joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401714
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
mov eax, dword [0x40a2a0]
push ebx
push ebp
mov ebp, dword [esp + 0x30]
push esi
xor esi, esi
mov ebx, ecx
push edi
mov dword [esp + 0x1c], ebx
mov dword [ebp], esi
sub eax, esi
je 0x40188b
dec eax
je 0x4017fc
dec eax
je 0x40179f
dec eax
je 0x40174c
xor eax, eax
inc eax
jmp 0x4018b1
mov edi, esi
mov ecx, dword [0x40a298]
lea eax, [esp + 0x20]
push eax
push 0x10
pop edx
test edi, edi
je 0x401762
mov ecx, eax
call fcn.004018bb
test eax, eax
jne 0x4018b1
mov ecx, edi
shl ecx, 4
add ecx, dword [esp + 0x34]
mov ebp, ebx
sub ebp, dword [esp + 0x34]
mov edx, esi
mov al, byte [ecx + ebp]
xor al, byte [esp + edx + 0x20]
inc edx
mov byte [ecx], al
inc ecx
cmp edx, 0x10
jb 0x401780
mov ebp, dword [esp + 0x38]
inc edi
cmp edi, 0x10
jb 0x40174e
jmp 0x4018a8
mov edi, esi
lea eax, [esp + 0x20]
push eax
push 0x10
pop edx
test edi, edi
jne 0x4017b5
mov ecx, dword [0x40a298]
jmp 0x4017bf
mov eax, edi
shl eax, 4
lea ecx, [ebx - 0x10]
add ecx, eax
call fcn.004018bb
test eax, eax
jne 0x4018b1
mov ecx, edi
shl ecx, 4
add ecx, dword [esp + 0x34]
mov ebp, ebx
sub ebp, dword [esp + 0x34]
mov edx, esi
mov al, byte [ecx + ebp]
xor al, byte [esp + edx + 0x20]
inc edx
mov byte [ecx], al
inc ecx
cmp edx, 0x10
jb 0x4017dd
mov ebp, dword [esp + 0x38]
inc edi
cmp edi, 0x10
jb 0x4017a1
jmp 0x4018a8
mov edi, esi
mov eax, edi
shl eax, 4
mov dword [esp + 0x10], eax
add eax, ebx
lea edx, [esp + 0x20]
mov ecx, eax
mov dword [esp + 0x14], eax
call fcn.00401915
test eax, eax
jne 0x4018b1
mov edx, dword [esp + 0x34]
mov ebx, dword [esp + 0x10]
mov ebp, esi
mov esi, dword [0x40a298]
mov eax, edx
lea ecx, [esp + 0x20]
sub esi, edx
sub eax, ecx
mov dword [esp + 0x18], eax
test edi, edi
jne 0x401858
lea ecx, [esp + 0x20]
add ecx, ebp
lea edx, [eax + ecx]
mov al, byte [edx + esi]
xor al, byte [ecx]
mov byte [edx], al
mov edx, dword [esp + 0x34]
jmp 0x40186a
mov eax, dword [esp + 0x14]
mov cl, byte [eax + ebp - 0x10]
xor cl, byte [esp + ebp + 0x20]
lea eax, [ebx + ebp]
mov byte [eax + edx], cl
mov eax, dword [esp + 0x18]
inc ebp
cmp ebp, 0x10
jb 0x40183e
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x38]
inc edi
push 0
pop esi
cmp edi, 0x10
jb 0x4017fe
jmp 0x4018a8
mov edi, dword [esp + 0x34]
sub edi, ebx
lea edx, [edi + ebx]
mov ecx, ebx
call fcn.00401915
test eax, eax
jne 0x4018b1
inc esi
add ebx, 0x10
cmp esi, 0x10
jb 0x401891
mov dword [ebp], 0x100
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 8

Function at 0x4023b7
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
xor edi, edi
movzx eax, byte [edi + ecx]
mov esi, edi
shl esi, 8
xor esi, eax
xor esi, edx
mov al, byte [esi + 0x403200]
mov byte [edi + ecx], al
inc edi
cmp edi, 0x10
jb 0x4023bb
pop edi
pop esi
ret

Function at 0x4023da
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x4023ee
sub ecx, edx
mov al, byte [ecx + edx]
xor byte [edx], al
inc edx
dec esi
jne 0x4023e5
pop esi
ret 4
Function at 0x4024e1
Capabilities:
Query or enumerate registry value
Terminate process

Disassembly:
sub esp, 0x18
lea eax, [esp + 4]
push ebx
push ebp
push esi
push edi
push eax
push 0x20019
xor ebx, ebx
push ebx
push str.SYSTEMCurrentControlSetServicesKMSServerServiceParameters
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebp, 0x40a428
test eax, eax
jne 0x4025e7
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0x10]
push eax
push 0x40a3a8
push ebx
push ebx
push str.Windows
push dword [esp + 0x28]
mov edi, 0x80
mov dword [esp + 0x28], edi
call esi
lea eax, [esp + 0x10]
push eax
push 0x40a2a8
push ebx
push ebx
push str.Office2010
push dword [esp + 0x28]
mov dword [esp + 0x28], edi
call esi
lea eax, [esp + 0x10]
push eax
push 0x40a328
push ebx
push ebx
push str.Office2013
push dword [esp + 0x28]
mov dword [esp + 0x28], edi
call esi
lea eax, [esp + 0x10]
push eax
push ebp
push ebx
push ebx
push str.Port
push dword [esp + 0x28]
mov dword [esp + 0x28], 0xc
call esi
push 4
pop edi
lea eax, [esp + 0x10]
push eax
push 0x40a438
push ebx
push ebx
push str.ActivatedMachines
push dword [esp + 0x28]
mov dword [esp + 0x28], edi
call esi
lea eax, [esp + 0x10]
push eax
push 0x40a434
push ebx
push ebx
push str.ActivationInterval
push dword [esp + 0x28]
mov dword [esp + 0x28], edi
call esi
lea eax, [esp + 0x10]
push eax
push 0x40a43c
push ebx
push ebx
push str.RenewalInterval
push dword [esp + 0x28]
mov dword [esp + 0x28], edi
call esi
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
call dword [sym.imp.msvcrt.dll__wtoi]
pop ecx
cmp eax, 1
jb 0x4025fb
cmp eax, 0xffff
jbe 0x402609
mov esi, str.1688
mov edi, 0x40a428
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov eax, dword [0x40a438]
push 0x32
pop ecx
cmp eax, 0x19
jb 0x40261a
cmp eax, ecx
jbe 0x402620
mov dword [0x40a438], ecx
mov eax, dword [0x40a434]
mov ecx, 0xa8c0
cmp eax, 0xf
jb 0x402633
cmp eax, ecx
jbe 0x40263d
mov dword [0x40a434], 0x78
mov eax, dword [0x40a43c]
cmp eax, 0xf
jb 0x40264b
cmp eax, ecx
jbe 0x402655
mov dword [0x40a43c], 0x2760
xor eax, eax
lea edi, [esp + 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], str.KMSServerService
mov dword [esp + 0x20], 0x4026c8
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x402a0a
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x33c
push ebx
push ebp
push esi
push edi
push 0x1ff
xor ebx, ebx
lea eax, [esp + 0x51]
mov ebp, ecx
push ebx
push eax
mov dword [esp + 0x24], edx
mov dword [esp + 0x20], ebp
call sub.msvcrt.dll_memset
mov eax, dword [ebp]
mov dword [esp + 0x58], eax
lea esi, [ebp + 4]
lea edi, [esp + 0x5c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
add esp, 0xc
movsd dword es:[edi], dword [esi]
lea esi, [ebp + 4]
push esi
push ecx
push 4
call fcn.00401107
mov edx, esi
call fcn.00402253
call fcn.00401238
lea ecx, [ebp + 0x14]
lea edx, [esp + 0x60]
call fcn.00402801
lea ebp, [esp + 0x60]
add ebp, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call dword [sym.imp.msvcrt.dll_srand]
pop ecx
push 0x10
pop edi
call dword [sym.imp.msvcrt.dll_rand]
and eax, 0x800000ff
jns 0x402a94
dec eax
or eax, 0xffffff00
inc eax
mov cl, byte [esi + ebx]
xor cl, byte [esp + ebx + 0x50]
mov byte [esp + ebx + 0x1c], al
xor cl, al
mov byte [ebx + ebp], cl
inc ebx
cmp ebx, edi
jl 0x402a80
add ebp, edi
push ebp
lea edx, [esp + 0x20]
mov ecx, edi
call fcn.00402bc3
add ebp, 0x28
mov dword [ebp - 8], 0x8863d35f
mov dword [ebp - 4], 0x364f463a
lea edx, [esp + 0x24c]
lea edi, [esp + 0x4c]
sub edi, dword [esp + 0x14]
mov ebx, ebp
mov eax, edx
push 0x10
mov dword [esp + 0x14], ebp
sub ebx, eax
pop ebp
movzx ecx, byte [edi + esi]
movzx eax, byte [esi]
xor ecx, eax
mov byte [ebx + edx], cl
inc esi
mov byte [edx], cl
inc edx
dec ebp
jne 0x402ae4
mov ebp, dword [esp + 0x10]
add ebp, 0x10
lea eax, [esp + 0x60]
mov esi, ebp
sub esi, eax
push esi
push eax
lea eax, [esp + 0x264]
push eax
call sub.msvcrt.dll_memcpy
mov ecx, dword [esp + 0x20]
add esp, 0xc
lea ecx, [ecx + 0x68]
mov edx, 0x40a240
call fcn.00402c62
lea eax, [esp + 0x2c]
push eax
lea ecx, [esi + 0x10]
lea edx, [esp + 0x250]
call fcn.00402cb6
push 0x10
pop ecx
mov edi, ebp
add ebp, ecx
lea eax, [esp + 0x60]
lea esi, [esp + 0x3c]
movsd dword es:[edi], dword [esi]
mov ebx, ebp
sub ebx, eax
mov al, bl
not al
movsd dword es:[edi], dword [esi]
inc al
and al, 0xf
movsd dword es:[edi], dword [esi]
movzx eax, al
cmove eax, ecx
movsd dword es:[edi], dword [esi]
movzx esi, al
push esi
push esi
push ebp
mov byte [esp + 0x1c], al
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [esp + 0x50]
push eax
push ecx
push dword [esp + 0x18]
add ebx, esi
call fcn.00401107
lea edx, [esp + 0x60]
mov ecx, ebx
call fcn.0040228c
call fcn.00401238
mov edi, dword [esp + 0x18]
lea eax, [ebx + 0x14]
push eax
mov dword [edi], eax
call fcn.00402e02
push dword [edi]
mov esi, eax
lea eax, [esp + 0x50]
push eax
push esi
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x33c
ret
Function at 0x402bc3
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push 0xf0000000
xor ebx, ebx
push 0x18
push ebx
push ebx
lea eax, [ebp - 8]
push eax
mov esi, edx
mov edi, ecx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], 0x20
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x402c3a
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push 0x800c
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x402c3a
push ebx
push edi
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x402c3a
push ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
push 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x402c3a
xor esi, esi
inc esi
jmp 0x402c3c
mov esi, ebx
cmp dword [ebp - 4], ebx
je 0x402c4a
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
cmp dword [ebp - 8], ebx
je 0x402c59
push ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4

Function at 0x402cb6
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
push edi
xor eax, eax
lea edi, [esp + 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0xf0000000
xor ebp, ebp
stosd dword es:[edi], eax
push 0x18
push ebp
stosd dword es:[edi], eax
push ebp
lea eax, [esp + 0x24]
push eax
mov esi, edx
mov ebx, ecx
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x30], 0x20
mov dword [esp + 0x34], 0x800c
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x402d80
lea eax, [esp + 0x18]
push eax
push ebp
push ebp
push 0x1c
push 0x40a234
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x402d80
lea eax, [esp + 0x10]
push eax
push ebp
push dword [esp + 0x20]
push 0x8009
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x402d80
push ebp
lea eax, [esp + 0x24]
push eax
push 5
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptSetHashParam]
test eax, eax
je 0x402d80
push ebp
push ebx
push esi
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x402d80
push ebp
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x40]
push 2
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x402d80
xor esi, esi
inc esi
jmp 0x402d82
mov esi, ebp
cmp dword [esp + 0x18], ebp
je 0x402d92
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
cmp dword [esp + 0x10], ebp
je 0x402da2
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
cmp dword [esp + 0x14], ebp
je 0x402db3
push ebp
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 4
Function at 0x4059cc
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ebx
and eax, 4
push edi
mov dword [ebp - 4], eax
call fcn.00405c97
test bl, 8
mov dword [ebp - 8], eax
je 0x405a0b
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
inc eax
add dword [0x47af88], eax
jmp 0x405b88
mov dword [ebp + 8], ebx
and dword [ebp + 8], 1
je 0x405a25
test eax, eax
je 0x405b36
test bl, 2
je 0x405b36
mov esi, 0x460250
push edi
push esi
call fcn.004062ba
cmp dword [ebp + 8], 0
je 0x405a44
push 0x40a54c
push esi
call sub.KERNEL32.dll_lstrcatW
jmp 0x405a4a
push edi
call fcn.00405bdb
cmp word [edi], 0
jne 0x405a5a
cmp word [0x460250], 0x5c
jne 0x405a65
push 0x40a014
push edi
call sub.KERNEL32.dll_lstrcatW
push edi
call sub.KERNEL32.dll_lstrlenW
lea ebx, [edi + eax*2]
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405b2b
cmp word [ebp - 0x22c], 0x2e
jne 0x405aaf
cmp word [ebp - 0x22a], 0
je 0x405b0e
cmp word [ebp - 0x22a], 0x2e
jne 0x405aaf
cmp word [ebp - 0x228], 0
je 0x405b0e
lea eax, [ebp - 0x22c]
push eax
push ebx
call fcn.004062ba
test byte [ebp - 0x258], 0x10
je 0x405ada
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405b0e
push dword [ebp + 0xc]
push edi
call fcn.004059cc
jmp 0x405b0e
push dword [ebp - 4]
push edi
call fcn.00405984
test eax, eax
jne 0x405b06
cmp dword [ebp - 4], eax
je 0x405afe
push edi
push 0xfffffffffffffff1
call fcn.00405322
push 0
push edi
call fcn.00406080
jmp 0x405b0e
inc dword [0x47af88]
jmp 0x405b0e
push edi
push 0xfffffffffffffff2
call fcn.00405322
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x405a87
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x405b36
and word [ebx - 2], 0
xor esi, esi
cmp dword [ebp + 8], esi
je 0x405b88
cmp dword [ebp - 8], esi
jne 0x405b4a
inc dword [0x47af88]
jmp 0x405b88
push edi
call fcn.004065fd
test eax, eax
je 0x405b88
push edi
call fcn.00405b8f
mov eax, dword [ebp - 4]
or al, 1
push eax
push edi
call fcn.00405984
test eax, eax
jne 0x405b80
cmp dword [ebp - 4], esi
je 0x405b42
push edi
push 0xfffffffffffffff1
call fcn.00405322
push esi
push edi
call fcn.00406080
jmp 0x405b88
push edi
push 0xffffffffffffffe5
call fcn.00405322
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x401110
Capabilities:
Access firewall settings via inetfwmgr

Disassembly:
push esi
push 2
push 0
mov esi, eax
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jge 0x401128
cmp eax, 0x80010106
jne 0x4011a6
push edi
push esi
push 0x6637cc
push 1
push 0
push 0x6637bc
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
test edi, edi
jge 0x401157
push edi
push str.CoCreateInstance_NetFwMgr_failed:_0x_08lx_n
call fcn.00569d40
add esp, 8
mov eax, edi
pop edi
pop esi
ret
mov eax, dword [esi]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1c]
push ebx
lea edi, [esi + 4]
push edi
push eax
call edx
mov ebx, eax
test ebx, ebx
jge 0x401180
push ebx
push str.get_LocalPolicy_failed:_0x_08lx_n
call fcn.00569d40
add esp, 8
mov eax, ebx
pop ebx
pop edi
pop esi
ret
mov eax, dword [edi]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1c]
add esi, 8
push esi
push eax
call edx
mov esi, eax
test esi, esi
jge 0x4011a4
push esi
push str.get_CurrentProfile_failed:_0x_08lx_n
call fcn.00569d40
mov eax, esi
add esp, 8
pop ebx
pop edi
pop esi
ret

Function at 0x4014a0
Capabilities:
Access firewall policy via inetfwpolicy2

Disassembly:
push esi
push 2
push 0
mov esi, eax
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jge 0x4014b8
cmp eax, 0x80010106
jne 0x40150c
push edi
push esi
push 0x66380c
push 1
push 0
push 0x6637fc
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
test edi, edi
jge 0x4014e7
push edi
push str.CoCreateInstance_NetFwPolicy2_failed:_0x_08lx_n
call fcn.00569d40
add esp, 8
mov eax, edi
pop edi
pop esi
ret
mov eax, dword [esi]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x48]
add esi, 4
push esi
push eax
call edx
mov esi, eax
test esi, esi
jge 0x40150b
push esi
push str.get_Rules_failed:_0x_08lx_n
call fcn.00569d40
mov eax, esi
add esp, 8
pop edi
pop esi
ret
Function at 0x401590
Capabilities:
Access firewall rule properties via inetfwrule

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
cmp dword [esi + 4], 0
jne 0x4015a6
mov eax, 0x80004001
pop esi
pop ecx
ret 0xc
push ebx
push ebp
push edi
push str.DT_WARZ
call fcn.00401050
mov edi, eax
mov eax, dword [esp + 0x20]
push eax
call fcn.00401050
mov ecx, dword [esp + 0x28]
push ecx
mov ebp, eax
call fcn.00401050
mov dword [esp + 0x28], eax
add esp, 0xc
lea ebx, [esp + 0x20]
mov eax, esi
mov dword [esp + 0x10], 0
call fcn.00401510
mov esi, eax
test esi, esi
jge 0x401603
push esi
push str.IsAppEnabled_failed:_0x_08lx_n
call fcn.00569d40
add esp, 8
pop edi
pop ebp
pop ebx
mov eax, esi
pop esi
pop ecx
ret 0xc
cmp dword [esp + 0x20], 0
je 0x401614
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
pop ecx
ret 0xc
lea edx, [esp + 0x10]
push edx
push 0x66382c
push 1
push 0
push 0x66381c
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
jge 0x40163e
push esi
push str.CoCreateInstance_NetFwRule_failed:_0x_08lx_n
jmp 0x4016cd
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x20]
push edi
push eax
call edx
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x1c]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x28]
call eax
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x30]
push ebp
push eax
call edx
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x40]
push 0x100
push eax
call edx
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x98]
push 6
push eax
call edx
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xa8]
push 1
push eax
call edx
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x88]
push 0xffffffffffffffff
push eax
call edx
mov eax, dword [esp + 0x18]
mov eax, dword [eax + 4]
mov edx, dword [esp + 0x10]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x20]
call eax
mov esi, eax
test esi, esi
jge 0x4016d5
push esi
push str.Firewall_Rule_Add_failed:_0x_08lx_n
call fcn.00569d40
add esp, 8
push edi
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call edi
push ebp
call edi
mov ecx, dword [esp + 0x1c]
push ecx
call edi
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4016f8
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
pop edi
pop ebp
pop ebx
mov eax, esi
pop esi
pop ecx
ret 0xc
Function at 0x401910
Capabilities:
Copy file

Disassembly:
sub esp, 0x614
mov eax, dword [0x690dfc]
xor eax, esp
mov dword [esp + 0x610], eax
push esi
push edi
push 0x104
lea eax, [esp + 0x118]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x114]
push 0x5c
push ecx
call fcn.00590150
mov esi, eax
inc esi
add esp, 8
cmp esi, 1
jne 0x40196b
push 0
push 0x14
push str..GenerateUpdaterXML.cpp
push str._DWORD_fname___1
call fcn.0056a050
add esp, 0x10
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x11c]
push ecx
call fcn.0056a9f0
add esp, 0xc
test al, al
jne 0x40199e
lea edx, [esp + 0x114]
push edx
push str.failed_to_get_crc_for__s_n
call fcn.00569f10
add esp, 8
push str.1.0.0
push esi
lea eax, [esp + 0x18]
push str._s__s.exe
push eax
call fcn.00401aa0
add esp, 0x10
push 0
lea ecx, [esp + 0x14]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x4019db
lea edx, [esp + 0x10]
push edx
push esi
push str.unable_to_copy__s___s_n
call fcn.00569f10
add esp, 0xc
push 0x2f
push str.http:__147.50.252.10_WARZ3000_launcher_wzupd.xml
call fcn.00590150
mov esi, eax
add esp, 8
test esi, esi
jne 0x401a05
push eax
push 0x21
push str..GenerateUpdaterXML.cpp
push str.updater_file
call fcn.0056a050
add esp, 0x10
lea edi, [esi + 1]
push 0x6638bc
push edi
call fcn.0056af00
mov esi, eax
push 0x6638c0
push esi
call fcn.0059017d
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
push eax
push str.1.0.0
push ecx
lea edx, [esp + 0x2c]
push edx
push str.http:__147.50.252.10_WARZ3000_launcher_
push str.__u_url__s_s__crc__u__ver__s__size__u____n
push esi
call fcn.0059017d
push 0x6638f8
push esi
call fcn.0059017d
push esi
call fcn.00590310
lea eax, [esp + 0x48]
push eax
push edi
lea ecx, [esp + 0x258]
push str.XML__s_generated_nnew_exe:_s
push ecx
call fcn.00401ac0
add esp, 0x48
push 0
push str.Updater_XML
lea edx, [esp + 0x220]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x618]
pop edi
pop esi
xor ecx, esp
call fcn.0058fe87
add esp, 0x614
ret
Function at 0x4021c0
Capabilities:
Get cpu information
Get memory capacity
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c
push ebx
push esi
push edi
mov esi, eax
call fcn.004022a0
mov eax, esi
call fcn.00402310
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402220
lea ecx, [esp + 0x10]
push ecx
lea edx, [esi + 0x88]
push edx
push eax
push eax
mov eax, dword [esp + 0x24]
push str.MHz
push eax
mov dword [esp + 0x28], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x1c], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
push 0
shrd edx, eax, 0xa
push 0
push 0
push str.DISPLAY
shr eax, 0xa
mov dword [esi + 0x8c], edx
call dword [sym.imp.GDI32.dll_CreateICA]
mov ebx, dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov edi, eax
push 8
push edi
call ebx
push 0xa
push edi
mov dword [esi + 0x90], eax
call ebx
push edi
mov dword [esi + 0x94], eax
call dword [sym.imp.GDI32.dll_DeleteDC]
call fcn.004025b0
mov ebx, esi
call fcn.00402480
call fcn.00402750
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402bb0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
lea eax, [esp]
push eax
push 0xf003f
push 0
push str.SoftwareArktos_Entertainment_GroupWarZ
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x402bd8
mov al, 1
add esp, 0x10
ret
mov eax, dword [esp]
push esi
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x10]
push edx
push 0
push 0
push str.UpdaterTime1
push eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x20], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 4]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x402c4a
push esi
call fcn.00590675
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
add esp, 4
add esi, 0x2a300
adc ecx, 0
cmp edx, ecx
jg 0x402c4a
jl 0x402c43
cmp eax, esi
jae 0x402c4a
xor al, al
pop esi
add esp, 0x10
ret
mov al, 1
pop esi
add esp, 0x10
ret