joyce8/EMBER2024-capa huggingface dataset:
Function at 0x565610
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x6e8da0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x41c]
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
push eax
lea eax, [ebp - 0x418]
push eax
push edi
call fcn.005b7f20
add esp, 0xc
test al, al
je 0x56565b
mov eax, dword [ebp - 0x418]
cmp eax, dword [edi + 0x112]
je 0x56573d
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edi
call dword [sym.imp.dbghelp.dll_MakeSureDirectoryPathExists]
push 0x6a6c9c
push edi
call fcn.005dca8b
add esp, 8
mov dword [ebp - 0x410], eax
test eax, eax
je 0x565750
lea eax, [ebp - 0x414]
mov ecx, esi
push eax
lea eax, [ebp - 0x40c]
push eax
call fcn.004011c0
push eax
mov ecx, esi
call fcn.004011f0
push eax
push edi
lea ecx, [ebx + 0x4c0]
call fcn.005c7b50
mov eax, dword [edi + 0x10a]
cmp eax, dword [ebp - 0x414]
je 0x5656d6
push 0
push 0x19b
push str.Updater.cpp
push str.fe__size__out_size
call fcn.005b72c0
add esp, 0x10
lea esi, [ebx + 0x20d6c]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push dword [ebp - 0x410]
push 1
push dword [ebp - 0x414]
push dword [ebp - 0x40c]
call fcn.005ddca3
push dword [ebp - 0x410]
call fcn.005dc465
add esp, 0x14
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push str.infestation.exe
push edi
call fcn.005dfd4b
add esp, 8
test eax, eax
jne 0x56572f
mov byte [ebx + 0x215ec], 1
call fcn.005659f0
push dword [ebp - 0x40c]
call fcn.005b9080
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005dbd73
mov esp, ebp
pop ebp
ret 8
push edi
lea eax, [ebp - 0x408]
push str.Cant_replace_file__s_nPlease_delete_this_file_manually
push eax
call fcn.0055d630
add esp, 0xc
lea eax, [ebp - 0x408]
push eax
push ebx
call fcn.005649e0
int3
Function at 0x565850
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fdda8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x6e8da0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
push 0x400
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0
call fcn.005680d0
mov eax, dword [esi + 0x5cc]
xor edi, edi
sub eax, dword [esi + 0x5c8]
mov ebx, dword [ebp - 0x20]
sar eax, 2
mov dword [ebp - 0x10], edi
test eax, eax
je 0x56596c
lea esp, [esp]
mov eax, dword [esi + 0x5c8]
mov esi, dword [eax + edi*4]
test dword [esi + 0x116], 0x100000
jne 0x56594e
cmp esi, ebx
jae 0x565921
mov eax, dword [ebp - 0x24]
cmp eax, esi
ja 0x565921
sub esi, eax
mov eax, 0xdd67c8a7
imul esi
add edx, esi
sar edx, 8
mov esi, edx
shr esi, 0x1f
add esi, edx
cmp ebx, dword [ebp - 0x1c]
jne 0x565916
push ecx
lea ecx, [ebp - 0x24]
call fcn.00568170
mov ebx, dword [ebp - 0x20]
imul esi, esi, 0x128
add esi, dword [ebp - 0x24]
jmp 0x565932
cmp ebx, dword [ebp - 0x1c]
jne 0x565932
push ecx
lea ecx, [ebp - 0x24]
call fcn.00568170
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x565942
mov ecx, 0x4a
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x10]
add ebx, 0x128
inc dword [ebp - 0x14]
mov dword [ebp - 0x20], ebx
mov esi, dword [ebp - 0x18]
inc edi
mov dword [ebp - 0x10], edi
mov eax, dword [esi + 0x5cc]
sub eax, dword [esi + 0x5c8]
sar eax, 2
cmp edi, eax
jb 0x5658d0
mov edi, dword [ebp - 0x24]
mov eax, 0xdd67c8a7
sub ebx, edi
imul ebx
add edx, ebx
sar edx, 8
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
je 0x5659b8
add esi, 0x5c4
mov dword [ebp - 0x18], esi
mov esi, edi
mov edi, dword [ebp - 0x18]
push esi
mov ecx, edi
call fcn.005c7770
test byte [esi + 0x116], 1
je 0x5659ac
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esi, 0x128
dec ebx
jne 0x565994
mov edi, dword [ebp - 0x24]
push dword [ebp - 0x14]
push str.removed__d_files_n
call fcn.005b6df0
add esp, 8
test edi, edi
je 0x5659d5
push edi
call fcn.005b9080
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5659f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x618
mov eax, dword [0x6e8da0]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push str.infestation.exe
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x110]
push 0x6b059c
push eax
call fcn.0055d610
push str.Infestation:_Survivor_Stories
lea eax, [ebp - 0x618]
push str.Allow_network_traffic_for__s
push eax
call fcn.0055d630
add esp, 0x1c
lea eax, [ebp - 0x618]
lea ecx, [ebp - 0x110]
push eax
call fcn.0055d2c0
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
call fcn.005dbd73
mov esp, ebp
pop ebp
ret
Function at 0x565ee0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x6e8da0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push str.Making_sure_extracted_files_exists_n
mov edi, ecx
call fcn.005b6df0
add esp, 4
lea ecx, [edi + 0x4c0]
push 1
push 1
call fcn.005c6f90
mov eax, dword [edi + 0x5cc]
xor ebx, ebx
sub eax, dword [edi + 0x5c8]
sar eax, 2
test eax, eax
je 0x565fc3
push esi
lea ecx, [ecx]
mov eax, dword [edi + 0x5c8]
mov esi, dword [eax + ebx*4]
test byte [esi + 0x116], 1
je 0x565faa
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x40c]
push eax
push esi
call fcn.005b7f20
add esp, 0xc
test al, al
je 0x565f79
mov eax, dword [ebp - 0x40c]
cmp eax, dword [esi + 0x112]
jne 0x565f79
mov eax, dword [ebp - 0x408]
cmp eax, dword [esi + 0x10a]
je 0x565faa
push esi
push str.restoring__s_n
call fcn.005b6df0
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
call dword [sym.imp.dbghelp.dll_MakeSureDirectoryPathExists]
push 0x6b073c
push esi
lea ecx, [edi + 0x4c0]
call fcn.005c6570
test al, al
je 0x565feb
mov eax, dword [edi + 0x5cc]
inc ebx
sub eax, dword [edi + 0x5c8]
sar eax, 2
cmp ebx, eax
jb 0x565f30
pop esi
lea ecx, [edi + 0x4c0]
call fcn.005c6260
push str.Making_sure_extracted_files_exists___finished_n
call fcn.005b6df0
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop edi
pop ebx
call fcn.005dbd73
mov esp, ebp
pop ebp
ret
push esi
lea eax, [ebp - 0x404]
push str.Cant_extract_file__s_nPlease_delete_this_file_manually
push eax
call fcn.0055d630
add esp, 0xc
lea eax, [ebp - 0x404]
push eax
push edi
call fcn.005649e0
int3
Function at 0x5665a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fde80
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x6e8da0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
cmp dword [esi + 0x20d84], 0
je 0x5665f9
push 0
push 0x34b
push str.Updater.cpp
push str.status___STATUS_Checking
call fcn.005b72c0
add esp, 0x10
mov ecx, esi
call fcn.00564a40
mov ecx, esi
call fcn.00564c60
test al, al
je 0x566624
mov ecx, esi
call fcn.00564cd0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [0x8a90f3], 0
mov byte [esi + 0x84], 1
jne 0x56663b
mov eax, 3
jmp 0x566693
mov eax, dword [0x8aad50]
or eax, dword [0x8aad54]
jne 0x56664f
mov eax, 3
jmp 0x566693
lea eax, [esi + 0x20d8d]
push str.Checking_for_linked_steam_account
push eax
call fcn.0055d630
add esp, 8
lea ecx, [esi + 0x215f8]
call fcn.00569110
test al, al
jne 0x566679
mov eax, 3
jmp 0x566693
mov ecx, esi
call fcn.00567340
xor eax, eax
cmp dword [esi + 0x20d84], 5
sete al
lea eax, [eax*2 + 3]
mov dword [esi + 0x20d84], eax
lea eax, [esi + 0x20d8d]
push 0x6af950
push eax
call fcn.0055d630
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 8
cmp dword [esi + 0x20d84], 5
jne 0x566762
mov eax, dword [esi + 0x2172c]
mov dword [0x8a9b20], eax
mov eax, dword [esi + 0x21730]
mov dword [0x8a9b24], eax
mov eax, dword [0x8a9b30]
or eax, dword [0x8a9b34]
je 0x56670b
call fcn.0055e030
test al, al
je 0x56670b
push 0
push 0
push 0x8a9b20
push 0x55dca0
push 0
push 0
call fcn.005dc6fe
add esp, 0x18
mov dword [0x8a9ce8], eax
mov ecx, esi
call fcn.00564fe0
mov ecx, esi
call fcn.00565190
push dword [esi + 0x18]
push dword [esi + 0x5c4]
push str.current_build_version_d__updater_data_version_d_n
call fcn.005b6df0
mov eax, dword [esi + 0x5c4]
add esp, 0xc
mov ecx, esi
cmp eax, dword [esi + 0x18]
jne 0x566741
call fcn.005664d0
call fcn.005653f0
mov ecx, esi
call fcn.00565ba0
mov ecx, esi
call fcn.00566430
mov ecx, esi
call fcn.005663d0
mov ecx, esi
call fcn.005664d0
push 0x32
call edi
jmp 0x5666b3
Function at 0x5675a0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
lea ecx, [esi + 0x215f8]
call fcn.00563e50
push 0
push 0
push esi
push 0x567240
push 0
push 0
call fcn.005dc6fe
add esp, 0x18
mov dword [esi + 0x215f0], eax
pop esi
ret

Function at 0x567720
Capabilities:
Create thread

Disassembly:
push esi
push edi
mov edi, ecx
lea edx, [edi + 0x21944]
mov esi, edx
lea ecx, [esi + 1]
nop
mov al, byte [esi]
inc esi
test al, al
jne 0x567730
sub esi, ecx
cmp esi, 0x13
je 0x567766
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x567741
sub edx, ecx
cmp edx, 0x1d
je 0x567766
push 0
push str.Create_Account
push str.Please_enter_Serial_Key_in_following_format:_nXXXX_XXXX_XXXX_XXXX_or_XXXXX_XXXXX_XXXXX_XXXXX_XXXXX
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
ret
push 0
push 0
push edi
push 0x5675d0
push 0
push 0
call fcn.005dc6fe
add esp, 0x18
mov dword [edi + 0x215f0], eax
pop edi
pop esi
ret

Function at 0x567af0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
push edi
lea ecx, [esi + 0x21740]
mov edx, ecx
lea edi, [edx + 1]
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x567b00
sub edx, edi
cmp edx, 4
jae 0x567b2f
push 0
push str.Create_Account
push str.email_address_is_too_short
push 0
mov dword [esi + 0x2173c], 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
ret
call fcn.005677b0
test eax, eax
jne 0x567b53
push eax
push str.Create_Account
push str.email_address_is_not_valid
push eax
mov dword [esi + 0x2173c], eax
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
ret
lea ecx, [esi + 0x21840]
lea eax, [esi + 0x217c0]
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x567b80
test dl, dl
je 0x567b7c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x567b80
add eax, 2
add ecx, 2
test dl, dl
jne 0x567b60
xor eax, eax
jmp 0x567b85
sbb eax, eax
or eax, 1
push 0
test eax, eax
je 0x567baa
push str.Create_Account
push str.Passwords_do_not_match
push 0
mov dword [esi + 0x2173c], 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
ret
push 0
push esi
push 0x567790
push 0
push 0
call fcn.005dc6fe
add esp, 0x18
mov dword [esi + 0x215f0], eax
pop edi
pop esi
ret

Function at 0x567d90
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x215d0], 0
je 0x567db7
push 0
push 0x5cb
push str.Updater.cpp
push str.mainThread___NULL
call fcn.005b72c0
add esp, 0x10
cmp dword [edi + 0x215f0], 0
je 0x567dd9
push 0
push 0x5cc
push str.Updater.cpp
push str.loginThread___NULL
call fcn.005b72c0
add esp, 0x10
push 0
push 0
push edi
push 0x566830
push 0
push 0
call fcn.005dc6fe
push 0
push 0
push edi
push 0x567200
push 0
push 0
mov dword [edi + 0x215d0], eax
call fcn.005dc6fe
add esp, 0x30
mov dword [edi + 0x21c3c], eax
lea esi, [edi + 0x215e0]
mov ebx, 3
lea esp, [esp]
push 0
push 0
push edi
push 0x567220
push 0
push 0
call fcn.005dc6fe
add esp, 0x18
mov dword [esi], eax
lea esi, [esi + 4]
dec ebx
jne 0x567e20
pop edi
pop esi
pop ebx
ret
Function at 0x567e50
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
push edi
push str.CUpdater::Stop___n
mov ebx, ecx
call fcn.005b6df0
add esp, 4
cmp byte [ebx + 0x20d8c], 0
jne 0x567e71
mov eax, dword [ebx + 0x215d8]
mov edi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x88c4dc
call edi
lea esi, [ebx + 0x20d6c]
push esi
call edi
mov ecx, dword [ebx + 0x215d0]
mov edi, dword [sym.imp.KERNEL32.dll_TerminateThread]
test ecx, ecx
je 0x567eb2
push 0
push ecx
call edi
push dword [ebx + 0x215d0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 0x215d0], 0
mov eax, dword [ebx + 0x21c3c]
test eax, eax
je 0x567ed7
push 0
push eax
call edi
push dword [ebx + 0x21c3c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 0x21c3c], 0
mov eax, dword [ebx + 0x215f0]
test eax, eax
je 0x567efc
push 0
push eax
call edi
push dword [ebx + 0x215f0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 0x215f0], 0
lea edi, [ebx + 0x215e0]
mov ebx, 3
mov eax, dword [edi]
test eax, eax
je 0x567f24
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], 0
add edi, 4
dec ebx
jne 0x567f07
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call esi
push 0x88c4dc
call esi
pop edi
pop esi
pop ebx
ret
Function at 0x568b90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fe1bf
mov eax, dword fs:[0]
push eax
sub esp, 0xc8
push ebx
push esi
push edi
mov eax, dword [0x6e8da0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi], 0
je 0x568bd8
push 0
push 0x21
push str.WOCreateAccHelper.cpp
push str.createAccCode__CA_Unactive
call fcn.005b72c0
add esp, 0x10
cmp byte [esi + 4], 0
lea edi, [esi + 4]
jne 0x568bf7
push 0
push 0x22
push str.WOCreateAccHelper.cpp
push 0x6afee8
call fcn.005b72c0
add esp, 0x10
cmp byte [esi + 0x84], 0
lea ebx, [esi + 0x84]
jne 0x568c1c
push 0
push 0x23
push str.WOCreateAccHelper.cpp
push str.passwd1
call fcn.005b72c0
add esp, 0x10
cmp byte [esi + 0x104], 0
jne 0x568c3b
push 0
push 0x24
push str.WOCreateAccHelper.cpp
push str.passwd2
call fcn.005b72c0
add esp, 0x10
lea eax, [ebp - 0x10]
push eax
push 0xf003f
push 0
push str.SoftwareHouse_of_Warrior_InteractiveWarZ
push bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x32
push eax
push 0x8a91dc
push 0
push 0
push str.hardwareid
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0xd0]
call fcn.00401d80
lea ecx, [ebp - 0x8c]
mov dword [ebp - 4], 0
call fcn.00401430
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 1
call fcn.00401000
push str.api_AccRegister.aspx
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 2
call fcn.005685a0
push edi
push str.username
lea ecx, [ebp - 0x8c]
mov dword [ebp - 4], 3
call fcn.004017d0
push ebx
push str.password
lea ecx, [ebp - 0x8c]
call fcn.004017d0
lea eax, [esi + 0x184]
push eax
push 0x6b1254
lea ecx, [ebp - 0x8c]
call fcn.004017d0
push str.not_used.anymore
push str.email
lea ecx, [ebp - 0x8c]
call fcn.004017d0
push 0x8a91dc
push str.hardwareid
lea ecx, [ebp - 0x8c]
call fcn.004017d0
cmp dword [0x8aad54], 0
jl 0x568d80
jg 0x568d3c
cmp dword [0x8aad50], 0
jbe 0x568d80
lea ecx, [ebp - 0x28]
call fcn.00402af0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 4
push eax
push 0x6b15f8
mov ecx, 0x8aae58
call fcn.00401210
lea ecx, [ebp - 0x28]
call fcn.00402d30
push eax
push str.ticket
lea ecx, [ebp - 0x8c]
call fcn.004017d0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 3
call fcn.00402c00
mov dword [esi], 1
lea ecx, [ebp - 0xd4]
call fcn.00568970
mov dword [esi], 0
mov esi, dword [ebp - 0x48]
mov dword [ebp - 4], 7
mov ecx, dword [ebp - 0x4c]
test ecx, ecx
je 0x568db5
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [ebp - 0x4c], 0
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 6
call fcn.004010b0
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 5
call fcn.00401510
lea ecx, [ebp - 0xd0]
mov dword [ebp - 4], 0xffffffff
call fcn.00401e40
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x568f30
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fe221
mov eax, dword fs:[0]
push eax
sub esp, 0xb8
push esi
mov eax, dword [0x6e8da0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareArktos_Entertainment_GroupWarZ
push bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x568fb0
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x568f87
sub ecx, edx
lea eax, [ecx + 1]
push eax
push esi
push 1
push 0
push str.username
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x10]
push eax
push 0xf003f
push 0
push str.SoftwareHouse_of_Warrior_InteractiveWarZ
push bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x568fd8
mov ecx, esi
call fcn.005692c0
jmp 0x569005
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0x32
push eax
lea eax, [esi + 0x100]
push eax
push 0
push 0
push str.hardwareid
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0xc0]
call fcn.00401d80
lea ecx, [ebp - 0x7c]
mov dword [ebp - 4], 0
call fcn.00401430
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 1
call fcn.00401000
push str.api_Login.aspx
lea ecx, [ebp - 0xc4]
mov byte [ebp - 4], 2
call fcn.005685a0
push esi
push str.username
lea ecx, [ebp - 0x7c]
mov dword [ebp - 4], 3
call fcn.004017d0
lea eax, [esi + 0x80]
push eax
push str.password
lea ecx, [ebp - 0x7c]
call fcn.004017d0
lea eax, [esi + 0x100]
push eax
push str.computerid
lea ecx, [ebp - 0x7c]
call fcn.004017d0
lea ecx, [ebp - 0xc4]
call fcn.00568970
test al, al
jne 0x5690a7
push dword [ebp - 0x38]
push str.Login_FAILED__code:__d_n
call fcn.005b6df0
add esp, 8
mov dword [esi + 0x140], 3
jmp 0x5690b5
lea eax, [ebp - 0xc4]
mov ecx, esi
push eax
call fcn.00568e00
mov dword [ebp - 4], 6
mov ecx, dword [ebp - 0x3c]
test ecx, ecx
je 0x5690d0
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [ebp - 0x3c], 0
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 5
call fcn.004010b0
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 4
call fcn.00401510
lea ecx, [ebp - 0xc0]
mov dword [ebp - 4], 0xffffffff
call fcn.00401e40
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5692c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1d4
mov eax, dword [0x6e8da0]
xor eax, esp
mov dword [esp + 0x1d0], eax
push esi
push 0
lea eax, [esp + 8]
mov esi, ecx
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareHouse_of_Warrior_InteractiveWarZ
push bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x56936d
push 0x1c8
push eax
lea eax, [esp + 0x10]
push eax
call fcn.005dfe30
add esp, 0xc
lea ecx, [esp + 8]
call fcn.0055c370
push dword [esp + 0x1c]
add esi, 0x100
push dword [esp + 0x1c]
push str.0x_I64x
push esi
call fcn.00569490
mov ecx, esi
add esp, 0x10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x569342
sub ecx, edx
lea eax, [ecx + 1]
push eax
push esi
push 1
push 0
push str.hardwareid
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [esp + 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x1d4]
pop esi
xor ecx, esp
call fcn.005dbd73
mov esp, ebp
pop ebp
ret

Function at 0x569c40
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x8a920f], 0
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
jne 0x569cd9
jmp 0x569cbd
push 0
push 0
push 0
push 0x569c10
push 0
push 0
mov byte [0x8a920f], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x569d3f
mov esi, dword [ebp + 0x10]
mov edx, 0xa
mov ecx, esi
call fcn.00569b90
mov ecx, eax
call fcn.00569710
shr eax, 0x10
mov ecx, esi
mov dl, al
call fcn.00569970
xor byte [ebx], al
jmp 0x569dc9
mov edx, 0x14
mov ecx, esi
call fcn.00569b90
mov ecx, eax
call fcn.00569710
mov dl, al
mov ecx, esi
call fcn.00569970
mov ecx, dword [ebp + 8]
xor byte [ecx], al
jmp 0x569e50
mov edx, 0x1e
mov ecx, esi
call fcn.00569b90
mov ecx, eax
call fcn.00569710
shr eax, 8
mov ecx, esi
mov dl, al
call fcn.00569970
xor byte [edi], al
jmp 0x569ed7
mov edx, 0x28
mov ecx, esi
call fcn.00569b90
mov ecx, eax
call fcn.00569710
shr eax, 0x18
mov ecx, esi
mov dl, al
call fcn.00569970
mov ecx, dword [ebp + 0xc]
xor byte [ecx], al
jmp 0x569f61
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x569f80
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x8a920f], 0
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
jne 0x56a019
jmp 0x569ffd
push 0
push 0
push 0
push 0x569c10
push 0
push 0
mov byte [0x8a920f], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x56a07f
mov esi, dword [ebp + 0x10]
mov edx, 0xa
mov ecx, esi
call fcn.00569b90
mov ecx, eax
call fcn.00569710
shr eax, 0x10
mov ecx, esi
mov dl, al
call fcn.00569970
xor byte [ebx], al
jmp 0x56a109
mov edx, 0x14
mov ecx, esi
call fcn.00569b90
mov ecx, eax
call fcn.00569710
mov dl, al
mov ecx, esi
call fcn.00569970
mov ecx, dword [ebp + 8]
xor byte [ecx], al
jmp 0x56a190
mov edx, 0x1e
mov ecx, esi
call fcn.00569b90
mov ecx, eax
call fcn.00569710
shr eax, 8
mov ecx, esi
mov dl, al
call fcn.00569970
xor byte [edi], al
jmp 0x56a217
mov edx, 0x28
mov ecx, esi
call fcn.00569b90
mov ecx, eax
call fcn.00569710
shr eax, 0x18
mov ecx, esi
mov dl, al
call fcn.00569970
mov ecx, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
xor byte [ecx], al
pop ebp
ret