Function at 0x4ae490
Capabilities:
Accept command line arguments
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x42c
mov ebx, dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileApisToOEM]
mov dword [ebp - 0x3b8], 0
mov dword [ebp - 0x3b4], 0
test ebx, ebx
mov dword [ebp - 0x3b0], 0
je 0x4aeb30
lea ecx, [ebp - 0x218]
mov dword [esp], ebx
call fcn.00473fd0
lea eax, [ebp - 0x3b8]
sub esp, 4
mov dword [ebp - 0x3e8], eax
mov dword [esp + 4], eax
lea eax, [ebp - 0x218]
mov dword [esp], eax
call fcn.004b2520
mov eax, dword [ebp - 0x218]
test eax, eax
je 0x4ae50c
mov dword [esp], eax
call fcn.006febd0
mov eax, dword [ebp - 0x3b4]
test eax, eax
jne 0x4ae5f0
mov ebx, dword [0x86b9a4]
test ebx, ebx
je 0x4ae5e5
mov eax, dword [ebx]
mov dword [esp + 8], 0x48
mov dword [esp + 4], 1
mov dword [esp], str._n7_Zip__r__17.01_beta__x86__:_Igor_Pavlov_:_Public_domain_:_2017_08_28_n_n
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [ebx]
mov dword [esp + 8], 0xa0a
mov dword [esp + 4], 1
mov dword [esp], str.Usage:_7zr__command____switches_...___archive_name____file_names_...__n_n_Commands__n__a_:_Add_files_to_archive_n__b_:_Benchmark_n__d_:_Delete_files_from_archive_n__e_:_Extract_files_from_archive__without_using_directory_names__n__h_:_Calculate_hash_values_for_files_n__i_:_Show_information_about_supported_formats_n__l_:_List_contents_of_archive_n__rn_:_Rename_files_in_archive_n__t_:_Test_integrity_of_archive_n__u_:_Update_files_to_archive_n__x_:_eXtract_files_with_full_paths_n_n_Switches__n_____:_Stop_switches_parsing_n___listfile_:_set_path_to_listfile_that_contains_file_names_n___ai_r__0___listfile_wildcard_:_Include_archives_n___ax_r__0___listfile_wildcard_:_eXclude_archives_n___aoastu_:_set_Overwrite_mode_n___an_:_disable_archive_name_field_n___bb_0_3__:_set_output_log_level_n___bd_:_disable_progress_indicator_n___bsoep012_:_set_output_stream_for_output_error_progress_line_n___bt_:_show_execution_time_statistics_n___i_r__0___listfile_wildcard_:_Include_filenames_n___mParameters_:_set_compression_Method_n_____mmt_N__:_set_number_of_CPU_threads_n_____mx_N__:_set_compression_level:__mx1__fastest__...__mx9__ultra__n___oDirectory_:_set_Output_directory_n___r__0__:_Recurse_subdirectories_n___saaes_:_set_Archive_name_mode_n___sccUTF_8WINDOS_:_set_charset_for_for_console_input_output_n___scsUTF_8UTF_16LEUTF_16BEWINDOSid_:_set_charset_for_list_files_n___scrc_CRC32CRC64SHA1SHA256__:_set_hash_function_for_x__e__h_commands_n___sdel_:_delete_files_after_compression_n___seml_.__:_send_archive_by_email_n___sfx_name__:_Create_SFX_archive_n___si_name__:_read_data_from_stdin_n___slp_:_set_Large_Pages_mode_n___slt_:_show_technical_information_for_l__List__command_n___snh_:_store_hard_links_as_links_n___snl_:_store_symbolic_links_as_links_n___sni_:_store_NT_security_information_n___sns____:_store_NTFS_alternate_streams_n___so_:_write_data_to_stdout_n___spd_:_disable_wildcard_matching_for_file_names_n___spe_:_eliminate_duplication_of_root_folder_for_extract_command_n___spf_:_use_fully_qualified_file_paths_n___ssc____:_set_sensitive_case_mode_n___ssw_:_compress_shared_files_n___stl_:_set_archive_timestamp_from_the_most_recently_modified_file_n___stmHexMask_:_set_CPU_thread_affinity_mask__hexadecimal_number__n___stxType_:_exclude_archive_type_n___tType_:_Set_type_of_archive_n___u____p__q__r__x__y__z___newArchiveName__:_Update_options_n___vSize_bkmg__:_Create_volumes_n___w_path__:_assign_Work_directory._Empty_path_means_a_temporary_directory_n___x_r__0___listfile_wildcard_:_eXclude_filenames_n___y_:_assume_Yes_on_all_queries_n
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
xor ebx, ebx
mov edi, dword [ebp - 0x3b4]
mov eax, dword [ebp - 0x3b8]
test edi, edi
je 0x4ae5cf
lea ecx, [edi*4 - 4]
mov dword [ebp - 0x3d0], ecx
nop
lea esi, [esi]
mov ecx, dword [ebp - 0x3d0]
sub edi, 1
mov esi, dword [eax + ecx]
test esi, esi
je 0x4ae5c4
mov eax, dword [esi]
test eax, eax
je 0x4ae5ae
mov dword [esp], eax
call fcn.006febd0
mov dword [esp + 4], 0xc
mov dword [esp], esi
call fcn.006fec10
mov eax, dword [ebp - 0x3b8]
sub dword [ebp - 0x3d0], 4
test edi, edi
jne 0x4ae590
test eax, eax
je 0x4ae5db
mov dword [esp], eax
call fcn.006febd0
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x3b8]
xor ebx, ebx
jmp 0x4ae5cf
mov edx, dword [ebp - 0x3b8]
mov ebx, dword [edx]
test ebx, ebx
je 0x4ae626
mov eax, dword [ebx]
test eax, eax
je 0x4ae60a
mov dword [esp], eax
call fcn.006febd0
mov dword [esp + 4], 0xc
mov dword [esp], ebx
call fcn.006fec10
mov edx, dword [ebp - 0x3b8]
mov eax, dword [ebp - 0x3b4]
lea eax, [eax*4 - 4]
mov dword [esp], edx
mov dword [esp + 8], eax
lea eax, [edx + 4]
mov dword [esp + 4], eax
call sub.msvcrt.dll_memmove
sub dword [ebp - 0x3b4], 1
je 0x4ae51a
lea ecx, [ebp - 0x1f0]
mov byte [ebp - 0x217], 0
mov byte [ebp - 0x216], 0
mov byte [ebp - 0x215], 0
mov byte [ebp - 0x211], 0
mov byte [ebp - 0x210], 0
mov dword [ebp - 0x20c], 0
mov dword [ebp - 0x208], 0
mov dword [ebp - 0x204], 0
mov dword [ebp - 0x200], 0
mov dword [ebp - 0x1fc], 0
mov dword [ebp - 0x1f8], 0
call fcn.00473f00
lea ecx, [ebp - 0x1b8]
mov dword [ebp - 0x1e0], 0
mov dword [ebp - 0x1dc], 0
mov dword [ebp - 0x1d8], 0
mov dword [ebp - 0x1d0], 0
mov dword [ebp - 0x1cc], 0
mov dword [ebp - 0x1c8], 0
mov dword [ebp - 0x1c4], 0
mov dword [ebp - 0x1c0], 0
mov dword [ebp - 0x1bc], 0
call fcn.00473f00
lea ecx, [ebp - 0x194]
mov dword [ebp - 0x1ac], 0
mov dword [ebp - 0x1a8], 0
mov dword [ebp - 0x1a4], 0
mov dword [ebp - 0x1a0], 0
mov dword [ebp - 0x19c], 0
mov dword [ebp - 0x198], 0
call fcn.00473f00
lea ecx, [ebp - 0x128]
mov byte [ebp - 0x188], 0
mov byte [ebp - 0x187], 0
mov byte [ebp - 0x185], 0
mov byte [ebp - 0x183], 0
mov byte [ebp - 0x181], 0
mov byte [ebp - 0x180], 0
mov byte [ebp - 0x17f], 0
mov byte [ebp - 0x186], 1
mov byte [ebp - 0x184], 1
mov byte [ebp - 0x182], 1
mov byte [ebp - 0x17e], 1
mov byte [ebp - 0x17c], 0
mov byte [ebp - 0x17b], 0
mov byte [ebp - 0x17a], 0
mov byte [ebp - 0x179], 0
mov byte [ebp - 0x178], 0
mov byte [ebp - 0x177], 0
mov byte [ebp - 0x176], 0
mov byte [ebp - 0x175], 0
mov byte [ebp - 0x170], 0
mov dword [ebp - 0x168], 0xffffffff
mov byte [ebp - 0x160], 0
mov byte [ebp - 0x15f], 0
mov byte [ebp - 0x15e], 0
mov byte [ebp - 0x15d], 0
mov byte [ebp - 0x15c], 0
mov byte [ebp - 0x158], 1
mov byte [ebp - 0x157], 1
mov byte [ebp - 0x156], 0
mov byte [ebp - 0x155], 0
mov byte [ebp - 0x154], 0
mov byte [ebp - 0x153], 0
mov dword [ebp - 0x150], 0
mov dword [ebp - 0x14c], 0
mov byte [ebp - 0x164], 1
mov byte [ebp - 0x163], 1
mov byte [ebp - 0x162], 1
mov byte [ebp - 0x161], 1
mov byte [ebp - 0x15a], 1
mov byte [ebp - 0x159], 1
mov byte [ebp - 0x15b], 1
mov dword [ebp - 0x148], 0
mov dword [ebp - 0x144], 0
mov dword [ebp - 0x140], 0
mov dword [ebp - 0x138], 0
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x130], 0
mov byte [ebp - 0x12c], 1
call fcn.00473f00
lea ecx, [ebp - 0x11c]
call fcn.00473f00
lea ecx, [ebp - 0x110]
call fcn.00473f00
lea ecx, [ebp - 0x104]
call fcn.00473f00
lea ecx, [ebp - 0xf8]
call fcn.00473f00
lea ecx, [ebp - 0xe8]
mov byte [ebp - 0xec], 0
call fcn.00473f00
lea ecx, [ebp - 0xdc]
call fcn.00473f00
lea ecx, [ebp - 0xc8]
mov dword [ebp - 0xd0], 0
mov byte [ebp - 0xcc], 0
call fcn.00473f00
lea ecx, [ebp - 0xb8]
mov byte [ebp - 0xbc], 0
mov byte [ebp - 0xbb], 0
call fcn.00473f00
lea ecx, [ebp - 0xa8]
mov byte [ebp - 0xac], 0
mov byte [ebp - 0xab], 0
mov byte [ebp - 0xaa], 0
call fcn.00473f00
lea ecx, [ebp - 0x9c]
call fcn.00473f00
lea ecx, [ebp - 0x8c]
mov dword [ebp - 0x90], 0
call fcn.00473f00
lea ecx, [ebp - 0x44]
mov byte [ebp - 0x80], 0
mov byte [ebp - 0x7f], 0
mov byte [ebp - 0x7e], 0
mov byte [ebp - 0x7d], 0
mov byte [ebp - 0x7c], 0
mov byte [ebp - 0x7b], 0
mov byte [ebp - 0x7a], 0
mov byte [ebp - 0x79], 0
mov byte [ebp - 0x78], 0
mov byte [ebp - 0x77], 0
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 0
mov byte [ebp - 0x4c], 0
mov byte [ebp - 0x4b], 0
mov byte [ebp - 0x4a], 0
mov dword [ebp - 0x48], 0
call fcn.00473f00
lea ecx, [ebp - 0x370]
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x28], 2
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x20], 0
call fcn.004b2860
lea eax, [ebp - 0x218]
lea ecx, [ebp - 0x370]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x3e8]
mov dword [esp], eax
call fcn.00499950
mov eax, dword [ebp - 0x2c]
sub esp, 8
cmp eax, 1
je 0x4aea93
cmp eax, 2
mov edx, 0
mov eax, 0x86b9a8
cmovne eax, edx
mov dword [0x86b9a4], eax
mov eax, dword [ebp - 0x28]
cmp eax, 2
je 0x4aeab0
cmp eax, 1
mov edx, 0
mov eax, 0x86b9b0
cmovne eax, edx
mov dword [0x86b9a0], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x3ec], 0
test eax, eax
jne 0x4aeb3d
cmp byte [ebp - 0x218], 0
je 0x4aeb60
mov ebx, dword [0x86b9a4]
test ebx, ebx
je 0x4aef14
mov eax, dword [ebx]
mov dword [esp + 8], 0x48
mov dword [esp + 4], 1
mov dword [esp], str._n7_Zip__r__17.01_beta__x86__:_Igor_Pavlov_:_Public_domain_:_2017_08_28_n_n
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov ecx, ebx
mov dword [esp], str.Usage:_7zr__command____switches_...___archive_name____file_names_...__n_n_Commands__n__a_:_Add_files_to_archive_n__b_:_Benchmark_n__d_:_Delete_files_from_archive_n__e_:_Extract_files_from_archive__without_using_directory_names__n__h_:_Calculate_hash_values_for_files_n__i_:_Show_information_about_supported_formats_n__l_:_List_contents_of_archive_n__rn_:_Rename_files_in_archive_n__t_:_Test_integrity_of_archive_n__u_:_Update_files_to_archive_n__x_:_eXtract_files_with_full_paths_n_n_Switches__n_____:_Stop_switches_parsing_n___listfile_:_set_path_to_listfile_that_contains_file_names_n___ai_r__0___listfile_wildcard_:_Include_archives_n___ax_r__0___listfile_wildcard_:_eXclude_archives_n___aoastu_:_set_Overwrite_mode_n___an_:_disable_archive_name_field_n___bb_0_3__:_set_output_log_level_n___bd_:_disable_progress_indicator_n___bsoep012_:_set_output_stream_for_output_error_progress_line_n___bt_:_show_execution_time_statistics_n___i_r__0___listfile_wildcard_:_Include_filenames_n___mParameters_:_set_compression_Method_n_____mmt_N__:_set_number_of_CPU_threads_n_____mx_N__:_set_compression_level:__mx1__fastest__...__mx9__ultra__n___oDirectory_:_set_Output_directory_n___r__0__:_Recurse_subdirectories_n___saaes_:_set_Archive_name_mode_n___sccUTF_8WINDOS_:_set_charset_for_for_console_input_output_n___scsUTF_8UTF_16LEUTF_16BEWINDOSid_:_set_charset_for_list_files_n___scrc_CRC32CRC64SHA1SHA256__:_set_hash_function_for_x__e__h_commands_n___sdel_:_delete_files_after_compression_n___seml_.__:_send_archive_by_email_n___sfx_name__:_Create_SFX_archive_n___si_name__:_read_data_from_stdin_n___slp_:_set_Large_Pages_mode_n___slt_:_show_technical_information_for_l__List__command_n___snh_:_store_hard_links_as_links_n___snl_:_store_symbolic_links_as_links_n___sni_:_store_NT_security_information_n___sns____:_store_NTFS_alternate_streams_n___so_:_write_data_to_stdout_n___spd_:_disable_wildcard_matching_for_file_names_n___spe_:_eliminate_duplication_of_root_folder_for_extract_command_n___spf_:_use_fully_qualified_file_paths_n___ssc____:_set_sensitive_case_mode_n___ssw_:_compress_shared_files_n___stl_:_set_archive_timestamp_from_the_most_recently_modified_file_n___stmHexMask_:_set_CPU_thread_affinity_mask__hexadecimal_number__n___stxType_:_exclude_archive_type_n___tType_:_Set_type_of_archive_n___u____p__q__r__x__y__z___newArchiveName__:_Update_options_n___vSize_bkmg__:_Create_volumes_n___w_path__:_assign_Work_directory._Empty_path_means_a_temporary_directory_n___x_r__0___listfile_wildcard_:_eXclude_filenames_n___y_:_assume_Yes_on_all_queries_n
xor ebx, ebx
call fcn.00608a80
sub esp, 4
lea ecx, [ebp - 0x370]
call fcn.004b2920
lea ecx, [ebp - 0x218]
call fcn.0060b760
jmp 0x4ae56e
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ebx, eax
jmp 0x4ae4cb
cmp eax, 2
mov edx, 0x86b9b0
mov eax, 0x86b9a8
cmovne eax, edx
cmp byte [ebp - 0x218], 0
mov dword [ebp - 0x3ec], eax
jne 0x4aeace
mov dword [esp + 4], 1
mov dword [esp], str.SeRestorePrivilege
call fcn.004bfb40
mov dword [esp + 4], 1
mov dword [esp], str.SeCreateSymbolicLinkPrivilege
call fcn.004bfb40
cmp byte [ebp - 0x20f], 0
je 0x4aebaa
mov ecx, dword [0x86b9a4]
test ecx, ecx
je 0x4aebaa
mov dword [esp], str._n7_Zip__r__17.01_beta__x86__:_Igor_Pavlov_:_Public_domain_:_2017_08_28_n_n
call fcn.00608a80
sub esp, 4
lea eax, [ebp - 0x218]
lea ecx, [ebp - 0x370]
mov dword [esp], eax
call fcn.0049b150
mov ebx, dword [ebp - 0x20]
sub esp, 4
mov dword [ebp - 0x3f4], 2
test ebx, ebx
je 0x4aebe7
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x24], eax
setne al
movzx eax, al
add eax, 1
mov dword [ebp - 0x3f4], eax
mov ecx, dword [ebp - 0x3ec]
test ecx, ecx
je 0x4afd24
mov dword [esp], 0xfffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
lea edi, [ebp - 0x2d8]
sub esp, 4
mov dword [esp], eax
mov dword [esp + 4], edi
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
sub esp, 8
test eax, eax
mov dword [ebp - 0x3fc], 0x50
jne 0x4af3c6
mov dword [esp], 0x18
call fcn.006fec40
mov edi, eax
mov dword [eax], 0x771fa8
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
mov ecx, edi
mov dword [eax + 4], 1
mov dword [ebp - 0x3e4], eax
movzx eax, byte [ebp - 0x216]
mov byte [edi + 0x14], al
movzx eax, byte [ebp - 0x215]
mov byte [edi + 0x15], al
call fcn.00470620
test eax, eax
jne 0x4b120a
lea ecx, [ebp - 0x1f4]
call fcn.004998a0
mov esi, dword [ebp - 0x3e4]
mov byte [ebp - 0x3ed], al
mov edx, dword [esi + 0xc]
test edx, edx
jne 0x4aeccc
test al, al
jne 0x4b11e0
cmp dword [ebp - 0x1f4], 6
je 0x4b11e0
lea ecx, [ebp - 0x1f4]
call fcn.004998d0
test al, al
jne 0x4b11e0
lea eax, [ebp - 0x3ac]
mov dword [ebp - 0x3ac], 0
mov dword [ebp - 0x3a8], 0
mov dword [ebp - 0x3a4], 0
mov dword [esp + 8], eax
lea eax, [ebp - 0x44]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x3e4]
mov dword [esp], eax
call fcn.004a66d0
test al, al
je 0x4b10fc
lea eax, [ebp - 0x2d8]
mov dword [ebp - 0x3a0], 0
mov dword [ebp - 0x39c], 0
mov dword [ebp - 0x398], 0
mov dword [ebp - 0x3d0], 0
mov dword [ebp - 0x3e0], eax
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x4aee95
mov eax, dword [ebp - 0x3e0]
mov ebx, dword [ebp - 0x3d0]
mov dword [ebp - 0x2d8], 0
mov ecx, dword [ebp - 0x3e4]
mov dword [ebp - 0x2d4], 0
mov dword [ebp - 0x2d0], 0
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + ebx*4]
mov dword [esp], eax
call fcn.00470130
sub esp, 8
test al, al
je 0x4b107a
cmp dword [ebp - 0x2d4], 1
jne 0x4b107a
mov eax, dword [ebp - 0x2d8]
xor edx, edx
mov edi, dword [ebp - 0x3a0]
mov dword [ebp - 0x3d0], ebx
mov dword [ebp - 0x3d8], eax
mov esi, dword [eax]
mov eax, dword [ebp - 0x39c]
mov ecx, eax
mov dword [ebp - 0x3d4], eax
cmp edx, ecx
je 0x4af313
lea ebx, [edx + ecx]
shr ebx, 1
cmp esi, dword [edi + ebx*4]
je 0x4af2d6
jge 0x4af3bd
mov eax, dword [ebp - 0x3d0]
mov ecx, eax
jmp 0x4aee16
lea eax, [edx + ebx]
shr eax, 1
cmp esi, dword [edi + eax*4]
je 0x4af2d0
jge 0x4af300
mov ebx, eax
cmp edx, ebx
jne 0x4aee00
mov eax, dword [ebp - 0x3d4]
cmp eax, dword [ebp - 0x398]
mov dword [ebp - 0x3d0], ecx
je 0x4af330
mov edx, dword [ebp - 0x3d4]
lea eax, [ebx*4]
sub edx, ebx
shl edx, 2
mov dword [esp + 8], edx
lea edx, [edi + eax]
lea eax, [edi + eax + 4]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_memmove
mov eax, dword [ebp - 0x3a0]
mov dword [eax + ebx*4], esi
mov eax, dword [ebp - 0x2d8]
add dword [ebp - 0x39c], 1
test eax, eax
mov dword [ebp - 0x3d8], eax
jne 0x4af2dc
add dword [ebp - 0x3d0], 1
mov eax, dword [ebp - 0x3d0]
cmp dword [ebp - 0x34], eax
ja 0x4aed50
mov eax, dword [ebp - 0x1f4]
cmp eax, 8
je 0x4af4e3
cmp eax, 6
je 0x4aef1b
cmp byte [ebp - 0x3ed], 0
jne 0x4aef1b
mov ebx, dword [0x86b9a0]
test ebx, ebx
je 0x4aeeea
mov dword [esp], ebx
call fcn.00475870
mov ecx, ebx
mov dword [esp], 0x747d52
call fcn.00608a80
push esi
mov ecx, eax
mov dword [esp], str.Incorrect_command_line
call fcn.00608a80
push edi
mov dword [esp], eax
call fcn.00475870
mov dword [esp], 4
call fcn.006fed60
mov dword [eax], 7
mov dword [esp + 8], 0
mov dword [esp + 4], 0x7650dc
mov dword [esp], eax
call fcn.006ff3c0
xor ebx, ebx
jmp 0x4aeb11
cmp byte [ebp - 0x211], 0
mov dword [ebp - 0x394], 0
mov dword [ebp - 0x390], 0
mov dword [ebp - 0x38c], 0
mov dword [ebp - 0x388], 0
mov dword [ebp - 0x384], 0
mov dword [ebp - 0x380], 0
jne 0x4af3d8
lea ecx, [ebp - 0x2b0]
mov dword [ebp - 0x2d8], 0x771b18
mov dword [ebp - 0x2c8], 0
mov dword [ebp - 0x2c4], 0
mov dword [ebp - 0x2c0], 0xffffffff
mov dword [ebp - 0x2bc], 0xffffffff
mov dword [ebp - 0x2b8], 0
mov dword [ebp - 0x2b4], 0
call reloc.msvcrt.dll_wcsncpy
lea ecx, [ebp - 0x2a4]
call fcn.00473f00
lea ecx, [ebp - 0x290]
mov dword [ebp - 0x298], 0xc8
mov dword [ebp - 0x294], 0
call reloc.msvcrt.dll_wcsncpy
lea ecx, [ebp - 0x284]
call reloc.msvcrt.dll_wcsncpy
lea ecx, [ebp - 0x278]
call reloc.msvcrt.dll_wcsncpy
lea ecx, [ebp - 0x26c]
call fcn.00473f00
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x260], 0
mov dword [ebp - 0x25c], 0
mov dword [ebp - 0x258], 0xffffffff
mov dword [ebp - 0x254], 0xffffffff
mov dword [ebp - 0x250], 0
mov dword [ebp - 0x24c], 0
call reloc.msvcrt.dll_wcsncpy
lea ecx, [ebp - 0x23c]
call fcn.00473f00
lea ecx, [ebp - 0x230]
call reloc.msvcrt.dll_wcsncpy
mov eax, dword [ebp - 0x3fc]
mov byte [ebp - 0x220], 1
mov edx, dword [0x86b9a0]
sub eax, 1
cmp byte [ebp - 0x20f], 0
je 0x4afd33
mov ecx, dword [0x86b9a4]
mov esi, dword [ebp - 0x3ec]
mov dword [ebp - 0x2d0], edx
mov dword [ebp - 0x21c], eax
test ecx, ecx
mov dword [ebp - 0x2d4], ecx
mov dword [ebp - 0x224], esi
je 0x4af0bf
mov dword [esp], str.Scanning_the_drive_for_archives:
call fcn.00608a80
sub esp, 4
mov dword [esp], eax
call fcn.00475870
lea edi, [ebp - 0x2d8]
lea eax, [ebp - 0x394]
mov dword [ebp - 0x310], 0
mov dword [ebp - 0x30c], 0
mov dword [ebp - 0x308], 0
lea esi, [ebp - 0x388]
mov ecx, edi
mov dword [ebp - 0x304], 0
mov dword [ebp - 0x300], 0
mov dword [ebp - 0x2fc], 0
mov dword [ebp - 0x2f8], 0
lea ebx, [ebp - 0x2c8]
mov dword [ebp - 0x2f4], 0
mov dword [ebp - 0x2f0], 0
mov dword [ebp - 0x2ec], 0
mov dword [ebp - 0x2e8], 0
mov dword [ebp - 0x2e4], 0
mov dword [ebp - 0x3e0], edi
mov dword [ebp - 0x3d0], eax
call fcn.004dc810
lea eax, [ebp - 0x344]
lea ecx, [ebp - 0x394]
mov dword [ebp - 0x3d0], ecx
mov ecx, eax
mov dword [ebp - 0x3f8], eax
call fcn.00473f00
mov eax, dword [ebp - 0x3f8]
lea ecx, [ebp - 0x394]
mov dword [esp + 0x18], edi
lea edi, [ebp - 0x310]
mov dword [esp + 0x10], esi
mov dword [esp + 4], 0
mov dword [esp + 0xc], ecx
mov dword [ebp - 0x3d0], ecx
mov dword [esp + 8], eax
lea eax, [ebp - 0x1d0]
mov dword [esp + 0x14], edi
mov dword [esp], eax
call fcn.00499d00
mov dword [ebp - 0x3d8], eax
mov eax, dword [ebp - 0x344]
test eax, eax
je 0x4af1db
mov dword [esp], eax
call fcn.006febd0
mov edx, dword [ebp - 0x224]
lea ebx, [ebp - 0x2c8]
test edx, edx
je 0x4af1fc
mov dword [esp], 1
mov ecx, ebx
call fcn.004b1b70
sub esp, 4
mov eax, dword [ebp - 0x3d8]
test eax, eax
jne 0x4b0a15
cmp byte [ebp - 0x20f], 0
jne 0x4b0cd3
mov ecx, ebx
mov dword [ebp - 0x2d8], 0x771b18
call fcn.004b19f0
cmp byte [ebp - 0x3ed], 0
jne 0x4afd5a
lea ecx, [ebp - 0x388]
call fcn.00607eb0
lea ecx, [ebp - 0x394]
call fcn.00607eb0
cmp byte [ebp - 0x1e3], 0
jne 0x4af467
xor ebx, ebx
mov eax, dword [ebp - 0x3a0]
test eax, eax
je 0x4af26c
mov dword [esp], eax
call fcn.006febd0
mov esi, dword [ebp - 0x3a8]
test esi, esi
je 0x4af2a3
lea edi, [esi*4 - 4]
lea esi, [esi]
mov eax, dword [ebp - 0x3ac]
mov dword [esp + 4], 0x20
sub esi, 1
mov eax, dword [eax + edi]
sub edi, 4
mov dword [esp], eax
call fcn.006fec10
test esi, esi
jne 0x4af280
mov eax, dword [ebp - 0x3ac]
test eax, eax
je 0x4af2b5
mov dword [esp], eax
call fcn.006febd0
mov edi, dword [ebp - 0x3e4]
mov eax, dword [edi]
mov dword [esp], edi
call dword [eax + 8]
sub esp, 4
jmp 0x4aeb11
mov dword [ebp - 0x3d0], ecx
mov eax, dword [ebp - 0x3d8]
mov dword [esp], eax
call fcn.006febd0
add dword [ebp - 0x3d0], 1
mov eax, dword [ebp - 0x3d0]
cmp eax, dword [ebp - 0x34]
jb 0x4aed50
jmp 0x4aee95
mov dword [ebp - 0x3d0], ecx
lea edx, [eax + 1]
mov ecx, ebx
cmp edx, ecx
jne 0x4aeddc
mov eax, dword [ebp - 0x3d4]
cmp eax, dword [ebp - 0x398]
mov ebx, edx
jne 0x4aee32
mov esi, esi
lea edi, [edi]
mov edi, eax
shr eax, 2
lea eax, [edi + eax + 1]
cmp eax, 0x1fffffff
mov dword [ebp - 0x3d8], eax
ja 0x4b1246
shl eax, 2
mov dword [esp], eax
call fcn.006fec20
mov edi, eax
mov eax, dword [ebp - 0x39c]
mov edx, dword [ebp - 0x3a0]
test eax, eax
mov dword [ebp - 0x3d4], eax
jne 0x4af388
test edx, edx
jne 0x4af3a7
mov eax, dword [ebp - 0x3d8]
mov dword [ebp - 0x3a0], edi
mov dword [ebp - 0x398], eax
jmp 0x4aee32
shl eax, 2
mov dword [esp + 4], edx
mov dword [esp], edi
mov dword [esp + 8], eax
mov dword [ebp - 0x3d4], edx
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0x3d4]
mov dword [esp], edx
call fcn.006febd0
mov eax, dword [ebp - 0x39c]
mov dword [ebp - 0x3d4], eax
jmp 0x4af371
mov eax, ebx
mov ebx, ecx
jmp 0x4af306
movsx eax, word [ebp - 0x2d8]
mov dword [ebp - 0x3fc], eax
jmp 0x4aec2d
mov dword [esp], 0xc
call fcn.006fec40
mov ebx, eax
lea eax, [ebp - 0x1b8]
mov ecx, ebx
mov dword [esp], eax
call fcn.00474110
mov eax, dword [ebp - 0x390]
sub esp, 4
cmp eax, dword [ebp - 0x38c]
lea esi, [eax + 1]
je 0x4b0959
mov edi, dword [ebp - 0x394]
mov dword [edi + eax*4], ebx
mov dword [esp], 0xc
mov dword [ebp - 0x390], esi
call fcn.006fec40
mov ebx, eax
lea eax, [ebp - 0x1b8]
mov ecx, ebx
mov dword [esp], eax
call fcn.00474110
mov eax, dword [ebp - 0x384]
sub esp, 4
cmp eax, dword [ebp - 0x380]
lea esi, [eax + 1]
je 0x4b09b7
mov edi, dword [ebp - 0x388]
mov dword [edi + eax*4], ebx
mov dword [ebp - 0x384], esi
jmp 0x4af228
mov ebx, dword [0x86b9a4]
test ebx, ebx
je 0x4af258
mov dword [ebp - 0x3d8], 0
xor ebx, ebx
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x3d0], eax
call eax
lea edx, [ebp - 0x344]
mov dword [esp], eax
mov dword [esp + 0x10], edx
lea edx, [ebp - 0x37c]
mov dword [esp + 0xc], edx
lea edx, [ebp - 0x388]
mov dword [esp + 8], edx
lea edx, [ebp - 0x394]
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
sub esp, 0x14
test eax, eax
jne 0x4b0ab9
mov esi, dword [ebp - 0x3d8]
test esi, esi
je 0x4af25a
mov eax, dword [ebp - 0x3d8]
call fcn.00701658
mov esi, dword [0x86b9a4]
mov eax, 0x86b9b0
test esi, esi
cmovne eax, esi
mov edi, eax
mov dword [esp], eax
mov dword [ebp - 0x3d0], eax
call fcn.00475870
mov ecx, edi
mov dword [esp], str.Formats:
call fcn.00608a80
sub esp, 4
mov dword [esp], eax
call fcn.00475870
mov eax, dword [ebp - 0x3e4]
mov dword [ebp - 0x3ec], 0
mov eax, dword [eax + 0xc]
test eax, eax
je 0x4af90c
mov esi, esi
lea edi, [edi]
mov eax, dword [ebp - 0x3e4]
mov edi, dword [ebp - 0x3ec]
mov esi, dword [ebp - 0x3d0]
mov eax, dword [eax + 8]
mov edi, dword [eax + edi*4]
mov eax, dword [esi]
mov dword [esp + 8], 2
mov dword [esp + 4], 1
mov dword [esp], 0x747c0f
mov dword [esp + 0xc], eax
mov dword [ebp - 0x3d8], edi
call sub.msvcrt.dll_fwrite
cmp byte [edi + 0x28], 1
mov edx, dword [esi]
mov dword [esp + 4], edx
sbb eax, eax
and eax, 0xffffffdd
add eax, 0x43
mov dword [esp], eax
call sub.msvcrt.dll_fputc
xor ebx, ebx
lea esi, [esi]
mov eax, dword [ebp - 0x3d8]
mov edx, dword [eax]
mov eax, 0x20
bt edx, ebx
jae 0x4af5b9
movzx eax, byte [ebx + str.KSNFMGOPBELH]
mov edi, dword [ebp - 0x3d0]
mov edx, dword [edi]
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_fputc
add ebx, 1
cmp ebx, 0xc
jne 0x4af5a0
mov edi, dword [ebp - 0x3d0]
mov eax, dword [edi]
mov dword [esp], 0x20
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputc
mov eax, dword [ebp - 0x3d8]
mov ecx, edi
mov ebx, dword [eax + 0x10]
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call fcn.004758b0
sub esp, 4
cmp ebx, 7
ja 0x4af630
nop
lea esi, [esi]
mov eax, dword [ebp - 0x3d0]
mov eax, dword [eax]
mov dword [esp], 0x20
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputc
add ebx, 1
cmp ebx, 8
jne 0x4af610
mov eax, dword [ebp - 0x3d0]
mov eax, dword [eax]
mov dword [esp], 0x20
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputc
lea eax, [ebp - 0x2d8]
mov ecx, eax
mov dword [ebp - 0x3e0], eax
call fcn.00473f00
mov eax, dword [ebp - 0x3d8]
xor ebx, ebx
mov eax, dword [eax + 0x1c]
test eax, eax
je 0x4af719
nop
mov eax, dword [ebp - 0x3d8]
mov ecx, dword [ebp - 0x3e0]
mov eax, dword [eax + 0x18]
mov esi, dword [eax + ebx*4]
mov dword [esp], esi
call fcn.004747a0
mov edi, dword [esi + 0x10]
sub esp, 4
test edi, edi
jne 0x4af6b3
mov eax, dword [ebp - 0x3d8]
add ebx, 1
cmp dword [eax + 0x1c], ebx
jbe 0x4af719
test ebx, ebx
je 0x4af670
mov ecx, dword [ebp - 0x3e0]
call fcn.004744b0
jmp 0x4af670
mov edi, dword [ebp - 0x3e0]
mov dword [esp], 0x747c1f
mov ecx, edi
call fcn.00474870
sub esp, 4
add esi, 0xc
mov ecx, edi
mov dword [esp], esi
call fcn.004747a0
sub esp, 4
mov eax, dword [ebp - 0x2d4]
cmp dword [ebp - 0x2d0], eax
je 0x4afca9
mov edx, dword [ebp - 0x2d8]
xor esi, esi
mov ecx, 0x29
add ebx, 1
mov word [edx + eax*2], cx
mov word [edx + eax*2 + 2], si
add eax, 1
mov dword [ebp - 0x2d4], eax
mov eax, dword [ebp - 0x3d8]
cmp dword [eax + 0x1c], ebx
ja 0x4af6a2
mov eax, dword [ebp - 0x2d8]
mov ecx, dword [ebp - 0x3d0]
mov ebx, dword [ebp - 0x2d4]
mov dword [esp], eax
call fcn.004758b0
sub esp, 4
cmp ebx, 0xc
ja 0x4af760
nop
lea esi, [esi]
mov eax, dword [ebp - 0x3d0]
mov eax, dword [eax]
mov dword [esp], 0x20
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputc
add ebx, 1
cmp ebx, 0xd
jne 0x4af740
mov eax, dword [ebp - 0x3d0]
mov eax, dword [eax]
mov dword [esp], 0x20
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputc
mov eax, dword [ebp - 0x3d8]
mov edx, dword [eax + 0x2c]
test edx, edx
jne 0x4afcdc
mov eax, dword [eax + 0x34]
mov dword [ebp - 0x3e0], 0
test eax, eax
je 0x4af8d0
nop
mov eax, dword [ebp - 0x3d8]
mov edi, dword [ebp - 0x3e0]
mov eax, dword [eax + 0x30]
mov edi, dword [eax + edi*4]
mov esi, dword [edi + 4]
test esi, esi
je 0x4af87c
mov eax, dword [ebp - 0x3d0]
xor esi, esi
mov ecx, dword [eax]
mov eax, dword [edi]
movzx ebx, byte [eax + esi]
lea eax, [ebx - 0x21]
cmp al, 0x5e
jbe 0x4af868
mov edx, ebx
mov dword [esp + 4], ecx
shr dl, 4
lea eax, [edx + 0x30]
cmp dl, 9
mov byte [ebp - 0x3d4], al
lea eax, [edx + 0x37]
movzx edx, byte [ebp - 0x3d4]
cmovbe eax, edx
movsx eax, al
mov dword [esp], eax
call sub.msvcrt.dll_fputc
and ebx, 0xf
mov ecx, dword [ebp - 0x3d0]
lea edx, [ebx + 0x37]
lea eax, [ebx + 0x30]
cmp bl, 0xa
cmovae eax, edx
mov edx, dword [ecx]
movsx eax, al
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_fputc
add esi, 1
cmp esi, dword [edi + 4]
jae 0x4af87c
mov eax, dword [ebp - 0x3d0]
test esi, esi
mov ecx, dword [eax]
je 0x4af7c7
mov dword [esp + 4], ecx
mov dword [esp], 0x20
call sub.msvcrt.dll_fputc
mov eax, dword [ebp - 0x3d0]
mov ecx, dword [eax]
mov eax, dword [edi]
movzx ebx, byte [eax + esi]
lea eax, [ebx - 0x21]
cmp al, 0x5e
ja 0x4af7d8
mov dword [esp + 4], ecx
mov dword [esp], ebx
call sub.msvcrt.dll_fputc
add esi, 1
cmp esi, dword [edi + 4]
jb 0x4af833
mov edi, dword [ebp - 0x3d8]
add dword [ebp - 0x3e0], 1
mov eax, dword [ebp - 0x3e0]
cmp eax, dword [edi + 0x34]
jae 0x4af8d0
mov edi, dword [ebp - 0x3e0]
test edi, edi
je 0x4af7a0
mov eax, dword [ebp - 0x3d0]
mov eax, dword [eax]
mov dword [esp + 8], 6
mov dword [esp + 4], 1
mov dword [esp], 0x747c2a
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
jmp 0x4af7a0
mov eax, dword [ebp - 0x3d0]
mov dword [esp], eax
call fcn.00475870
mov eax, dword [ebp - 0x2d8]
test eax, eax
je 0x4af8f0
mov dword [esp], eax
call fcn.006febd0
mov esi, dword [ebp - 0x3e4]
add dword [ebp - 0x3ec], 1
mov eax, dword [ebp - 0x3ec]
cmp eax, dword [esi + 0xc]
jb 0x4af540
mov edi, dword [ebp - 0x3d0]
mov dword [esp], edi
call fcn.00475870
mov ecx, edi
mov dword [esp], str.Codecs:
call fcn.00608a80
sub esp, 4
mov dword [esp], eax
call fcn.00475870
mov ebx, dword [0x86bb20]
test ebx, ebx
je 0x4afac4
mov dword [ebp - 0x3d4], 0
mov eax, dword [ebp - 0x3d4]
lea esi, [ebp - 0x2d8]
mov esi, esi
lea edi, [edi]
mov ebx, dword [ebp - 0x3d0]
mov dword [esp], 0x747c0f
mov edi, dword [eax*4 + 0x86ba20]
mov ecx, ebx
call fcn.00608a80
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], 0x20
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputc
mov eax, dword [edi + 0x14]
cmp eax, 1
je 0x4afcbf
mov ecx, dword [ebp - 0x3d0]
mov dword [esp], eax
call fcn.00475b30
sub esp, 4
cmp dword [edi + 4], 1
mov ebx, dword [ebp - 0x3d0]
mov edx, dword [ebx]
sbb eax, eax
and eax, 0xffffffdb
add eax, 0x45
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_fputc
cmp dword [edi], 1
mov edx, dword [ebx]
mov dword [esp + 4], edx
sbb eax, eax
and eax, 0xffffffdc
add eax, 0x44
mov dword [esp], eax
call sub.msvcrt.dll_fputc
mov eax, dword [ebp - 0x3d0]
mov eax, dword [eax]
mov dword [esp], 0x20
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputc
mov dword [esp + 8], esi
mov eax, dword [edi + 8]
xor ebx, ebx
mov edx, dword [edi + 0xc]
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.004b3820
cmp byte [ebp - 0x2d8], 0
je 0x4afa40
mov eax, dword [ebp - 0x3d0]
add ebx, 1
cmp byte [esi + ebx], 0
jne 0x4afa25
cmp ebx, 7
mov dword [ebp - 0x3d0], eax
jbe 0x4afa40
mov ebx, eax
jmp 0x4afa66
mov eax, dword [ebp - 0x3d0]
mov eax, dword [eax]
mov dword [esp], 0x20
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputc
add ebx, 1
cmp ebx, 8
jne 0x4afa40
mov ebx, dword [ebp - 0x3d0]
mov eax, dword [ebx]
mov dword [esp], esi
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
mov eax, dword [ebx]
mov dword [esp], 0x20
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputc
mov eax, dword [ebp - 0x3d0]
mov eax, dword [eax]
mov dword [esp + 4], eax
mov eax, dword [edi + 0x10]
mov dword [esp], eax
call sub.msvcrt.dll_fputs
mov eax, dword [ebp - 0x3d0]
mov dword [esp], eax
call fcn.00475870
add dword [ebp - 0x3d4], 1
mov eax, dword [ebp - 0x3d4]
cmp dword [0x86bb20], eax
ja 0x4af960
mov esi, dword [ebp - 0x3d0]
mov dword [esp], esi
call fcn.00475870
mov ecx, esi
mov dword [esp], str.Hashers:
call fcn.00608a80
sub esp, 4
mov dword [esp], eax
call fcn.00475870
mov ecx, dword [0x86ba00]
test ecx, ecx
je 0x4af24b
mov dword [ebp - 0x3d4], 0
mov eax, dword [ebp - 0x3d4]
lea esi, [ebp - 0x2d8]
nop
mov ebx, dword [ebp - 0x3d0]
mov dword [esp], 0x747c0f
mov edi, dword [eax*4 + 0x86b9c0]
mov ecx, ebx
call fcn.00608a80
mov eax, dword [ebx]
sub esp, 4
mov dword [ebp - 0x3d0], ebx
mov dword [esp], 0x20
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputc
mov dword [esp + 4], esi
mov eax, dword [edi + 0x14]
xor ebx, ebx
mov dword [esp], eax
call fcn.004b3110
cmp byte [ebp - 0x2d8], 0
je 0x4afb90
mov eax, dword [ebp - 0x3d0]
lea esi, [esi]
lea edi, [edi]
add ebx, 1
cmp byte [esi + ebx], 0
jne 0x4afb70
cmp ebx, 3
mov dword [ebp - 0x3d0], eax
jbe 0x4afb90
mov ebx, eax
jmp 0x4afbb6
mov eax, dword [ebp - 0x3d0]
mov eax, dword [eax]
mov dword [esp], 0x20
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputc
add ebx, 1
cmp ebx, 4
jne 0x4afb90
mov ebx, dword [ebp - 0x3d0]
mov eax, dword [ebx]
mov dword [esp], esi
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
mov eax, dword [ebx]
mov dword [esp], 0x20
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputc
mov dword [esp + 8], esi
mov eax, dword [edi + 8]
xor ebx, ebx
mov edx, dword [edi + 0xc]
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.004b3820
cmp byte [ebp - 0x2d8], 0
je 0x4afc20
mov eax, dword [ebp - 0x3d0]
lea esi, [esi]
add ebx, 1
cmp byte [esi + ebx], 0
jne 0x4afc00
cmp ebx, 7
mov dword [ebp - 0x3d0], eax
jbe 0x4afc20
mov ebx, eax
jmp 0x4afc46
mov eax, dword [ebp - 0x3d0]
mov eax, dword [eax]
mov dword [esp], 0x20
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputc
add ebx, 1
cmp ebx, 8
jne 0x4afc20
mov ebx, dword [ebp - 0x3d0]
mov eax, dword [ebx]
mov dword [esp], esi
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
mov eax, dword [ebx]
mov dword [esp], 0x20
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputc
mov eax, dword [ebp - 0x3d0]
mov eax, dword [eax]
mov dword [esp + 4], eax
mov eax, dword [edi + 0x10]
mov dword [esp], eax
call sub.msvcrt.dll_fputs
mov eax, dword [ebp - 0x3d0]
mov dword [esp], eax
call fcn.00475870
add dword [ebp - 0x3d4], 1
mov eax, dword [ebp - 0x3d4]
cmp dword [0x86ba00], eax
ja 0x4afb10
jmp 0x4af24b
mov ecx, dword [ebp - 0x3e0]
call fcn.004739d0
mov eax, dword [ebp - 0x2d4]
jmp 0x4af6ec
mov eax, dword [ebp - 0x3d0]
mov eax, dword [eax]
mov dword [esp], 0x20
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputc
jmp 0x4af9ad
mov ecx, dword [ebp - 0x3d0]
mov dword [esp], str.offset
call fcn.00608a80
mov esi, dword [ebp - 0x3d8]
sub esp, 4
mov ecx, eax
mov edx, dword [esi + 0x2c]
mov dword [esp], edx
call fcn.00475b30
mov eax, dword [eax]
sub esp, 4
mov dword [esp], 0x20
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputc
mov eax, dword [ebp - 0x3d8]
jmp 0x4af789
mov dword [ebp - 0x3fc], 0x50
jmp 0x4aec2d
mov edi, dword [ebp - 0x3ec]
mov dword [ebp - 0x2d4], 0
mov dword [ebp - 0x2d0], edx
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x224], edi
jmp 0x4af0bf
mov dword [esp], 0x168
call fcn.006fec40
mov edi, eax
mov dword [eax], method.rrent18bt_peer_connectionE.virtual_0
mov dword [eax + 4], 0x771e14
mov dword [eax + 8], 0x771b64
lea ecx, [edi + 0x28]
lea eax, [eax + 0x10]
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0xffffffff
mov dword [edi + 0x1c], 0xffffffff
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [ebp - 0x400], eax
call reloc.msvcrt.dll_wcsncpy
lea ecx, [edi + 0x34]
call fcn.00473f00
lea ecx, [edi + 0x48]
mov dword [edi + 0x40], 0xc8
mov dword [edi + 0x44], 0
call reloc.msvcrt.dll_wcsncpy
lea ecx, [edi + 0x54]
call reloc.msvcrt.dll_wcsncpy
lea ecx, [edi + 0x60]
call reloc.msvcrt.dll_wcsncpy
lea ecx, [edi + 0x6c]
call fcn.00473f00
lea ecx, [edi + 0x90]
mov dword [edi + 0x78], 0
mov dword [edi + 0x7c], 0
mov dword [edi + 0x80], 0xffffffff
mov dword [edi + 0x84], 0xffffffff
mov dword [edi + 0x88], 0
mov dword [edi + 0x8c], 0
call reloc.msvcrt.dll_wcsncpy
lea ecx, [edi + 0x9c]
call fcn.00473f00
lea ecx, [edi + 0xa8]
call reloc.msvcrt.dll_wcsncpy
lea ecx, [edi + 0xe0]
mov byte [edi + 0xb8], 1
mov dword [edi + 0xbc], 0x4f
mov byte [edi + 0xc8], 0
mov dword [edi + 0xd0], 0
mov dword [edi + 0xd4], 0
mov byte [edi + 0xd8], 0
mov dword [edi + 0xdc], 0
mov dword [edi], 0x771cbc
mov dword [edi + 4], 0x771cfc
mov dword [edi + 8], 0x771d14
call reloc.msvcrt.dll_wcsncpy
lea ecx, [edi + 0xec]
call fcn.00473f00
lea ecx, [edi + 0xf8]
call fcn.00473f00
mov eax, dword [edi]
mov byte [edi + 0x158], 0
mov dword [edi + 0x15c], 1
mov dword [edi + 0x160], 0
mov eax, dword [eax + 4]
cmp eax, 0x60d9c0
jne 0x4b1060
add dword [edi + 0xdc], 1
mov eax, dword [0x86b9a4]
cmp dword [ebp - 0x390], 1
mov esi, dword [ebp - 0x3ec]
mov dword [edi + 0x108], 0
mov dword [edi + 0x10c], 0
mov dword [edi + 0xc0], eax
mov eax, dword [0x86b9a0]
seta byte [edi + 0xd8]
test esi, esi
mov dword [edi + 0xb4], esi
mov byte [edi + 0x110], 0
mov byte [edi + 0x111], 0
mov dword [edi + 0x118], 0
mov dword [edi + 0xc4], eax
mov eax, dword [ebp - 0x20]
mov dword [edi + 0x11c], 0
mov dword [edi + 0x120], 0
mov dword [edi + 0x124], 0
mov dword [edi + 0x128], 0
mov dword [edi + 0x160], eax
mov eax, dword [ebp - 0x3f4]
mov dword [edi + 0x12c], 0
mov dword [edi + 0x130], 0
mov dword [edi + 0x134], 0
mov dword [edi + 0x138], 0
mov dword [edi + 0x13c], 0
mov dword [edi + 0x140], 0
mov dword [edi + 0x144], 0
mov dword [edi + 0x148], 0
mov dword [edi + 0x14c], 0
mov dword [edi + 0x150], 0
mov dword [edi + 0x154], 0
mov dword [edi + 0x15c], eax
je 0x4b0002
mov eax, dword [ebp - 0x3fc]
sub eax, 1
mov dword [edi + 0xbc], eax
lea ecx, [ebp - 0x338]
mov dword [ebp - 0x344], 0
mov dword [ebp - 0x340], 0
mov dword [ebp - 0x33c], 0
call fcn.00473f00
movzx eax, word [ebp - 0x1a0]
lea ecx, [ebp - 0x338]
mov byte [ebp - 0x32c], 0
mov byte [ebp - 0x32b], 0
mov byte [ebp - 0x329], 0
mov byte [ebp - 0x327], 0
mov byte [ebp - 0x325], 0
mov byte [ebp - 0x324], 0
mov byte [ebp - 0x323], 0
mov word [ebp - 0x344], ax
movzx eax, byte [ebp - 0x19e]
mov byte [ebp - 0x32a], 1
mov byte [ebp - 0x328], 1
mov byte [ebp - 0x326], 1
mov byte [ebp - 0x322], 1
mov byte [ebp - 0x321], 0
mov byte [ebp - 0x320], 0
mov byte [ebp - 0x342], al
movzx eax, byte [ebp - 0x19d]
mov byte [ebp - 0x31f], 0
mov byte [ebp - 0x31e], 0
mov dword [ebp - 0x31c], 0
mov dword [ebp - 0x318], 0
mov dword [ebp - 0x314], 0
mov byte [ebp - 0x341], al
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0x340], eax
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0x33c], eax
lea eax, [ebp - 0x194]
mov dword [esp], eax
call fcn.00474280
mov eax, dword [ebp - 0x188]
sub esp, 4
cmp dword [ebp - 0x1f4], 3
mov ebx, dword [ebp - 0x318]
mov dword [ebp - 0x32c], eax
mov eax, dword [ebp - 0x184]
sete byte [ebp - 0x31e]
test ebx, ebx
mov dword [ebp - 0x328], eax
movzx eax, word [ebp - 0x180]
mov word [ebp - 0x324], ax
movzx eax, byte [ebp - 0x17e]
mov byte [ebp - 0x322], al
movzx eax, byte [ebp - 0x211]
mov byte [ebp - 0x321], al
movzx eax, byte [ebp - 0x210]
mov byte [ebp - 0x320], al
movzx eax, byte [ebp - 0x20e]
mov byte [ebp - 0x31f], al
je 0x4b01d6
lea eax, [ebx*4 - 4]
mov dword [ebp - 0x3d0], eax
mov eax, dword [ebp - 0x31c]
mov esi, dword [ebp - 0x3d0]
sub ebx, 1
mov esi, dword [eax + esi]
test esi, esi
je 0x4b01cb
mov eax, dword [esi + 0xc]
test eax, eax
je 0x4b01ad
mov dword [esp], eax
call fcn.006febd0
mov eax, dword [esi]
test eax, eax
je 0x4b01bb
mov dword [esp], eax
call fcn.006febd0
mov dword [esp + 4], 0x18
mov dword [esp], esi
call fcn.006fec10
sub dword [ebp - 0x3d0], 4
test ebx, ebx
jne 0x4b0188
mov eax, dword [ebp - 0x1a8]
cmp eax, dword [ebp - 0x314]
mov dword [ebp - 0x318], 0
mov dword [ebp - 0x3d4], eax
jbe 0x4b023a
cmp eax, 0x1fffffff
ja 0x4b15ec
shl eax, 2
mov dword [esp], eax
call fcn.006fec20
mov ebx, eax
mov eax, dword [ebp - 0x318]
mov esi, dword [ebp - 0x31c]
test eax, eax
jne 0x4b0d9d
test esi, esi
jne 0x4b0db0
mov eax, dword [ebp - 0x3d4]
mov dword [ebp - 0x31c], ebx
mov dword [ebp - 0x314], eax
mov eax, dword [ebp - 0x3d4]
test eax, eax
je 0x4b02b6
mov dword [ebp - 0x3d0], 0
mov eax, dword [ebp - 0x1ac]
mov esi, dword [ebp - 0x3d0]
mov ebx, dword [eax + esi*4]
mov dword [esp], 0x18
call fcn.006fec40
mov dword [esp], ebx
mov ecx, eax
mov esi, eax
call fcn.00474110
sub esp, 4
add ebx, 0xc
lea ecx, [esi + 0xc]
mov dword [esp], ebx
call fcn.00474110
mov eax, dword [ebp - 0x318]
add dword [ebp - 0x3d0], 1
sub esp, 4
lea edx, [eax + 1]
mov dword [ebp - 0x318], edx
mov edx, dword [ebp - 0x31c]
mov dword [edx + eax*4], esi
mov eax, dword [ebp - 0x3d0]
cmp dword [ebp - 0x3d4], eax
jne 0x4b024e
lea ebx, [ebp - 0x37c]
mov ecx, ebx
call fcn.00473f00
mov eax, dword [ebp - 0x1dc]
mov dword [ebp - 0x2d8], 0x7713a8
mov dword [ebp - 0x2d4], 0
mov dword [ebp - 0x2d0], 0
mov dword [ebp - 0x2cc], 0
test eax, eax
je 0x4b0d2a
lea eax, [ebp - 0x1e0]
lea ecx, [ebp - 0x2d8]
lea esi, [ebp - 0x388]
mov dword [esp], eax
lea eax, [ebp - 0x344]
mov dword [ebp - 0x3e0], ecx
mov dword [ebp - 0x3f8], eax
lea eax, [ebp - 0x394]
mov dword [ebp - 0x3d0], eax
call fcn.004d8380
sub esp, 4
test eax, eax
jne 0x4b1626
mov dword [ebp - 0x2a0], 0
mov dword [ebp - 0x29c], 0
mov dword [ebp - 0x2a8], 0
mov dword [ebp - 0x2a4], 0
mov dword [ebp - 0x2b0], 0
mov dword [ebp - 0x2ac], 0
mov dword [ebp - 0x2b8], 0
mov dword [ebp - 0x2b4], 0
mov dword [ebp - 0x2c0], 0
mov dword [ebp - 0x2bc], 0
mov dword [ebp - 0x2c8], 0
mov dword [ebp - 0x2c4], 0
lea eax, [ebp - 0x310]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], edi
lea esi, [ebp - 0x388]
mov dword [esp + 0x2c], eax
mov eax, dword [ebp - 0x3e0]
mov dword [esp + 0x24], eax
lea eax, [edi + 8]
mov dword [esp + 0x1c], eax
lea eax, [ebp - 0x344]
mov dword [esp + 0x18], eax
mov dword [ebp - 0x3f8], eax
mov eax, dword [ebp - 0x20c]
mov eax, dword [eax]
mov dword [esp + 0x10], esi
add eax, 0xc
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x394]
mov dword [ebp - 0x3d0], eax
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x3a0]
mov dword [esp + 8], eax
lea eax, [ebp - 0x3ac]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x3e4]
mov dword [esp], eax
call fcn.004d5240
mov dword [ebp - 0x3d8], eax
mov eax, dword [edi + 0xb4]
test eax, eax
je 0x4b0457
mov ecx, dword [ebp - 0x400]
mov dword [esp], 1
call fcn.004b1b70
sub esp, 4
mov eax, dword [ebp - 0x378]
test eax, eax
je 0x4b04bf
mov ebx, dword [0x86b9a0]
test ebx, ebx
je 0x4b04a9
mov dword [esp], ebx
call fcn.00475870
mov ecx, ebx
mov dword [esp], 0x747c65
call fcn.00608a80
sub esp, 4
mov ebx, eax
mov dword [esp], eax
call fcn.00475870
mov eax, dword [ebp - 0x37c]
mov ecx, ebx
mov dword [esp], eax
call fcn.004758b0
sub esp, 4
mov dword [esp], eax
call fcn.00475870
mov ecx, dword [ebp - 0x3d8]
mov eax, 0x80004005
test ecx, ecx
cmovne eax, ecx
mov dword [ebp - 0x3d8], eax
mov eax, dword [0x86b9a4]
test eax, eax
mov dword [ebp - 0x3d4], eax
je 0x4b0ce9
mov dword [esp], eax
call fcn.00475870
cmp dword [edi + 0x10c], 0
ja 0x4b04ec
cmp dword [edi + 0x108], 1
jbe 0x4b055e
mov ebx, dword [ebp - 0x3d4]
mov dword [esp], str.Archives:
mov ecx, ebx
call fcn.00608a80
mov edx, dword [edi + 0x108]
mov ecx, dword [edi + 0x10c]
sub esp, 4
mov dword [esp], edx
mov dword [esp + 4], ecx
mov ecx, eax
call fcn.00475b80
sub esp, 8
mov dword [esp], eax
call fcn.00475870
mov ecx, ebx
mov dword [esp], str.OK_archives:
call fcn.00608a80
mov ecx, dword [edi + 0x118]
mov ebx, dword [edi + 0x11c]
sub esp, 4
mov dword [esp], ecx
mov dword [esp + 4], ebx
mov ecx, eax
call fcn.00475b80
sub esp, 8
mov dword [esp], eax
call fcn.00475870
mov eax, dword [edi + 0x124]
or eax, dword [edi + 0x120]
je 0x4b0ee2
mov ecx, dword [ebp - 0x3d4]
mov dword [esp], str.Cant_open_as_archive:
call fcn.00608a80
mov ecx, dword [edi + 0x120]
mov ebx, dword [edi + 0x124]
sub esp, 4
mov dword [esp], ecx
mov dword [esp + 4], ebx
mov ecx, eax
call fcn.00475b80
sub esp, 8
mov dword [esp], eax
call fcn.00475870
mov eax, dword [edi + 0x12c]
or eax, dword [edi + 0x128]
je 0x4b05f2
mov ecx, dword [ebp - 0x3d4]
mov dword [esp], str.Archives_with_Errors:
call fcn.00608a80
mov ecx, dword [edi + 0x128]
mov ebx, dword [edi + 0x12c]
sub esp, 4
mov dword [esp], ecx
mov dword [esp + 4], ebx
mov ecx, eax
call fcn.00475b80
sub esp, 8
mov dword [esp], eax
call fcn.00475870
mov eax, dword [edi + 0x134]
or eax, dword [edi + 0x130]
je 0x4b063a
mov ecx, dword [ebp - 0x3d4]
mov dword [esp], str.Archives_with_Warnings:
call fcn.00608a80
mov ecx, dword [edi + 0x130]
mov ebx, dword [edi + 0x134]
sub esp, 4
mov dword [esp], ecx
mov dword [esp + 4], ebx
mov ecx, eax
call fcn.00475b80
sub esp, 8
mov dword [esp], eax
call fcn.00475870
mov eax, dword [edi + 0x144]
or eax, dword [edi + 0x140]
jne 0x4b0e83
mov eax, dword [edi + 0x13c]
or eax, dword [edi + 0x138]
jne 0x4b0e1f
xor ebx, ebx
cmp byte [ebp - 0x3ed], 0
setne bl
add ebx, ebx
mov eax, dword [edi + 0x12c]
or eax, dword [edi + 0x128]
jne 0x4b0a5a
mov eax, dword [edi + 0x14c]
or eax, dword [edi + 0x148]
jne 0x4b0a5a
mov eax, dword [ebp - 0x3d8]
test eax, eax
jne 0x4b07bb
mov eax, dword [ebp - 0x2ec]
or eax, dword [ebp - 0x2f0]
jne 0x4b0feb
mov eax, dword [ebp - 0x2e8]
xor eax, 1
or eax, dword [ebp - 0x2e4]
je 0x4b1049
mov ecx, dword [ebp - 0x3d4]
mov dword [esp], str.Files:
call fcn.00608a80
mov edx, dword [ebp - 0x2e8]
mov ecx, dword [ebp - 0x2e4]
sub esp, 4
mov dword [esp], edx
mov dword [esp + 4], ecx
mov ecx, eax
call fcn.00475b80
sub esp, 8
mov dword [esp], eax
call fcn.00475870
mov eax, dword [ebp - 0x2dc]
or eax, dword [ebp - 0x2e0]
jne 0x4b141a
mov ecx, dword [ebp - 0x3d4]
mov dword [esp], 0x747d38
call fcn.00608a80
mov edx, dword [ebp - 0x308]
mov ecx, dword [ebp - 0x304]
sub esp, 4
mov dword [esp], edx
mov dword [esp + 4], ecx
mov ecx, eax
call fcn.00475b80
sub esp, 8
mov dword [ebp - 0x3ec], eax
mov dword [esp], eax
call fcn.00475870
mov ecx, dword [ebp - 0x3ec]
mov dword [esp], str.Compressed:
call fcn.00608a80
mov edx, dword [ebp - 0x2f8]
mov ecx, dword [ebp - 0x2f4]
sub esp, 4
mov dword [esp], edx
mov dword [esp + 4], ecx
mov ecx, eax
call fcn.00475b80
sub esp, 8
mov dword [esp], eax
call fcn.00475870
mov eax, dword [ebp - 0x3e0]
test eax, eax
je 0x4b07bb
mov eax, dword [ebp - 0x3d4]
mov dword [esp], eax
call fcn.00475870
lea eax, [ebp - 0x2d8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x3d4]
mov dword [esp], eax
call fcn.004df090
mov ecx, dword [ebp - 0x2d0]
mov dword [ebp - 0x2d8], 0x7713a8
mov eax, dword [ebp - 0x2d4]
test ecx, ecx
je 0x4b084b
lea edx, [ecx*4 - 4]
mov dword [ebp - 0x3d4], edi
mov dword [ebp - 0x3ec], esi
mov dword [ebp - 0x3e0], ebx
mov esi, ecx
mov edi, edx
mov ebx, dword [eax + edi]
sub esi, 1
test ebx, ebx
je 0x4b0832
mov eax, dword [ebx + 4]
test eax, eax
je 0x4b080b
mov dword [esp], eax
call fcn.006febd0
mov eax, dword [ebx]
test eax, eax
je 0x4b081c
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
sub esp, 4
mov dword [esp + 4], 0x114
mov dword [esp], ebx
call fcn.006fec10
mov eax, dword [ebp - 0x2d4]
sub edi, 4
test esi, esi
jne 0x4b07f2
mov edi, dword [ebp - 0x3d4]
mov ebx, dword [ebp - 0x3e0]
mov esi, dword [ebp - 0x3ec]
test eax, eax
je 0x4b0857
mov dword [esp], eax
call fcn.006febd0
mov eax, dword [ebp - 0x37c]
test eax, eax
je 0x4b0869
mov dword [esp], eax
call fcn.006febd0
mov eax, dword [ebp - 0x318]
mov ecx, dword [ebp - 0x31c]
test eax, eax
je 0x4b08ec
lea edx, [eax*4 - 4]
mov dword [ebp - 0x3e0], ebx
mov dword [ebp - 0x3ec], esi
mov dword [ebp - 0x3d4], edi
mov ebx, eax
mov esi, edx
mov edi, dword [ecx + esi]
sub ebx, 1
test edi, edi
je 0x4b08d3
mov ecx, dword [edi + 0xc]
test ecx, ecx
je 0x4b08af
mov dword [esp], ecx
call fcn.006febd0
mov ecx, dword [edi]
test ecx, ecx
je 0x4b08bd
mov dword [esp], ecx
call fcn.006febd0
mov dword [esp + 4], 0x18
mov dword [esp], edi
call fcn.006fec10
mov ecx, dword [ebp - 0x31c]
sub esi, 4
test ebx, ebx
jne 0x4b0896
mov edi, dword [ebp - 0x3d4]
mov ebx, dword [ebp - 0x3e0]
mov esi, dword [ebp - 0x3ec]
test ecx, ecx
je 0x4b08f8
mov dword [esp], ecx
call fcn.006febd0
mov eax, dword [ebp - 0x338]
test eax, eax
je 0x4b090a
mov dword [esp], eax
call fcn.006febd0
mov eax, dword [edi]
mov eax, dword [eax + 8]
cmp eax, 0x60d9e0
jne 0x4b106d
sub dword [edi + 0xdc], 1
je 0x4b0f00
mov ecx, esi
call fcn.00607eb0
mov ecx, dword [ebp - 0x3d0]
call fcn.00607eb0
cmp byte [ebp - 0x1e3], 0
je 0x4af4ca
mov ecx, dword [0x86b9a4]
test ecx, ecx
je 0x4af4ca
jmp 0x4af481
shr eax, 2
add esi, eax
cmp esi, 0x1fffffff
ja 0x4b15e7
lea eax, [esi*4]
mov dword [esp], eax
call fcn.006fec20
mov edi, eax
mov eax, dword [ebp - 0x390]
mov ecx, dword [ebp - 0x394]
test eax, eax
mov dword [ebp - 0x3d0], ecx
jne 0x4b0d6b
mov edx, dword [ebp - 0x3d0]
test edx, edx
jne 0x4b0d84
mov dword [ebp - 0x38c], esi
mov dword [ebp - 0x394], edi
lea esi, [eax + 1]
jmp 0x4af414
shr eax, 2
add esi, eax
cmp esi, 0x1fffffff
ja 0x4b15f1
lea eax, [esi*4]
mov dword [esp], eax
call fcn.006fec20
mov edi, eax
mov eax, dword [ebp - 0x384]
mov ecx, dword [ebp - 0x388]
test eax, eax
mov dword [ebp - 0x3d0], ecx
jne 0x4b0d39
mov ecx, dword [ebp - 0x3d0]
test ecx, ecx
jne 0x4b0d52
mov dword [ebp - 0x380], esi
mov dword [ebp - 0x388], edi
lea esi, [eax + 1]
jmp 0x4af459
mov ecx, ebx
mov dword [ebp - 0x2d8], 0x771b18
call fcn.004b19f0
mov ecx, esi
call fcn.00607eb0
mov ecx, dword [ebp - 0x3d0]
call fcn.00607eb0
cmp byte [ebp - 0x1e3], 0
je 0x4af4d8
mov ecx, dword [0x86b9a4]
test ecx, ecx
je 0x4af4d8
xor ebx, ebx
jmp 0x4af481
mov eax, dword [ebp - 0x3d4]
mov dword [esp], eax
call fcn.00475870
mov eax, dword [edi + 0x14c]
or eax, dword [edi + 0x148]
je 0x4b07bb
mov ecx, dword [ebp - 0x3d4]
mov dword [esp], 0x747ce6
call fcn.00608a80
mov ecx, dword [edi + 0x14c]
mov edx, dword [edi + 0x148]
sub esp, 4
mov dword [esp], edx
mov dword [esp + 4], ecx
mov ecx, eax
call fcn.00475b80
sub esp, 8
mov dword [esp], eax
call fcn.00475870
jmp 0x4b07bb
lea eax, [ebp - 0x310]
lea edi, [ebp - 0x2d8]
mov dword [esp], eax
call fcn.004c1410
mov ecx, 0xa
xor eax, eax
mov dword [ebp - 0x3e0], edi
rep stosd dword es:[edi], eax
mov dword [ebp - 0x3c0], 0
mov dword [ebp - 0x3bc], 0
mov dword [esp], 0x747d72
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
sub esp, 4
mov dword [ebp - 0x3ec], eax
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 4], str.K32GetProcessMemoryInfo
mov dword [esp], eax
call edi
sub esp, 8
test eax, eax
mov esi, eax
je 0x4b0faf
mov eax, dword [ebp - 0x3d0]
call eax
mov ecx, dword [ebp - 0x3e0]
mov dword [esp + 8], 0x28
mov dword [esp], eax
mov dword [esp + 4], ecx
call esi
sub esp, 0xc
mov dword [ebp - 0x3d4], eax
mov eax, dword [ebp - 0x3ec]
mov dword [esp + 4], str.QueryProcessCycleTime
mov dword [esp], eax
call edi
sub esp, 8
test eax, eax
mov esi, eax
je 0x4b0dbd
mov eax, dword [ebp - 0x3d0]
call eax
lea edx, [ebp - 0x3c0]
mov dword [esp], eax
mov dword [esp + 4], edx
call esi
mov esi, dword [ebp - 0x37c]
mov edi, dword [ebp - 0x378]
sub esp, 8
mov dword [ebp - 0x3ec], eax
mov eax, str.Kernel
mov edx, esi
mov dword [ebp - 0x3e0], esi
mov esi, dword [ebp - 0x344]
mov ecx, edi
mov dword [ebp - 0x3dc], edi
mov edi, dword [ebp - 0x340]
mov dword [ebp - 0x3d0], esi
mov esi, dword [ebp - 0x310]
sub esi, dword [ebp - 0x394]
mov dword [ebp - 0x3cc], edi
mov edi, dword [ebp - 0x30c]
sbb edi, dword [ebp - 0x390]
mov dword [esp], esi
mov dword [esp + 4], edi
call fcn.004ae040
mov eax, dword [ebp - 0x3ec]
test eax, eax
je 0x4b0c58
mov ecx, dword [0x86b9a4]
mov dword [esp], 0x747deb
call fcn.00608a80
mov eax, dword [ebp - 0x3c0]
mov edx, dword [ebp - 0x3bc]
sub esp, 4
mov dword [esp + 8], 0xf4240
mov dword [esp + 0xc], 0
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.005e3780
mov dword [esp], 0x20
mov ecx, 0x16
call fcn.004add90
mov ecx, dword [0x86b9a4]
mov dword [esp], str._MCycles
call fcn.00608a80
sub esp, 4
mov edx, dword [ebp - 0x3d0]
mov ecx, dword [ebp - 0x3cc]
mov eax, str.User
mov dword [esp], esi
mov dword [esp + 4], edi
call fcn.004ae040
mov edx, dword [ebp - 0x3d0]
add edx, dword [ebp - 0x3e0]
mov eax, str.Process
mov ecx, dword [ebp - 0x3cc]
adc ecx, dword [ebp - 0x3dc]
mov dword [esp], esi
mov dword [esp + 4], edi
call fcn.004ae040
mov eax, dword [ebp - 0x3d4]
test eax, eax
jne 0x4b0f71
mov dword [esp], esi
mov dword [esp + 4], edi
mov edx, esi
mov ecx, edi
mov eax, str.Global
call fcn.004ae040
mov eax, dword [0x86b9a4]
mov dword [esp], eax
call fcn.00475870
jmp 0x4af4ca
mov ecx, dword [ebp - 0x3e0]
mov dword [esp], edi
call fcn.004dd250
sub esp, 4
jmp 0x4af217
mov eax, dword [edi + 0x124]
or eax, dword [edi + 0x120]
mov ebx, 2
jne 0x4b07bb
mov eax, dword [edi + 0x12c]
or eax, dword [edi + 0x128]
jne 0x4b07bb
xor ebx, ebx
mov eax, dword [edi + 0x13c]
or eax, dword [edi + 0x138]
setne bl
add ebx, ebx
jmp 0x4b07bb
mov dword [ebp - 0x3e0], 0
jmp 0x4b03b4
shl eax, 2
mov dword [esp], edi
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x3d0]
mov dword [esp + 4], eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x3d0]
mov dword [esp], eax
call fcn.006febd0
mov eax, dword [ebp - 0x384]
jmp 0x4b0a01
shl eax, 2
mov dword [esp], edi
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x3d0]
mov dword [esp + 4], eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x3d0]
mov dword [esp], eax
call fcn.006febd0
mov eax, dword [ebp - 0x390]
jmp 0x4b09a3
shl eax, 2
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 8], eax
call sub.msvcrt.dll_memcpy
mov dword [esp], esi
call fcn.006febd0
jmp 0x4b0228
mov esi, dword [ebp - 0x344]
mov edi, dword [ebp - 0x340]
mov eax, dword [ebp - 0x37c]
mov edx, dword [ebp - 0x378]
mov dword [ebp - 0x3d0], esi
mov esi, dword [ebp - 0x310]
sub esi, dword [ebp - 0x394]
mov dword [ebp - 0x3cc], edi
mov ecx, edx
mov edi, dword [ebp - 0x30c]
sbb edi, dword [ebp - 0x390]
mov dword [ebp - 0x3e0], eax
mov dword [ebp - 0x3dc], edx
mov edx, eax
mov eax, str.Kernel
mov dword [esp], esi
mov dword [esp + 4], edi
call fcn.004ae040
jmp 0x4b0c58
mov eax, dword [ebp - 0x3d4]
mov ebx, 2
mov dword [esp], eax
call fcn.00475870
mov eax, dword [edi + 0x13c]
or eax, dword [edi + 0x138]
je 0x4b066c
mov ecx, dword [ebp - 0x3d4]
mov dword [esp], str.Open_Errors:
call fcn.00608a80
mov ecx, dword [edi + 0x13c]
mov edx, dword [edi + 0x138]
sub esp, 4
mov dword [esp], edx
mov dword [esp + 4], ecx
mov ecx, eax
call fcn.00475b80
sub esp, 8
mov dword [esp], eax
call fcn.00475870
jmp 0x4b066c
mov eax, dword [ebp - 0x3d4]
mov dword [esp], eax
call fcn.00475870
mov eax, dword [edi + 0x144]
or eax, dword [edi + 0x140]
je 0x4b064c
mov ecx, dword [ebp - 0x3d4]
mov dword [esp], str.Warnings:
call fcn.00608a80
mov ecx, dword [edi + 0x140]
mov ebx, dword [edi + 0x144]
sub esp, 4
mov dword [esp], ecx
mov dword [esp + 4], ebx
mov ecx, eax
call fcn.00475b80
sub esp, 8
mov dword [esp], eax
call fcn.00475870
jmp 0x4b064c
mov eax, dword [edi + 0x12c]
or eax, dword [edi + 0x128]
jne 0x4b05b8
mov byte [ebp - 0x3ed], 0
jmp 0x4b05f2
mov eax, dword [edi + 0xf8]
mov dword [edi], 0x771cbc
mov dword [edi + 4], 0x771cfc
mov dword [edi + 8], 0x771d14
test eax, eax
je 0x4b0f26
mov dword [esp], eax
call fcn.006febd0
mov eax, dword [edi + 0xec]
test eax, eax
je 0x4b0f38
mov dword [esp], eax
call fcn.006febd0
mov eax, dword [edi + 0xe0]
test eax, eax
je 0x4b0f4a
mov dword [esp], eax
call fcn.006febd0
mov ecx, dword [ebp - 0x400]
mov dword [edi + 8], 0x771b64
call fcn.004b19f0
mov dword [esp + 4], 0x168
mov dword [esp], edi
call fcn.006fec10
jmp 0x4b0927
mov edx, dword [ebp - 0x2b4]
xor ecx, ecx
mov eax, str.Virtual
call fcn.004ade70
mov edx, esi
mov ecx, edi
mov dword [esp], esi
mov dword [esp + 4], edi
mov eax, str.Global
call fcn.004ae040
mov edx, dword [ebp - 0x2d0]
xor ecx, ecx
mov eax, str.Physical
call fcn.004ade70
jmp 0x4b0cc1
mov dword [esp], str.Psapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
sub esp, 4
test eax, eax
je 0x4b0fdc
mov dword [esp + 4], str.GetProcessMemoryInfo
mov dword [esp], eax
call edi
test eax, eax
mov esi, eax
push edx
push edx
jne 0x4b0b26
mov dword [ebp - 0x3d4], 0
jmp 0x4b0b4e
mov ecx, dword [ebp - 0x3d4]
mov dword [esp], str.Folders:
call fcn.00608a80
mov ecx, dword [ebp - 0x2ec]
push edx
mov edx, dword [ebp - 0x2f0]
mov dword [esp + 4], ecx
mov ecx, eax
mov dword [esp], edx
call fcn.00475b80
push ecx
push ecx
mov dword [esp], eax
call fcn.00475870
mov eax, dword [ebp - 0x2e8]
xor eax, 1
or eax, dword [ebp - 0x2e4]
jne 0x4b06c5
mov eax, dword [ebp - 0x2ec]
or eax, dword [ebp - 0x2f0]
jne 0x4b06c5
mov eax, dword [ebp - 0x2dc]
or eax, dword [ebp - 0x2e0]
jne 0x4b06c5
jmp 0x4b0711
mov dword [esp], edi
call eax
sub esp, 4
jmp 0x4afee8
mov dword [esp], edi
call eax
sub esp, 4
jmp 0x4b0927
mov dword [esp], 4
call fcn.006fed60
mov dword [eax], str.Unsupported_archive_type
mov dword [esp + 8], 0
mov dword [esp + 4], 0x7658cc
mov dword [esp], eax
call fcn.006ff3c0
mov ebx, eax
mov eax, dword [ebp - 0x2d8]
test eax, eax
je 0x4b10b8
mov dword [esp], eax
call fcn.006febd0
mov eax, dword [ebp - 0x3a0]
test eax, eax
je 0x4b10ca
mov dword [esp], eax
call fcn.006febd0
mov esi, dword [ebp - 0x3a8]
lea edi, [esi*4 - 4]
test esi, esi
mov eax, dword [ebp - 0x3ac]
je 0x4b1126
mov dword [esp + 4], 0x20
mov eax, dword [eax + edi]
sub esi, 1
sub edi, 4
mov dword [esp], eax
call fcn.006fec10
jmp 0x4b10d7
mov dword [esp], 4
call fcn.006fed60
mov dword [eax], str.Unsupported_archive_type
mov dword [esp + 8], 0
mov dword [esp + 4], 0x7658cc
mov dword [esp], eax
call fcn.006ff3c0
test eax, eax
je 0x4b1132
mov dword [esp], eax
call fcn.006febd0
mov edi, dword [ebp - 0x3e4]
mov eax, dword [edi]
mov dword [esp], edi
call dword [eax + 8]
push eax
lea ecx, [ebp - 0x370]
call fcn.004b2920
lea ecx, [ebp - 0x218]
call fcn.0060b760
mov ecx, dword [ebp - 0x3e8]
call fcn.00607eb0
mov dword [esp], ebx
call fcn.005e6130
add edx, 1
mov dword [esp], eax
jne 0x4b1165
call fcn.006feee0
jmp 0x4b116a
mov eax, dword [edi]
mov dword [esp], edi
call dword [eax + 8]
push edx
mov ecx, esi
call fcn.00607eb0
mov ecx, dword [ebp - 0x3d0]
call fcn.00607eb0
jmp 0x4b10b8
mov dword [esp], 4
call fcn.006fed60
mov dword [eax], str.7_Zip_cannot_find_the_code_that_works_with_archives.
mov dword [esp + 8], 0
mov dword [esp + 4], 0x7658cc
mov dword [esp], eax
call fcn.006ff3c0
call fcn.00701658
mov ebx, eax
jmp 0x4b1132
call fcn.006ff430
jmp 0x4b116a
mov ecx, dword [ebp - 0x3d4]
mov dword [esp], str.Alternate_Streams:
call fcn.00608a80
mov ecx, dword [ebp - 0x2dc]
push edx
mov edx, dword [ebp - 0x2e0]
mov dword [esp + 4], ecx
mov ecx, eax
mov dword [esp], edx
call fcn.00475b80
push ecx
push ecx
mov dword [esp], eax
call fcn.00475870
mov ecx, dword [ebp - 0x3d4]
mov dword [esp], str.Alternate_Streams_Size:
call fcn.00608a80
mov ecx, dword [ebp - 0x2fc]
push edx
mov edx, dword [ebp - 0x300]
mov dword [esp + 4], ecx
mov ecx, eax
mov dword [esp], edx
call fcn.00475b80
push ecx
push ecx
mov dword [esp], eax
call fcn.00475870
jmp 0x4b0711
call fcn.006ff430
call fcn.006ff430
call fcn.006ff430
mov ebx, eax
lea eax, [ebp - 0x344]
lea esi, [ebp - 0x388]
mov dword [ebp - 0x3f8], eax
lea eax, [ebp - 0x394]
mov dword [ebp - 0x3d0], eax
mov ecx, dword [ebp - 0x3f8]
call fcn.00609aa0
jmp 0x4b1191
lea esi, [ebp - 0x344]
lea ecx, [ebp - 0x394]
mov dword [ebp - 0x3f8], esi
mov dword [ebp - 0x3d0], ecx
lea esi, [ebp - 0x388]
call fcn.00701658
lea ecx, [ebp - 0x2d4]
mov ebx, eax
mov dword [ebp - 0x2d8], 0x7713a8
call fcn.006076c0
mov eax, dword [ebp - 0x37c]
test eax, eax
je 0x4b1616
mov dword [esp], eax
call fcn.006febd0
jmp 0x4b1616