joyce8/EMBER2024-capa huggingface dataset:
Function at 0x542e50
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
sub esp, 0x10
push esi
push edi
push 0
push 2
call fcn.0062775f
add esp, 8
mov edi, eax
mov esi, 0x670fb8
mov ecx, 2
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x542e78
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x542ea2
call dword [sym.imp.KERNEL32.dll_GetACP]
push eax
lea eax, [esp + 0xc]
push 0x670fb4
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [esp + 0x14]
push ecx
push 2
call fcn.0062775f
add esp, 0x14
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push ebp
push 0
push 0
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push edi
push 0
call ebp
mov esi, eax
push esi
push edi
call ebx
push 0
push esi
push 0
call fcn.00626d94
add esp, 0xc
mov edi, eax
inc edi
lea edx, [edi + edi]
push edx
push 0
call ebp
push edi
push esi
push eax
mov dword [0x721dd0], eax
call fcn.00626d94
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [0x71961c]
test eax, eax
pop ebp
pop ebx
je 0x542f0d
pop edi
mov dword [0x721dc4], 0
pop esi
add esp, 0x10
ret
push str.keystone.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [0x721dc4], eax
je 0x543062
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.KeystoneCreate
push eax
call esi
mov dword [0x721dc8], eax
mov eax, dword [0x721dc4]
push str.Call_KsTranslateAccelerator
push eax
call esi
mov ecx, dword [0x721dc4]
push str.Call_KsCreateWindow
push ecx
mov dword [0x721dd8], eax
call esi
mov edx, dword [0x721dc4]
push str.Call_KsGetWindow
push edx
mov dword [0x721ddc], eax
call esi
mov dword [0x721de0], eax
mov eax, dword [0x721dc4]
push str.Call_KsUpdate
push eax
call esi
mov ecx, dword [0x721dc4]
push str.Call_KsDispatchMessage
push ecx
mov dword [0x721de4], eax
call esi
mov edx, dword [0x721dc4]
push str.Call_KW_Release
push edx
mov dword [0x721de8], eax
call esi
mov dword [0x721df0], eax
mov eax, dword [0x721dc4]
push str.Call_KsSetFocusWindow
push eax
call esi
mov ecx, dword [0x721dc4]
push str.Call_KW_GetControlByID
push ecx
mov dword [0x721dec], eax
call esi
mov edx, dword [0x721dc4]
push str.Call_KC_GetAttribute
push edx
mov dword [0x721df4], eax
call esi
mov dword [0x721e08], eax
mov eax, dword [0x721dc4]
push str.Call_KC_SetAttribute
push eax
call esi
mov ecx, dword [0x721dc4]
push str.Call_KC_SendMessage
push ecx
mov dword [0x721e0c], eax
call esi
mov edx, dword [0x721dc4]
push str.Call_KW_ReLayout
push edx
mov dword [0x721e10], eax
call esi
mov dword [0x721df8], eax
mov eax, dword [0x721dc4]
push str.Call_KW_SetFocusControl
push eax
call esi
mov ecx, dword [0x721dc4]
push str.Call_KW_AddDirtyControl
push ecx
mov dword [0x721dfc], eax
call esi
mov edx, dword [0x721dc4]
push str.Call_KsRelease
push edx
mov dword [0x721e00], eax
call esi
mov dword [0x721dd4], eax
push str.Call_KW_ShowWindow
mov eax, dword [0x721dc4]
push eax
call esi
mov dword [0x721e04], eax
pop edi
pop esi
add esp, 0x10
ret
Function at 0x5430f0
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Check os version
Terminate process

Disassembly:
sub esp, 0xc8
push esi
mov esi, dword [esp + 0xd0]
push edi
lea eax, [esp + 0x3c]
push eax
mov dword [0x69eac4], esi
mov dword [0x721e2c], 0xffffffff
mov dword [esp + 0x40], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp esi, 1
jne 0x543137
mov edi, esi
mov dword [esp + 8], edi
mov dword [esp + 0xc], 8
jmp 0x543143
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov edi, eax
cmp edi, dword [esp + 0xc]
push ebx
push ebp
jg 0x5431bb
mov ebx, dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x543160
cmp dword [esp + 0x48], 5
mov eax, dword [edi*4 + 0x69eac8]
jae 0x543171
add eax, 7
push eax
push 1
push 0
call ebx
mov dword [0x721e28], eax
call ebp
mov esi, eax
cmp esi, 0xb7
mov eax, dword [0x721e28]
jne 0x5431a0
test eax, eax
je 0x5431a4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x721e28]
jmp 0x5431a4
test eax, eax
jne 0x5431af
mov ecx, dword [esp + 0x14]
inc edi
cmp edi, ecx
jle 0x543160
jmp 0x5431c4
sub edi, dword [esp + 0x10]
mov dword [0x721e2c], edi
jmp 0x5431c4
mov esi, dword [esp + 0x10]
mov eax, dword [0x721e28]
cmp esi, 0xb7
pop ebp
pop ebx
je 0x5431e5
test eax, eax
je 0x543209
mov ecx, dword [0x721e2c]
or esi, 0xffffffff
cmp ecx, esi
jne 0x54326c
jmp 0x5431e8
or esi, 0xffffffff
test eax, eax
je 0x543209
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x721e28], 0
mov dword [0x69eac4], esi
mov dword [0x721e2c], esi
cmp dword [esp + 0xd4], 1
je 0x54325b
push 0x6710e0
push 0x6710e0
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
test esi, esi
je 0x54325b
lea ecx, [esp + 0x10]
push ecx
push esi
mov dword [esp + 0x18], 0x2c
call dword [sym.imp.USER32.dll_GetWindowPlacement]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
cmp dword [esp + 0x18], 2
jne 0x543254
push 9
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
call fcn.00626234
push 1
push 0x7e
push 0x92
call fcn.0057eea0
add esp, 0xc
pop edi
pop esi
add esp, 0xc8
ret
Function at 0x5499a0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov al, byte [0x725122]
sub esp, 0x10
test al, al
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push esi
jne 0x549a93
mov al, byte [0x725120]
test al, al
je 0x549ae2
mov al, byte [0x725121]
test al, al
je 0x549ae2
mov al, byte [0x7251d6]
test al, al
jne 0x549ae2
push edi
call fcn.00449380
mov edi, dword [0x7251e0]
or edx, 0xffffffff
mov dword [esp + 0xc], eax
call fcn.004d0670
mov esi, eax
cmp esi, 0xffffffff
je 0x549a89
push ebx
push esi
push 0x3e99999a
push 0
or ebx, 0xffffffff
call fcn.0054b340
add esp, 0xc
mov edx, esi
call fcn.004d0670
mov esi, eax
cmp esi, 0xffffffff
jne 0x549a03
fild dword [esp + 0x10]
pop ebx
fadd dword [0x67317c]
fstp dword [esp + 0xc]
lea eax, [esp + 0x14]
push eax
call ebp
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push 0
push 0x3e8
push ecx
push edx
call fcn.0062e0c0
mov ecx, dword [0x6ac824]
push ecx
mov ecx, dword [0x6ac820]
push ecx
push edx
push eax
call fcn.00639340
test eax, eax
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
jge 0x549a77
fadd dword [0x672bf8]
fcomp dword [esp + 0xc]
fnstsw ax
test ah, 5
jp 0x549a89
call fcn.00549d10
jmp 0x549a33
mov al, byte [0x725122]
test al, al
pop edi
je 0x549ae2
mov eax, dword [0x725128]
test eax, eax
mov byte [0x725122], 0
je 0x549aab
push 0
call dword [eax + 0x28]
add esp, 4
lea edx, [esp + 0x10]
push edx
call ebp
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push 0
push 0x3e8
push eax
push ecx
call fcn.0062e0c0
mov ecx, dword [0x6ac824]
push ecx
mov ecx, dword [0x6ac820]
push ecx
push edx
push eax
call fcn.00639340
mov dword [0x72512c], eax
call fcn.0054b190
mov esi, dword [0x724970]
test esi, esi
je 0x549afd
mov al, byte [esi + 0x24]
test al, al
je 0x549afd
call fcn.004d05c0
pop esi
pop ebp
add esp, 0x10
ret
Function at 0x551db0
Capabilities:
Delete directory
Delete file
Enumerate files on windows

Disassembly:
sub esp, 0x3d0
push ebx
mov ebx, ecx
test ebx, ebx
push edi
mov edi, eax
je 0x551dc4
test edi, edi
jne 0x551dd2
pop edi
mov eax, 0x57
pop ebx
add esp, 0x3d0
ret
push ebp
push esi
push 0x80
lea esi, [esp + 0x14]
call fcn.00557d80
mov eax, esi
push eax
push ebx
lea ecx, [esp + 0x9c]
push str._s_s_
push ecx
call fcn.006238e3
lea edx, [esp + 0xa4]
push edx
lea eax, [esp + 0x2f0]
push str._s.
push eax
call fcn.006238e3
add esp, 0x20
lea ecx, [esp + 0x198]
push ecx
lea edx, [esp + 0x2dc]
push edx
xor ebp, ebp
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x551ea2
cmp byte [esp + 0x1c4], 0x2e
je 0x551e88
mov edi, str.checkpoints
lea esi, [esp + 0x1c4]
mov ecx, 0xc
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x551e88
lea ecx, [esp + 0x1c4]
push ecx
lea edx, [esp + 0x94]
push edx
lea eax, [esp + 0x18]
push str._s_s
push eax
call fcn.006238e3
add esp, 0x10
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebp, eax
test ebp, ebp
je 0x551e9b
lea edx, [esp + 0x198]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x551e34
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [esp + 0x90]
push eax
lea ecx, [esp + 0x2dc]
push str._scheckpoints.
push ecx
call fcn.006238e3
add esp, 0xc
test ebp, ebp
je 0x551fb3
lea edx, [esp + 0x198]
push edx
lea eax, [esp + 0x2dc]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x551f85
jmp 0x551ef0
cmp byte [esp + 0x1c4], 0x2e
je 0x551f3e
mov edi, str.checkpoints
lea esi, [esp + 0x1c4]
mov ecx, 0xc
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x551f3e
lea eax, [esp + 0x1c4]
push eax
lea ecx, [esp + 0x94]
push ecx
lea edx, [esp + 0x18]
push str._scheckpoints_s
push edx
call fcn.006238e3
add esp, 0x10
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x198]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x551ef0
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x90]
push edx
lea eax, [esp + 0x2dc]
push str._scheckpoints
push eax
call fcn.006238e3
add esp, 0xc
lea ecx, [esp + 0x2d8]
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov ebp, eax
test ebp, ebp
je 0x551fb3
lea eax, [esp + 0x90]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x551f93
sub eax, edx
lea edx, [esp + 0x90]
push edx
mov byte [esp + eax + 0x93], cl
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov ebp, eax
pop esi
xor eax, eax
cmp ebp, 1
pop ebp
pop edi
setne al
pop ebx
add esp, 0x3d0
ret
Function at 0x551fd0
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x10c
push ebp
mov ebp, dword [esp + 0x114]
test ebp, ebp
push esi
mov esi, eax
je 0x551fe9
test esi, esi
jne 0x551ff6
pop esi
xor eax, eax
pop ebp
add esp, 0x10c
ret 4
push ebx
push edi
push ebp
lea eax, [esp + 0x18]
push 0x671e40
push eax
call fcn.006238e3
add esp, 0xc
push esi
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
mov dword [esp + 0x10], edi
je 0x552086
push ebp
push edi
xor ebx, ebx
call fcn.00551a60
add esp, 8
cmp eax, 0xffffffff
jne 0x55204a
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop ebx
pop esi
or eax, 0xffffffff
pop ebp
add esp, 0x10c
ret 4
test byte [esi], 0x10
je 0x552073
lea ebp, [esi + 0x2c]
cmp byte [ebp], 0x2e
jne 0x552095
cmp ebx, 1
je 0x552073
push esi
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x55206e
mov ebx, 1
test byte [esi], 0x10
jne 0x552052
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [esp + 0x10], 0xffffffff
mov edi, dword [esp + 0x10]
mov eax, edi
pop edi
pop ebx
pop esi
pop ebp
add esp, 0x10c
ret 4
lea ebx, [esi + 0x140]
mov edx, ebx
mov eax, ebp
sub edx, ebp
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x5520a1
push 0x80
lea eax, [esi + 0x244]
mov edi, ebp
call fcn.00557dc0
mov eax, dword [esp + 0x124]
mov edx, ebx
add esp, 4
sub edx, eax
jmp 0x5520d0
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x5520d0
mov edi, ebx
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x5520e0
mov dx, word [0x660190]
mov eax, ebp
mov word [edi], dx
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5520f6
mov edi, ebx
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x552102
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
dec ebx
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
jmp 0x552120
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x552120
mov ax, word [0x660190]
mov word [edi], ax
mov edi, dword [esp + 0x10]
mov eax, edi
pop edi
pop ebx
pop esi
pop ebp
add esp, 0x10c
ret 4
Function at 0x5559e0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x904
push ebx
push esi
mov esi, eax
push edi
xor eax, eax
xor bl, bl
mov byte [esp + 0x10], bl
mov ecx, 0x3f
lea edi, [esp + 0x11]
rep stosd dword es:[edi], eax
mov cx, word [esi + 6]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edi, [esi + 8]
lea edx, [esp + 0x10]
mov eax, edi
call fcn.00556500
test byte [esi + 4], 1
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
je 0x555a57
push 0x80
push 2
push 0
push 0
push 0x40000000
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x555a6b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x555a4e
call esi
cmp eax, 0xb7
je 0x555a4e
call esi
push 0
push 0x800
lea ecx, [esp + 0x118]
push ecx
push 0
push eax
push 0
push 0x12ff
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x555aa0
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x900
push ebx
push edi
xor eax, eax
xor ebx, ebx
mov byte [esp + 8], bl
mov ecx, 0x3f
lea edi, [esp + 9]
rep stosd dword es:[edi], eax
mov cx, word [esi + 6]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esi + 8]
lea edx, [esp + 8]
call fcn.00556500
test byte [esi + 4], 1
je 0x555b05
push 0x80
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
je 0x555b1c
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x555b1c
mov al, 1
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
je 0x555b1c
mov al, 1
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
push 0x800
lea ecx, [esp + 0x110]
push ecx
push ebx
push eax
push ebx
push 0x12ff
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x555b50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x104
push ebx
push esi
mov esi, eax
push edi
xor eax, eax
xor bl, bl
mov byte [esp + 0x10], bl
mov ecx, 0x3f
lea edi, [esp + 0x11]
rep stosd dword es:[edi], eax
mov cx, word [esi + 6]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esi + 8]
lea edx, [esp + 0x10]
call fcn.00556500
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x555ba0
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 2
je 0x555bb9
call esi
cmp eax, 3
je 0x555bb9
call fcn.005565a0
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x555d80
Capabilities:
Get file size

Disassembly:
mov ecx, dword [eax + 0x108]
sub esp, 0x800
push esi
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x555dc7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0x800
lea edx, [esp + 0xc]
push edx
push 0
push eax
push 0
push 0x12ff
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
pop esi
add esp, 0x800
ret

Function at 0x555de0
Capabilities:
Clear file content

Disassembly:
sub esp, 0x800
mov ecx, esi
call fcn.00555d20
test al, al
je 0x555e0b
mov eax, dword [esi + 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x555e0b
mov al, 1
add esp, 0x800
ret
push ebx
xor bl, bl
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0x800
lea ecx, [esp + 0xc]
push ecx
push 0
push eax
push 0
push 0x12ff
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov al, bl
pop ebx
add esp, 0x800
ret

Function at 0x555e50
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x804
push ebx
push edi
push 0
lea eax, [esp + 0xc]
push eax
mov eax, dword [edx + 0x108]
push esi
push ecx
push eax
xor bl, bl
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
je 0x555e8f
cmp dword [esp + 8], esi
jne 0x555e8b
pop edi
mov al, 1
pop ebx
add esp, 0x804
ret
push 0x26
call edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0x800
lea ecx, [esp + 0x14]
push ecx
push 0
push eax
push 0
push 0x12ff
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push 0
call edi
pop edi
mov al, bl
pop ebx
add esp, 0x804
ret

Function at 0x555ec0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x804
push ebx
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [edx + 0x108]
push esi
push ecx
push eax
xor bl, bl
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x555ef3
cmp dword [esp + 4], esi
jne 0x555ef3
mov al, 1
pop ebx
add esp, 0x804
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0x800
lea ecx, [esp + 0x10]
push ecx
push 0
push eax
push 0
push 0x12ff
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov al, bl
pop ebx
add esp, 0x804
ret
Function at 0x575870
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x85ff50]
mov edx, dword [ecx + 0x34]
sub esp, 0x28
and eax, 0xffff
push ebx
lea eax, [eax + eax*2]
push ebp
mov ebp, dword [edx + eax*4 + 8]
mov ecx, dword [ebp]
mov eax, dword [0x87b7b4]
and ecx, 0xffff
shl ecx, 5
push esi
mov esi, dword [ecx + eax + 0x14]
mov edx, dword [esi + 0x8c]
and edx, 0xffff
shl edx, 5
mov ebx, dword [edx + eax + 0x14]
cmp dword [esi + 0x3dc], 0xffffffff
push edi
je 0x575a43
mov ecx, dword [ebx + 0x74]
xor eax, eax
cmp ecx, eax
mov dword [esp + 0x1c], eax
jle 0x575a43
mov edx, dword [esp + 0x3c]
mov ecx, eax
imul ecx, ecx, 0x130
add ecx, edx
mov edx, dword [ebx + 0x78]
shl eax, 7
add eax, edx
mov edx, eax
test byte [ecx], 2
je 0x575a2c
fld dword [ecx + 0x5c]
fld dword [ecx + 0x58]
fld dword [ecx + 0x54]
fld st(1)
fmul st(2)
fld st(3)
fmul st(4)
faddp st(1)
fld st(1)
fmul st(2)
faddp st(1)
fsqrt
fstp dword [esp + 0x14]
fstp st(0)
fstp st(0)
fstp st(0)
fld dword [esp + 0x14]
fcomp dword [0x672d00]
fnstsw ax
test ah, 0x41
jne 0x575a2c
fld dword [esp + 0x14]
fsub dword [0x672d00]
fmul dword [0x6732a8]
fld dword [ecx + 0x74]
fsub dword [edx + 0x68]
fadd dword [0x673004]
fld st(0)
fmul dword [ecx + 0x60]
fadd dword [ecx + 4]
fstp dword [esp + 0x2c]
fld st(0)
fmul dword [ecx + 0x64]
fadd dword [ecx + 8]
fstp dword [esp + 0x30]
fmul dword [ecx + 0x68]
fadd dword [ecx + 0xc]
fstp dword [esp + 0x34]
fld dword [0x672fa8]
fdiv dword [esp + 0x14]
fld st(0)
fmul dword [ecx + 0x54]
fld st(1)
fmul dword [ecx + 0x58]
fstp dword [esp + 0x24]
fxch st(1)
fmul dword [ecx + 0x5c]
fstp dword [esp + 0x28]
fld dword [ecx + 0x60]
fmul dword [0x672af4]
fadd st(1)
fstp dword [esp + 0x20]
fstp st(0)
fld dword [ecx + 0x64]
fmul dword [0x672af4]
fadd dword [esp + 0x24]
fstp dword [esp + 0x24]
fld dword [ecx + 0x68]
fmul dword [0x672af4]
fadd dword [esp + 0x28]
fstp dword [esp + 0x28]
fcom dword [0x672af8]
fnstsw ax
test ah, 5
jp 0x5759d8
fstp st(0)
mov dword [esp + 0x18], 0
jmp 0x5759f5
fcom dword [0x672afc]
fnstsw ax
test ah, 0x41
jne 0x5759f1
fstp st(0)
mov dword [esp + 0x18], 0x3f800000
jmp 0x5759f5
fstp dword [esp + 0x18]
mov edx, dword [edx + 0x24]
mov eax, dword [esp + 0x18]
movsx ecx, word [ecx + 0x70]
and dl, 1
neg dl
push eax
lea eax, [ebp + 0x98]
push eax
mov eax, dword [esi + 0x3dc]
push ecx
lea edi, [esp + 0x2c]
sbb edx, edx
neg edx
add edx, 9
push edx
lea edx, [esp + 0x3c]
call fcn.004535f0
add esp, 0x10
mov eax, dword [esp + 0x1c]
mov ecx, dword [ebx + 0x74]
inc eax
mov dword [esp + 0x1c], eax
movsx eax, ax
cmp eax, ecx
jl 0x5758d2
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
Function at 0x577040
Capabilities:
Create thread
Resume thread

Disassembly:
sub esp, 8
mov byte [esp + 3], 0
mov eax, 0x6ef864
lea ecx, [ecx]
xor ecx, ecx
mov edx, eax
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
mov dword [edx + 0x10], ecx
mov dword [eax], 0xffffffff
add eax, 0x14
cmp eax, 0x6ef88c
jl 0x577050
push ebx
push esi
call fcn.0061c030
xor bl, bl
xor esi, esi
xor ecx, ecx
mov eax, 0x6f0cfc
cmp byte [eax], 0
je 0x577096
add eax, 0x28
inc ecx
cmp eax, 0x6f11fc
jl 0x577084
jmp 0x5770ae
lea esi, [ecx + ecx*4]
lea esi, [esi*8 + 0x6f0cd8]
mov byte [esi + 4], 0
mov dword [esi], 0
mov byte [esi + 0x24], 1
test esi, esi
je 0x5770eb
mov eax, dword [0x6f0bd4]
mov ecx, eax
push ecx
inc eax
push str.mutex__ld
mov dword [0x6f0bd4], eax
lea eax, [esi + 4]
push 0x20
push eax
call fcn.00623c7d
add esp, 0x10
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
mov dword [esi], eax
je 0x5770e9
mov bl, 1
jmp 0x5770eb
xor esi, esi
test bl, bl
mov dword [0x7226e8], esi
je 0x5771a7
xor eax, eax
jmp 0x577100
mov cl, byte [eax*8 + 0x6f0bdc]
test cl, cl
je 0x577113
inc eax
cmp eax, 0x20
jl 0x577100
jmp 0x57716f
lea ecx, [esp + 0xc]
push ecx
push 4
push 0
push 0x576f90
lea esi, [eax*8 + 0x6f0bd8]
push 0x4000
push 0
mov dword [esi], 0
mov byte [esi + 4], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [esi], eax
mov dword [0x7226ec], esi
je 0x57716f
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
je 0x577166
mov edx, dword [esi]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x5771a2
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [0x7226e8]
mov ecx, dword [esi]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [esi + 4], 0
mov dword [esi], 0
mov byte [esi + 0x24], 0
mov dword [0x7226e8], 0
mov dword [0x7226ec], 0
jmp 0x5771a7
mov byte [esp + 0xb], 1
mov al, byte [esp + 0xb]
pop esi
mov byte [0x7226e4], 1
mov byte [0x7226f0], 0
pop ebx
add esp, 8
ret

Function at 0x577650
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x114
cmp dword [0x69fe14], 0xffffffff
push ebx
push esi
push edi
jne 0x577711
call fcn.00542bc0
test eax, eax
je 0x5776ca
xor eax, eax
mov ecx, 0x43
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
test byte [esp + 0x14], 1
mov dword [esp + 0x10], 0x66696c6f
mov word [esp + 0x16], 0xffff
je 0x5776a1
lea ebx, [esp + 0x18]
call fcn.005563b0
mov ebx, str.currentupdate.cfg
lea esi, [esp + 0x18]
call fcn.005562f0
or byte [esp + 0x14], 1
lea eax, [esp + 0x10]
call fcn.00555b50
test al, al
je 0x5776ca
lea esi, [esp + 0x10]
call fcn.00555aa0
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0x5775f0
push 0x10400
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, 0xffffffff
je 0x577707
mov dword [0x69fe14], 1
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x69fe14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [0x69fe14], 0
mov eax, dword [0x69fe14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret