Function at 0x4c9d40
Capabilities:
Delete file
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51b130
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
push ebx
push esi
push edi
mov eax, dword [0x57b728]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [ebp + 8]
xor edi, edi
mov ecx, dword [ebx + 0x64]
mov eax, dword [ebx + 0x60]
push edi
push edi
push ecx
push eax
push dword [esi + 8]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x20], ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x4c9e43
cmp dword [0x57604c], str.The_offset_of_the_file__
lea ecx, [esi + 0x78]
jne 0x4c9da6
call fcn.00419670
jmp 0x4c9db4
push 0
push 0xffffffffffffffff
push str.The_offset_of_the_file__
call fcn.00418a80
push 0xffffffffffffffff
push dword [ebx + 0x3c]
mov ecx, eax
call fcn.00418b20
cmp dword [0x57604c], 0x546c50
mov ecx, eax
jne 0x4c9dd5
call fcn.00419670
jmp 0x4c9de3
push 0
push 0xffffffffffffffff
push str.__is_invalid__the_file_is_not_extracted._nRead_value_was
call fcn.00418a80
push dword [ebp - 0x20]
mov esi, dword [0x57604c]
push dword [ebp - 0x18]
push eax
call fcn.00418850
add esp, 0xc
mov ecx, eax
cmp esi, dword [0x57604c]
jne 0x4c9e20
call fcn.00419670
mov eax, 0x19
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0
push 0xffffffffffffffff
push esi
call fcn.00418a80
mov eax, 0x19
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea eax, [ebx + 0x34]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x44]
push eax
call fcn.004147b0
add esp, 0xc
push 0
push 0x80
push 2
push 0
push 0
push 2
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x14], eax
call fcn.00417dd0
cmp dword [ebp - 0x14], 0xffffffff
jne 0x4c9f7b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0x20]
mov edi, eax
mov eax, dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.004147b0
add esp, 0xc
mov ebx, eax
add esi, 0x78
cmp dword [0x57604c], 0x5344c4
mov dword [ebp - 4], 0
mov ecx, esi
jne 0x4c9ec2
call fcn.00419670
jmp 0x4c9ed0
push 0
push 0xffffffffffffffff
push str.The_file__
call fcn.00418a80
push 0xffffffffffffffff
push dword [ebx + 8]
mov ecx, eax
call fcn.00418b20
cmp dword [0x57604c], 0x546ca8
mov ecx, eax
jne 0x4c9ef1
call fcn.00419670
jmp 0x4c9eff
push 0
push 0xffffffffffffffff
push str.__cannot_be_created._n
call fcn.00418a80
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], 0xffffffff
call fcn.00417dd0
mov ecx, esi
cmp edi, 0x7b
jne 0x4c9f3e
cmp dword [0x57604c], str.The_name_is_invalid_for_this_system.__ERROR_INVALID_NAME_
jne 0x4c9f2b
call fcn.00419670
jmp 0x4ca015
push 0
push 0xffffffffffffffff
push str.The_name_is_invalid_for_this_system.__ERROR_INVALID_NAME_
call fcn.00418a80
jmp 0x4ca015
cmp dword [0x57604c], str.Received_error:
jne 0x4c9f5e
call fcn.00419670
push edi
push eax
call fcn.00418470
add esp, 8
jmp 0x4ca015
push 0
push 0xffffffffffffffff
push str.Received_error:
call fcn.00418a80
push edi
push eax
call fcn.00418470
add esp, 8
jmp 0x4ca015
mov eax, dword [ebp + 8]
mov ebx, dword [ebx + 0x68]
mov eax, dword [eax + 0x6c]
mov dword [ebp - 0x18], eax
test ebx, ebx
je 0x4c9ffc
jmp 0x4c9f90
test edi, edi
jne 0x4c9ffc
cmp byte [esi + 0x68], 0
je 0x4c9fa1
mov edi, 0x4c7
jmp 0x4c9ff8
push 0
mov eax, 0x800000
cmp ebx, eax
lea ecx, [ebp - 0x10]
push ecx
cmovb eax, ebx
push eax
push dword [esi + 4]
mov dword [ebp - 0x10], eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jle 0x4ca14a
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x4ca0e2
push 0
lea ecx, [ebp - 0x18]
push ecx
push eax
push dword [esi + 4]
mov dword [ebp - 0x18], 0
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x10], eax
jne 0x4ca02b
sub ebx, eax
test ebx, ebx
jne 0x4c9f90
mov ebx, dword [ebp + 8]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x4ca015
push dword [ebx + 0x14]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push dword [ebp - 0x20]
mov eax, dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x68]
push eax
call fcn.004147b0
add esp, 0xc
mov edi, eax
cmp dword [0x57604c], 0x546d48
mov dword [ebp - 4], 1
lea ecx, [esi + 0x78]
jne 0x4ca05d
call fcn.00419670
jmp 0x4ca06b
push 0
push 0xffffffffffffffff
push str.Fails_to_write
call fcn.00418a80
push dword [ebp - 0x10]
push eax
call fcn.00418640
add esp, 8
cmp dword [0x57604c], 0x546d34
mov ecx, eax
jne 0x4ca08c
call fcn.00419670
jmp 0x4ca09a
push 0
push 0xffffffffffffffff
push str._bytes_to_file__
call fcn.00418a80
push 0xffffffffffffffff
push dword [edi + 8]
mov ecx, eax
call fcn.00418b20
cmp dword [0x57604c], 0x546d30
mov ecx, eax
jne 0x4ca0bb
call fcn.00419670
jmp 0x4ca0c9
push 0
push 0xffffffffffffffff
push 0x546d30
call fcn.00418a80
lea ecx, [ebp - 0x68]
mov dword [ebp - 4], 0xffffffff
call fcn.00417dd0
mov edi, 0x1d
jmp 0x4c9ffc
cmp dword [0x57604c], str.The_file__
lea ecx, [esi + 0x78]
jne 0x4ca0f8
call fcn.00419670
jmp 0x4ca106
push 0
push 0xffffffffffffffff
push str.The_file__
call fcn.00418a80
mov ebx, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebx + 0x3c]
mov ecx, eax
call fcn.00418b20
cmp dword [0x57604c], 0x546d10
mov ecx, eax
jne 0x4ca132
call fcn.00419670
mov edi, 0x19
jmp 0x4c9fff
push 0
push 0xffffffffffffffff
push str.__cannot_be_read_from_archive._n
call fcn.00418a80
mov edi, 0x19
jmp 0x4c9fff
cmp dword [0x57604c], str.The_file__
lea ecx, [esi + 0x78]
jne 0x4ca160
call fcn.00419670
jmp 0x4ca16e
push 0
push 0xffffffffffffffff
push str.The_file__
call fcn.00418a80
mov ebx, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebx + 0x3c]
mov ecx, eax
call fcn.00418b20
cmp dword [0x57604c], 0x546d10
mov ecx, eax
jne 0x4ca19a
call fcn.00419670
mov edi, 0x1e
jmp 0x4c9fff
push 0
push 0xffffffffffffffff
push str.__cannot_be_read_from_archive._n
call fcn.00418a80
mov edi, 0x1e
jmp 0x4c9fff