
push esi
call fcn.0061c773
add esp, 0x14
push dword [0x8477f4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x108]
push eax
push str.executing__s_n
call fcn.005f20b0
add esp, 8
lea eax, [ebp - 0x108]
push 5
push 0
push 0x7a3480
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
pop ebx
cmp eax, 0x20
jge 0x592e5b
push eax
lea eax, [ebp - 0x108]
push eax
push str.failed_to_launch__s___d
call fcn.005f1cd0
add esp, 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
call fcn.0061b9b8
mov esp, ebp
pop ebp
ret
Function at 0x5931b0
Capabilities:
Extract resource via kernel32 functions
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63e788
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x79b5e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x28]
call fcn.00410000
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
call fcn.00410190
push 0x6ed3a0
push 0xc8
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x5932d4
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x5932d4
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.00410350
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], 0
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 0
push eax
push 0x6ed228
call fcn.005f28e0
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.004101c0
push eax
lea ecx, [ebp - 0x28]
call fcn.004101f0
push eax
call fcn.005f28b0
add esp, 8
cmp dword [ebp - 0x10], eax
je 0x5932e8
push 0x80
push 0x6ed228
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x6e91e4
push 0x6ed228
call fcn.0061d2a7
mov esi, eax
add esp, 8
test esi, esi
jne 0x5932af
push 0x10
push str.Warning
push str.Can_not_update_steam_api.dll
jmp 0x5932e0
push esi
lea ecx, [ebp - 0x28]
call fcn.004101c0
push eax
push 1
lea ecx, [ebp - 0x28]
call fcn.004101f0
push eax
call fcn.0061d9f4
push esi
call fcn.0061c773
add esp, 0x14
jmp 0x5932e8
push 0x10
push str.Warning
push str.No_steam_api.dll_resource
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0xffffffff
call fcn.004100b0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x5936f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
push esi
push eax
mov esi, ecx
push 0xf003f
push 0
push str.SoftwareArktos_Entertainment_GroupWarZ
mov byte [esi], 0
mov byte [esi + 0x80], 0
mov dword [esi + 0xa00], 0
mov dword [esi + 0xa04], 0
mov dword [esi + 0xa08], 0
push bind
mov dword [esi + 0xa0c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x593771
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x80
push eax
push esi
push 0
push 0
push str.username
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x594f40
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x79b5e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x41c]
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
push eax
lea eax, [ebp - 0x418]
push eax
push edi
call fcn.005f28e0
add esp, 0xc
test al, al
je 0x594f8b
mov eax, dword [ebp - 0x418]
cmp eax, dword [edi + 0x10e]
je 0x59506d
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edi
call dword [sym.imp.dbghelp.dll_MakeSureDirectoryPathExists]
push 0x6e91e4
push edi
call fcn.0061d2a7
add esp, 8
mov dword [ebp - 0x410], eax
test eax, eax
je 0x595080
lea eax, [ebp - 0x414]
mov ecx, esi
push eax
lea eax, [ebp - 0x40c]
push eax
call fcn.004101c0
push eax
mov ecx, esi
call fcn.004101f0
push eax
push edi
lea ecx, [ebx + 0x4c0]
call fcn.006077d0
mov eax, dword [edi + 0x106]
cmp eax, dword [ebp - 0x414]
je 0x595006
push 0
push 0x19b
push str.Updater.cpp
push str.fe__size__out_size
call fcn.005f2580
add esp, 0x10
lea esi, [ebx + 0x20d6c]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push dword [ebp - 0x410]
push 1
push dword [ebp - 0x414]
push dword [ebp - 0x40c]
call fcn.0061d9f4
push dword [ebp - 0x410]
call fcn.0061c773
add esp, 0x14
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push str.MiniA.exe
push edi
call fcn.0062075b
add esp, 8
test eax, eax
jne 0x59505f
mov byte [ebx + 0x215ec], 1
call fcn.00595320
push dword [ebp - 0x40c]
call fcn.005f1450
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0061b9b8
mov esp, ebp
pop ebp
ret 8
push edi
lea eax, [ebp - 0x408]
push str.Cant_replace_file__s_nPlease_delete_this_file_manually
push eax
call fcn.0058d7a0
add esp, 0xc
lea eax, [ebp - 0x408]
push eax
push ebx
call fcn.00594310
int3
Function at 0x595180
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63eb18
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x79b5e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
push 0x400
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0
call fcn.00597a50
mov eax, dword [esi + 0x5cc]
xor edi, edi
sub eax, dword [esi + 0x5c8]
mov ebx, dword [ebp - 0x20]
sar eax, 2
mov dword [ebp - 0x10], edi
test eax, eax
je 0x59529c
lea esp, [esp]
mov eax, dword [esi + 0x5c8]
mov esi, dword [eax + edi*4]
test dword [esi + 0x116], 0x100000
jne 0x59527e
cmp esi, ebx
jae 0x595251
mov eax, dword [ebp - 0x24]
cmp eax, esi
ja 0x595251
sub esi, eax
mov eax, 0xdd67c8a7
imul esi
add edx, esi
sar edx, 8
mov esi, edx
shr esi, 0x1f
add esi, edx
cmp ebx, dword [ebp - 0x1c]
jne 0x595246
push ecx
lea ecx, [ebp - 0x24]
call fcn.00597af0
mov ebx, dword [ebp - 0x20]
imul esi, esi, 0x128
add esi, dword [ebp - 0x24]
jmp 0x595262
cmp ebx, dword [ebp - 0x1c]
jne 0x595262
push ecx
lea ecx, [ebp - 0x24]
call fcn.00597af0
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x595272
mov ecx, 0x4a
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x10]
add ebx, 0x128
inc dword [ebp - 0x14]
mov dword [ebp - 0x20], ebx
mov esi, dword [ebp - 0x18]
inc edi
mov dword [ebp - 0x10], edi
mov eax, dword [esi + 0x5cc]
sub eax, dword [esi + 0x5c8]
sar eax, 2
cmp edi, eax
jb 0x595200
mov edi, dword [ebp - 0x24]
mov eax, 0xdd67c8a7
sub ebx, edi
imul ebx
add edx, ebx
sar edx, 8
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
je 0x5952e8
add esi, 0x5c4
mov dword [ebp - 0x18], esi
mov esi, edi
mov edi, dword [ebp - 0x18]
push esi
mov ecx, edi
call fcn.006073f0
test byte [esi + 0x116], 1
je 0x5952dc
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esi, 0x128
dec ebx
jne 0x5952c4
mov edi, dword [ebp - 0x24]
push dword [ebp - 0x14]
push str.removed__d_files_n
call fcn.005f20b0
add esp, 8
test edi, edi
je 0x595305
push edi
call fcn.005f1450
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x595320
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x618
mov eax, dword [0x79b5e0]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push str.MiniA.exe
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x110]
push 0x6edbc0
push eax
call fcn.0058d780
push 0x847a70
lea eax, [ebp - 0x618]
push str.Allow_network_traffic_for__s
push eax
call fcn.0058d7a0
add esp, 0x1c
lea eax, [ebp - 0x618]
lea ecx, [ebp - 0x110]
push eax
call fcn.0058d420
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
call fcn.0061b9b8
mov esp, ebp
pop ebp
ret
Function at 0x595800
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x79b5e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push str.Making_sure_extracted_files_exists_n
mov edi, ecx
call fcn.005f20b0
add esp, 4
lea ecx, [edi + 0x4c0]
push 1
push 1
call fcn.00606bd0
mov eax, dword [edi + 0x5cc]
xor ebx, ebx
sub eax, dword [edi + 0x5c8]
sar eax, 2
test eax, eax
je 0x5958e3
push esi
lea ecx, [ecx]
mov eax, dword [edi + 0x5c8]
mov esi, dword [eax + ebx*4]
test byte [esi + 0x116], 1
je 0x5958ca
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x40c]
push eax
push esi
call fcn.005f28e0
add esp, 0xc
test al, al
je 0x595899
mov eax, dword [ebp - 0x40c]
cmp eax, dword [esi + 0x10e]
jne 0x595899
mov eax, dword [ebp - 0x408]
cmp eax, dword [esi + 0x106]
je 0x5958ca
push esi
push str.restoring__s_n
call fcn.005f20b0
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
call dword [sym.imp.dbghelp.dll_MakeSureDirectoryPathExists]
push 0x6edd40
push esi
lea ecx, [edi + 0x4c0]
call fcn.006061b0
test al, al
je 0x59590b
mov eax, dword [edi + 0x5cc]
inc ebx
sub eax, dword [edi + 0x5c8]
sar eax, 2
cmp ebx, eax
jb 0x595850
pop esi
lea ecx, [edi + 0x4c0]
call fcn.00605eb0
push str.Making_sure_extracted_files_exists___finished_n
call fcn.005f20b0
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop edi
pop ebx
call fcn.0061b9b8
mov esp, ebp
pop ebp
ret
push esi
lea eax, [ebp - 0x404]
push str.Cant_extract_file__s_nPlease_delete_this_file_manually
push eax
call fcn.0058d7a0
add esp, 0xc
lea eax, [ebp - 0x404]
push eax
push edi
call fcn.00594310
int3
Function at 0x595ee0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63ebf0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x79b5e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
cmp dword [esi + 0x20d84], 0
je 0x595f39
push 0
push 0x36f
push str.Updater.cpp
push str.status___STATUS_Checking
call fcn.005f2580
add esp, 0x10
mov ecx, esi
call fcn.00594370
mov ecx, esi
call fcn.00594590
test al, al
je 0x595f64
mov ecx, esi
call fcn.00594600
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [0x8477b3], 0
mov byte [esi + 0x84], 1
jne 0x595f7b
mov eax, 3
jmp 0x595fd3
mov eax, dword [0x848f68]
or eax, dword [0x848f6c]
jne 0x595f8f
mov eax, 3
jmp 0x595fd3
lea eax, [esi + 0x20d8d]
push str.Checking_for_linked_steam_account
push eax
call fcn.0058d7a0
add esp, 8
lea ecx, [esi + 0x215f8]
call fcn.005994f0
test al, al
jne 0x595fb9
mov eax, 3
jmp 0x595fd3
mov ecx, esi
call fcn.00596c80
xor eax, eax
cmp dword [esi + 0x20d84], 5
sete al
lea eax, [eax*2 + 3]
mov dword [esi + 0x20d84], eax
lea eax, [esi + 0x20d8d]
push 0x6e90d9
push eax
call fcn.0058d7a0
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 8
cmp dword [esi + 0x20d84], 5
jne 0x5960a2
mov eax, dword [esi + 0x21ff8]
mov dword [0x847d30], eax
mov eax, dword [esi + 0x21ffc]
mov dword [0x847d34], eax
mov eax, dword [0x847d40]
or eax, dword [0x847d44]
je 0x59604b
call fcn.0058e540
test al, al
je 0x59604b
push 0
push 0
push 0x847d30
push 0x58e160
push 0
push 0
call fcn.0061c970
add esp, 0x18
mov dword [0x847ef8], eax
mov ecx, esi
call fcn.00594910
mov ecx, esi
call fcn.00594ac0
push dword [esi + 0x18]
push dword [esi + 0x5c4]
push str.current_build_version_d__updater_data_version_d_n
call fcn.005f20b0
mov eax, dword [esi + 0x5c4]
add esp, 0xc
mov ecx, esi
cmp eax, dword [esi + 0x18]
jne 0x596081
call fcn.00595df0
call fcn.00594d20
mov ecx, esi
call fcn.005954d0
mov ecx, esi
call fcn.00595d50
mov ecx, esi
call fcn.00595cf0
mov ecx, esi
call fcn.00595df0
push 0x32
call edi
jmp 0x595ff3

Function at 0x596ef0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
lea ecx, [esi + 0x215f8]
call fcn.00593780
push 0
push 0
push esi
push 0x596b80
push 0
push 0
call fcn.0061c970
add esp, 0x18
mov dword [esi + 0x215f0], eax
pop esi
ret

Function at 0x597070
Capabilities:
Create thread

Disassembly:
push esi
push edi
mov edi, ecx
lea edx, [edi + 0x22210]
mov esi, edx
lea ecx, [esi + 1]
nop
mov al, byte [esi]
inc esi
test al, al
jne 0x597080
sub esi, ecx
cmp esi, 0x13
je 0x5970b6
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x597091
sub edx, ecx
cmp edx, 0x1d
je 0x5970b6
push 0
push str.Create_Account
push str.Please_enter_Serial_Key_in_following_format:_nXXXX_XXXX_XXXX_XXXX_or_XXXXX_XXXXX_XXXXX_XXXXX_XXXXX
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
ret
push 0
push 0
push edi
push 0x596f20
push 0
push 0
call fcn.0061c970
add esp, 0x18
mov dword [edi + 0x215f0], eax
pop edi
pop esi
ret
Function at 0x597440
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
push edi
lea ecx, [esi + 0x2200c]
mov edx, ecx
lea edi, [edx + 1]
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x597450
sub edx, edi
cmp edx, 4
jae 0x59747f
push 0
push str.Create_Account
push str.email_address_is_too_short
push 0
mov dword [esi + 0x22008], 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
ret
call fcn.00597100
test eax, eax
jne 0x5974a3
push eax
push str.Create_Account
push str.email_address_is_not_valid
push eax
mov dword [esi + 0x22008], eax
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
ret
lea ecx, [esi + 0x2210c]
lea eax, [esi + 0x2208c]
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x5974d0
test dl, dl
je 0x5974cc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x5974d0
add eax, 2
add ecx, 2
test dl, dl
jne 0x5974b0
xor eax, eax
jmp 0x5974d5
sbb eax, eax
or eax, 1
push 0
test eax, eax
je 0x5974fa
push str.Create_Account
push str.Passwords_do_not_match
push 0
mov dword [esi + 0x22008], 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
ret
push 0
push esi
push 0x5970e0
push 0
push 0
call fcn.0061c970
add esp, 0x18
mov dword [esi + 0x215f0], eax
pop edi
pop esi
ret

Function at 0x597710
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x215d0], 0
je 0x597737
push 0
push 0x60c
push str.Updater.cpp
push str.mainThread___NULL
call fcn.005f2580
add esp, 0x10
cmp dword [edi + 0x215f0], 0
je 0x597759
push 0
push 0x60d
push str.Updater.cpp
push str.loginThread___NULL
call fcn.005f2580
add esp, 0x10
push 0
push 0
push edi
push 0x596170
push 0
push 0
call fcn.0061c970
push 0
push 0
push edi
push 0x596b40
push 0
push 0
mov dword [edi + 0x215d0], eax
call fcn.0061c970
add esp, 0x30
mov dword [edi + 0x22508], eax
lea esi, [edi + 0x215e0]
mov ebx, 3
lea esp, [esp]
push 0
push 0
push edi
push 0x596b60
push 0
push 0
call fcn.0061c970
add esp, 0x18
mov dword [esi], eax
lea esi, [esi + 4]
dec ebx
jne 0x5977a0
pop edi
pop esi
pop ebx
ret
Function at 0x5977d0
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
push edi
push str.CUpdater::Stop___n
mov ebx, ecx
call fcn.005f20b0
add esp, 4
cmp byte [ebx + 0x20d8c], 0
jne 0x5977f1
mov eax, dword [ebx + 0x215d8]
mov edi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x82a704
call edi
lea esi, [ebx + 0x20d6c]
push esi
call edi
mov ecx, dword [ebx + 0x215d0]
mov edi, dword [sym.imp.KERNEL32.dll_TerminateThread]
test ecx, ecx
je 0x597832
push 0
push ecx
call edi
push dword [ebx + 0x215d0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 0x215d0], 0
mov eax, dword [ebx + 0x22508]
test eax, eax
je 0x597857
push 0
push eax
call edi
push dword [ebx + 0x22508]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 0x22508], 0
mov eax, dword [ebx + 0x215f0]
test eax, eax
je 0x59787c
push 0
push eax
call edi
push dword [ebx + 0x215f0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 0x215f0], 0
lea edi, [ebx + 0x215e0]
mov ebx, 3
mov eax, dword [edi]
test eax, eax
je 0x5978a4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], 0
add edi, 4
dec ebx
jne 0x597887
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call esi
push 0x82a704
call esi
pop edi
pop esi
pop ebx
ret

Function at 0x598c90
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x63efd8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x79b5e0]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov eax, dword [0x79b5e0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 0x10]
sub esp, 0x18
mov ecx, esp
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.0058c600
push dword [ebp + 0xc]
lea eax, [esp + 0x2c]
push dword [ebp + 8]
push eax
call fcn.00598bb0
add esp, 0x24
mov dword [esp + 0x38], 0
cmp dword [eax + 0x14], 0x10
jb 0x598d0d
mov eax, dword [eax]
mov dword [esp + 0xc], eax
mov ecx, esi
lea eax, [esp + 0xc]
push eax
call fcn.0061dcb3
cmp dword [esp + 0x24], 0x10
mov dword [esi], vtable.std::runtime_error.0
jb 0x598d36
push dword [esp + 0x10]
call fcn.005f1450
add esp, 4
mov ecx, dword [ebp + 8]
mov eax, esi
mov dword [esi + 0xc], ecx
mov ecx, dword [ebp + 0xc]
mov dword [esi], vtable.std::_System_error.0
mov dword [esi + 0x10], ecx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0061b9b8
mov esp, ebp
pop ebp
ret 0xc