joyce8/EMBER2024-capa huggingface dataset:
Function at 0x55d030
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x614
mov eax, dword [0x680da0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call fcn.0058ebd0
add esp, 8
lea esi, [eax + 1]
cmp esi, 1
jne 0x55d088
push 0
push 0x14
push str.GenerateUpdaterXML.cpp
push str._DWORD_fname___1
call fcn.00569b10
add esp, 0x10
lea eax, [ebp - 0x610]
push eax
lea eax, [ebp - 0x614]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0056a630
add esp, 0xc
test al, al
jne 0x55d0bd
lea eax, [ebp - 0x20c]
push eax
push str.failed_to_get_crc_for__s_n
call fcn.00569260
add esp, 8
push str.1.0.0
push esi
lea eax, [ebp - 0x108]
push str._s__s.exe
push eax
call fcn.0055d1c0
add esp, 0x10
lea eax, [ebp - 0x108]
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x55d100
lea eax, [ebp - 0x108]
push eax
push esi
push str.unable_to_copy__s___s_n
call fcn.00569260
add esp, 0xc
push 0x2f
push str.https:__147.50.252.53_Client_Launcher_launcher_upd.xml
call fcn.0058ebd0
mov edi, eax
add esp, 8
test edi, edi
jne 0x55d12a
push eax
push 0x21
push str.GenerateUpdaterXML.cpp
push str.updater_file
call fcn.00569b10
add esp, 0x10
inc edi
push 0x653788
push edi
call fcn.0056aeb0
mov esi, eax
push 0x65378c
push esi
call fcn.0058ed07
push dword [ebp - 0x610]
lea eax, [ebp - 0x108]
push str.1.0.0
push dword [ebp - 0x614]
push eax
push str.http:__147.50.252.53_Client_Launcher_
push str.__u_url__s_s__crc__u__ver__s__size__u____n
push esi
call fcn.0058ed07
push str.__p__n
push esi
call fcn.0058ed07
push esi
call fcn.0058ee85
lea eax, [ebp - 0x108]
push eax
push edi
lea eax, [ebp - 0x60c]
push str.XML__s_generated_nnew_exe:_s
push eax
call fcn.0055d1e0
add esp, 0x48
lea eax, [ebp - 0x60c]
push 0
push str.Updater_XML
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0058e793
mov esp, ebp
pop ebp
ret

Function at 0x55dc30
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push str.SoftwareArktos_Entertainment_GroupWarZ
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x55dc5b
mov al, 1
mov esp, ebp
pop ebp
ret
push esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 8
push eax
lea eax, [ebp - 0x10]
xorps xmm0, xmm0
push eax
push 0
push 0
push str.UpdaterTime1
push dword [ebp - 4]
movlpd qword [ebp - 0x10], xmm0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x55dcbd
push esi
call fcn.0058f0cd
mov esi, dword [ebp - 0x10]
add esp, 4
mov ecx, dword [ebp - 0xc]
add esi, 0x2a300
adc ecx, 0
cmp edx, ecx
jg 0x55dcbd
jl 0x55dcb6
cmp eax, esi
jae 0x55dcbd
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x55ddd0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb14
mov eax, dword [0x680da0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x310]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0xb14]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x104
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
mov eax, dword [ebp - 0xb14]
test eax, eax
je 0x55de25
mov byte [eax - 1], 0
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0059276b
add esp, 8
test eax, eax
je 0x55de89
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0xb10]
push str.Updater_current_directory___s__is_different_from_working_directory___s_
push eax
call fcn.00561c40
add esp, 0x10
lea eax, [ebp - 0xb10]
push 0x30
push str.Warning
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
call fcn.0058e793
mov esp, ebp
pop ebp
ret

Function at 0x55df20
Capabilities:
Inspect load icon resource
Terminate process

Disassembly:
push 5
push dword [0x688040]
call dword [sym.imp.USER32.dll_LoadIconA]
push str._generate
push 0x688050
mov dword [0x688048], eax
mov dword [0x67fbd8], 0
call fcn.0058f510
add esp, 8
test eax, eax
je 0x55df68
call fcn.0055d030
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
ret
call fcn.0055dd40
test al, al
jne 0x55df58
call fcn.0055ddd0
call fcn.0055dea0
test al, al
jne 0x55dfa3
push 0x40
push str.UAC_problem
push str.Updater_must_be_run_from_administrator
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
ret
call fcn.00562a60
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0x72c0f0
push 0x653f04
push 0x17
push 0
push 0x63b864
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov ecx, dword [0x72c0f0]
xor edx, edx
test eax, eax
push str._cmdLine
cmovs ecx, edx
push 0x688050
mov dword [0x72c0f0], ecx
call fcn.0058f510
movzx ecx, byte [0x72bc37]
add esp, 8
test eax, eax
mov edx, 1
cmovne ecx, edx
push 0x7f00
push 0
mov byte [0x72bc37], cl
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f89
push 0
mov dword [0x72c058], eax
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0x209
push 0x72bc40
push 0x12f
push 0
mov dword [0x72c054], eax
call dword [sym.imp.USER32.dll_LoadStringW]
ret
Function at 0x55ecb0
Capabilities:
Hide graphical window
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5abfb2
mov eax, dword fs:[0]
push eax
sub esp, 0x208
mov eax, dword [0x680da0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [0x72bc37], 0
je 0x55ed2c
call dword [sym.imp.KERNEL32.dll_AllocConsole]
call fcn.0059045a
add eax, 0x20
push eax
push 0x653b5c
push str.CONOUT_
call fcn.0059039a
call fcn.0059045a
push eax
push 0x653f38
push str.CONIN_
call fcn.0059039a
add esp, 0x18
mov dword [0x686e50], 1
jmp 0x55ee9a
call fcn.0055bf10
push 5
push dword [0x688040]
call dword [sym.imp.USER32.dll_LoadIconA]
push eax
push 0
push 0x80
push dword [0x688044]
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x800000
push 0
push dword [0x688044]
call fcn.00569e10
push 0xc00000
push 0
push dword [0x688044]
call fcn.00569e10
add esp, 0x18
push 0x55eb30
push 0xfffffffffffffffc
push dword [0x688044]
call dword [sym.imp.USER32.dll_SetWindowLongA]
call fcn.00573960
push 0
push 0
push 0
push str.DISPLAY
call dword [sym.imp.GDI32.dll_CreateICA]
mov esi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov ebx, eax
push 8
push ebx
call esi
push 0xa
push ebx
mov edi, eax
call esi
mov ecx, eax
lea eax, [edi - 0x311]
cdq
sub eax, edx
mov esi, eax
push 0
lea eax, [ecx - 0x28a]
sar esi, 1
push 0x28a
cdq
push 0x311
sub eax, edx
sar eax, 1
push eax
push esi
push 0
push dword [0x688044]
call dword [sym.imp.USER32.dll_SetWindowPos]
push 1
push 0x102650
call fcn.0056b770
add esp, 8
mov dword [ebp - 0x214], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x55ee16
mov ecx, eax
call fcn.0056ba40
jmp 0x55ee18
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov ecx, eax
push 0
push dword [0x688044]
mov dword [0x686f04], eax
call fcn.0056dfc0
call fcn.0055e050
push str.Feb_15_2024_10:37:44
push str.1.0.0
lea eax, [ebp - 0x210]
push str.Infestation_Launcher__s___s_
push eax
call fcn.00561c60
add esp, 0x10
lea eax, [ebp - 0x210]
push eax
push dword [0x688044]
call dword [sym.imp.USER32.dll_SetWindowTextA]
call fcn.0055e4e0
push 5
push dword [0x688044]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
call dword [sym.imp.USER32.dll_ClipCursor]
mov ecx, dword [0x686eec]
call fcn.00576e40
mov ecx, dword [0x686ee8]
call fcn.00576e90
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0058e793
mov esp, ebp
pop ebp
ret
Function at 0x55fae0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push 0x70
mov esi, ecx
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp dword [esi + 0x217bc], 1
je 0x55fce3
cmp byte [0x72df50], 0
je 0x55fbca
cmp byte [0x72e150], 0
je 0x55fbca
cmp byte [0x72e350], 0
je 0x55fbca
push ecx
mov ecx, 0x683190
call fcn.0055dce0
add esp, 4
test al, al
je 0x55fbca
movss xmm0, dword [0x68319c]
lea eax, [ebp - 4]
movss xmm3, dword [0x683198]
movss xmm2, dword [0x683194]
movss xmm1, dword [0x683190]
push eax
push ecx
mov ecx, dword [0x72c090]
movss dword [esp], xmm0
call fcn.005633e0
cmp dword [0x72c060], 0
je 0x55fbca
lea ecx, [esi + 0x217c0]
mov edx, 0x72df50
call fcn.00561ca0
lea ecx, [esi + 0x21840]
mov edx, 0x72e150
call fcn.00561ca0
lea ecx, [esi + 0x218c0]
mov edx, 0x72e350
call fcn.00561ca0
lea edx, [esi + 0x219c4]
lea ecx, [esi + 0x21940]
call fcn.00561ca0
mov ecx, esi
call fcn.00567250
mov eax, dword [0x72df40]
xor edi, edi
mov ebx, 0x72df50
mov esi, 0x6831a4
jmp 0x55fbe0
cmp dword [0x72c060], 0
je 0x55fc45
movd xmm2, dword [0x72c068]
movss xmm1, dword [esi - 4]
cvtdq2ps xmm2, xmm2
comiss xmm2, xmm1
jb 0x55fc45
movss xmm0, dword [esi + 4]
addss xmm0, xmm1
comiss xmm0, xmm2
jb 0x55fc45
movd xmm1, dword [0x72c064]
movss xmm0, dword [esi]
cvtdq2ps xmm1, xmm1
comiss xmm1, xmm0
jb 0x55fc45
addss xmm0, dword [esi + 8]
comiss xmm0, xmm1
jb 0x55fc45
mov eax, edi
mov dword [0x72df40], eax
mov dword [0x683fe4], 0x72c740
mov dword [0x683fe0], 0x72c740
cmp edi, 1
je 0x55fc53
cmp edi, 2
je 0x55fc53
xor ecx, ecx
jmp 0x55fc58
mov ecx, 1
push dword [edi*4 + 0x653ecc]
movss xmm1, dword [esi]
cmp eax, edi
movss xmm0, dword [esi - 4]
push ecx
sete dl
mov ecx, ebx
call fcn.0055f080
add esp, 8
cmp eax, 9
jne 0x55fc97
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
mov eax, dword [0x72df40]
je 0x55fca6
dec eax
jmp 0x55fcae
cmp eax, 0xd
jne 0x55fca9
cmp byte [ebx], 0
je 0x55fca9
mov eax, dword [0x72df40]
inc eax
jmp 0x55fcae
mov eax, dword [0x72df40]
cmp eax, 3
jl 0x55fcb7
xor eax, eax
jmp 0x55fcc1
test eax, eax
mov ecx, 2
cmovs eax, ecx
add esi, 0x10
mov dword [0x72df40], eax
inc edi
add ebx, 0x200
cmp esi, 0x6831d4
jl 0x55fbe0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movss xmm1, dword [0x655c38]
xor ebx, ebx
movss xmm2, dword [0x655c34]
mov esi, 0x6831a4
mov edi, 0x72df50
nop
movss xmm0, dword [esi + 8]
lea eax, [ebp - 8]
push 0
addss xmm0, xmm1
mov dword [ebp - 8], 0x64000000
push 0
push eax
sub esp, 0x10
movss dword [esp + 0xc], xmm0
movss xmm0, dword [esi + 4]
addss xmm0, xmm1
movss dword [esp + 8], xmm0
movss xmm0, dword [esi]
subss xmm0, xmm2
movss dword [esp + 4], xmm0
movss xmm0, dword [esi - 4]
subss xmm0, xmm2
movss dword [esp], xmm0
call fcn.00577350
movss xmm1, dword [esi]
add esp, 0x1c
movss xmm0, dword [esi - 4]
xor eax, eax
cmp ebx, 1
mov ecx, edi
setge al
xor dl, dl
push 0x20
push eax
call fcn.0055f080
movss xmm1, dword [0x655c38]
add edi, 0x200
movss xmm2, dword [0x655c34]
add esp, 8
inc ebx
add esi, 0x10
cmp edi, 0x72e550
jl 0x55fd00
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x55fdb0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push 0x70
mov esi, ecx
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp dword [esi + 0x217bc], 1
je 0x55ffa0
cmp byte [0x72dd40], 0
je 0x55fe65
movd xmm2, dword [0x72c068]
movss xmm1, dword [0x683170]
cvtdq2ps xmm2, xmm2
comiss xmm2, xmm1
jb 0x55fe65
movss xmm3, dword [0x683178]
movaps xmm0, xmm1
addss xmm0, xmm3
comiss xmm0, xmm2
jb 0x55fe65
movd xmm4, dword [0x72c064]
movss xmm2, dword [0x683174]
cvtdq2ps xmm4, xmm4
comiss xmm4, xmm2
jb 0x55fe65
movss xmm5, dword [0x68317c]
movaps xmm0, xmm2
addss xmm0, xmm5
comiss xmm0, xmm4
jb 0x55fe65
lea eax, [ebp - 4]
push eax
push ecx
mov ecx, dword [0x72c07c]
movss dword [esp], xmm5
call fcn.005633e0
cmp dword [0x72c060], 0
je 0x55fe65
push ecx
mov ecx, esi
call fcn.00567330
pop esi
mov esp, ebp
pop ebp
ret
movd xmm2, dword [0x72c068]
movss xmm1, dword [0x683160]
cvtdq2ps xmm2, xmm2
comiss xmm2, xmm1
jb 0x55fee0
movss xmm3, dword [0x683168]
movaps xmm0, xmm1
addss xmm0, xmm3
comiss xmm0, xmm2
jb 0x55fee0
movd xmm4, dword [0x72c064]
movss xmm2, dword [0x683164]
cvtdq2ps xmm4, xmm4
comiss xmm4, xmm2
jb 0x55fee0
movss xmm5, dword [0x68316c]
movaps xmm0, xmm2
addss xmm0, xmm5
comiss xmm0, xmm4
jb 0x55fee0
lea eax, [ebp - 4]
push eax
push ecx
mov ecx, dword [0x72c080]
movss dword [esp], xmm5
call fcn.005633e0
jmp 0x55fee0
cmp dword [0x72c060], 0
movss xmm1, dword [0x683184]
movss xmm2, dword [0x683180]
je 0x55ff73
movd xmm3, dword [0x72c068]
cvtdq2ps xmm3, xmm3
comiss xmm3, xmm2
jb 0x55ff73
movss xmm0, dword [0x683188]
addss xmm0, xmm2
comiss xmm0, xmm3
jb 0x55ff73
movd xmm3, dword [0x72c064]
cvtdq2ps xmm3, xmm3
comiss xmm3, xmm1
jb 0x55ff73
movss xmm0, dword [0x68318c]
addss xmm0, xmm1
comiss xmm0, xmm3
jb 0x55ff73
xor eax, eax
movaps xmm0, xmm2
test eax, eax
mov dword [0x72dd38], eax
push 0x40
mov dword [0x683fe4], 0x72c740
sete dl
push eax
mov ecx, 0x72dd40
mov dword [0x683fe0], 0x72c740
call fcn.0055f080
add esp, 8
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [0x72dd38]
movaps xmm0, xmm2
test eax, eax
mov ecx, 0x72dd40
push 0x40
sete dl
push 0
call fcn.0055f080
add esp, 8
pop esi
mov esp, ebp
pop ebp
ret
movss xmm0, dword [0x68318c]
lea eax, [ebp - 8]
addss xmm0, dword [0x655c38]
push 0
push 0
push eax
sub esp, 0x10
mov dword [ebp - 8], 0x64000000
movss dword [esp + 0xc], xmm0
movss xmm0, dword [0x683188]
addss xmm0, dword [0x655c38]
movss dword [esp + 8], xmm0
movss xmm0, dword [0x683184]
subss xmm0, dword [0x655c34]
movss dword [esp + 4], xmm0
movss xmm0, dword [0x683180]
subss xmm0, dword [0x655c34]
movss dword [esp], xmm0
call fcn.00577350
movss xmm1, dword [0x683184]
add esp, 0x1c
movss xmm0, dword [0x683180]
xor dl, dl
mov ecx, 0x72dd40
push 0x20
push 0
call fcn.0055f080
add esp, 8
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x56087a
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x680da0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x204]
add ecx, 0x216ac
push eax
mov esi, edx
call fcn.00568a20
cmp esi, 5
ja case.default.0x56081d
jmp dword [esi*4 + 0x5608a4]
lea eax, [ebp - 0x404]
push str.https:__www.google.com_
push eax
call fcn.0055d1e0
add esp, 8
lea eax, [ebp - 0x404]
push 5
push 0
push 0x653f2c
push eax
jmp 0x560888
push 5
push 0
push 0x653f2c
push str.https:__www.google.com_
jmp 0x560888
push 5
push 0
push 0x653f2c
push str.https:__www.youtube.com_
jmp 0x560888
push 5
push 0
push 0x653f2c
push str.https:__www.facebook.com_
jmp 0x560888
push 5
push 0
push 0x653f2c
push str.https:__www.twitter.com_
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0058e793
mov esp, ebp
pop ebp
ret
Function at 0x560dd0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ac038
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x680da0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x21c70], 2
jne 0x560e7c
lea esi, [edi + 0x21c58]
push esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 0
cmp dword [edi + 0x21c9c], 0
je 0x560e5a
cmp byte [0x683068], 0
je 0x560e5a
cmp dword [edi + 0x21ca0], 0x10
lea eax, [edi + 0x21c8c]
mov byte [0x683068], 0
jb 0x560e43
mov eax, dword [eax]
push 5
push 0
push 0x653f2c
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
movss xmm1, dword [0x655c58]
lea ecx, [edi + 0x21c4c]
movss xmm0, dword [0x655c48]
call fcn.00560b60
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x560fe0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ac06b
mov eax, dword fs:[0]
push eax
sub esp, 0xc14
mov eax, dword [0x680da0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push str.Starting_game_n
call fcn.00569640
inc dword [0x686ef8]
add esp, 4
push 6
push 0
mov dword [ebp - 4], 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
lea eax, [ebp - 0xc1c]
push eax
lea eax, [ebp - 0xc18]
push eax
push str.infestation.exe
call fcn.0056a630
add esp, 0xc
test al, al
jne 0x561060
push str.failed1_n
call fcn.00569640
add esp, 4
jmp 0x561079
push dword [ebp - 0xc1c]
push dword [ebp - 0xc18]
push str._08x__d_n
call fcn.00569640
add esp, 0xc
lea eax, [ebp - 0xc10]
push eax
lea ecx, [esi + 0x216ac]
call fcn.00568a20
lea eax, [ebp - 0xc10]
push eax
push 0x688050
lea eax, [ebp - 0x810]
push str._WOUpdatedOk__s__WOLogin___s_
push eax
call fcn.00561c40
add esp, 0x10
cmp dword [esi + 0x21cb4], 0
jbe 0x5610fd
lea ecx, [ebp - 0x810]
lea edx, [ecx + 1]
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x5610c0
sub ecx, edx
lea eax, [ebp - 0x810]
add eax, ecx
cmp dword [esi + 0x21cb8], 0x10
mov dword [ebp - 0xc14], eax
lea eax, [esi + 0x21ca4]
jb 0x5610e8
mov eax, dword [eax]
push eax
lea eax, [ebp - 0xc14]
push str.__survey___s_
push eax
call fcn.00561c80
add esp, 0xc
cmp dword [0x72da14], 0
jl 0x56114b
jg 0x561111
cmp dword [0x72da10], 0
jbe 0x56114b
lea ecx, [ebp - 0x810]
lea edx, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x561120
sub ecx, edx
lea eax, [ebp - 0x810]
add eax, ecx
mov dword [ebp - 0xc14], eax
lea eax, [ebp - 0xc14]
push str.__steam
push eax
call fcn.00561c80
add esp, 8
push 5
push 0
lea eax, [ebp - 0x810]
push eax
push str.infestation.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jge 0x56117b
push eax
push str.failed:__d_n
call fcn.00569640
add esp, 8
mov eax, dword [0x686ef8]
test eax, eax
je 0x56118a
dec eax
mov dword [0x686ef8], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0058e793
mov esp, ebp
pop ebp
ret
Function at 0x562260
Capabilities:
Set console window title

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x680da0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
call fcn.00567530
call fcn.00569a50
call fcn.00569090
call fcn.00569a50
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esi + 0x20d84], 3
jne 0x5622a7
mov dword [esi + 0x20d84], 5
cmp dword [esi + 0x20d88], 0
jne 0x562351
mov edi, dword [esi + 0x21590]
mov eax, edi
mov ebx, dword [esi + 0x21594]
or eax, ebx
jne 0x5622cb
xorps xmm1, xmm1
jmp 0x562311
mov edx, dword [esi + 0x2159c]
mov ecx, dword [esi + 0x21598]
call fcn.0059671f
cvtsd2ss xmm0, xmm0
mov edx, ebx
mov ecx, edi
movss dword [ebp - 0x20c], xmm0
call fcn.0059671f
movss xmm1, dword [ebp - 0x20c]
cvtsd2ss xmm0, xmm0
divss xmm1, xmm0
movss xmm0, dword [0x655c30]
comiss xmm1, xmm0
jbe 0x562311
movaps xmm1, xmm0
mulss xmm1, dword [0x655c4c]
lea eax, [esi + 0x20d8d]
sub esp, 8
cvtps2pd xmm0, xmm1
movsd qword [esp], xmm0
push eax
lea eax, [ebp - 0x208]
push str._s:__.1f__
push eax
call fcn.00561c60
add esp, 0x14
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
jmp 0x562282
mov ecx, esi
call fcn.005675f0
mov eax, dword [esi + 0x20d88]
dec eax
je 0x562395
dec eax
je 0x56237f
dec eax
je 0x5623a2
push 0
push 0x37
push str.Main_CmdLine.cpp
push 0x653ec8
call fcn.00569b10
add esp, 0x10
jmp 0x5623a2
lea eax, [esi + 0x2118d]
push eax
push str.Update_error_n_s_n_nPlease_retry_later
call fcn.00569640
add esp, 8
jmp 0x5623a2
push str.Update_ok_n
call fcn.00569640
add esp, 4
push str._nPress_enter_to_exit...
call fcn.00569640
add esp, 4
call fcn.00590543
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0058e793
mov esp, ebp
pop ebp
ret
Function at 0x562a60
Capabilities:
Copy file
Create process on windows
Delete file
Move file
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60c
mov eax, dword [0x680da0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x108]
push str..new.exe
push eax
call fcn.0058f510
add esp, 8
test eax, eax
jne 0x562ad7
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push str._s.new.exe
push eax
call fcn.0055d1c0
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0058e793
mov esp, ebp
pop ebp
ret
push edi
push str..exe_updated__moving_back_n
mov byte [0x72c052], 1
call fcn.00569640
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 4
push 0x1f4
call edi
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0058f02d
lea ecx, [ebp - 0x108]
add esp, 0xc
lea edx, [ecx + 1]
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x562b20
sub ecx, edx
cmp ecx, 8
ja 0x562b44
push 0
push 0x33
push str.SelfUpdateEXE.cpp
push str.strlen_exeMain____8
call fcn.00569b10
add esp, 0x10
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x562b50
sub ecx, edx
add ecx, 0xfffffff8
cmp ecx, 0x104
jae 0x562c61
push ebx
mov byte [ebp + ecx - 0x108], al
lea eax, [ebp - 0x108]
push esi
push eax
push str.exeMain:__s_n
call fcn.00569640
mov ebx, dword [sym.imp.KERNEL32.dll_CopyFileA]
add esp, 8
xor esi, esi
lea ecx, [ecx]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x562c4e
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
call ebx
test eax, eax
jne 0x562c4e
push 0x64
call edi
inc esi
cmp esi, 0xa
jl 0x562b90
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x60c]
push str.Failed_to_replace_updater_file_n_nPlease_manually_rename__s_to__s
push eax
call fcn.0055d1e0
add esp, 0x10
lea eax, [ebp - 0x60c]
push 0x30
push str.Updater
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 5
push 0
push 0
push 0x653f00
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
pop ebx
xor al, al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0058e793
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop esi
pop ebx
xor ecx, ebp
pop edi
call fcn.0058e793
mov esp, ebp
pop ebp
ret
call fcn.0058fb37
int3