Function at 0x4bc6a0
Capabilities:
Read file on windows
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x3864
call fcn.005e00d0
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0x3860], eax
push ebx
push ebp
push esi
push edi
mov ecx, dword [esp + 0x387c]
mov edx, dword [esp + 0x3880]
mov eax, dword [esp + 0x3878]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x3888]
mov dword [esp + 0x68], ecx
mov ecx, dword [esp + 0x3894]
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x388c]
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x389c]
mov dword [esp + 0x6c], edx
mov edx, dword [esp + 0x3898]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x38a4]
mov dword [esp + 0x1c], edx
mov edx, dword [esp + 0x38a0]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x38ac]
mov dword [esp + 0x44], edx
mov edx, dword [esp + 0x38a8]
mov ebx, dword [esp + 0x38c4]
mov dword [esp + 0x48], ecx
mov ecx, dword [esp + 0x38bc]
mov dword [esp + 0x64], edx
mov edx, dword [esp + 0x38b8]
mov ebp, dword [esp + 0x38d8]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x3884]
mov dword [esp + 0x5c], ecx
mov ecx, dword [esp + 0x38d4]
mov dword [esp + 0x50], edx
mov edx, dword [esp + 0x38cc]
mov esi, dword [esp + 0x38c8]
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x3890]
mov dword [esp + 0x54], ecx
xor ecx, ecx
mov edi, dword [esp + 0x38b4]
mov dword [esp + 0x20], edx
mov edx, dword [esp + 0x38e0]
mov dword [esp + 0x58], eax
mov dword [esp + 0x3c], edi
mov dword [esp + 0x38], ebp
mov dword [esp + 0x40], edx
mov dword [esp + 0x34], ecx
mov dword [esp + 0x60], ecx
cmp dword [eax], ecx
je 0x4bd62f
cmp ebp, ecx
je 0x4bc84d
cmp edi, ecx
je 0x4bc84d
cmp byte [edi], cl
je 0x4bc84d
push 0x641470
push edi
call fcn.004dd6e0
add esp, 8
test eax, eax
je 0x4bc81b
push str..doc
push edi
call fcn.004dd6e0
add esp, 8
test eax, eax
jne 0x4bc81b
push str..ppt
push edi
call fcn.004dd6e0
add esp, 8
test eax, eax
jne 0x4bc81b
push str..xlt
push edi
call fcn.004dd6e0
add esp, 8
test eax, eax
jne 0x4bc84d
push 0
push str.eicar
push ebp
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4bc845
push 0
push str.Psalm
push ebp
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x4bc84d
mov dword [esp + 0x60], 1
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
cmp eax, 0x100
jbe 0x4bc8f8
mov ecx, dword [esp + 0x30]
mov ecx, dword [ecx]
cmp ecx, 1
je 0x4bc8f8
cmp ecx, 2
je 0x4bc8f8
mov edx, dword [esp + 0x20]
cmp dword [edx], 0
jne 0x4bc8f8
mov edi, dword [esp + 0x24]
push eax
push edi
call fcn.0049eb30
add esp, 8
cmp eax, 1
jne 0x4bc8e3
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4bc8a0
mov dword [eax], 1
cmp byte [edi], 0x47
jne 0x4bc8bd
cmp byte [edi + 1], 0x49
jne 0x4bc8bd
cmp byte [edi + 2], 0x46
jne 0x4bc8bd
mov eax, dword [esp + 0x18]
mov dword [eax], 0x4c4355
jmp 0x4bc8db
mov ecx, dword [str.Mangled_EXE]
mov eax, dword [esp + 0x18]
mov dword [eax], ecx
mov edx, dword [0x6419d4]
mov dword [eax + 4], edx
mov ecx, dword [0x6419d8]
mov dword [eax + 8], ecx
mov dword [esp + 0x34], 1
cmp dword [esp + 0x34], 0
mov edx, dword [esp + 0x20]
mov dword [edx], 1
jne 0x4bd5d1
mov ebp, dword [esp + 0x18]
push str.cpio
push ebp
call fcn.004dd620
mov edi, dword [esp + 0x2c]
add esp, 8
test eax, eax
jne 0x4bc95b
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
cmp eax, 0x400
jbe 0x4bc926
push 0x400
jmp 0x4bc927
push eax
push str._MacDefend
push edi
call fcn.004f5ad0
add esp, 0xc
cmp eax, 0xffffffff
je 0x4bc95b
mov ecx, dword [str.MacBinary]
mov dword [ebp], ecx
mov edx, dword [0x63e70c]
mov dword [ebp + 4], edx
mov ax, word [0x63e710]
mov word [ebp + 8], ax
jmp 0x4bd5d1
push str.Virus_Signature
push ebp
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x4bc998
mov ecx, dword [esp + 0x14]
cmp dword [ecx], 0x190
jbe 0x4bc998
cmp byte [edi + 0x180], 0x2a
jne 0x4bc998
cmp byte [edi + 0x181], 0x2b
jne 0x4bc998
cmp byte [edi + 0x182], 0xff
je 0x4bd5d1
push 0x6419c4
push ebp
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x4bc9f1
push 6
push str.GIF87a
push edi
call fcn.004dd670
add esp, 0xc
test eax, eax
jne 0x4bc9f1
mov esi, dword [esp + 0x20]
cmp dword [esi], eax
jne 0x4bd5d1
mov edx, dword [esp + 0x14]
mov eax, dword [edx]
push eax
push edi
call fcn.0049eb30
add esp, 8
cmp eax, 1
jne 0x4bc9e6
mov dword [ebp], 0x4c4355
mov dword [esi], 1
jmp 0x4bd5d1
push 0x6419b8
push ebp
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4bd5d1
push 0x6419b4
push ebp
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4bd5d1
push 0x62f42c
push ebp
call fcn.004dd620
mov ebp, dword [sym.imp.KERNEL32.dll_SetFilePointer]
add esp, 8
test eax, eax
jne 0x4bcb71
mov ecx, dword [esp + 0x10]
cmp dword [ecx], 0
jne 0x4bcb49
mov edx, dword [0x7424a8]
mov eax, dword [esp + 0x24]
push 0
push 0
push edx
push eax
call fcn.004bb0e0
add esp, 0x10
cmp eax, 0xffffffff
jne 0x4bcb49
mov eax, dword [esp + 0x38c0]
mov ecx, dword [esp + 0x14]
sub eax, dword [ecx]
mov edi, 0x800
cmp eax, 0x800
ja 0x4bca82
mov edi, eax
cmp eax, 0x400
jbe 0x4bcb71
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x1c], 0
mov dword [edx], 1
test ebx, ebx
je 0x4bcae5
push ebx
call fcn.005e45b4
mov dword [esp + 0x24], eax
mov eax, edi
push 2
neg eax
push eax
push ebx
call fcn.005e0626
add esp, 0x10
test eax, eax
jne 0x4bcb1e
push ebx
push edi
lea ecx, [esp + 0x78]
push 1
push ecx
call fcn.005e057f
mov edx, dword [esp + 0x30]
push 0
push edx
push ebx
mov dword [esp + 0x38], eax
call fcn.005e0626
add esp, 0x1c
jmp 0x4bcb1e
push 1
push 0
push 0
push esi
call ebp
mov dword [esp + 0x20], eax
push 2
push 0
mov eax, edi
neg eax
push eax
push esi
call ebp
push 0
lea ecx, [esp + 0x20]
push ecx
push edi
lea edx, [esp + 0x7c]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x20]
push 0
push 0
push eax
push esi
call ebp
mov ecx, dword [esp + 0x1c]
add ecx, 0xffffffff
js 0x4bcb40
mov al, byte [esp + ecx + 0x70]
cmp al, 0x7d
je 0x4bcb40
test al, al
je 0x4bcb3b
cmp al, 0xa
je 0x4bcb3b
cmp al, 0xd
jne 0x4bcb58
sub ecx, 1
jns 0x4bcb27
mov edx, dword [esp + 0x10]
cmp dword [edx], 0
je 0x4bcb71
mov eax, dword [esp + 0x18]
mov dword [eax], 0x4c4355
jmp 0x4bd5d1
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov dword [ecx], 1
mov dword [eax], 0x4c4355
jmp 0x4bd5d1
mov ecx, dword [esp + 0x30]
cmp dword [ecx], 1
jne 0x4bd113
mov edi, dword [esp + 0x18]
push 0x62f418
push edi
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x4bcd54
mov edx, dword [esp + 0x14]
mov eax, dword [edx]
lea ecx, [eax - 1]
cmp ecx, 0x800
ja 0x4bcbac
dec eax
jmp 0x4bcbb1
mov eax, 0x800
mov edx, dword [0x7424a4]
push 0
push 0
push edx
push eax
mov eax, dword [esp + 0x34]
push eax
call fcn.004bb240
add esp, 0x14
cmp eax, 0xffffffff
je 0x4bcd54
mov ecx, dword [str.DOCX]
mov eax, edi
mov edi, dword [esp + 0x38c0]
mov dword [eax], ecx
mov dl, byte [0x6419b0]
mov byte [eax + 4], dl
mov eax, edi
mov dword [esp + 0x44], eax
fild dword [esp + 0x44]
test eax, eax
jge 0x4bcc01
fadd qword [0x60ecc0]
fcomp qword [str.ffffffVAxlt]
fnstsw ax
test ah, 5
jnp 0x4bcc25
mov ecx, dword [esp + 0x38]
push 0
push ecx
call fcn.004ad650
add esp, 8
test eax, eax
je 0x4bd5d1
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
push 0
push 0
push 0
lea edx, [esp + 0x50]
push edx
mov edx, dword [esp + 0x34]
dec ecx
push ecx
push 0
push str.media_image1.eps
push str.embeddings_oleobject
push str.vbaProject.bin
push edx
call fcn.004ab880
add esp, 0x28
cmp eax, 0xffffffff
je 0x4bcc75
mov ecx, dword [str.UCLDOCX]
mov eax, dword [esp + 0x18]
mov dword [eax], ecx
mov edx, dword [0x641998]
mov dword [eax + 4], edx
jmp 0x4bd5d1
mov eax, dword [esp + 0x14]
sub edi, dword [eax]
mov eax, edi
cmp eax, 0x800
jbe 0x4bcc89
mov edi, 0x800
cmp eax, 0x400
jbe 0x4bd5d1
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x10], 0
mov dword [ecx], 1
test ebx, ebx
je 0x4bcce6
push ebx
call fcn.005e45b4
mov edx, edi
push 2
neg edx
push edx
push ebx
mov esi, eax
call fcn.005e0626
add esp, 0x10
test eax, eax
jne 0x4bcd19
push ebx
push edi
lea eax, [esp + 0x78]
push 1
push eax
call fcn.005e057f
push 0
push esi
push ebx
mov dword [esp + 0x2c], eax
call fcn.005e0626
add esp, 0x1c
jmp 0x4bcd19
push 1
push 0
push 0
push esi
call ebp
push 2
push 0
mov ecx, edi
neg ecx
push ecx
push esi
mov ebx, eax
call ebp
push 0
lea edx, [esp + 0x14]
push edx
push edi
lea eax, [esp + 0x7c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
push 0
push ebx
push esi
call ebp
mov ecx, dword [esp + 0x10]
dec ecx
push ecx
lea edx, [esp + 0x74]
push str.vbaproject.bin
push edx
call fcn.004f5ad0
add esp, 0xc
cmp eax, 0xffffffff
je 0x4bd5d1
mov ecx, dword [str.UCLDOCX]
mov eax, dword [esp + 0x18]
mov dword [eax], ecx
mov edx, dword [0x641998]
mov dword [eax + 4], edx
jmp 0x4bd5d1
mov eax, dword [esp + 0x30]
cmp dword [eax], 1
jne 0x4bd113
push 0x62f418
push edi
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x4bcf63
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x4bcd9e
inc eax
push 0x641980
push eax
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x4bcd9e
mov dword [esp + 0x20], 1
mov eax, dword [esp + 0x38c0]
mov ecx, dword [esp + 0x14]
sub eax, dword [ecx]
mov edi, 0x800
cmp eax, 0x800
ja 0x4bcdb9
mov edi, eax
cmp eax, 0x400
jbe 0x4bce7f
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x1c], 0
mov dword [edx], 1
test ebx, ebx
je 0x4bce1c
push ebx
call fcn.005e45b4
mov dword [esp + 0x14], eax
mov eax, edi
push 2
neg eax
push eax
push ebx
call fcn.005e0626
add esp, 0x10
test eax, eax
jne 0x4bce55
push ebx
push edi
lea ecx, [esp + 0x78]
push 1
push ecx
call fcn.005e057f
mov edx, dword [esp + 0x20]
push 0
push edx
push ebx
mov dword [esp + 0x38], eax
call fcn.005e0626
add esp, 0x1c
jmp 0x4bce55
push 1
push 0
push 0
push esi
call ebp
mov dword [esp + 0x10], eax
push 2
push 0
mov eax, edi
neg eax
push eax
push esi
call ebp
push 0
lea ecx, [esp + 0x20]
push ecx
push edi
lea edx, [esp + 0x7c]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x10]
push 0
push 0
push eax
push esi
call ebp
mov ecx, dword [0x7424bc]
mov edx, dword [esp + 0x1c]
push 0
push 0
push ecx
dec edx
push edx
lea eax, [esp + 0x80]
push eax
call fcn.004bb240
add esp, 0x14
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
jne 0x4bcea8
mov edx, dword [esp + 0x14]
mov ecx, dword [0x7424e0]
mov eax, dword [edx]
push 0
push 0
push ecx
mov ecx, dword [esp + 0x30]
dec eax
push eax
push ecx
call fcn.004bb240
add esp, 0x14
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
je 0x4bceb6
mov eax, dword [esp + 0x64]
test eax, eax
je 0x4bceb6
mov dword [eax], 1
mov edi, dword [esp + 0x48]
push 0
push str.lib_
push edi
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4bcf33
push 0
push str.jboss
push edi
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4bcf33
push 0
push str.Libre
push edi
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4bcf33
push 0
push str.Mozilla
push edi
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4bcf33
push 0
push str.BrowserExtension
push edi
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4bcf33
mov edx, dword [esp + 0x38]
cmp byte [edx], 0x7b
je 0x4bcf33
cmp dword [esp + 0x20], 1
jne 0x4bcf43
mov eax, dword [esp + 0x64]
test eax, eax
je 0x4bcf4a
mov dword [eax], 0
jmp 0x4bcf4a
cmp dword [esp + 0x10], 0xffffffff
jne 0x4bcf54
cmp dword [esp + 0x38b0], 0
je 0x4bcf63
mov eax, dword [esp + 0x18]
mov dword [eax], 0x4c4355
jmp 0x4bd5d1
mov ecx, dword [esp + 0x30]
cmp dword [ecx], 1
jne 0x4bd113
mov edx, dword [esp + 0x18]
push 0x641944
push edx
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x4bd113
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov edi, dword [esp + 0x24]
push ecx
push str.WWKeywordLinks_Property
push edi
call fcn.004f5ad0
add esp, 0xc
mov dword [esp + 0x48], eax
cmp eax, 0xffffffff
je 0x4bcfd8
push str.WWKeywordLinks_Property
call fcn.004dd6c0
mov edx, dword [esp + 0x4c]
lea eax, [edx + eax + 5]
add esp, 4
cmp byte [edi + eax], 0x2f
je 0x4bd104
mov ecx, edi
cmp byte [ecx + eax + 1], 0x2f
je 0x4bd104
mov edx, dword [esp + 0x14]
mov eax, dword [edx]
cmp eax, 0x400
jbe 0x4bcfec
push 0x400
jmp 0x4bcfed
push eax
push 0x6283e8
push edi
call fcn.004f5ad0
mov ecx, dword [esp + 0x38cc]
mov edx, dword [esp + 0x20]
sub ecx, dword [edx]
add esp, 0xc
mov edi, 0x2800
cmp ecx, 0x2800
ja 0x4bd017
mov edi, ecx
cmp eax, 0xffffffff
jne 0x4bd104
cmp ecx, 0x400
jbe 0x4bd113
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x20], 0
mov dword [eax], 1
test ebx, ebx
je 0x4bd087
push ebx
call fcn.005e45b4
mov ecx, edi
push 2
neg ecx
push ecx
push ebx
mov dword [esp + 0x20], eax
call fcn.005e0626
add esp, 0x10
test eax, eax
jne 0x4bd0c3
push ebx
push edi
lea edx, [esp + 0x1078]
push 1
push edx
call fcn.005e057f
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x20]
push 0
push eax
push ebx
call fcn.005e0626
add esp, 0x1c
jmp 0x4bd0c3
push 1
push 0
push 0
push esi
call ebp
push 2
push 0
mov ecx, edi
neg ecx
push ecx
push esi
mov dword [esp + 0x20], eax
call ebp
push 0
lea edx, [esp + 0x24]
push edx
push edi
lea eax, [esp + 0x107c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x10]
push 0
push 0
push ecx
push esi
call ebp
mov edx, dword [esp + 0x20]
dec edx
push edx
lea eax, [esp + 0x1074]
push 0x6283e8
push eax
call fcn.004f5ad0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4bd104
mov eax, dword [esp + 0x20]
cmp byte [esp + eax + 0x1005], 7
lea eax, [esp + eax + 0x1005]
jne 0x4bd113
cmp byte [eax + 1], 0xa0
jne 0x4bd113
cmp byte [eax + 2], 0xfb
jne 0x4bd113
mov ecx, dword [esp + 0x18]
mov dword [ecx], 0x4c4355
jmp 0x4bd5d1
mov edi, dword [esp + 0x18]
push 0x61c038
push edi
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x4bd14f
mov edx, dword [0x7424a4]
push eax
push eax
mov eax, dword [esp + 0x2c]
push edx
push eax
call fcn.004bb0e0
add esp, 0x10
cmp eax, 0xffffffff
je 0x4bd14f
mov dword [edi], 0x4c4355
jmp 0x4bd5d1
push 0x641928
push edi
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x4bd26e
mov edx, dword [esp + 0x14]
mov ecx, dword [0x7424b4]
push eax
push eax
mov eax, dword [edx]
push ecx
mov ecx, dword [esp + 0x30]
dec eax
push eax
push ecx
call fcn.004bb240
add esp, 0x14
cmp eax, 0xffffffff
jne 0x4bd5d1
mov eax, dword [esp + 0x2c]
mov edx, 0x2800
cmp edx, dword [esp + 0x38c0]
mov dword [esp + 0x1c], 0
sbb edi, edi
and edi, 0x2600
add edi, 0x200
mov dword [eax], 1
test ebx, ebx
je 0x4bd201
push ebx
call fcn.005e45b4
mov ecx, edi
push 2
neg ecx
push ecx
push ebx
mov dword [esp + 0x20], eax
call fcn.005e0626
add esp, 0x10
test eax, eax
jne 0x4bd23d
push ebx
push edi
lea edx, [esp + 0x1078]
push 1
push edx
call fcn.005e057f
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x20]
push 0
push eax
push ebx
call fcn.005e0626
add esp, 0x1c
jmp 0x4bd23d
push 1
push 0
push 0
push esi
call ebp
push 2
push 0
mov ecx, edi
neg ecx
push ecx
push esi
mov dword [esp + 0x20], eax
call ebp
push 0
lea edx, [esp + 0x20]
push edx
push edi
lea eax, [esp + 0x107c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x10]
push 0
push 0
push ecx
push esi
call ebp
mov eax, dword [esp + 0x1c]
cmp eax, 0x200
jb 0x4bd26e
mov edx, dword [0x7424b4]
push 0
push 0
push edx
dec eax
push eax
lea eax, [esp + 0x1080]
push eax
call fcn.004bb240
add esp, 0x14
cmp eax, 0xffffffff
jne 0x4bd5d1
mov ecx, dword [esp + 0x18]
push 0x6419c4
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x4bd317
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x10], eax
mov dword [edx], 1
test ebx, ebx
je 0x4bd2d4
push ebx
call fcn.005e45b4
push 2
push 0xffffffffffffffff
push ebx
mov edi, eax
call fcn.005e0626
add esp, 0x10
test eax, eax
jne 0x4bd305
push ebx
push 1
lea eax, [esp + 0x33]
push 1
push eax
call fcn.005e057f
push 0
push edi
push ebx
mov dword [esp + 0x2c], eax
call fcn.005e0626
add esp, 0x1c
jmp 0x4bd305
push 1
push 0
push 0
push esi
call ebp
push 2
push 0
push 0xffffffffffffffff
push esi
mov edi, eax
call ebp
push 0
lea ecx, [esp + 0x14]
push ecx
push 1
lea edx, [esp + 0x37]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
push 0
push edi
push esi
call ebp
cmp dword [esp + 0x10], 1
jne 0x4bd317
cmp byte [esp + 0x2b], 0x3b
jne 0x4bd5d1
mov eax, dword [esp + 0x14]
cmp dword [eax], 0
jbe 0x4bd62f
mov ecx, dword [esp + 0x30]
cmp dword [ecx], 1
je 0x4bd554
mov edi, dword [esp + 0x18]
push 0x641924
push edi
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x4bd36c
mov edi, dword [esp + 0x3c]
test edi, edi
je 0x4bd368
lea edx, [edi + 1]
push 0x63a37c
push edx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4bd558
mov edi, dword [esp + 0x18]
push 0x641924
push edi
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x4bd3c8
mov eax, dword [esp + 0x50]
test eax, eax
je 0x4bd38c
mov dword [eax], 1
cmp dword [esp + 0x60], 0
je 0x4bd53e
mov eax, dword [esp + 0x4c]
test eax, eax
je 0x4bd3a5
mov dword [eax], 0
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x58]
mov edx, dword [esp + 0x14]
mov dword [eax], 0
mov dword [ecx], 0
mov dword [edx], 0
jmp 0x4bd5c0
push 0x641920
push edi
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4bd548
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
mov ecx, dword [esp + 0x38c0]
sub ecx, eax
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x10], ecx
mov edi, 0x1000
cmp ecx, 0x1000
ja 0x4bd408
mov edi, ecx
cmp ecx, 0x400
jbe 0x4bd4e0
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x10], 0
mov dword [ecx], 1
test ebx, ebx
je 0x4bd466
push ebx
call fcn.005e45b4
mov edx, edi
push 2
neg edx
push edx
push ebx
mov esi, eax
call fcn.005e0626
add esp, 0x10
test eax, eax
jne 0x4bd499
push ebx
push edi
lea eax, [esp + 0x78]
push 1
push eax
call fcn.005e057f
push 0
push esi
push ebx
mov dword [esp + 0x2c], eax
call fcn.005e0626
add esp, 0x1c
jmp 0x4bd499
push 1
push 0
push 0
push esi
call ebp
push 2
push 0
mov ecx, edi
neg ecx
push ecx
push esi
mov ebx, eax
call ebp
push 0
lea edx, [esp + 0x14]
push edx
push edi
lea eax, [esp + 0x7c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
push 0
push ebx
push esi
call ebp
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x38dc]
push ecx
mov ecx, dword [esp + 0x38d4]
push edx
mov edx, dword [esp + 0x18]
push eax
push 0
push 0
push ecx
push edx
lea eax, [esp + 0x8c]
push eax
call fcn.004bc470
add esp, 0x20
cmp eax, 0xffffffff
jne 0x4bd53e
mov ecx, dword [esp + 0x5c]
mov dword [ecx], 1
jmp 0x4bd5c0
mov ecx, dword [esp + 0x54]
cmp dword [ecx], 0
jne 0x4bd525
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x40]
push edx
mov edx, dword [esp + 0x38e0]
push ecx
mov ecx, dword [esp + 0x5c]
push edx
mov edx, dword [esp + 0x38dc]
push 0
push ecx
push edx
push eax
mov eax, dword [esp + 0x40]
push eax
call fcn.004bc470
add esp, 0x20
cmp eax, 0xffffffff
je 0x4bd525
mov dword [esp + 0x1c], 1
cmp dword [esp + 0x10], 0x30
jbe 0x4bd537
cmp dword [esp + 0x1c], 0xffffffff
je 0x4bd414
cmp dword [esp + 0x1c], 1
jne 0x4bd4d1
mov dword [esp + 0x34], 1
jmp 0x4bd5c0
mov edx, dword [esp + 0x5c]
mov dword [edx], 1
jmp 0x4bd5c0
mov edi, dword [esp + 0x3c]
mov eax, dword [esp + 0x18]
push 0x641924
push eax
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x4bd5b2
test edi, edi
je 0x4bd5b2
push 0x63a37c
inc edi
push edi
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x4bd5b2
mov ecx, dword [esp + 0x38c0]
fild dword [esp + 0x38c0]
test ecx, ecx
jge 0x4bd59d
fadd qword [0x60ecc0]
fcomp qword [str.ffffffVAxlt]
fnstsw ax
test ah, 5
jp 0x4bd5b2
mov dword [esp + 0x34], 1
mov eax, dword [esp + 0x44]
test eax, eax
je 0x4bd5c0
mov dword [eax], 1
cmp dword [esp + 0x34], 0
mov edx, dword [esp + 0x14]
mov dword [edx], 0
je 0x4bd62f
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x58]
mov edx, dword [esp + 0x14]
mov dword [eax], 0
mov eax, dword [esp + 0x4c]
mov dword [ecx], 0
mov dword [edx], 0
test eax, eax
je 0x4bd5fd
mov dword [eax], 1
mov eax, dword [esp + 0x68]
test eax, eax
je 0x4bd60b
mov dword [eax], 1
mov esi, dword [esp + 0x6c]
test esi, esi
je 0x4bd62f
mov eax, dword [esp + 0x18]
push 0x641924
push eax
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4bd62f
mov dword [esi], 1
mov ecx, dword [esp + 0x3870]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005dfbbe
add esp, 0x3864
ret