Function at 0x49deb0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d5e58
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x1608
call fcn.004c1320
mov eax, dword [0x4eb0b4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor ebx, ebx
cmp byte [ebp + 0x10], bl
je 0x49df08
cmp word [0x54806e], bx
je 0x49df68
cmp dword [0x56becc], ebx
je 0x49df68
xor eax, eax
mov word [0x54806e], ax
jmp 0x49df68
push 1
call fcn.0049b350
mov dword [0x54b1b4], 3
mov al, byte [ebp + 0xc]
cmp al, bl
je 0x49df25
mov byte [0x54b1ee], al
mov dword [0x533be8], ebx
mov dword [0x533bec], ebx
cmp byte [0x532b51], bl
jne 0x49e034
push ebx
push 0x551474
mov ecx, 0x53f4e8
call fcn.0044d400
cmp byte [0x540502], bl
je 0x49df68
cmp dword [0x551488], 1
jbe 0x49df68
mov dword [0x54b1b0], 4
cmp byte [0x532b51], bl
jne 0x49e034
cmp word [0x550472], bx
jne 0x49e034
mov byte [ebp + 8], bl
mov esi, 0x550472
call fcn.0049ab20
push 0x800
push 0x4d79fc
lea ecx, [ebp - 0x10b4]
push ecx
push str.DefFolder
push str.Compression
call fcn.0046c8c0
cmp word [ebp - 0x10b4], bx
jne 0x49dfd4
cmp byte [0x540502], bl
je 0x49e011
lea edx, [ebp - 0x10b4]
push edx
call fcn.00449230
cmp word [ebp - 0x10b4], bx
je 0x49e011
push 0x800
lea eax, [ebp - 0x10b4]
push eax
call fcn.004601c0
push 0x800
push 0x550472
lea ecx, [ebp - 0x10b4]
push ecx
call fcn.0047f4c0
push 0x800
lea edx, [ebp - 0x10b4]
push edx
push 0x550472
call fcn.0047f480
mov eax, dword [0x54d410]
push eax
cmp word [0x546068], bx
setne cl
movzx edx, cl
push edx
push 0x800
push 0x550472
call fcn.00497e60
cmp dword [0x54b1b0], ebx
jne 0x49e046
mov dword [0x54b1b0], 5
cmp byte [0x532b51], bl
je 0x49e14e
mov esi, dword [0x54181c]
cmp esi, ebx
je 0x49e087
cmp esi, 1
je 0x49e087
push 0x30
push 0x65
call fcn.00475570
push eax
push 0x1fd
call fcn.00475570
push eax
mov eax, dword [0x534ca4]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x49e460
push 0x800
push 0x550472
mov ecx, 0x541610
call fcn.00415320
push 0x800
push 0x54907c
mov ecx, 0x541610
call fcn.00415300
cmp word [0x54907c], bx
je 0x49e0c7
push 0x800
push 0x54907c
call fcn.004601c0
mov byte [0x54b208], bl
lea ecx, [ebp - 0x1614]
push ecx
mov ecx, 0x541610
call fcn.00415350
mov eax, dword [ebp - 0x1594]
mov dword [0x54d410], eax
cmp eax, ebx
jne 0x49e0fc
cmp byte [ebp - 0x1590], bl
mov byte [0x54b1ef], 1
jne 0x49e102
mov byte [0x54b1ef], bl
cmp esi, ebx
jne 0x49e10e
cmp dword [ebp - 0x1508], ebx
je 0x49e11a
mov edx, dword [ebp - 0x14cc]
mov dword [0x54b1a0], edx
xor eax, eax
cmp dword [ebp - 0x14ec], ebx
je 0x49e148
jmp 0x49e130
movzx ecx, word [eax + 0x4d7800]
mov word [eax + 0x546068], cx
add eax, 2
cmp cx, bx
jne 0x49e130
jmp 0x49e14e
mov word [0x546068], ax
mov ecx, dword [0x534ca4]
push ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
neg eax
sbb eax, eax
and eax, dword [0x534ca4]
push ebx
mov edx, dword [ebp + 8]
push edx
push eax
call fcn.0049dbb0
test al, al
je 0x49e441
mov eax, dword [0x56bed4]
cmp eax, 1
je 0x49e187
cmp eax, 2
jne 0x49e1dc
mov eax, dword [0x56bee0]
push eax
mov ecx, dword [0x56bedc]
push ecx
mov edx, dword [0x56bed8]
push edx
push str._dd_dh_dm
lea eax, [ebp - 0xb4]
push eax
mov edx, 0x50
call fcn.0041cb70
add esp, 0x14
cmp dword [0x56bed4], 1
jne 0x49e1cb
lea ecx, [ebp - 0xb4]
push ecx
mov ecx, 0x54b310
jmp 0x49e1d7
lea edx, [ebp - 0xb4]
push edx
mov ecx, 0x54b318
call fcn.00482b90
mov eax, dword [0x56becc]
cmp eax, ebx
je 0x49e1ed
push eax
call fcn.00495bb0
jmp 0x49e20f
cmp byte [0x532b51], bl
je 0x49e20f
cmp dword [ebp - 0x14ec], ebx
je 0x49e20f
cmp word [0x546068], 0x2a
jne 0x49e20f
xor eax, eax
mov word [0x546068], ax
cmp dword [0x551488], ebx
jne 0x49e23e
push 0x30
push 0x65
call fcn.00475570
push eax
push 0x14b
call fcn.00475570
push eax
mov ecx, dword [0x534ca4]
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x49e441
cmp word [0x54806e], bx
je 0x49e2b5
cmp dword [0x549070], ebx
jne 0x49e2b5
push 0x4d9470
push 0x54806e
call fcn.0043caf0
mov esi, eax
cmp esi, ebx
je 0x49e2b5
push esi
push 0x400
push 1
lea edx, [ebp - 0x14b4]
push edx
call fcn.004c4965
add esp, 0x10
mov dword [ebp - 0x1618], 0x30c
cmp eax, ebx
jbe 0x49e2ac
lea ecx, [ebp - 0x1618]
push ecx
push eax
lea edx, [ebp - 0x14b4]
push edx
call dword [sym.imp.ADVAPI32.dll_IsTextUnicode]
test eax, eax
je 0x49e2ac
mov dword [0x549070], 3
push esi
call fcn.004c3d02
add esp, 4
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x70]
call fcn.0047fbd0
mov byte [ebp - 4], 1
mov ecx, 0x551474
call fcn.0047f9c0
mov edi, edi
mov ecx, 0x551474
call fcn.0047fd20
cmp eax, ebx
je 0x49e306
push 0x800
lea ecx, [ebp - 0x10b4]
push ecx
push eax
mov ecx, 0x53f4e8
call fcn.0044bff0
lea edx, [ebp - 0x10b4]
push edx
lea ecx, [ebp - 0x70]
call fcn.0047fa40
jmp 0x49e2d0
lea eax, [ebp - 0x70]
push eax
mov ecx, 0x551474
call fcn.0042de40
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x70]
call fcn.00401b10
mov dword [ebp - 4], 0xffffffff
jmp 0x49e341
cmp byte [0x54f41d], bl
jne 0x49e362
push 0x800
push 0x550472
push 0x550472
mov ecx, 0x53f4e8
call fcn.0044bff0
mov cl, byte [0x54a17c]
mov byte [0x534cd4], cl
mov ecx, 0x534ca8
call fcn.0047ee50
cmp byte [0x54f434], bl
je 0x49e387
call fcn.0049bfd0
jmp 0x49e399
movzx edx, byte [0x54f41b]
push edx
mov ecx, 0x541610
call fcn.00419910
cmp dword [0x56becc], ebx
je 0x49e3ab
push 0x54806e
call fcn.0043c760
cmp dword [0x533b6c], 1
je 0x49e441
cmp byte [0x532b51], bl
je 0x49e3cc
mov ecx, 0x53f4e8
call fcn.00451660
jmp 0x49e441
cmp byte [0x54b1ee], bl
je 0x49e3de
mov ecx, 0x53f4c8
call fcn.00485a50
push 0x800
lea eax, [ebp - 0x10b4]
push eax
mov ecx, 0x53f4e8
call fcn.0044bfc0
lea eax, [ebp - 0x10b4]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x49e400
sub eax, edx
sar eax, 1
push eax
push 0x550472
lea ecx, [ebp - 0x10b4]
push ecx
call fcn.00486ff0
test eax, eax
jne 0x49e431
push 0x550472
call fcn.00460620
jmp 0x49e436
mov eax, 0x4d79fc
push eax
mov ecx, 0x53f4e8
call fcn.0044f9e0
mov edx, dword [0x56becc]
push edx
call fcn.004c1dca
add esp, 4
mov byte [0x534cd4], bl
mov ecx, 0x534ca8
call fcn.0047ee50
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004c1302
mov esp, ebp
pop ebp
ret 0xc