joyce8/EMBER2024-capa huggingface dataset:
Function at 0x582d10
Capabilities:
Set console window title

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x6c9db0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
call fcn.00587850
call fcn.00589f10
call fcn.00589550
call fcn.00589f10
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esi + 0x20d84], 3
jne 0x582d57
mov dword [esi + 0x20d84], 5
cmp dword [esi + 0x20d88], 0
jne 0x582e01
mov edi, dword [esi + 0x21590]
mov eax, edi
mov ebx, dword [esi + 0x21594]
or eax, ebx
jne 0x582d7b
xorps xmm1, xmm1
jmp 0x582dc1
mov edx, dword [esi + 0x2159c]
mov ecx, dword [esi + 0x21598]
call fcn.005b6e4f
cvtsd2ss xmm0, xmm0
mov edx, ebx
mov ecx, edi
movss dword [ebp - 0x20c], xmm0
call fcn.005b6e4f
movss xmm1, dword [ebp - 0x20c]
cvtsd2ss xmm0, xmm0
divss xmm1, xmm0
movss xmm0, dword [0x676af0]
comiss xmm1, xmm0
jbe 0x582dc1
movaps xmm1, xmm0
mulss xmm1, dword [0x676b0c]
lea eax, [esi + 0x20d8d]
sub esp, 8
cvtps2pd xmm0, xmm1
movsd qword [esp], xmm0
push eax
lea eax, [ebp - 0x208]
push str._s:__.1f__
push eax
call fcn.00582710
add esp, 0x14
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
jmp 0x582d32
mov ecx, esi
call fcn.00587970
mov eax, dword [esi + 0x20d88]
dec eax
je 0x582e45
dec eax
je 0x582e2f
dec eax
je 0x582e52
push 0
push 0x37
push str.Main_CmdLine.cpp
push 0x674dac
call fcn.00589fd0
add esp, 0x10
jmp 0x582e52
lea eax, [esi + 0x2118d]
push eax
push str.Update_error_n_s_n_nPlease_retry_later
call fcn.00589b00
add esp, 8
jmp 0x582e52
push str.Update_ok_n
call fcn.00589b00
add esp, 4
push str._nPress_enter_to_exit...
call fcn.00589b00
add esp, 4
call fcn.005b0b93
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005aede3
mov esp, ebp
pop ebp
ret
Function at 0x583510
Capabilities:
Copy file
Create process on windows
Delete file
Move file
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60c
mov eax, dword [0x6c9db0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x108]
push str..new.exe
push eax
call fcn.005afb60
add esp, 8
test eax, eax
jne 0x583587
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push str._s.new.exe
push eax
call fcn.0057de30
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005aede3
mov esp, ebp
pop ebp
ret
push edi
push str..exe_updated__moving_back_n
mov byte [0x775b72], 1
call fcn.00589b00
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 4
push 0x1f4
call edi
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.005af67d
lea ecx, [ebp - 0x108]
add esp, 0xc
lea edx, [ecx + 1]
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x5835d0
sub ecx, edx
cmp ecx, 8
ja 0x5835f4
push 0
push 0x31
push str.SelfUpdateEXE.cpp
push str.strlen_exeMain____8
call fcn.00589fd0
add esp, 0x10
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x583600
sub ecx, edx
add ecx, 0xfffffff8
cmp ecx, 0x104
jae 0x583711
push ebx
mov byte [ebp + ecx - 0x108], al
lea eax, [ebp - 0x108]
push esi
push eax
push str.exeMain:__s_n
call fcn.00589b00
mov ebx, dword [sym.imp.KERNEL32.dll_CopyFileA]
add esp, 8
xor esi, esi
lea ecx, [ecx]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x5836fe
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
call ebx
test eax, eax
jne 0x5836fe
push 0x64
call edi
inc esi
cmp esi, 0xa
jl 0x583640
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x60c]
push str.Failed_to_replace_updater_file_n_nPlease_manually_rename__s_to__s
push eax
call fcn.0057de50
add esp, 0x10
lea eax, [ebp - 0x60c]
push 0x30
push str.Updater
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 5
push 0
push 0
push 0x674de4
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
pop ebx
xor al, al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005aede3
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop esi
pop ebx
xor ecx, ebp
pop edi
call fcn.005aede3
mov esp, ebp
pop ebp
ret
call fcn.005b0187
int3
Function at 0x583720
Capabilities:
Create process on windows
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x6c9db0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x104
lea eax, [ebp - 0x20c]
mov edi, edx
push eax
push 0
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push str.Trying_to_update_n
call fcn.00589b00
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push str._s.new.exe
push eax
call fcn.0057de30
lea eax, [ebp - 0x108]
push 0x674a2c
push eax
call fcn.005afafb
mov esi, eax
add esp, 0x18
test esi, esi
jne 0x58379e
lea eax, [ebp - 0x108]
push eax
push str.cant_open__s_for_writing_n
call fcn.00589720
add esp, 8
push esi
push 1
push edi
push ebx
call fcn.005b0d13
push esi
call fcn.005af4d5
add esp, 0x14
push dword [0x775c10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x108]
push eax
push str.executing__s_n
call fcn.00589b00
add esp, 8
lea eax, [ebp - 0x108]
push 5
push 0
push 0x6d1980
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
pop ebx
cmp eax, 0x20
jge 0x58380b
push eax
lea eax, [ebp - 0x108]
push eax
push str.failed_to_launch__s___d
call fcn.00589720
add esp, 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
call fcn.005aede3
mov esp, ebp
pop ebp
ret

Function at 0x583aa0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 4]
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, ecx
push eax
push 0xf003f
push 0
push str.SoftwareCodex_Development_GroupWarZSiam
mov byte [esi], 0
mov byte [esi + 0x80], 0
mov dword [esi + 0x198], 0
mov dword [esi + 0x19c], 0
mov dword [esi + 0x1a0], 0
push bind
mov dword [esi + 0x1a4], 0
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x583b27
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x80
push eax
push esi
push 0
push 0
push str.username
push dword [ebp - 4]
call ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push str.AppEventsEventLabelsSystemFool
push bind
call edi
test eax, eax
jne 0x583b6b
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x80
push eax
lea eax, [esi + 0x80]
push eax
push 0
push 0
push str.password
push dword [ebp - 8]
call ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x585270
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x6c9db0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x41c]
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
push eax
lea eax, [ebp - 0x418]
push eax
push edi
call fcn.0058acb0
add esp, 0xc
test al, al
je 0x5852bb
mov eax, dword [ebp - 0x418]
cmp eax, dword [edi + 0x10e]
je 0x58539d
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edi
call dword [sym.imp.dbghelp.dll_MakeSureDirectoryPathExists]
push 0x674a2c
push edi
call fcn.005afafb
add esp, 8
mov dword [ebp - 0x410], eax
test eax, eax
je 0x5853b0
lea eax, [ebp - 0x414]
mov ecx, esi
push eax
lea eax, [ebp - 0x40c]
push eax
call fcn.004011c0
push eax
mov ecx, esi
call fcn.004011f0
push eax
push edi
lea ecx, [ebx + 0x4c0]
call fcn.0059a860
mov eax, dword [edi + 0x106]
cmp eax, dword [ebp - 0x414]
je 0x585336
push 0
push 0x18b
push str.Updater.cpp
push str.fe__size__out_size
call fcn.00589fd0
add esp, 0x10
lea esi, [ebx + 0x20d6c]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push dword [ebp - 0x410]
push 1
push dword [ebp - 0x414]
push dword [ebp - 0x40c]
call fcn.005b0d13
push dword [ebp - 0x410]
call fcn.005af4d5
add esp, 0x14
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push str.siammmo.exe
push edi
call fcn.005b2e0b
add esp, 8
test eax, eax
jne 0x58538f
mov byte [ebx + 0x215c4], 1
call fcn.00585650
push dword [ebp - 0x40c]
call fcn.0058be30
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005aede3
mov esp, ebp
pop ebp
ret 8
push edi
lea eax, [ebp - 0x408]
push str.Cant_replace_file__s_nPlease_delete_this_file_manually
push eax
call fcn.0057de50
add esp, 0xc
lea eax, [ebp - 0x408]
push eax
push ebx
call fcn.005846a0
int3
Function at 0x5854b0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ccb18
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x6c9db0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
push 0x400
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0
call fcn.00587bf0
mov eax, dword [esi + 0x5cc]
xor edi, edi
sub eax, dword [esi + 0x5c8]
mov ebx, dword [ebp - 0x20]
sar eax, 2
mov dword [ebp - 0x10], edi
test eax, eax
je 0x5855cc
lea esp, [esp]
mov eax, dword [esi + 0x5c8]
mov esi, dword [eax + edi*4]
test dword [esi + 0x116], 0x100000
jne 0x5855ae
cmp esi, ebx
jae 0x585581
mov eax, dword [ebp - 0x24]
cmp eax, esi
ja 0x585581
sub esi, eax
mov eax, 0xdd67c8a7
imul esi
add edx, esi
sar edx, 8
mov esi, edx
shr esi, 0x1f
add esi, edx
cmp ebx, dword [ebp - 0x1c]
jne 0x585576
push ecx
lea ecx, [ebp - 0x24]
call fcn.00587c90
mov ebx, dword [ebp - 0x20]
imul esi, esi, 0x128
add esi, dword [ebp - 0x24]
jmp 0x585592
cmp ebx, dword [ebp - 0x1c]
jne 0x585592
push ecx
lea ecx, [ebp - 0x24]
call fcn.00587c90
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x5855a2
mov ecx, 0x4a
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x10]
add ebx, 0x128
inc dword [ebp - 0x14]
mov dword [ebp - 0x20], ebx
mov esi, dword [ebp - 0x18]
inc edi
mov dword [ebp - 0x10], edi
mov eax, dword [esi + 0x5cc]
sub eax, dword [esi + 0x5c8]
sar eax, 2
cmp edi, eax
jb 0x585530
mov edi, dword [ebp - 0x24]
mov eax, 0xdd67c8a7
sub ebx, edi
imul ebx
add edx, ebx
sar edx, 8
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
je 0x585618
add esi, 0x5c4
mov dword [ebp - 0x18], esi
mov esi, edi
mov edi, dword [ebp - 0x18]
push esi
mov ecx, edi
call fcn.0059a480
test byte [esi + 0x116], 1
je 0x58560c
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esi, 0x128
dec ebx
jne 0x5855f4
mov edi, dword [ebp - 0x24]
push dword [ebp - 0x14]
push str.removed__d_files_n
call fcn.00589b00
add esp, 8
test edi, edi
je 0x585635
push edi
call fcn.0058be30
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x585650
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x618
mov eax, dword [0x6c9db0]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push str.siammmo.exe
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x110]
push 0x67579c
push eax
call fcn.0057de30
push str.WarZ_Siam_MMO__Survivor_Stories
lea eax, [ebp - 0x618]
push str.Allow_network_traffic_for__s
push eax
call fcn.0057de50
add esp, 0x1c
lea eax, [ebp - 0x618]
lea ecx, [ebp - 0x110]
push eax
call fcn.0057dae0
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
call fcn.005aede3
mov esp, ebp
pop ebp
ret
Function at 0x585b20
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x6c9db0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push str.Making_sure_extracted_files_exists_n
mov edi, ecx
call fcn.00589b00
add esp, 4
lea ecx, [edi + 0x4c0]
push 1
push 1
call fcn.00599c60
mov eax, dword [edi + 0x5cc]
xor ebx, ebx
sub eax, dword [edi + 0x5c8]
sar eax, 2
test eax, eax
je 0x585c03
push esi
lea ecx, [ecx]
mov eax, dword [edi + 0x5c8]
mov esi, dword [eax + ebx*4]
test byte [esi + 0x116], 1
je 0x585bea
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x40c]
push eax
push esi
call fcn.0058acb0
add esp, 0xc
test al, al
je 0x585bb9
mov eax, dword [ebp - 0x40c]
cmp eax, dword [esi + 0x10e]
jne 0x585bb9
mov eax, dword [ebp - 0x408]
cmp eax, dword [esi + 0x106]
je 0x585bea
push esi
push str.restoring__s_n
call fcn.00589b00
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
call dword [sym.imp.dbghelp.dll_MakeSureDirectoryPathExists]
push 0x67591c
push esi
lea ecx, [edi + 0x4c0]
call fcn.00599240
test al, al
je 0x585c2b
mov eax, dword [edi + 0x5cc]
inc ebx
sub eax, dword [edi + 0x5c8]
sar eax, 2
cmp ebx, eax
jb 0x585b70
pop esi
lea ecx, [edi + 0x4c0]
call fcn.00598f40
push str.Making_sure_extracted_files_exists___finished_n
call fcn.00589b00
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop edi
pop ebx
call fcn.005aede3
mov esp, ebp
pop ebp
ret
push esi
lea eax, [ebp - 0x404]
push str.Cant_extract_file__s_nPlease_delete_this_file_manually
push eax
call fcn.0057de50
add esp, 0xc
lea eax, [ebp - 0x404]
push eax
push edi
call fcn.005846a0
int3
Function at 0x586280
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ccbf0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x6c9db0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
cmp dword [esi + 0x20d84], 0
je 0x5862d9
push 0
push 0x33b
push str.Updater.cpp
push str.status___STATUS_Checking
call fcn.00589fd0
add esp, 0x10
mov ecx, esi
call fcn.00584700
mov ecx, esi
call fcn.00584920
test al, al
je 0x586304
mov ecx, esi
call fcn.00584990
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov byte [esi + 0x84], 1
cmp dword [esi + 0x20d84], 5
push 0x674e14
sete al
lea eax, [eax*2 + 3]
mov dword [esi + 0x20d84], eax
lea eax, [esi + 0x20d8d]
push eax
call fcn.0057de50
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 8
mov edi, edi
cmp dword [esi + 0x20d84], 5
jne 0x5863ef
mov eax, dword [esi + 0x21768]
mov dword [0x7762c0], eax
mov eax, dword [esi + 0x2176c]
mov dword [0x7762c4], eax
mov eax, dword [0x7762d0]
or eax, dword [0x7762d4]
je 0x586398
call fcn.0057e8a0
test al, al
je 0x586398
push 0
push 0
push 0x7762c0
push 0x57e4c0
push 0
push 0
call fcn.005af76e
add esp, 0x18
mov dword [0x776488], eax
mov ecx, esi
call fcn.00584c40
mov ecx, esi
call fcn.00584df0
push dword [esi + 0x18]
push dword [esi + 0x5c4]
push str.current_build_version_d__updater_data_version_d_n
call fcn.00589b00
mov eax, dword [esi + 0x5c4]
add esp, 0xc
mov ecx, esi
cmp eax, dword [esi + 0x18]
jne 0x5863ce
call fcn.005861b0
call fcn.00585050
mov ecx, esi
call fcn.005857f0
mov ecx, esi
call fcn.00586110
mov ecx, esi
call fcn.005860b0
mov ecx, esi
call fcn.005861b0
push 0x32
call edi
jmp 0x586340

Function at 0x587040
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
lea ecx, [esi + 0x215d0]
call fcn.00583b80
push 0
push 0
push esi
push 0x586ca0
push 0
push 0
call fcn.005af76e
add esp, 0x18
mov dword [esi + 0x215c8], eax
pop esi
ret

Function at 0x5871c0
Capabilities:
Create thread

Disassembly:
push esi
push edi
mov edi, ecx
lea edx, [edi + 0x21980]
mov esi, edx
lea ecx, [esi + 1]
nop
mov al, byte [esi]
inc esi
test al, al
jne 0x5871d0
sub esi, ecx
cmp esi, 0x13
je 0x587206
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x5871e1
sub edx, ecx
cmp edx, 0x1d
je 0x587206
push 0
push str.Create_Account
push str.Please_enter_Serial_Key_in_following_format:_nXXXX_XXXX_XXXX_XXXX_or_XXXXX_XXXXX_XXXXX_XXXXX_XXXXX
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
ret
push 0
push 0
push edi
push 0x587070
push 0
push 0
call fcn.005af76e
add esp, 0x18
mov dword [edi + 0x215c8], eax
pop edi
pop esi
ret
Function at 0x587580
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
push edi
lea ecx, [esi + 0x2177c]
mov edx, ecx
lea edi, [edx + 1]
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x587590
sub edx, edi
cmp edx, 4
jae 0x5875bf
push 0
push str.Create_Account
push str.email_address_is_too_short
push 0
mov dword [esi + 0x21778], 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
ret
call fcn.00587250
test eax, eax
jne 0x5875e3
push eax
push str.Create_Account
push str.email_address_is_not_valid
push eax
mov dword [esi + 0x21778], eax
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
ret
lea ecx, [esi + 0x2187c]
lea eax, [esi + 0x217fc]
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x587610
test dl, dl
je 0x58760c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x587610
add eax, 2
add ecx, 2
test dl, dl
jne 0x5875f0
xor eax, eax
jmp 0x587615
sbb eax, eax
or eax, 1
push 0
test eax, eax
je 0x58763a
push str.Create_Account
push str.Passwords_do_not_match
push 0
mov dword [esi + 0x21778], 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
ret
push 0
push esi
push 0x587230
push 0
push 0
call fcn.005af76e
add esp, 0x18
mov dword [esi + 0x215c8], eax
pop edi
pop esi
ret

Function at 0x587850
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x215b0], 0
je 0x587875
push 0
push 0x5b9
push str.Updater.cpp
push str.mainThread___NULL
call fcn.00589fd0
add esp, 0x10
cmp dword [esi + 0x215c8], 0
je 0x587897
push 0
push 0x5ba
push str.Updater.cpp
push str.loginThread___NULL
call fcn.00589fd0
add esp, 0x10
push 0
push 0
push esi
push 0x5864b0
push 0
push 0
call fcn.005af76e
push 0
push 0
push esi
push 0x586c60
push 0
push 0
mov dword [esi + 0x215b0], eax
call fcn.005af76e
push 0
push 0
push esi
push 0x586c80
push 0
push 0
mov dword [esi + 0x21c78], eax
call fcn.005af76e
add esp, 0x48
mov dword [esi + 0x215c0], eax
pop esi
ret

Function at 0x587970
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
push edi
push str.CUpdater::Stop___n
mov ebx, ecx
call fcn.00589b00
add esp, 4
cmp byte [ebx + 0x20d8c], 0
jne 0x587991
mov eax, dword [ebx + 0x215b8]
mov edi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x758f44
call edi
lea esi, [ebx + 0x20d6c]
push esi
call edi
mov ecx, dword [ebx + 0x215b0]
mov edi, dword [sym.imp.KERNEL32.dll_TerminateThread]
test ecx, ecx
je 0x5879d2
push 0
push ecx
call edi
push dword [ebx + 0x215b0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 0x215b0], 0
mov eax, dword [ebx + 0x21c78]
test eax, eax
je 0x5879f7
push 0
push eax
call edi
push dword [ebx + 0x21c78]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 0x21c78], 0
mov eax, dword [ebx + 0x215c8]
test eax, eax
je 0x587a1c
push 0
push eax
call edi
push dword [ebx + 0x215c8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 0x215c8], 0
mov eax, dword [ebx + 0x215c0]
test eax, eax
je 0x587a41
push 0
push eax
call edi
push dword [ebx + 0x215c0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 0x215c0], 0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call esi
push 0x758f44
call esi
pop edi
pop esi
pop ebx
ret
Function at 0x588990
Capabilities:
Get local ipv4 addresses
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push 0x11
mov dword [ebp - 4], 4
call fcn.005b0e5c
mov ebx, eax
push 0x288
mov dword [ebp - 8], ebx
call fcn.005b0e5c
mov esi, eax
add esp, 8
test esi, esi
jne 0x5889cb
push str.Error_allocating_memory_needed_to_call_GetAdaptersinfo_n
call fcn.005b0f03
add esp, 4
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x5889f9
push dword [ebp - 4]
call fcn.005b0e5c
mov esi, eax
add esp, 4
test esi, esi
jne 0x5889f9
push str.Error_allocating_memory_needed_to_call_GetAdaptersinfo_n
call fcn.005b0f03
add esp, 4
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x588a63
movzx eax, byte [esi + 0x199]
push eax
movzx eax, byte [esi + 0x198]
push eax
movzx eax, byte [esi + 0x197]
push eax
movzx eax, byte [esi + 0x196]
push eax
movzx eax, byte [esi + 0x195]
push eax
movzx eax, byte [esi + 0x194]
push eax
lea eax, [ebp - 8]
push str._02X:_02X:_02X:_02X:_02X:_02X
push eax
call fcn.00582730
push ebx
lea eax, [esi + 0x1b0]
push eax
push str.Address:__s__mac:__s_n
call fcn.005b0f03
add esp, 0x2c
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call fcn.005b0fb2
add esp, 4
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x588d30
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0
lea eax, [ebp - 4]
mov esi, ecx
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareCodex_Development_GroupWarZSiam
push bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x588d8c
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x588d63
sub ecx, edx
lea eax, [ecx + 1]
push eax
push esi
push 1
push 0
push str.username
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x588da0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0
lea eax, [ebp - 4]
mov esi, ecx
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.AppEventsEventLabelsSystemFool
push bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x588dff
sub esi, 0xffffff80
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x588dd6
sub ecx, edx
lea eax, [ecx + 1]
push eax
push esi
push 1
push 0
push str.password
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x588e10
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1d4
mov eax, dword [0x6c9db0]
xor eax, esp
mov dword [esp + 0x1d0], eax
push esi
push 0
lea eax, [esp + 8]
mov esi, ecx
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.AppEventsEventLabelsNotification.Machine
push bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x588ebd
push 0x1c8
push eax
lea eax, [esp + 0x10]
push eax
call fcn.005b2ef0
add esp, 0xc
lea ecx, [esp + 8]
call fcn.0057cb90
push dword [esp + 0x1c]
add esi, 0x100
push dword [esp + 0x1c]
push str.0x_I64x
push esi
call fcn.00588fe0
mov ecx, esi
add esp, 0x10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x588e92
sub ecx, edx
lea eax, [ecx + 1]
push eax
push esi
push 1
push 0
push str.Decrypt
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [esp + 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x1d4]
pop esi
xor ecx, esp
call fcn.005aede3
mov esp, ebp
pop ebp
ret