joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49e730
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x4e5161
call fcn.004d0500
sub esp, 0x38
push dword [ebp + 8]
mov dword [ebp - 0x10], ecx
call dword [0x4eaadc]
test eax, eax
jne 0x49e754
xor al, al
jmp 0x49e886
push ebx
push esi
lea ecx, [ebp - 0x44]
call fcn.0040ef83
xor esi, esi
push esi
push esi
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], esi
call fcn.0040f4aa
push dword [ebp + 8]
lea ecx, [ebp - 0x44]
call fcn.0040f500
test al, al
lea ecx, [ebp - 0x40]
jne 0x49e78b
call fcn.0040dea8
xor bl, bl
jmp 0x49e876
push edi
call fcn.0040dea8
lea ecx, [ebp - 0x44]
call fcn.00446d5c
mov edi, eax
mov dword [ebp - 0x18], edi
cmp edi, esi
mov byte [ebp - 4], 1
jne 0x49e7ad
xor bl, bl
jmp 0x49e875
lea ecx, [edi + 0x30]
call dword [0x4ea4e0]
cmp eax, esi
je 0x49e868
push str.auto_thunder_skin
push eax
call fcn.004d06fe
test eax, eax
pop ecx
pop ecx
jne 0x49e868
lea ecx, [edi + 0x80]
call fcn.0045fdf8
cmp eax, esi
mov dword [ebp - 0x14], eax
mov dword [ebp + 8], esi
jbe 0x49e856
push dword [ebp + 8]
mov ecx, edi
call fcn.0040e6ef
mov esi, eax
mov dword [ebp - 0x1c], esi
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call dword [0x4ea4e0]
mov ebx, eax
push str.info
push ebx
call fcn.004d06fe
test eax, eax
pop ecx
pop ecx
jne 0x49e822
mov ecx, dword [ebp - 0x10]
push esi
call fcn.0049d4f6
jmp 0x49e83c
push str.skin_package_list
push ebx
call fcn.004d06fe
test eax, eax
pop ecx
pop ecx
jne 0x49e83c
mov ecx, dword [ebp - 0x10]
push esi
call fcn.0049e6ab
test esi, esi
mov byte [ebp - 4], 1
je 0x49e84b
mov ecx, esi
call fcn.0040d957
inc dword [ebp + 8]
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 0x14]
jb 0x49e7e8
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0xb0]
mov eax, dword [ecx]
call dword [eax + 4]
mov bl, 1
jmp 0x49e86a
xor bl, bl
mov ecx, edi
mov byte [ebp - 4], 0
call fcn.0040d957
pop edi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
call fcn.0040ea10
pop esi
mov al, bl
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret 4

Function at 0x49e8c0
Capabilities:
Check if file exists

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
cmp edi, 1
mov esi, ecx
jl 0x49e90d
cmp byte [esi + 0xa5], 0
jne 0x49e8f1
lea ecx, [esi + 0x40]
call dword [0x4ea6a4]
push eax
call dword [0x4eaadc]
test eax, eax
je 0x49e8f1
mov ecx, esi
call fcn.0049e894
lea ecx, [esi + 0x78]
call fcn.0045fdf8
test eax, eax
je 0x49e90d
lea ecx, [esi + 0xc8]
dec edi
call fcn.0045fdf8
cmp edi, eax
jl 0x49e911
xor eax, eax
jmp 0x49e922
mov eax, dword [esi + 0xcc]
lea eax, [eax + edi*4]
mov eax, dword [eax]
inc dword [eax + 0x108]
pop edi
pop esi
ret 4
Function at 0x4a1a6a
Capabilities:
Check if file exists
Create directory

Disassembly:
mov eax, 0x4e5514
call fcn.004d0500
sub esp, 0x248
mov eax, dword [0x52d320]
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
xor eax, ebp
test edi, edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x254], ecx
jne 0x4a1a9d
xor al, al
jmp 0x4a1bb0
push esi
mov esi, dword [0x4eaadc]
push ebx
call esi
test eax, eax
jne 0x4a1ab2
xor al, al
jmp 0x4a1baf
lea ecx, [ebp - 0x234]
call dword [0x4ea6b0]
and dword [ebp - 4], 0
lea ecx, [ebp - 0x250]
call dword [0x4ea6b0]
lea eax, [ebp - 0x250]
push eax
push edi
mov byte [ebp - 4], 1
call fcn.004d05da
pop ecx
push eax
push edi
call fcn.0044f5c2
add esp, 0xc
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x250]
call dword [0x4ea6a4]
mov ecx, dword [ebp - 0x254]
push eax
call fcn.004a1a11
lea ecx, [ebp - 0x234]
call dword [0x4ea6a4]
push eax
call esi
test eax, eax
je 0x4a1b37
lea ecx, [ebp - 0x234]
call dword [0x4ea6a4]
push eax
call dword [0x4ea364]
test eax, eax
jne 0x4a1b37
xor bl, bl
jmp 0x4a1b8d
push 0x4eb254
lea ecx, [ebp - 0x234]
call dword [0x4ea6a4]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [0x4eaad8]
lea eax, [ebp - 0x218]
push eax
call dword [0x4eaaa8]
lea eax, [ebp - 0x218]
push eax
call dword [0x4ea860]
pop ecx
push 0
lea ecx, [ebp - 0x234]
call dword [0x4ea6a4]
push eax
push ebx
call dword [0x4ea36c]
test eax, eax
je 0x4a1b33
mov bl, 1
lea ecx, [ebp - 0x250]
mov byte [ebp - 4], 0
call dword [0x4ea4f8]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x234]
call dword [0x4ea4f8]
mov al, bl
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop edi
xor ecx, ebp
pop ebx
call fcn.004d0557
leave
ret 8

Function at 0x4a1bca
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x4e5530
call fcn.004d0500
sub esp, 0x3c
mov eax, dword [0x52d320]
push esi
mov esi, dword [ebp + 8]
xor eax, ebp
test esi, esi
push edi
mov dword [ebp - 0x10], eax
mov edi, ecx
jne 0x4a1bf3
xor al, al
jmp 0x4a1c83
push ebx
lea ecx, [ebp - 0x2c]
call dword [0x4ea6b0]
and dword [ebp - 4], 0
lea ecx, [ebp - 0x48]
call dword [0x4ea6b0]
lea eax, [ebp - 0x48]
push eax
push esi
mov byte [ebp - 4], 1
call fcn.004d05da
pop ecx
push eax
push esi
call fcn.0044f5c2
add esp, 0xc
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x48]
call dword [0x4ea6a4]
push eax
mov ecx, edi
call fcn.004a1a11
lea ecx, [ebp - 0x2c]
call dword [0x4ea6a4]
push eax
call dword [0x4eaadc]
test eax, eax
je 0x4a1c64
lea ecx, [ebp - 0x2c]
call dword [0x4ea6a4]
push eax
call dword [0x4ea364]
test eax, eax
jne 0x4a1c64
xor bl, bl
jmp 0x4a1c66
mov bl, 1
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0
call dword [0x4ea4f8]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call dword [0x4ea4f8]
mov al, bl
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop edi
xor ecx, ebp
pop esi
call fcn.004d0557
leave
ret 4
Function at 0x4a2c6f
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x4e56a3
call fcn.004d0500
sub esp, 0x64
mov eax, dword [0x52d320]
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, ebp
push edi
mov dword [ebp - 0x10], eax
mov esi, ecx
call dword [0x4eaad4]
test eax, eax
mov dword [ebp - 0x6c], eax
jne 0x4a2ca2
xor al, al
jmp 0x4a2ddf
push ebx
mov ecx, esi
call fcn.004a2772
mov ebx, eax
mov dword [ebp - 0x70], ebx
and dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call dword [0x4ea6b0]
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 1
call dword [0x4ea6b0]
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.004a2588
test eax, eax
mov dword [ebp - 0x68], eax
je 0x4a2d00
lea ecx, [ebp - 0x2c]
push ecx
push eax
call fcn.004d05da
pop ecx
push eax
push dword [ebp - 0x68]
call fcn.0044f5c2
add esp, 0xc
push 0x4eb7e4
lea ecx, [ebp - 0x2c]
call dword [0x4ea734]
push str.thumbnail
lea ecx, [ebp - 0x2c]
call dword [0x4ea734]
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x2c]
call dword [0x4ea734]
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x2c]
call dword [0x4ea6a4]
mov ecx, dword [esi + 0xc]
push eax
call fcn.004a1a11
lea ecx, [ebp - 0x48]
call dword [0x4ea6a4]
push eax
call dword [0x4eaadc]
test eax, eax
je 0x4a2d54
lea ecx, [ebp - 0x48]
call dword [0x4ea6a4]
push eax
call dword [0x4ea364]
push 0x32
push 0x4d
lea ecx, [ebp - 0x48]
call dword [0x4ea6a4]
push eax
push edi
call fcn.004aee27
mov ecx, eax
call fcn.004af124
lea ecx, [ebp - 0x64]
call dword [0x4ea6d4]
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 0x18]
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 3
call dword [0x4ea6a4]
push eax
call fcn.0044f54c
add esp, 0xc
lea ecx, [ebp - 0x64]
call dword [0x4ea4e0]
push eax
mov ecx, ebx
call fcn.0040ee6a
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 2
call dword [0x4ea4dc]
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 1
call dword [0x4ea4f8]
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call dword [0x4ea4f8]
or dword [ebp - 4], 0xffffffff
test ebx, ebx
je 0x4a2ddc
mov ecx, ebx
call fcn.0040d957
mov al, 1
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop edi
xor ecx, ebp
pop esi
call fcn.004d0557
leave
ret 4

Function at 0x4a2fad
Capabilities:
Create directory

Disassembly:
mov eax, 0x4e56fe
call fcn.004d0500
push esi
push dword [ebp + 8]
mov esi, ecx
call dword [0x4ea860]
test eax, eax
pop ecx
je 0x4a2fd7
call dword [0x4ea938]
cmp dword [eax], 0x11
je 0x4a2fd7
xor al, al
jmp 0x4a304c
push edi
push dword [ebp + 8]
lea edi, [esi + 0xc]
mov ecx, edi
call dword [0x4ea730]
push edi
lea ecx, [esi + 0x28]
call dword [0x4ea4e8]
push 0x94
call fcn.004d00ba
pop ecx
mov ecx, eax
mov dword [ebp + 8], ecx
and dword [ebp - 4], 0
test ecx, ecx
je 0x4a3018
push 0
push str.thunder_skin
call fcn.0040e8b7
mov edi, eax
jmp 0x4a301a
xor edi, edi
mov dword [ebp + 8], edi
lea eax, [ebp + 8]
push eax
lea ecx, [esi + 0x44]
mov dword [ebp - 4], 1
call fcn.0049f1a0
mov ecx, dword [esi + 0x48]
push 0
call fcn.004a2ac3
or dword [ebp - 4], 0xffffffff
test edi, edi
je 0x4a3049
mov ecx, edi
call fcn.0040d957
mov al, 1
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x4a4510
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x52d320]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
xor eax, ebp
test esi, esi
mov dword [ebp - 4], eax
je 0x4a4594
push esi
call dword [0x4eaadc]
test eax, eax
je 0x4a4594
push esi
call dword [0x4eaac8]
test eax, eax
jne 0x4a4594
push edi
lea eax, [ebp - 0x14]
push eax
push esi
call fcn.004d1d1f
and word [ebp - 0x64], 0
pop ecx
pop ecx
push 0x13
xor eax, eax
pop ecx
lea edi, [ebp - 0x62]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edi, [ebp - 0x64]
xor esi, esi
movzx eax, byte [ebp + esi - 0x14]
push eax
push str._02X
push edi
call dword [0x4ea838]
add esp, 0xc
add edi, 4
inc esi
cmp esi, 0x10
jl 0x4a4565
lea eax, [ebp - 0x64]
push eax
mov ecx, ebx
call dword [0x4ea730]
mov al, 1
pop edi
jmp 0x4a4596
xor al, al
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004d0557
leave
ret
Function at 0x4a4772
Capabilities:
Delete file

Disassembly:
mov eax, 0x4e5858
call fcn.004d0500
sub esp, 0x7c
mov eax, dword [0x52d320]
push ebx
mov ebx, dword [ebp + 8]
xor eax, ebp
push esi
mov esi, ecx
mov dword [ebp - 0x10], eax
mov eax, dword [esi]
cmp eax, 3
je 0x4a479c
cmp eax, 2
jne 0x4a47b9
mov ecx, dword [esi + 0x9c]
mov eax, dword [esi + 0x98]
jmp 0x4a47b1
cmp dword [eax], ebx
je 0x4a47b5
add eax, 4
cmp eax, ecx
jne 0x4a47aa
cmp eax, ecx
jne 0x4a47c0
xor al, al
jmp 0x4a491f
push edi
push eax
lea eax, [ebp - 0x68]
push eax
lea ecx, [esi + 0x94]
call fcn.00411427
mov ecx, ebx
call fcn.004a5963
test eax, eax
mov dword [ebp - 0x68], eax
je 0x4a47fc
lea edi, [esi + 0xa4]
mov ecx, dword [edi]
push eax
call fcn.004a2474
mov ecx, dword [edi]
call fcn.004a2a28
mov ecx, dword [ebp - 0x68]
call fcn.00494481
mov ecx, ebx
call fcn.004a51ec
mov ecx, ebx
call fcn.004a4d9d
test eax, eax
je 0x4a490a
lea ecx, [ebp - 0x64]
call dword [0x4ea6b0]
xor edi, edi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], edi
call dword [0x4ea6b0]
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 1
call dword [0x4ea6d4]
lea eax, [ebp - 0x48]
push eax
mov ecx, ebx
mov byte [ebp - 4], 2
call fcn.004a4d9d
push eax
call fcn.004a4cd9
pop ecx
pop ecx
lea eax, [ebp - 0x64]
push eax
mov ecx, ebx
call fcn.004a4d9d
push eax
call fcn.004d05da
pop ecx
push eax
lea ecx, [ebp - 0x48]
call dword [0x4ea4e0]
push eax
call fcn.0044f8f4
add esp, 0xc
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x64]
call dword [0x4ea6a4]
mov ecx, dword [esi + 0xa4]
push eax
call fcn.004a1a11
push edi
lea ecx, [ebp - 0x2c]
call dword [0x4ea480]
cmp dword [ebp - 0x18], edi
jbe 0x4a48e3
push 6
pop ecx
xor eax, eax
lea edi, [ebp - 0x84]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor esi, esi
lea ecx, [ebp - 0x2c]
mov word [ebp - 0x78], 0x414
mov dword [ebp - 0x72], esi
mov dword [ebp - 0x88], esi
mov dword [ebp - 0x6e], esi
call dword [0x4ea6a4]
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x88]
push eax
mov dword [ebp - 0x7c], esi
mov dword [ebp - 0x84], 3
call dword [0x4eaa78]
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 1
call dword [0x4ea4dc]
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call dword [0x4ea4f8]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x64]
call dword [0x4ea4f8]
test ebx, ebx
pop edi
je 0x4a491d
mov ecx, ebx
call fcn.004a565f
push ebx
call fcn.004d04f4
pop ecx
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
xor ecx, ebp
pop ebx
call fcn.004d0557
leave
ret 4
Function at 0x4a4aeb
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x4e58ce
call fcn.004d0500
sub esp, 0x44
mov eax, dword [0x52d320]
push esi
mov esi, ecx
mov ecx, dword [esi + 0xa4]
xor eax, ebp
push edi
mov dword [ebp - 0x10], eax
call fcn.004a1c9d
mov edi, eax
push edi
call dword [0x4eaac8]
test eax, eax
je 0x4a4b25
xor al, al
jmp 0x4a4c1a
push edi
call dword [0x4eaadc]
test eax, eax
je 0x4a4b37
push edi
call dword [0x4ea364]
push ebx
lea ecx, [ebp - 0x48]
call dword [0x4ea6d4]
lea eax, [ebp - 0x48]
push eax
xor ebx, ebx
push edi
mov dword [ebp - 4], ebx
call dword [0x4ea7b4]
pop ecx
push eax
push edi
call fcn.0044f87c
add esp, 0xc
push ebx
lea ecx, [ebp - 0x48]
call dword [0x4ea4e0]
push eax
call sub.minizip.dll_zipOpen
mov edi, dword [esi + 0x98]
mov dword [ebp - 0x4c], eax
mov eax, dword [esi + 0x9c]
cmp edi, eax
pop ecx
pop ecx
mov dword [ebp - 0x50], eax
je 0x4a4b96
push dword [ebp - 0x4c]
mov ecx, dword [edi]
call fcn.004a6ecb
add edi, 4
cmp edi, dword [ebp - 0x50]
jne 0x4a4b84
push 0xffffffffffffffff
push 8
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push str.skin.xml
push dword [ebp - 0x4c]
call sub.minizip.dll_zipOpenNewFileInZip
mov ecx, dword [esi + 0xa4]
add esp, 0x28
call fcn.004a2159
lea ecx, [ebp - 0x2c]
mov esi, eax
call dword [0x4ea6d4]
lea eax, [ebp - 0x2c]
push eax
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.0040ee28
push dword [ebp - 0x18]
lea ecx, [ebp - 0x2c]
call dword [0x4ea4e0]
push eax
push dword [ebp - 0x4c]
call sub.minizip.dll_zipWriteInFileInZip
push dword [ebp - 0x4c]
call sub.minizip.dll_zipCloseFileInZip
push ebx
push dword [ebp - 0x4c]
call sub.minizip.dll_zipClose
add esp, 0x18
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], bl
call dword [0x4ea4dc]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call dword [0x4ea4dc]
mov al, 1
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop edi
xor ecx, ebp
pop esi
call fcn.004d0557
leave
ret

Function at 0x4a6e03
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x4e5b45
call fcn.004d0500
sub esp, 0x24
mov eax, dword [0x52d320]
push ebx
push esi
xor eax, ebp
mov dword [ebp - 0x30], ecx
push edi
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x10], eax
call dword [0x4ea6d4]
and dword [ebp - 4], 0
lea eax, [ebp - 0x2c]
push eax
push edi
call dword [0x4ea7b4]
pop ecx
push eax
push edi
call fcn.0044f87c
add esp, 0xc
push 0
lea ecx, [ebp - 0x2c]
call dword [0x4ea4e0]
push eax
call sub.minizip.dll_zipOpen
mov esi, eax
test esi, esi
pop ecx
pop ecx
jne 0x4a6e63
xor bl, bl
jmp 0x4a6ea1
mov ecx, dword [ebp - 0x30]
push esi
call fcn.004a6bdc
mov bl, al
test bl, bl
je 0x4a6e7d
mov ecx, dword [ebp - 0x30]
push esi
call fcn.004a6d09
mov bl, al
push 0
push esi
call sub.minizip.dll_zipClose
test bl, bl
pop ecx
pop ecx
jne 0x4a6e9f
push edi
call dword [0x4eaadc]
test eax, eax
je 0x4a6e5f
push edi
call dword [0x4ea364]
jmp 0x4a6e5f
mov bl, 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call dword [0x4ea4dc]
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.004d0557
leave
ret 4
Function at 0x4aa501
Capabilities:
Create thread

Disassembly:
mov eax, 0x4e5de4
call fcn.004d0500
push ecx
push ecx
mov eax, dword [0x4eac50]
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esi + 4], edi
mov dword [esi + 0x14], edi
mov dword [ebp - 0x10], esi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], eax
mov dword [esi], vtable.HttpDownloader.0
mov dword [ebp - 4], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
lea ecx, [esi + 0x38]
mov byte [ebp - 4], 1
call fcn.004076aa
push edi
push ecx
mov eax, esp
mov dword [ebp - 0x10], esp
push edi
push closesocket
push edi
push ecx
lea ebx, [esi + 0x50]
mov dword [ebx], edi
mov dword [eax], edi
mov eax, esp
mov dword [ebp - 0x10], esp
push 0xfffffffffffffffd
mov ecx, esi
mov dword [eax], edi
call fcn.004a9c41
push edi
push edi
push 1
push edi
mov ecx, ebx
call fcn.004a994b
lea eax, [ebp - 0x14]
push eax
push edi
push esi
push 0x4aa4f5
push edi
push edi
call dword [0x4ea7f8]
add esp, 0x18
push eax
call dword [0x4ea2b4]
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x4ac12d
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4e5f7a
call fcn.004d0500
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov byte [esi], bl
mov dword [ebp - 0x10], esi
mov dword [esi + 4], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 8], ebx
push dword [ebp + 8]
lea ecx, [esi + 0xc]
mov byte [ebp - 4], 1
call dword [0x4ea4e4]
or dword [esi + 0x2c], 0xffffffff
mov dword [esi + 0x28], ebx
mov word [esi + 0x30], bx
mov word [esi + 0x32], bx
mov word [esi + 0x34], bx
mov byte [esi + 0x36], bl
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x4b19e0
Capabilities:
Parse pe header

Disassembly:
push 0x2c
push 0x4fddd8
call fcn.004d0664
push 0x1c
lea eax, [ebp - 0x3c]
push eax
push dword [ebp + 8]
call dword [0x4ea1cc]
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x1c], ecx
cmp word [ecx], 0x5a4d
jne 0x4b1a4c
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov dword [ebp - 0x20], eax
cmp dword [eax], 0x4550
je 0x4b1a24
xor al, al
or dword [ebp - 4], 0xffffffff
jmp 0x4b1a52
mov edx, dword [eax + 0xd8]
lea esi, [edx + ecx]
cmp dword [ebp + 0xc], esi
jb 0x4b1a1c
mov eax, dword [eax + 0xdc]
add eax, edx
add eax, ecx
cmp dword [ebp + 0xc], eax
jae 0x4b1a1c
mov al, 1
jmp 0x4b1a1e
or dword [ebp - 4], 0xffffffff
xor al, al
call fcn.004d069f
ret
Function at 0x4b1b54
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
mov esi, eax
cmp esi, 0x7ff80000
push edi
mov ebx, 0x10000
jbe 0x4b1b77
lea eax, [esi - 0x7ff80000]
mov dword [ebp - 4], eax
jmp 0x4b1b7a
mov dword [ebp - 4], ebx
cmp esi, 0x80000000
jae 0x4b1b8d
lea eax, [esi + 0x7ff80000]
mov dword [ebp - 8], eax
jmp 0x4b1b94
mov dword [ebp - 8], 0xfff80000
mov eax, dword [0x533c64]
test eax, eax
mov ecx, dword [0x533c60]
jne 0x4b1bae
test ecx, ecx
je 0x4b1bc3
mov eax, ecx
mov dword [0x533c64], eax
mov edx, dword [eax + 8]
test edx, edx
je 0x4b1bc3
cmp edx, dword [ebp - 4]
jb 0x4b1bc3
cmp edx, dword [ebp - 8]
jbe 0x4b1c97
mov eax, ecx
test ecx, ecx
jmp 0x4b1be7
test eax, eax
je 0x4b1be2
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x4b1be2
cmp ecx, dword [ebp - 4]
jb 0x4b1be2
cmp ecx, dword [ebp - 8]
jbe 0x4b1c97
mov eax, dword [eax + 4]
test eax, eax
mov dword [0x533c64], eax
jne 0x4b1bc9
mov eax, esi
and eax, 0xffff
sub esi, eax
cmp esi, dword [ebp - 4]
mov edi, esi
jbe 0x4b1d32
cmp edi, 0x70000000
jb 0x4b1c17
cmp edi, 0x80000000
ja 0x4b1c17
mov edi, 0x6fff0000
push 0x1c
lea eax, [ebp - 0x40]
push eax
push edi
call dword [0x4ea1cc]
test eax, eax
je 0x4b1d32
cmp dword [ebp - 0x30], ebx
jne 0x4b1c36
cmp dword [ebp - 0x34], ebx
jae 0x4b1c49
mov edi, dword [ebp - 0x3c]
add edi, 0xffff0000
cmp edi, dword [ebp - 4]
ja 0x4b1c02
jmp 0x4b1d32
push 0x40
push 0x3000
push ebx
push edi
call dword [0x4ea1a8]
test eax, eax
mov dword [0x533c64], eax
je 0x4b1d32
mov ecx, dword [0x533c60]
xor edx, edx
mov dword [eax + 4], ecx
mov dword [eax], 0x52727464
mov dword [eax + 8], edx
mov dword [0x533c60], eax
lea ecx, [eax + 0xffe0]
mov esi, 0x7fd
mov dword [ecx + 0x18], edx
mov edx, ecx
sub ecx, 0x20
dec esi
jne 0x4b1c89
mov dword [eax + 8], edx
mov esi, dword [eax + 8]
cmp esi, dword [ebp - 4]
jb 0x4b1d37
cmp esi, dword [ebp - 8]
ja 0x4b1d37
mov ecx, dword [esi + 0x18]
push 0x20
push 0xcc
push esi
mov dword [eax + 8], ecx
call fcn.004d05b6
add esp, 0xc
mov eax, esi
jmp 0x4b1d39
cmp esi, 0x70000000
jb 0x4b1cdb
cmp esi, 0x80000000
ja 0x4b1cdb
mov esi, 0x80010000
push 0x1c
lea eax, [ebp - 0x24]
push eax
push esi
call dword [0x4ea1cc]
test eax, eax
je 0x4b1d37
cmp dword [ebp - 0x14], ebx
jne 0x4b1d29
cmp dword [ebp - 0x18], ebx
jb 0x4b1d29
mov ecx, esi
and ecx, 0xffff
je 0x4b1d0d
mov eax, ebx
sub eax, ecx
sub dword [ebp - 0x18], eax
add dword [ebp - 0x24], eax
mov esi, dword [ebp - 0x24]
push 0x40
push 0x3000
push ebx
push esi
call dword [0x4ea1a8]
test eax, eax
mov dword [0x533c64], eax
jne 0x4b1c65
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x18]
lea esi, [eax + ecx]
cmp esi, dword [ebp - 8]
jb 0x4b1cc6
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4b1d5f
Capabilities:
Parse pe header

Disassembly:
push 0x28
push 0x4fdde8
call fcn.004d0664
push 0x1c
lea eax, [ebp - 0x38]
push eax
push dword [ebp + 8]
call dword [0x4ea1cc]
test eax, eax
je 0x4b1dba
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x34]
cmp word [ecx], 0x5a4d
jne 0x4b1db6
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov dword [ebp - 0x1c], eax
cmp dword [eax], 0x4550
jne 0x4b1db6
cmp word [eax + 0x14], 0
jne 0x4b1dab
xor eax, eax
or dword [ebp - 4], 0xffffffff
jmp 0x4b1dbc
mov eax, ecx
jmp 0x4b1da5
or dword [ebp - 4], 0xffffffff
xor eax, eax
call fcn.004d069f
ret

Function at 0x4b30ab
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x4e6475
call fcn.004d0500
sub esp, 0x14
push ebx
mov ebx, ecx
push edi
push dword [ebx + 0x10]
mov dword [ebp - 0x18], ebx
call dword [0x4eaadc]
test eax, eax
je 0x4b30d5
push dword [ebx + 0x10]
call dword [0x4ea364]
push 0x94
call fcn.004d00ba
pop ecx
mov dword [ebp - 0x1c], eax
xor edi, edi
cmp eax, edi
mov dword [ebp - 4], edi
je 0x4b30fe
push edi
push str.MsgSys
mov ecx, eax
call fcn.00449ab8
mov dword [ebp - 0x10], eax
jmp 0x4b3101
mov dword [ebp - 0x10], edi
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x10], edi
je 0x4b31d4
mov eax, dword [ebx + 8]
push esi
mov esi, dword [ebx + 4]
cmp esi, eax
mov dword [ebp - 0x1c], eax
je 0x4b31c0
jmp 0x4b3124
xor edi, edi
push 0x94
call fcn.004d00ba
pop ecx
mov dword [ebp - 0x20], eax
cmp eax, edi
mov dword [ebp - 4], 1
je 0x4b314c
push edi
push str.Package
mov ecx, eax
call fcn.00449ab8
mov edi, eax
or dword [ebp - 4], 0xffffffff
test edi, edi
je 0x4b31b4
push dword [esi]
mov ecx, edi
push str.msgid
call fcn.0044b123
lea ecx, [ebp - 0x14]
call fcn.004316a3
push dword [esi + 4]
lea eax, [ebp - 0x14]
push 0x4f032c
push eax
mov dword [ebp - 4], 2
call fcn.00405be2
mov ebx, dword [ebp - 0x14]
add esp, 0xc
push ebx
push str.loadtype
mov ecx, edi
call fcn.0044b123
mov ecx, dword [ebp - 0x10]
push edi
call fcn.00449e04
mov ecx, edi
call fcn.0040d957
or dword [ebp - 4], 0xffffffff
lea ecx, [ebx - 0x10]
call fcn.004015bd
mov ebx, dword [ebp - 0x18]
add esi, 8
cmp esi, dword [ebp - 0x1c]
jne 0x4b3122
push dword [ebx + 0x10]
mov ecx, dword [ebp - 0x10]
call fcn.0048a16c
mov ecx, dword [ebp - 0x10]
call fcn.0040d957
pop esi
mov ecx, dword [ebp - 0xc]
pop edi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x4b3490
Capabilities:
Create thread

Disassembly:
push ecx
push 0
push 0x4b342f
call dword [0x4ea940]
add esp, 0xc
ret

Function at 0x4b4211
Capabilities:
Create thread

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, ecx
lea ecx, [esi + 0x24]
call fcn.004024c4
lea ecx, [esi + 0x2c]
push str.http:__alarm.xl7.sandai.net_thunder7_msgupdate.xml
call fcn.004024c4
xor edi, edi
push edi
push ecx
mov eax, esp
push edi
push closesocket
push edi
push ecx
mov dword [eax], edi
mov eax, esp
push edi
mov ecx, esi
mov dword [eax], edi
call fcn.004b3746
lea eax, [esi + 0x3c]
push eax
call dword [0x4ea34c]
push edi
push 0xff
push edi
push edi
call dword [0x4ea3d0]
push esi
push edi
push 0x4b4020
mov dword [esi + 0x54], eax
call dword [0x4ea940]
add esp, 0xc
pop edi
pop esi
ret 4