joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414987
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x43a50c]
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ecx + 4]
push esi
push edi
add eax, 0x14
push str.360se.exe
push eax
lea eax, [ebp - 8]
push eax
call fcn.0041a0ea
push eax
lea ecx, [ebp - 4]
call fcn.0040478a
lea ecx, [ebp - 8]
call fcn.00404c0d
xor ebx, ebx
mov ecx, 0x83
xor eax, eax
lea edi, [ebp - 0x218]
mov byte [ebp - 0x234], 0x28
mov byte [ebp - 0x233], 2
mov byte [ebp - 0x232], bl
mov byte [ebp - 0x231], bl
mov byte [ebp - 0x230], 1
mov byte [ebp - 0x22f], bl
mov byte [ebp - 0x22e], bl
mov byte [ebp - 0x22d], bl
mov byte [ebp - 0x22c], bl
mov byte [ebp - 0x22b], bl
mov byte [ebp - 0x22a], 0x81
mov byte [ebp - 0x229], bl
mov byte [ebp - 0x228], bl
mov byte [ebp - 0x227], bl
mov byte [ebp - 0x226], bl
mov byte [ebp - 0x225], bl
mov byte [ebp - 0x224], bl
mov byte [ebp - 0x223], bl
mov byte [ebp - 0x222], bl
mov byte [ebp - 0x221], bl
mov byte [ebp - 0x220], bl
mov byte [ebp - 0x21f], bl
mov byte [ebp - 0x21e], bl
mov byte [ebp - 0x21d], bl
mov byte [ebp - 0x21c], bl
mov byte [ebp - 0x21b], bl
mov byte [ebp - 0x21a], bl
mov byte [ebp - 0x219], bl
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax - 8]
shl ecx, 1
push ecx
push eax
lea eax, [ebp - 0x218]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea eax, [ebp - 0x234]
mov dword [ebp - 0xc], ebx
push 0x228
push eax
push 3
mov ebx, str.SoftwareMicrosoftWindowsCurrentVersionApp_ManagementARPCache23F3F476_BE34_4f48_9C77_2806A8393EC4
push str.SlowInfoCache
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push ebx
push edi
call esi
lea eax, [ebp - 0xc]
push 4
push eax
push 4
push str.Changed
push ebx
push edi
call esi
lea ecx, [ebp - 4]
call fcn.00404c0d
pop edi
pop esi
pop ebx
leave
ret
Function at 0x415ab1
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov esi, ecx
push 1
push ecx
mov ecx, esp
push 0x43d9ac
call fcn.00404729
mov ecx, esi
call fcn.0041977a
push 9
push ecx
mov ecx, esp
push str.seext.dll
call fcn.00404729
mov ecx, esi
call fcn.0041977a
push 2
push ecx
mov ecx, esp
push str.360SEUP.dll
call fcn.00404729
mov ecx, esi
call fcn.0041977a
push 4
push ecx
mov ecx, esp
push str.seup.exe
call fcn.00404729
mov ecx, esi
call fcn.0041977a
push 8
push ecx
mov ecx, esp
push 0x43de40
call fcn.00404729
mov ecx, esi
call fcn.0041977a
push 7
push ecx
mov ecx, esp
push str.sqlite3.dll
call fcn.00404729
mov ecx, esi
call fcn.0041977a
push 5
push ecx
mov ecx, esp
push str.sefix.exe
call fcn.00404729
mov ecx, esi
call fcn.0041977a
push 0x24
push ecx
mov ecx, esp
push str.pacomp.exe
call fcn.00404729
mov ecx, esi
call fcn.0041977a
push 0x2a
push ecx
mov ecx, esp
push str.sesvc.exe
call fcn.00404729
mov ecx, esi
call fcn.0041977a
mov edi, str.cloudurls.dat
lea eax, [esi + 0x34]
push edi
push eax
lea eax, [ebp - 8]
push eax
call fcn.0041a0ea
mov ebx, dword [eax]
add esi, 0x38
push edi
lea eax, [ebp - 4]
push esi
push eax
call fcn.0041a0ea
mov eax, dword [eax]
push 0
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea ecx, [ebp - 4]
call fcn.00404c0d
lea ecx, [ebp - 8]
call fcn.00404c0d
pop edi
pop esi
pop ebx
leave
ret
Function at 0x415bc5
Capabilities:
Check if file exists
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
push ebx
push esi
push edi
mov edi, ecx
push str.SafeCentral
lea eax, [edi + 0x34]
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 8]
push eax
call fcn.0041a0ea
push dword [eax]
call fcn.00421506
pop ecx
lea ecx, [ebp - 8]
call fcn.00404c0d
push 0x1c
push ecx
mov ecx, esp
push str.SafeCentral.dll
call fcn.00404729
push ecx
mov esi, 0x43f3f8
mov ecx, esp
push esi
call fcn.00404729
mov ecx, edi
call fcn.0041994d
push 0x1f
push ecx
mov ecx, esp
push str.urlprocnet.dll
call fcn.00404729
push ecx
mov ecx, esp
push esi
call fcn.00404729
mov ecx, edi
call fcn.0041994d
push 0x1d
push ecx
mov ecx, esp
push str.urlproc.dll
call fcn.00404729
push ecx
mov ecx, esp
push esi
call fcn.00404729
mov ecx, edi
call fcn.0041994d
push 0x1e
push ecx
mov ecx, esp
push str.urlproc.exe
call fcn.00404729
push ecx
mov ecx, esp
push esi
call fcn.00404729
mov ecx, edi
call fcn.0041994d
push 0x20
push ecx
mov ecx, esp
push str.wdui2.dll
call fcn.00404729
push ecx
mov ecx, esp
push esi
call fcn.00404729
mov ecx, edi
call fcn.0041994d
push 0x25
push ecx
mov ecx, esp
push str.urllibauth.dat
call fcn.00404729
push ecx
mov ecx, esp
push esi
call fcn.00404729
mov ecx, edi
call fcn.0041994d
push 0x27
push ecx
mov ecx, esp
push str.SiteVerifier.dll
call fcn.00404729
push ecx
mov ecx, esp
push esi
call fcn.00404729
mov ecx, edi
call fcn.0041994d
push 0x2b
push ecx
mov ecx, esp
push str.SafeAddressRes.dll
call fcn.00404729
push ecx
mov ecx, esp
push esi
call fcn.00404729
mov ecx, edi
call fcn.0041994d
lea eax, [edi + 0x2c]
push str.extensionsSafeCentral
push eax
lea eax, [ebp - 4]
push eax
call fcn.0041a0ea
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x415d1d
push dword [ebp - 4]
call fcn.00421506
pop ecx
lea eax, [ebp - 4]
push str.esimple.ini
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.0041a0ea
mov esi, dword [eax]
add edi, 0x38
push str.SafeCentralesimple.ini
lea eax, [ebp - 8]
push edi
push eax
call fcn.0041a0ea
mov eax, dword [eax]
xor ebx, ebx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileW]
push eax
call esi
lea ecx, [ebp - 8]
call fcn.00404c0d
lea ecx, [ebp - 0xc]
call fcn.00404c0d
lea eax, [ebp - 4]
push str.SafeProtect.dat
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0041a0ea
mov eax, dword [eax]
push str.SafeCentralSafeProtect.dat
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push edi
push eax
call fcn.0041a0ea
mov eax, dword [eax]
push ebx
push dword [ebp - 0xc]
push eax
call esi
lea ecx, [ebp - 8]
call fcn.00404c0d
lea ecx, [ebp - 0x14]
call fcn.00404c0d
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x21a]
mov word [ebp - 0x21c], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp - 0x10]
push str._sefix.exe_downloadurllib
push dword [eax]
lea eax, [ebp - 0x21c]
push 0x43f208
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
push ebx
push ebx
lea eax, [ebp - 0x21c]
push ebx
push eax
call fcn.00420ed0
add esp, 0x24
lea ecx, [ebp - 4]
call fcn.00404c0d
pop edi
pop esi
pop ebx
leave
ret
Function at 0x416e9f
Capabilities:
Delete file
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc34
push ebx
mov ebx, ecx
push esi
xor esi, esi
mov eax, dword [ebx + 4]
cmp dword [eax + 8], esi
je 0x416ebb
call fcn.0041818a
mov eax, dword [ebx + 4]
cmp dword [eax + 8], esi
je 0x416ef9
push dword [ebx + 0x28]
push 0xffffffffffffffff
push str.FAVSOURCE
push 0x43efb8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, esi
jne 0x416ee5
mov ecx, ebx
call fcn.004182a5
jmp 0x416ef9
cmp eax, 1
jne 0x416ef9
mov ecx, ebx
call fcn.004182a5
test eax, eax
je 0x4170f6
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x20a]
mov word [ebp - 0x20c], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebx + 4]
push dword [eax + 0x2c]
lea eax, [ebp - 0x20c]
push 0x43fce4
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
mov eax, dword [ebx + 4]
add esp, 0x10
cmp dword [eax + 8], esi
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
jne 0x417072
and word [ebp - 0xa2c], 0
mov edx, 0x81
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0xa2a]
and word [ebp - 0xc34], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0xc32]
and word [ebp - 0x414], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x412]
and word [ebp - 0x61c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x61a]
and word [ebp - 0x824], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x822]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, dword [sym.imp.MSVCRT.dll__snwprintf]
lea eax, [ebp - 0x20c]
push eax
push 0x43fccc
lea eax, [ebp - 0xa2c]
push 0x103
push eax
call edi
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
push 0x43fcb0
lea eax, [ebp - 0xc34]
push 0x103
push eax
call edi
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
push 0x43fc94
lea eax, [ebp - 0x414]
push 0x103
push eax
call edi
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
push 0x43fc78
lea eax, [ebp - 0x61c]
push 0x103
push eax
call edi
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
push 0x43fc5c
lea eax, [ebp - 0x824]
push 0x103
push eax
call edi
add esp, 0x10
lea eax, [ebp - 0xa2c]
push eax
call esi
lea eax, [ebp - 0x414]
push eax
call esi
lea eax, [ebp - 0x61c]
push eax
call esi
lea eax, [ebp - 0x824]
push eax
call esi
mov eax, dword [ebx + 4]
push 0x43fc38
push 0x2c
pop edi
add eax, edi
push eax
lea eax, [ebp - 4]
push eax
call fcn.0041a0ea
push dword [eax]
call esi
lea ecx, [ebp - 4]
call fcn.00404c0d
mov eax, dword [ebx + 4]
push 0x43fc18
add eax, edi
push eax
lea eax, [ebp - 4]
push eax
call fcn.0041a0ea
push dword [eax]
call esi
lea ecx, [ebp - 4]
call fcn.00404c0d
mov eax, dword [ebx + 4]
push 0x43fbfc
add eax, edi
push eax
lea eax, [ebp - 4]
push eax
call fcn.0041a0ea
push dword [eax]
call esi
lea ecx, [ebp - 4]
call fcn.00404c0d
mov eax, dword [ebx + 4]
push 0x43fbe0
add eax, edi
push eax
lea eax, [ebp - 4]
push eax
call fcn.0041a0ea
push dword [eax]
call esi
lea ecx, [ebp - 4]
call fcn.00404c0d
pop edi
pop esi
pop ebx
leave
ret
Function at 0x417c48
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
and word [ebp - 0x20c], 0
push ebx
push esi
mov esi, ecx
mov ebx, 0x81
push edi
push dword [esi + 0x28]
mov ecx, ebx
xor eax, eax
lea edi, [ebp - 0x20a]
rep stosd dword es:[edi], eax
push 0
push str.IsSave
push str.AddUnstall
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
and word [ebp - 0x414], 0
mov dword [ebp - 4], eax
mov ecx, ebx
xor eax, eax
lea edi, [ebp - 0x412]
push dword [esi + 0x28]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x414]
push 0x104
push eax
mov ebx, 0x440160
push 0x443154
mov edi, str.Main
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x414], 0
je 0x417cd5
cmp dword [ebp - 4], 1
jne 0x417ce5
push dword [esi + 0x28]
push 0x444ce4
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov eax, dword [esi + 4]
cmp dword [eax + 8], 0
je 0x417cf8
push dword [esi + 0x34]
push str._s_seup.exe__reinstall
jmp 0x417d0d
cmp dword [esi + 0x3c], 0
push dword [esi + 0x34]
jne 0x417d08
push str._s_seup.exe__install__m
jmp 0x417d0d
push str._s_seup.exe__install
lea eax, [ebp - 0x20c]
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.00420ed0
add esp, 0x10
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41818a
Capabilities:
Check if file exists
Delete file
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1458
call fcn.0042f4a0
and word [ebp - 0x410], 0
push ebx
push esi
mov edx, ecx
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x40e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [edx + 4]
mov esi, dword [sym.imp.MSVCRT.dll__snwprintf]
mov ebx, 0x103
push dword [eax + 0x2c]
lea eax, [ebp - 0x410]
push 0x43fce4
push ebx
push eax
call esi
and word [ebp - 0x208], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x206]
rep stosd dword es:[edi], eax
add esp, 0x10
stosw word es:[edi], ax
lea eax, [ebp - 0x410]
push eax
push 0x440420
lea eax, [ebp - 0x208]
push ebx
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryEmptyW]
test eax, eax
jne 0x4182a0
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4182a0
and word [ebp - 0x1458], 0
mov ecx, 0x411
xor eax, eax
lea edi, [ebp - 0x1456]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x1458]
push 0x823
push eax
push 0x443154
push 0x440418
push str.InternetShortcut
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x1458], 0
je 0x4182a0
lea eax, [ebp - 0x1458]
push eax
push str.http:__avc.360.cn_index.html_a6073
call dword [sym.imp.MSVCRT.dll__wcsicmp]
pop ecx
test eax, eax
pop ecx
jne 0x4182a0
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4182a5
Capabilities:
Check if file exists
Delete file
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x145c
call fcn.0042f4a0
and word [ebp - 0x414], 0
push ebx
push esi
mov edx, ecx
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x412]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [edx + 4]
mov esi, dword [sym.imp.MSVCRT.dll__snwprintf]
and dword [ebp - 4], 0
mov ebx, 0x103
push dword [eax + 0x2c]
lea eax, [ebp - 0x414]
push 0x43fce4
push ebx
push eax
call esi
and word [ebp - 0x20c], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x20a]
rep stosd dword es:[edi], eax
add esp, 0x10
stosw word es:[edi], ax
lea eax, [ebp - 0x414]
push eax
push str._s_
lea eax, [ebp - 0x20c]
push ebx
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryEmptyW]
test eax, eax
jne 0x4183fe
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4183e2
and word [ebp - 0x145c], 0
mov ecx, 0x411
xor eax, eax
lea edi, [ebp - 0x145a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x20c]
mov edi, 0x440418
push eax
lea eax, [ebp - 0x145c]
push 0x823
push eax
push 0x443154
mov esi, str.InternetShortcut
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x145c], 0
je 0x4183d9
lea eax, [ebp - 0x145c]
push eax
push str.http:__www.baidu.com_index.php_tn360se_dg
call dword [sym.imp.MSVCRT.dll__wcsicmp]
pop ecx
test eax, eax
pop ecx
jne 0x4183d9
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x20c]
push eax
push str.http:__www.baidu.com_index.php_se360se_dg
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov dword [ebp - 4], 1
jmp 0x4183fe
lea eax, [ebp - 0x20c]
push eax
push str.http:__www.baidu.com_index.php_se360se_dg
push 0x440418
push str.InternetShortcut
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x418406
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push 1
add ecx, 0x34
pop ebx
push ecx
lea ecx, [ebp - 4]
call fcn.004046e3
xor esi, esi
lea ecx, [ebp - 4]
push esi
push 0x43bbcc
call fcn.00404a64
cmp eax, esi
jle 0x41849e
add eax, 2
push edi
push eax
lea eax, [ebp - 8]
push esi
push eax
lea ecx, [ebp - 4]
call fcn.0040ccb7
xor eax, eax
lea edi, [ebp - 0x1c]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x18], esi
stosd dword es:[edi], eax
lea edi, [ebp - 0x14]
mov dword [ebp - 0x10], esi
stosd dword es:[edi], eax
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x418495
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
push 0x14
pop ecx
call fcn.0042f5f0
push str.8.05
mov edi, eax
call dword [sym.imp.MSVCRT.dll__wtoi]
cmp eax, edi
pop ecx
jbe 0x418495
xor ebx, ebx
lea ecx, [ebp - 8]
call fcn.00404c0d
pop edi
lea ecx, [ebp - 4]
call fcn.00404c0d
mov eax, ebx
pop esi
pop ebx
leave
ret

Function at 0x418826
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x517c
call fcn.0042f4a0
mov ecx, dword [ebp + 8]
push esi
call fcn.0041a074
lea eax, [ebp - 8]
xor esi, esi
push eax
push str.SoftwareMicrosoftInternet_ExplorerMain
push SysReAllocStringLen
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x418910
push ebx
push edi
mov ecx, 0x1459
lea edi, [ebp - 0x517a]
mov word [ebp - 0x517c], si
mov dword [ebp - 0x10], 0x28b3
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x517c]
push eax
push esi
push esi
push str.Secondary_Start_Pages
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x418905
mov esi, dword [ebp - 0x10]
lea ebx, [ebp - 0x517c]
shr esi, 1
dec esi
test esi, esi
jle 0x418905
lea eax, [ebp - 0x517a]
mov edi, 0x43fdc4
mov dword [ebp - 0xc], eax
mov ax, word [ebx]
test ax, ax
je 0x4188cf
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 1
jmp 0x4188ef
mov eax, dword [ebp - 4]
inc eax
cmp eax, esi
jge 0x4188f7
mov eax, dword [ebp - 0xc]
cmp word [eax], 0
je 0x4188f7
mov eax, edi
test eax, eax
je 0x4188ed
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push edi
push eax
mov ecx, dword [ebp + 8]
call fcn.00404d28
inc dword [ebp - 4]
add dword [ebp - 0xc], 2
inc ebx
inc ebx
cmp dword [ebp - 4], esi
jl 0x4188bc
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
pop esi
leave
ret 4
Function at 0x418a24
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
and word [ebp - 0x414], 0
push ebx
push esi
mov edx, ecx
push edi
mov ecx, 0x81
push dword [edx + 0x34]
xor eax, eax
lea edi, [ebp - 0x412]
mov esi, dword [sym.imp.MSVCRT.dll__snwprintf]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ebx, 0x103
push str._s_seup.exe__delv3cfg
lea eax, [ebp - 0x414]
push ebx
push eax
mov dword [ebp - 4], edx
call esi
and word [ebp - 0x20c], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x20a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp - 4]
add esp, 0x10
push dword [eax + 0x34]
lea eax, [ebp - 0x20c]
push str._s_seup.exe
push ebx
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop edi
pop esi
test eax, eax
pop ebx
je 0x418acb
push 0
push 0xbb8
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.00420ed0
add esp, 0x10
leave
ret

Function at 0x418acd
Capabilities:
Check if file exists
Delete file
Get common file path
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push edi
xor edx, edx
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x206]
mov word [ebp - 0x208], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push edx
lea eax, [ebp - 0x208]
push 0x1a
push eax
push edx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
pop edi
je 0x418b5f
lea eax, [ebp - 0x208]
push str.360se
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x418b5f
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x418b5f
test al, 0x10
jne 0x418b5f
lea eax, [ebp - 0x208]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
leave
ret
Function at 0x418b61
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
add ecx, 0x2c
push str._v3update_
lea eax, [ebp - 0xc]
push ecx
push eax
call fcn.0041a0ea
lea eax, [ebp - 0xc]
push str.v3update.ini
push eax
lea eax, [ebp - 4]
push eax
call fcn.0041a0ea
lea eax, [ebp - 0xc]
push str.v3update.ini.bak
push eax
lea eax, [ebp - 8]
push eax
call fcn.0041a0ea
push dword [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
call esi
push dword [ebp - 4]
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
call edi
test eax, eax
je 0x418bde
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x418bd9
test al, 0x10
jne 0x418bd9
push 0x80
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call edi
test eax, eax
je 0x418c09
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.0042190a
pop ecx
pop ecx
push dword [ebp - 8]
call esi
test eax, eax
jne 0x418c09
push 4
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea ecx, [ebp - 8]
call fcn.00404c0d
lea ecx, [ebp - 4]
call fcn.00404c0d
lea ecx, [ebp - 0xc]
call fcn.00404c0d
pop edi
pop esi
leave
ret

Function at 0x418c25
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2090
call fcn.0042f4a0
push esi
mov esi, ecx
push str.3.9.1.5
mov eax, dword [esi + 0x20]
push eax
call fcn.00421396
pop ecx
test eax, eax
pop ecx
jl 0x418c86
mov eax, dword [esi + 0x20]
push str.4.0.0.0
push eax
call fcn.00421396
pop ecx
test eax, eax
pop ecx
jle 0x418c71
mov eax, dword [esi + 0x20]
push str.4.0.0.9
push eax
call fcn.00421396
pop ecx
test eax, eax
pop ecx
jl 0x418c86
push dword [ebp + 0xc]
mov ecx, 0x443120
push dword [ebp + 8]
call fcn.0040411f
jmp 0x418d2a
and word [ebp - 0x2090], 0
push ebx
push edi
mov ecx, 0x823
xor eax, eax
lea edi, [ebp - 0x208e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esi + 0x24]
mov ebx, str.HomePage
test eax, eax
mov edi, str.option
je 0x418cda
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x418cda
lea eax, [ebp - 0x2090]
push 0x1047
push eax
push ebx
push edi
mov ecx, 0x443120
push dword [esi + 0x24]
push 0
call fcn.00403195
cmp word [ebp - 0x2090], 0
jne 0x418d0d
push dword [esi + 0x28]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x418d0d
push dword [esi + 0x28]
lea eax, [ebp - 0x2090]
push 0x1047
push eax
push 0x443154
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x2090]
push eax
push 0x43ab18
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
pop edi
pop ebx
pop esi
leave
ret 8
Function at 0x418d8d
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [ebp + 8]
cmp dword [eax - 8], 0
je 0x418e83
lea eax, [ebp + 8]
push str._skin.ini
push eax
add ecx, 0x34
push str.Skin_
lea eax, [ebp - 0xc]
push ecx
push eax
call fcn.0041a0ea
push eax
lea eax, [ebp - 8]
push eax
call fcn.00407f31
push eax
lea eax, [ebp - 4]
push eax
call fcn.0041a0ea
lea ecx, [ebp - 8]
call fcn.00404c0d
lea ecx, [ebp - 0xc]
call fcn.00404c0d
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x418e7b
and word [ebp - 0x214], 0
push ebx
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x212]
push dword [ebp - 4]
rep stosd dword es:[edi], eax
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x103
stosw word es:[edi], ax
lea eax, [ebp - 0x214]
mov ebx, 0x443154
push eax
push ebx
mov edi, str.General
push 0x4406d0
push edi
call esi
cmp word [ebp - 0x214], 0
jne 0x418e59
push dword [ebp - 4]
lea eax, [ebp - 0x214]
push 0x103
push eax
push ebx
push str.TheWorld
push edi
call esi
cmp word [ebp - 0x214], 0x33
pop edi
pop esi
pop ebx
jne 0x418e7b
lea ecx, [ebp - 4]
call fcn.00404c0d
lea ecx, [ebp + 8]
call fcn.00404c0d
push 1
pop eax
jmp 0x418e8d
lea ecx, [ebp - 4]
call fcn.00404c0d
lea ecx, [ebp + 8]
call fcn.00404c0d
xor eax, eax
leave
ret 4