Function at 0x49e700
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d6728
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x1608
call fcn.004c1c40
mov eax, dword [0x4ec0b4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor ebx, ebx
cmp byte [ebp + 0x10], bl
je 0x49e758
cmp word [0x549076], bx
je 0x49e7b8
cmp dword [0x56ced4], ebx
je 0x49e7b8
xor eax, eax
mov word [0x549076], ax
jmp 0x49e7b8
push 1
call fcn.0049bb20
mov dword [0x54c1bc], 3
mov al, byte [ebp + 0xc]
cmp al, bl
je 0x49e775
mov byte [0x54c1f6], al
mov dword [0x534bf0], ebx
mov dword [0x534bf4], ebx
cmp byte [0x533b59], bl
jne 0x49e884
push ebx
push 0x55247c
mov ecx, 0x5404f0
call fcn.0044da00
cmp byte [0x54150a], bl
je 0x49e7b8
cmp dword [0x552490], 1
jbe 0x49e7b8
mov dword [0x54c1b8], 4
cmp byte [0x533b59], bl
jne 0x49e884
cmp word [0x55147a], bx
jne 0x49e884
mov byte [ebp + 8], bl
mov esi, 0x55147a
call fcn.0049b2f0
push 0x800
push 0x4d89fc
lea ecx, [ebp - 0x10b4]
push ecx
push str.DefFolder
push str.Compression
call fcn.0046ceb0
cmp word [ebp - 0x10b4], bx
jne 0x49e824
cmp byte [0x54150a], bl
je 0x49e861
lea edx, [ebp - 0x10b4]
push edx
call fcn.004498c0
cmp word [ebp - 0x10b4], bx
je 0x49e861
push 0x800
lea eax, [ebp - 0x10b4]
push eax
call fcn.004607d0
push 0x800
push 0x55147a
lea ecx, [ebp - 0x10b4]
push ecx
call fcn.0047fc20
push 0x800
lea edx, [ebp - 0x10b4]
push edx
push 0x55147a
call fcn.0047fbe0
mov eax, dword [0x54e418]
push eax
cmp word [0x547070], bx
setne cl
movzx edx, cl
push edx
push 0x800
push 0x55147a
call fcn.00498630
cmp dword [0x54c1b8], ebx
jne 0x49e896
mov dword [0x54c1b8], 5
cmp byte [0x533b59], bl
je 0x49e99e
mov esi, dword [0x542824]
cmp esi, ebx
je 0x49e8d7
cmp esi, 1
je 0x49e8d7
push 0x30
push 0x65
call fcn.00475cc0
push eax
push 0x1fd
call fcn.00475cc0
push eax
mov eax, dword [0x535cac]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x49ecb0
push 0x800
push 0x55147a
mov ecx, 0x542618
call fcn.004153c0
push 0x800
push 0x54a084
mov ecx, 0x542618
call fcn.004153a0
cmp word [0x54a084], bx
je 0x49e917
push 0x800
push 0x54a084
call fcn.004607d0
mov byte [0x54c210], bl
lea ecx, [ebp - 0x1614]
push ecx
mov ecx, 0x542618
call fcn.004153f0
mov eax, dword [ebp - 0x1594]
mov dword [0x54e418], eax
cmp eax, ebx
jne 0x49e94c
cmp byte [ebp - 0x1590], bl
mov byte [0x54c1f7], 1
jne 0x49e952
mov byte [0x54c1f7], bl
cmp esi, ebx
jne 0x49e95e
cmp dword [ebp - 0x1508], ebx
je 0x49e96a
mov edx, dword [ebp - 0x14cc]
mov dword [0x54c1a8], edx
xor eax, eax
cmp dword [ebp - 0x14ec], ebx
je 0x49e998
jmp 0x49e980
movzx ecx, word [eax + 0x4d8800]
mov word [eax + 0x547070], cx
add eax, 2
cmp cx, bx
jne 0x49e980
jmp 0x49e99e
mov word [0x547070], ax
mov ecx, dword [0x535cac]
push ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
neg eax
sbb eax, eax
and eax, dword [0x535cac]
push ebx
mov edx, dword [ebp + 8]
push edx
push eax
call fcn.0049e400
test al, al
je 0x49ec91
mov eax, dword [0x56cedc]
cmp eax, 1
je 0x49e9d7
cmp eax, 2
jne 0x49ea2c
mov eax, dword [0x56cee8]
push eax
mov ecx, dword [0x56cee4]
push ecx
mov edx, dword [0x56cee0]
push edx
push str._dd_dh_dm
lea eax, [ebp - 0xb4]
push eax
mov edx, 0x50
call fcn.00407810
add esp, 0x14
cmp dword [0x56cedc], 1
jne 0x49ea1b
lea ecx, [ebp - 0xb4]
push ecx
mov ecx, 0x54c318
jmp 0x49ea27
lea edx, [ebp - 0xb4]
push edx
mov ecx, 0x54c320
call fcn.00483260
mov eax, dword [0x56ced4]
cmp eax, ebx
je 0x49ea3d
push eax
call fcn.00496380
jmp 0x49ea5f
cmp byte [0x533b59], bl
je 0x49ea5f
cmp dword [ebp - 0x14ec], ebx
je 0x49ea5f
cmp word [0x547070], 0x2a
jne 0x49ea5f
xor eax, eax
mov word [0x547070], ax
cmp dword [0x552490], ebx
jne 0x49ea8e
push 0x30
push 0x65
call fcn.00475cc0
push eax
push 0x14b
call fcn.00475cc0
push eax
mov ecx, dword [0x535cac]
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x49ec91
cmp word [0x549076], bx
je 0x49eb05
cmp dword [0x54a078], ebx
jne 0x49eb05
push 0x4da470
push 0x549076
call fcn.0043d170
mov esi, eax
cmp esi, ebx
je 0x49eb05
push esi
push 0x400
push 1
lea edx, [ebp - 0x14b4]
push edx
call fcn.004c5285
add esp, 0x10
mov dword [ebp - 0x1618], 0x30c
cmp eax, ebx
jbe 0x49eafc
lea ecx, [ebp - 0x1618]
push ecx
push eax
lea edx, [ebp - 0x14b4]
push edx
call dword [sym.imp.ADVAPI32.dll_IsTextUnicode]
test eax, eax
je 0x49eafc
mov dword [0x54a078], 3
push esi
call fcn.004c4622
add esp, 4
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x70]
call fcn.00480330
mov byte [ebp - 4], 1
mov ecx, 0x55247c
call fcn.00480120
mov edi, edi
mov ecx, 0x55247c
call fcn.00480480
cmp eax, ebx
je 0x49eb56
push 0x800
lea ecx, [ebp - 0x10b4]
push ecx
push eax
mov ecx, 0x5404f0
call fcn.0044c5f0
lea edx, [ebp - 0x10b4]
push edx
lea ecx, [ebp - 0x70]
call fcn.004801a0
jmp 0x49eb20
lea eax, [ebp - 0x70]
push eax
mov ecx, 0x55247c
call fcn.0042e280
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x70]
call fcn.00401b50
mov dword [ebp - 4], 0xffffffff
jmp 0x49eb91
cmp byte [0x550425], bl
jne 0x49ebb2
push 0x800
push 0x55147a
push 0x55147a
mov ecx, 0x5404f0
call fcn.0044c5f0
mov cl, byte [0x54b184]
mov byte [0x535cdc], cl
mov ecx, 0x535cb0
call fcn.0047f5c0
cmp byte [0x55043c], bl
je 0x49ebd7
call fcn.0049c7a0
jmp 0x49ebe9
movzx edx, byte [0x550423]
push edx
mov ecx, 0x542618
call fcn.00419a60
cmp dword [0x56ced4], ebx
je 0x49ebfb
push 0x549076
call fcn.0043cde0
cmp dword [0x534b74], 1
je 0x49ec91
cmp byte [0x533b59], bl
je 0x49ec1c
mov ecx, 0x5404f0
call fcn.00451d40
jmp 0x49ec91
cmp byte [0x54c1f6], bl
je 0x49ec2e
mov ecx, 0x5404d0
call fcn.00486120
push 0x800
lea eax, [ebp - 0x10b4]
push eax
mov ecx, 0x5404f0
call fcn.0044c5c0
lea eax, [ebp - 0x10b4]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x49ec50
sub eax, edx
sar eax, 1
push eax
push 0x55147a
lea ecx, [ebp - 0x10b4]
push ecx
call fcn.004876b0
test eax, eax
jne 0x49ec81
push 0x55147a
call fcn.00460c50
jmp 0x49ec86
mov eax, 0x4d89fc
push eax
mov ecx, 0x5404f0
call fcn.00450010
mov edx, dword [0x56ced4]
push edx
call fcn.004c26ea
add esp, 4
mov byte [0x535cdc], bl
mov ecx, 0x535cb0
call fcn.0047f5c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004c1c22
mov esp, ebp
pop ebp
ret 0xc