Function at 0x487ce4
Capabilities:
Contain obfuscated stackstrings
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5290c9
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x3bc
mov eax, dword [0x5770a4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x2d0], ecx
and dword [ebp - 0x380], 0
push dword [ebp + 8]
call fcn.00481158
pop ecx
movzx eax, al
test eax, eax
jne 0x487d3a
mov al, 1
jmp 0x4888dd
lea eax, [ebp - 0x2d9]
push eax
lea ecx, [ebp - 0x2d8]
call fcn.0048ca9e
and dword [ebp - 4], 0
mov dword [ebp - 4], 1
mov dword [ebp - 4], 2
push str.mmog_data.xml
lea ecx, [ebp - 0x84]
call fcn.00409053
mov byte [ebp - 4], 3
push dword [ebp - 0x37c]
lea eax, [ebp - 0x84]
push eax
push 0
lea eax, [ebp - 0x3c4]
push eax
lea ecx, [ebp - 0x2d8]
call fcn.0048c7ab
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x84]
call fcn.0040a62b
mov byte [ebp - 4], 5
mov byte [ebp - 4], 2
lea eax, [ebp - 0x84]
mov dword [ebp - 0x378], eax
mov byte [ebp - 4], 6
mov byte [ebp - 4], 7
mov byte [ebp - 4], 2
push str.version.ini
lea ecx, [ebp - 0xb4]
call fcn.00409053
mov byte [ebp - 4], 8
push dword [ebp - 0x374]
lea eax, [ebp - 0xb4]
push eax
push 0
lea eax, [ebp - 0x3cc]
push eax
lea ecx, [ebp - 0x2d8]
call fcn.0048c7ab
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xb4]
call fcn.0040a62b
mov byte [ebp - 4], 0xa
mov byte [ebp - 4], 2
lea eax, [ebp - 0xb4]
mov dword [ebp - 0x370], eax
mov byte [ebp - 4], 0xb
mov byte [ebp - 4], 0xc
mov byte [ebp - 4], 2
mov dword [ebp - 0x2c8], 1
lea ecx, [ebp - 0x6c]
call fcn.0040b2fe
mov byte [ebp - 4], 0xd
cmp dword [ebp - 0x2c8], 0
je 0x487f8f
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x2d8]
push eax
push 1
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00482b90
add esp, 0x14
movzx eax, al
test eax, eax
jne 0x487f8f
lea eax, [ebp - 0x6c]
push eax
push str._SelfUpdateImpl_CopyOrMoveDir:
lea eax, [ebp - 0x204]
push eax
call fcn.00425f4c
add esp, 0xc
mov dword [ebp - 0x314], eax
mov eax, dword [ebp - 0x314]
mov dword [ebp - 0x318], eax
mov byte [ebp - 4], 0xe
push dword [ebp - 0x318]
lea ecx, [ebp - 0x6c]
call fcn.0041dc17
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x204]
call fcn.0040a62b
mov byte [ebp - 4], 0x10
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0x204]
mov dword [ebp - 0x36c], eax
mov byte [ebp - 4], 0x11
mov byte [ebp - 4], 0x12
mov byte [ebp - 4], 0xd
push 0x540bd8
lea ecx, [ebp - 0x9c]
call fcn.00409053
mov byte [ebp - 4], 0x13
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x1ec]
push eax
call fcn.0044ae06
pop ecx
pop ecx
mov dword [ebp - 0x31c], eax
mov eax, dword [ebp - 0x31c]
mov dword [ebp - 0x320], eax
mov byte [ebp - 4], 0x14
push dword [ebp - 0x320]
lea eax, [ebp - 0x9c]
push eax
call fcn.004838f3
pop ecx
pop ecx
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x1ec]
call fcn.00405a40
mov byte [ebp - 4], 0x16
mov byte [ebp - 4], 0x13
lea eax, [ebp - 0x1ec]
mov dword [ebp - 0x368], eax
mov byte [ebp - 4], 0x17
mov byte [ebp - 4], 0x18
mov byte [ebp - 4], 0x13
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x9c]
call fcn.0040a62b
mov byte [ebp - 4], 0x1a
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0x9c]
mov dword [ebp - 0x364], eax
mov byte [ebp - 4], 0x1b
mov byte [ebp - 4], 0x1c
mov byte [ebp - 4], 0xd
and dword [ebp - 0x2c8], 0
cmp dword [ebp - 0x2c8], 0
je 0x4880e5
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x2d8]
push eax
push 1
push dword [ebp + 0xc]
push dword [ebp + 8]
mov ecx, dword [ebp - 0x2d0]
call fcn.0048bc2a
movzx eax, al
test eax, eax
jne 0x4880e5
lea eax, [ebp - 0x6c]
push eax
push str._SelfUpdateImpl_CopyOrMoveFiles:
lea eax, [ebp - 0x21c]
push eax
call fcn.00425f4c
add esp, 0xc
mov dword [ebp - 0x310], eax
mov eax, dword [ebp - 0x310]
mov dword [ebp - 0x324], eax
mov byte [ebp - 4], 0x1d
push dword [ebp - 0x324]
lea ecx, [ebp - 0x6c]
call fcn.0041dc17
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x21c]
call fcn.0040a62b
mov byte [ebp - 4], 0x1f
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x360], eax
mov byte [ebp - 4], 0x20
mov byte [ebp - 4], 0x21
mov byte [ebp - 4], 0xd
push 0x540c34
lea ecx, [ebp - 0x174]
call fcn.00409053
mov byte [ebp - 4], 0x22
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x234]
push eax
call fcn.0044ae06
pop ecx
pop ecx
mov dword [ebp - 0x328], eax
mov eax, dword [ebp - 0x328]
mov dword [ebp - 0x32c], eax
mov byte [ebp - 4], 0x23
push dword [ebp - 0x32c]
lea eax, [ebp - 0x174]
push eax
call fcn.004838f3
pop ecx
pop ecx
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x234]
call fcn.00405a40
mov byte [ebp - 4], 0x25
mov byte [ebp - 4], 0x22
lea eax, [ebp - 0x234]
mov dword [ebp - 0x35c], eax
mov byte [ebp - 4], 0x26
mov byte [ebp - 4], 0x27
mov byte [ebp - 4], 0x22
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x174]
call fcn.0040a62b
mov byte [ebp - 4], 0x29
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0x174]
mov dword [ebp - 0x358], eax
mov byte [ebp - 4], 0x2a
mov byte [ebp - 4], 0x2b
mov byte [ebp - 4], 0xd
and dword [ebp - 0x2c8], 0
cmp dword [ebp - 0x2c8], 0
je 0x48822a
push dword [ebp + 8]
mov ecx, dword [ebp - 0x2d0]
call fcn.0048bf15
movzx eax, al
test eax, eax
jne 0x48822a
push dword [ebp + 8]
push str._SelfUpdateImpl_REMOVE:
lea eax, [ebp - 0x24c]
push eax
call fcn.00425f4c
add esp, 0xc
mov dword [ebp - 0x330], eax
mov eax, dword [ebp - 0x330]
mov dword [ebp - 0x334], eax
mov byte [ebp - 4], 0x2c
push dword [ebp - 0x334]
lea ecx, [ebp - 0x6c]
call fcn.0041dc17
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x24c]
call fcn.0040a62b
mov byte [ebp - 4], 0x2e
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0x24c]
mov dword [ebp - 0x354], eax
mov byte [ebp - 4], 0x2f
mov byte [ebp - 4], 0x30
mov byte [ebp - 4], 0xd
push 0x540c4c
lea ecx, [ebp - 0x1a4]
call fcn.00409053
mov byte [ebp - 4], 0x31
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x264]
push eax
call fcn.0044ae06
pop ecx
pop ecx
mov dword [ebp - 0x338], eax
mov eax, dword [ebp - 0x338]
mov dword [ebp - 0x33c], eax
mov byte [ebp - 4], 0x32
push dword [ebp - 0x33c]
lea eax, [ebp - 0x1a4]
push eax
call fcn.004838f3
pop ecx
pop ecx
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0x264]
call fcn.00405a40
mov byte [ebp - 4], 0x34
mov byte [ebp - 4], 0x31
lea eax, [ebp - 0x264]
mov dword [ebp - 0x350], eax
mov byte [ebp - 4], 0x35
mov byte [ebp - 4], 0x36
mov byte [ebp - 4], 0x31
mov byte [ebp - 4], 0x37
lea ecx, [ebp - 0x1a4]
call fcn.0040a62b
mov byte [ebp - 4], 0x38
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0x1a4]
mov dword [ebp - 0x390], eax
mov byte [ebp - 4], 0x39
mov byte [ebp - 4], 0x3a
mov byte [ebp - 4], 0xd
and dword [ebp - 0x2c8], 0
cmp dword [ebp - 0x2c8], 0
jne 0x488861
lea eax, [ebp - 0xcc]
push eax
call fcn.00482219
pop ecx
mov byte [ebp - 4], 0x3b
push str._tinydl_tcls.ini
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0xe4]
push eax
call fcn.004640ab
add esp, 0xc
mov byte [ebp - 4], 0x3c
push 0x40
push 0
lea eax, [ebp - 0x54]
push eax
call fcn.004b0090
add esp, 0xc
lea ecx, [ebp - 0xe4]
call fcn.0040a5f1
mov dword [ebp - 0x340], eax
push dword [ebp - 0x340]
push 0x20
lea eax, [ebp - 0x54]
push eax
push 0x540c88
push str.kill_tcls
push str.main
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [ebp - 0x344], eax
mov dword [ebp - 0x2e0], 1
cmp dword [ebp - 0x344], 0
je 0x4882d6
push 2
pop eax
imul eax, eax, 0
movzx eax, word [ebp + eax - 0x54]
cmp eax, 0x31
je 0x488378
push str._SelfUpdateImpl_kill_tcls_not_open
lea ecx, [ebp - 0x15c]
call fcn.0040c8ed
mov byte [ebp - 4], 0x3d
push 0x540cd0
lea ecx, [ebp - 0x18c]
call fcn.00409053
mov byte [ebp - 4], 0x3e
lea eax, [ebp - 0x15c]
push eax
lea eax, [ebp - 0x18c]
push eax
call fcn.004838f3
pop ecx
pop ecx
mov byte [ebp - 4], 0x3f
lea ecx, [ebp - 0x18c]
call fcn.0040a62b
mov byte [ebp - 4], 0x40
mov byte [ebp - 4], 0x3d
lea eax, [ebp - 0x18c]
mov dword [ebp - 0x384], eax
mov byte [ebp - 4], 0x41
mov byte [ebp - 4], 0x42
mov byte [ebp - 4], 0x3d
mov byte [ebp - 4], 0x43
lea ecx, [ebp - 0x15c]
call fcn.00405a40
mov byte [ebp - 4], 0x44
mov byte [ebp - 4], 0x3c
lea eax, [ebp - 0x15c]
mov dword [ebp - 0x388], eax
mov byte [ebp - 4], 0x45
mov byte [ebp - 4], 0x46
mov byte [ebp - 4], 0x3c
and dword [ebp - 0x2e0], 0
mov byte [ebp - 4], 0x47
push 0x540ce8
lea ecx, [ebp - 0x144]
call fcn.00409053
mov byte [ebp - 4], 0x48
lea eax, [ebp - 0x144]
push eax
push dword [ebp - 0x2e0]
push dword [ebp + 0xc]
call fcn.0048408e
add esp, 0xc
mov byte [ebp - 4], 0x49
lea ecx, [ebp - 0x144]
call fcn.0040a62b
mov byte [ebp - 4], 0x4a
mov byte [ebp - 4], 0x47
lea eax, [ebp - 0x144]
mov dword [ebp - 0x38c], eax
mov byte [ebp - 4], 0x4b
mov byte [ebp - 4], 0x4c
mov byte [ebp - 4], 0x47
jmp 0x4883df
mov dword [ebp - 4], 0x3c
jmp 0x4883ef
cmp dword [ebp - 0x2e0], 1
jne 0x488401
mov byte [ebp - 0x2ca], 1
jmp 0x488408
mov byte [ebp - 0x2ca], 0
movzx eax, byte [ebp - 0x2ca]
mov dword [ebp - 0x2c8], eax
cmp dword [ebp - 0x2c8], 0
je 0x488568
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x2d8]
push eax
push 1
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00482b90
add esp, 0x14
movzx eax, al
test eax, eax
jne 0x488568
lea eax, [ebp - 0x6c]
push eax
push str._SelfUpdateImpl_KillProcess__CopyOrMoveDir:
lea eax, [ebp - 0x27c]
push eax
call fcn.00425f4c
add esp, 0xc
mov dword [ebp - 0x348], eax
mov eax, dword [ebp - 0x348]
mov dword [ebp - 0x2e4], eax
mov byte [ebp - 4], 0x4e
push dword [ebp - 0x2e4]
lea ecx, [ebp - 0x6c]
call fcn.0041dc17
mov byte [ebp - 4], 0x4f
lea ecx, [ebp - 0x27c]
call fcn.0040a62b
mov byte [ebp - 4], 0x50
mov byte [ebp - 4], 0x3c
lea eax, [ebp - 0x27c]
mov dword [ebp - 0x394], eax
mov byte [ebp - 4], 0x51
mov byte [ebp - 4], 0x52
mov byte [ebp - 4], 0x3c
push 0x540d5c
lea ecx, [ebp - 0x12c]
call fcn.00409053
mov byte [ebp - 4], 0x53
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x294]
push eax
call fcn.0044ae06
pop ecx
pop ecx
mov dword [ebp - 0x2e8], eax
mov eax, dword [ebp - 0x2e8]
mov dword [ebp - 0x2ec], eax
mov byte [ebp - 4], 0x54
push dword [ebp - 0x2ec]
lea eax, [ebp - 0x12c]
push eax
call fcn.004838f3
pop ecx
pop ecx
mov byte [ebp - 4], 0x55
lea ecx, [ebp - 0x294]
call fcn.00405a40
mov byte [ebp - 4], 0x56
mov byte [ebp - 4], 0x53
lea eax, [ebp - 0x294]
mov dword [ebp - 0x398], eax
mov byte [ebp - 4], 0x57
mov byte [ebp - 4], 0x58
mov byte [ebp - 4], 0x53
mov byte [ebp - 4], 0x59
lea ecx, [ebp - 0x12c]
call fcn.0040a62b
mov byte [ebp - 4], 0x5a
mov byte [ebp - 4], 0x3c
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x39c], eax
mov byte [ebp - 4], 0x5b
mov byte [ebp - 4], 0x5c
mov byte [ebp - 4], 0x3c
and dword [ebp - 0x2c8], 0
cmp dword [ebp - 0x2c8], 0
je 0x4886be
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x2d8]
push eax
push 1
push dword [ebp + 0xc]
push dword [ebp + 8]
mov ecx, dword [ebp - 0x2d0]
call fcn.0048bc2a
movzx eax, al
test eax, eax
jne 0x4886be
lea eax, [ebp - 0x6c]
push eax
push str._SelfUpdateImpl_KillProcess__CopyOrMoveFiles:
lea eax, [ebp - 0x2ac]
push eax
call fcn.00425f4c
add esp, 0xc
mov dword [ebp - 0x2f0], eax
mov eax, dword [ebp - 0x2f0]
mov dword [ebp - 0x2f4], eax
mov byte [ebp - 4], 0x5d
push dword [ebp - 0x2f4]
lea ecx, [ebp - 0x6c]
call fcn.0041dc17
mov byte [ebp - 4], 0x5e
lea ecx, [ebp - 0x2ac]
call fcn.0040a62b
mov byte [ebp - 4], 0x5f
mov byte [ebp - 4], 0x3c
lea eax, [ebp - 0x2ac]
mov dword [ebp - 0x3a0], eax
mov byte [ebp - 4], 0x60
mov byte [ebp - 4], 0x61
mov byte [ebp - 4], 0x3c
push 0x540e00
lea ecx, [ebp - 0x114]
call fcn.00409053
mov byte [ebp - 4], 0x62
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x2c4]
push eax
call fcn.0044ae06
pop ecx
pop ecx
mov dword [ebp - 0x2f8], eax
mov eax, dword [ebp - 0x2f8]
mov dword [ebp - 0x2fc], eax
mov byte [ebp - 4], 0x63
push dword [ebp - 0x2fc]
lea eax, [ebp - 0x114]
push eax
call fcn.004838f3
pop ecx
pop ecx
mov byte [ebp - 4], 0x64
lea ecx, [ebp - 0x2c4]
call fcn.00405a40
mov byte [ebp - 4], 0x65
mov byte [ebp - 4], 0x62
lea eax, [ebp - 0x2c4]
mov dword [ebp - 0x3a4], eax
mov byte [ebp - 4], 0x66
mov byte [ebp - 4], 0x67
mov byte [ebp - 4], 0x62
mov byte [ebp - 4], 0x68
lea ecx, [ebp - 0x114]
call fcn.0040a62b
mov byte [ebp - 4], 0x69
mov byte [ebp - 4], 0x3c
lea eax, [ebp - 0x114]
mov dword [ebp - 0x3a8], eax
mov byte [ebp - 4], 0x6a
mov byte [ebp - 4], 0x6b
mov byte [ebp - 4], 0x3c
and dword [ebp - 0x2c8], 0
cmp dword [ebp - 0x2c8], 0
je 0x488803
push dword [ebp + 8]
mov ecx, dword [ebp - 0x2d0]
call fcn.0048bf15
movzx eax, al
test eax, eax
jne 0x488803
push dword [ebp + 8]
push str._SelfUpdateImpl_KillProcess__REMOVE:
lea eax, [ebp - 0x1bc]
push eax
call fcn.00425f4c
add esp, 0xc
mov dword [ebp - 0x300], eax
mov eax, dword [ebp - 0x300]
mov dword [ebp - 0x304], eax
mov byte [ebp - 4], 0x6c
push dword [ebp - 0x304]
lea ecx, [ebp - 0x6c]
call fcn.0041dc17
mov byte [ebp - 4], 0x6d
lea ecx, [ebp - 0x1bc]
call fcn.0040a62b
mov byte [ebp - 4], 0x6e
mov byte [ebp - 4], 0x3c
lea eax, [ebp - 0x1bc]
mov dword [ebp - 0x3ac], eax
mov byte [ebp - 4], 0x6f
mov byte [ebp - 4], 0x70
mov byte [ebp - 4], 0x3c
push str.occupy.log
lea ecx, [ebp - 0xfc]
call fcn.00409053
mov byte [ebp - 4], 0x71
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x1d4]
push eax
call fcn.0044ae06
pop ecx
pop ecx
mov dword [ebp - 0x308], eax
mov eax, dword [ebp - 0x308]
mov dword [ebp - 0x30c], eax
mov byte [ebp - 4], 0x72
push dword [ebp - 0x30c]
lea eax, [ebp - 0xfc]
push eax
call fcn.004838f3
pop ecx
pop ecx
mov byte [ebp - 4], 0x73
lea ecx, [ebp - 0x1d4]
call fcn.00405a40
mov byte [ebp - 4], 0x74
mov byte [ebp - 4], 0x71
lea eax, [ebp - 0x1d4]
mov dword [ebp - 0x3b0], eax
mov byte [ebp - 4], 0x75
mov byte [ebp - 4], 0x76
mov byte [ebp - 4], 0x71
mov byte [ebp - 4], 0x77
lea ecx, [ebp - 0xfc]
call fcn.0040a62b
mov byte [ebp - 4], 0x78
mov byte [ebp - 4], 0x3c
lea eax, [ebp - 0xfc]
mov dword [ebp - 0x3b4], eax
mov byte [ebp - 4], 0x79
mov byte [ebp - 4], 0x7a
mov byte [ebp - 4], 0x3c
and dword [ebp - 0x2c8], 0
mov byte [ebp - 4], 0x7b
lea ecx, [ebp - 0xe4]
call fcn.0040a62b
mov byte [ebp - 4], 0x7c
mov byte [ebp - 4], 0x3b
lea eax, [ebp - 0xe4]
mov dword [ebp - 0x3b8], eax
mov byte [ebp - 4], 0x7d
mov byte [ebp - 4], 0x7e
mov byte [ebp - 4], 0x3b
mov byte [ebp - 4], 0x7f
lea ecx, [ebp - 0xcc]
call fcn.0040a62b
mov byte [ebp - 4], 0x80
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0xcc]
mov dword [ebp - 0x3bc], eax
mov byte [ebp - 4], 0x81
mov byte [ebp - 4], 0x82
mov byte [ebp - 4], 0xd
cmp dword [ebp - 0x2c8], 0
je 0x488873
mov byte [ebp - 0x2c9], 1
jmp 0x48887a
mov byte [ebp - 0x2c9], 0
mov al, byte [ebp - 0x2c9]
mov byte [ebp - 0x2cb], al
mov byte [ebp - 4], 0x83
lea ecx, [ebp - 0x6c]
call fcn.0040a62b
mov byte [ebp - 4], 0x84
mov byte [ebp - 4], 2
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x34c], eax
mov byte [ebp - 4], 0x85
mov byte [ebp - 4], 0x86
mov byte [ebp - 4], 2
mov dword [ebp - 4], 0x87
mov dword [ebp - 4], 0x88
lea ecx, [ebp - 0x2d8]
call fcn.0048e25c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2d8]
call fcn.0048cba9
mov al, byte [ebp - 0x2cb]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004ad99f
leave
ret 8