joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402f70
Capabilities:
Inspect load icon resource
Terminate process

Disassembly:
mov eax, dword [0x6fdf28]
push 5
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
push str._generate
push 0x6fd5f0
mov dword [0x6fdf30], eax
mov dword [0x6f5bf8], 0
call fcn.005d0d90
add esp, 8
test eax, eax
je 0x402fb8
call fcn.00401910
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
ret
call fcn.00402d50
test al, al
jne 0x402fa8
call fcn.00402de0
call fcn.00402eb0
test al, al
jne 0x402ff3
push 0x40
push str.UAC_problem
push str.Updater_must_be_run_from_administrator
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
ret
call fcn.004073f0
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0x7a29f8
push 0x6c7ea8
push 0x17
push 0
push 0x6a084c
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jge 0x403027
mov dword [0x7a29f8], 0
push str._cmdLine
push 0x6fd5f0
call fcn.005d0d90
add esp, 8
test eax, eax
je 0x403044
mov byte [0x7a29f4], 1
push esi
mov esi, dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f00
push 0
call esi
push 0x7f89
push 0
mov dword [0x7a2958], eax
call esi
push 0x209
push 0x7a2a90
push 0x12f
push 0
mov dword [0x7a2954], eax
call dword [sym.imp.USER32.dll_LoadStringW]
pop esi
ret
Function at 0x403c20
Capabilities:
Hide graphical window
Inspect load icon resource

Disassembly:
push 0xffffffffffffffff
push 0x61f45e
mov eax, dword fs:[0]
push eax
sub esp, 0x208
mov eax, dword [0x6f6dfc]
xor eax, esp
mov dword [esp + 0x204], eax
push ebx
push esi
push edi
mov eax, dword [0x6f6dfc]
xor eax, esp
push eax
lea eax, [esp + 0x218]
mov dword fs:[0], eax
cmp byte [0x7a29f4], 0
je 0x403ca8
call dword [sym.imp.KERNEL32.dll_AllocConsole]
call fcn.005d1475
add eax, 0x20
push eax
push 0x6c7f54
push 0x6c8268
call fcn.005d144f
call fcn.005d1475
push eax
push 0x6c8270
push str.CONIN_
call fcn.005d144f
add esp, 0x18
mov dword [0x6fdfa8], 1
jmp 0x403e22
mov eax, 0x7a3520
call fcn.004021c0
mov eax, dword [0x6fdf28]
push 5
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov ecx, dword [0x6fdf2c]
push eax
push 0
push 0x80
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edx, dword [0x6fdf2c]
push 0x800000
push 0
push edx
call fcn.005a9730
mov eax, dword [0x6fdf2c]
push 0xc00000
push 0
push eax
call fcn.005a9730
mov ecx, dword [0x6fdf2c]
add esp, 0x18
push 0x403a90
push 0xfffffffffffffffc
push ecx
call dword [sym.imp.USER32.dll_SetWindowLongA]
call fcn.005b3e90
push 0
push 0
push 0
push str.DISPLAY
call dword [sym.imp.GDI32.dll_CreateICA]
mov edi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov esi, eax
push 8
push esi
call edi
push 0xa
push esi
mov ebx, eax
call edi
mov esi, eax
lea eax, [ebx - 0x311]
cdq
sub eax, edx
mov ecx, eax
push 0
lea eax, [esi - 0x28a]
cdq
push 0x28a
sub eax, edx
mov edx, dword [0x6fdf2c]
push 0x311
sar eax, 1
push eax
sar ecx, 1
push ecx
push 0
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0x102660
call fcn.005abf40
add esp, 4
mov dword [esp + 0x10], eax
mov dword [esp + 0x220], 0
test eax, eax
je 0x403d9b
mov ecx, eax
call fcn.005b1820
jmp 0x403d9d
xor eax, eax
mov dword [esp + 0x220], 0xffffffff
mov ecx, dword [0x6fdf2c]
push 0
push ecx
mov ecx, eax
mov dword [0x6fdf94], eax
call fcn.005ad0b0
call fcn.00403080
push str.Oct_27_2024_22:00:22
push str.1.7.1
lea edx, [esp + 0x1c]
push str.RKS_STUDIO__s___s_
push edx
call fcn.004068b0
mov ecx, dword [0x6fdf2c]
add esp, 0x10
lea eax, [esp + 0x14]
push eax
push ecx
call dword [sym.imp.USER32.dll_SetWindowTextA]
call fcn.00403460
mov edx, dword [0x6fdf2c]
push 5
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
call dword [sym.imp.USER32.dll_ClipCursor]
mov ecx, dword [0x6fdf9c]
call fcn.005b7660
mov ecx, dword [0x6fdf98]
call fcn.005b78a0
mov ecx, dword [esp + 0x218]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x204]
xor ecx, esp
call fcn.005d0167
add esp, 0x214
ret
Function at 0x405780
Capabilities:
Create process on windows

Disassembly:
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
mov eax, 0x30c30c31
imul ecx
sub esp, 0x30
sar edx, 4
push ebx
mov eax, edx
shr eax, 0x1f
push ebp
xor ebx, ebx
add eax, edx
push edi
je 0x4059af
xor edi, edi
mov dword [esp + 0xc], edi
jmp 0x4057b4
mov edi, dword [esp + 0xc]
cmp edi, 0x1a4
jae 0x4059af
cmp ebx, eax
jb 0x4057c9
call fcn.005d1366
mov eax, dword [esi + 0xc]
lea eax, [edi + eax + 0x38]
mov ebp, 0x10
cmp dword [eax + 0x18], ebp
jb 0x4057df
mov eax, dword [eax + 4]
jmp 0x4057e2
add eax, 4
fld dword [esp + 0x44]
mov edx, dword [0x7a2a74]
push eax
lea ecx, [esp + 0x20]
push ecx
sub esp, 8
fstp dword [esp + 4]
mov dword [esp + 0x2c], 0xfff3b656
fld dword [esp + 0x50]
fadd qword [0x6ca7c0]
fstp dword [esp + 0x28]
fld dword [esp + 0x28]
fstp dword [esp]
push edx
call fcn.005b3880
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
mov eax, 0x30c30c31
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
add esp, 0x14
cmp ebx, eax
jb 0x40583f
call fcn.005d1366
mov eax, dword [esi + 0xc]
add eax, edi
cmp dword [eax + 0x18], ebp
jb 0x40584e
mov ebp, dword [eax + 4]
jmp 0x405851
lea ebp, [eax + 4]
mov edi, dword [0x7a2a74]
push ebp
call fcn.00403ec0
fld dword [esp + 0x44]
fstp dword [esp + 0x2c]
mov dword [esp + 0x24], eax
fld dword [esp + 0x48]
mov dword [esp + 0x28], edx
fstp dword [esp + 0x30]
add esp, 4
fild dword [esp + 0x20]
lea ecx, [esp + 0x28]
mov dword [esp + 0x10], 0xffffffff
fstp dword [esp + 0x14]
fld dword [esp + 0x14]
fstp dword [esp + 0x30]
fild dword [esp + 0x24]
fstp dword [esp + 0x18]
fld dword [esp + 0x18]
fstp dword [esp + 0x34]
call fcn.00402ce0
test al, al
je 0x405950
fld1
push 0
push 0
lea ecx, [esp + 0x18]
push ecx
sub esp, 0x10
fstp dword [esp + 0xc]
mov dword [esp + 0x2c], 0xffffd800
fld dword [esp + 0x30]
fstp dword [esp + 8]
fld dword [esp + 0x34]
fadd dword [esp + 0x60]
fstp dword [esp + 0x34]
fld dword [esp + 0x34]
fstp dword [esp + 4]
fld dword [esp + 0x5c]
fstp dword [esp]
call fcn.005b7a00
add esp, 0x1c
cmp dword [0x7a2a88], 0
je 0x405950
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
mov eax, 0x30c30c31
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebx, eax
jb 0x40591f
call fcn.005d1366
mov ecx, dword [esi + 0xc]
mov edx, dword [esp + 0xc]
cmp dword [edx + ecx + 0x34], 0x10
lea eax, [edx + ecx + 0x1c]
jb 0x405936
mov eax, dword [eax + 4]
jmp 0x405939
add eax, 4
push 5
push 0
push 0x6c8266
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
fld dword [esp + 0x44]
mov ecx, dword [0x7a2a74]
push ebp
push 0x6c272c
lea eax, [esp + 0x18]
push eax
sub esp, 8
fstp dword [esp + 4]
fld dword [esp + 0x54]
fstp dword [esp]
push ecx
call fcn.005b3880
fld dword [esp + 0x5c]
mov ecx, dword [esi + 0x10]
fadd qword [0x6ca7b8]
sub ecx, dword [esi + 0xc]
add dword [esp + 0x24], 0x54
mov eax, 0x30c30c31
fstp dword [esp + 0x5c]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
inc ebx
add eax, edx
add esp, 0x18
cmp ebx, eax
jb 0x4057b0
pop edi
pop ebp
pop ebx
add esp, 0x30
ret
Function at 0x405ca0
Capabilities:
Set registry value

Disassembly:
push ecx
push 0
lea eax, [esp + 4]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareArktos_Entertainment_GroupWarZ
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x405ccd
xor al, al
pop ecx
ret
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x405cd2
mov ecx, dword [esp]
sub eax, edx
inc eax
push eax
push esi
push 1
push 0
push str.LoginToken
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x405cc9
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
pop ecx
ret

Function at 0x405d10
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x61eedb
mov eax, dword fs:[0]
push eax
sub esp, 0xc14
mov eax, dword [0x6f6dfc]
xor eax, esp
mov dword [esp + 0xc10], eax
push ebx
push esi
push edi
mov eax, dword [0x6f6dfc]
xor eax, esp
push eax
lea eax, [esp + 0xc24]
mov dword fs:[0], eax
push str.Starting_game_n
mov ebx, ecx
call fcn.005a9f90
inc dword [0x6fdfc0]
add esp, 4
push 6
push 0
mov dword [esp + 0xc34], 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x20]
push ecx
push str.ExEWarZ.exe
call fcn.005aace0
add esp, 0xc
test al, al
jne 0x405d9e
push str.failed1_n
call fcn.005a9f90
add esp, 4
jmp 0x405db5
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
push edx
push eax
push str._08x__d_n
call fcn.005a9f90
add esp, 0xc
lea ecx, [ebx + 0x21714]
push ecx
lea edi, [esp + 0x24]
call fcn.0040e3e0
mov esi, edi
call fcn.00405ca0
test al, al
je 0x405df6
push 0xffffffffffffffff
call fcn.005b7fe0
add esp, 4
push eax
push 0xffffffffffffffff
call fcn.005b7fe0
add esp, 4
push eax
mov edx, edi
push str._08X_08X
push edx
call fcn.00401ac0
add esp, 0x10
lea eax, [esp + 0x20]
push eax
push 0x6fd5f0
lea ecx, [esp + 0x428]
push str._WOUpdatedOk__s__WOLogin___s_
push ecx
call fcn.00406890
add esp, 0x10
cmp dword [ebx + 0x21db8], 0
jbe 0x405e66
lea eax, [esp + 0x420]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x405e28
sub eax, edx
cmp dword [ebx + 0x21dbc], 0x10
lea edx, [esp + eax + 0x420]
mov dword [esp + 0x14], edx
jb 0x405e4d
mov ebx, dword [ebx + 0x21da8]
jmp 0x405e53
add ebx, 0x21da8
push ebx
lea eax, [esp + 0x18]
push str.__survey___s_
push eax
call fcn.0040e520
add esp, 0xc
cmp dword [0x7a4754], 0
jl 0x405eaa
jg 0x405e7a
cmp dword [0x7a4750], 0
jbe 0x405eaa
lea eax, [esp + 0x420]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x405e84
sub eax, edx
lea edx, [esp + 0x14]
lea ecx, [esp + eax + 0x420]
push str.__steam
push edx
mov dword [esp + 0x1c], ecx
call fcn.0040e520
add esp, 8
push 5
push 0
lea eax, [esp + 0x428]
push eax
push str.ExEWarZ.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jge 0x405edb
push eax
push str.failed:__d_n
call fcn.005a9f90
add esp, 8
cmp dword [0x6fdfc0], 0
je 0x405eea
dec dword [0x6fdfc0]
mov ecx, dword [esp + 0xc24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc10]
xor ecx, esp
call fcn.005d0167
add esp, 0xc20
ret
Function at 0x406e30
Capabilities:
Set console window title

Disassembly:
sub esp, 0x218
mov eax, dword [0x6f6dfc]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
push esi
push edi
mov esi, ecx
call fcn.0040bad0
call fcn.005a9cd0
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
nop
call fcn.005a9d20
call fcn.005a9cd0
push 0x64
call edi
cmp dword [esi + 0x20dec], 3
jne 0x406e81
mov dword [esi + 0x20dec], 5
cmp dword [esi + 0x20df0], 0
jne 0x406f08
mov eax, dword [esi + 0x215f8]
mov ecx, dword [esi + 0x215fc]
mov dword [esp + 0x10], eax
or eax, ecx
mov dword [esp + 0x14], ecx
jne 0x406ea6
fldz
jmp 0x406ecf
fild qword [esi + 0x21600]
fild qword [esp + 0x10]
fdivp st(1)
fstp dword [esp + 0xc]
fld1
fcom dword [esp + 0xc]
fnstsw ax
test ah, 5
jp 0x406ec9
fstp dword [esp + 0xc]
jmp 0x406ecb
fstp st(0)
fld dword [esp + 0xc]
fstp dword [esp + 0xc]
sub esp, 8
fld dword [esp + 0x14]
lea eax, [esi + 0x20df5]
fmul qword [0x6ca850]
lea ecx, [esp + 0x20]
fstp qword [esp]
push eax
push str._s:__.1f__
push ecx
call fcn.004068b0
add esp, 0x14
lea edx, [esp + 0x18]
push edx
call ebx
jmp 0x406e60
mov eax, esi
call fcn.0040bc00
mov eax, dword [esi + 0x20df0]
sub eax, 1
je 0x406f52
sub eax, 1
je 0x406f3c
sub eax, 1
je 0x406f5f
push 0
push 0x37
push str..Main_CmdLine.cpp
push 0x6c8264
call fcn.005aa2a0
add esp, 0x10
jmp 0x406f5f
add esi, 0x211f5
push esi
push str.Update_error_n_s_n_nPlease_retry_later
call fcn.005a9f90
add esp, 8
jmp 0x406f5f
push str.Update_ok_n
call fcn.005a9f90
add esp, 4
push str._nPress_enter_to_exit...
call fcn.005a9f90
add esp, 4
call fcn.005d1637
mov ecx, dword [esp + 0x21c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005d0167
add esp, 0x218
ret
Function at 0x4073f0
Capabilities:
Copy file
Create process on windows
Delete file
Move file
Terminate process

Disassembly:
sub esp, 0x60c
mov eax, dword [0x6f6dfc]
xor eax, esp
mov dword [esp + 0x608], eax
push 0x104
lea eax, [esp + 4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp]
push str..new.exe
push ecx
call fcn.005d0d90
add esp, 8
test eax, eax
jne 0x407469
lea edx, [esp]
push edx
lea eax, [esp + 0x108]
push str._s.new.exe
push eax
call fcn.00401aa0
add esp, 0xc
lea ecx, [esp + 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor al, al
mov ecx, dword [esp + 0x608]
xor ecx, esp
call fcn.005d0167
add esp, 0x60c
ret
push str..exe_updated__moving_back_n
mov byte [0x7a2ea2], 1
call fcn.005a9f90
add esp, 4
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
lea ebx, [ebx]
mov cl, byte [esp + eax]
mov byte [esp + eax + 0x104], cl
inc eax
test cl, cl
jne 0x407490
lea eax, [esp]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4074a5
sub eax, edx
cmp eax, 8
ja 0x4074c9
push 0
push 0x31
push str..SelfUpdateEXE.cpp
push str.strlen_exeMain____8
call fcn.005aa2a0
add esp, 0x10
lea eax, [esp]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4074d0
push ebx
push ebp
push esi
sub eax, edx
push edi
lea edx, [esp + 0x10]
push edx
push str.exeMain:__s_n
mov byte [esp + eax + 0x10], cl
call fcn.005a9f90
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileA]
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
add esp, 8
xor esi, esi
lea eax, [esp + 0x10]
push eax
call edi
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x118]
push edx
call ebx
test eax, eax
jne 0x4075ab
push eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x11c]
push ecx
call ebp
test eax, eax
jne 0x4075ab
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0xa
jl 0x407507
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x118]
push eax
lea ecx, [esp + 0x220]
push str.Failed_to_replace_updater_file_n_nPlease_manually_rename__s_to__s
push ecx
call fcn.00401ac0
add esp, 0x10
push 0x30
push str.Updater
lea edx, [esp + 0x220]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 5
push 0
push 0
push 0x6c8044
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor al, al
jmp 0x4075ad
mov al, 1
mov ecx, dword [esp + 0x618]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005d0167
add esp, 0x60c
ret
Function at 0x4075d0
Capabilities:
Create process on windows
Terminate process
Write and execute a file
Write file on windows

Disassembly:
sub esp, 0x20c
mov eax, dword [0x6f6dfc]
xor eax, esp
mov dword [esp + 0x208], eax
push esi
push 0x104
lea eax, [esp + 0x10c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push str.Trying_to_update_n
call fcn.005a9f90
lea ecx, [esp + 0x10c]
push ecx
lea edx, [esp + 0xc]
push str._s.new.exe
push edx
call fcn.00401aa0
lea eax, [esp + 0x14]
push 0x6c7f54
push eax
call fcn.005d0d30
mov esi, eax
add esp, 0x18
test esi, esi
jne 0x407645
lea ecx, [esp + 4]
push ecx
push str.cant_open__s_for_writing_n
call fcn.005aa160
add esp, 8
mov edx, dword [esp + 0x214]
push esi
push 1
push edx
push edi
call fcn.005d179e
push esi
call fcn.005d05f0
mov eax, dword [0x7a29fc]
add esp, 0x14
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 4]
push ecx
push str.executing__s_n
call fcn.005a9f90
add esp, 8
push 5
push 0
push 0x6fd5f0
lea edx, [esp + 0x10]
push edx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
pop esi
jge 0x4076b1
push eax
lea eax, [esp + 4]
push eax
push str.failed_to_launch__s___d
call fcn.005aa160
add esp, 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [esp + 0x208]
xor ecx, esp
mov al, 1
call fcn.005d0167
add esp, 0x20c
ret
Function at 0x4079e0
Capabilities:
Extract resource via kernel32 functions
Set file attributes
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x61ed08
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x6f6dfc]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
lea ecx, [esp + 0x14]
call fcn.0044eea0
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], 0
call fcn.0044f030
push 0x6c8650
push 0xc8
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x407aef
push edi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x407aef
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push esi
lea ecx, [esp + 0x1c]
call fcn.0044f1f0
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
push 0x6c84d8
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
call fcn.005aace0
add esp, 0xc
lea ecx, [esp + 0x14]
call fcn.0044f060
push eax
lea ecx, [esp + 0x18]
call fcn.0044f090
push eax
call fcn.005aa990
add esp, 8
cmp dword [esp + 0xc], eax
je 0x407b2a
push 0x80
push 0x6c84d8
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x6c7f54
push 0x6c84d8
call fcn.005d0d30
mov esi, eax
add esp, 8
test esi, esi
jne 0x407b05
push 0x10
push str.Warning
push str.Can_not_update_steam_api.dll
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x407b2a
push 0x10
push str.Warning
push str.No_steam_api.dll_resource
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x407b2a
push esi
lea ecx, [esp + 0x18]
call fcn.0044f060
push eax
push 1
lea ecx, [esp + 0x20]
call fcn.0044f090
push eax
call fcn.005d179e
push esi
call fcn.005d05f0
add esp, 0x14
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], 0xffffffff
call fcn.0044ef50
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x28
ret
Function at 0x407cd0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x61ee88
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push ebx
push edi
mov eax, dword [0x6f6dfc]
xor eax, esp
push eax
lea eax, [esp + 0x4c]
mov dword fs:[0], eax
fldz
lea ecx, [esp + 0x14]
fst dword [esi]
mov dword [esi + 8], 0
fstp dword [esi + 4]
call fcn.0044eea0
lea ecx, [esp + 0x14]
mov dword [esp + 0x54], 0
call fcn.0044f030
movzx eax, word [esp + 0x5c]
push 0x6c876c
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x407e0d
push edi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x407e0d
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push ebx
lea ecx, [esp + 0x1c]
call fcn.0044f1f0
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x18]
call fcn.0044f060
push eax
lea ecx, [esp + 0x1c]
call fcn.0044f090
mov ecx, dword [0x6fdf94]
push eax
add ecx, 0x50
call fcn.005acb60
push eax
call sub.d3dx9_43.dll_D3DXCreateTextureFromFileInMemory
test eax, eax
jne 0x407e0d
mov ecx, dword [0x6fdf94]
call fcn.005bc560
push 1
push 1
push 0x16
push 4
push 4
mov ecx, eax
mov dword [esi + 8], eax
call fcn.005be240
mov edx, dword [esp + 0x10]
mov ecx, dword [esi + 8]
push edx
call fcn.005be0b0
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
lea edx, [esp + 0x28]
push edx
push 0
push eax
mov eax, dword [ecx + 0x44]
call eax
fild dword [esp + 0x60]
mov ecx, dword [esp + 0x40]
fild dword [esp + 0x40]
test ecx, ecx
jge 0x407dee
fadd dword [0x6ca770]
fdivp st(1)
mov edx, dword [esp + 0x44]
fstp dword [esi]
fild dword [esp + 0x64]
fild dword [esp + 0x44]
test edx, edx
jge 0x407e08
fadd dword [0x6ca770]
fdivp st(1)
fstp dword [esi + 4]
lea ecx, [esp + 0x14]
mov dword [esp + 0x54], 0xffffffff
call fcn.0044ef50
mov eax, esi
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x4c
ret 0xc
Function at 0x409480
Capabilities:
Delete file
Write file on windows

Disassembly:
sub esp, 0x41c
mov eax, dword [0x6f6dfc]
xor eax, esp
mov dword [esp + 0x414], eax
push ebx
push ebp
lea eax, [esp + 0x14]
mov ebx, ecx
push eax
lea ecx, [esp + 0x14]
push ecx
push esi
call fcn.005aace0
add esp, 0xc
test al, al
je 0x4094bf
mov edx, dword [esp + 0x10]
cmp edx, dword [esi + 0x10e]
je 0x4095a5
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
call dword [sym.imp.dbghelp.dll_MakeSureDirectoryPathExists]
push 0x6c7f54
push esi
call fcn.005d0d30
mov ebp, eax
add esp, 8
test ebp, ebp
jne 0x409500
push esi
lea eax, [esp + 0x1c]
push str.Cant_replace_file__s_nPlease_delete_this_file_manually
push eax
call fcn.00401ac0
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
mov eax, edi
call fcn.00408940
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x10]
push eax
mov ecx, ebx
call fcn.0044f060
push eax
mov ecx, ebx
call fcn.0044f090
push eax
push esi
lea ecx, [edi + 0x4e0]
call fcn.005b8660
mov ecx, dword [esi + 0x106]
cmp ecx, dword [esp + 8]
je 0x40954b
push 0
push 0x1c2
push str..Updater.cpp
push str.fe__size__out_size
call fcn.005aa2a0
add esp, 0x10
lea ebx, [edi + 0x20dd4]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, dword [esp + 8]
mov eax, dword [esp + 0xc]
push ebp
push 1
push edx
push eax
call fcn.005d179e
push ebp
call fcn.005d05f0
add esp, 0x14
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push str.ExEWarZ.exe
push esi
call fcn.005d3adc
add esp, 8
test eax, eax
jne 0x409598
mov byte [edi + 0x21708], 1
call fcn.00409810
mov ecx, dword [esp + 0xc]
push ecx
call fcn.005abf60
add esp, 4
mov ecx, dword [esp + 0x41c]
pop ebp
pop ebx
xor ecx, esp
call fcn.005d0167
add esp, 0x41c
ret
Function at 0x409690
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x61f938
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6f6dfc]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [esp + 0x18]
xor ebx, ebx
push eax
xor esi, esi
mov dword [esp + 0x18], ebx
call fcn.0040bde0
lea ecx, [esp + 0x18]
mov dword [esp + 0x38], esi
call fcn.0040bf60
mov ecx, dword [edi + 0x5f8]
sub ecx, dword [edi + 0x5f4]
sar ecx, 2
test ecx, ecx
jbe 0x40973f
mov ebp, 0x100000
mov edx, dword [edi + 0x5f8]
sub edx, dword [edi + 0x5f4]
sar edx, 2
cmp esi, edx
jb 0x409708
call fcn.005d1366
mov eax, dword [edi + 0x5f4]
mov eax, dword [eax + esi*4]
test dword [eax + 0x116], ebp
jne 0x409725
push eax
lea ecx, [esp + 0x1c]
push ecx
call fcn.0040c070
inc ebx
mov edx, dword [edi + 0x5f8]
sub edx, dword [edi + 0x5f4]
inc esi
sar edx, 2
cmp esi, edx
jb 0x4096f0
mov dword [esp + 0x14], ebx
xor esi, esi
mov ecx, dword [esp + 0x28]
sub ecx, dword [esp + 0x24]
mov eax, 0xdd67c8a7
imul ecx
add edx, ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x4097b8
xor ebp, ebp
lea ebx, [edi + 0x5e4]
cmp esi, eax
jb 0x40976d
call fcn.005d1366
mov eax, dword [esp + 0x24]
lea edi, [eax + ebp]
push edi
mov ecx, ebx
call fcn.005ba110
test byte [edi + 0x116], 1
je 0x40978c
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [esp + 0x28]
sub ecx, dword [esp + 0x24]
mov eax, 0xdd67c8a7
imul ecx
add edx, ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
inc esi
add eax, edx
add ebp, 0x128
cmp esi, eax
jb 0x40976d
mov ebx, dword [esp + 0x14]
xor esi, esi
push ebx
push str.removed__d_files_n
call fcn.005a9f90
mov eax, dword [esp + 0x2c]
add esp, 8
cmp eax, esi
je 0x4097d7
push eax
call fcn.005abf60
add esp, 4
mov ecx, dword [esp + 0x18]
push ecx
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
call fcn.005abf60
add esp, 4
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret

Function at 0x409810
Capabilities:
Get common file path

Disassembly:
sub esp, 0x61c
mov eax, dword [0x6f6dfc]
xor eax, esp
mov dword [esp + 0x614], eax
lea eax, [esp + 0x108]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push str.ExEWarZ.exe
lea ecx, [esp + 0x10c]
push ecx
lea edx, [esp + 8]
push 0x6c8ec4
push edx
call fcn.00401aa0
push str.RKS_STUDIO
lea eax, [esp + 0x224]
push str.Allow_network_traffic_for__s
push eax
call fcn.00401ac0
lea ecx, [esp + 0x22c]
add esp, 0x1c
push ecx
lea ecx, [esp + 4]
call fcn.00401710
mov ecx, dword [esp + 0x618]
add esp, 4
xor ecx, esp
call fcn.005d0167
add esp, 0x61c
ret