joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10031505
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10064b88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x30
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10031672
lea eax, [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x10031668
mov dword [ebp - 0x28], 0x4165
mov dword [ebp - 0x30], str.rsnjh_tdqwuvhx_ixetrzdj_kjwt_myjvvnt_usyh_qqnsil_xypb_doeb_hlytuhc
cmp dword [ebp - 0x28], 0x421d
jle 0x100315fe
call dword [sym.imp.KERNEL32.dll_GetVersion]
and dword [ebp - 0x24], 0
jmp 0x10031575
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xc56
jge 0x100315f4
and dword [ebp - 0x18], 0
jmp 0x1003158b
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x19f2
jge 0x100315ef
and dword [ebp - 0x1c], 0
jmp 0x100315a1
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x3f08
jge 0x100315ed
and dword [ebp - 0x20], 0
jmp 0x100315b7
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x7e74
jge 0x100315eb
mov eax, dword [ebp - 0x18]
cdq
idiv dword [ebp - 0x1c]
imul edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov ecx, edx
sar eax, cl
cdq
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], edx
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
mov ecx, 0x10081838
call fcn.10001e6d
jmp 0x100315b0
jmp 0x1003159a
jmp 0x10031584
jmp 0x1003156e
push 0
push 0
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
mov byte [ebp - 0x11], 0
and dword [ebp - 4], 0
cmp dword [ebp - 0x28], 0x4022
jge 0x1003161c
mov edx, dword [ebp - 0x30]
mov ecx, 0x10081838
call fcn.100038af
jmp 0x10031638
or dword [ebp - 4], 0xffffffff
jmp 0x10031642
push 0
push 0x5de8
lea eax, [ebp - 0x11]
push eax
push 0x2064
push 0x40b7
push 1
push 0x5a8e
call fcn.10043236
add esp, 0x1c
jmp 0x10031670
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x10031693
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
push 1
push dword [ebp - 0x34]
push 0x6e31
push dword [ebp - 0x38]
call fcn.10030a03
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10034296
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10064c76
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x40
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1003442e
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x38], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x2c], 0x2faf
mov dword [ebp - 0x48], str.ikruxu_ygjr_gxmpeux_dqaf_qsuqizy_ihhnp_plajywj
cmp dword [ebp - 0x2c], 0x3218
jle 0x10034377
and dword [ebp - 0x24], 0
jmp 0x100342fe
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x7e1b
jge 0x10034377
and dword [ebp - 0x1c], 0
jmp 0x10034314
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x6942
jge 0x10034375
and dword [ebp - 0x20], 0
jmp 0x1003432a
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x4e3e
jge 0x10034373
and dword [ebp - 0x28], 0
jmp 0x10034340
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x1868
jge 0x10034371
mov eax, dword [ebp - 0x1c]
cdq
idiv dword [ebp - 0x20]
and edx, dword [ebp - 0x24]
xor edx, dword [ebp - 0x28]
mov eax, edx
cdq
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
mov ecx, 0x10081838
call fcn.10001e6d
jmp 0x10034339
jmp 0x10034323
jmp 0x1003430d
jmp 0x100342f7
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x100343ce
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x18]
mov dword [eax], 0
jmp 0x100343af
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x18]
mov dword [ecx], eax
mov eax, dword [ebp - 0x18]
cmp dword [eax], 2
jge 0x100343cc
mov eax, dword [ebp - 0x18]
push dword [eax]
mov ecx, dword [ebp - 0x44]
call fcn.10001ffb
mov dword [eax], 0x6a3367f5
jmp 0x100343a4
jmp 0x100343ec
mov byte [ebp - 0x11], 0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x100343ec
push 0
push 0x25a1
push 0x26f
call dword [sym.imp.USER32.dll_AttachThreadInput]
and dword [ebp - 4], 0
cmp dword [ebp - 0x2c], 0x2ee5
jge 0x10034406
mov edx, dword [ebp - 0x48]
mov ecx, 0x10081838
call fcn.100038af
jmp 0x10034422
or dword [ebp - 4], 0xffffffff
jmp 0x1003442c
jmp 0x10034442
push 0
push 0x7839
push 0x4830
call fcn.10037a3a
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10035647
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10064c9e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x7c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x100357d6
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3c], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x100356b4
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
test eax, eax
je 0x100356af
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x100357d1
mov dword [ebp - 0x30], 0x4e1f
mov dword [ebp - 0x50], str.zodylai_giqdb_inlicvx_qosshi_pgqdxqwzx_eim_aqhtujohe_pmpcxjmk_vdcy_zaka
cmp dword [ebp - 0x30], 0x5169
jle 0x1003575f
and dword [ebp - 0x14], 0
jmp 0x100356dc
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x7df8
jge 0x1003575f
and dword [ebp - 0x18], 0
jmp 0x100356f2
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x5034
jge 0x1003575a
and dword [ebp - 0x1c], 0
jmp 0x10035708
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x88a
jge 0x10035758
mov eax, dword [ebp - 0x14]
cdq
idiv dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
shl edx, cl
mov eax, edx
cdq
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], edx
push dword [ebp - 0x68]
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x8c]
call fcn.10001a31
pop ecx
pop ecx
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
call fcn.10001e4d
push eax
call fcn.1004b116
pop ecx
lea ecx, [ebp - 0x8c]
call fcn.10001e43
jmp 0x10035701
jmp 0x100356eb
jmp 0x100356d5
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x54], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x30], 0x4b42
jge 0x1003577b
push dword [ebp - 0x50]
call fcn.1004b116
pop ecx
jmp 0x10035797
or dword [ebp - 4], 0xffffffff
jmp 0x100357a1
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
movzx eax, byte [eax]
test eax, eax
je 0x100357d1
push 0x16a8
push 0x3382
push 0x1563
push 0x1365
push 0
push 1
call fcn.1003093d
add esp, 0x18
jmp 0x100358e6
mov dword [ebp - 0x34], 0x57c4
mov dword [ebp - 0x5c], str.dcg_mife_dqxti_isomslfb_mum_vqxti_zkinuw_xyvdkjjcn_tqxpgrr_efssdxuth_lqc_vbypiw_eqhqdkt_cosoo
cmp dword [ebp - 0x34], 0x5884
jle 0x10035882
push 0x104
call dword [sym.imp.KERNEL32.dll_ExitThread]
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x60], eax
mov dword [ebp - 4], 2
cmp dword [ebp - 0x34], 0x5493
jge 0x100358a5
mov edx, dword [ebp - 0x5c]
mov ecx, 0x10081838
call fcn.100038af
jmp 0x100358c1
or dword [ebp - 4], 0xffffffff
jmp 0x100358cb
mov eax, dword [ebp + 8]
mov dword [ebp - 0x64], eax
push 0
push 0x19ca
push dword [ebp - 0x60]
push dword [ebp - 0x64]
call fcn.10037563
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10036808
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x100368aa
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10036872
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x10036870
push 0x5e32
push 1
push 0x4468
push 0
push 1
push 0x273c
call fcn.10036808
add esp, 0x18
jmp 0x100368a8
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
imul esi, dword [eax], 0xa
mov ecx, dword [ebp - 0x28]
call fcn.1002271c
movsx eax, byte [eax]
lea eax, [esi + eax - 0x30]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov dword [ecx], eax
jmp 0x100368dc
lea eax, [ebp + 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x100368ce
push 0
push 0x25a1
push 0x26f
call dword [sym.imp.USER32.dll_AttachThreadInput]
jmp 0x100368dc
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10036e20
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10064d09
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], 0x6fb2
mov dword [ebp - 0x50], str.nhmctd_rkihf_mwni_ixmlmxq_qtrv_kunsht_dtfvkggig_dwey_miw_vlheivsyd_vqyhsw_iauekm_swo_usz
cmp dword [ebp - 0x24], 0x7359
jle 0x10036f09
and dword [ebp - 0x18], 0
jmp 0x10036e6a
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x2206
jge 0x10036ee1
and dword [ebp - 0x1c], 0
jmp 0x10036e80
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x6f1f
jge 0x10036edf
and dword [ebp - 0x20], 0
jmp 0x10036e96
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x475
jge 0x10036edd
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
sar eax, cl
cdq
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], edx
push dword [ebp - 0x54]
push dword [ebp - 0x58]
lea ecx, [ebp - 0x70]
call fcn.10001a31
pop ecx
pop ecx
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
call fcn.10001e4d
push eax
call fcn.1004b116
pop ecx
lea ecx, [ebp - 0x70]
call fcn.10001e43
jmp 0x10036e8f
jmp 0x10036e79
jmp 0x10036e63
push 0
push 0x1d01
push 0x194b
push 0x1fcb
push 0x240e
push 0x1f90
push 0x1f84
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10036f1e
push 1
call fcn.10036ff8
pop ecx
jmp 0x10036fab
lea eax, [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x10036f60
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x10036f5e
push 0
call fcn.10033fde
pop ecx
jmp 0x10036fab
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x14]
mov dword [eax], 0
jmp 0x10036f8e
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax], 1
jge 0x10036fab
mov eax, dword [ebp - 0x14]
push dword [eax]
mov ecx, dword [ebp - 0x4c]
call fcn.10001ffb
mov dword [eax], 0xfffffff9
jmp 0x10036f83
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x6dee
jge 0x10036fc1
push dword [ebp - 0x50]
call fcn.1004b116
pop ecx
jmp 0x10036fdd
or dword [ebp - 4], 0xffffffff
jmp 0x10036fe7
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10037009
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10064d13
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x3c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], 0x29a3
mov dword [ebp - 0x2c], str.smj_bukmguu_onixxgkbq_nypym_onuwdeyx_yejpuc_mxsbqouvt_whbi
cmp dword [ebp - 0x20], 0x2ccc
jle 0x100370b0
and dword [ebp - 0x18], 0
jmp 0x1003704f
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x687a
jge 0x100370aa
and dword [ebp - 0x1c], 0
jmp 0x10037065
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x75b9
jge 0x100370a8
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x1c]
cdq
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], edx
push dword [ebp - 0x30]
push dword [ebp - 0x34]
lea ecx, [ebp - 0x4c]
call fcn.10001a31
pop ecx
pop ecx
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
call fcn.10001e4d
push eax
call fcn.1004b116
pop ecx
lea ecx, [ebp - 0x4c]
call fcn.10001e43
jmp 0x1003705e
jmp 0x10037048
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
movzx eax, byte [ebp + 8]
test eax, eax
je 0x100370ff
lea eax, [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x100370e9
mov byte [ebp - 0x11], 0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x100370e7
push 1
push 1
push 0
push 0x4f44
call fcn.1003555c
add esp, 0x10
jmp 0x100370fd
mov byte [ebp - 0x12], 0
movzx eax, byte [ebp - 0x12]
test eax, eax
je 0x100370fd
push 0
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
jmp 0x10037113
push 0x4b71
push 0
push 0xf5a
call fcn.1003427e
add esp, 0xc
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x27cd
jge 0x10037129
push dword [ebp - 0x2c]
call fcn.1004b116
pop ecx
jmp 0x10037145
or dword [ebp - 4], 0xffffffff
jmp 0x1003714f
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4011f9
Capabilities:
Create thread

Disassembly:
push edi
xor edi, edi
push edi
push eax
push edi
push edi
push edi
mov dword [0x42bde0], eax
mov eax, closesocket
push eax
push edi
push eax
push 0xcf0000
push 0x42bd18
push 0x42bc50
push edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
jne 0x40122a
pop edi
ret
push ebx
push esi
push str.highlow2.exe
push 0x40
pop esi
push esi
push 0x42a454
call fcn.0040eadc
push 0x424900
push esi
push 0x42a954
call fcn.0040eadc
push 0x42490c
push esi
push 0x42a4d4
call fcn.0040eadc
push 0x424928
push esi
push 0x42a9d4
call fcn.0040eadc
push str.poker7.exe
push esi
push 0x42a554
call fcn.0040eadc
push 0x42495c
push esi
push 0x42aa54
call fcn.0040eadc
add esp, 0x48
push str.Baduki.exe
push esi
push 0x42a5d4
call fcn.0040eadc
push 0x424984
push esi
push 0x42aad4
call fcn.0040eadc
push str.HOOLA3.exe
push esi
push 0x42a654
call fcn.0040eadc
push 0x4249b0
push esi
push 0x42ab54
call fcn.0040eadc
push str.DuelPoker.exe
push esi
push 0x42a6d4
call fcn.0040eadc
push 0x4249e0
push esi
push 0x42abd4
call fcn.0040eadc
add esp, 0x48
push str.PMLauncher.exe
push esi
push 0x42a754
call fcn.0040eadc
mov ebx, 0x424a10
push ebx
push esi
push 0x42ac54
call fcn.0040eadc
push str._PMLauncher.exe
push esi
push 0x42a7d4
call fcn.0040eadc
push ebx
push esi
push 0x42acd4
call fcn.0040eadc
push str.Newbadugi.exe
push esi
push 0x42a854
call fcn.0040eadc
push 0x424a58
push esi
push 0x42ad54
call fcn.0040eadc
add esp, 0x48
mov dword [0x42a450], 9
push 0x100
push edi
push 0x44bde8
call fcn.004100c0
add esp, 0xc
push 2
xor eax, eax
pop edx
movzx ecx, word [eax + 0x424a64]
mov word [eax + 0x44bdec], cx
add eax, edx
cmp cx, di
jne 0x401377
xor eax, eax
movzx ecx, word [eax + 0x424a68]
mov word [eax + 0x44be1c], cx
add eax, edx
cmp cx, di
jne 0x40138e
xor eax, eax
movzx ecx, word [eax + str.218.54.31.166]
mov word [eax + 0x44bdf0], cx
add eax, edx
cmp cx, di
jne 0x4013a5
mov dword [0x44be18], 0x51
xor eax, eax
movzx ecx, word [eax + str.MyCom]
mov word [eax + 0x44be3a], cx
add eax, edx
cmp cx, di
jne 0x4013c6
mov dword [0x44bed4], 5
mov dword [0x44bedc], 0x32
call fcn.0040243c
mov dword [0x44c0f0], eax
mov dword [0x42ae54], eax
call fcn.004024d8
mov dword [0x42ae58], eax
call fcn.0040230b
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push edi
push edi
push edi
push 0x4014ad
push edi
push edi
mov dword [0x46caf2], 0x401e21
call esi
push edi
push edi
push edi
push 0x4017f1
push edi
push edi
call esi
pop esi
xor eax, eax
pop ebx
inc eax
pop edi
ret
Function at 0x401fba
Capabilities:
Get common file path
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x4290a0]
xor eax, ebp
mov dword [ebp + 0x194], eax
push esi
xor eax, eax
xor esi, esi
push 0x206
mov word [ebp - 0x74], ax
lea eax, [ebp - 0x72]
push esi
push eax
mov dword [ebp - 0x7c], esi
call fcn.004100c0
add esp, 0xc
mov dword [ebp - 0x78], esi
cmp ebx, esi
je 0x40206c
push edi
mov edi, str.golfinfo.ini
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x402005
sub eax, edx
sar eax, 1
je 0x40206b
lea eax, [ebp - 0x74]
push eax
mov esi, 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push edi
lea eax, [ebp - 0x74]
push esi
push eax
call fcn.0040ebcd
push 0x424b8c
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x78]
push eax
call fcn.0040e674
add esp, 0x18
cmp dword [ebp - 0x78], 0
je 0x40206b
push dword [ebp - 0x78]
xor esi, esi
inc esi
push esi
push 0x200
push ebx
call fcn.0040eeea
push dword [ebp - 0x78]
call fcn.0040e922
add esp, 0x14
mov dword [ebp - 0x7c], esi
pop edi
mov ecx, dword [ebp + 0x194]
mov eax, dword [ebp - 0x7c]
xor ecx, ebp
pop esi
call fcn.0040e3f8
add ebp, 0x198
leave
ret

Function at 0x4021f9
Capabilities:
Delete file
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
xor edi, edi
push 0x3e8
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x424b8c
mov esi, 0x44bee8
lea eax, [ebp - 4]
push esi
push eax
call fcn.0040e674
add esp, 0xc
cmp dword [ebp - 4], edi
je 0x402307
push ebx
push 2
push edi
push dword [ebp - 4]
call fcn.0040f35f
push dword [ebp - 4]
call fcn.0040f581
mov edi, eax
push edi
call fcn.0040f5ef
push 0
push 0
push dword [ebp - 4]
mov ebx, eax
mov dword [ebp - 8], ebx
call fcn.0040f35f
push dword [ebp - 4]
push edi
push 1
push ebx
call fcn.0040eeea
add esp, 0x30
cmp edi, eax
jne 0x4022e8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.0040f2a1
pop ecx
call fcn.0040f2b3
mov dword [ebp - 0xc], eax
fild dword [ebp - 0xc]
fmul qword [0x426d68]
fmul qword [0x426d60]
fadd qword [0x426d58]
call fcn.00411090
cmp edi, eax
jl 0x4022e8
sub ebx, eax
push eax
add ebx, edi
call fcn.004021b7
push dword [ebp - 4]
call fcn.0040e922
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x42489c
lea eax, [ebp - 4]
push esi
push eax
call fcn.0040e674
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x402306
push dword [ebp - 4]
push edi
push 1
push dword [ebp - 8]
call fcn.0040e829
add esp, 0x10
cmp dword [ebp - 4], 0
je 0x4022f7
push dword [ebp - 4]
call fcn.0040e922
pop ecx
cmp dword [ebp - 8], 0
je 0x402306
push dword [ebp - 8]
call fcn.0040e3ed
pop ecx
pop ebx
pop edi
pop esi
leave
ret
Function at 0x40230b
Capabilities:
Create thread
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x274
mov eax, dword [0x4290a0]
xor eax, esp
mov dword [esp + 0x270], eax
push ebx
push esi
push edi
xor eax, eax
push 0x62
mov word [esp + 0x214], ax
xor ebx, ebx
lea eax, [esp + 0x216]
push ebx
push eax
call fcn.004100c0
add esp, 0xc
push 0x200
lea eax, [esp + 0x14]
push ebx
push eax
call fcn.004100c0
add esp, 0xc
lea edi, [esp + 0x10]
call fcn.00402085
test eax, eax
je 0x402427
xor eax, eax
movzx ecx, word [esp + eax + 0x14]
mov word [eax + 0x44bdf0], cx
inc eax
inc eax
cmp cx, bx
jne 0x40236d
movzx eax, word [esp + 0x94]
mov dword [0x44be18], eax
xor eax, eax
movzx ecx, word [esp + eax + 0x96]
mov word [eax + 0x44be1c], cx
inc eax
inc eax
cmp cx, bx
jne 0x40238f
cmp dword [0x44c0f0], 3
mov edi, 0x104
mov esi, 0x44bee8
jne 0x4023d1
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x424bb0
push edi
push esi
call fcn.0040ebcd
add esp, 0xc
jmp 0x4023d9
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [esp + 0x1b8]
push eax
push edi
push esi
call fcn.0040ebcd
add esp, 0xc
push 0x424bb4
push edi
push esi
call fcn.0040ebcd
add esp, 0xc
call fcn.004021f9
push ebx
push ebx
push ebx
push 0x402104
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea edi, [esp + 0x210]
call fcn.00402129
mov eax, edi
push eax
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [esp + 0x27c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040e3f8
mov esp, ebp
pop ebp
ret

Function at 0x40243c
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0xa0]
sub esp, 0x120
mov eax, dword [0x4290a0]
xor eax, ebp
mov dword [ebp + 0x9c], eax
push esi
push 0x118
xor esi, esi
lea eax, [ebp - 0x7c]
push esi
push eax
call fcn.004100c0
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4024c0
cmp dword [ebp - 0x7c], 5
mov eax, dword [ebp - 0x78]
jne 0x4024aa
test eax, eax
jne 0x402499
cmp word [ebp + 0x94], 4
jb 0x4024c0
inc esi
cmp eax, 2
jne 0x4024a0
push eax
pop esi
jae 0x4024a7
cmp eax, 1
jne 0x4024c0
push 3
pop esi
cmp dword [ebp - 0x7c], 6
jne 0x4024c0
test eax, eax
jne 0x4024b8
push 4
jmp 0x4024bf
cmp eax, 1
jne 0x4024c0
push 5
pop esi
mov ecx, dword [ebp + 0x9c]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0040e3f8
add ebp, 0xa0
leave
ret