joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415c62
Capabilities:
Check if file exists
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
push ebx
push esi
push edi
mov edi, ecx
push str.SafeCentral
lea eax, [edi + 0x38]
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 8]
push eax
call fcn.0041a27c
push dword [eax]
call fcn.004216ea
pop ecx
lea ecx, [ebp - 8]
call fcn.00404c0d
push 0x1c
push ecx
mov ecx, esp
push str.SafeCentral.dll
call fcn.00404729
push ecx
mov esi, 0x4404a8
mov ecx, esp
push esi
call fcn.00404729
mov ecx, edi
call fcn.00419a1a
push 0x1f
push ecx
mov ecx, esp
push str.urlprocnet.dll
call fcn.00404729
push ecx
mov ecx, esp
push esi
call fcn.00404729
mov ecx, edi
call fcn.00419a1a
push 0x1d
push ecx
mov ecx, esp
push str.urlproc.dll
call fcn.00404729
push ecx
mov ecx, esp
push esi
call fcn.00404729
mov ecx, edi
call fcn.00419a1a
push 0x1e
push ecx
mov ecx, esp
push str.urlproc.exe
call fcn.00404729
push ecx
mov ecx, esp
push esi
call fcn.00404729
mov ecx, edi
call fcn.00419a1a
push 0x20
push ecx
mov ecx, esp
push str.wdui2.dll
call fcn.00404729
push ecx
mov ecx, esp
push esi
call fcn.00404729
mov ecx, edi
call fcn.00419a1a
push 0x25
push ecx
mov ecx, esp
push str.urllibauth.dat
call fcn.00404729
push ecx
mov ecx, esp
push esi
call fcn.00404729
mov ecx, edi
call fcn.00419a1a
push 0x27
push ecx
mov ecx, esp
push str.SiteVerifier.dll
call fcn.00404729
push ecx
mov ecx, esp
push esi
call fcn.00404729
mov ecx, edi
call fcn.00419a1a
push 0x2b
push ecx
mov ecx, esp
push str.SafeAddressRes.dll
call fcn.00404729
push ecx
mov ecx, esp
push esi
call fcn.00404729
mov ecx, edi
call fcn.00419a1a
lea eax, [edi + 0x30]
push str.extensionsSafeCentral
push eax
lea eax, [ebp - 4]
push eax
call fcn.0041a27c
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x415dba
push dword [ebp - 4]
call fcn.004216ea
pop ecx
lea eax, [ebp - 4]
push str.esimple.ini
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.0041a27c
mov esi, dword [eax]
add edi, 0x3c
push str.SafeCentralesimple.ini
lea eax, [ebp - 8]
push edi
push eax
call fcn.0041a27c
mov eax, dword [eax]
xor ebx, ebx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileW]
push eax
call esi
lea ecx, [ebp - 8]
call fcn.00404c0d
lea ecx, [ebp - 0xc]
call fcn.00404c0d
lea eax, [ebp - 4]
push str.SafeProtect.dat
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0041a27c
mov eax, dword [eax]
push str.SafeCentralSafeProtect.dat
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push edi
push eax
call fcn.0041a27c
mov eax, dword [eax]
push ebx
push dword [ebp - 0xc]
push eax
call esi
lea ecx, [ebp - 8]
call fcn.00404c0d
lea ecx, [ebp - 0x14]
call fcn.00404c0d
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x21a]
mov word [ebp - 0x21c], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp - 0x10]
push str._sefix.exe__downloadurllib
push dword [eax]
lea eax, [ebp - 0x21c]
push str.__s_s
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
push ebx
push ebx
lea eax, [ebp - 0x21c]
push ebx
push eax
call fcn.004210b4
add esp, 0x24
lea ecx, [ebp - 4]
call fcn.00404c0d
pop edi
pop esi
pop ebx
leave
ret
Function at 0x416f55
Capabilities:
Delete file
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc34
push ebx
mov ebx, ecx
push esi
xor esi, esi
mov eax, dword [ebx + 4]
cmp dword [eax + 8], esi
je 0x416f71
call fcn.00418240
mov eax, dword [ebx + 4]
cmp dword [eax + 8], esi
je 0x416faf
push dword [ebx + 0x28]
push 0xffffffffffffffff
push str.FAVSOURCE
push 0x440064
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, esi
jne 0x416f9b
mov ecx, ebx
call fcn.0041835b
jmp 0x416faf
cmp eax, 1
jne 0x416faf
mov ecx, ebx
call fcn.0041835b
test eax, eax
je 0x4171ac
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x20a]
mov word [ebp - 0x20c], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebx + 4]
push dword [eax + 0x2c]
lea eax, [ebp - 0x20c]
push 0x440d94
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
mov eax, dword [ebx + 4]
add esp, 0x10
cmp dword [eax + 8], esi
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
jne 0x417128
and word [ebp - 0xa2c], 0
mov edx, 0x81
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0xa2a]
and word [ebp - 0xc34], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0xc32]
and word [ebp - 0x414], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x412]
and word [ebp - 0x61c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x61a]
and word [ebp - 0x824], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x822]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, dword [sym.imp.MSVCRT.dll__snwprintf]
lea eax, [ebp - 0x20c]
push eax
push 0x440d7c
lea eax, [ebp - 0xa2c]
push 0x103
push eax
call edi
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
push 0x440d60
lea eax, [ebp - 0xc34]
push 0x103
push eax
call edi
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
push 0x440d44
lea eax, [ebp - 0x414]
push 0x103
push eax
call edi
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
push 0x440d28
lea eax, [ebp - 0x61c]
push 0x103
push eax
call edi
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
push 0x440d0c
lea eax, [ebp - 0x824]
push 0x103
push eax
call edi
add esp, 0x10
lea eax, [ebp - 0xa2c]
push eax
call esi
lea eax, [ebp - 0x414]
push eax
call esi
lea eax, [ebp - 0x61c]
push eax
call esi
lea eax, [ebp - 0x824]
push eax
call esi
mov eax, dword [ebx + 4]
push 0x440ce8
push 0x2c
pop edi
add eax, edi
push eax
lea eax, [ebp - 4]
push eax
call fcn.0041a27c
push dword [eax]
call esi
lea ecx, [ebp - 4]
call fcn.00404c0d
mov eax, dword [ebx + 4]
push 0x440cc8
add eax, edi
push eax
lea eax, [ebp - 4]
push eax
call fcn.0041a27c
push dword [eax]
call esi
lea ecx, [ebp - 4]
call fcn.00404c0d
mov eax, dword [ebx + 4]
push 0x440cac
add eax, edi
push eax
lea eax, [ebp - 4]
push eax
call fcn.0041a27c
push dword [eax]
call esi
lea ecx, [ebp - 4]
call fcn.00404c0d
mov eax, dword [ebx + 4]
push 0x440c90
add eax, edi
push eax
lea eax, [ebp - 4]
push eax
call fcn.0041a27c
push dword [eax]
call esi
lea ecx, [ebp - 4]
call fcn.00404c0d
pop edi
pop esi
pop ebx
leave
ret
Function at 0x417cfe
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
and word [ebp - 0x20c], 0
push ebx
push esi
mov esi, ecx
mov ebx, 0x81
push edi
push dword [esi + 0x28]
mov ecx, ebx
xor eax, eax
lea edi, [ebp - 0x20a]
rep stosd dword es:[edi], eax
push 0
push str.IsSave
push str.AddUnstall
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
and word [ebp - 0x414], 0
mov dword [ebp - 4], eax
mov ecx, ebx
xor eax, eax
lea edi, [ebp - 0x412]
push dword [esi + 0x28]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x414]
push 0x104
push eax
mov ebx, 0x44121c
push 0x444224
mov edi, str.Main
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x414], 0
je 0x417d8b
cmp dword [ebp - 4], 1
jne 0x417d9b
push dword [esi + 0x28]
push 0x445db4
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov eax, dword [esi + 4]
cmp dword [eax + 8], 0
je 0x417dae
push dword [esi + 0x38]
push str.__s_seup.exe___reinstall
jmp 0x417dc3
cmp dword [esi + 0x40], 0
push dword [esi + 0x38]
jne 0x417dbe
push str.__s_seup.exe___install__m
jmp 0x417dc3
push str.__s_seup.exe___install
lea eax, [ebp - 0x20c]
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004210b4
add esp, 0x10
pop edi
pop esi
pop ebx
leave
ret
Function at 0x418240
Capabilities:
Check if file exists
Delete file
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1458
call fcn.0042f680
and word [ebp - 0x410], 0
push ebx
push esi
mov edx, ecx
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x40e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [edx + 4]
mov esi, dword [sym.imp.MSVCRT.dll__snwprintf]
mov ebx, 0x103
push dword [eax + 0x2c]
lea eax, [ebp - 0x410]
push 0x440d94
push ebx
push eax
call esi
and word [ebp - 0x208], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x206]
rep stosd dword es:[edi], eax
add esp, 0x10
stosw word es:[edi], ax
lea eax, [ebp - 0x410]
push eax
push 0x4414dc
lea eax, [ebp - 0x208]
push ebx
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryEmptyW]
test eax, eax
jne 0x418356
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x418356
and word [ebp - 0x1458], 0
mov ecx, 0x411
xor eax, eax
lea edi, [ebp - 0x1456]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x1458]
push 0x823
push eax
push 0x444224
push 0x4414d4
push str.InternetShortcut
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x1458], 0
je 0x418356
lea eax, [ebp - 0x1458]
push eax
push str.http:__avc.360.cn_index.html_a6073
call dword [sym.imp.MSVCRT.dll__wcsicmp]
pop ecx
test eax, eax
pop ecx
jne 0x418356
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41835b
Capabilities:
Check if file exists
Delete file
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x145c
call fcn.0042f680
and word [ebp - 0x414], 0
push ebx
push esi
mov edx, ecx
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x412]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [edx + 4]
mov esi, dword [sym.imp.MSVCRT.dll__snwprintf]
and dword [ebp - 4], 0
mov ebx, 0x103
push dword [eax + 0x2c]
lea eax, [ebp - 0x414]
push 0x440d94
push ebx
push eax
call esi
and word [ebp - 0x20c], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x20a]
rep stosd dword es:[edi], eax
add esp, 0x10
stosw word es:[edi], ax
lea eax, [ebp - 0x414]
push eax
push str._s_
lea eax, [ebp - 0x20c]
push ebx
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryEmptyW]
test eax, eax
jne 0x4184b4
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x418498
and word [ebp - 0x145c], 0
mov ecx, 0x411
xor eax, eax
lea edi, [ebp - 0x145a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x20c]
mov edi, 0x4414d4
push eax
lea eax, [ebp - 0x145c]
push 0x823
push eax
push 0x444224
mov esi, str.InternetShortcut
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x145c], 0
je 0x41848f
lea eax, [ebp - 0x145c]
push eax
push str.http:__www.baidu.com_index.php_tn360se_dg
call dword [sym.imp.MSVCRT.dll__wcsicmp]
pop ecx
test eax, eax
pop ecx
jne 0x41848f
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x20c]
push eax
push str.http:__www.baidu.com_index.php_se360se_dg
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov dword [ebp - 4], 1
jmp 0x4184b4
lea eax, [ebp - 0x20c]
push eax
push str.http:__www.baidu.com_index.php_se360se_dg
push 0x4414d4
push str.InternetShortcut
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4184bc
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push 1
add ecx, 0x38
pop ebx
push ecx
lea ecx, [ebp - 4]
call fcn.004046e3
xor esi, esi
lea ecx, [ebp - 4]
push esi
push 0x43cbf4
call fcn.00404a64
cmp eax, esi
jle 0x418554
add eax, 2
push edi
push eax
lea eax, [ebp - 8]
push esi
push eax
lea ecx, [ebp - 4]
call fcn.0040cbae
xor eax, eax
lea edi, [ebp - 0x1c]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x18], esi
stosd dword es:[edi], eax
lea edi, [ebp - 0x14]
mov dword [ebp - 0x10], esi
stosd dword es:[edi], eax
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x41854b
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
push 0x14
pop ecx
call fcn.0042f7d0
push str.8.05
mov edi, eax
call dword [sym.imp.MSVCRT.dll__wtoi]
cmp eax, edi
pop ecx
jbe 0x41854b
xor ebx, ebx
lea ecx, [ebp - 8]
call fcn.00404c0d
pop edi
lea ecx, [ebp - 4]
call fcn.00404c0d
mov eax, ebx
pop esi
pop ebx
leave
ret

Function at 0x4188f3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x517c
call fcn.0042f680
mov ecx, dword [ebp + 8]
push esi
call fcn.0041a190
lea eax, [ebp - 8]
xor esi, esi
push eax
push str.SoftwareMicrosoftInternet_ExplorerMain
push SysReAllocStringLen
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x4189dd
push ebx
push edi
mov ecx, 0x1459
lea edi, [ebp - 0x517a]
mov word [ebp - 0x517c], si
mov dword [ebp - 0x10], 0x28b3
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x517c]
push eax
push esi
push esi
push str.Secondary_Start_Pages
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4189d2
mov esi, dword [ebp - 0x10]
lea ebx, [ebp - 0x517c]
shr esi, 1
dec esi
test esi, esi
jle 0x4189d2
lea eax, [ebp - 0x517a]
mov edi, 0x440e74
mov dword [ebp - 0xc], eax
mov ax, word [ebx]
test ax, ax
je 0x41899c
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 1
jmp 0x4189bc
mov eax, dword [ebp - 4]
inc eax
cmp eax, esi
jge 0x4189c4
mov eax, dword [ebp - 0xc]
cmp word [eax], 0
je 0x4189c4
mov eax, edi
test eax, eax
je 0x4189ba
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push edi
push eax
mov ecx, dword [ebp + 8]
call fcn.00404d28
inc dword [ebp - 4]
add dword [ebp - 0xc], 2
inc ebx
inc ebx
cmp dword [ebp - 4], esi
jl 0x418989
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
pop esi
leave
ret 4
Function at 0x418af1
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
and word [ebp - 0x414], 0
push ebx
push esi
mov edx, ecx
push edi
mov ecx, 0x81
push dword [edx + 0x38]
xor eax, eax
lea edi, [ebp - 0x412]
mov esi, dword [sym.imp.MSVCRT.dll__snwprintf]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ebx, 0x103
push str.__s_seup.exe___delv3cfg
lea eax, [ebp - 0x414]
push ebx
push eax
mov dword [ebp - 4], edx
call esi
and word [ebp - 0x20c], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x20a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp - 4]
add esp, 0x10
push dword [eax + 0x38]
lea eax, [ebp - 0x20c]
push str.__s_seup.exe_
push ebx
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop edi
pop esi
test eax, eax
pop ebx
je 0x418b98
push 0
push 0xbb8
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.004210b4
add esp, 0x10
leave
ret

Function at 0x418b9a
Capabilities:
Check if file exists
Delete file
Get common file path
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push edi
xor edx, edx
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x206]
mov word [ebp - 0x208], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push edx
lea eax, [ebp - 0x208]
push 0x1a
push eax
push edx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
pop edi
je 0x418c2c
lea eax, [ebp - 0x208]
push str.360se
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x418c2c
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x418c2c
test al, 0x10
jne 0x418c2c
lea eax, [ebp - 0x208]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
leave
ret
Function at 0x418c2e
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
add ecx, 0x30
push str._v3update_
lea eax, [ebp - 0xc]
push ecx
push eax
call fcn.0041a27c
lea eax, [ebp - 0xc]
push str.v3update.ini
push eax
lea eax, [ebp - 4]
push eax
call fcn.0041a27c
lea eax, [ebp - 0xc]
push str.v3update.ini.bak
push eax
lea eax, [ebp - 8]
push eax
call fcn.0041a27c
push dword [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
call esi
push dword [ebp - 4]
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
call edi
test eax, eax
je 0x418cab
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x418ca6
test al, 0x10
jne 0x418ca6
push 0x80
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call edi
test eax, eax
je 0x418cd6
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.00421aee
pop ecx
pop ecx
push dword [ebp - 8]
call esi
test eax, eax
jne 0x418cd6
push 4
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea ecx, [ebp - 8]
call fcn.00404c0d
lea ecx, [ebp - 4]
call fcn.00404c0d
lea ecx, [ebp - 0xc]
call fcn.00404c0d
pop edi
pop esi
leave
ret

Function at 0x418cf2
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2090
call fcn.0042f680
push esi
mov esi, ecx
push str.3.9.1.5
mov eax, dword [esi + 0x20]
push eax
call fcn.0042157a
pop ecx
test eax, eax
pop ecx
jl 0x418d53
mov eax, dword [esi + 0x20]
push str.4.0.0.0
push eax
call fcn.0042157a
pop ecx
test eax, eax
pop ecx
jle 0x418d3e
mov eax, dword [esi + 0x20]
push str.4.0.0.9
push eax
call fcn.0042157a
pop ecx
test eax, eax
pop ecx
jl 0x418d53
push dword [ebp + 0xc]
mov ecx, 0x4441f0
push dword [ebp + 8]
call fcn.0040411f
jmp 0x418df7
and word [ebp - 0x2090], 0
push ebx
push edi
mov ecx, 0x823
xor eax, eax
lea edi, [ebp - 0x208e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esi + 0x24]
mov ebx, str.HomePage
test eax, eax
mov edi, str.option
je 0x418da7
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x418da7
lea eax, [ebp - 0x2090]
push 0x1047
push eax
push ebx
push edi
mov ecx, 0x4441f0
push dword [esi + 0x24]
push 0
call fcn.00403195
cmp word [ebp - 0x2090], 0
jne 0x418dda
push dword [esi + 0x28]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x418dda
push dword [esi + 0x28]
lea eax, [ebp - 0x2090]
push 0x1047
push eax
push 0x444224
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x2090]
push eax
push 0x43bb18
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
pop edi
pop ebx
pop esi
leave
ret 8
Function at 0x418e5a
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [ebp + 8]
cmp dword [eax - 8], 0
je 0x418f50
lea eax, [ebp + 8]
push str._skin.ini
push eax
add ecx, 0x38
push str.Skin_
lea eax, [ebp - 0xc]
push ecx
push eax
call fcn.0041a27c
push eax
lea eax, [ebp - 8]
push eax
call fcn.0041a23b
push eax
lea eax, [ebp - 4]
push eax
call fcn.0041a27c
lea ecx, [ebp - 8]
call fcn.00404c0d
lea ecx, [ebp - 0xc]
call fcn.00404c0d
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x418f48
and word [ebp - 0x214], 0
push ebx
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x212]
push dword [ebp - 4]
rep stosd dword es:[edi], eax
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x103
stosw word es:[edi], ax
lea eax, [ebp - 0x214]
mov ebx, 0x444224
push eax
push ebx
mov edi, str.General
push 0x4417a0
push edi
call esi
cmp word [ebp - 0x214], 0
jne 0x418f26
push dword [ebp - 4]
lea eax, [ebp - 0x214]
push 0x103
push eax
push ebx
push str.TheWorld
push edi
call esi
cmp word [ebp - 0x214], 0x33
pop edi
pop esi
pop ebx
jne 0x418f48
lea ecx, [ebp - 4]
call fcn.00404c0d
lea ecx, [ebp + 8]
call fcn.00404c0d
push 1
pop eax
jmp 0x418f5a
lea ecx, [ebp - 4]
call fcn.00404c0d
lea ecx, [ebp + 8]
call fcn.00404c0d
xor eax, eax
leave
ret 4
Function at 0x419342
Capabilities:
Enumerate files on windows

Disassembly:
mov eax, 0x432bb0
call fcn.0042f740
sub esp, 0x490
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov ebx, ecx
or dword [ebp - 0x474], 0xffffffff
xor esi, esi
mov word [ebp - 0x220], si
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x21e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x44190c
push dword [ebx + 0x38]
push str._sSkin_s
push 0x103
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x14
mov word [ebp - 0x1a], si
mov dword [ebp - 4], esi
lea eax, [ebp - 0x470]
push eax
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
mov dword [ebp - 0x474], edi
cmp edi, 0xffffffff
je 0x419463
mov esi, dword [sym.imp.MSVCRT.dll_wcscmp]
push 0x43ce9c
lea eax, [ebp - 0x444]
push eax
call esi
pop ecx
pop ecx
test eax, eax
je 0x419446
push 0x4418ec
lea eax, [ebp - 0x444]
push eax
call esi
pop ecx
pop ecx
test eax, eax
je 0x419446
test byte [ebp - 0x470], 0x10
je 0x419446
push ecx
mov ecx, esp
lea eax, [ebp - 0x444]
push eax
call fcn.00404729
mov ecx, ebx
call fcn.00418e5a
test eax, eax
je 0x419446
lea eax, [ebp - 0x444]
push eax
lea ecx, [ebp - 0x480]
call fcn.00404729
lea eax, [ebp - 0x480]
push eax
mov ecx, dword [ebp + 8]
call fcn.0041a130
lea ecx, [ebp - 0x480]
call fcn.00404c0d
lea eax, [ebp - 0x470]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4193cf
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
or dword [ebp - 0x474], 0xffffffff
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 4