Function at 0x4892e0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x9a8
mov eax, dword [0x4d8620]
xor eax, esp
mov dword [esp + 0x9a4], eax
push ebx
xor ebx, ebx
push esi
push edi
cmp byte [esp + 0x9c0], bl
je 0x48931d
cmp word [0x531efa], bx
je 0x489387
cmp dword [0x5629dc], ebx
je 0x489387
xor eax, eax
mov word [0x531efa], ax
jmp 0x489387
push 1
call fcn.00486900
mov al, byte [esp + 0x9bc]
mov dword [0x533838], 3
cmp al, bl
je 0x48933e
mov byte [0x533872], al
mov dword [0x527620], ebx
mov dword [0x527624], ebx
cmp byte [0x526d89], bl
jne 0x48949a
mov ecx, dword [0x536aac]
push 1
push ecx
mov ecx, 0x52d6c0
call fcn.00444810
cmp byte [0x52deda], bl
je 0x489387
mov edx, dword [0x536aac]
cmp dword [edx + 0x20], 1
jbe 0x489387
mov dword [0x533834], 4
cmp byte [0x526d89], bl
jne 0x48949a
cmp word [0x5362aa], bx
jne 0x48949a
mov esi, 0x5362aa
mov byte [esp + 0x9b8], bl
call fcn.00483dd0
push 0x400
push 0x4c5d70
lea eax, [esp + 0x1b8]
push eax
push str.DefFolder
push str.Compression
call fcn.0045fba0
cmp word [esp + 0x1b0], bx
jne 0x489404
cmp byte [0x52deda], bl
je 0x489477
push 0x400
lea ecx, [esp + 0x1b4]
push ecx
call fcn.0048af80
cmp word [esp + 0x1b0], bx
je 0x489477
lea edx, [esp + 0x1b0]
push edx
call fcn.004554c0
mov eax, 0x5362aa
mov edx, eax
jmp 0x489420
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x489420
lea edi, [esp + 0x1b0]
sub eax, edx
add edi, 0xfffffffe
jmp 0x489440
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x489440
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor eax, eax
mov edi, edi
movzx ecx, word [esp + eax + 0x1b0]
mov word [eax + 0x5362aa], cx
add eax, 2
cmp cx, bx
jne 0x489460
cmp word [0x5306f8], bx
mov eax, dword [0x53423c]
setne cl
push eax
movzx edx, cl
push edx
push 0x400
push 0x5362aa
call fcn.00483f70
cmp dword [0x533834], ebx
jne 0x4894ac
mov dword [0x533834], 5
cmp byte [0x526d89], bl
je 0x489591
mov esi, dword [0x52e1f4]
cmp esi, ebx
je 0x4894ed
cmp esi, 1
je 0x4894ed
push 0x30
push 0x65
call fcn.00465ec0
push eax
push 0x1fd
call fcn.00465ec0
push eax
mov eax, dword [0x527edc]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x4897fa
push 0x400
push 0x5362aa
mov ecx, 0x52dfe8
call fcn.00412e90
push 0x400
push 0x532b04
mov ecx, 0x52dfe8
call fcn.00412e70
cmp word [0x532b04], bx
je 0x489528
push 0x532b04
call fcn.004554c0
lea ecx, [esp + 0x10]
push ecx
mov ecx, 0x52dfe8
mov byte [0x533876], bl
call fcn.00412ec0
mov edx, dword [esp + 0x90]
mov dword [0x53423c], edx
cmp esi, ebx
jne 0x489557
cmp dword [esp + 0x118], ebx
je 0x489563
mov eax, dword [esp + 0x144]
mov dword [0x533824], eax
cmp dword [esp + 0x130], ebx
je 0x489588
xor eax, eax
mov edi, edi
movzx ecx, word [eax + 0x4c5f34]
mov word [eax + 0x5306f8], cx
add eax, 2
cmp cx, bx
jne 0x489570
jmp 0x489591
xor ecx, ecx
mov word [0x5306f8], cx
mov edx, dword [0x527edc]
push edx
call dword [sym.imp.USER32.dll_IsWindowVisible]
mov ecx, dword [esp + 0x9b8]
neg eax
sbb eax, eax
and eax, dword [0x527edc]
push ebx
push ecx
push eax
call fcn.00488ff0
test al, al
je 0x4897db
mov eax, dword [0x5629e4]
mov edi, 1
cmp eax, edi
je 0x4895d2
cmp eax, 2
jne 0x489624
mov edx, dword [0x5629f0]
mov eax, dword [0x5629ec]
mov ecx, dword [0x5629e8]
push edx
push eax
push ecx
lea edx, [esp + 0x16c]
push str._dd_dh_dm
push edx
call fcn.004aedca
add esp, 0x14
cmp dword [0x5629e4], edi
jne 0x489612
lea eax, [esp + 0x160]
push eax
mov ecx, 0x5338fc
jmp 0x48961f
lea ecx, [esp + 0x160]
push ecx
mov ecx, 0x533920
call fcn.00472680
mov eax, dword [0x5629dc]
cmp eax, ebx
je 0x489635
push eax
call fcn.00481760
jmp 0x489659
cmp byte [0x526d89], bl
je 0x489659
cmp dword [esp + 0x130], ebx
je 0x489659
cmp word [0x5306f8], 0x2a
jne 0x489659
xor edx, edx
mov word [0x5306f8], dx
mov eax, dword [0x536aac]
cmp dword [eax + 0x20], ebx
jne 0x48968a
push 0x30
push 0x65
call fcn.00465ec0
push eax
push 0x14b
call fcn.00465ec0
mov ecx, dword [0x527edc]
push eax
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x4897db
cmp word [0x531efa], bx
je 0x4896ff
cmp dword [0x5326fc], ebx
jne 0x4896ff
push ebx
push 0x4c79e8
push 0x531efa
call fcn.00432bd0
mov esi, eax
cmp esi, ebx
je 0x4896ff
push esi
push 0x400
lea edx, [esp + 0x1b8]
push edi
push edx
call fcn.004b1faa
add esp, 0x10
mov dword [esp + 0xc], 0x30c
cmp eax, ebx
jbe 0x4896f6
lea ecx, [esp + 0xc]
push ecx
push eax
lea edx, [esp + 0x1b8]
push edx
call dword [sym.imp.ADVAPI32.dll_IsTextUnicode]
test eax, eax
je 0x4896f6
mov dword [0x5326fc], 3
push esi
call fcn.004b203e
add esp, 4
cmp word [0x533304], bx
mov ecx, 0x527ee0
setne al
mov byte [0x527f0c], al
call fcn.0046ee90
cmp byte [0x5629f6], bl
je 0x489727
call fcn.00487620
jmp 0x489739
movzx ecx, byte [0x535243]
push ecx
mov ecx, 0x52dfe8
call fcn.00417650
cmp dword [0x5629dc], ebx
je 0x48974b
push 0x531efa
call fcn.00432710
cmp dword [0x5275a4], edi
je 0x4897db
cmp byte [0x526d89], bl
je 0x48976b
mov ecx, 0x52d6c0
call fcn.00448b20
jmp 0x4897db
cmp byte [0x533872], bl
je 0x48977d
mov ecx, 0x52d698
call fcn.004755e0
push 0x400
lea edx, [esp + 0x1b4]
push edx
call fcn.0048af80
lea eax, [esp + 0x1b0]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4897a0
sub eax, edx
sar eax, 1
push eax
push 0x5362aa
lea eax, [esp + 0x1b8]
push eax
call fcn.00477db0
push 0x5362aa
test eax, eax
jne 0x4897d1
call fcn.00455b40
push eax
mov ecx, 0x52d6c0
call fcn.00447100
mov ecx, dword [0x5629dc]
push ecx
call fcn.004afa05
add esp, 4
mov ecx, 0x527ee0
mov byte [0x527f0c], bl
call fcn.0046ee90
mov ecx, dword [esp + 0x9b0]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004aedbb
add esp, 0x9a8
ret 0xc