Function at 0x4baa80
Capabilities:
Check if file exists
Copy file
Get file attributes
Read file on windows
Resolve function by parsing pe exports
Set file attributes
Write file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x862add
push eax
mov dword fs:[0], esp
sub esp, 0x774
push ebx
push ebp
mov ebp, dword [esp + 0x78c]
xor ebx, ebx
push esi
cmp ebp, ebx
push edi
je 0x4bb67e
cmp word [ebp], bx
je 0x4bb67e
mov edi, dword [esp + 0x798]
cmp edi, ebx
je 0x4bb67e
cmp word [edi], bx
je 0x4bb67e
push 0xffffffffffffffff
lea ecx, [esp + 0x24]
call fcn.00469e90
push ebx
push ebx
push ebx
push ebp
mov dword [esp + 0x79c], ebx
call fcn.006791b0
add esp, 0x10
cmp eax, 4
je 0x4bab01
push 0x454
push 1
jmp 0x4bacf1
mov eax, dword [esp + 0x7a4]
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, ebx
je 0x4bac5e
push ebx
push ebx
push 3
push ebx
push 5
push 0xc0000000
push ebp
call esi
mov esi, eax
cmp esi, 0xffffffff
jne 0x4bab36
push 0x466
jmp 0x4bacef
mov ecx, 0xdb
xor eax, eax
lea edi, [esp + 0xa5]
mov byte [esp + 0xa4], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push ebx
push ebx
lea eax, [esp + 0xac]
push ebx
push eax
push esi
call fcn.00679580
add esp, 0x14
test eax, eax
je 0x4bac4a
lea ecx, [esp + 0xd4]
push str._OEAX_
push ecx
call fcn.005fd3f1
add esp, 8
test eax, eax
jne 0x4bac4a
push ebp
call fcn.00516c30
add esp, 4
lea ecx, [esp + 0x10]
push eax
call fcn.00617650
push 0x2e
lea ecx, [esp + 0x14]
mov byte [esp + 0x790], 1
call fcn.006190d0
mov edi, eax
cmp edi, 0xffffffff
je 0x4bac26
lea edx, [esp + 0x18]
push edi
push edx
lea ecx, [esp + 0x18]
call fcn.0061a220
mov eax, dword [esp + 0x18]
push str..oeax
push eax
mov byte [esp + 0x794], 2
call fcn.005fc4b7
add esp, 8
cmp eax, ebx
jne 0x4bac15
lea ecx, [esp + 0x50]
push edi
push ecx
lea ecx, [esp + 0x18]
call fcn.0061a690
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x790], 3
call fcn.00618070
lea ecx, [esp + 0x50]
mov byte [esp + 0x78c], 2
call fcn.00617ec0
lea ecx, [esp + 0x18]
mov byte [esp + 0x78c], 1
call fcn.00617ec0
mov edi, dword [esp + 0x10]
call fcn.00517960
push eax
push edi
push esi
call fcn.00679170
add esp, 0xc
lea ecx, [esp + 0x10]
mov byte [esp + 0x78c], bl
call fcn.00617ec0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, dword [esp + 0x798]
push edi
call fcn.004b9330
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
mov dword [esp + 0x1c], eax
je 0x4bac84
test al, 0x10
je 0x4bacb8
push 0x484
push 1
jmp 0x4bacf1
push ebx
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x4bac9a
push 0x48c
push 4
jmp 0x4bacf1
lea ecx, [esp + 0x20]
mov dword [esp + 0x78c], 0xffffffff
call fcn.00469ec0
mov eax, 1
jmp 0x4bb68f
push ebx
push ebx
push ebx
push edi
call fcn.006791b0
add esp, 0x10
cmp eax, 4
je 0x4bacd2
push 0x495
push 1
jmp 0x4bacf1
push ebx
push ebx
push 3
push ebx
push 5
push SysReAllocString
push ebp
call esi
cmp eax, 0xffffffff
mov dword [esp + 0x44], eax
jne 0x4bad12
push 0x4a7
push 3
call fcn.004b8630
add esp, 8
lea ecx, [esp + 0x20]
mov dword [esp + 0x78c], 0xffffffff
call fcn.00469ec0
jmp 0x4bb68d
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x50], ebx
test al, 1
je 0x4bad28
and al, 0xfe
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
push 0x80
push 3
push ebx
push 1
push 0xc0000000
push edi
call esi
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x58], esi
je 0x4bb5a2
mov edi, dword [esp + 0x44]
mov ebp, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
push ebx
push ebx
push edi
call ebp
push ebx
push ebx
push ebx
push esi
call ebp
cmp dword [esp + 0x79c], ebx
je 0x4bae82
mov ecx, 0xdb
xor eax, eax
lea edi, [esp + 0xa5]
mov byte [esp + 0xa4], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x14]
stosb byte es:[edi], al
call fcn.00636b60
mov ecx, dword [esp + 0x44]
push ebx
lea edx, [esp + 0x18]
push ebx
lea eax, [esp + 0xac]
push edx
push eax
push ecx
mov byte [esp + 0x7a0], 4
call fcn.00679580
add esp, 0x14
test eax, eax
je 0x4bb5b6
mov ecx, 0xdb
xor eax, eax
lea edi, [esp + 0x415]
mov byte [esp + 0x414], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x10]
stosb byte es:[edi], al
call fcn.00636b60
push ebx
lea edx, [esp + 0x14]
push ebx
lea eax, [esp + 0x41c]
push edx
push eax
push esi
mov byte [esp + 0x7a0], 5
call fcn.00679580
add esp, 0x14
test eax, eax
je 0x4bb5c7
lea ecx, [esp + 0x10]
call fcn.00636d30
lea ecx, [esp + 0x14]
mov edi, eax
call fcn.00636d30
cmp eax, edi
jne 0x4bb5fc
lea ecx, [esp + 0x14]
call fcn.00636d30
lea ecx, [esp + 0x10]
mov esi, eax
call fcn.00637450
lea ecx, [esp + 0x14]
mov edi, eax
call fcn.00637450
mov ecx, esi
mov esi, eax
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x4bae51
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x4bb631
lea ecx, [esp + 0x10]
mov byte [esp + 0x78c], 4
call fcn.00636c90
lea ecx, [esp + 0x14]
mov byte [esp + 0x78c], bl
call fcn.00636c90
mov esi, dword [esp + 0x58]
mov edi, dword [esp + 0x44]
push 0x10000
call fcn.008325b4
add esp, 4
cmp eax, ebx
mov dword [esp + 0x7c], eax
je 0x4bb66a
push ebx
push ebx
push ebx
push edi
call ebp
push 2
push ebx
push ebx
push esi
call ebp
mov dword [esp + 0x24], 0x893fcc
mov dword [esp + 0x28], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], ebx
lea ecx, [esp + 0x80]
mov byte [esp + 0x78c], 6
call fcn.0061ebd0
mov eax, dword [0x8ab26c]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x54], ebx
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x7a0]
mov byte [esp + 0x78c], 9
cmp eax, ebx
mov dword [esp + 0x40], ebx
je 0x4bb38a
push ebx
push ebx
push ebx
push edi
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x24], ebx
call ebp
push ebx
push ebx
push ebx
push esi
call ebp
mov dword [esp + 0x68], 0x893fcc
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x78], ebx
mov dword [esp + 0x74], ebx
mov dword [esp + 0x70], ebx
lea ecx, [esp + 0x94]
mov byte [esp + 0x78c], 0xa
call fcn.0061ebd0
mov eax, dword [0x8ab26c]
mov dword [esp + 0x18], eax
mov dword [esp + 0x48], ebx
mov dword [esp + 0x60], eax
push ebx
lea edx, [esp + 0x44]
push ebx
lea eax, [esp + 0x68]
push edx
push eax
lea ecx, [esp + 0x58]
push ebx
lea edx, [esp + 0x2c]
push ecx
lea eax, [esp + 0xac]
push edx
lea ecx, [esp + 0x84]
push eax
push ecx
push edi
mov byte [esp + 0x7b4], 0xd
call fcn.004b72f0
mov eax, dword [esp + 0x98]
add esp, 0x28
cmp eax, ebx
jne 0x4bafce
lea edx, [esp + 0x68]
push edx
push edi
call fcn.004ba720
mov eax, dword [esp + 0x78]
add esp, 8
xor edi, edi
cmp eax, ebx
jle 0x4bafce
mov eax, dword [esp + 0x98]
push 0x9b5220
push eax
lea ecx, [esp + 0x9c]
call fcn.0061f240
mov eax, dword [esp + 0x70]
inc edi
cmp edi, eax
jl 0x4bafac
push ebx
lea ecx, [esp + 0x68]
push ebx
lea edx, [esp + 0x40]
push ecx
push edx
lea eax, [esp + 0x64]
push ebx
lea ecx, [esp + 0x50]
push eax
lea edx, [esp + 0x98]
push ecx
lea eax, [esp + 0x40]
push edx
push eax
push esi
mov dword [esp + 0x8c], ebx
call fcn.004b72f0
mov eax, dword [esp + 0x54]
add esp, 0x28
cmp eax, ebx
jne 0x4bb044
lea ecx, [esp + 0x24]
push ecx
push esi
call fcn.004ba720
mov eax, dword [esp + 0x34]
add esp, 8
xor esi, esi
cmp eax, ebx
jle 0x4bb044
mov edx, dword [esp + 0x84]
push 0x9b5220
push edx
lea ecx, [esp + 0x88]
call fcn.0061f240
mov eax, dword [esp + 0x2c]
inc esi
cmp esi, eax
jl 0x4bb022
mov ecx, dword [esp + 0x40]
cmp ecx, ebx
je 0x4bb055
cmp ecx, 0xffffffff
je 0x4bb055
add ecx, eax
jmp 0x4bb059
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x70]
mov esi, eax
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0x28]
lea ebp, [eax + edx]
mov dword [esp + 0x4c], esi
cmp ebp, ebx
jne 0x4bb092
cmp ecx, ebx
je 0x4bb085
push ecx
call fcn.008325dd
add esp, 4
xor ecx, ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], ebx
jmp 0x4bb18c
cmp ecx, ebx
jne 0x4bb0c0
mov eax, ebp
shl eax, 4
push eax
call fcn.008325b4
add esp, 4
mov dword [esp + 0x28], eax
push ebp
push eax
call fcn.00444dd0
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x30], ebp
mov dword [esp + 0x2c], ebp
jmp 0x4bb18c
mov edi, dword [esp + 0x30]
cmp ebp, edi
jg 0x4bb0e9
cmp ebp, eax
jle 0x4bb0e0
mov edx, ebp
sub edx, eax
shl eax, 4
add eax, ecx
push edx
push eax
call fcn.00444dd0
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x2c], ebp
jmp 0x4bb18c
mov ecx, dword [esp + 0x34]
cmp ecx, ebx
jne 0x4bb115
cdq
and edx, 7
add eax, edx
mov ecx, eax
sar ecx, 3
cmp ecx, 4
jge 0x4bb108
mov ecx, 4
jmp 0x4bb115
cmp ecx, 0x400
jle 0x4bb115
mov ecx, 0x400
lea eax, [edi + ecx]
cmp ebp, eax
mov dword [esp + 0x10], eax
jl 0x4bb124
mov dword [esp + 0x10], ebp
mov eax, dword [esp + 0x10]
shl eax, 4
push eax
call fcn.008325b4
mov ecx, dword [esp + 0x30]
mov esi, dword [esp + 0x2c]
shl ecx, 4
mov edx, ecx
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, ebp
and ecx, 3
add esp, 4
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x5c], eax
sub edx, ecx
shl ecx, 4
add ecx, eax
push edx
push ecx
call fcn.00444dd0
mov eax, dword [esp + 0x28]
push eax
call fcn.008325dd
mov ecx, dword [esp + 0x60]
mov edx, dword [esp + 0x14]
mov esi, dword [esp + 0x50]
add esp, 4
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], edx
mov edx, dword [esp + 0x6c]
shl esi, 4
add esi, ecx
mov ecx, dword [esp + 0x70]
cmp ecx, ebx
mov eax, esi
je 0x4bb1c2
mov esi, edx
mov edi, eax
add eax, 0x10
add edx, 0x10
mov ebp, dword [esi]
dec ecx
mov dword [edi], ebp
mov ebp, dword [esi + 4]
mov dword [edi + 4], ebp
mov ebp, dword [esi + 8]
mov dword [edi + 8], ebp
mov esi, dword [esi + 0xc]
mov dword [edi + 0xc], esi
jne 0x4bb19f
lea eax, [esp + 0x94]
lea ecx, [esp + 0x80]
push eax
call fcn.0061eef0
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x54]
cmp eax, ecx
jle 0x4bb1e6
mov dword [esp + 0x54], eax
push ecx
mov ecx, esp
mov dword [esp + 0x60], esp
push 0x933d50
call fcn.00617650
push ecx
lea edx, [esp + 0x44]
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
mov byte [esp + 0x798], 0xe
call fcn.00617440
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x9c], esp
push eax
mov byte [esp + 0x79c], 0xf
call fcn.00617440
lea ecx, [esp + 0x58]
mov byte [esp + 0x798], 0xd
push ecx
call fcn.004bb6b0
add esp, 0x10
push eax
lea ecx, [esp + 0x40]
mov byte [esp + 0x790], 0x10
call fcn.00618070
lea ecx, [esp + 0x4c]
mov byte [esp + 0x78c], 0xd
call fcn.00617ec0
push ecx
mov ecx, esp
mov dword [esp + 0x94], esp
push 0x92f588
call fcn.00617650
push ecx
lea edx, [esp + 0x40]
mov ecx, esp
mov dword [esp + 0x64], esp
push edx
mov byte [esp + 0x798], 0x11
call fcn.00617440
push ecx
lea eax, [esp + 0x6c]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
mov byte [esp + 0x79c], 0x12
call fcn.00617440
lea ecx, [esp + 0x58]
mov byte [esp + 0x798], 0xd
push ecx
call fcn.004bb6b0
add esp, 0x10
push eax
lea ecx, [esp + 0x3c]
mov byte [esp + 0x790], 0x13
call fcn.00618070
lea ecx, [esp + 0x4c]
mov byte [esp + 0x78c], 0xd
call fcn.00617ec0
mov edx, dword [esp + 0x44]
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
push ebx
push ebx
push edx
call esi
mov edi, dword [esp + 0x58]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
push ecx
push edi
call fcn.004b7e80
mov eax, dword [esp + 0x28]
add esp, 0xc
cmp eax, ebx
jne 0x4bb31d
cmp dword [esp + 0x14], ebx
jne 0x4bb31d
push 2
push ebx
push ebx
jmp 0x4bb324
lea edx, [esp + 0x14]
push ebx
push edx
push eax
push edi
call esi
lea ecx, [esp + 0x60]
mov byte [esp + 0x78c], 0xc
call fcn.00617ec0
lea ecx, [esp + 0x18]
mov byte [esp + 0x78c], 0xb
call fcn.00617ec0
lea ecx, [esp + 0x94]
mov byte [esp + 0x78c], 0xa
call fcn.0061ebe0
mov dword [esp + 0x68], 0x893fcc
mov eax, dword [esp + 0x6c]
mov byte [esp + 0x78c], 0x14
cmp eax, ebx
je 0x4bb37e
push eax
call fcn.008325dd
add esp, 4
mov esi, dword [esp + 0x58]
mov byte [esp + 0x78c], 9
mov ebp, dword [esp + 0x7c]
mov dword [esp + 0x48], ebx
mov dword [esp + 0x10], ebx
mov ecx, 0x4000
xor eax, eax
mov edi, ebp
push ebx
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x48]
lea eax, [esp + 0x1c]
push eax
push 0x10000
push ebp
push ecx
mov dword [esp + 0x2c], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4bb402
mov eax, dword [esp + 0x18]
cmp eax, 0x10000
jae 0x4bb3d7
cmp eax, ebx
mov dword [esp + 0x48], 1
je 0x4bb427
lea edx, [esp + 0x1c]
push ebx
push edx
push eax
push ebp
push esi
mov dword [esp + 0x30], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4bb409
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
cmp eax, ecx
jb 0x4bb410
cmp dword [esp + 0x48], ebx
je 0x4bb396
jmp 0x4bb427
push 0x53e
jmp 0x4bb415
push 0x54d
jmp 0x4bb415
push 0x553
push 4
call fcn.004b8630
add esp, 8
mov dword [esp + 0x10], 1
push ebp
call fcn.008325dd
mov eax, dword [esp + 0x7a4]
add esp, 4
cmp eax, ebx
je 0x4bb539
mov eax, dword [esp + 0x7ac]
cmp eax, ebx
je 0x4bb456
cmp dword [eax], ebx
je 0x4bb456
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x40], ecx
mov edx, dword [esp + 0x7b4]
mov eax, dword [esp + 0x7b0]
push ebx
push edx
mov edx, dword [esp + 0x40]
lea ecx, [esp + 0x48]
push eax
mov eax, dword [esp + 0x7b4]
push ecx
mov ecx, dword [esp + 0x64]
push edx
mov edx, dword [esp + 0x50]
push eax
push ecx
lea eax, [esp + 0x9c]
push edx
lea ecx, [esp + 0x44]
push eax
push ecx
push esi
call fcn.004b67b0
add esp, 0x2c
test eax, eax
jne 0x4bb539
push 0x569
push 4
call fcn.004b8630
add esp, 8
lea ecx, [esp + 0x38]
mov byte [esp + 0x78c], 8
call fcn.00617ec0
lea ecx, [esp + 0x3c]
mov byte [esp + 0x78c], 7
call fcn.00617ec0
lea ecx, [esp + 0x80]
mov byte [esp + 0x78c], 6
call fcn.0061ebe0
mov dword [esp + 0x24], 0x893fcc
mov eax, dword [esp + 0x28]
mov byte [esp + 0x78c], 0x15
cmp eax, ebx
je 0x4bb507
push eax
call fcn.008325dd
add esp, 4
mov edx, dword [esp + 0x44]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call edi
cmp esi, 0xffffffff
je 0x4bb51c
push esi
call edi
lea ecx, [esp + 0x20]
mov dword [esp + 0x78c], 0xffffffff
call fcn.00469ec0
mov eax, dword [esp + 0x50]
jmp 0x4bb68f
cmp dword [esp + 0x10], ebx
jne 0x4bb4b0
lea ecx, [esp + 0x38]
mov dword [esp + 0x50], 1
mov byte [esp + 0x78c], 8
call fcn.00617ec0
lea ecx, [esp + 0x3c]
mov byte [esp + 0x78c], 7
call fcn.00617ec0
lea ecx, [esp + 0x80]
mov byte [esp + 0x78c], 6
call fcn.0061ebe0
mov dword [esp + 0x24], 0x893fcc
mov eax, dword [esp + 0x28]
mov byte [esp + 0x78c], 0x16
cmp eax, ebx
je 0x4bb507
jmp 0x4bb4fe
push 0x4bd
push 4
call fcn.004b8630
add esp, 8
jmp 0x4bb507
push 0x4ca
push 3
call fcn.004b8630
add esp, 8
jmp 0x4bb61c
push 0x4d2
push 4
call fcn.004b8630
add esp, 8
lea ecx, [esp + 0x10]
mov byte [esp + 0x78c], 4
call fcn.00636c90
lea ecx, [esp + 0x14]
mov byte [esp + 0x78c], bl
call fcn.00636c90
jmp 0x4bb507
push 0x4db
push 0x1c
call fcn.004b8630
add esp, 8
lea ecx, [esp + 0x10]
mov byte [esp + 0x78c], 4
call fcn.00636c90
lea ecx, [esp + 0x14]
mov byte [esp + 0x78c], bl
call fcn.00636c90
jmp 0x4bb507
push 0x4e1
push 0x1c
call fcn.004b8630
add esp, 8
lea ecx, [esp + 0x10]
mov byte [esp + 0x78c], 4
call fcn.00636c90
lea ecx, [esp + 0x14]
mov byte [esp + 0x78c], bl
call fcn.00636c90
mov esi, dword [esp + 0x58]
jmp 0x4bb507
push 0x4ea
push 4
call fcn.004b8630
add esp, 8
jmp 0x4bb507
push 0x44c
push 1
call fcn.004b8630
add esp, 8
xor eax, eax
mov ecx, dword [esp + 0x784]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x780
ret