joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5853b0
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x6a1da0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x41c]
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
push eax
lea eax, [ebp - 0x418]
push eax
push edi
call fcn.0058ab10
add esp, 0xc
test al, al
je 0x5853fb
mov eax, dword [ebp - 0x418]
cmp eax, dword [edi + 0x10e]
je 0x5854dd
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edi
call dword [sym.imp.dbghelp.dll_MakeSureDirectoryPathExists]
push 0x6749dc
push edi
call fcn.005af96b
add esp, 8
mov dword [ebp - 0x410], eax
test eax, eax
je 0x5854f0
lea eax, [ebp - 0x414]
mov ecx, esi
push eax
lea eax, [ebp - 0x40c]
push eax
call fcn.004011c0
push eax
mov ecx, esi
call fcn.004011f0
push eax
push edi
lea ecx, [ebx + 0x4c0]
call fcn.0059a790
mov eax, dword [edi + 0x106]
cmp eax, dword [ebp - 0x414]
je 0x585476
push 0
push 0x18b
push str.Updater.cpp
push str.fe__size__out_size
call fcn.0058a010
add esp, 0x10
lea esi, [ebx + 0x20d6c]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push dword [ebp - 0x410]
push 1
push dword [ebp - 0x414]
push dword [ebp - 0x40c]
call fcn.005b0b83
push dword [ebp - 0x410]
call fcn.005af345
add esp, 0x14
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push str.siamexe.exe
push edi
call fcn.005b2c1b
add esp, 8
test eax, eax
jne 0x5854cf
mov byte [ebx + 0x215ec], 1
call fcn.00585790
push dword [ebp - 0x40c]
call fcn.0058bc70
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005aec53
mov esp, ebp
pop ebp
ret 8
push edi
lea eax, [ebp - 0x408]
push str.Cant_replace_file__s_nPlease_delete_this_file_manually
push eax
call fcn.0057df30
add esp, 0xc
lea eax, [ebp - 0x408]
push eax
push ebx
call fcn.005847e0
int3
Function at 0x5855f0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5cc978
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x6a1da0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
push 0x400
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0
call fcn.00587d70
mov eax, dword [esi + 0x5cc]
xor edi, edi
sub eax, dword [esi + 0x5c8]
mov ebx, dword [ebp - 0x20]
sar eax, 2
mov dword [ebp - 0x10], edi
test eax, eax
je 0x58570c
lea esp, [esp]
mov eax, dword [esi + 0x5c8]
mov esi, dword [eax + edi*4]
test dword [esi + 0x116], 0x100000
jne 0x5856ee
cmp esi, ebx
jae 0x5856c1
mov eax, dword [ebp - 0x24]
cmp eax, esi
ja 0x5856c1
sub esi, eax
mov eax, 0xdd67c8a7
imul esi
add edx, esi
sar edx, 8
mov esi, edx
shr esi, 0x1f
add esi, edx
cmp ebx, dword [ebp - 0x1c]
jne 0x5856b6
push ecx
lea ecx, [ebp - 0x24]
call fcn.00587e10
mov ebx, dword [ebp - 0x20]
imul esi, esi, 0x128
add esi, dword [ebp - 0x24]
jmp 0x5856d2
cmp ebx, dword [ebp - 0x1c]
jne 0x5856d2
push ecx
lea ecx, [ebp - 0x24]
call fcn.00587e10
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x5856e2
mov ecx, 0x4a
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x10]
add ebx, 0x128
inc dword [ebp - 0x14]
mov dword [ebp - 0x20], ebx
mov esi, dword [ebp - 0x18]
inc edi
mov dword [ebp - 0x10], edi
mov eax, dword [esi + 0x5cc]
sub eax, dword [esi + 0x5c8]
sar eax, 2
cmp edi, eax
jb 0x585670
mov edi, dword [ebp - 0x24]
mov eax, 0xdd67c8a7
sub ebx, edi
imul ebx
add edx, ebx
sar edx, 8
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
je 0x585758
add esi, 0x5c4
mov dword [ebp - 0x18], esi
mov esi, edi
mov edi, dword [ebp - 0x18]
push esi
mov ecx, edi
call fcn.0059a3b0
test byte [esi + 0x116], 1
je 0x58574c
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esi, 0x128
dec ebx
jne 0x585734
mov edi, dword [ebp - 0x24]
push dword [ebp - 0x14]
push str.removed__d_files_n
call fcn.00589b40
add esp, 8
test edi, edi
je 0x585775
push edi
call fcn.0058bc70
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x585790
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x618
mov eax, dword [0x6a1da0]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push str.siamexe.exe
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x110]
push 0x675754
push eax
call fcn.0057df10
push str.WarZ_Siam_MMO__Survivor_Stories
lea eax, [ebp - 0x618]
push str.Allow_network_traffic_for__s
push eax
call fcn.0057df30
add esp, 0x1c
lea eax, [ebp - 0x618]
lea ecx, [ebp - 0x110]
push eax
call fcn.0057dbc0
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
call fcn.005aec53
mov esp, ebp
pop ebp
ret
Function at 0x585c80
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x6a1da0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push str.Making_sure_extracted_files_exists_n
mov edi, ecx
call fcn.00589b40
add esp, 4
lea ecx, [edi + 0x4c0]
push 1
push 1
call fcn.00599b90
mov eax, dword [edi + 0x5cc]
xor ebx, ebx
sub eax, dword [edi + 0x5c8]
sar eax, 2
test eax, eax
je 0x585d63
push esi
lea ecx, [ecx]
mov eax, dword [edi + 0x5c8]
mov esi, dword [eax + ebx*4]
test byte [esi + 0x116], 1
je 0x585d4a
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x40c]
push eax
push esi
call fcn.0058ab10
add esp, 0xc
test al, al
je 0x585d19
mov eax, dword [ebp - 0x40c]
cmp eax, dword [esi + 0x10e]
jne 0x585d19
mov eax, dword [ebp - 0x408]
cmp eax, dword [esi + 0x106]
je 0x585d4a
push esi
push str.restoring__s_n
call fcn.00589b40
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
call dword [sym.imp.dbghelp.dll_MakeSureDirectoryPathExists]
push 0x6758d4
push esi
lea ecx, [edi + 0x4c0]
call fcn.00599170
test al, al
je 0x585d8b
mov eax, dword [edi + 0x5cc]
inc ebx
sub eax, dword [edi + 0x5c8]
sar eax, 2
cmp ebx, eax
jb 0x585cd0
pop esi
lea ecx, [edi + 0x4c0]
call fcn.00598e70
push str.Making_sure_extracted_files_exists___finished_n
call fcn.00589b40
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop edi
pop ebx
call fcn.005aec53
mov esp, ebp
pop ebp
ret
push esi
lea eax, [ebp - 0x404]
push str.Cant_extract_file__s_nPlease_delete_this_file_manually
push eax
call fcn.0057df30
add esp, 0xc
lea eax, [ebp - 0x404]
push eax
push edi
call fcn.005847e0
int3
Function at 0x5863e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5cca50
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x6a1da0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
cmp dword [esi + 0x20d84], 0
je 0x586439
push 0
push 0x33b
push str.Updater.cpp
push str.status___STATUS_Checking
call fcn.0058a010
add esp, 0x10
mov ecx, esi
call fcn.00584840
mov ecx, esi
call fcn.00584a60
test al, al
je 0x586464
mov ecx, esi
call fcn.00584ad0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov byte [esi + 0x84], 1
cmp dword [esi + 0x20d84], 5
push 0x674dcc
sete al
lea eax, [eax*2 + 3]
mov dword [esi + 0x20d84], eax
lea eax, [esi + 0x20d8d]
push eax
call fcn.0057df30
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 8
mov edi, edi
cmp dword [esi + 0x20d84], 5
jne 0x58654f
mov eax, dword [esi + 0x21778]
mov dword [0x74e290], eax
mov eax, dword [esi + 0x2177c]
mov dword [0x74e294], eax
mov eax, dword [0x74e2a0]
or eax, dword [0x74e2a4]
je 0x5864f8
call fcn.0057e980
test al, al
je 0x5864f8
push 0
push 0
push 0x74e290
push 0x57e5a0
push 0
push 0
call fcn.005af5de
add esp, 0x18
mov dword [0x74e458], eax
mov ecx, esi
call fcn.00584d80
mov ecx, esi
call fcn.00584f30
push dword [esi + 0x18]
push dword [esi + 0x5c4]
push str.current_build_version_d__updater_data_version_d_n
call fcn.00589b40
mov eax, dword [esi + 0x5c4]
add esp, 0xc
mov ecx, esi
cmp eax, dword [esi + 0x18]
jne 0x58652e
call fcn.00586310
call fcn.00585190
mov ecx, esi
call fcn.00585940
mov ecx, esi
call fcn.00586270
mov ecx, esi
call fcn.00586210
mov ecx, esi
call fcn.00586310
push 0x32
call edi
jmp 0x5864a0

Function at 0x5871a0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
lea ecx, [esi + 0x215f8]
call fcn.00583c50
push 0
push 0
push esi
push 0x586e00
push 0
push 0
call fcn.005af5de
add esp, 0x18
mov dword [esi + 0x215f0], eax
pop esi
ret

Function at 0x587320
Capabilities:
Create thread

Disassembly:
push esi
push edi
mov edi, ecx
lea edx, [edi + 0x21990]
mov esi, edx
lea ecx, [esi + 1]
nop
mov al, byte [esi]
inc esi
test al, al
jne 0x587330
sub esi, ecx
cmp esi, 0x13
je 0x587366
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x587341
sub edx, ecx
cmp edx, 0x1d
je 0x587366
push 0
push str.Create_Account
push str.Please_enter_Serial_Key_in_following_format:_nXXXX_XXXX_XXXX_XXXX_or_XXXXX_XXXXX_XXXXX_XXXXX_XXXXX
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
ret
push 0
push 0
push edi
push 0x5871d0
push 0
push 0
call fcn.005af5de
add esp, 0x18
mov dword [edi + 0x215f0], eax
pop edi
pop esi
ret
Function at 0x5876e0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
push edi
lea ecx, [esi + 0x2178c]
mov edx, ecx
lea edi, [edx + 1]
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x5876f0
sub edx, edi
cmp edx, 4
jae 0x58771f
push 0
push str.Create_Account
push str.email_address_is_too_short
push 0
mov dword [esi + 0x21788], 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
ret
call fcn.005873b0
test eax, eax
jne 0x587743
push eax
push str.Create_Account
push str.email_address_is_not_valid
push eax
mov dword [esi + 0x21788], eax
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
ret
lea ecx, [esi + 0x2188c]
lea eax, [esi + 0x2180c]
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x587770
test dl, dl
je 0x58776c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x587770
add eax, 2
add ecx, 2
test dl, dl
jne 0x587750
xor eax, eax
jmp 0x587775
sbb eax, eax
or eax, 1
push 0
test eax, eax
je 0x58779a
push str.Create_Account
push str.Passwords_do_not_match
push 0
mov dword [esi + 0x21788], 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
ret
push 0
push esi
push 0x587390
push 0
push 0
call fcn.005af5de
add esp, 0x18
mov dword [esi + 0x215f0], eax
pop edi
pop esi
ret

Function at 0x5879b0
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x215d0], 0
je 0x5879d7
push 0
push 0x5b9
push str.Updater.cpp
push str.mainThread___NULL
call fcn.0058a010
add esp, 0x10
cmp dword [edi + 0x215f0], 0
je 0x5879f9
push 0
push 0x5ba
push str.Updater.cpp
push str.loginThread___NULL
call fcn.0058a010
add esp, 0x10
push 0
push 0
push edi
push 0x586610
push 0
push 0
call fcn.005af5de
push 0
push 0
push edi
push 0x586dc0
push 0
push 0
mov dword [edi + 0x215d0], eax
call fcn.005af5de
add esp, 0x30
mov dword [edi + 0x21c88], eax
lea esi, [edi + 0x215e0]
mov ebx, 3
lea esp, [esp]
push 0
push 0
push edi
push 0x586de0
push 0
push 0
call fcn.005af5de
add esp, 0x18
mov dword [esi], eax
lea esi, [esi + 4]
dec ebx
jne 0x587a40
pop edi
pop esi
pop ebx
ret
Function at 0x587af0
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
push edi
push str.CUpdater::Stop___n
mov ebx, ecx
call fcn.00589b40
add esp, 4
cmp byte [ebx + 0x20d8c], 0
jne 0x587b11
mov eax, dword [ebx + 0x215d8]
mov edi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x730f24
call edi
lea esi, [ebx + 0x20d6c]
push esi
call edi
mov ecx, dword [ebx + 0x215d0]
mov edi, dword [sym.imp.KERNEL32.dll_TerminateThread]
test ecx, ecx
je 0x587b52
push 0
push ecx
call edi
push dword [ebx + 0x215d0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 0x215d0], 0
mov eax, dword [ebx + 0x21c88]
test eax, eax
je 0x587b77
push 0
push eax
call edi
push dword [ebx + 0x21c88]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 0x21c88], 0
mov eax, dword [ebx + 0x215f0]
test eax, eax
je 0x587b9c
push 0
push eax
call edi
push dword [ebx + 0x215f0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 0x215f0], 0
lea edi, [ebx + 0x215e0]
mov ebx, 3
mov eax, dword [edi]
test eax, eax
je 0x587bc4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], 0
add edi, 4
dec ebx
jne 0x587ba7
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call esi
push 0x730f24
call esi
pop edi
pop esi
pop ebx
ret
Function at 0x588b30
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5cce11
mov eax, dword fs:[0]
push eax
sub esp, 0xb4
push esi
mov eax, dword [0x6a1da0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetControlComputerNameComputerName
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x588ba7
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x80
push eax
lea eax, [esi + 0x100]
push eax
push 0
push 0
push str.ComputerName
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0xbc]
call fcn.00401cb0
lea ecx, [ebp - 0x78]
mov dword [ebp - 4], 0
call fcn.00401360
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.00401000
push str.api_Login.aspx
lea ecx, [ebp - 0xc0]
mov byte [ebp - 4], 2
call fcn.005881f0
push esi
push str.username
lea ecx, [ebp - 0x78]
mov dword [ebp - 4], 3
call fcn.00401700
lea eax, [esi + 0x80]
push eax
push str.password
lea ecx, [ebp - 0x78]
call fcn.00401700
lea eax, [esi + 0x100]
push eax
push str.ComputerName
lea ecx, [ebp - 0x78]
call fcn.00401700
mov ecx, dword [ebp - 0x38]
test ecx, ecx
je 0x588c32
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [ebp - 0x38], 0
call fcn.00589a80
lea eax, [ebp - 0x78]
fstp st(0)
push eax
push 1
push 0x229
push str.api.warzsiam.in.th
lea ecx, [ebp - 0xbc]
call fcn.00402050
push eax
lea ecx, [ebp - 0xc0]
mov dword [ebp - 0x38], eax
call fcn.00588440
mov dword [ebp - 0x34], eax
test eax, eax
je 0x588c84
push eax
push str.Login_FAILED__code:__d_n
call fcn.00589b40
add esp, 8
mov dword [esi + 0x18c], 3
jmp 0x588c92
lea eax, [ebp - 0xc0]
mov ecx, esi
push eax
call fcn.005889a0
mov dword [ebp - 4], 6
mov ecx, dword [ebp - 0x38]
test ecx, ecx
je 0x588cad
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [ebp - 0x38], 0
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 5
call fcn.004010b0
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 4
call fcn.00401440
lea ecx, [ebp - 0xbc]
mov dword [ebp - 4], 0xffffffff
call fcn.00401d70
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x588cf0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0
lea eax, [ebp - 4]
mov esi, ecx
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareCodex_Development_GroupWarZ_Siam_MMO
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x588d4c
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x588d23
sub ecx, edx
lea eax, [ecx + 1]
push eax
push esi
push 1
push 0
push str.username
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x588d60
Capabilities:
Encrypt data using dpapi
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 4]
push esi
push 0
push eax
push 0
push 2
push 0
push 0
push 0
push str.AppEventsEventLabelsSystemFool
push SysReAllocString
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x588df5
lea ecx, [esi + 0x80]
mov dword [ebp - 0x10], ecx
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x588da0
sub ecx, edx
lea eax, [ecx + 1]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.CRYPT32.dll_CryptProtectData]
test eax, eax
je 0x588dec
push dword [ebp - 0xc]
push dword [ebp - 8]
push 3
push 0
push str.password
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x588e00
Capabilities:
Encrypt data using dpapi
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x6a1da0]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
lea eax, [ebp - 0x20c]
mov edi, ecx
push eax
push 1
push 0
push str.AppEventsEventLabelsSystemFool
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x588f05
push esi
lea eax, [ebp - 0x208]
mov dword [ebp - 0x208], 0x200
push eax
lea eax, [ebp - 0x204]
push eax
push 0
push 0
push str.password
push dword [ebp - 0x20c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x20c]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x588f05
lea eax, [ebp - 0x204]
mov dword [ebp - 0x218], eax
mov eax, dword [ebp - 0x208]
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
je 0x588f05
mov eax, dword [ebp - 0x214]
mov ecx, 0x7f
cmp eax, 0x80
cmova eax, ecx
push eax
push dword [ebp - 0x210]
lea eax, [edi + 0x80]
push eax
call fcn.005b0cd0
add esp, 0xc
mov byte [edi + 0xff], 0
push dword [ebp - 0x210]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov al, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005aec53
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
pop edi
call fcn.005aec53
mov esp, ebp
pop ebp
ret
Function at 0x589590
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov ecx, dword [0x730fa8]
sub esp, 0x10
test ecx, ecx
je 0x5895af
cmp dword [0x730fa4], 1
jl 0x5895af
test ecx, ecx
je 0x5895af
call fcn.005a2770
call fcn.00589a80
mov eax, dword [0x6a826c]
mov ecx, 0x1e
fstp dword [0x6a0be0]
movss xmm2, dword [0x6a0be0]
xorps xmm1, xmm1
subss xmm2, dword [0x6a8268]
movss dword [eax*4 + 0x6a8270], xmm2
inc eax
cdq
idiv ecx
movss dword [0x6a0be4], xmm2
mov eax, 0x6a8274
mov dword [0x6a826c], edx
jmp 0x589600
addss xmm1, dword [eax - 4]
addss xmm1, dword [eax]
addss xmm1, dword [eax + 4]
addss xmm1, dword [eax + 8]
addss xmm1, dword [eax + 0xc]
addss xmm1, dword [eax + 0x10]
addss xmm1, dword [eax + 0x14]
addss xmm1, dword [eax + 0x18]
addss xmm1, dword [eax + 0x1c]
addss xmm1, dword [eax + 0x20]
add eax, 0x28
cmp eax, 0x6a82ec
jl 0x589600
mulss xmm1, dword [0x65cac0]
movss xmm0, dword [0x65cabc]
comiss xmm0, xmm2
movss dword [0x6a0be8], xmm1
jbe 0x589662
mov dword [0x6a0be4], 0x3983126f
comiss xmm0, xmm1
jbe 0x589671
mov dword [0x6a0be8], 0x3983126f
cmp dword [0x6a8224], 0
jne 0x5896ad
lea eax, [esp]
mov dword [0x6a8224], 1
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov edx, dword [esp + 4]
mov ecx, dword [esp]
call fcn.005b6c1d
push 0x6a8348
movsd qword [0x6a8340], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [esp + 8]
sub ecx, dword [0x6a8348]
mov edx, dword [esp + 0xc]
sbb edx, dword [0x6a834c]
call fcn.005b6c1d
divsd xmm0, qword [0x6a8340]
movsd xmm1, qword [0x6a8230]
xorps xmm2, xmm2
cvtsd2ss xmm2, xmm0
movaps xmm0, xmm2
subss xmm0, dword [0x6a823c]
comiss xmm0, dword [0x65cac4]
jbe 0x589727
movd xmm0, dword [0x6a8238]
xor eax, eax
cvtdq2pd xmm0, xmm0
movss dword [0x6a823c], xmm2
divsd xmm1, xmm0
cvtpd2ps xmm0, xmm1
xorps xmm1, xmm1
movss dword [0x6a8240], xmm0
jmp 0x58972c
mov eax, dword [0x6a8238]
movss xmm0, dword [0x676968]
inc eax
divss xmm0, dword [0x6a0be4]
mov dword [0x6a8238], eax
cvtps2pd xmm0, xmm0
addsd xmm0, xmm1
movsd qword [0x6a8230], xmm0
add esp, 0x10
jmp 0x59bfb0
push ecx
call fcn.00589a80
fstp dword [esp]
movss xmm0, dword [esp]
subss xmm0, dword [0x730f78]
comiss xmm0, dword [0x676968]
jbe 0x59bffe
mov eax, dword [0x730f4c]
test eax, eax
je 0x59bffe
push eax
push str.Loads_unloads_collapsed:__d_n
call fcn.00589b40
movss xmm0, dword [esp + 8]
add esp, 8
mov dword [0x730f4c], 0
movss dword [0x730f78], xmm0
pop ecx
ret
Function at 0x589a80
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub esp, 0x10
cmp dword [0x6a8224], 0
jne 0x589abf
lea eax, [esp]
mov dword [0x6a8224], 1
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov edx, dword [esp + 4]
mov ecx, dword [esp]
call fcn.005b6c1d
push 0x6a8348
movsd qword [0x6a8340], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [esp + 8]
sub ecx, dword [0x6a8348]
mov edx, dword [esp + 0xc]
sbb edx, dword [0x6a834c]
call fcn.005b6c1d
divsd xmm0, qword [0x6a8340]
cvtsd2ss xmm0, xmm0
movss dword [esp], xmm0
fld dword [esp]
add esp, 0x10
ret