Function at 0x4b74e0
Capabilities:
Create pipe
Create process on windows
Create process suspended
Create two anonymous pipes
Get common file path
Get file size
Read file on windows
Resolve function by parsing pe exports
Write and execute a file
Write file on windows
Write pipe

Disassembly:
push 0xffffffffffffffff
push 0x564878
mov eax, dword fs:[0]
push eax
mov eax, 0x33f4
call fcn.00541260
mov eax, dword [0x5b7a9c]
xor eax, esp
mov dword [esp + 0x33f0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5b7a9c]
xor eax, esp
push eax
lea eax, [esp + 0x3408]
mov dword fs:[0], eax
mov eax, dword [esp + 0x3418]
mov edi, dword [esp + 0x3420]
mov esi, ecx
mov ecx, dword [eax + 8]
lea edx, [ecx - 1]
mov ecx, dword [esp + 0x341c]
cmp ecx, edx
jg 0x4b8594
mov eax, dword [eax + 4]
mov eax, dword [eax + ecx*4]
mov ecx, dword [eax + 4]
mov edx, dword [eax + 0xc]
mov ebp, dword [eax]
mov ebx, dword [eax + 8]
mov dword [esp + 0x28], ecx
mov ecx, dword [eax + 0x10]
mov dword [esp + 0x38], edx
mov edx, dword [eax + 0x1c]
mov eax, dword [eax + 0x18]
mov dword [esp + 0x40], ebp
mov dword [esp + 0x50], ecx
mov dword [esp + 0x6c], edx
mov dword [esp + 0x30], eax
mov dword [esp + 0x24], 0
test edi, edi
je 0x4b75a7
push 0x57e3a8
mov ecx, edi
call fcn.0050ae41
test eax, eax
je 0x4b75a7
cmp dword [edi + 0x2a8], 0
mov dword [esp + 0x24], edi
je 0x4b75a7
mov dword [esp + 0x30], 0x10
call fcn.0050830c
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4b75c1
push 0x80004005
call fcn.00401350
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 0x3410], eax
mov dword [esp + 0x70], 0xc
mov dword [esp + 0x78], 1
mov dword [esp + 0x74], eax
call fcn.0050830c
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4b7608
push 0x80004005
call fcn.00401350
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x20], eax
lea ecx, [esp + 0x18]
push ecx
push edi
push ebp
lea edx, [esp + 0x2c]
push ebx
push edx
mov byte [esp + 0x3424], 1
mov dword [esi + 0x5d0], 1
mov dword [esp + 0x2c], 0xffffffff
call fcn.004b4870
add esp, 0x14
test eax, eax
je 0x4b8545
mov eax, dword [esp + 0x18]
cmp eax, 0xffffffff
je 0x4b765e
mov dword [esi + 0x5d0], eax
call fcn.0050830c
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4b7678
push 0x80004005
call fcn.00401350
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x38]
mov byte [esp + 0x3410], 2
test eax, eax
je 0x4b76bb
push 0
push edi
push ebp
push eax
lea ecx, [esp + 0x3c]
push ecx
call fcn.004b4870
mov ecx, dword [esp + 0x40]
mov eax, dword [ecx - 0xc]
add esp, 0x14
neg eax
sbb eax, eax
and eax, ecx
mov dword [esp + 0x38], eax
xor eax, eax
push 0x44
push eax
lea edx, [esp + 0x84]
push edx
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], eax
call fcn.00540610
mov ebx, dword [esp + 0x3c]
mov eax, 5
add esp, 0xc
and ebx, 0x10
mov word [esp + 0xac], ax
mov dword [esp + 0x7c], 0x44
mov dword [esp + 0xa8], 1
mov dword [esp + 0x3c], ebx
mov eax, 0x100
jne 0x4b7d73
test dword [esp + 0x30], eax
jne 0x4b7d8a
lea ecx, [esp + 0x1c]
call fcn.00401d40
push 0
push edi
mov edi, dword [esp + 0x30]
push ebp
lea ecx, [esp + 0x28]
push edi
push ecx
mov byte [esp + 0x3424], 4
call fcn.004b4870
mov ebx, dword [esp + 0x44]
add esp, 0x14
test ebx, 0x200
jne 0x4b791c
test bl, 1
jne 0x4b791c
push edi
call fcn.004b22f0
add esp, 4
test eax, eax
jne 0x4b791c
push edi
call fcn.0044d530
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x4b7785
mov ebp, 0x57bd68
lea edi, [esi + 0x160]
push edi
push 0x208
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push str.epp_run.cmd
push edi
call fcn.00411af0
add esp, 8
lea ecx, [esp + 0x44]
call fcn.0044fce0
push 1
push 1
push 0x40000000
push edi
lea ecx, [esp + 0x54]
mov byte [esp + 0x3420], 5
call fcn.00450840
test eax, eax
je 0x4b7909
push 0x22
lea ecx, [esp + 0x18]
call fcn.004297f0
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x18]
call fcn.00414960
push 0x22
lea ecx, [esp + 0x18]
call fcn.00405f80
mov eax, dword [esp + 0x20]
cmp dword [eax - 0xc], 0
jle 0x4b7818
push 0x20
lea ecx, [esp + 0x18]
call fcn.00405f80
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x18]
call fcn.00414960
push str._echo_off_r_n
lea edx, [esp + 0xcf8]
push 0x1388
push edx
call fcn.0054013c
push 0x582f8c
push ebp
call fcn.005408be
add esp, 0x14
test eax, eax
je 0x4b7858
push 0x582f84
push ebp
call fcn.005408be
add esp, 8
test eax, eax
mov eax, 0x57bd68
jne 0x4b785d
mov eax, str.call
push eax
lea eax, [esp + 0xcf8]
push eax
call fcn.004b2540
mov ecx, dword [esp + 0x1c]
push ecx
lea edx, [esp + 0xd00]
push edx
call fcn.004b2540
push str._r_npause
lea eax, [esp + 0xd08]
push 0x1388
push eax
call fcn.005400bf
lea eax, [esp + 0xd10]
add esp, 0x1c
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4b78a1
sub eax, edx
sar eax, 1
mov ebp, eax
lea ebx, [ebp + ebp]
lea ecx, [ebx + 1]
push ecx
call fcn.004ff272
add esp, 4
push 0
push 0
push ebx
mov edi, eax
push edi
push ebp
lea edx, [esp + 0xd08]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push eax
push edi
lea ecx, [esp + 0x4c]
mov byte [eax + edi], 0
call fcn.004509e0
push edi
call fcn.004ff267
add esp, 4
lea eax, [esi + 0x160]
push eax
lea ecx, [esp + 0x18]
call fcn.00402260
mov ebx, dword [esp + 0x30]
lea ecx, [esp + 0x44]
mov byte [esp + 0x3410], 4
call fcn.0044fd20
jmp 0x4b794d
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x18]
call fcn.00405fa0
mov ecx, dword [esp + 0x20]
cmp dword [ecx - 0xc], 0
jle 0x4b794d
push 0x20
lea ecx, [esp + 0x18]
call fcn.00405f80
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x18]
call fcn.00414960
mov eax, ebx
and eax, 1
mov dword [esp + 0x3c], eax
je 0x4b7b70
cmp dword [esi + 0x5e8], 0
jne 0x4b79c1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea edi, [esi + 0x570]
push 0x582f50
push edi
call fcn.004b2560
add esp, 0xc
push edi
push 0x1000
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 0x5e8], eax
test eax, eax
jne 0x4b79c1
push eax
push eax
push eax
push 0x53ec
call fcn.00450540
xor eax, eax
add esp, 0x10
lea ecx, [esp + 0x1c]
mov word [edi], ax
call fcn.00401b70
jmp 0x4b7f91
cmp dword [esi + 0xb8], 0
jne 0x4b7a0d
mov ecx, dword [esi + 0x5e8]
push 0
push 0
push 0
push 0xf001f
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0xb8], eax
test eax, eax
jne 0x4b7a0d
push 0
push 0
push 0
push 0x53ec
call fcn.00450540
add esp, 0x10
lea ecx, [esp + 0x1c]
call fcn.00401b70
jmp 0x4b7f91
mov edx, dword [esi + 0xb8]
mov eax, dword [esp + 0x14]
mov ecx, dword [eax - 0xc]
push 0
push 0
push 0xff6
add edx, 3
push edx
push ecx
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, dword [esi + 0xb8]
mov byte [eax + ecx + 3], 0
mov edx, dword [esi + 0xb8]
push 0x582f4c
add edx, 3
push 0xff6
push edx
call fcn.005421af
mov ebx, dword [sym.imp.KERNEL32.dll_CreatePipe]
add esp, 0xc
push 0
lea eax, [esp + 0x48]
push eax
lea edi, [esi + 0x5dc]
push edi
lea ecx, [esi + 0x5d8]
push ecx
mov dword [esp + 0x54], 0xc
mov dword [esp + 0x5c], 1
mov dword [esp + 0x58], 0
call ebx
push 0
test eax, eax
je 0x4b79ee
lea edx, [esp + 0x48]
push edx
lea eax, [esi + 0x15c]
push eax
lea ebp, [esi + 0x5e0]
push ebp
mov dword [esp + 0x54], 0xc
mov dword [esp + 0x5c], 1
mov dword [esp + 0x58], 0
call ebx
test eax, eax
je 0x4b79ec
lea ecx, [esp + 0x28]
call fcn.00401d40
mov edx, dword [0x5ba2a8]
mov eax, dword [edx + 0xdc]
lea ecx, [esi + 0x570]
push ecx
push eax
lea ecx, [esp + 0x30]
push str._slauncher.exe__s
push ecx
mov byte [esp + 0x3420], 6
call fcn.00406020
add esp, 0x10
lea edx, [esp + 0x28]
push edx
lea ecx, [esp + 0x18]
call fcn.00405fa0
mov ecx, dword [ebp]
mov edi, dword [edi]
mov edx, dword [esi + 0xb8]
or dword [esp + 0xa8], 0x100
mov dword [esp + 0xb4], ecx
xor eax, eax
mov word [esp + 0xac], ax
mov dword [esp + 0xb8], edi
mov dword [esp + 0xbc], edi
mov byte [edx + 2], 1
mov eax, dword [esi + 0xb8]
mov byte [eax + 1], 1
mov ecx, dword [esi + 0xb8]
mov byte [ecx], 1
lea ecx, [esp + 0x28]
mov byte [esp + 0x3410], 4
call fcn.00401b70
mov edx, dword [esp + 0x14]
mov ebp, dword [edx - 0xc]
inc ebp
xor ecx, ecx
mov eax, ebp
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004ff272
mov edi, eax
mov eax, dword [esp + 0x18]
push eax
push ebp
push edi
call fcn.0054013c
mov eax, dword [esp + 0x48]
add esp, 0x10
lea ecx, [esp + 0x54]
push ecx
lea edx, [esp + 0x80]
push edx
push eax
xor ebp, ebp
push ebp
push ebp
push 1
push ebp
push ebp
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push edi
mov ebx, eax
call fcn.004ff267
mov eax, dword [esi + 0x5dc]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 4
cmp eax, ebp
je 0x4b7be7
push eax
call edi
mov dword [esi + 0x5dc], ebp
mov eax, dword [esi + 0x5e0]
cmp eax, ebp
je 0x4b7bfa
push eax
call edi
mov dword [esi + 0x5e0], ebp
cmp ebx, ebp
je 0x4b7d2b
mov ecx, dword [esp + 0x54]
push ecx
call edi
mov edx, dword [esp + 0x58]
push edx
call edi
cmp dword [esp + 0x3c], ebp
je 0x4b7d42
mov eax, dword [esp + 0x6c]
mov ecx, dword [esp + 0x50]
push 1
push eax
push ecx
mov ecx, esi
call fcn.004b2890
lea edx, [esp + 0x2c]
lea ecx, [esi + 0x134]
push edx
call fcn.00405fa0
lea ecx, [esp + 0x24]
call fcn.00401d40
push str.__________
lea ecx, [esp + 0x28]
mov byte [esp + 0x3414], 7
call fcn.00402260
mov ebx, dword [esp + 0x40]
xor edi, edi
cmp word [ebx], bp
je 0x4b7c8d
mov eax, ebx
lea esp, [esp]
movzx eax, word [eax]
cmp ax, 0x26
je 0x4b7c83
push eax
lea ecx, [esp + 0x28]
call fcn.00405b30
inc edi
cmp word [ebx + edi*2], bp
lea eax, [ebx + edi*2]
jne 0x4b7c70
push str.___________
lea ecx, [esp + 0x28]
call fcn.004022a0
mov eax, dword [esp + 0x24]
mov ecx, dword [eax - 0xc]
push 1
push ecx
push eax
mov ecx, esi
call fcn.004b2780
mov ecx, dword [0x5ed04c]
push ebp
push 1
push esi
call fcn.0050e34e
mov eax, dword [0x5ed04c]
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, dword [0x5ed04c]
cmp eax, ebp
jne 0x4b7cd8
xor eax, eax
jmp 0x4b7cdb
mov eax, dword [eax + 0x20]
mov dword [esi + 0x5e4], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x11c], eax
cmp dword [esp + 0x3424], ebp
je 0x4b7d0a
push esi
call fcn.004b6d70
add esp, 4
lea ecx, [esp + 0x24]
call fcn.00401b70
jmp 0x4b7d42
push ebp
push ebp
push ebp
push 0xfffffffffffffffe
push esi
push fcn.004b6d70
call fcn.00512bba
lea ecx, [esp + 0x24]
mov dword [esi + 0x5d4], eax
call fcn.00401b70
jmp 0x4b7d42
mov ecx, esi
call fcn.004b2330
push ebp
push ebp
push ebp
push 0x5b9e
call fcn.00450540
add esp, 0x10
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
mov byte [esp + 0x3410], 2
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4b851d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x4b851d
test dword [esp + 0x30], eax
jne 0x4b7d8a
mov ecx, dword [esp + 0x28]
push ecx
call fcn.004b22f0
add esp, 4
test eax, eax
jne 0x4b7d94
xor edx, edx
mov word [esp + 0xac], dx
mov eax, dword [esp + 0x28]
push 0
push edi
push ebp
push eax
lea ecx, [esp + 0x24]
push ecx
call fcn.004b4870
mov edi, dword [esp + 0x34]
add esp, 0x14
cmp dword [edi - 0xc], 0
jle 0x4b7dcd
push 0x20
lea ecx, [esp + 0x18]
call fcn.00405b30
mov eax, dword [edi - 0xc]
push eax
push edi
lea ecx, [esp + 0x1c]
call fcn.00401fe0
mov edx, dword [esp + 0x14]
mov edi, dword [edx - 0xc]
inc edi
xor ecx, ecx
mov eax, edi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004ff272
mov ecx, dword [esp + 0x18]
push ecx
push edi
push eax
mov dword [esp + 0x74], eax
call fcn.0054013c
xor ebp, ebp
xor edi, edi
xor edx, edx
xor eax, eax
xor ecx, ecx
add esp, 0x10
mov dword [esp + 0x68], ebp
mov dword [esp + 0x28], edi
mov word [esp + 0x8e4], dx
mov word [esp + 0x4d4], ax
mov word [esp + 0xc4], cx
test ebx, ebx
je 0x4b80e7
lea edx, [esp + 0x4d4]
push edx
push 0x208
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [esp + 0xc4]
push eax
push edi
lea ecx, [esp + 0x4dc]
push 0x582ef0
push ecx
call fcn.004506e0
mov ecx, dword [esp + 0x34]
add esp, 0x10
mov dword [esp + 0x1c], edi
cmp ecx, edi
je 0x4b7f83
mov eax, dword [ecx + 0x2a8]
cmp eax, edi
je 0x4b7e8c
mov ebx, dword [ecx + 0x2ac]
mov dword [esp + 0x18], eax
jmp 0x4b7f7c
mov edx, dword [esp + 0x18]
cmp edx, 0xffffffff
je 0x4b7e99
cmp edx, edi
jne 0x4b7ed2
mov eax, dword [ecx + 0xf8]
cmp eax, 0xf4240
mov dword [esi + 0x5d0], eax
jle 0x4b7eb7
add eax, 0xfff0bdc0
mov dword [esi + 0x5d0], eax
cmp dword [esi + 0x5d0], 0xfde9
je 0x4b7ed2
cmp edx, 0xffffffff
jne 0x4b7ed2
mov dword [esi + 0x5d0], 1
mov edx, dword [ecx + 0xf4]
lea eax, [esp + 0x1c]
cmp dword [ecx + 0x100], edi
je 0x4b7ef3
push 1
push 1
push 0
push edx
push eax
call fcn.0047fcf0
jmp 0x4b7efe
push 0
push 0
push edx
push eax
call fcn.0047fbc0
mov ebx, eax
mov eax, dword [esi + 0x5d0]
cmp eax, 0x4b0
jne 0x4b7f19
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x18], ecx
add ebx, ebx
jmp 0x4b7f7c
mov edx, dword [esp + 0x1c]
push 0
push 0
push 0
push 0
push ebx
push edx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebp, eax
lea eax, [ebp + 1]
push eax
call fcn.004ff272
mov ecx, dword [esp + 0x20]
mov edx, dword [esi + 0x5d0]
add esp, 4
push 0
push 0
push ebp
mov edi, eax
push edi
push ebx
push ecx
push 0
push edx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebp, eax
mov byte [edi + ebp], 0
mov eax, dword [esp + 0x1c]
push eax
call fcn.004ff267
add esp, 4
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], edi
mov ebx, ebp
cmp dword [esp + 0x18], 0
jne 0x4b7fb1
push 0xffffffffffffffff
push 0
push 0x53eb
call fcn.0050bdf5
lea ecx, [esp + 0x2c]
call fcn.00401b70
lea ecx, [esp + 0x20]
call fcn.00401b70
lea ecx, [esp + 0x14]
call fcn.00401b70
jmp 0x4b8594
push 0
push 0x80
push 2
lea ecx, [esp + 0x7c]
push ecx
push 3
push 0xc0000000
lea edx, [esp + 0xdc]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
mov dword [esp + 0x68], ebp
cmp ebp, 0xffffffff
jne 0x4b8001
push eax
push 0
push 0x53ef
call fcn.0050bdf5
mov eax, dword [esp + 0x1c]
push eax
call fcn.004ff267
push edi
call fcn.004ff267
add esp, 8
jmp 0x4b7f91
mov edx, dword [esp + 0x18]
push 0
lea ecx, [esp + 0xc4]
push ecx
push ebx
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
push 0
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x1c]
push eax
call fcn.004ff267
push edi
call fcn.004ff267
lea ecx, [esp + 0x8ec]
push ecx
push 0
lea edx, [esp + 0x4e4]
push 0x57e7e0
push edx
call fcn.004506e0
add esp, 0x18
push 0
push 0x80
push 2
lea eax, [esp + 0x7c]
push eax
push 3
push 0xc0000000
lea ecx, [esp + 0x8fc]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [esp + 0x28], edi
cmp edi, 0xffffffff
jne 0x4b80ab
push eax
push 0
push 0x53ef
call fcn.0050bdf5
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0xc4]
push edx
call fcn.0044dfe0
add esp, 4
jmp 0x4b7f91
mov eax, dword [esp + 0x30]
or dword [esp + 0xa8], 0x100
and eax, 0x50
mov dword [esp + 0xb4], ebp
mov dword [esp + 0xb8], edi
cmp al, 0x50
jne 0x4b80d8
mov dword [esp + 0xbc], edi
jmp 0x4b80e7
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esp + 0xbc], eax
mov ecx, dword [esp + 0x40]
push ecx
lea edx, [esp + 0x18]
push 0x54db
push edx
call fcn.00402170
mov ecx, dword [0x5ed04c]
add esp, 0xc
push 0
lea eax, [esp + 0x18]
push eax
call fcn.004625a0
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x54]
push ecx
mov ecx, dword [esp + 0x68]
lea edx, [esp + 0x80]
push edx
push eax
push 0
push 0
push 1
push 0
push 0
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x4b84d3
cmp dword [esp + 0x3c], 0
je 0x4b84c3
lea ecx, [esp + 0x37]
call fcn.00409b90
mov edx, dword [esp + 0x54]
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x7530
push edx
mov byte [esp + 0x3418], 3
call ebx
mov edi, eax
cmp edi, 0x102
jne 0x4b81a9
nop
push 0xffffffffffffffff
push 5
push 0x53ea
call fcn.0050bdf5
cmp eax, 2
je 0x4b81a9
mov eax, dword [esp + 0x54]
push 0x7530
push eax
call ebx
mov edi, eax
cmp edi, 0x102
je 0x4b8180
test edi, edi
jne 0x4b84a4
mov ecx, dword [esp + 0x28]
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esp + 0x18], eax
test eax, eax
jle 0x4b8499
inc eax
push eax
xor ebx, ebx
call fcn.004ff272
mov edi, dword [esp + 0x2c]
add esp, 4
push ebx
push ebx
push ebx
push edi
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x18]
push ebx
lea edx, [esp + 0x3c]
push edx
push eax
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
mov byte [ecx + ebp], bl
test edi, edi
je 0x4b822f
mov eax, dword [edi + 0x2a8]
test eax, eax
je 0x4b822f
push eax
call fcn.004ff267
mov edx, dword [esp + 0x1c]
add esp, 4
mov dword [edi + 0x2a8], ebp
mov dword [edi + 0x2ac], edx
jmp 0x4b84a4
cmp byte [ebp], 0xff
jne 0x4b824e
cmp byte [ebp + 1], 0xfe
jne 0x4b824e
mov eax, dword [esp + 0x18]
cdq
sub eax, edx
sar eax, 1
dec eax
lea edi, [ebp + 2]
mov dword [esp + 0x18], eax
jmp 0x4b82b4
mov eax, dword [esp + 0x18]
push eax
push ebp
call fcn.0044e3e0
mov edi, eax
mov eax, dword [esp + 0x20]
xor ecx, ecx
inc eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004ff272
add esp, 0xc
mov ebx, eax
mov eax, dword [esp + 0x18]
push eax
dec edi
push ebx
neg edi
push eax
sbb edi, edi
push ebp
and edi, 0xffff0218
push 0
add edi, 0xfde9
push edi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor ecx, ecx
mov dword [esp + 0x18], eax
push ebp
mov word [ebx + eax*2], cx
mov edi, ebx
call fcn.004ff267
add esp, 4
xor ebp, ebp
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x44]
push eax
push edi
call fcn.0046e7d0
add esp, 0xc
test eax, eax
je 0x4b82da
mov edi, dword [esp + 0x40]
push ebx
call fcn.004ff267
add esp, 4
xor ebx, ebx
mov eax, dword [esp + 0x30]
mov ecx, eax
and ecx, 0x50
cmp cl, 0x50
jne 0x4b833c
mov edx, dword [esp + 0x6c]
mov eax, dword [esp + 0x50]
push 1
push edx
push eax
mov ecx, esi
call fcn.004b2890
mov ecx, dword [esp + 0x18]
push ecx
mov ecx, dword [0x5ed04c]
push edi
add ecx, 0x5fc
call fcn.004b2a90
mov ecx, dword [0x5ed04c]
push 0
push 1
lea edx, [ecx + 0x5fc]
push edx
call fcn.0050e34e
push ebx
call fcn.004ff267
push ebp
call fcn.004ff267
add esp, 8
jmp 0x4b84a4
and eax, 0x12
cmp al, 0x12
jne 0x4b8373
mov eax, dword [esp + 0x18]
mov ecx, dword [0x5ed04c]
mov edx, dword [ecx + 0x20]
push 0
push 0
push eax
push edi
push edx
call fcn.00486ee0
add esp, 0x14
push ebx
call fcn.004ff267
push ebp
call fcn.004ff267
add esp, 8
jmp 0x4b84a4
mov ecx, dword [esp + 0x24]
call fcn.0046e620
mov esi, eax
test esi, esi
je 0x4b83d3
push 0x57ef54
mov ecx, esi
call fcn.0050ae41
test eax, eax
je 0x4b83d3
mov eax, dword [esp + 0x30]
and eax, 0x30
push 0
cmp al, 0x30
jne 0x4b83e7
push 0
mov ecx, esi
call fcn.00495400
mov ecx, dword [esi + 0x8c]
mov edx, dword [esp + 0x18]
mov eax, dword [esi + 0x70]
push ecx
mov ecx, dword [esi + 0x74]
push edx
push edi
push eax
push ecx
mov ecx, dword [esp + 0x38]
call fcn.0047e380
push 0
push 0
push 1
mov ecx, esi
call fcn.004958c0
push ebx
call fcn.004ff267
push ebp
call fcn.004ff267
add esp, 8
jmp 0x4b84a4
mov edx, dword [esp + 0x28]
mov eax, dword [edx + 0x100]
test eax, eax
je 0x4b8423
mov edx, dword [esp + 0x1c]
xor ecx, ecx
cmp eax, 2
sete cl
push 1
push 1
push ecx
push edx
push edi
mov ecx, esi
call fcn.0049b680
push ebx
call fcn.004ff267
push ebp
call fcn.004ff267
add esp, 8
jmp 0x4b84a4
mov ecx, dword [esp + 0x28]
mov eax, dword [ecx + 0x2d0]
mov ecx, dword [ecx + 0x31c]
dec eax
lea edx, [eax + eax*8]
mov ecx, dword [ecx + edx*4]
mov edx, dword [esi + 0x8c]
push edx
mov edx, dword [esp + 0x20]
push edx
push edi
push eax
dec ecx
push ecx
mov ecx, dword [esp + 0x3c]
push 0
push 0
call fcn.00481920
mov eax, dword [esp + 0x30]
and eax, 0x90
cmp al, 0x90
jne 0x4b83c6
push 0
push 0
push 0
mov ecx, esi
call fcn.004958c0
mov eax, dword [esi + 0x70]
mov ecx, dword [esi + 0x74]
push 0
push 0
push eax
push ecx
mov ecx, esi
call fcn.004948e0
push ebx
call fcn.004ff267
push ebp
call fcn.004ff267
add esp, 8
jmp 0x4b84a4
mov ecx, dword [0x5ba2a8]
call fcn.00411ad0
lea ecx, [esp + 0x37]
mov byte [esp + 0x3410], 2
call fcn.0040abf0
mov edi, dword [esp + 0x28]
mov ebp, dword [esp + 0x68]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esp + 0x54]
push edx
call ebx
mov eax, dword [esp + 0x58]
push eax
call ebx
jmp 0x4b84e6
push 0
push 0
push 0
push 0x5b9e
call fcn.00450540
add esp, 0x10
mov ecx, dword [esp + 0x64]
push ecx
call fcn.004ff267
add esp, 4
cmp dword [esp + 0x3c], 0
je 0x4b851d
push ebp
call ebx
push edi
call ebx
lea edx, [esp + 0xc4]
push edx
call fcn.0044dfe0
lea eax, [esp + 0x8e8]
push eax
call fcn.0044dfe0
add esp, 8
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
mov byte [esp + 0x3410], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4b8545
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov byte [esp + 0x3410], 0
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4b856d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov dword [esp + 0x3410], edx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4b8594
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x3408]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x33f0]
xor ecx, esp
call fcn.0053fa67
add esp, 0x3400
ret 0x10