Function at 0x4ad112d2
Capabilities:
Check if file exists
Copy file
Delete file
Get file attributes
Get file size
Read file on windows
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa90
mov eax, dword [0x4ad240ac]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push 0x204
xor edi, edi
lea eax, [ebp - 0x410]
push edi
push eax
mov dword [ebp - 0xa48], ebx
mov dword [ebp - 0x414], 0x20
call sub.msvcrt.dll_memset
mov eax, dword [ebx + 0x20]
or dword [ebp - 0xa30], 0xffffffff
add esp, 0xc
mov dword [ebp - 0xa50], edi
mov dword [ebp - 0xa70], edi
mov dword [ebp - 0xa44], edi
mov dword [ebp - 0xa78], 1
cmp eax, edi
je 0x4ad18b89
mov eax, dword [eax + 0x1c]
shr eax, 1
and eax, 8
push edi
mov dword [ebp - 0xa64], eax
lea eax, [ebp - 0xa68]
push eax
mov ebx, 0x80
push ebx
push 0xfe00
mov dword [ebp - 0xa6c], edi
mov dword [ebp - 0xa58], edi
call fcn.4ad10feb
mov dword [ebp - 0xa40], eax
cmp eax, edi
je 0x4ad18b91
cmp dword [0x4ad2415c], edi
jne 0x4ad18b99
mov ebx, dword [esi + 0x20]
cmp ebx, edi
jne 0x4ad113bc
cmp dword [0x4ad24168], 3
je 0x4ad194b2
mov eax, dword [ebp - 0xa50]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.4ad013a9
leave
ret 8
lea eax, [ebp - 0xa3c]
push eax
push dword [ebx + 0x18]
push 0x21
push dword [ebx]
call fcn.4ad02598
push eax
call fcn.4ad03117
test al, al
je 0x4ad18bbe
cmp dword [0x4ad241b4], edi
jne 0x4ad194d7
mov esi, 0x104
push esi
lea eax, [ebp - 0xa2c]
push eax
push ebx
call fcn.4ad1113b
cmp eax, 1
je 0x4ad1950c
cmp dword [0x4ad241e8], edi
je 0x4ad123ca
test byte [ebx + 0x1c], 8
jne 0x4ad123dc
cmp dword [0x4ad24168], 3
je 0x4ad123dc
push edi
push esi
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0xa48]
push ebx
call fcn.4ad11ca5
cmp eax, 1
je 0x4ad1950c
cmp dword [0x4ad24168], 3
je 0x4ad18c1e
cmp word [ebp - 0x20c], di
je 0x4ad117f3
push edi
push dword [ebx + 4]
call fcn.4ad11f66
mov dword [ebp - 0xa38], eax
cmp eax, 0xffffffff
je 0x4ad18c37
push eax
call fcn.4ad03b03
test eax, eax
jne 0x4ad18c76
cmp dword [0x4ad2415c], edi
jne 0x4ad18c9d
mov eax, dword [ebp - 0xa68]
mov dword [ebp - 0xa4c], eax
mov eax, dword [ebp - 0xa4c]
mov dword [ebp - 0xa7c], eax
mov eax, dword [ebx + 0x1c]
test al, 4
je 0x4ad123fd
and eax, 0xfffffffb
mov dword [ebx + 0x1c], eax
test al, al
js 0x4ad18cbc
or eax, 1
mov dword [ebx + 0x1c], eax
cmp byte [0x4ad24081], 0
je 0x4ad18cc4
push dword [ebx + 4]
lea eax, [ebp - 0x824]
push 0x208
push eax
call fcn.4ad02faf
mov esi, eax
lea eax, [ebp - 0x20c]
push eax
call fcn.4ad02598
push eax
push dword [ebp - 0xa30]
lea eax, [ebp - 0xa34]
push ebx
push eax
push 0x200
push dword [ebp - 0xa40]
push dword [ebp - 0xa38]
call fcn.4ad110a5
mov dword [ebp - 0xa54], eax
cmp dword [0x4ad24128], edi
jne 0x4ad18cf3
cmp dword [0x4ad24168], 3
je 0x4ad18d17
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x824]
push eax
push esi
call fcn.4ad11823
test eax, eax
jne 0x4ad18d28
mov eax, dword [ebp - 0xa48]
mov dword [0x4ad240e8], 1
cmp dword [eax + 0x20], edi
je 0x4ad115a6
cmp dword [0x4ad241e8], edi
je 0x4ad115a6
mov dword [0x4ad240ec], 1
mov dword [0x4ad24128], edi
push dword [eax + 0x20]
call fcn.4ad0944c
mov eax, dword [0x4ad24128]
cmp eax, 0x15
je 0x4ad121e3
cmp eax, 0x458
je 0x4ad121e3
push 1
push 0x104
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0xa48]
push ebx
call fcn.4ad11ca5
cmp eax, 1
je 0x4ad19501
cmp word [ebp - 0x20c], di
je 0x4ad18db4
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x824]
push eax
push esi
call fcn.4ad11823
test eax, eax
jne 0x4ad18dc4
lea eax, [ebp - 0x20c]
xor esi, esi
push eax
inc esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [ebp - 0xa44], edi
jne 0x4ad11647
cmp dword [ebp - 0xa78], edi
je 0x4ad11627
mov dword [ebp - 0xa58], edi
cmp eax, 0xffffffff
jne 0x4ad121a6
mov dword [ebp - 0xa78], edi
and dword [ebx + 0x1c], 0xfffffffb
cmp byte [0x4ad24081], 0
mov ecx, dword [ebx + 0x1c]
je 0x4ad18e34
cmp dword [ebp - 0xa58], edi
jne 0x4ad18e78
cmp dword [0x4ad241e8], edi
je 0x4ad11673
mov ecx, dword [ebp - 0xa48]
mov ecx, dword [ecx + 0x20]
cmp ecx, edi
je 0x4ad11666
test byte [ecx + 0x1c], 8
jne 0x4ad122b4
cmp dword [0x4ad24168], 3
je 0x4ad18e8f
test al, 6
je 0x4ad12224
or dword [ebp - 0xa30], 0xffffffff
mov dword [0x4ad24128], 5
cmp dword [ebp - 0xa30], 0xffffffff
mov dword [ebp - 0xa60], edi
jne 0x4ad121ef
mov dword [ebp - 0xa74], edi
xor esi, esi
inc esi
cmp dword [ebp - 0xa70], esi
je 0x4ad18ecd
mov eax, dword [ebx + 0x1c]
test al, 8
jne 0x4ad116c8
cmp dword [0x4ad24168], 3
je 0x4ad18efc
mov eax, dword [ebx + 0x1c]
test al, 8
jne 0x4ad12408
push dword [ebx + 0x1c]
lea eax, [ebp - 0xa34]
push eax
push dword [ebp - 0xa40]
call fcn.4ad11079
cmp dword [0x4ad24168], 3
je 0x4ad121d1
mov eax, dword [ebx + 0x1c]
test al, 1
je 0x4ad121d1
and eax, 0x800
cmp dword [ebp - 0xa30], 0xffffffff
mov edi, eax
jne 0x4ad1220d
test dword [ebx + 0x1c], 0x400
jne 0x4ad18f3c
mov eax, dword [0x4ad241ec]
test eax, eax
je 0x4ad18f84
mov ecx, edi
or ecx, dword [ebp - 0xa64]
push ecx
push 0x4ad241b4
push 0
push 0
lea ecx, [ebp - 0x20c]
push ecx
push dword [ebx + 4]
call eax
test eax, eax
je 0x4ad18f9f
cmp dword [ebp - 0xa60], 0
jne 0x4ad1178d
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4ad11780
and eax, 0xfffffffe
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp dword [0x4ad2415c], 0
jne 0x4ad19036
push dword [ebp - 0xa38]
xor edi, edi
mov dword [0x4ad24120], edi
mov eax, dword [ebx + 0x18]
mov ecx, dword [eax + 0x14]
mov dword [ebp - 0xa90], ecx
mov eax, dword [eax + 0x18]
mov dword [ebp - 0xa8c], eax
call fcn.4ad03ab3
cmp dword [0x4ad24168], 3
je 0x4ad117ed
cmp dword [0x4ad241b4], edi
jne 0x4ad1948b
lea eax, [ebp - 0xa90]
push eax
push dword [ebp - 0xa30]
push dword [ebp - 0xa48]
push ebx
call fcn.4ad11be3
mov dword [0x4ad241f0], 1
mov dword [0x4ad241e8], edi
push dword [ebp - 0xa3c]
push 0x21
push dword [ebx + 0x18]
call fcn.4ad095f8
test al, al
jne 0x4ad113dd
push dword [ebp - 0xa3c]
call fcn.4ad02f5c
mov ebx, dword [ebx + 0x20]
jmp 0x4ad11394
test al, 0x10
je 0x4ad11621
jmp 0x4ad18e29
test eax, eax
je 0x4ad11411
jmp 0x4ad117f3
cmp dword [0x4ad241e8], edi
jne 0x4ad11428
jmp 0x4ad11460
cmp dword [ebp - 0xa30], 0xffffffff
jne 0x4ad1924b
jmp 0x4ad192af
push edi
push eax
call fcn.4ad099e1
jmp 0x4ad194ff
push dword [ebp - 0xa30]
mov dword [ebp - 0xa74], esi
call fcn.4ad03b03
test eax, eax
je 0x4ad116a5
jmp 0x4ad18eaa
push dword [ebp - 0xa30]
call fcn.4ad03ab3
or dword [ebp - 0xa30], 0xffffffff
jmp 0x4ad11714
test dword [ebx + 0x1c], 0x400
jne 0x4ad1168c
lea eax, [ebp - 0x20c]
push eax
call fcn.4ad1224d
mov dword [ebp - 0xa30], eax
jmp 0x4ad1168c
cmp dword [ebx + 0x20], edi
jne 0x4ad11666
mov dword [0x4ad24168], esi
jmp 0x4ad11666
cmp dword [0x4ad24168], 3
jne 0x4ad11411
jmp 0x4ad18c0a
push dword [ebx + 4]
push str._s_r_n
call fcn.4ad058f3
cmp dword [0x4ad24168], 3
pop ecx
pop ecx
jne 0x4ad11428
jmp 0x4ad121c0
mov dword [ebp - 0xa44], eax
jmp 0x4ad114d6
cmp dword [0x4ad24168], 3
jne 0x4ad116d3
jmp 0x4ad18f16
mov eax, dword [ebx + 0x1c]
jmp 0x4ad11348
xor eax, eax
inc eax
jmp 0x4ad113ab
push 1
lea eax, [ebp - 0xa7c]
push eax
push ebx
push dword [ebp - 0xa68]
call fcn.4ad10feb
mov dword [ebp - 0xa5c], eax
cmp eax, edi
jne 0x4ad11391
jmp 0x4ad18b91
cmp dword [0x4ad24168], 3
jne 0x4ad18bd3
cmp dword [0x4ad241e8], edi
je 0x4ad11816
push dword [ebx]
push 0x4ad245b0
call fcn.4ad058f3
push 0x4ad245a8
call fcn.4ad058f3
add esp, 0xc
push dword [0x4ad24128]
call fcn.4ad1056b
push dword [ebp - 0xa3c]
call fcn.4ad02f5c
push 1
push edi
call fcn.4ad1f2d7
push dword [ebx + 4]
lea eax, [ebp - 0x414]
push eax
call fcn.4ad1f25d
jmp 0x4ad121b3
lea eax, [ebp - 0x20c]
push eax
push esi
lea eax, [ebp - 0x414]
push eax
call fcn.4ad0185a
jmp 0x4ad11453
push dword [0x4ad24128]
call fcn.4ad1056b
cmp dword [0x4ad24168], 3
jne 0x4ad18c67
cmp dword [ebp - 0xa30], 0xffffffff
jne 0x4ad18c67
push dword [ebx + 4]
lea eax, [ebp - 0x20c]
push eax
call fcn.4ad1f25d
test eax, eax
jne 0x4ad18bf7
mov dword [ebp - 0xa50], 1
jmp 0x4ad117f3
mov eax, 0x80
or dword [ebx + 0x1c], eax
mov dword [ebp - 0xa4c], eax
mov eax, dword [ebx + 0x1c]
test al, 1
je 0x4ad114aa
and eax, 0xfffffffe
or eax, 4
mov dword [ebx + 0x1c], eax
jmp 0x4ad114aa
mov ecx, dword [ebp - 0xa68]
mov eax, dword [ebp - 0xa7c]
cmp ecx, eax
jae 0x4ad11498
mov dword [ebp - 0xa4c], ecx
jmp 0x4ad1149e
or eax, 2
jmp 0x4ad114c6
cmp dword [0x4ad241e8], edi
je 0x4ad114d6
test al, 8
jne 0x4ad114d6
cmp dword [0x4ad24168], 3
jne 0x4ad114d6
and eax, 0xfffffffe
or eax, 2
mov dword [ebx + 0x1c], eax
jmp 0x4ad114d6
push dword [ebp - 0xa38]
call fcn.4ad03ab3
push 0x6e
call fcn.4ad1056b
cmp dword [0x4ad24168], 3
jne 0x4ad18c67
jmp 0x4ad18bf7
cmp dword [0x4ad241e8], edi
jne 0x4ad1153c
jmp 0x4ad116a5
test byte [ebx + 0x1c], 0x80
jne 0x4ad11558
push dword [ebp - 0xa38]
call fcn.4ad03ab3
push dword [ebp - 0xa3c]
lea eax, [ebp - 0xa30]
push dword [ebp - 0xa4c]
push dword [ebp - 0xa40]
push dword [0x4ad241e8]
push eax
push ebx
call fcn.4ad1f55a
cmp dword [0x4ad241e8], edi
je 0x4ad18d9a
cmp dword [0x4ad24168], 3
jne 0x4ad18d90
and dword [ebx + 0x1c], 0xfffffffe
mov eax, dword [ebx + 0x1c]
cmp dword [ebp - 0xa44], edi
jne 0x4ad18d87
or eax, 2
jmp 0x4ad18d8d
or eax, dword [ebp - 0xa44]
mov dword [ebx + 0x1c], eax
mov dword [ebp - 0xa70], 1
push dword [ebx + 0x1c]
lea eax, [ebp - 0xa34]
push eax
push dword [ebp - 0xa40]
call fcn.4ad11079
jmp 0x4ad117ed
push dword [ebp - 0xa38]
call fcn.4ad03ab3
jmp 0x4ad117f3
test byte [ebx + 0x1c], 0x80
jne 0x4ad115f2
push dword [ebp - 0xa38]
call fcn.4ad03ab3
mov eax, dword [0x4ad241e8]
cmp eax, edi
je 0x4ad18e04
mov ecx, dword [ebp - 0xa48]
mov ecx, dword [ecx + 0x20]
cmp ecx, edi
je 0x4ad18e04
test byte [ecx + 0x1c], 8
je 0x4ad18e04
cmp dword [ebx + 0x20], edi
jne 0x4ad18e04
mov dword [0x4ad24168], 1
push dword [ebp - 0xa3c]
push dword [ebp - 0xa4c]
push dword [ebp - 0xa40]
push eax
lea eax, [ebp - 0xa30]
push eax
push ebx
call fcn.4ad1f55a
jmp 0x4ad115f2
mov dword [ebp - 0xa58], esi
jmp 0x4ad11621
test cl, 8
je 0x4ad1163b
cmp dword [0x4ad24168], 3
jne 0x4ad1163b
mov dword [ebp - 0xa6c], 3
cmp dword [ebp - 0xa58], edi
jne 0x4ad11647
mov edx, dword [ebp - 0xa48]
mov edx, dword [edx + 0x20]
cmp edx, edi
je 0x4ad18e73
test byte [edx + 0x1c], 8
jne 0x4ad18e85
or ecx, 2
jmp 0x4ad18e87
cmp dword [ebp - 0xa6c], 3
jne 0x4ad11647
or ecx, esi
mov dword [ebx + 0x1c], ecx
jmp 0x4ad11647
mov ecx, dword [ebp - 0xa44]
cmp ecx, edi
jne 0x4ad18ea2
mov ecx, dword [ebx + 0x1c]
and ecx, 0xfffffffe
or ecx, 2
mov dword [ebx + 0x1c], ecx
jmp 0x4ad11673
mov dword [ebp - 0xa60], esi
cmp dword [ebp - 0xa44], edi
jne 0x4ad116a5
mov eax, dword [ebx + 0x1c]
and eax, 0xfffffffe
or eax, 2
mov dword [ebx + 0x1c], eax
jmp 0x4ad116a5
cmp dword [0x4ad24168], 3
jne 0x4ad116b4
and dword [ebx + 0x1c], 0xfffffffe
mov eax, dword [ebx + 0x1c]
cmp dword [ebp - 0xa44], edi
jne 0x4ad18eee
or eax, 2
jmp 0x4ad18ef4
or eax, dword [ebp - 0xa44]
mov dword [ebx + 0x1c], eax
jmp 0x4ad116b4
cmp dword [ebp - 0xa44], edi
jne 0x4ad116c8
and eax, 0xfffffffe
or eax, 2
mov dword [ebx + 0x1c], eax
jmp 0x4ad116c8
cmp dword [ebp - 0xa58], edi
jne 0x4ad116d3
cmp dword [ebp - 0xa44], edi
jne 0x4ad116d3
and eax, 0xfffffffe
or eax, 2
mov dword [ebx + 0x1c], eax
jmp 0x4ad116d3
push dword [ebx + 4]
call fcn.4ad20103
test eax, eax
jne 0x4ad18f58
lea eax, [ebp - 0x20c]
push eax
call fcn.4ad20103
test eax, eax
je 0x4ad18f5b
xor eax, eax
inc eax
mov ecx, edi
or ecx, dword [ebp - 0xa64]
or ecx, 2
push ecx
push 0
push eax
push 0x4ad1f1b6
lea eax, [ebp - 0x20c]
push eax
push dword [ebx + 4]
call dword [0x4ad241ec]
jmp 0x4ad1174c
push dword [ebp - 0xa64]
lea eax, [ebp - 0x20c]
push eax
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
jmp 0x4ad1174c
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x4ad24128], eax
cmp eax, 1
jne 0x4ad18fca
test edi, edi
je 0x4ad18fca
mov eax, dword [ebx + 0x18]
test dword [eax], 0x400
je 0x4ad18fca
mov dword [0x4ad24128], 0x40002730
push dword [ebp - 0xa38]
call fcn.4ad03ab3
xor edi, edi
cmp dword [ebp - 0xa60], edi
je 0x4ad18fe2
push 0x1d
pop esi
mov dword [0x4ad24120], edi
cmp dword [0x4ad24128], edi
jne 0x4ad18ffa
mov dword [0x4ad24128], 0x70
cmp dword [0x4ad241b4], edi
je 0x4ad19006
xor esi, esi
jmp 0x4ad19015
cmp esi, edi
jne 0x4ad19015
push dword [0x4ad24128]
call fcn.4ad1056b
cmp dword [ebp - 0xa74], edi
jne 0x4ad1951c
xor eax, eax
inc eax
mov dword [ebp - 0xa50], eax
mov dword [0x4ad241f0], eax
xor edi, edi
jmp 0x4ad117f3
push 0
push 1
lea eax, [ebp - 0x20c]
push eax
call fcn.4ad1fdfd
mov esi, eax
or edi, 0xffffffff
mov dword [ebp - 0xa30], esi
cmp esi, edi
jne 0x4ad19070
lea eax, [ebp - 0x20c]
push eax
push 1
push 0x4000271f
call fcn.4ad06d44
add esp, 0xc
jmp 0x4ad1178d
push esi
call fcn.4ad03b03
push esi
test eax, eax
je 0x4ad1908b
call fcn.4ad03ab3
mov dword [ebp - 0xa30], edi
jmp 0x4ad1178d
call dword [sym.imp.msvcrt.dll__get_osfhandle]
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
test eax, eax
jne 0x4ad190b6
lea eax, [ebp - 0x20c]
push eax
push 1
push 0x4000271f
call fcn.4ad06d44
add esp, 0xc
push esi
jmp 0x4ad1907b
push esi
call fcn.4ad03ab3
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.4ad11f66
mov esi, eax
mov dword [ebp - 0xa30], esi
cmp esi, edi
je 0x4ad19055
push esi
call fcn.4ad03b03
test eax, eax
jne 0x4ad1909d
mov edi, dword [sym.imp.msvcrt.dll__get_osfhandle]
push eax
push eax
push eax
push dword [ebp - 0xa38]
call edi
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
pop ecx
push eax
call esi
xor eax, eax
push eax
push eax
push eax
push dword [ebp - 0xa30]
call edi
pop ecx
push eax
call esi
lea eax, [ebp - 0xa88]
push eax
push dword [ebp - 0xa38]
call edi
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
lea eax, [ebp - 0xa84]
push eax
push dword [ebp - 0xa30]
call edi
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp esi, eax
jne 0x4ad1921e
mov eax, dword [ebp - 0xa88]
cmp eax, dword [ebp - 0xa84]
jne 0x4ad1921e
and dword [ebp - 0xa54], 0
mov edi, dword [sym.imp.msvcrt.dll__get_osfhandle]
push 0
lea eax, [ebp - 0xa34]
push eax
push dword [ebp - 0xa4c]
push dword [ebp - 0xa40]
push dword [ebp - 0xa38]
call edi
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
pop ecx
push eax
call esi
test eax, eax
je 0x4ad19234
cmp dword [ebp - 0xa34], 0
je 0x4ad19234
push 0
lea eax, [ebp - 0xa80]
push eax
push dword [ebp - 0xa34]
push dword [ebp - 0xa5c]
push dword [ebp - 0xa30]
call edi
pop ecx
push eax
call esi
test eax, eax
je 0x4ad19207
mov ecx, dword [ebp - 0xa34]
cmp dword [ebp - 0xa80], ecx
jne 0x4ad19207
cmp dword [ebp - 0xa4c], ecx
je 0x4ad191e8
mov dword [ebp - 0xa54], 1
mov edi, dword [ebp - 0xa5c]
mov esi, dword [ebp - 0xa40]
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x4ad19207
cmp dword [ebp - 0xa54], eax
jne 0x4ad19234
jmp 0x4ad19161
push dword [ebp - 0xa30]
call fcn.4ad03ab3
or dword [ebp - 0xa30], 0xffffffff
jmp 0x4ad19055
lea eax, [ebp - 0x20c]
push eax
push 1
push 0x4000271f
call fcn.4ad06d44
add esp, 0xc
push dword [ebp - 0xa30]
call fcn.4ad03ab3
or dword [ebp - 0xa30], 0xffffffff
jmp 0x4ad1178d
push dword [ebp - 0xa30]
call dword [sym.imp.msvcrt.dll__get_osfhandle]
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
cmp dword [0x4ad241e8], edi
jne 0x4ad19304
cmp dword [0x4ad24168], 3
jne 0x4ad19304
mov eax, dword [ebx + 0x1c]
test al, 2
je 0x4ad19304
mov esi, 0x4000
test esi, eax
je 0x4ad19309
mov eax, dword [ebp - 0xa40]
sub dword [ebp - 0xa34], 2
push dword [ebp - 0xa34]
lea ecx, [eax + 2]
push ecx
push eax
call dword [sym.imp.msvcrt.dll_memmove]
add esp, 0xc
jmp 0x4ad19309
push edi
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.4ad1fdfd
mov dword [ebp - 0xa30], eax
cmp eax, 0xffffffff
jne 0x4ad1925f
push dword [ebp - 0xa38]
call fcn.4ad03ab3
cmp dword [0x4ad240f0], edi
jne 0x4ad192e6
push dword [0x4ad24128]
call fcn.4ad1056b
cmp dword [0x4ad24168], 3
je 0x4ad19524
mov dword [ebp - 0xa50], esi
mov dword [0x4ad241f0], esi
jmp 0x4ad117f3
mov esi, 0x4000
test dword [ebx + 0x1c], esi
je 0x4ad19323
mov ecx, dword [ebp - 0xa48]
mov eax, dword [ecx + 0x20]
cmp eax, edi
je 0x4ad19320
or dword [eax + 0x1c], esi
jmp 0x4ad19323
or dword [ecx + 0x1c], esi
cmp dword [0x4ad24120], edi
je 0x4ad1933c
cmp dword [ebp - 0xa34], edi
jg 0x4ad19415
jmp 0x4ad1178d
cmp dword [ebp - 0xa54], 1
jne 0x4ad193f0
push dword [ebp - 0xa38]
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0xa34]
push dword [ebp - 0xa40]
push dword [ebp - 0xa30]
call fcn.4ad1f619
cmp dword [0x4ad2415c], edi
je 0x4ad193b2
push dword [ebp - 0xa30]
call fcn.4ad03b03
test eax, eax
jne 0x4ad193b2
push dword [ebp - 0xa5c]
lea eax, [ebp - 0x20c]
push dword [ebp - 0xa40]
push dword [ebp - 0xa34]
push eax
lea eax, [ebp - 0xa30]
push eax
call fcn.4ad1f46a
cmp eax, 1
je 0x4ad18bf7
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0xa30]
lea eax, [ebp - 0xa34]
push ebx
push eax
push dword [ebp - 0xa4c]
push dword [ebp - 0xa40]
push dword [ebp - 0xa38]
call fcn.4ad110a5
mov dword [ebp - 0xa54], eax
cmp dword [0x4ad24120], edi
je 0x4ad1933c
cmp dword [0x4ad24120], edi
je 0x4ad1178d
cmp dword [ebp - 0xa34], edi
jle 0x4ad1178d
cmp dword [ebp - 0xa54], 1
jne 0x4ad1178d
push dword [ebp - 0xa38]
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0xa34]
push dword [ebp - 0xa40]
push dword [ebp - 0xa30]
call fcn.4ad1f619
cmp dword [0x4ad2415c], edi
je 0x4ad1178d
push dword [ebp - 0xa30]
call fcn.4ad03b03
test eax, eax
jne 0x4ad1178d
push dword [ebp - 0xa5c]
lea eax, [ebp - 0x20c]
push dword [ebp - 0xa40]
push dword [ebp - 0xa34]
push eax
lea eax, [ebp - 0xa30]
push eax
call fcn.4ad1f46a
cmp eax, 1
jne 0x4ad1178d
jmp 0x4ad18bf7
push dword [ebp - 0xa30]
call fcn.4ad03ab3
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0xa50], 1
jmp 0x4ad117e3
cmp dword [ebp - 0xa30], 0xffffffff
je 0x4ad113a5
push edi
push dword [ebp - 0xa30]
push dword [ebp - 0xa48]
push ebx
call fcn.4ad11be3
jmp 0x4ad113a5
push dword [ebp - 0xa3c]
call fcn.4ad02f5c
cmp dword [ebp - 0xa30], 0xffffffff
je 0x4ad18b91
push dword [ebp - 0xa30]
call fcn.4ad03ab3
jmp 0x4ad18b91
pop ecx
pop ecx
push dword [ebp - 0xa38]
call fcn.4ad03ab3
push dword [ebp - 0xa3c]
call fcn.4ad02f5c
jmp 0x4ad18b91
push 1
push esi
jmp 0x4ad18c05
push dword [ebp - 0xa3c]
call fcn.4ad02f5c
push esi
jmp 0x4ad18c04