Function at 0x48a400
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4c48fb
mov eax, dword fs:[0]
push eax
sub esp, 0x9ac
mov eax, dword [0x4d98f0]
xor eax, esp
mov dword [esp + 0x9a8], eax
push ebx
push esi
push edi
mov eax, dword [0x4d98f0]
xor eax, esp
push eax
lea eax, [esp + 0x9bc]
mov dword fs:[0], eax
xor ebx, ebx
mov edi, 1
cmp byte [esp + 0x9d4], bl
je 0x48a465
cmp word [0x5258e2], bx
je 0x48a4cc
cmp dword [0x53b4d4], ebx
je 0x48a4cc
xor eax, eax
mov word [0x5258e2], ax
jmp 0x48a4cc
push edi
call fcn.004879e0
mov al, byte [esp + 0x9d0]
mov dword [0x527220], 3
cmp al, bl
je 0x48a485
mov byte [0x52725a], al
mov dword [0x51b010], ebx
mov dword [0x51b014], ebx
cmp byte [0x51a779], bl
jne 0x48a5df
mov ecx, dword [0x52a494]
push edi
push ecx
mov ecx, 0x5210a8
call fcn.00446320
cmp byte [0x5218c2], bl
je 0x48a4cc
mov edx, dword [0x52a494]
cmp dword [edx + 0x20], edi
jbe 0x48a4cc
mov dword [0x52721c], 4
cmp byte [0x51a779], bl
jne 0x48a5df
cmp word [0x529c92], bx
jne 0x48a5df
mov esi, 0x529c92
mov byte [esp + 0x9cc], bl
call fcn.00484e80
push 0x400
push 0x4c6d80
lea eax, [esp + 0x1c0]
push eax
push str.DefFolder
push str.Compression
call fcn.00460470
cmp word [esp + 0x1b8], bx
jne 0x48a549
cmp byte [0x5218c2], bl
je 0x48a5b7
push 0x400
lea ecx, [esp + 0x1bc]
push ecx
call fcn.0048c120
cmp word [esp + 0x1b8], bx
je 0x48a5b7
lea edx, [esp + 0x1b8]
push edx
call fcn.00455810
mov eax, 0x529c92
mov edx, eax
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x48a560
lea edi, [esp + 0x1b8]
sub eax, edx
add edi, 0xfffffffe
jmp 0x48a580
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x48a580
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor eax, eax
mov edi, edi
movzx ecx, word [esp + eax + 0x1b8]
mov word [eax + 0x529c92], cx
add eax, 2
cmp cx, bx
jne 0x48a5a0
cmp word [0x5240e0], bx
mov eax, dword [0x527c24]
setne cl
push eax
movzx edx, cl
push edx
push 0x400
push 0x529c92
call fcn.00485020
mov edi, 1
cmp dword [0x52721c], ebx
jne 0x48a5f1
mov dword [0x52721c], 5
cmp byte [0x51a779], bl
je 0x48a6d3
mov esi, dword [0x521bdc]
cmp esi, ebx
je 0x48a631
cmp esi, edi
je 0x48a631
push 0x30
push 0x65
call fcn.00466860
push eax
push 0x1fd
call fcn.00466860
push eax
mov eax, dword [0x51b8cc]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x48a9da
push 0x400
push 0x529c92
mov ecx, 0x5219d0
call fcn.00413210
push 0x400
push 0x5264ec
mov ecx, 0x5219d0
call fcn.004131f0
cmp word [0x5264ec], bx
je 0x48a66c
push 0x5264ec
call fcn.00455810
lea ecx, [esp + 0x18]
push ecx
mov ecx, 0x5219d0
mov byte [0x52725e], bl
call fcn.00413240
mov edx, dword [esp + 0x98]
mov dword [0x527c24], edx
cmp esi, ebx
jne 0x48a69b
cmp dword [esp + 0x120], ebx
je 0x48a6a7
mov eax, dword [esp + 0x14c]
mov dword [0x52720c], eax
cmp dword [esp + 0x138], ebx
je 0x48a6ca
xor eax, eax
movzx ecx, word [eax + 0x4c6f44]
mov word [eax + 0x5240e0], cx
add eax, 2
cmp cx, bx
jne 0x48a6b2
jmp 0x48a6d3
xor ecx, ecx
mov word [0x5240e0], cx
mov edx, dword [0x51b8cc]
push edx
call dword [sym.imp.USER32.dll_IsWindowVisible]
mov ecx, dword [esp + 0x9cc]
neg eax
sbb eax, eax
and eax, dword [0x51b8cc]
push ebx
push ecx
push eax
call fcn.0048a110
test al, al
je 0x48a9bb
mov eax, dword [0x53b4dc]
cmp eax, edi
je 0x48a70f
cmp eax, 2
jne 0x48a761
mov edx, dword [0x53b4e8]
mov eax, dword [0x53b4e4]
mov ecx, dword [0x53b4e0]
push edx
push eax
push ecx
lea edx, [esp + 0x174]
push str._dd_dh_dm
push edx
call fcn.004b002b
add esp, 0x14
cmp dword [0x53b4dc], edi
jne 0x48a74f
lea eax, [esp + 0x168]
push eax
mov ecx, 0x5272e4
jmp 0x48a75c
lea ecx, [esp + 0x168]
push ecx
mov ecx, 0x527308
call fcn.004730d0
cmp word [0x5240e0], bx
je 0x48a807
cmp word [0x5258e2], bx
jne 0x48a807
mov eax, dword [0x53b4d4]
cmp eax, ebx
jne 0x48a810
lea ecx, [esp + 0x13]
call fcn.0046c330
mov dword [esp + 0x9c4], ebx
lea ecx, [esp + 0x13]
call fcn.0046d2a0
mov esi, eax
cmp esi, ebx
je 0x48a7f3
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x48a7b0
sub eax, edx
sar eax, 1
xor ecx, ecx
inc eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004af997
add esp, 4
mov dword [0x53b4d4], eax
mov ecx, esi
mov edx, eax
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
cmp ax, bx
jne 0x48a7e2
mov dword [esp + 0x9c4], 0xffffffff
lea ecx, [esp + 0x13]
call fcn.0046a9a0
mov eax, dword [0x53b4d4]
cmp eax, ebx
je 0x48a818
push eax
call fcn.00482800
jmp 0x48a83b
cmp byte [0x51a779], bl
je 0x48a83b
cmp dword [esp + 0x138], ebx
je 0x48a83b
cmp word [0x5240e0], 0x2a
jne 0x48a83b
xor eax, eax
mov word [0x5240e0], ax
mov ecx, dword [0x52a494]
cmp dword [ecx + 0x20], ebx
jne 0x48a86d
push 0x30
push 0x65
call fcn.00466860
push eax
push 0x14b
call fcn.00466860
mov edx, dword [0x51b8cc]
push eax
push edx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x48a9bb
cmp word [0x5258e2], bx
je 0x48a8e2
cmp dword [0x5260e4], ebx
jne 0x48a8e2
push ebx
push 0x4c8358
push 0x5258e2
call fcn.00435dd0
mov esi, eax
cmp esi, ebx
je 0x48a8e2
push esi
push 0x400
lea eax, [esp + 0x1c0]
push edi
push eax
call fcn.004b2cda
add esp, 0x10
mov dword [esp + 0x14], 0x30c
cmp eax, ebx
jbe 0x48a8d9
lea ecx, [esp + 0x14]
push ecx
push eax
lea edx, [esp + 0x1c0]
push edx
call dword [sym.imp.ADVAPI32.dll_IsTextUnicode]
test eax, eax
je 0x48a8d9
mov dword [0x5260e4], 3
push esi
call fcn.004b2d6e
add esp, 4
cmp word [0x526cec], bx
mov ecx, 0x51b8d0
setne al
mov byte [0x51b8fc], al
call fcn.0046f8a0
cmp byte [0x53b4ee], bl
je 0x48a90a
call fcn.00488730
jmp 0x48a91c
movzx ecx, byte [0x528c2b]
push ecx
mov ecx, 0x5219d0
call fcn.00417940
cmp dword [0x53b4d4], ebx
je 0x48a92e
push 0x5258e2
call fcn.00435910
cmp dword [0x51af94], edi
je 0x48a9bb
cmp byte [0x51a779], bl
je 0x48a94e
mov ecx, 0x5210a8
call fcn.0044a650
jmp 0x48a9bb
cmp byte [0x52725a], bl
je 0x48a960
mov ecx, 0x521088
call fcn.00475fd0
push 0x400
lea edx, [esp + 0x1bc]
push edx
call fcn.0048c120
lea eax, [esp + 0x1b8]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x48a980
sub eax, edx
sar eax, 1
push eax
push 0x529c92
lea eax, [esp + 0x1c0]
push eax
call fcn.00477530
push 0x529c92
test eax, eax
jne 0x48a9b1
call fcn.00455e90
push eax
mov ecx, 0x5210a8
call fcn.00448c00
mov ecx, dword [0x53b4d4]
push ecx
call fcn.004b0855
add esp, 4
mov ecx, 0x51b8d0
mov byte [0x51b8fc], bl
call fcn.0046f8a0
mov ecx, dword [esp + 0x9bc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x9a8]
xor ecx, esp
call fcn.004affec
add esp, 0x9b8
ret 0xc