joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4590d0
Capabilities:
Copy file
Create process on windows
Delete file
Move file
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x628
mov eax, dword [0x6f7f90]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x220]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push str..new.exe
lea ecx, [ebp - 0x220]
push ecx
call fcn.00402450
add esp, 8
test eax, eax
jne 0x45913e
lea edx, [ebp - 0x220]
push edx
push 0x61b864
lea eax, [ebp - 0x110]
push eax
call fcn.00451eb0
add esp, 0xc
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor al, al
jmp 0x4592be
mov byte [0x837678], 1
push str..exe_updated__moving_back_n
call fcn.005bead0
add esp, 4
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [ebp - 0x220]
push edx
lea eax, [ebp - 0x110]
push eax
call fcn.005e5680
add esp, 8
lea ecx, [ebp - 0x220]
push ecx
call fcn.005e45a0
add esp, 4
cmp eax, 8
ja 0x45919d
push 0
push 0x31
push str..SelfUpdateEXE.cpp
push str.strlen_exeMain____8
call fcn.005bede0
add esp, 0x10
lea eax, [ebp - 0x220]
push eax
call fcn.005e45a0
add esp, 4
mov byte [ebp + eax - 0x228], 0
lea ecx, [ebp - 0x220]
push ecx
push str.exeMain:__s_n
call fcn.005bead0
add esp, 8
mov byte [ebp - 0x111], 0
mov dword [ebp - 0x224], 0
jmp 0x4591ea
mov edx, dword [ebp - 0x224]
add edx, 1
mov dword [ebp - 0x224], edx
cmp dword [ebp - 0x224], 0xa
jge 0x45924e
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x220]
push ecx
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
je 0x459221
mov byte [ebp - 0x111], 1
jmp 0x45924e
push 0
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x459244
mov byte [ebp - 0x111], 1
jmp 0x45924e
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4591db
movzx edx, byte [ebp - 0x111]
test edx, edx
jne 0x4592bc
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x110]
push ecx
push str.Failed_to_replace_updater_file_n_nPlease_manually_rename__s_to__s
lea edx, [ebp - 0x628]
push edx
call fcn.00451ee0
add esp, 0x10
push 0x30
push str.Updater
lea eax, [ebp - 0x628]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 5
push 0
push 0
push 0x61b910
push 0x61b914
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor al, al
jmp 0x4592be
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005e4a11
mov esp, ebp
pop ebp
ret
Function at 0x4592d0
Capabilities:
Create process on windows
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x6f7f90]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x220]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push str.Trying_to_update_n
call fcn.005bead0
add esp, 4
lea ecx, [ebp - 0x220]
push ecx
push str._s.new.exe
lea edx, [ebp - 0x110]
push edx
call fcn.00451eb0
add esp, 0xc
push 0x61b93c
lea eax, [ebp - 0x110]
push eax
call fcn.005e5d15
add esp, 8
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x459356
lea ecx, [ebp - 0x110]
push ecx
push 0x61b940
call fcn.005beca0
add esp, 8
mov edx, dword [ebp - 0x114]
push edx
push 1
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.005e689b
add esp, 0x10
mov edx, dword [ebp - 0x114]
push edx
call fcn.005e50e5
add esp, 4
mov eax, dword [0x835734]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x110]
push ecx
push str.executing__s_n
call fcn.005bead0
add esp, 8
mov dword [ebp - 0x224], 0x61b96c
push 5
push 0
push 0x83ab08
lea edx, [ebp - 0x110]
push edx
mov eax, dword [ebp - 0x224]
push eax
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 0x20
jge 0x4593f1
mov ecx, dword [ebp - 0x228]
push ecx
lea edx, [ebp - 0x110]
push edx
push str.failed_to_launch__s___d
call fcn.005beca0
add esp, 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005e4a11
mov esp, ebp
pop ebp
ret
Function at 0x459670
Capabilities:
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x608078
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x6f7f90]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x2c]
call fcn.004636a0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x2c]
push eax
push str.DATA
push 0xc8
call fcn.00459b50
add esp, 0xc
movzx ecx, al
test ecx, ecx
jne 0x4596ec
push 0x10
push 0x61bb0c
push str.No_steam_api.dll_resource
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00463750
jmp 0x4597d7
mov dword [ebp - 0x18], str.steam_api.dll
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x14], 0
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.005c0800
add esp, 0xc
lea ecx, [ebp - 0x2c]
call fcn.00463860
push eax
lea ecx, [ebp - 0x2c]
call fcn.00463890
push eax
call fcn.005c04b0
add esp, 8
mov dword [ebp - 0x34], eax
mov edx, dword [ebp - 0x30]
cmp edx, dword [ebp - 0x34]
jne 0x45974e
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00463750
jmp 0x4597d7
push 0x80
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x61bb40
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.005e5d15
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x45979c
push 0x10
push str.Warning
push str.Can_not_update_steam_api.dll
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00463750
jmp 0x4597d7
mov edx, dword [ebp - 0x10]
push edx
lea ecx, [ebp - 0x2c]
call fcn.00463860
push eax
push 1
lea ecx, [ebp - 0x2c]
call fcn.00463890
push eax
call fcn.005e689b
add esp, 0x10
mov eax, dword [ebp - 0x10]
push eax
call fcn.005e50e5
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00463750
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x459b50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 0x10]
call fcn.00463830
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x459b7b
xor al, al
jmp 0x459bc2
mov edx, dword [ebp - 0x10]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x459ba1
xor al, al
jmp 0x459bc2
mov ecx, dword [ebp - 0x10]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0x10]
call fcn.00463a10
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x45b390
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x6f7f90]
xor eax, ebp
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x420], ecx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.005c0800
add esp, 0xc
movzx eax, al
test eax, eax
je 0x45b3d7
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x14]
cmp edx, dword [ecx + 0x112]
jne 0x45b3d7
jmp 0x45b525
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.dbghelp.dll_MakeSureDirectoryPathExists]
push 0x61c3c0
mov edx, dword [ebp + 8]
push edx
call fcn.005e5d15
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x45b442
mov eax, dword [ebp + 8]
push eax
push str.Cant_replace_file__s_nPlease_delete_this_file_manually
lea ecx, [ebp - 0x418]
push ecx
call fcn.00451ee0
add esp, 0xc
lea edx, [ebp - 0x418]
push edx
mov eax, dword [ebp - 0x420]
push eax
call fcn.0045a6b0
add esp, 8
lea ecx, [ebp - 0x418]
push ecx
call fcn.005beca0
add esp, 4
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00463860
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00463890
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x420]
add ecx, 0x4e0
call fcn.005cd0c0
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x10a]
cmp eax, dword [ebp - 0xc]
je 0x45b498
push 0
push 0x19f
push 0x61c3fc
push str.fe__size__out_size
call fcn.005bede0
add esp, 0x10
mov edx, dword [ebp - 0x420]
add edx, 0x20dd4
push edx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp - 8]
push eax
push 1
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.005e689b
add esp, 0x10
mov eax, dword [ebp - 8]
push eax
call fcn.005e50e5
add esp, 4
mov ecx, dword [ebp - 0x420]
add ecx, 0x20dd4
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push str.ExEWarZ.exe
mov edx, dword [ebp + 8]
push edx
call fcn.005e8598
add esp, 8
test eax, eax
jne 0x45b50d
mov eax, dword [ebp - 0x420]
mov byte [eax + 0x21690], 1
mov ecx, dword [ebp - 0x420]
call fcn.0045b7b0
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x41c], ecx
mov edx, dword [ebp - 0x41c]
push edx
call fcn.005c0a50
add esp, 4
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.005e4a11
mov esp, ebp
pop ebp
ret 8
Function at 0x45b670
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6083d2
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x6f7f90]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x28]
call fcn.0045eb90
mov dword [ebp - 4], 0
push 0x400
lea ecx, [ebp - 0x28]
call fcn.0045ec60
mov dword [ebp - 0x2c], 0
jmp 0x45b6cd
mov eax, dword [ebp - 0x2c]
add eax, 1
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x3c]
add ecx, 0x5e8
call fcn.00458fe0
cmp dword [ebp - 0x2c], eax
jae 0x45b71f
mov ecx, dword [ebp - 0x2c]
push ecx
mov ecx, dword [ebp - 0x3c]
add ecx, 0x5e8
call fcn.0045e810
mov edx, dword [eax]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0x116]
and ecx, 0x100000
jne 0x45b71d
mov edx, dword [ebp - 0x30]
push edx
lea ecx, [ebp - 0x28]
call fcn.0045ee40
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
jmp 0x45b6c4
mov dword [ebp - 0x34], 0
jmp 0x45b731
mov ecx, dword [ebp - 0x34]
add ecx, 1
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0x28]
call fcn.0045ede0
cmp dword [ebp - 0x34], eax
jae 0x45b779
mov edx, dword [ebp - 0x34]
push edx
lea ecx, [ebp - 0x28]
call fcn.0045ee00
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
push eax
mov ecx, dword [ebp - 0x3c]
add ecx, 0x5e4
call fcn.005ceab0
mov ecx, dword [ebp - 0x38]
mov edx, dword [ecx + 0x116]
and edx, 1
je 0x45b777
mov eax, dword [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x45b728
mov ecx, dword [ebp - 0x10]
push ecx
push str.removed__d_files_n
call fcn.005bead0
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0045ec00
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x45b7b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x61c
mov eax, dword [0x6f7f90]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x61c], ecx
lea eax, [ebp - 0x510]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push str.ExEWarZ.exe
lea ecx, [ebp - 0x510]
push ecx
push 0x61c438
lea edx, [ebp - 0x618]
push edx
call fcn.00451eb0
add esp, 0x10
push str.EminemZSS2
push str.Allow_network_traffic_for__s
lea eax, [ebp - 0x408]
push eax
call fcn.00451ee0
add esp, 0xc
lea ecx, [ebp - 0x408]
push ecx
push str.EminemZSS2
lea edx, [ebp - 0x618]
push edx
call fcn.00451ab0
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005e4a11
mov esp, ebp
pop ebp
ret
Function at 0x45bdc0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x6f7f90]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x41c], ecx
push 0x61c618
call fcn.005bead0
add esp, 4
push 1
mov ecx, dword [ebp - 0x41c]
add ecx, 0x4e0
call fcn.0045e670
mov dword [ebp - 4], 0
jmp 0x45be0b
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x41c]
add ecx, 0x5e8
call fcn.00458fe0
cmp dword [ebp - 4], eax
jae 0x45bf13
mov ecx, dword [ebp - 4]
push ecx
mov ecx, dword [ebp - 0x41c]
add ecx, 0x5e8
call fcn.0045e810
mov edx, dword [eax]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x116]
and ecx, 1
jne 0x45be4f
jmp 0x45be02
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.005c0800
add esp, 0xc
movzx edx, al
test edx, edx
je 0x45be8b
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [eax + 0x112]
jne 0x45be8b
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
cmp eax, dword [edx + 0x10a]
jne 0x45be8b
jmp 0x45be02
mov ecx, dword [ebp - 8]
push ecx
push str.restoring__s_n
call fcn.005bead0
add esp, 8
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.dbghelp.dll_MakeSureDirectoryPathExists]
push 0x61c64c
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [ebp - 0x41c]
add ecx, 0x4e0
call fcn.005cdab0
movzx edx, al
test edx, edx
jne 0x45bf0e
mov eax, dword [ebp - 8]
push eax
push 0x61c650
lea ecx, [ebp - 0x418]
push ecx
call fcn.00451ee0
add esp, 0xc
lea edx, [ebp - 0x418]
push edx
mov eax, dword [ebp - 0x41c]
push eax
call fcn.0045a6b0
add esp, 8
lea ecx, [ebp - 0x418]
push ecx
call fcn.005beca0
add esp, 4
jmp 0x45be02
mov ecx, dword [ebp - 0x41c]
add ecx, 0x4e0
call fcn.005ccda0
push 0x61c688
call fcn.005bead0
add esp, 4
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005e4a11
mov esp, ebp
pop ebp
ret
Function at 0x45d370
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
add ecx, 0x2169c
call fcn.0045e770
push 0
push 0
mov eax, dword [ebp - 4]
push eax
push 0x45d3b0
push 0
push 0
call fcn.005e5a5a
add esp, 0x18
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x21694], eax
mov esp, ebp
pop ebp
ret

Function at 0x45d530
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
add eax, 0x21acc
push eax
call fcn.005e45a0
add esp, 4
cmp eax, 0x13
je 0x45d57a
mov ecx, dword [ebp - 4]
add ecx, 0x21acc
push ecx
call fcn.005e45a0
add esp, 4
cmp eax, 0x1d
je 0x45d57a
push 0
push 0x61d238
push 0x61d248
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x45d59c
push 0
push 0
mov edx, dword [ebp - 4]
push edx
push 0x45d5a0
push 0
push 0
call fcn.005e5a5a
add esp, 0x18
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x21694], eax
mov esp, ebp
pop ebp
ret

Function at 0x45dad0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
add eax, 0x21848
push eax
call fcn.005e45a0
add esp, 4
cmp eax, 4
jae 0x45db13
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x21844], 0
push 0
push 0x61d53c
push str.email_address_is_too_short
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x45dbed
mov edx, dword [ebp - 4]
add edx, 0x21848
push edx
call fcn.0045d5c0
add esp, 4
test eax, eax
jne 0x45db4f
mov eax, dword [ebp - 4]
mov dword [eax + 0x21844], 0
push 0
push 0x61d568
push str.email_address_is_not_valid
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x45dbed
mov ecx, dword [ebp - 4]
add ecx, 0x21948
push ecx
mov edx, dword [ebp - 4]
add edx, 0x218c8
push edx
call fcn.005e55f0
add esp, 8
test eax, eax
je 0x45db92
mov eax, dword [ebp - 4]
mov dword [eax + 0x21844], 0
push 0
push 0x61d594
push str.Passwords_do_not_match
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x45dbed
mov ecx, dword [ebp - 4]
add ecx, 0x219c8
push ecx
call fcn.0045d7d0
add esp, 4
test eax, eax
jne 0x45dbcb
mov edx, dword [ebp - 4]
mov dword [edx + 0x21844], 0
push 0
push 0x61d5bc
push str.UserName_cannot_containt_special_symbols
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x45dbed
push 0
push 0
mov eax, dword [ebp - 4]
push eax
push 0x45dc00
push 0
push 0
call fcn.005e5a5a
add esp, 0x18
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x21694], eax
mov esp, ebp
pop ebp
ret
Function at 0x45ddc0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax + 0x21668], 0
je 0x45ddee
push 0
push 0x638
push 0x61d778
push str.mainThread___NULL
call fcn.005bede0
add esp, 0x10
mov edx, dword [ebp - 8]
cmp dword [edx + 0x21694], 0
je 0x45de13
push 0
push 0x639
push str..Updater.cpp
push str.loginThread___NULL
call fcn.005bede0
add esp, 0x10
push 0
push 0
mov ecx, dword [ebp - 8]
push ecx
push 0x45dea0
push 0
push 0
call fcn.005e5a5a
add esp, 0x18
mov edx, dword [ebp - 8]
mov dword [edx + 0x21668], eax
push 0
push 0
mov eax, dword [ebp - 8]
push eax
push 0x45dec0
push 0
push 0
call fcn.005e5a5a
add esp, 0x18
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x21ddc], eax
mov dword [ebp - 4], 0
jmp 0x45de69
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 6
jge 0x45de97
push 0
push 0
mov eax, dword [ebp - 8]
push eax
push 0x45dee0
push 0
push 0
call fcn.005e5a5a
add esp, 0x18
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [edx + ecx*4 + 0x21678], eax
jmp 0x45de60
mov esp, ebp
pop ebp
ret

Function at 0x45df00
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x45df32
push 0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp + 8]
mov dword [edx], 0
mov esp, ebp
pop ebp
ret 4

Function at 0x462ca0
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], 4
push 0x11
call fcn.005e6b8f
add esp, 4
mov dword [ebp - 8], eax
push 0x288
call fcn.005e6b8f
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x462cdd
push 0x61dbc8
call fcn.005e6a7b
add esp, 4
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, 0x6f
jne 0x462d11
mov edx, dword [ebp - 0xc]
push edx
call fcn.005e6b8f
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x462d11
push str.Error_allocating_memory_needed_to_call_GetAdaptersinfo_n
call fcn.005e6a7b
add esp, 4
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
jne 0x462d9b
mov edx, dword [ebp - 4]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
movzx ecx, byte [eax + 0x199]
push ecx
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx + 0x198]
push eax
mov ecx, dword [ebp - 0x10]
movzx edx, byte [ecx + 0x197]
push edx
mov eax, dword [ebp - 0x10]
movzx ecx, byte [eax + 0x196]
push ecx
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx + 0x195]
push eax
mov ecx, dword [ebp - 0x10]
movzx edx, byte [ecx + 0x194]
push edx
push str._02X:_02X:_02X:_02X:_02X:_02X
lea eax, [ebp - 8]
push eax
call fcn.00458470
add esp, 0x20
mov eax, dword [ebp - 8]
jmp 0x462da7
mov eax, dword [ebp - 4]
push eax
call fcn.005e69ed
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x4630f0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
push 0
lea eax, [ebp - 4]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push 0x61dd74
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x46315f
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.005e45a0
add esp, 4
add eax, 1
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
push 1
push 0
push 0x61dda0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret

Function at 0x463170
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push str.SoftwareArktos_Entertainment_GroupWarZ
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4631a1
mov al, 1
jmp 0x4631d2
mov dword [ebp - 8], 0x80
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 0x10]
push edx
push 0
push 0
push 0x61ddd8
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x4631e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push 0x61dde4
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x463219
mov ecx, dword [ebp - 0x10]
call fcn.00463260
mov al, 1
jmp 0x463250
mov dword [ebp - 8], 0x32
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 0x10]
add edx, 0x100
push edx
push 0
push 0
push 0x61ddfc
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov esp, ebp
pop ebp
ret