Function at 0x4ad11442
Capabilities:
Check if file exists
Copy file
Delete file
Get file attributes
Get file size
Read file on windows
Set file attributes

Disassembly:
cmp dword [0x4ad241ac], edi
jne 0x4ad19568
mov esi, 0x104
push esi
lea eax, [ebp - 0xa2c]
push eax
push ebx
call fcn.4ad111cc
cmp eax, 1
je 0x4ad1959d
cmp dword [0x4ad241e0], edi
je 0x4ad11e4e
test byte [ebx + 0x1c], 8
jne 0x4ad11e21
cmp dword [0x4ad24160], 3
je 0x4ad11e21
push edi
push esi
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0xa48]
push ebx
call fcn.4ad10e7a
cmp eax, 1
je 0x4ad1959d
cmp dword [0x4ad24160], 3
je 0x4ad11ec4
cmp word [ebp - 0x20c], di
je 0x4ad10db4
push edi
push dword [ebx + 4]
call fcn.4ad1127a
mov dword [ebp - 0xa38], eax
cmp eax, 0xffffffff
je 0x4ad18cd9
push eax
call fcn.4ad03bd3
test eax, eax
jne 0x4ad18d18
cmp dword [0x4ad24154], edi
jne 0x4ad18d3f
mov eax, dword [ebp - 0xa68]
mov dword [ebp - 0xa4c], eax
mov eax, dword [ebp - 0xa4c]
mov dword [ebp - 0xa7c], eax
mov eax, dword [ebx + 0x1c]
test al, 4
je 0x4ad11e60
and eax, 0xfffffffb
mov dword [ebx + 0x1c], eax
test al, al
js 0x4ad18d5e
or eax, 1
mov dword [ebx + 0x1c], eax
cmp byte [0x4ad24081], 0
je 0x4ad18d66
push dword [ebx + 4]
lea eax, [ebp - 0x824]
push 0x208
push eax
call fcn.4ad02ece
mov esi, eax
lea eax, [ebp - 0x20c]
push eax
call fcn.4ad01b0c
push eax
push dword [ebp - 0xa30]
lea eax, [ebp - 0xa34]
push ebx
push eax
push 0x200
push dword [ebp - 0xa40]
push dword [ebp - 0xa38]
call fcn.4ad10de4
mov dword [ebp - 0xa54], eax
cmp dword [0x4ad24120], edi
jne 0x4ad18d95
cmp dword [0x4ad24160], 3
je 0x4ad11f08
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x824]
push eax
push esi
call fcn.4ad11167
test eax, eax
jne 0x4ad18db9
mov eax, dword [ebp - 0xa48]
mov dword [0x4ad240e0], 1
cmp dword [eax + 0x20], edi
je 0x4ad10b67
cmp dword [0x4ad241e0], edi
je 0x4ad10b67
mov dword [0x4ad240e4], 1
mov dword [0x4ad24120], edi
push dword [eax + 0x20]
call fcn.4ad098bc
mov eax, dword [0x4ad24120]
cmp eax, 0x15
je 0x4ad11efc
cmp eax, 0x458
je 0x4ad11efc
push 1
push 0x104
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0xa48]
push ebx
call fcn.4ad10e7a
cmp eax, 1
je 0x4ad19592
cmp word [ebp - 0x20c], di
je 0x4ad18e45
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x824]
push eax
push esi
call fcn.4ad11167
test eax, eax
jne 0x4ad18e55
lea eax, [ebp - 0x20c]
xor esi, esi
push eax
inc esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [ebp - 0xa44], edi
jne 0x4ad10c08
cmp dword [ebp - 0xa78], edi
je 0x4ad10be8
mov dword [ebp - 0xa58], edi
cmp eax, 0xffffffff
jne 0x4ad11b12
mov dword [ebp - 0xa78], edi
and dword [ebx + 0x1c], 0xfffffffb
cmp byte [0x4ad24081], 0
mov ecx, dword [ebx + 0x1c]
je 0x4ad18ec5
cmp dword [ebp - 0xa58], edi
jne 0x4ad18f09
cmp dword [0x4ad241e0], edi
je 0x4ad10c34
mov ecx, dword [ebp - 0xa48]
mov ecx, dword [ecx + 0x20]
cmp ecx, edi
je 0x4ad10c27
test byte [ecx + 0x1c], 8
jne 0x4ad11dfb
cmp dword [0x4ad24160], 3
je 0x4ad18f20
test al, 6
je 0x4ad11b54
or dword [ebp - 0xa30], 0xffffffff
mov dword [0x4ad24120], 5
cmp dword [ebp - 0xa30], 0xffffffff
mov dword [ebp - 0xa60], edi
jne 0x4ad11b1f
mov dword [ebp - 0xa74], edi
xor esi, esi
inc esi
cmp dword [ebp - 0xa70], esi
je 0x4ad18f5e
mov eax, dword [ebx + 0x1c]
test al, 8
jne 0x4ad10c89
cmp dword [0x4ad24160], 3
je 0x4ad18f8d
mov eax, dword [ebx + 0x1c]
test al, 8
jne 0x4ad11e0f
push dword [ebx + 0x1c]
lea eax, [ebp - 0xa34]
push eax
push dword [ebp - 0xa40]
call fcn.4ad1113b
cmp dword [0x4ad24160], 3
je 0x4ad11eea
mov eax, dword [ebx + 0x1c]
test al, 1
je 0x4ad11eea
and eax, 0x800
cmp dword [ebp - 0xa30], 0xffffffff
mov edi, eax
jne 0x4ad11b3d
test dword [ebx + 0x1c], 0x400
jne 0x4ad18fcd
mov eax, dword [0x4ad241e4]
test eax, eax
je 0x4ad19015
mov ecx, edi
or ecx, dword [ebp - 0xa64]
push ecx
push 0x4ad241ac
push 0
push 0
lea ecx, [ebp - 0x20c]
push ecx
push dword [ebx + 4]
call eax
test eax, eax
je 0x4ad19030
cmp dword [ebp - 0xa60], 0
jne 0x4ad10d4e
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4ad10d41
and eax, 0xfffffffe
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp dword [0x4ad24154], 0
jne 0x4ad190c7
push dword [ebp - 0xa38]
xor edi, edi
mov dword [0x4ad24118], edi
mov eax, dword [ebx + 0x18]
mov ecx, dword [eax + 0x14]
mov dword [ebp - 0xa90], ecx
mov eax, dword [eax + 0x18]
mov dword [ebp - 0xa8c], eax
call fcn.4ad03b88
cmp dword [0x4ad24160], 3
je 0x4ad10dae
cmp dword [0x4ad241ac], edi
jne 0x4ad1951c
lea eax, [ebp - 0xa90]
push eax
push dword [ebp - 0xa30]
push dword [ebp - 0xa48]
push ebx
call fcn.4ad1136a
mov dword [0x4ad241e8], 1
mov dword [0x4ad241e0], edi
push dword [ebp - 0xa3c]
push 0x21
push dword [ebx + 0x18]
call fcn.4ad09a65
test al, al
jne 0x4ad1099e
push dword [ebp - 0xa3c]
call fcn.4ad02e7b
mov ebx, dword [ebx + 0x20]
jmp 0x4ad11504
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa90
mov eax, dword [0x4ad240ac]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push 0x204
xor edi, edi
lea eax, [ebp - 0x410]
push edi
push eax
mov dword [ebp - 0xa48], ebx
mov dword [ebp - 0x414], 0x20
call sub.msvcrt.dll_memset
mov eax, dword [ebx + 0x20]
or dword [ebp - 0xa30], 0xffffffff
add esp, 0xc
mov dword [ebp - 0xa50], edi
mov dword [ebp - 0xa70], edi
mov dword [ebp - 0xa44], edi
mov dword [ebp - 0xa78], 1
cmp eax, edi
je 0x4ad18c44
mov eax, dword [eax + 0x1c]
shr eax, 1
and eax, 8
push edi
mov dword [ebp - 0xa64], eax
lea eax, [ebp - 0xa68]
push eax
mov ebx, 0x80
push ebx
push 0xfe00
mov dword [ebp - 0xa6c], edi
mov dword [ebp - 0xa58], edi
call fcn.4ad116cd
mov dword [ebp - 0xa40], eax
cmp eax, edi
je 0x4ad18c4c
cmp dword [0x4ad24154], edi
jne 0x4ad18c54
mov ebx, dword [esi + 0x20]
cmp ebx, edi
jne 0x4ad11739
cmp dword [0x4ad24160], 3
je 0x4ad19543
mov eax, dword [ebp - 0xa50]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.4ad0139d
leave
ret 8
lea eax, [ebp - 0xa3c]
push eax
push dword [ebx + 0x18]
push 0x21
push dword [ebx]
call fcn.4ad01b0c
push eax
call fcn.4ad02e35
test al, al
je 0x4ad18c79
jmp 0x4ad1099e
test al, 0x10
je 0x4ad10be2
jmp 0x4ad18eba
push dword [ebp - 0xa30]
mov dword [ebp - 0xa74], esi
call fcn.4ad03bd3
test eax, eax
je 0x4ad10c66
jmp 0x4ad18f3b
push dword [ebp - 0xa30]
call fcn.4ad03b88
or dword [ebp - 0xa30], 0xffffffff
jmp 0x4ad10cd5
test dword [ebx + 0x1c], 0x400
jne 0x4ad10c4d
lea eax, [ebp - 0x20c]
push eax
call fcn.4ad11b7d
mov dword [ebp - 0xa30], eax
jmp 0x4ad10c4d
cmp dword [ebx + 0x20], edi
jne 0x4ad10c27
mov dword [0x4ad24160], esi
jmp 0x4ad10c27
cmp dword [0x4ad24160], 3
jne 0x4ad10c94
jmp 0x4ad18fa7
push dword [ebx + 4]
push str._s_r_n
call fcn.4ad0735f
cmp dword [0x4ad24160], 3
pop ecx
pop ecx
jne 0x4ad109e9
cmp dword [0x4ad241e0], edi
jne 0x4ad109e9
jmp 0x4ad10a21
cmp dword [0x4ad24160], 3
jne 0x4ad109d2
jmp 0x4ad18cc5
mov dword [ebp - 0xa44], eax
jmp 0x4ad10a97
lea eax, [ebp - 0x20c]
push eax
push esi
lea eax, [ebp - 0x414]
push eax
call fcn.4ad017fb
jmp 0x4ad10a14
test eax, eax
je 0x4ad109d2
jmp 0x4ad10db4
cmp dword [ebp - 0xa30], 0xffffffff
jne 0x4ad192dc
jmp 0x4ad19340
push edi
push eax
call fcn.4ad0a0bd
jmp 0x4ad19590
cmp dword [0x4ad241e0], edi
jne 0x4ad10afd
jmp 0x4ad10c66
mov eax, dword [ebx + 0x1c]
jmp 0x4ad114b8
xor eax, eax
inc eax
jmp 0x4ad1151f
push 1
lea eax, [ebp - 0xa7c]
push eax
push ebx
push dword [ebp - 0xa68]
call fcn.4ad116cd
mov dword [ebp - 0xa5c], eax
cmp eax, edi
jne 0x4ad11501
jmp 0x4ad18c4c
cmp dword [0x4ad24160], 3
jne 0x4ad18c8e
cmp dword [0x4ad241e0], edi
je 0x4ad10dd7
push dword [ebx]
push 0x4ad245b0
call fcn.4ad0735f
push 0x4ad245a8
call fcn.4ad0735f
add esp, 0xc
push dword [0x4ad24120]
call fcn.4ad13642
push dword [ebp - 0xa3c]
call fcn.4ad02e7b
push 1
push edi
call fcn.4ad1efd3
push dword [ebx + 4]
lea eax, [ebp - 0x414]
push eax
call fcn.4ad1ef59
jmp 0x4ad11edd
push dword [0x4ad24120]
call fcn.4ad13642
cmp dword [0x4ad24160], 3
jne 0x4ad18d09
cmp dword [ebp - 0xa30], 0xffffffff
jne 0x4ad18d09
push dword [ebx + 4]
lea eax, [ebp - 0x20c]
push eax
call fcn.4ad1ef59
test eax, eax
jne 0x4ad18cb2
mov dword [ebp - 0xa50], 1
jmp 0x4ad10db4
mov eax, 0x80
or dword [ebx + 0x1c], eax
mov dword [ebp - 0xa4c], eax
mov eax, dword [ebx + 0x1c]
test al, 1
je 0x4ad10a6b
and eax, 0xfffffffe
or eax, 4
mov dword [ebx + 0x1c], eax
jmp 0x4ad10a6b
mov ecx, dword [ebp - 0xa68]
mov eax, dword [ebp - 0xa7c]
cmp ecx, eax
jae 0x4ad10a59
mov dword [ebp - 0xa4c], ecx
jmp 0x4ad10a5f
or eax, 2
jmp 0x4ad10a87
cmp dword [0x4ad241e0], edi
je 0x4ad10a97
test al, 8
jne 0x4ad10a97
cmp dword [0x4ad24160], 3
jne 0x4ad10a97
and eax, 0xfffffffe
or eax, 2
mov dword [ebx + 0x1c], eax
jmp 0x4ad10a97
push dword [ebp - 0xa38]
call fcn.4ad03b88
push 0x6e
call fcn.4ad13642
cmp dword [0x4ad24160], 3
jne 0x4ad18d09
jmp 0x4ad18cb2
test byte [ebx + 0x1c], 0x80
jne 0x4ad10b19
push dword [ebp - 0xa38]
call fcn.4ad03b88
push dword [ebp - 0xa3c]
lea eax, [ebp - 0xa30]
push dword [ebp - 0xa4c]
push dword [ebp - 0xa40]
push dword [0x4ad241e0]
push eax
push ebx
call fcn.4ad1f256
cmp dword [0x4ad241e0], edi
je 0x4ad18e2b
cmp dword [0x4ad24160], 3
jne 0x4ad18e21
and dword [ebx + 0x1c], 0xfffffffe
mov eax, dword [ebx + 0x1c]
cmp dword [ebp - 0xa44], edi
jne 0x4ad18e18
or eax, 2
jmp 0x4ad18e1e
or eax, dword [ebp - 0xa44]
mov dword [ebx + 0x1c], eax
mov dword [ebp - 0xa70], 1
push dword [ebx + 0x1c]
lea eax, [ebp - 0xa34]
push eax
push dword [ebp - 0xa40]
call fcn.4ad1113b
jmp 0x4ad10dae
push dword [ebp - 0xa38]
call fcn.4ad03b88
jmp 0x4ad10db4
test byte [ebx + 0x1c], 0x80
jne 0x4ad10bb3
push dword [ebp - 0xa38]
call fcn.4ad03b88
mov eax, dword [0x4ad241e0]
cmp eax, edi
je 0x4ad18e95
mov ecx, dword [ebp - 0xa48]
mov ecx, dword [ecx + 0x20]
cmp ecx, edi
je 0x4ad18e95
test byte [ecx + 0x1c], 8
je 0x4ad18e95
cmp dword [ebx + 0x20], edi
jne 0x4ad18e95
mov dword [0x4ad24160], 1
push dword [ebp - 0xa3c]
push dword [ebp - 0xa4c]
push dword [ebp - 0xa40]
push eax
lea eax, [ebp - 0xa30]
push eax
push ebx
call fcn.4ad1f256
jmp 0x4ad10bb3
mov dword [ebp - 0xa58], esi
jmp 0x4ad10be2
test cl, 8
je 0x4ad10bfc
cmp dword [0x4ad24160], 3
jne 0x4ad10bfc
mov dword [ebp - 0xa6c], 3
cmp dword [ebp - 0xa58], edi
jne 0x4ad10c08
mov edx, dword [ebp - 0xa48]
mov edx, dword [edx + 0x20]
cmp edx, edi
je 0x4ad18f04
test byte [edx + 0x1c], 8
jne 0x4ad18f16
or ecx, 2
jmp 0x4ad18f18
cmp dword [ebp - 0xa6c], 3
jne 0x4ad10c08
or ecx, esi
mov dword [ebx + 0x1c], ecx
jmp 0x4ad10c08
mov ecx, dword [ebp - 0xa44]
cmp ecx, edi
jne 0x4ad18f33
mov ecx, dword [ebx + 0x1c]
and ecx, 0xfffffffe
or ecx, 2
mov dword [ebx + 0x1c], ecx
jmp 0x4ad10c34
mov dword [ebp - 0xa60], esi
cmp dword [ebp - 0xa44], edi
jne 0x4ad10c66
mov eax, dword [ebx + 0x1c]
and eax, 0xfffffffe
or eax, 2
mov dword [ebx + 0x1c], eax
jmp 0x4ad10c66
cmp dword [0x4ad24160], 3
jne 0x4ad10c75
and dword [ebx + 0x1c], 0xfffffffe
mov eax, dword [ebx + 0x1c]
cmp dword [ebp - 0xa44], edi
jne 0x4ad18f7f
or eax, 2
jmp 0x4ad18f85
or eax, dword [ebp - 0xa44]
mov dword [ebx + 0x1c], eax
jmp 0x4ad10c75
cmp dword [ebp - 0xa44], edi
jne 0x4ad10c89
and eax, 0xfffffffe
or eax, 2
mov dword [ebx + 0x1c], eax
jmp 0x4ad10c89
cmp dword [ebp - 0xa58], edi
jne 0x4ad10c94
cmp dword [ebp - 0xa44], edi
jne 0x4ad10c94
and eax, 0xfffffffe
or eax, 2
mov dword [ebx + 0x1c], eax
jmp 0x4ad10c94
push dword [ebx + 4]
call fcn.4ad1ff07
test eax, eax
jne 0x4ad18fe9
lea eax, [ebp - 0x20c]
push eax
call fcn.4ad1ff07
test eax, eax
je 0x4ad18fec
xor eax, eax
inc eax
mov ecx, edi
or ecx, dword [ebp - 0xa64]
or ecx, 2
push ecx
push 0
push eax
push 0x4ad1eeb2
lea eax, [ebp - 0x20c]
push eax
push dword [ebx + 4]
call dword [0x4ad241e4]
jmp 0x4ad10d0d
push dword [ebp - 0xa64]
lea eax, [ebp - 0x20c]
push eax
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
jmp 0x4ad10d0d
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x4ad24120], eax
cmp eax, 1
jne 0x4ad1905b
test edi, edi
je 0x4ad1905b
mov eax, dword [ebx + 0x18]
test dword [eax], 0x400
je 0x4ad1905b
mov dword [0x4ad24120], 0x40002730
push dword [ebp - 0xa38]
call fcn.4ad03b88
xor edi, edi
cmp dword [ebp - 0xa60], edi
je 0x4ad19073
push 0x1d
pop esi
mov dword [0x4ad24118], edi
cmp dword [0x4ad24120], edi
jne 0x4ad1908b
mov dword [0x4ad24120], 0x70
cmp dword [0x4ad241ac], edi
je 0x4ad19097
xor esi, esi
jmp 0x4ad190a6
cmp esi, edi
jne 0x4ad190a6
push dword [0x4ad24120]
call fcn.4ad13642
cmp dword [ebp - 0xa74], edi
jne 0x4ad195ad
xor eax, eax
inc eax
mov dword [ebp - 0xa50], eax
mov dword [0x4ad241e8], eax
xor edi, edi
jmp 0x4ad10db4
push 0
push 1
lea eax, [ebp - 0x20c]
push eax
call fcn.4ad1fc01
mov esi, eax
or edi, 0xffffffff
mov dword [ebp - 0xa30], esi
cmp esi, edi
jne 0x4ad19101
lea eax, [ebp - 0x20c]
push eax
push 1
push 0x4000271f
call fcn.4ad0ab8b
add esp, 0xc
jmp 0x4ad10d4e
push esi
call fcn.4ad03bd3
push esi
test eax, eax
je 0x4ad1911c
call fcn.4ad03b88
mov dword [ebp - 0xa30], edi
jmp 0x4ad10d4e
call dword [sym.imp.msvcrt.dll__get_osfhandle]
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
test eax, eax
jne 0x4ad19147
lea eax, [ebp - 0x20c]
push eax
push 1
push 0x4000271f
call fcn.4ad0ab8b
add esp, 0xc
push esi
jmp 0x4ad1910c
push esi
call fcn.4ad03b88
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.4ad1127a
mov esi, eax
mov dword [ebp - 0xa30], esi
cmp esi, edi
je 0x4ad190e6
push esi
call fcn.4ad03bd3
test eax, eax
jne 0x4ad1912e
mov edi, dword [sym.imp.msvcrt.dll__get_osfhandle]
push eax
push eax
push eax
push dword [ebp - 0xa38]
call edi
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
pop ecx
push eax
call esi
xor eax, eax
push eax
push eax
push eax
push dword [ebp - 0xa30]
call edi
pop ecx
push eax
call esi
lea eax, [ebp - 0xa88]
push eax
push dword [ebp - 0xa38]
call edi
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
lea eax, [ebp - 0xa84]
push eax
push dword [ebp - 0xa30]
call edi
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp esi, eax
jne 0x4ad192af
mov eax, dword [ebp - 0xa88]
cmp eax, dword [ebp - 0xa84]
jne 0x4ad192af
and dword [ebp - 0xa54], 0
mov edi, dword [sym.imp.msvcrt.dll__get_osfhandle]
push 0
lea eax, [ebp - 0xa34]
push eax
push dword [ebp - 0xa4c]
push dword [ebp - 0xa40]
push dword [ebp - 0xa38]
call edi
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
pop ecx
push eax
call esi
test eax, eax
je 0x4ad192c5
cmp dword [ebp - 0xa34], 0
je 0x4ad192c5
push 0
lea eax, [ebp - 0xa80]
push eax
push dword [ebp - 0xa34]
push dword [ebp - 0xa5c]
push dword [ebp - 0xa30]
call edi
pop ecx
push eax
call esi
test eax, eax
je 0x4ad19298
mov ecx, dword [ebp - 0xa34]
cmp dword [ebp - 0xa80], ecx
jne 0x4ad19298
cmp dword [ebp - 0xa4c], ecx
je 0x4ad19279
mov dword [ebp - 0xa54], 1
mov edi, dword [ebp - 0xa5c]
mov esi, dword [ebp - 0xa40]
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x4ad19298
cmp dword [ebp - 0xa54], eax
jne 0x4ad192c5
jmp 0x4ad191f2
push dword [ebp - 0xa30]
call fcn.4ad03b88
or dword [ebp - 0xa30], 0xffffffff
jmp 0x4ad190e6
lea eax, [ebp - 0x20c]
push eax
push 1
push 0x4000271f
call fcn.4ad0ab8b
add esp, 0xc
push dword [ebp - 0xa30]
call fcn.4ad03b88
or dword [ebp - 0xa30], 0xffffffff
jmp 0x4ad10d4e
push dword [ebp - 0xa30]
call dword [sym.imp.msvcrt.dll__get_osfhandle]
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
cmp dword [0x4ad241e0], edi
jne 0x4ad19395
cmp dword [0x4ad24160], 3
jne 0x4ad19395
mov eax, dword [ebx + 0x1c]
test al, 2
je 0x4ad19395
mov esi, 0x4000
test esi, eax
je 0x4ad1939a
mov eax, dword [ebp - 0xa40]
sub dword [ebp - 0xa34], 2
push dword [ebp - 0xa34]
lea ecx, [eax + 2]
push ecx
push eax
call dword [sym.imp.msvcrt.dll_memmove]
add esp, 0xc
jmp 0x4ad1939a
push edi
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.4ad1fc01
mov dword [ebp - 0xa30], eax
cmp eax, 0xffffffff
jne 0x4ad192f0
push dword [ebp - 0xa38]
call fcn.4ad03b88
cmp dword [0x4ad240e8], edi
jne 0x4ad19377
push dword [0x4ad24120]
call fcn.4ad13642
cmp dword [0x4ad24160], 3
je 0x4ad195b5
mov dword [ebp - 0xa50], esi
mov dword [0x4ad241e8], esi
jmp 0x4ad10db4
mov esi, 0x4000
test dword [ebx + 0x1c], esi
je 0x4ad193b4
mov ecx, dword [ebp - 0xa48]
mov eax, dword [ecx + 0x20]
cmp eax, edi
je 0x4ad193b1
or dword [eax + 0x1c], esi
jmp 0x4ad193b4
or dword [ecx + 0x1c], esi
cmp dword [0x4ad24118], edi
je 0x4ad193cd
cmp dword [ebp - 0xa34], edi
jg 0x4ad194a6
jmp 0x4ad10d4e
cmp dword [ebp - 0xa54], 1
jne 0x4ad19481
push dword [ebp - 0xa38]
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0xa34]
push dword [ebp - 0xa40]
push dword [ebp - 0xa30]
call fcn.4ad1f315
cmp dword [0x4ad24154], edi
je 0x4ad19443
push dword [ebp - 0xa30]
call fcn.4ad03bd3
test eax, eax
jne 0x4ad19443
push dword [ebp - 0xa5c]
lea eax, [ebp - 0x20c]
push dword [ebp - 0xa40]
push dword [ebp - 0xa34]
push eax
lea eax, [ebp - 0xa30]
push eax
call fcn.4ad1f166
cmp eax, 1
je 0x4ad18cb2
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0xa30]
lea eax, [ebp - 0xa34]
push ebx
push eax
push dword [ebp - 0xa4c]
push dword [ebp - 0xa40]
push dword [ebp - 0xa38]
call fcn.4ad10de4
mov dword [ebp - 0xa54], eax
cmp dword [0x4ad24118], edi
je 0x4ad193cd
cmp dword [0x4ad24118], edi
je 0x4ad10d4e
cmp dword [ebp - 0xa34], edi
jle 0x4ad10d4e
cmp dword [ebp - 0xa54], 1
jne 0x4ad10d4e
push dword [ebp - 0xa38]
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0xa34]
push dword [ebp - 0xa40]
push dword [ebp - 0xa30]
call fcn.4ad1f315
cmp dword [0x4ad24154], edi
je 0x4ad10d4e
push dword [ebp - 0xa30]
call fcn.4ad03bd3
test eax, eax
jne 0x4ad10d4e
push dword [ebp - 0xa5c]
lea eax, [ebp - 0x20c]
push dword [ebp - 0xa40]
push dword [ebp - 0xa34]
push eax
lea eax, [ebp - 0xa30]
push eax
call fcn.4ad1f166
cmp eax, 1
jne 0x4ad10d4e
jmp 0x4ad18cb2
push dword [ebp - 0xa30]
call fcn.4ad03b88
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0xa50], 1
jmp 0x4ad10da4
cmp dword [ebp - 0xa30], 0xffffffff
je 0x4ad11519
push edi
push dword [ebp - 0xa30]
push dword [ebp - 0xa48]
push ebx
call fcn.4ad1136a
jmp 0x4ad11519
push dword [ebp - 0xa3c]
call fcn.4ad02e7b
cmp dword [ebp - 0xa30], 0xffffffff
je 0x4ad18c4c
push dword [ebp - 0xa30]
call fcn.4ad03b88
jmp 0x4ad18c4c
pop ecx
pop ecx
push dword [ebp - 0xa38]
call fcn.4ad03b88
push dword [ebp - 0xa3c]
call fcn.4ad02e7b
jmp 0x4ad18c4c
push 1
push esi
jmp 0x4ad18cc0
push dword [ebp - 0xa3c]
call fcn.4ad02e7b
push esi
jmp 0x4ad18cbf