joyce8/EMBER2024-capa huggingface dataset:
Function at 0x562c70
Capabilities:
Create process on windows
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x680da0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x104
lea eax, [ebp - 0x20c]
mov edi, edx
push eax
push 0
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push str.Trying_to_update_n
call fcn.00569640
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push str._s.new.exe
push eax
call fcn.0055d1c0
lea eax, [ebp - 0x108]
push 0x653b5c
push eax
call fcn.0058f4ab
mov esi, eax
add esp, 0x18
test esi, esi
jne 0x562cee
lea eax, [ebp - 0x108]
push eax
push str.cant_open__s_for_writing_n
call fcn.00569260
add esp, 8
push esi
push 1
push edi
push ebx
call fcn.005906c3
push esi
call fcn.0058ee85
add esp, 0x14
push dword [0x72c0ec]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x108]
push eax
push str.executing__s_n
call fcn.00569640
add esp, 8
lea eax, [ebp - 0x108]
push 5
push 0
push 0x688050
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
pop ebx
cmp eax, 0x20
jge 0x562d5b
push eax
lea eax, [ebp - 0x108]
push eax
push str.failed_to_launch__s___d
call fcn.00569260
add esp, 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
call fcn.0058e793
mov esp, ebp
pop ebp
ret

Function at 0x5634b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
push esi
push eax
mov esi, ecx
push 0xf003f
push 0
push str.SoftwareArktos_Entertainment_GroupWarZ
mov byte [esi], 0
mov byte [esi + 0x80], 0
mov dword [esi + 0x100], 0
mov dword [esi + 0x104], 0
mov dword [esi + 0x108], 0
push SysReAllocString
mov dword [esi + 0x10c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x563531
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x80
push eax
push esi
push 0
push 0
push str.username
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x564cb0
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x680da0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x41c]
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
push eax
lea eax, [ebp - 0x418]
push eax
push edi
call fcn.0056a630
add esp, 0xc
test al, al
je 0x564cfb
mov eax, dword [ebp - 0x418]
cmp eax, dword [edi + 0x112]
je 0x564ddd
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edi
call dword [sym.imp.dbghelp.dll_MakeSureDirectoryPathExists]
push 0x653b5c
push edi
call fcn.0058f4ab
add esp, 8
mov dword [ebp - 0x410], eax
test eax, eax
je 0x564df0
lea eax, [ebp - 0x414]
mov ecx, esi
push eax
lea eax, [ebp - 0x40c]
push eax
call fcn.004011c0
push eax
mov ecx, esi
call fcn.004011f0
push eax
push edi
lea ecx, [ebx + 0x4c0]
call fcn.00579f80
mov eax, dword [edi + 0x10a]
cmp eax, dword [ebp - 0x414]
je 0x564d76
push 0
push 0x1b8
push str.Updater.cpp
push str.fe__size__out_size
call fcn.00569b10
add esp, 0x10
lea esi, [ebx + 0x20d6c]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push dword [ebp - 0x410]
push 1
push dword [ebp - 0x414]
push dword [ebp - 0x40c]
call fcn.005906c3
push dword [ebp - 0x410]
call fcn.0058ee85
add esp, 0x14
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push str.infestation.exe
push edi
call fcn.0059276b
add esp, 8
test eax, eax
jne 0x564dcf
mov byte [ebx + 0x216a0], 1
call fcn.00565090
push dword [ebp - 0x40c]
call fcn.0056b790
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0058e793
mov esp, ebp
pop ebp
ret 8
push edi
lea eax, [ebp - 0x408]
push str.Cant_replace_file__s_nPlease_delete_this_file_manually
push eax
call fcn.0055d1e0
add esp, 0xc
lea eax, [ebp - 0x408]
push eax
push ebx
call fcn.00564080
int3
Function at 0x564ef0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ac428
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x680da0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
push 0x400
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0
call fcn.00567870
mov eax, dword [esi + 0x5cc]
xor edi, edi
sub eax, dword [esi + 0x5c8]
mov ebx, dword [ebp - 0x20]
sar eax, 2
mov dword [ebp - 0x10], edi
test eax, eax
je 0x56500c
lea esp, [esp]
mov eax, dword [esi + 0x5c8]
mov esi, dword [eax + edi*4]
test dword [esi + 0x116], 0x100000
jne 0x564fee
cmp esi, ebx
jae 0x564fc1
mov eax, dword [ebp - 0x24]
cmp eax, esi
ja 0x564fc1
sub esi, eax
mov eax, 0xdd67c8a7
imul esi
add edx, esi
sar edx, 8
mov esi, edx
shr esi, 0x1f
add esi, edx
cmp ebx, dword [ebp - 0x1c]
jne 0x564fb6
push ecx
lea ecx, [ebp - 0x24]
call fcn.00567910
mov ebx, dword [ebp - 0x20]
imul esi, esi, 0x128
add esi, dword [ebp - 0x24]
jmp 0x564fd2
cmp ebx, dword [ebp - 0x1c]
jne 0x564fd2
push ecx
lea ecx, [ebp - 0x24]
call fcn.00567910
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x564fe2
mov ecx, 0x4a
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x10]
add ebx, 0x128
inc dword [ebp - 0x14]
mov dword [ebp - 0x20], ebx
mov esi, dword [ebp - 0x18]
inc edi
mov dword [ebp - 0x10], edi
mov eax, dword [esi + 0x5cc]
sub eax, dword [esi + 0x5c8]
sar eax, 2
cmp edi, eax
jb 0x564f70
mov edi, dword [ebp - 0x24]
mov eax, 0xdd67c8a7
sub ebx, edi
imul ebx
add edx, ebx
sar edx, 8
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
je 0x565058
add esi, 0x5c4
mov dword [ebp - 0x18], esi
mov esi, edi
mov edi, dword [ebp - 0x18]
push esi
mov ecx, edi
call fcn.00579ba0
test byte [esi + 0x116], 1
je 0x56504c
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esi, 0x128
dec ebx
jne 0x565034
mov edi, dword [ebp - 0x24]
push dword [ebp - 0x14]
push str.removed__d_files_n
call fcn.00569640
add esp, 8
test edi, edi
je 0x565075
push edi
call fcn.0056b790
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x565090
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x618
mov eax, dword [0x680da0]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push str.infestation.exe
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x110]
push 0x654b3c
push eax
call fcn.0055d1c0
push str.CYBERZ_Survival_Stories
lea eax, [ebp - 0x618]
push str.Allow_network_traffic_for__s
push eax
call fcn.0055d1e0
add esp, 0x1c
lea eax, [ebp - 0x618]
lea ecx, [ebp - 0x110]
push eax
call fcn.0055ce70
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
call fcn.0058e793
mov esp, ebp
pop ebp
ret
Function at 0x565570
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x680da0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push str.Making_sure_extracted_files_exists_n
mov edi, ecx
call fcn.00569640
add esp, 4
lea ecx, [edi + 0x4c0]
push 1
push 1
call fcn.00579380
mov eax, dword [edi + 0x5cc]
xor ebx, ebx
sub eax, dword [edi + 0x5c8]
sar eax, 2
test eax, eax
je 0x565653
push esi
lea ecx, [ecx]
mov eax, dword [edi + 0x5c8]
mov esi, dword [eax + ebx*4]
test byte [esi + 0x116], 1
je 0x56563a
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x40c]
push eax
push esi
call fcn.0056a630
add esp, 0xc
test al, al
je 0x565609
mov eax, dword [ebp - 0x40c]
cmp eax, dword [esi + 0x112]
jne 0x565609
mov eax, dword [ebp - 0x408]
cmp eax, dword [esi + 0x10a]
je 0x56563a
push esi
push str.restoring__s_n
call fcn.00569640
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
call dword [sym.imp.dbghelp.dll_MakeSureDirectoryPathExists]
push 0x654cd4
push esi
lea ecx, [edi + 0x4c0]
call fcn.00578960
test al, al
je 0x56567b
mov eax, dword [edi + 0x5cc]
inc ebx
sub eax, dword [edi + 0x5c8]
sar eax, 2
cmp ebx, eax
jb 0x5655c0
pop esi
lea ecx, [edi + 0x4c0]
call fcn.00578650
push str.Making_sure_extracted_files_exists___finished_n
call fcn.00569640
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop edi
pop ebx
call fcn.0058e793
mov esp, ebp
pop ebp
ret
push esi
lea eax, [ebp - 0x404]
push str.Cant_extract_file__s_nPlease_delete_this_file_manually
push eax
call fcn.0055d1e0
add esp, 0xc
lea eax, [ebp - 0x404]
push eax
push edi
call fcn.00564080
int3
Function at 0x565cd0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ac500
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x680da0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
cmp dword [esi + 0x20d84], 0
je 0x565d29
push 0
push 0x373
push str.Updater.cpp
push str.status___STATUS_Checking
call fcn.00569b10
add esp, 0x10
mov ecx, esi
call fcn.005640e0
mov ecx, esi
call fcn.00564300
test al, al
je 0x565d54
mov ecx, esi
call fcn.00564370
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [0x72c053], 0
mov byte [esi + 0x84], 1
jne 0x565d6b
mov eax, 3
jmp 0x565dc3
mov eax, dword [0x72da10]
or eax, dword [0x72da14]
jne 0x565d7f
mov eax, 3
jmp 0x565dc3
lea eax, [esi + 0x20d8d]
push str.Checking_for_linked_steam_account
push eax
call fcn.0055d1e0
add esp, 8
lea ecx, [esi + 0x216ac]
call fcn.00568820
test al, al
jne 0x565da9
mov eax, 3
jmp 0x565dc3
mov ecx, esi
call fcn.00566a70
xor eax, eax
cmp dword [esi + 0x20d84], 5
sete al
lea eax, [eax*2 + 3]
mov dword [esi + 0x20d84], eax
lea eax, [esi + 0x20d8d]
push 0x653f2c
push eax
call fcn.0055d1e0
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 8
cmp dword [esi + 0x20d84], 5
jne 0x565e92
mov eax, dword [esi + 0x217ac]
mov dword [0x72c7e0], eax
mov eax, dword [esi + 0x217b0]
mov dword [0x72c7e4], eax
mov eax, dword [0x72c7f0]
or eax, dword [0x72c7f4]
je 0x565e3b
call fcn.0055dc30
test al, al
je 0x565e3b
push 0
push 0
push 0x72c7e0
push 0x55d850
push 0
push 0
call fcn.0058f11e
add esp, 0x18
mov dword [0x72c9a8], eax
mov ecx, esi
call fcn.00564680
mov ecx, esi
call fcn.00564830
push dword [esi + 0x18]
push dword [esi + 0x5c4]
push str.current_build_version_d__updater_data_version_d_n
call fcn.00569640
mov eax, dword [esi + 0x5c4]
add esp, 0xc
mov ecx, esi
cmp eax, dword [esi + 0x18]
jne 0x565e71
call fcn.00565c00
call fcn.00564a90
mov ecx, esi
call fcn.00565240
mov ecx, esi
call fcn.00565b60
mov ecx, esi
call fcn.00565b00
mov ecx, esi
call fcn.00565c00
push 0x32
call edi
jmp 0x565de3
Function at 0x566cb0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
lea ecx, [esi + 0x216ac]
call fcn.00563540
push 0
push 0
push esi
push 0x566970
push 0
push 0
call fcn.0058f11e
add esp, 0x18
mov dword [esi + 0x216a4], eax
pop esi
ret

Function at 0x566e30
Capabilities:
Create thread

Disassembly:
push esi
push edi
mov edi, ecx
lea edx, [edi + 0x219c4]
mov esi, edx
lea ecx, [esi + 1]
nop
mov al, byte [esi]
inc esi
test al, al
jne 0x566e40
sub esi, ecx
cmp esi, 0x13
je 0x566e76
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x566e51
sub edx, ecx
cmp edx, 0x1d
je 0x566e76
push 0
push str.Create_Account
push str.Please_enter_Serial_Key_in_following_format:_nXXXX_XXXX_XXXX_XXXX_or_XXXXX_XXXXX_XXXXX_XXXXX_XXXXX
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
ret
push 0
push 0
push edi
push 0x566ce0
push 0
push 0
call fcn.0058f11e
add esp, 0x18
mov dword [edi + 0x216a4], eax
pop edi
pop esi
ret

Function at 0x567250
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
push edi
lea ecx, [esi + 0x217c0]
mov edx, ecx
lea edi, [edx + 1]
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x567260
sub edx, edi
cmp edx, 4
jae 0x56728f
push 0
push str.Create_Account
push str.email_address_is_too_short
push 0
mov dword [esi + 0x217bc], 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
ret
call fcn.00566ec0
test eax, eax
jne 0x5672b3
push eax
push str.Create_Account
push str.email_address_is_not_valid
push eax
mov dword [esi + 0x217bc], eax
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
ret
lea ecx, [esi + 0x218c0]
lea eax, [esi + 0x21840]
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x5672e0
test dl, dl
je 0x5672dc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x5672e0
add eax, 2
add ecx, 2
test dl, dl
jne 0x5672c0
xor eax, eax
jmp 0x5672e5
sbb eax, eax
or eax, 1
push 0
test eax, eax
je 0x56730a
push str.Create_Account
push str.Passwords_do_not_match
push 0
mov dword [esi + 0x217bc], 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
ret
push 0
push esi
push 0x566ea0
push 0
push 0
call fcn.0058f11e
add esp, 0x18
mov dword [esi + 0x216a4], eax
pop edi
pop esi
ret

Function at 0x567530
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x21660], 0
je 0x567557
push 0
push 0x5ee
push str.Updater.cpp
push str.mainThread___NULL
call fcn.00569b10
add esp, 0x10
cmp dword [edi + 0x216a4], 0
je 0x567579
push 0
push 0x5ef
push str.Updater.cpp
push str.loginThread___NULL
call fcn.00569b10
add esp, 0x10
push 0
push 0
push edi
push 0x565f60
push 0
push 0
call fcn.0058f11e
push 0
push 0
push edi
push 0x566930
push 0
push 0
mov dword [edi + 0x21660], eax
call fcn.0058f11e
add esp, 0x30
mov dword [edi + 0x21cbc], eax
lea esi, [edi + 0x21670]
mov ebx, 0xc
lea esp, [esp]
push 0
push 0
push edi
push 0x566950
push 0
push 0
call fcn.0058f11e
add esp, 0x18
mov dword [esi], eax
lea esi, [esi + 4]
dec ebx
jne 0x5675c0
pop edi
pop esi
pop ebx
ret
Function at 0x5675f0
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
push edi
push str.CUpdater::Stop___n
mov ebx, ecx
call fcn.00569640
add esp, 4
cmp byte [ebx + 0x20d8c], 0
jne 0x567611
mov eax, dword [ebx + 0x21668]
mov edi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x708368
call edi
lea esi, [ebx + 0x20d6c]
push esi
call edi
mov ecx, dword [ebx + 0x21660]
mov edi, dword [sym.imp.KERNEL32.dll_TerminateThread]
test ecx, ecx
je 0x567652
push 0
push ecx
call edi
push dword [ebx + 0x21660]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 0x21660], 0
mov eax, dword [ebx + 0x21cbc]
test eax, eax
je 0x567677
push 0
push eax
call edi
push dword [ebx + 0x21cbc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 0x21cbc], 0
mov eax, dword [ebx + 0x216a4]
test eax, eax
je 0x56769c
push 0
push eax
call edi
push dword [ebx + 0x216a4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 0x216a4], 0
lea edi, [ebx + 0x21670]
mov ebx, 0xc
mov eax, dword [edi]
test eax, eax
je 0x5676c4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], 0
add edi, 4
dec ebx
jne 0x5676a7
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call esi
push 0x708368
call esi
pop edi
pop esi
pop ebx
ret
Function at 0x568660
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ac8a1
mov eax, dword fs:[0]
push eax
sub esp, 0xb0
push esi
mov eax, dword [0x680da0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0
lea eax, [ebp - 0x10]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareArktos_Entertainment_GroupWarZ
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x5686e0
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x5686b7
sub ecx, edx
lea eax, [ecx + 1]
push eax
push esi
push 1
push 0
push str.username
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0xb8]
call fcn.00401da0
lea ecx, [ebp - 0x74]
mov dword [ebp - 4], 0
call fcn.00401450
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.00401000
push str.api_Login.aspx
lea ecx, [ebp - 0xbc]
mov byte [ebp - 4], 2
call fcn.00567cf0
push esi
push str.username
lea ecx, [ebp - 0x74]
mov dword [ebp - 4], 3
call fcn.004017f0
lea eax, [esi + 0x80]
push eax
push str.password
lea ecx, [ebp - 0x74]
call fcn.004017f0
mov ecx, dword [ebp - 0x34]
test ecx, ecx
je 0x568757
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [ebp - 0x34], 0
call fcn.00569580
mov eax, dword [0x707024]
lea ecx, [ebp - 0x74]
push ecx
push 1
add eax, 0x84
lea ecx, [ebp - 0xb8]
push 0x1bb
push eax
fstp st(0)
call fcn.00402140
push eax
lea ecx, [ebp - 0xbc]
mov dword [ebp - 0x34], eax
call fcn.00567f40
mov dword [ebp - 0x30], eax
test eax, eax
je 0x5687af
push eax
push str.Login_FAILED__code:__d_n
call fcn.00569640
add esp, 8
mov dword [esi + 0x10c], 3
jmp 0x5687bd
lea eax, [ebp - 0xbc]
mov ecx, esi
push eax
call fcn.00568520
mov dword [ebp - 4], 6
mov ecx, dword [ebp - 0x34]
test ecx, ecx
je 0x5687d8
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [ebp - 0x34], 0
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 5
call fcn.004010b0
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 4
call fcn.00401530
lea ecx, [ebp - 0xb8]
mov dword [ebp - 4], 0xffffffff
call fcn.00401e60
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x569090
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov ecx, dword [0x70f670]
sub esp, 0x10
test ecx, ecx
je 0x5690af
cmp dword [0x70f66c], 1
jl 0x5690af
test ecx, ecx
je 0x5690af
call fcn.005822c0
call fcn.00569580
mov eax, dword [0x686e6c]
mov ecx, 0x1e
fstp dword [0x67fbe0]
movss xmm2, dword [0x67fbe0]
xorps xmm1, xmm1
subss xmm2, dword [0x686e68]
movss dword [eax*4 + 0x686e70], xmm2
inc eax
cdq
idiv ecx
movss dword [0x67fbe4], xmm2
mov eax, 0x686e74
mov dword [0x686e6c], edx
jmp 0x569100
addss xmm1, dword [eax - 4]
addss xmm1, dword [eax]
addss xmm1, dword [eax + 4]
addss xmm1, dword [eax + 8]
addss xmm1, dword [eax + 0xc]
addss xmm1, dword [eax + 0x10]
addss xmm1, dword [eax + 0x14]
addss xmm1, dword [eax + 0x18]
addss xmm1, dword [eax + 0x1c]
addss xmm1, dword [eax + 0x20]
add eax, 0x28
cmp eax, 0x686eec
jl 0x569100
mulss xmm1, dword [0x63bae0]
movss xmm0, dword [0x63badc]
comiss xmm0, xmm2
movss dword [0x67fbe8], xmm1
jbe 0x569162
mov dword [0x67fbe4], 0x3983126f
comiss xmm0, xmm1
jbe 0x569171
mov dword [0x67fbe8], 0x3983126f
cmp dword [0x686e28], 0
jne 0x5691ad
lea eax, [esp]
mov dword [0x686e28], 1
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov edx, dword [esp + 4]
mov ecx, dword [esp]
call fcn.0059671f
push 0x686f48
movsd qword [0x686f40], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [esp + 8]
sub ecx, dword [0x686f48]
mov edx, dword [esp + 0xc]
sbb edx, dword [0x686f4c]
call fcn.0059671f
divsd xmm0, qword [0x686f40]
movsd xmm1, qword [0x686e30]
xorps xmm2, xmm2
cvtsd2ss xmm2, xmm0
movaps xmm0, xmm2
subss xmm0, dword [0x686e3c]
comiss xmm0, dword [0x63bae4]
jbe 0x569227
movd xmm0, dword [0x686e38]
xor eax, eax
cvtdq2pd xmm0, xmm0
movss dword [0x686e3c], xmm2
divsd xmm1, xmm0
cvtpd2ps xmm0, xmm1
xorps xmm1, xmm1
movss dword [0x686e40], xmm0
jmp 0x56922c
mov eax, dword [0x686e38]
movss xmm0, dword [0x655c30]
inc eax
divss xmm0, dword [0x67fbe4]
mov dword [0x686e38], eax
cvtps2pd xmm0, xmm0
addsd xmm0, xmm1
movsd qword [0x686e30], xmm0
add esp, 0x10
jmp 0x57b790
push ecx
call fcn.00569580
fstp dword [esp]
movss xmm0, dword [esp]
subss xmm0, dword [0x7083bc]
comiss xmm0, dword [0x655c30]
jbe 0x57b7de
mov eax, dword [0x708380]
test eax, eax
je 0x57b7de
push eax
push str.Loads_unloads_collapsed:__d_n
call fcn.00569640
movss xmm0, dword [esp + 8]
add esp, 8
mov dword [0x708380], 0
movss dword [0x7083bc], xmm0
pop ecx
ret
Function at 0x569580
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub esp, 0x10
cmp dword [0x686e28], 0
jne 0x5695bf
lea eax, [esp]
mov dword [0x686e28], 1
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov edx, dword [esp + 4]
mov ecx, dword [esp]
call fcn.0059671f
push 0x686f48
movsd qword [0x686f40], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [esp + 8]
sub ecx, dword [0x686f48]
mov edx, dword [esp + 0xc]
sbb edx, dword [0x686f4c]
call fcn.0059671f
divsd xmm0, qword [0x686f40]
cvtsd2ss xmm0, xmm0
movss dword [esp], xmm0
fld dword [esp]
add esp, 0x10
ret
Function at 0x569c10
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x28
cmp dword [0x688040], 0
jne 0x569c35
push 0
push 0x1ef
push str.SourceWinMain.cpp
push str.hInstance___NULL
call fcn.00569b10
add esp, 0x10
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push esi
push edi
push 0
mov dword [esp + 0x10], 0x4008
mov dword [esp + 0x14], 0x569e70
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
call ebx
mov dword [esp + 0x1c], eax
mov eax, dword [0x688048]
test eax, eax
jne 0x569c7b
push 0x7f00
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
push 0x7f00
push 0
mov dword [esp + 0x28], eax
call dword [sym.imp.USER32.dll_LoadCursorA]
push 4
mov dword [esp + 0x28], eax
call dword [sym.imp.GDI32.dll_GetStockObject]
mov dword [esp + 0x28], eax
mov eax, dword [str.r3dWin]
mov dword [esp + 0x30], eax
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x30], 0
call dword [sym.imp.USER32.dll_RegisterClassA]
push 0
push 0
push 0
push str.DISPLAY
call dword [sym.imp.GDI32.dll_CreateICA]
mov esi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov edi, eax
push 8
push edi
call esi
push 0xa
push edi
mov dword [0x687fa8], eax
call esi
push edi
mov dword [0x687fac], eax
call dword [sym.imp.GDI32.dll_DeleteDC]
push 0
push 0
call ebx
mov ecx, dword [0x67fbec]
mov esi, dword [0x67fbf0]
push eax
mov eax, dword [0x687fac]
push 0
sub eax, ecx
push 0
cdq
push ecx
sub eax, edx
push esi
sar eax, 1
push eax
mov eax, dword [0x687fa8]
sub eax, esi
cdq
sub eax, edx
sar eax, 1
push eax
push 0x10cf0000
push dword [0x67fc00]
push dword [0x67fc08]
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x688044], eax
test eax, eax
jne 0x569d62
push eax
push str.Error
push str.Window_Creation_Failed
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x28
ret
push dword [esp + 0x20]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push 1
push 0x80
push eax
call esi
push dword [esp + 0x20]
push 0
push 0x80
push dword [0x688044]
call esi
mov esi, dword [0x688044]
mov ebx, dword [sym.imp.USER32.dll_GetWindowLongA]
push 0xfffffffffffffff0
push esi
call ebx
mov edi, dword [sym.imp.USER32.dll_SetWindowLongA]
and eax, 0xfffbffff
push eax
push 0xfffffffffffffff0
push esi
call edi
mov esi, dword [0x688044]
push 0xfffffffffffffff0
push esi
call ebx
and eax, 0xfffeffff
push eax
push 0xfffffffffffffff0
push esi
call edi
push 0
push dword [0x688044]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
push dword [0x688044]
call dword [sym.imp.USER32.dll_InvalidateRect]
push dword [0x688044]
call dword [sym.imp.USER32.dll_UpdateWindow]
push dword [0x688044]
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x28
ret

Function at 0x56a600
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 8]
or eax, 0xffffffff
test edx, edx
je 0x56a62c
push esi
mov esi, dword [esp + 8]
movzx ecx, byte [esi]
lea esi, [esi + 1]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x67fc10]
dec edx
jne 0x56a610
pop esi
not eax
ret