joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48ac00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x48ad5a
cmp word [edi], 0
je 0x48ad5a
mov ebx, dword [ebp + 8]
cmp ebx, 0xffffffff
je 0x48ad5a
mov eax, edi
mov dword [ebp + 0xc], 0
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x48ac35
sub eax, edx
sar eax, 1
push esi
lea esi, [eax + eax]
test esi, esi
je 0x48ad50
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x18]
push eax
push 0
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
jne 0x48ac81
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x3e5
jne 0x48acba
mov ecx, dword [ebp + 0x10]
push ecx
push ebx
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
test eax, eax
jne 0x48ace2
push eax
lea edx, [ebp - 4]
mov dword [ebp - 4], eax
push edx
lea eax, [ebp - 0x18]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetOverlappedResult]
test eax, eax
je 0x48ad1d
mov eax, dword [ebp - 4]
add edi, eax
sub esi, eax
jne 0x48ac50
mov eax, dword [ebp + 0xc]
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
jle 0x48acce
and eax, 0xffff
or eax, 0x80070000
mov ecx, eax
push ecx
push str.Failed_WriteFile:_0x_08x.
push str.kupdate::KIPCMessage::SendIPCMessage
mov dword [ebp + 0xc], eax
push 0x35
jmp 0x48ad41
lea edx, [ebp - 0x18]
push edx
push ebx
call fcn.0048ab90
push 0x800705b4
push str.WaitForSingleObject_timeout.
push str.kupdate::KIPCMessage::SendIPCMessage
push 0x3c
push str.S:_rc_v11_edu_20191101_branchCoding_supportwpsupdateUpdateClient_srcutilKIpcMessage.cpp
push 0
mov dword [ebp + 0xc], 0x800705b4
call fcn.0041a9b0
mov eax, dword [ebp + 0xc]
add esp, 0x20
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
jle 0x48ad31
and eax, 0xffff
or eax, 0x80070000
push eax
push str.Failed_GetOverlappedResult:_0x_08x.
push str.kupdate::KIPCMessage::SendIPCMessage
mov dword [ebp + 0xc], eax
push 0x43
push str.S:_rc_v11_edu_20191101_branchCoding_supportwpsupdateUpdateClient_srcutilKIpcMessage.cpp
push 0
call fcn.0041a9b0
add esp, 0x18
mov eax, dword [ebp + 0xc]
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x542a80
push str.kupdate::KIPCMessage::SendIPCMessage
push 0x26
push str.S:_rc_v11_edu_20191101_branchCoding_supportwpsupdateUpdateClient_srcutilKIpcMessage.cpp
push 0
call fcn.0041a9b0
add esp, 0x14
pop edi
mov eax, 0x80070057
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48beb0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
or eax, 0xffffffff
cmp dword [ebp + 8], eax
je 0x48bf44
push ebx
mov ebx, dword [ebp + 0xc]
test ebx, ebx
jne 0x48becf
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push edi
mov edi, 0x80000
cmp ebx, 0x80000
ja 0x48bee0
mov edi, ebx
push edi
call fcn.004b7ad5
push edi
mov esi, eax
push 0
push esi
call fcn.004ba010
mov edi, ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_WriteFile]
add esp, 0x10
lea esp, [esp]
mov eax, 0x80000
cmp edi, 0x80000
ja 0x48bf0f
mov eax, edi
mov edx, dword [ebp + 8]
push 0
lea ecx, [ebp - 4]
push ecx
push eax
push esi
push edx
mov dword [ebp - 4], 0
call ebx
mov eax, dword [ebp - 4]
test eax, eax
je 0x48bf2f
sub edi, eax
jne 0x48bf00
test esi, esi
je 0x48bf3c
push esi
call fcn.004b9ded
add esp, 4
mov eax, dword [ebp + 0xc]
sub eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48cd80
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x69c]
lea eax, [esi + 0x69c]
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
test eax, eax
je 0x48cde8
cmp dword [esi + 0x6a0], 0
je 0x48cdbb
mov edx, dword [esi + 0x67c]
push edx
call dword [sym.imp.KERNEL32.DLL_ResumeThread]
mov dword [esi + 0x6a0], 0
mov eax, dword [esi]
push edi
push eax
call dword [sym.imp.KERNEL32.DLL_SetEvent]
mov ecx, dword [esi + 0x67c]
mov edi, dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push 0x7d0
push ecx
call edi
mov edx, dword [esi + 0x680]
push 0x7d0
push edx
call edi
pop edi
pop esi
ret
Function at 0x48e2d0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 0x14], 0
push esi
mov esi, ecx
jl 0x48e37b
jg 0x48e2ef
cmp dword [ebp + 0x10], 0
jbe 0x48e37b
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_GetTickCount]
call edi
fild qword [ebp + 8]
fstp qword [ebp - 8]
call edi
mov ecx, 1
sub ecx, dword [esi + 0x10]
add eax, ecx
mov dword [ebp + 0xc], eax
fild dword [ebp + 0xc]
jns 0x48e318
fadd qword [0x55ad00]
fld qword [ebp - 8]
pop edi
fnstcw word [ebp + 0xe]
movzx eax, word [ebp + 0xe]
fld st(0)
or eax, 0xc00
fdivrp st(2)
mov dword [ebp - 4], eax
fldcw word [ebp - 4]
fxch st(1)
fistp dword [ebp - 4]
mov dx, word [ebp - 4]
movzx ecx, dx
shl ecx, 0x10
fldcw word [ebp + 0xe]
fild qword [ebp + 0x10]
fnstcw word [ebp + 0x16]
fdivp st(1)
movzx eax, word [ebp + 0x16]
or eax, 0xc00
mov dword [ebp + 0xc], eax
fmul qword [0x543c30]
fldcw word [ebp + 0xc]
fistp dword [ebp + 0xc]
mov ax, word [ebp + 0xc]
movzx edx, ax
mov eax, dword [esi]
fldcw word [ebp + 0x16]
or ecx, edx
test eax, eax
je 0x48e37b
push ecx
push 7
call eax
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x490f20
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
jne 0x490f3c
mov eax, dword [ebp - 4]
jmp 0x491017
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
shr ecx, 3
xor eax, 0xffffffff
test ecx, ecx
je 0x490ff2
push ebp
mov ebp, ecx
xor edx, edx
xor ecx, ecx
mov edi, edi
mov ebx, dword [esi]
add esi, 4
mov dl, bl
mov cl, bh
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x55b150]
shr ebx, 0x10
xor eax, edi
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x55b150]
mov dl, bl
xor eax, edi
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x55b150]
mov cl, bh
xor eax, edi
mov ebx, dword [esi]
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x55b150]
add esi, 4
xor eax, edi
mov dl, bl
mov cl, bh
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x55b150]
shr ebx, 0x10
xor eax, edi
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x55b150]
mov dl, bl
xor eax, edi
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x55b150]
mov cl, bh
xor eax, edi
xor cl, al
shr eax, 8
xor eax, dword [ecx*4 + 0x55b150]
dec ebp
jne 0x490f5c
pop ebp
mov ecx, dword [ebp + 0x10]
xor edx, edx
and ecx, 7
je 0x49100e
mov dl, byte [esi]
inc esi
xor dl, al
shr eax, 8
xor eax, dword [edx*4 + 0x55b150]
dec ecx
jne 0x490ffc
xor eax, 0xffffffff
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x491470
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52f428
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x590cc0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
mov esi, ecx
mov ecx, dword [ebp + 0xc]
push 4
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], edx
call fcn.004b9d21
mov edi, eax
xor ebx, ebx
add esp, 4
cmp edi, ebx
je 0x4914da
mov eax, dword [0x5921b0]
mov edx, dword [eax + 0xc]
mov ecx, 0x5921b0
call edx
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 0x30], edi
jmp 0x4914dd
mov dword [ebp - 0x30], ebx
lea eax, [ebp - 0x2c]
push eax
mov ecx, esi
call fcn.00491360
mov dword [ebp - 4], ebx
lea ecx, [esi + 0x70]
mov ebx, 8
cmp dword [ecx + 0x14], ebx
jb 0x4914fa
mov ecx, dword [ecx]
lea edx, [esi + 0x1c]
mov dword [ebp - 0x34], ecx
cmp dword [edx + 0x14], ebx
jb 0x491507
mov edx, dword [edx]
cmp dword [esi + 0xbc], ebx
mov dword [ebp - 0x38], edx
lea edx, [esi + 0xa8]
jb 0x49151f
mov ecx, dword [edx]
mov dword [ebp - 0x3c], ecx
jmp 0x491522
mov dword [ebp - 0x3c], edx
cmp dword [esi + 0x4c], ebx
jb 0x49152c
mov edi, dword [esi + 0x38]
jmp 0x49152f
lea edi, [esi + 0x38]
cmp dword [esi + 0xa0], ebx
jb 0x49153f
mov ecx, dword [esi + 0x8c]
jmp 0x491545
lea ecx, [esi + 0x8c]
cmp dword [esi + 0x68], ebx
lea edx, [esi + 0x54]
jb 0x49154f
mov edx, dword [edx]
cmp dword [esi + 0x14], ebx
jb 0x491556
mov esi, dword [esi]
cmp dword [eax + 0x14], ebx
jb 0x49155d
mov eax, dword [eax]
mov ebx, dword [ebp - 0x34]
push ebx
mov ebx, dword [ebp - 0x38]
push ebx
mov ebx, dword [ebp - 0x3c]
push ebx
push edi
mov edi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp - 0x40]
mov edi, dword [edi]
push edi
mov edi, dword [ebp - 0x48]
mov edi, dword [edi]
push edi
mov edi, dword [ebp - 0x44]
mov edi, dword [edi]
push edi
push ecx
push edx
mov edx, dword [0x59028c]
push esi
mov esi, dword [ebp - 0x30]
push eax
mov eax, dword [str.http:__www.google_analytics.com_collect_]
push edx
push eax
push str._sv_stid_steventcid_sanwpsupdateav_sul_sec_sea_sel_sev_dcd1_scd2_scd3_scd4_s
push esi
call fcn.00449e90
add esp, 0x40
cmp dword [ebp - 0x18], 8
jb 0x4915b4
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.004b9008
add esp, 4
push 0
push 0
push esi
push 0x4911c0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b9ff3
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4923b0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x590cc0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x595145], 0
jne 0x49243c
push 0x118
lea eax, [ebp - 0x11c]
push 0
push eax
mov byte [0x595145], 1
mov dword [ebp - 0x120], 0x11c
call fcn.004ba010
add esp, 0xc
lea ecx, [ebp - 0x120]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetVersionExW]
cmp dword [ebp - 0x11c], 5
jne 0x492427
cmp dword [ebp - 0x118], 1
jne 0x492427
mov al, 1
mov byte [0x595144], al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b9ff3
mov esp, ebp
pop ebp
ret
xor al, al
mov byte [0x595144], al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b9ff3
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, byte [0x595144]
xor ecx, ebp
call fcn.004b9ff3
mov esp, ebp
pop ebp
ret
Function at 0x495090
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52f93b
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x590cc0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push 0x206
xor ebx, ebx
lea edx, [ebp - 0x216]
xor ecx, ecx
push ebx
push edx
mov dword [ebp - 0x228], eax
mov word [ebp - 0x218], cx
call fcn.004ba010
add esp, 0xc
push 0x104
lea eax, [ebp - 0x218]
push eax
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x224], ebx
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
push 0x55bae4
lea ecx, [ebp - 0x218]
push 0x104
push ecx
call fcn.004bdeb6
add esp, 0xc
call fcn.00494fc0
mov eax, dword [0x595140]
cmp eax, ebx
je 0x4951f4
push ebx
lea edx, [ebp - 0x218]
push edx
call eax
mov esi, eax
cmp esi, ebx
je 0x4951f4
lea eax, [ebp - 0x219]
push eax
push esi
lea ecx, [ebp - 0x238]
mov byte [ebp - 0x219], bl
mov dword [ebp - 0x238], ebx
mov dword [ebp - 0x234], ebx
mov dword [ebp - 0x230], ebx
call fcn.00493630
mov edi, dword [ebp - 0x238]
mov dword [ebp - 4], ebx
cmp edi, ebx
je 0x4951f4
call fcn.00494fc0
mov eax, dword [0x59513c]
cmp eax, ebx
je 0x4951eb
push edi
push esi
push ebx
lea ecx, [ebp - 0x218]
push ecx
call eax
cmp eax, ebx
je 0x4951eb
call fcn.00494fc0
mov eax, dword [0x595138]
cmp eax, ebx
je 0x4951eb
lea edx, [ebp - 0x224]
push edx
lea ecx, [ebp - 0x220]
push ecx
push 0x539ff0
push edi
call eax
cmp eax, ebx
je 0x4951eb
mov eax, dword [ebp - 0x220]
cmp eax, ebx
je 0x4951eb
cmp word [eax + 0x12], 0xa
mov eax, dword [ebp - 0x228]
setae dl
lea ecx, [ebp - 0x238]
mov byte [eax], dl
call fcn.0040b740
xor eax, eax
jmp 0x4951f9
push edi
call fcn.004b9008
add esp, 4
mov eax, 0x80004005
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b9ff3
mov esp, ebp
pop ebp
ret
Function at 0x49a4a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x49a4ae
xor eax, eax
pop ebp
ret
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
push esi
not eax
cmp edx, 8
jb 0x49a58d
mov esi, edx
shr esi, 3
push edi
jmp 0x49a4d0
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x55cfe0]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x55cfe0]
movzx edi, byte [ecx + 2]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x55cfe0]
movzx edi, byte [ecx + 3]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x55cfe0]
movzx edi, byte [ecx + 4]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x55cfe0]
movzx edi, byte [ecx + 5]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x55cfe0]
movzx edi, byte [ecx + 6]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x55cfe0]
movzx edi, byte [ecx + 7]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x55cfe0]
add ecx, 8
sub edx, 8
dec esi
jne 0x49a4d0
pop edi
test edx, edx
je 0x49a5aa
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x55cfe0]
inc ecx
dec edx
jne 0x49a591
not eax
pop esi
pop ebp
ret

Function at 0x49a5b0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov eax, dword [edx]
movsx ecx, byte [ebp + 0xc]
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x55cfe0]
xor ecx, eax
movzx eax, cl
add eax, dword [edx + 4]
mov dword [edx], ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x55cfe0]
mov dword [edx + 8], ecx
pop ebp
ret

Function at 0x49a600
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 8]
mov eax, ecx
and eax, 0xfffd
or eax, 2
mov edx, eax
xor edx, 1
imul edx, eax
mov al, byte [ebp + 0xc]
shr edx, 8
xor al, dl
mov edx, dword [esi]
push edi
movsx edi, al
xor edi, edx
shr edx, 8
and edi, 0xff
mov ebx, dword [edi*4 + 0x55cfe0]
xor ebx, edx
movzx edx, bl
add edx, dword [esi + 4]
mov dword [esi], ebx
imul edx, edx, 0x8088405
inc edx
mov dword [esi + 4], edx
shr edx, 0x18
xor edx, ecx
and edx, 0xff
shr ecx, 8
xor ecx, dword [edx*4 + 0x55cfe0]
pop edi
mov dword [esi + 8], ecx
pop esi
pop ebx
pop ebp
ret
Function at 0x49aa60
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, ebx
imul esi, dword [ebp + 0x10]
cmp byte [edi], 0
je 0x49aaa0
mov ecx, dword [ebp + 8]
mov edx, dword [edi + 4]
push 0
lea eax, [ebp + 0xc]
push eax
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x49aa94
mov byte [edi + 8], 1
mov eax, dword [ebp + 0xc]
pop edi
xor edx, edx
pop esi
div ebx
pop ebx
pop ebp
ret
mov ecx, dword [edi + 0x1c]
mov eax, dword [edi + 0x18]
lea edx, [ecx + esi]
cmp edx, eax
jbe 0x49aab1
sub eax, ecx
mov esi, eax
mov eax, dword [edi + 0x14]
add eax, ecx
mov ecx, dword [ebp + 8]
push esi
push eax
push ecx
call fcn.004b9350
add dword [edi + 0x1c], esi
add esp, 0xc
pop edi
mov eax, esi
xor edx, edx
pop esi
div ebx
pop ebx
pop ebp
ret
Function at 0x49ac80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov esi, dword [ebp + 8]
cmp byte [esi], 0
je 0x49accb
cmp byte [esi + 1], 0
je 0x49acd3
mov eax, dword [esi + 4]
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
cmp byte [esi], 0
push ebx
je 0x49ace7
cmp byte [esi + 1], 0
je 0x49acdb
mov edx, dword [esi + 4]
push 1
push 0
push 0
push edx
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
mov ebx, eax
sub ebx, dword [esi + 0xc]
mov dword [ebp + 8], ebx
jmp 0x49acef
mov ecx, dword [esi + 0x18]
mov dword [esi + 0x1c], ecx
jmp 0x49aca5
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
mov dword [ebp + 8], 0
mov ebx, dword [ebp + 8]
jmp 0x49acef
mov eax, dword [esi + 0x1c]
mov dword [ebp + 8], eax
mov ebx, eax
push edi
mov edi, 0xffff
mov dword [ebp - 4], edi
cmp ebx, edi
jae 0x49ad01
mov dword [ebp - 4], ebx
mov edi, ebx
push 0x404
call fcn.004ba94d
add esp, 4
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x49ad1f
pop edi
pop ebx
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 4
mov dword [ebp - 0x10], 0xffffffff
cmp edi, eax
jbe 0x49ae2d
jmp 0x49ad3e
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov ebx, dword [ebp + 8]
add eax, 0x400
mov dword [ebp - 8], edi
cmp eax, edi
ja 0x49ad4d
mov dword [ebp - 8], eax
mov eax, ebx
sub eax, dword [ebp - 8]
sub ebx, eax
mov dword [ebp - 0x18], eax
cmp ebx, 0x404
jbe 0x49ad64
mov ebx, 0x404
cmp byte [esi], 0
je 0x49ad89
cmp byte [esi + 1], 0
je 0x49ae2d
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
push 0
push 0
add ecx, eax
push ecx
push edx
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
jmp 0x49ad8c
mov dword [esi + 0x1c], eax
cmp byte [esi], 0
mov edi, ebx
je 0x49adb5
mov ecx, dword [ebp - 0xc]
mov edx, dword [esi + 4]
push 0
lea eax, [ebp - 0x14]
push eax
push ebx
push ecx
push edx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x49adb0
mov byte [esi + 8], 1
mov eax, dword [ebp - 0x14]
jmp 0x49adde
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
lea edx, [eax + ebx]
cmp edx, ecx
jbe 0x49adc6
sub ecx, eax
mov edi, ecx
mov ecx, dword [esi + 0x14]
mov edx, dword [ebp - 0xc]
push edi
add ecx, eax
push ecx
push edx
call fcn.004b9350
add esp, 0xc
add dword [esi + 0x1c], edi
mov eax, edi
xor edx, edx
div ebx
cmp eax, 1
jne 0x49ae2d
lea eax, [ebx - 3]
test eax, eax
js 0x49ae1b
mov edi, edi
mov ecx, dword [ebp - 0xc]
dec eax
cmp byte [eax + ecx], 0x50
jne 0x49ae0f
cmp byte [eax + ecx + 1], 0x4b
jne 0x49ae0f
cmp byte [eax + ecx + 2], 5
jne 0x49ae0f
cmp byte [eax + ecx + 3], 6
je 0x49ae15
test eax, eax
jns 0x49adf0
jmp 0x49ae1b
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x49ae2d
mov edx, dword [ebp - 4]
cmp dword [ebp - 8], edx
jb 0x49ad35
mov eax, dword [ebp - 0xc]
push eax
call fcn.004ba8b3
mov eax, dword [ebp - 0x10]
add esp, 4
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x49bc30
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x590cc0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x49bc64
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x49bc64
push 0
push esi
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
movzx eax, word [ebx]
test ax, ax
je 0x49bd4e
mov ecx, ebx
mov edx, ebx
cmp ax, 0x2f
je 0x49bc80
cmp ax, 0x5c
jne 0x49bc82
mov ecx, edx
movzx eax, word [edx + 2]
add edx, 2
test ax, ax
jne 0x49bc74
push edi
cmp ecx, ebx
je 0x49bcc2
sub ecx, ebx
sar ecx, 1
lea edi, [ecx + ecx]
push edi
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.004b9350
lea edx, [ebp - 0x414]
push edx
xor ecx, ecx
push esi
mov word [ebp + edi - 0x414], cx
call fcn.0049bc30
add esp, 0x14
xor eax, eax
mov word [ebp - 0x20c], ax
test esi, esi
je 0x49bcef
lea edx, [ebp - 0x20c]
mov eax, esi
sub edx, esi
lea esp, [esp]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x49bce0
mov eax, ebx
mov edx, ebx
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x49bcf3
lea edi, [ebp - 0x20c]
sub eax, edx
add edi, 0xfffffffe
lea esp, [esp]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x49bd10
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
pop edi
cmp eax, 0xffffffff
jne 0x49bd4e
push 0
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004b9ff3
mov esp, ebp
pop ebp
ret

Function at 0x49d790
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, ecx
cmp dword [ebx], 0
jne 0x49d862
cmp dword [ebx + 4], 0xffffffff
jne 0x49d862
push edi
lea edi, [ebx + 0x244]
push edi
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x49d7c1
sub eax, edx
sar eax, 1
movzx eax, word [ebx + eax*2 + 0x242]
cmp eax, 0x5c
je 0x49d7f8
cmp eax, 0x2f
je 0x49d7f8
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x49d7e5
mov eax, dword [0x539ff0]
mov dword [edi], eax
mov edi, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
cmp edi, 1
jne 0x49d822
push 1
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
cmp eax, 0xffffffff
jne 0x49d822
pop esi
pop edi
mov eax, 0x2000000
pop ebx
pop ebp
ret 0xc
mov edx, dword [ebp + 0xc]
lea ecx, [ebp + 0x10]
push ecx
push edi
push edx
push esi
call fcn.0049a950
add esp, 0x10
test eax, eax
jne 0x49d842
mov eax, dword [ebp + 0x10]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
push eax
call fcn.0049d1b0
add esp, 4
mov dword [ebx], eax
neg eax
sbb eax, eax
pop esi
and eax, 0xfffffe00
pop edi
add eax, 0x200
pop ebx
pop ebp
ret 0xc
mov eax, 0x1000000
pop ebx
pop ebp
ret 0xc
Function at 0x49e0b0
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
push edi
je 0x49e0f1
mov eax, dword [esi + 0xd0]
mov ecx, dword [esi]
push eax
push ecx
mov byte [esi + 0xdc], 1
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
cmp eax, 0x102
jne 0x49e0e2
mov edx, dword [esi]
push 0
push edx
call dword [sym.imp.KERNEL32.DLL_TerminateThread]
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [esi], 0
push ebx
mov ebx, 8
mov dword [esi + 0xd8], vtable.kupdate::CBindCallback.0
cmp dword [esi + 0xc4], ebx
jb 0x49e118
mov ecx, dword [esi + 0xb0]
push ecx
call fcn.004b9008
add esp, 4
mov edi, 7
xor edx, edx
mov dword [esi + 0xc4], edi
mov dword [esi + 0xc0], 0
mov word [esi + 0xb0], dx
cmp dword [esi + 0xa8], ebx
jb 0x49e14d
mov eax, dword [esi + 0x94]
push eax
call fcn.004b9008
add esp, 4
xor ecx, ecx
mov dword [esi + 0xa8], edi
mov dword [esi + 0xa4], 0
mov word [esi + 0x94], cx
cmp dword [esi + 0x8c], ebx
jb 0x49e17a
mov edx, dword [esi + 0x78]
push edx
call fcn.004b9008
add esp, 4
xor eax, eax
mov dword [esi + 0x8c], edi
mov dword [esi + 0x88], 0
mov word [esi + 0x78], ax
cmp dword [esi + 0x70], ebx
jb 0x49e1a1
mov ecx, dword [esi + 0x5c]
push ecx
call fcn.004b9008
add esp, 4
xor edx, edx
mov dword [esi + 0x70], edi
mov dword [esi + 0x6c], 0
mov word [esi + 0x5c], dx
cmp dword [esi + 0x54], ebx
jb 0x49e1c2
mov eax, dword [esi + 0x40]
push eax
call fcn.004b9008
add esp, 4
xor ecx, ecx
mov dword [esi + 0x54], edi
mov dword [esi + 0x50], 0
mov word [esi + 0x40], cx
cmp dword [esi + 0x38], ebx
jb 0x49e1e3
mov edx, dword [esi + 0x24]
push edx
call fcn.004b9008
add esp, 4
xor eax, eax
mov dword [esi + 0x38], edi
mov dword [esi + 0x34], 0
mov word [esi + 0x24], ax
cmp dword [esi + 0x1c], ebx
pop ebx
jb 0x49e205
mov ecx, dword [esi + 8]
push ecx
call fcn.004b9008
add esp, 4
mov dword [esi + 0x1c], edi
mov dword [esi + 0x18], 0
xor edx, edx
pop edi
mov word [esi + 8], dx
pop esi
ret