Function at 0x49b540
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x20
mov eax, 0x50fdd9
call fcn.004d02ab
lea eax, [ebp - 0x18]
push eax
call fcn.0040df3e
xor ebx, ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x10]
push eax
call fcn.0040df3e
mov byte [ebp - 4], 1
lea eax, [ebp - 0x14]
push eax
call fcn.0040df3e
mov byte [ebp - 4], 2
lea esi, [ebp - 0x20]
call fcn.0040d18b
mov byte [ebp - 4], 3
push dword [eax]
lea eax, [ebp - 0x1c]
push eax
call fcn.004022e5
mov byte [ebp - 4], 4
lea eax, [ebp - 0x1c]
lea edi, [ebp - 0x18]
call fcn.00403a2e
mov byte [ebp - 4], 3
lea eax, [ebp - 0x1c]
push eax
call fcn.004025f7
mov byte [ebp - 4], 2
mov ecx, esi
call fcn.004028da
mov eax, dword [ebp - 0x18]
cmp eax, ebx
je 0x49b5be
cmp word [eax], bx
jne 0x49b5e1
push str.ERROR_CHECK_BOOLEX:_IsStrEmpty__LPCTSTR_pathKLive_
push 0xc2
push str..dlgmakeinstallpackdlgSimpleKLivePacker.cpp
push 5
pop ecx
mov dword [ebp + 8], 0x80004005
call fcn.0040ef48
jmp 0x49bc38
lea eax, [ebp - 0x18]
lea edi, [ebp - 0x10]
call fcn.00403a2e
push 0x52a100
mov eax, edi
call fcn.0040d65b
mov eax, edi
lea edi, [ebp - 0x14]
call fcn.00403a2e
push 0x53678c
mov eax, edi
call fcn.0040d65b
lea eax, [ebp - 0x18]
call fcn.004707d9
lea eax, [ebp - 0x10]
call fcn.004707d9
mov eax, edi
call fcn.004707d9
mov edi, dword [ebp + 8]
add edi, 8
mov eax, dword [edi]
cmp eax, ebx
je 0x49b636
cmp word [eax], bx
jne 0x49b642
push str.ERROR_CHECK_BOOLEX:_IsStrEmpty__LPCTSTR_m_pathTemp_res_
push 0xcd
jmp 0x49b5c8
push dword [ebp - 0x18]
call fcn.0040ab08
cmp eax, ebx
pop ecx
mov dword [ebp + 8], eax
jge 0x49b672
push eax
push str.ERROR_CHECK_COM_hr___x:_hr
push 0xd1
push str..dlgmakeinstallpackdlgSimpleKLivePacker.cpp
push 5
pop esi
call fcn.0040f52f
add esp, 0x10
jmp 0x49bc38
push dword [ebp - 0x10]
call fcn.0040ab08
cmp eax, ebx
pop ecx
mov dword [ebp + 8], eax
jge 0x49b68f
push eax
push str.ERROR_CHECK_COM_hr___x:_hr
push 0xd3
jmp 0x49b65d
push dword [ebp - 0x14]
call fcn.0040ab08
cmp eax, ebx
pop ecx
mov dword [ebp + 8], eax
jge 0x49b6ac
push eax
push str.ERROR_CHECK_COM_hr___x:_hr
push 0xd5
jmp 0x49b65d
push ecx
mov eax, esp
mov dword [ebp - 0x24], esp
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.004029d3
mov byte [ebp - 4], 5
push edi
lea eax, [ebp - 0x20]
push eax
call fcn.004029d3
mov byte [ebp - 4], 6
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push str.eventoffline.mht
push ecx
mov ecx, eax
call fcn.0040a149
pop ecx
pop ecx
mov byte [ebp - 4], 7
mov byte [ebp - 4], 8
call fcn.0049d3be
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x20]
call fcn.004028da
push ecx
mov eax, esp
mov dword [ebp - 0x28], esp
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.004029d3
mov byte [ebp - 4], 9
push edi
lea eax, [ebp - 0x20]
push eax
call fcn.004029d3
mov byte [ebp - 4], 0xa
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push str._newbieoffline.mht
push ecx
mov ecx, eax
call fcn.0040a149
pop ecx
pop ecx
mov byte [ebp - 4], 0xb
mov byte [ebp - 4], 0xc
call fcn.0049d3be
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x20]
call fcn.004028da
push ecx
mov eax, esp
mov dword [ebp - 0x28], esp
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.004029d3
mov byte [ebp - 4], 0xd
push edi
lea eax, [ebp - 0x20]
push eax
call fcn.004029d3
mov byte [ebp - 4], 0xe
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push str.offline.mht
push ecx
mov ecx, eax
call fcn.0040a149
pop ecx
pop ecx
mov byte [ebp - 4], 0xf
mov byte [ebp - 4], 0x10
call fcn.0049d3be
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x20]
call fcn.004028da
push ecx
mov eax, esp
mov dword [ebp - 0x28], esp
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.004029d3
mov byte [ebp - 4], 0x11
push edi
lea eax, [ebp - 0x20]
push eax
call fcn.004029d3
mov byte [ebp - 4], 0x12
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push str._familialoffline.mht
push ecx
mov ecx, eax
call fcn.0040a149
pop ecx
pop ecx
mov byte [ebp - 4], 0x13
mov byte [ebp - 4], 0x14
call fcn.0049d3be
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x20]
call fcn.004028da
push ecx
mov eax, esp
mov dword [ebp - 0x28], esp
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.004029d3
mov byte [ebp - 4], 0x15
push edi
lea eax, [ebp - 0x20]
push eax
call fcn.004029d3
mov byte [ebp - 4], 0x16
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push str._reloginoffline.mht
push ecx
mov ecx, eax
call fcn.0040a149
pop ecx
pop ecx
mov byte [ebp - 4], 0x17
mov byte [ebp - 4], 0x18
call fcn.0049d3be
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x20]
call fcn.004028da
push ecx
mov eax, esp
mov dword [ebp - 0x28], esp
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.004029d3
mov byte [ebp - 4], 0x19
push edi
lea eax, [ebp - 0x20]
push eax
call fcn.004029d3
mov byte [ebp - 4], 0x1a
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push 0x53c714
push ecx
mov ecx, eax
call fcn.0040a149
pop ecx
pop ecx
mov byte [ebp - 4], 0x1b
mov byte [ebp - 4], 0x1c
call fcn.0049d3be
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x20]
call fcn.004028da
push ecx
mov eax, esp
mov dword [ebp - 0x28], esp
lea ecx, [ebp - 0x10]
push ecx
push eax
call fcn.004029d3
mov byte [ebp - 4], 0x1d
push edi
lea eax, [ebp - 0x20]
push eax
call fcn.004029d3
mov byte [ebp - 4], 0x1e
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push str.klive.dll
push ecx
mov ecx, eax
call fcn.0040a149
pop ecx
pop ecx
mov byte [ebp - 4], 0x1f
mov byte [ebp - 4], 0x20
call fcn.0049d3be
mov esi, eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x20]
call fcn.004028da
cmp esi, ebx
jne 0x49b8f1
push str.ERROR_CHECK_BOOLEX:bCheck
push 0xe5
jmp 0x49b5c8
push ecx
mov eax, esp
mov dword [ebp - 0x28], esp
lea ecx, [ebp - 0x10]
push ecx
push eax
call fcn.004029d3
mov byte [ebp - 4], 0x21
push edi
lea eax, [ebp - 0x20]
push eax
call fcn.004029d3
mov byte [ebp - 4], 0x22
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push str.kliveshellext.dll
push ecx
mov ecx, eax
call fcn.0040a149
pop ecx
pop ecx
mov byte [ebp - 4], 0x23
mov byte [ebp - 4], 0x24
call fcn.0049d3be
mov esi, eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x20]
call fcn.004028da
cmp esi, ebx
jne 0x49b956
push str.ERROR_CHECK_BOOLEX:bCheck
push 0xe7
jmp 0x49b5c8
push ecx
mov eax, esp
mov dword [ebp - 0x28], esp
lea ecx, [ebp - 0x10]
push ecx
push eax
call fcn.004029d3
mov byte [ebp - 4], 0x25
push edi
lea eax, [ebp - 0x20]
push eax
call fcn.004029d3
mov byte [ebp - 4], 0x26
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push str.kliveshellext64.dll
push ecx
mov ecx, eax
call fcn.0040a149
pop ecx
pop ecx
mov byte [ebp - 4], 0x27
mov byte [ebp - 4], 0x28
call fcn.0049d3be
mov esi, eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x20]
call fcn.004028da
cmp esi, ebx
jne 0x49b9bb
push str.ERROR_CHECK_BOOLEX:bCheck
push 0xe9
jmp 0x49b5c8
push ecx
mov eax, esp
mov dword [ebp - 0x28], esp
lea ecx, [ebp - 0x10]
push ecx
push eax
call fcn.004029d3
mov byte [ebp - 4], 0x29
push edi
lea eax, [ebp - 0x20]
push eax
call fcn.004029d3
mov byte [ebp - 4], 0x2a
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push str.KLiveUpdate.exe
push ecx
mov ecx, eax
call fcn.0040a149
pop ecx
pop ecx
mov byte [ebp - 4], 0x2b
mov byte [ebp - 4], 0x2c
call fcn.0049d3be
mov esi, eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x20]
call fcn.004028da
cmp esi, ebx
jne 0x49ba20
push str.ERROR_CHECK_BOOLEX:bCheck
push 0xed
jmp 0x49b5c8
push ecx
mov eax, esp
mov dword [ebp - 0x28], esp
lea ecx, [ebp - 0x10]
push ecx
push eax
call fcn.004029d3
mov byte [ebp - 4], 0x2d
push edi
lea eax, [ebp - 0x20]
push eax
call fcn.004029d3
mov byte [ebp - 4], 0x2e
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push 0x53c238
push ecx
mov ecx, eax
call fcn.0040a149
pop ecx
pop ecx
mov byte [ebp - 4], 0x2f
mov byte [ebp - 4], 0x30
call fcn.0049d3be
mov esi, eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x20]
call fcn.004028da
cmp esi, ebx
jne 0x49ba85
push str.ERROR_CHECK_BOOLEX:bCheck
push 0xef
jmp 0x49b5c8
push ecx
mov eax, esp
mov dword [ebp - 0x28], esp
lea ecx, [ebp - 0x18]
push ecx
push eax
call fcn.004029d3
mov byte [ebp - 4], 0x31
push edi
lea eax, [ebp - 0x20]
push eax
call fcn.004029d3
mov byte [ebp - 4], 0x32
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push str.klive.ini
push ecx
mov ecx, eax
call fcn.0040a149
pop ecx
pop ecx
mov byte [ebp - 4], 0x33
mov byte [ebp - 4], 0x34
call fcn.0049d3be
mov esi, eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x20]
call fcn.004028da
cmp esi, ebx
jne 0x49baea
push str.ERROR_CHECK_BOOLEX:bCheck
push 0xf3
jmp 0x49b5c8
lea eax, [ebp - 0x24]
push 0xcf
push eax
call fcn.0040df84
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x20]
push 0x52b784
push ecx
mov esi, eax
call fcn.00446303
mov byte [ebp - 4], 0x36
lea ecx, [ebp - 0x1c]
push str..exe
push ecx
mov ecx, eax
call fcn.0040a149
add esp, 0x18
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0x20]
call fcn.004028da
mov byte [ebp - 4], 0x39
lea ecx, [ebp - 0x24]
call fcn.004028da
push edi
lea eax, [ebp - 0x20]
push eax
call fcn.004029d3
mov byte [ebp - 4], 0x3a
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
mov ebx, 0x53bcc8
push ebx
push ecx
mov ecx, eax
call fcn.0040a149
pop ecx
pop ecx
mov byte [ebp - 4], 0x3b
push edi
lea eax, [ebp - 0x24]
push eax
call fcn.004029d3
mov byte [ebp - 4], 0x3c
push ecx
mov ecx, esp
lea edx, [ebp - 0x1c]
mov dword [ebp - 0x2c], esp
push edx
push ecx
mov esi, eax
call fcn.004812e3
pop ecx
pop ecx
mov byte [ebp - 4], 0x3d
mov byte [ebp - 4], 0x3e
call fcn.0049d4f9
mov esi, eax
mov byte [ebp - 4], 0x3a
lea ecx, [ebp - 0x24]
call fcn.004028da
mov byte [ebp - 4], 0x39
lea ecx, [ebp - 0x20]
call fcn.004028da
test esi, esi
jne 0x49bbbc
push str.ERROR_CHECK_BOOLEX:bCheck
push 0xf8
jmp 0x49bc18
push ecx
mov eax, esp
mov dword [ebp - 0x2c], esp
lea ecx, [ebp - 0x10]
push ecx
push eax
call fcn.004029d3
mov byte [ebp - 4], 0x3f
push edi
lea eax, [ebp - 0x24]
push eax
call fcn.004029d3
mov byte [ebp - 4], 0x40
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push ebx
push ecx
mov ecx, eax
call fcn.0040a149
pop ecx
pop ecx
mov byte [ebp - 4], 0x41
mov byte [ebp - 4], 0x42
call fcn.0049d3be
mov esi, eax
mov byte [ebp - 4], 0x39
lea ecx, [ebp - 0x24]
call fcn.004028da
test esi, esi
jne 0x49bc2c
push str.ERROR_CHECK_BOOLEX:bCheck
push 0xfa
push str..dlgmakeinstallpackdlgSimpleKLivePacker.cpp
push 5
pop ecx
mov dword [ebp + 8], 0x80004005
call fcn.0040ef48
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1c]
call fcn.004028da
mov byte [ebp - 4], 1
lea eax, [ebp - 0x14]
push eax
call fcn.004025f7
mov byte [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
call fcn.004025f7
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x18]
push eax
call fcn.004025f7
mov eax, dword [ebp + 8]
call fcn.004d0383
ret 4