Function at 0x489b80
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4c3fdb
mov eax, dword fs:[0]
push eax
sub esp, 0x9ac
mov eax, dword [0x4d88f0]
xor eax, esp
mov dword [esp + 0x9a8], eax
push ebx
push esi
push edi
mov eax, dword [0x4d88f0]
xor eax, esp
push eax
lea eax, [esp + 0x9bc]
mov dword fs:[0], eax
xor ebx, ebx
mov edi, 1
cmp byte [esp + 0x9d4], bl
je 0x489be5
cmp word [0x5248e2], bx
je 0x489c4c
cmp dword [0x53a4d4], ebx
je 0x489c4c
xor eax, eax
mov word [0x5248e2], ax
jmp 0x489c4c
push edi
call fcn.00487170
mov al, byte [esp + 0x9d0]
mov dword [0x526220], 3
cmp al, bl
je 0x489c05
mov byte [0x52625a], al
mov dword [0x51a010], ebx
mov dword [0x51a014], ebx
cmp byte [0x519779], bl
jne 0x489d5f
mov ecx, dword [0x529494]
push edi
push ecx
mov ecx, 0x5200a8
call fcn.00445c40
cmp byte [0x5208c2], bl
je 0x489c4c
mov edx, dword [0x529494]
cmp dword [edx + 0x20], edi
jbe 0x489c4c
mov dword [0x52621c], 4
cmp byte [0x519779], bl
jne 0x489d5f
cmp word [0x528c92], bx
jne 0x489d5f
mov esi, 0x528c92
mov byte [esp + 0x9cc], bl
call fcn.00484600
push 0x400
push 0x4c5d80
lea eax, [esp + 0x1c0]
push eax
push str.DefFolder
push str.Compression
call fcn.0045fc10
cmp word [esp + 0x1b8], bx
jne 0x489cc9
cmp byte [0x5208c2], bl
je 0x489d37
push 0x400
lea ecx, [esp + 0x1bc]
push ecx
call fcn.0048b890
cmp word [esp + 0x1b8], bx
je 0x489d37
lea edx, [esp + 0x1b8]
push edx
call fcn.004550c0
mov eax, 0x528c92
mov edx, eax
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x489ce0
lea edi, [esp + 0x1b8]
sub eax, edx
add edi, 0xfffffffe
jmp 0x489d00
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x489d00
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor eax, eax
mov edi, edi
movzx ecx, word [esp + eax + 0x1b8]
mov word [eax + 0x528c92], cx
add eax, 2
cmp cx, bx
jne 0x489d20
cmp word [0x5230e0], bx
mov eax, dword [0x526c24]
setne cl
push eax
movzx edx, cl
push edx
push 0x400
push 0x528c92
call fcn.004847a0
mov edi, 1
cmp dword [0x52621c], ebx
jne 0x489d71
mov dword [0x52621c], 5
cmp byte [0x519779], bl
je 0x489e53
mov esi, dword [0x520bdc]
cmp esi, ebx
je 0x489db1
cmp esi, edi
je 0x489db1
push 0x30
push 0x65
call fcn.00465ff0
push eax
push 0x1fd
call fcn.00465ff0
push eax
mov eax, dword [0x51a8cc]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x48a15a
push 0x400
push 0x528c92
mov ecx, 0x5209d0
call fcn.00413210
push 0x400
push 0x5254ec
mov ecx, 0x5209d0
call fcn.004131f0
cmp word [0x5254ec], bx
je 0x489dec
push 0x5254ec
call fcn.004550c0
lea ecx, [esp + 0x18]
push ecx
mov ecx, 0x5209d0
mov byte [0x52625e], bl
call fcn.00413240
mov edx, dword [esp + 0x98]
mov dword [0x526c24], edx
cmp esi, ebx
jne 0x489e1b
cmp dword [esp + 0x120], ebx
je 0x489e27
mov eax, dword [esp + 0x14c]
mov dword [0x52620c], eax
cmp dword [esp + 0x138], ebx
je 0x489e4a
xor eax, eax
movzx ecx, word [eax + 0x4c5f44]
mov word [eax + 0x5230e0], cx
add eax, 2
cmp cx, bx
jne 0x489e32
jmp 0x489e53
xor ecx, ecx
mov word [0x5230e0], cx
mov edx, dword [0x51a8cc]
push edx
call dword [sym.imp.USER32.dll_IsWindowVisible]
mov ecx, dword [esp + 0x9cc]
neg eax
sbb eax, eax
and eax, dword [0x51a8cc]
push ebx
push ecx
push eax
call fcn.00489890
test al, al
je 0x48a13b
mov eax, dword [0x53a4dc]
cmp eax, edi
je 0x489e8f
cmp eax, 2
jne 0x489ee1
mov edx, dword [0x53a4e8]
mov eax, dword [0x53a4e4]
mov ecx, dword [0x53a4e0]
push edx
push eax
push ecx
lea edx, [esp + 0x174]
push str._dd_dh_dm
push edx
call fcn.004af76b
add esp, 0x14
cmp dword [0x53a4dc], edi
jne 0x489ecf
lea eax, [esp + 0x168]
push eax
mov ecx, 0x5262e4
jmp 0x489edc
lea ecx, [esp + 0x168]
push ecx
mov ecx, 0x526308
call fcn.00472850
cmp word [0x5230e0], bx
je 0x489f87
cmp word [0x5248e2], bx
jne 0x489f87
mov eax, dword [0x53a4d4]
cmp eax, ebx
jne 0x489f90
lea ecx, [esp + 0x13]
call fcn.0046bab0
mov dword [esp + 0x9c4], ebx
lea ecx, [esp + 0x13]
call fcn.0046ca20
mov esi, eax
cmp esi, ebx
je 0x489f73
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x489f30
sub eax, edx
sar eax, 1
xor ecx, ecx
inc eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004af0d7
add esp, 4
mov dword [0x53a4d4], eax
mov ecx, esi
mov edx, eax
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
cmp ax, bx
jne 0x489f62
mov dword [esp + 0x9c4], 0xffffffff
lea ecx, [esp + 0x13]
call fcn.0046a120
mov eax, dword [0x53a4d4]
cmp eax, ebx
je 0x489f98
push eax
call fcn.00481f80
jmp 0x489fbb
cmp byte [0x519779], bl
je 0x489fbb
cmp dword [esp + 0x138], ebx
je 0x489fbb
cmp word [0x5230e0], 0x2a
jne 0x489fbb
xor eax, eax
mov word [0x5230e0], ax
mov ecx, dword [0x529494]
cmp dword [ecx + 0x20], ebx
jne 0x489fed
push 0x30
push 0x65
call fcn.00465ff0
push eax
push 0x14b
call fcn.00465ff0
mov edx, dword [0x51a8cc]
push eax
push edx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x48a13b
cmp word [0x5248e2], bx
je 0x48a062
cmp dword [0x5250e4], ebx
jne 0x48a062
push ebx
push 0x4c7358
push 0x5248e2
call fcn.004356c0
mov esi, eax
cmp esi, ebx
je 0x48a062
push esi
push 0x400
lea eax, [esp + 0x1c0]
push edi
push eax
call fcn.004b241a
add esp, 0x10
mov dword [esp + 0x14], 0x30c
cmp eax, ebx
jbe 0x48a059
lea ecx, [esp + 0x14]
push ecx
push eax
lea edx, [esp + 0x1c0]
push edx
call dword [sym.imp.ADVAPI32.dll_IsTextUnicode]
test eax, eax
je 0x48a059
mov dword [0x5250e4], 3
push esi
call fcn.004b24ae
add esp, 4
cmp word [0x525cec], bx
mov ecx, 0x51a8d0
setne al
mov byte [0x51a8fc], al
call fcn.0046f020
cmp byte [0x53a4ee], bl
je 0x48a08a
call fcn.00487ec0
jmp 0x48a09c
movzx ecx, byte [0x527c2b]
push ecx
mov ecx, 0x5209d0
call fcn.00417940
cmp dword [0x53a4d4], ebx
je 0x48a0ae
push 0x5248e2
call fcn.00435200
cmp dword [0x519f94], edi
je 0x48a13b
cmp byte [0x519779], bl
je 0x48a0ce
mov ecx, 0x5200a8
call fcn.00449f60
jmp 0x48a13b
cmp byte [0x52625a], bl
je 0x48a0e0
mov ecx, 0x520088
call fcn.00475750
push 0x400
lea edx, [esp + 0x1bc]
push edx
call fcn.0048b890
lea eax, [esp + 0x1b8]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x48a100
sub eax, edx
sar eax, 1
push eax
push 0x528c92
lea eax, [esp + 0x1c0]
push eax
call fcn.00476cb0
push 0x528c92
test eax, eax
jne 0x48a131
call fcn.00455740
push eax
mov ecx, 0x5200a8
call fcn.00448520
mov ecx, dword [0x53a4d4]
push ecx
call fcn.004aff95
add esp, 4
mov ecx, 0x51a8d0
mov byte [0x51a8fc], bl
call fcn.0046f020
mov ecx, dword [esp + 0x9bc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x9a8]
xor ecx, esp
call fcn.004af72c
add esp, 0x9b8
ret 0xc