Function at 0x4d4f40
Capabilities:
Delete file

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov ebx, dword [edx + 0x4c]
mov ebp, dword [esp + 0x70]
test ebx, ebx
jne 0x4d511b
mov esi, eax
test ebp, ebp
mov eax, ecx
mov ebx, edx
mov dword [esp + 0x18], esi
je 0x4d5180
mov edi, 0x50014e
mov ecx, 0xb
mov esi, ebp
repe cmpsb byte [esi], byte es:[edi]
jne 0x4d4fc1
cmp dword [0x4f7268], 3
jg 0x4d5160
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x20
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__fileno]
mov dword [esp + 4], 0x8000
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__setmode]
cmp dword [ebx + 4], 1
je 0x4d5125
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x20
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
test eax, eax
je 0x4d5000
mov dword [esp + 4], ebp
mov dword [esp], eax
call fcn.004dcfb0
test eax, eax
je 0x4d5000
mov ecx, dword [0x4f7268]
test ecx, ecx
jle 0x4d511b
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 4], str.zstd:_Refusing_to_open_an_output_file_which_will_overwrite_the_input_file__n
add eax, 0x40
mov dword [esp], eax
call fcn.004cfcb0
xor eax, eax
jmp 0x4d4fb9
mov dword [esp], ebp
call fcn.004dcd50
test eax, eax
je 0x4d50ab
mov edx, dword [ebx + 0x58]
test edx, edx
jne 0x4d506e
cmp dword [0x4f7268], 1
mov dword [esp + 8], ebp
jle 0x4d521a
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 4], str.zstd:__s_already_exists_
add eax, 0x40
mov dword [esp], eax
call fcn.004cfcb0
mov eax, dword [esp + 0x18]
mov eax, dword [eax]
mov dword [esp + 8], 0x5002ae
mov dword [esp + 4], str.Not_overwritten___n
mov dword [esp], str.overwrite__y_n___
mov dword [esp + 0xc], eax
call fcn.004dcc60
test eax, eax
jne 0x4d511b
lea ebx, [esp + 0x20]
mov dword [esp], ebp
mov dword [esp + 4], ebx
call fcn.004dcd20
test eax, eax
jne 0x4d51b0
cmp dword [0x4f7268], 1
jle 0x4d50ab
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], ebp
mov dword [esp + 4], str.zstd:_Failed_to_stat__s_while_trying_to_remove_it_n
add eax, 0x40
mov dword [esp], eax
call fcn.004cfcb0
mov eax, dword [esp + 0x74]
mov dword [esp + 4], 0x8301
mov dword [esp], ebp
mov dword [esp + 8], eax
call dword [sym.imp.msvcrt.dll__open]
cmp eax, 0xffffffff
je 0x4d50e2
mov dword [esp + 4], 0x500836
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__fdopen]
test eax, eax
jne 0x4d4fb9
mov eax, dword [0x4f7268]
test eax, eax
jle 0x4d511b
call dword [sym.imp.msvcrt.dll__errno]
mov eax, dword [eax]
mov dword [esp], eax
call sub.msvcrt.dll_strerror
mov dword [esp + 0xc], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], ebp
mov dword [esp + 4], str.zstd:__s:__s_n
add eax, 0x40
mov dword [esp], eax
call fcn.004cfcb0
add esp, 0x5c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
cmp dword [0x4f7268], 3
mov dword [ebx + 4], 0
jle 0x4d4fb1
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 4], str.Sparse_File_Support_is_automatically_disabled_on_stdout___try___sparse__n
add eax, 0x40
mov dword [esp], eax
call fcn.004cfcb0
jmp 0x4d4fb1
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 4], str.Using_stdout_for_output__n
add eax, 0x40
mov dword [esp], eax
call fcn.004cfcb0
jmp 0x4d4f85
mov dword [esp + 8], 0x28e
mov dword [esp + 4], 0x4ff030
mov dword [esp], str.dstFileName___NULL
mov dword [esp + 0x1c], ecx
call fcn.004ec460
mov eax, dword [esp + 0x1c]
jmp 0x4d4f68
mov dword [esp], ebx
call fcn.004dcd90
test eax, eax
jne 0x4d51f0
cmp dword [0x4f7268], 1
jle 0x4d50ab
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], ebp
mov dword [esp + 4], str.zstd:_Refusing_to_remove_non_regular_file__s_n
add eax, 0x40
mov dword [esp], eax
call fcn.004cfcb0
jmp 0x4d50ab
test byte [esp + 0x26], 0x80
je 0x4d5204
mov dword [esp], ebp
call sub.msvcrt.dll_remove
jmp 0x4d50ab
mov dword [esp + 8], pe_nt_image_headers32
mov dword [esp + 4], ebx
mov dword [esp], ebp
call fcn.004dcdb0
jmp 0x4d51f7
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 4], str.zstd:__s_already_exists__not_overwritten___n
add eax, 0x40
mov dword [esp], eax
call fcn.004cfcb0
xor eax, eax
jmp 0x4d4fb9