Function at 0x4e0a40
Capabilities:
Move file
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x12a1c]
mov eax, 0x12a1c
call fcn.00502fa0
push 0xffffffffffffffff
push 0x5214a1
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x5513d4]
xor eax, ebp
mov dword [ebp + 0x12a18], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0x12a24]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push dword [0x5511c4]
push 0x536bb4
push 0xc8
push 0x5bc798
call fcn.004027c0
add esp, 0x14
lea ecx, [ebp + 0x6234]
call fcn.00443700
mov dword [ebp - 4], 1
cmp byte [0x558b34], 0
mov byte [ebp + 0x726c], 0
je 0x4e0b95
push 0x800
lea eax, [ebp + 0x8918]
mov ecx, 0x57b208
push eax
call fcn.00406070
push 0x10f8
lea eax, [ebp + 0x40f4]
push 0
push eax
call fcn.00505530
add esp, 0xc
lea eax, [ebp + 0x8918]
push 0x800
push eax
lea eax, [ebp + 0x40f4]
push eax
call fcn.0049ce90
push 0
lea eax, [ebp + 0x51ec]
mov dword [ebp + 0x61fc], 0
push eax
lea eax, [ebp + 0x8918]
mov dword [ebp + 0x6200], 0
push eax
mov dword [ebp + 0x6204], 0
mov dword [ebp + 0x6208], 0
mov dword [ebp + 0x620c], 0
mov dword [ebp + 0x6210], 0
call fcn.00475a80
test al, al
je 0x4e0b7e
mov eax, dword [ebp + 0x61ec]
mov dword [ebp + 0x5174], eax
mov eax, dword [ebp + 0x61f0]
mov dword [ebp + 0x5178], eax
lea eax, [ebp + 0x40f4]
push eax
lea ecx, [ebp + 0x6234]
call fcn.00443d40
jmp 0x4e0c72
lea ecx, [ebp + 0x78b8]
call fcn.0049cee0
mov byte [ebp - 4], 2
lea esi, [ebp + 0x78b8]
test edi, edi
je 0x4e0bb2
mov esi, edi
jmp 0x4e0bc5
push 1
lea eax, [ebp + 0x78b8]
mov ecx, 0x57de98
push eax
call fcn.00447140
push 0
push 0
push 3
lea eax, [ebp + 0x6234]
push eax
push 3
push esi
call fcn.004b2620
test al, al
jne 0x4e0c17
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 0x78b8]
test ecx, ecx
je 0x4e0c12
cmp byte [ebp + 0x78c8], al
je 0x4e0c09
mov eax, dword [ebp + 0x78c0]
add eax, eax
push eax
push ecx
call fcn.0049a3e0
mov ecx, dword [ebp + 0x78b8]
push ecx
call fcn.005097b2
add esp, 4
jmp 0x4e1dc4
xor esi, esi
cmp dword [ebp + 0x6238], esi
jbe 0x4e0c3d
push esi
lea ecx, [ebp + 0x6234]
call fcn.00443c30
inc esi
mov dword [eax + 4], 0
cmp esi, dword [ebp + 0x6238]
jb 0x4e0c21
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 0x78b8]
test ecx, ecx
je 0x4e0c72
cmp byte [ebp + 0x78c8], 0
je 0x4e0c69
mov eax, dword [ebp + 0x78c0]
add eax, eax
push eax
push ecx
call fcn.0049a3e0
mov ecx, dword [ebp + 0x78b8]
push ecx
call fcn.005097b2
add esp, 4
push 0x5bc798
push dword [0x5511c4]
call fcn.004ad8a0
push dword [0x558aa8]
xor ebx, ebx
mov dword [ebp - 0x18], ebx
call dword [sym.imp.USER32.dll_IsWindowVisible]
neg eax
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp + 0x6234]
push ecx
sbb eax, eax
and eax, dword [0x558aa8]
push 0x4e1e00
push eax
push str.CONVERTARC
push dword [0x58c1f8]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
test eax, eax
je 0x4e1d97
push ebx
push 0x535ba8
push 0x5bc798
call fcn.004ae540
test eax, eax
jne 0x4e0cf0
cmp dword [0x558bac], 1
jne 0x4e0ceb
cmp byte [0x56eaab], bl
jne 0x4e0cf0
mov byte [ebp - 0x14], bl
jmp 0x4e0cf4
mov byte [ebp - 0x14], 1
push 0
push dword [ebp - 0x14]
push 0
push 0xa
call fcn.004d8980
push 0x800
lea eax, [ebp + 0xa918]
push eax
call fcn.004d68b0
lea ecx, [ebp + 0x7374]
call fcn.00499f80
mov byte [ebp - 4], 6
cmp byte [0x558b34], 0
je 0x4e0d3f
mov ecx, 0x40
lea edi, [ebp + 0x7374]
mov esi, 0x57b552
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor edi, edi
mov dword [ebp - 0x34], 0
xor esi, esi
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [0x559c00], 0
mov dword [0x559c04], 0
mov dword [ebp - 0x40], edi
cmp dword [ebp + 0x6238], esi
jbe 0x4e0db1
mov edi, edi
push esi
lea ecx, [ebp + 0x6234]
call fcn.00443c30
test byte [eax + 4], 2
je 0x4e0da5
mov ecx, dword [eax + 8]
add dword [0x559c00], ecx
mov eax, dword [eax + 0xc]
adc dword [0x559c04], eax
inc edi
inc esi
cmp esi, dword [ebp + 0x6238]
jb 0x4e0d80
mov dword [ebp - 0x40], edi
push 0x880
lea eax, [ebp + 0xb918]
push eax
push 0
push edi
call fcn.004b6670
lea eax, [ebp + 0xb918]
push eax
push 0x67
push dword [0x558ab4]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
cmp word [ebp + 0x6264], 0
mov dword [0x559be8], 0
mov dword [0x559bec], 0
je 0x4e0e34
lea eax, [ebp + 0x6264]
push eax
call fcn.00474160
test al, al
jne 0x4e0e34
push 0
lea eax, [ebp + 0x6264]
push eax
call fcn.00473bc0
test al, al
jne 0x4e0e34
lea eax, [ebp + 0x6264]
mov ecx, 0x58c304
push eax
call fcn.0046da70
mov al, 1
mov byte [0x558b36], al
jmp 0x4e0e39
mov al, byte [0x558b36]
xor edi, edi
or esi, 0xffffffff
mov dword [ebp - 0x14], edi
test al, al
jne 0x4e1ca2
lea esp, [esp]
cmp byte [0x558b37], 0
jne 0x4e1cb6
push 0x880
lea eax, [ebp + 0xb918]
push eax
push 0
push dword [ebp - 0x1c]
call fcn.004b6670
lea eax, [ebp + 0xb918]
push eax
push 0x69
push dword [0x558ab4]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
push 0x880
lea eax, [ebp + 0xb918]
push eax
push dword [ebp - 0x30]
push dword [ebp - 0x34]
call fcn.004b6670
lea eax, [ebp + 0xb918]
push eax
push 0x6c
push dword [0x558ab4]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
push 0x880
lea eax, [ebp + 0xb918]
push eax
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.004b6670
lea eax, [ebp + 0xb918]
push eax
push 0x6e
push dword [0x558ab4]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
cmp esi, 0xffffffff
je 0x4e0f13
push esi
lea eax, [ebp + 0x40f4]
push eax
lea ecx, [ebp + 0x6234]
call fcn.00443a00
mov ecx, dword [eax + 0x1080]
add dword [0x559be8], ecx
mov eax, dword [eax + 0x1084]
adc dword [0x559bec], eax
or esi, 0xffffffff
call fcn.004d7920
cmp edi, dword [ebp + 0x6238]
jge 0x4e1c9a
push edi
lea ecx, [ebp + 0x6234]
call fcn.00443c30
mov ebx, eax
test byte [ebx + 4], 2
je 0x4e1c87
mov al, byte [ebp + 0x7265]
mov esi, edi
mov dword [ebp - 0x20], esi
test al, al
je 0x4e0f6b
test byte [ebx + 0x38], 0x10
je 0x4e0f6b
push 0x50e
call fcn.00496b20
push eax
push dword [ebx]
call fcn.004dbba0
add esp, 8
jmp 0x4e1c87
cmp byte [0x558b34], 0
je 0x4e0f92
mov ecx, 0x40
lea esi, [ebp + 0x7374]
mov edi, 0x57b552
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, dword [ebp - 0x14]
mov byte [0x57b654], 1
test al, al
je 0x4e0f9d
push 1
call fcn.004516f0
push 1
push 0
push dword [ebx]
mov ecx, 0x57b208
call fcn.00406f60
cmp byte [ebp + 0x7265], 0
mov esi, eax
je 0x4e0fd6
call fcn.00451760
test al, al
je 0x4e0fd6
push 0x50e
call fcn.00496b20
push eax
push dword [ebx]
call fcn.004dbba0
add esp, 8
push 0
call fcn.004516f0
cmp esi, 1
jne 0x4e1c84
lea eax, [ebp + 0x7668]
mov ecx, 0x57b208
push eax
call fcn.004066f0
push 0
lea eax, [ebp + 0x51ec]
mov dword [ebp + 0x61fc], 0
push eax
mov dword [ebp + 0x6200], 0
mov dword [ebp + 0x6204], 0
mov dword [ebp + 0x6208], 0
mov dword [ebp + 0x620c], 0
mov dword [ebp + 0x6210], 0
push dword [ebx]
call fcn.00475a80
test al, al
je 0x4e1c84
cmp byte [ebp + 0x7265], 0
je 0x4e1080
cmp byte [ebp + 0x7854], 0
jne 0x4e1066
cmp byte [ebp + 0x77a3], 0
je 0x4e1080
push 0x50e
call fcn.00496b20
push eax
push dword [ebx]
call fcn.004dbba0
add esp, 8
jmp 0x4e1c84
push 1
push 0x800
lea eax, [ebp + 0x7918]
push eax
push str.Rar_CV
call fcn.004d5920
test al, al
je 0x4e1c84
lea eax, [ebp + 0x7918]
push eax
call fcn.004d70c0
push 1
call fcn.004d08b0
mov eax, dword [ebp - 0x40]
mov ecx, 0x57b208
push 0x800
push 0x56fafa
mov dword [0x559be0], eax
call fcn.00406070
mov eax, dword [0x57b20c]
mov ecx, 0x570afc
push 0x524704
mov dword [0x56caa0], eax
mov dword [0x56a6dc], 1
mov dword [0x56ba8c], 2
mov dword [0x56ba90], 2
call fcn.0049cf80
push 0x56fafa
push 0x20f
call fcn.00496b20
push eax
call fcn.004d71d0
add esp, 8
call fcn.004dbac0
mov ecx, dword [0x56ba84]
mov esi, eax
mov dword [ebp - 0x24], esi
test ecx, ecx
je 0x4e113f
mov dword [ebp - 0x18], ecx
mov dword [0x56ba84], 0
push 0
push str.WaitForOther
push 0x5bc798
call fcn.004ae540
test eax, eax
mov ecx, 0x57b208
push 1
push 0
setne byte [0x56eaac]
call fcn.00405be0
cmp byte [0x558b37], 0
jne 0x4e1c69
call fcn.004dbac0
cmp esi, eax
jne 0x4e1c69
push 0x5bc798
call fcn.004d1d30
cmp word [0x5675be], 0
mov eax, dword [0x56a734]
mov dword [ebp - 0x44], eax
mov byte [0x56a9b9], 0
jne 0x4e1208
push 0
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x38], 0
push eax
lea eax, [ebp - 0x38]
mov dword [ebp - 0x3c], 0
push eax
mov ecx, 0x57b208
call fcn.004061b0
cmp dword [ebp - 0x3c], 0
jbe 0x4e11fd
push 0x800
push 0x5675be
push str.Rar_CM
call fcn.004d5850
mov esi, eax
test esi, esi
je 0x4e11fd
push esi
push dword [ebp - 0x3c]
push 1
push dword [ebp - 0x38]
call fcn.0050a0c5
push esi
call fcn.00509ce0
add esp, 0x14
push dword [ebp - 0x38]
call fcn.005030dd
add esp, 4
push 0x800
lea eax, [ebp + 0x9918]
push eax
push dword [ebx]
call fcn.00484650
push 0x800
lea eax, [ebp + 0x6264]
push eax
lea eax, [ebp + 0xca18]
push eax
call fcn.0049ce90
cmp word [ebp + 0xca18], 0
je 0x4e124e
push 0x800
lea eax, [ebp + 0xca18]
push eax
call fcn.004836c0
push dword [ebx]
call fcn.00447d70
cmp dword [0x56caa0], 0
mov esi, 0x52472c
mov byte [ebp - 0xd], al
je 0x4e126b
mov esi, 0x524734
cmp word [0x5655b8], 0
je 0x4e127a
mov esi, 0x524724
push esi
push dword [ebx]
xor eax, eax
mov word [ebp + 0xea18], ax
call fcn.00483700
test al, al
je 0x4e1376
cmp word [ebp + 0xca18], 0
je 0x4e12b8
lea eax, [ebp + 0x9918]
push eax
lea eax, [ebp + 0xca18]
push eax
call fcn.004a05e0
test eax, eax
jne 0x4e1376
push 1
push 0x800
lea eax, [ebp + 0xea18]
mov byte [ebp - 0xe], 1
push eax
push str.Rar_CV
call fcn.004d5920
push 0x800
push 0x56fafa
push dword [ebx]
call fcn.00485280
push eax
lea eax, [ebp + 0xea18]
push eax
call fcn.00484d90
push 0x56fafa
call fcn.00484630
mov esi, eax
test esi, esi
je 0x4e144b
xor eax, eax
push 0x56fafa
mov word [esi], ax
call fcn.00484630
mov edx, eax
mov eax, 0x2e
mov word [esi], ax
test edx, edx
je 0x4e144b
cmp byte [ebp - 0xd], 0
je 0x4e144b
cmp dword [ebp + 0x77a8], 0
jne 0x4e144b
cmp byte [ebp + 0x778a], 0
je 0x4e144b
mov ecx, esi
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4e1350
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push esi
push edx
call fcn.005043a0
add esp, 0xc
jmp 0x4e144b
cmp word [ebp + 0xca18], 0
mov byte [ebp - 0xe], 0
push 0x800
je 0x4e13b3
lea eax, [ebp + 0xca18]
push eax
push 0x56fafa
call fcn.0049ce90
push 0x800
push dword [ebx]
call fcn.00485280
push eax
push 0x56fafa
call fcn.0049ce50
jmp 0x4e13bf
push dword [ebx]
push 0x56fafa
call fcn.0049ce90
push 0x56fafa
call fcn.00484630
mov edi, eax
test edi, edi
je 0x4e1411
xor eax, eax
push 0x56fafa
mov word [edi], ax
call fcn.00484630
test eax, eax
je 0x4e1409
push str..tar
push eax
call fcn.004a05e0
test eax, eax
je 0x4e1411
cmp byte [ebp - 0xd], 0
je 0x4e1409
cmp dword [ebp + 0x77a8], 0
jne 0x4e1409
cmp byte [ebp + 0x778a], 0
jne 0x4e1411
mov eax, 0x2e
mov word [edi], ax
push 0x800
push esi
push 0x56fafa
call fcn.00485320
push 0x56fafa
call fcn.00474160
test al, al
je 0x4e144b
push 0x50d
call fcn.00496b20
push eax
push 0x56fafa
call fcn.004dbba0
add esp, 8
mov byte [ebp - 0xe], 1
call fcn.004dbac0
mov esi, dword [ebp - 0x24]
cmp esi, eax
jne 0x4e14af
lea eax, [ebp + 0x7918]
push eax
call fcn.004d70c0
push 0x524704
mov ecx, 0x570afc
mov dword [0x56a708], 3
mov dword [0x56a704], 2
mov byte [0x56a74a], 0
call fcn.0049cf80
mov eax, dword [0x56ba84]
test eax, eax
je 0x4e14a3
mov dword [ebp - 0x18], eax
mov dword [0x56ba84], 0
push 0
mov ecx, 0x57b208
call fcn.00404e30
cmp word [0x5675be], 0
je 0x4e14c3
push 0x5675be
call fcn.004d4c10
cmp byte [0x558b37], 0
mov byte [ebp - 0xf], 0
jne 0x4e1c43
call fcn.004dbac0
cmp esi, eax
jne 0x4e1c43
mov ecx, 0x40
mov esi, 0x5695d0
mov edi, 0x57b552
rep movsd dword es:[edi], dword [esi]
push 1
push 0
push 0x56fafa
movsw word es:[edi], word [esi]
mov ecx, 0x57b208
mov byte [0x57b654], 1
call fcn.00406f60
cmp eax, 1
jne 0x4e1c43
lea eax, [ebp + 0x7478]
mov ecx, 0x57b208
push eax
call fcn.004066f0
mov eax, dword [ebp + 0x7840]
mov ecx, dword [ebp + 0x7844]
cmp eax, dword [ebp + 0x7650]
jne 0x4e1544
cmp ecx, dword [ebp + 0x7654]
je 0x4e157f
or eax, ecx
je 0x4e157f
push 0x5247ec
lea eax, [ebp + 0x7668]
push eax
call fcn.004a05e0
test eax, eax
jne 0x4e1565
cmp byte [ebp + 0x778a], al
jne 0x4e157f
push 0x50a
call fcn.00496b20
push eax
push dword [ebx]
call fcn.004dbba0
add esp, 8
jmp 0x4e1c43
mov eax, dword [ebp + 0x7268]
test eax, eax
je 0x4e15e3
push dword [ebp + 0x784c]
cdq
push dword [ebp + 0x7848]
push edx
push eax
call fcn.005031d0
push 0
push 0x64
push dword [ebp + 0x765c]
mov edi, eax
mov esi, edx
push dword [ebp + 0x7658]
call fcn.005031d0
cmp esi, edx
jg 0x4e15e3
jl 0x4e15c0
cmp edi, eax
jae 0x4e15e3
push 0x56fafa
call fcn.00485280
push eax
push 0x50f
call fcn.00496b20
push eax
call fcn.004d71d0
add esp, 8
jmp 0x4e1c43
mov ecx, 0x40
lea edi, [ebp + 0x7270]
mov esi, 0x5695d0
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov byte [ebp - 4], 7
push 1
call fcn.004d08b0
mov ecx, 0x40
lea esi, [ebp + 0x7270]
mov edi, 0x5695d0
rep movsd dword es:[edi], dword [esi]
push 0x800
push 0x56fafa
mov ecx, 0x57b208
movsw word es:[edi], word [esi]
call fcn.00406070
mov eax, dword [0x57b20c]
mov dword [0x56caa0], eax
mov byte [0x56a9b9], 1
call fcn.004d2200
push 0x524704
mov ecx, 0x570afc
call fcn.0049cf80
mov eax, dword [0x56ba84]
test eax, eax
je 0x4e1665
mov dword [ebp - 0x18], eax
mov dword [0x56ba84], 0
push 0
push 0
mov ecx, 0x57b208
call fcn.00405be0
cmp byte [0x558b37], 0
jne 0x4e1c2e
call fcn.004dbac0
cmp dword [ebp - 0x24], eax
jne 0x4e1c2e
mov eax, dword [ebp + 0x7650]
or eax, dword [ebp + 0x7654]
jne 0x4e16bd
cmp dword [ebp + 0x61f0], eax
ja 0x4e16b0
cmp dword [ebp + 0x61ec], 0x200
jb 0x4e16bd
cmp dword [ebp + 0x7830], 1
jbe 0x4e1c2e
mov eax, dword [ebp + 0x7268]
mov edi, dword [ebp + 0x784c]
mov ecx, dword [ebp + 0x7848]
test eax, eax
je 0x4e1710
push edi
cdq
push ecx
push edx
push eax
call fcn.005031d0
push 0
push 0x64
push dword [ebp + 0x765c]
mov dword [ebp - 0x24], eax
mov esi, edx
push dword [ebp + 0x7658]
call fcn.005031d0
cmp esi, edx
jl 0x4e1c2e
jg 0x4e170a
cmp dword [ebp - 0x24], eax
jb 0x4e1c2e
mov ecx, dword [ebp + 0x7848]
inc dword [ebp - 0x1c]
add dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x2c]
adc dword [ebp - 0x30], edi
add eax, dword [ebp + 0x7658]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
adc eax, dword [ebp + 0x765c]
cmp byte [ebp - 0xe], 0
mov byte [ebp - 0xf], 1
mov dword [ebp - 0x28], eax
je 0x4e1ad0
push 0
push 1
push dword [ebx]
mov ecx, 0x57b208
call fcn.00406f60
cmp eax, 1
jne 0x4e1c2e
lea ecx, [ebp + 0x78b8]
call fcn.0049cee0
mov byte [ebp - 4], 8
lea eax, [ebp + 0x10a18]
push 0x800
push dword [ebx]
push eax
call fcn.0049ce90
xor al, al
mov byte [ebp - 0xd], al
nop
lea eax, [ebp + 0x10a18]
push eax
push str._s._cvtbackup_
lea eax, [ebp + 0xfa18]
push 0x800
push eax
call fcn.004027c0
add esp, 0x10
lea eax, [ebp + 0xfa18]
push eax
lea eax, [ebp + 0x10a18]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x4e1a09
lea eax, [ebp + 0x10a18]
push eax
lea ecx, [ebp + 0x78b8]
call fcn.0049cf80
lea eax, [ebp + 0xfa18]
push eax
lea ecx, [ebp + 0x78b8]
call fcn.0049cf80
mov ecx, 0x57b208
call fcn.00406dc0
test eax, eax
je 0x4e181c
push 0x800
lea eax, [ebp + 0x10a18]
mov ecx, 0x57b208
push eax
call fcn.004068d0
test al, al
je 0x4e181c
lea eax, [ebp + 0x10a18]
push eax
call fcn.00474160
test al, al
jne 0x4e1780
cmp word [ebp + 0xea18], 0
je 0x4e1993
lea ecx, [ebp + 0x7858]
call fcn.0049cee0
mov byte [ebp - 4], 9
lea eax, [ebp + 0xea18]
push eax
lea ecx, [ebp + 0x7858]
call fcn.0049cf80
lea ecx, [ebp + 0x41a4]
call fcn.00404800
push 0
push 0
push 0
lea eax, [ebp + 0x7858]
push eax
lea ecx, [ebp]
call fcn.00498fe0
mov byte [ebp - 4], 0xa
lea eax, [ebp + 0x41a4]
push eax
lea ecx, [ebp]
call fcn.00499cb0
test eax, eax
jne 0x4e1978
mov edi, dword [ebp - 0x44]
lea esp, [esp]
push 0x800
push dword [ebx]
lea eax, [ebp + 0xfa18]
push eax
call fcn.0049ce90
push 0x800
lea eax, [ebp + 0x41a4]
push eax
call fcn.00485280
push eax
lea eax, [ebp + 0xfa18]
push eax
call fcn.00485380
lea eax, [ebp + 0x41a4]
push eax
call fcn.00485280
push eax
push 0x25a
call fcn.00496b20
push eax
call fcn.004d71d0
add esp, 8
lea eax, [ebp + 0xfa18]
push eax
lea eax, [ebp + 0x41a4]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x4e1953
cmp edi, 1
jne 0x4e193a
push 0
push 0
push 3
push 0
push 0
push 0x40000000
lea eax, [ebp + 0xfa18]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4e193a
lea eax, [ebp + 0x51dc]
push eax
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp + 0x41a4]
push eax
lea ecx, [ebp]
call fcn.00499cb0
test eax, eax
je 0x4e1890
jmp 0x4e1978
lea eax, [ebp + 0xfa18]
push eax
lea eax, [ebp + 0x41a4]
push eax
push 0x5b0
call fcn.00496b20
push eax
call fcn.004d71d0
add esp, 0xc
mov byte [ebp - 0xd], 1
mov byte [ebp - 4], 9
lea ecx, [ebp]
call fcn.004990d0
mov byte [ebp - 4], 8
lea ecx, [ebp + 0x7858]
call fcn.00404c50
mov bh, byte [ebp - 0xd]
xor bl, bl
cmp byte [ebp + 0x7264], bl
jne 0x4e1a1a
push 0x800
lea eax, [ebp + 0xda18]
mov bl, 1
push eax
lea ecx, [ebp + 0x78b8]
call fcn.0049d080
test al, al
je 0x4e1a0f
push 0x800
lea eax, [ebp + 0x11a18]
push eax
lea ecx, [ebp + 0x78b8]
call fcn.0049d080
test al, al
je 0x4e1a0f
lea eax, [ebp + 0xda18]
push eax
call fcn.00474160
test al, al
jne 0x4e1a0d
push 0x800
lea eax, [ebp + 0xda18]
push eax
lea ecx, [ebp + 0x78b8]
call fcn.0049d080
test al, al
jne 0x4e19c1
jmp 0x4e1a0f
mov bh, 1
jmp 0x4e1996
xor bl, bl
lea ecx, [ebp + 0x78b8]
call fcn.0049d1c0
push 0x800
lea eax, [ebp + 0xda18]
push eax
lea ecx, [ebp + 0x78b8]
call fcn.0049d080
test al, al
je 0x4e1abc
lea esp, [esp]
push 0x800
lea eax, [ebp + 0x11a18]
push eax
lea ecx, [ebp + 0x78b8]
call fcn.0049d080
test al, al
je 0x4e1abc
test bh, bh
jne 0x4e1a7d
test bl, bl
jne 0x4e1a8d
lea eax, [ebp + 0x11a18]
push eax
call fcn.00474990
lea eax, [ebp + 0x11a18]
push eax
call fcn.00473d60
jmp 0x4e1aa1
test bl, bl
jne 0x4e1a8d
lea eax, [ebp + 0xda18]
push eax
call fcn.00473d60
lea eax, [ebp + 0xda18]
push eax
lea eax, [ebp + 0x11a18]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x800
lea eax, [ebp + 0xda18]
push eax
lea ecx, [ebp + 0x78b8]
call fcn.0049d080
test al, al
jne 0x4e1a40
mov byte [ebp - 4], 7
lea ecx, [ebp + 0x78b8]
call fcn.00404c50
jmp 0x4e1c2e
cmp byte [ebp + 0x7264], 0
je 0x4e1b80
push 0
push 1
push dword [ebx]
mov ecx, 0x57b208
call fcn.00406f60
cmp eax, 1
jne 0x4e1b80
push 0x800
push dword [ebx]
lea eax, [ebp + 0x10a18]
push eax
call fcn.0049ce90
lea esp, [esp]
lea eax, [ebp + 0x10a18]
push eax
call fcn.00485280
push eax
push 0x258
call fcn.00496b20
push eax
call fcn.004d71d0
add esp, 8
lea eax, [ebp + 0x10a18]
push eax
call fcn.00474990
lea eax, [ebp + 0x10a18]
push eax
call fcn.00473d60
mov ecx, 0x57b208
call fcn.00406dc0
test eax, eax
je 0x4e1b80
push 0x800
lea eax, [ebp + 0x10a18]
mov ecx, 0x57b208
push eax
call fcn.004068d0
test al, al
je 0x4e1b80
lea eax, [ebp + 0x10a18]
push eax
call fcn.00474160
test al, al
jne 0x4e1b10
push 0
push 1
push 0x56fafa
mov ecx, 0x57b208
call fcn.00406f60
cmp eax, 1
jne 0x4e1c2e
push 0x800
push 0x56fafa
lea eax, [ebp + 0x11a18]
push eax
call fcn.0049ce90
mov edi, dword [ebp - 0x44]
cmp edi, 1
jne 0x4e1bf6
push 0
push 0
push 3
push 0
push 0
push 0x40000000
lea eax, [ebp + 0x11a18]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4e1bf6
lea eax, [ebp + 0x6224]
push eax
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x57b208
call fcn.00406dc0
test eax, eax
je 0x4e1c2e
push 0x800
lea eax, [ebp + 0x11a18]
mov ecx, 0x57b208
push eax
call fcn.004068d0
test al, al
je 0x4e1c2e
lea eax, [ebp + 0x11a18]
push eax
call fcn.00474160
test al, al
jne 0x4e1bb5
mov byte [ebp - 4], 6
lea ecx, [ebp + 0x7270]
call fcn.00499fa0
cmp byte [ebp - 0xf], 0
jne 0x4e1c53
cmp byte [ebp - 0xe], 0
jne 0x4e1c53
push 0x56fafa
call fcn.00473d60
cmp word [ebp + 0xea18], 0
je 0x4e1c69
lea eax, [ebp + 0xea18]
push eax
call fcn.004d4ce0
lea eax, [ebp + 0xa918]
push eax
call fcn.004d70c0
lea eax, [ebp + 0x7918]
push eax
call fcn.004d4ce0
mov edi, dword [ebp - 0x14]
mov esi, dword [ebp - 0x20]
mov al, byte [0x558b36]
inc edi
mov dword [ebp - 0x14], edi
test al, al
je 0x4e0e50
jmp 0x4e1c9f
mov al, byte [0x558b36]
mov ebx, dword [ebp - 0x18]
cmp byte [0x558b37], 0
jne 0x4e1cb9
test al, al
jne 0x4e1cb9
mov eax, 0x4d0
jmp 0x4e1cbe
mov ebx, dword [ebp - 0x18]
mov eax, 0x272
push eax
call fcn.00496b20
push eax
call fcn.004d71d0
add esp, 4
cmp byte [0x558b36], 0
je 0x4e1cdd
call fcn.004d90f0
jmp 0x4e1cf7
push 0
push 0
push 0
push 0
push 0
push 1
push 0
push 1
call fcn.004d9130
call fcn.004d9fd0
mov al, byte [0x558b34]
test al, al
je 0x4e1d4c
mov ecx, 0x40
lea esi, [ebp + 0x7374]
mov edi, 0x57b552
lea eax, [ebp + 0x8918]
rep movsd dword es:[edi], dword [esi]
push 0
push 0
push eax
movsw word es:[edi], word [esi]
mov ecx, 0x57b208
mov byte [0x57b654], 1
call fcn.00406f60
cmp eax, 1
je 0x4e1d43
mov ecx, 0x57de98
call fcn.00445510
test al, al
jne 0x4e1d52
mov al, byte [0x558b34]
test al, al
jne 0x4e1d6d
cmp dword [ebp - 0x1c], 0
jbe 0x4e1d69
push 0x56fafa
call fcn.00485280
push eax
mov ecx, 0x57de98
call fcn.0044ab10
jmp 0x4e1d88
test al, al
je 0x4e1d88
cmp dword [ebp - 0x1c], 0
jbe 0x4e1d88
push 0x56fafa
call fcn.00485280
push eax
mov ecx, 0x57de98
call fcn.00449d40
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x7374]
call fcn.00499fa0
cmp byte [ebp + 0x726c], 0
je 0x4e1db0
push dword [0x5511c4]
push 0x5bc798
call fcn.004ad8a0
push 0x5bc798
call fcn.004add00
test ebx, ebx
je 0x4e1dc4
push ebx
call fcn.004d5e70
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x6234]
call fcn.00443910
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x12a18]
xor ecx, ebp
call fcn.00502f8e
lea esp, [ebp + 0x12a1c]
pop ebp
ret 4