Function at 0x4a7800
Capabilities:
Accept command line arguments
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x47c
mov ebx, dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileApisToOEM]
mov dword [ebp - 0x3e0], 0
mov dword [ebp - 0x3dc], 0
test ebx, ebx
mov dword [ebp - 0x3d8], 0
je 0x4a8ea4
lea esi, [ebp - 0x3d4]
mov dword [esp], ebx
mov ecx, esi
call fcn.00472990
lea eax, [ebp - 0x3e0]
sub esp, 4
mov dword [esp], esi
mov dword [esp + 4], eax
mov dword [ebp - 0x44c], eax
call fcn.004ab810
mov eax, dword [ebp - 0x3d4]
test eax, eax
je 0x4a7878
mov dword [esp], eax
call fcn.006e9860
mov esi, dword [ebp - 0x3dc]
cmp esi, 1
je 0x4a8516
mov eax, dword [ebp - 0x3e0]
mov ebx, dword [eax]
test ebx, ebx
je 0x4a78bd
mov eax, dword [ebx]
test eax, eax
je 0x4a78a1
mov dword [esp], eax
call fcn.006e9860
mov dword [esp + 4], 0xc
mov dword [esp], ebx
call fcn.006e98a0
mov eax, dword [ebp - 0x3e0]
mov esi, dword [ebp - 0x3dc]
lea edx, [esi*4 - 4]
mov dword [esp], eax
mov dword [esp + 8], edx
lea edx, [eax + 4]
mov dword [esp + 4], edx
call sub.msvcrt.dll_memmove
lea ecx, [ebp - 0x1f0]
sub dword [ebp - 0x3dc], 1
mov byte [ebp - 0x217], 0
mov byte [ebp - 0x216], 0
mov byte [ebp - 0x215], 0
mov byte [ebp - 0x211], 0
mov byte [ebp - 0x210], 0
mov dword [ebp - 0x20c], 0
mov dword [ebp - 0x208], 0
mov dword [ebp - 0x204], 0
mov dword [ebp - 0x200], 0
mov dword [ebp - 0x1fc], 0
mov dword [ebp - 0x1f8], 0
call fcn.00472910
lea ecx, [ebp - 0x1b8]
mov dword [ebp - 0x1e0], 0
mov dword [ebp - 0x1dc], 0
mov dword [ebp - 0x1d8], 0
mov dword [ebp - 0x1d0], 0
mov dword [ebp - 0x1cc], 0
mov dword [ebp - 0x1c8], 0
mov dword [ebp - 0x1c4], 0
mov dword [ebp - 0x1c0], 0
mov dword [ebp - 0x1bc], 0
call fcn.00472910
lea ecx, [ebp - 0x194]
mov dword [ebp - 0x1ac], 0
mov dword [ebp - 0x1a8], 0
mov dword [ebp - 0x1a4], 0
mov dword [ebp - 0x1a0], 0
mov dword [ebp - 0x19c], 0
mov dword [ebp - 0x198], 0
call fcn.00472910
lea ecx, [ebp - 0x128]
mov byte [ebp - 0x188], 0
mov byte [ebp - 0x187], 0
mov byte [ebp - 0x185], 0
mov byte [ebp - 0x183], 0
mov byte [ebp - 0x181], 0
mov byte [ebp - 0x180], 0
mov byte [ebp - 0x17f], 0
mov byte [ebp - 0x186], 1
mov byte [ebp - 0x184], 1
mov byte [ebp - 0x182], 1
mov byte [ebp - 0x17c], 0
mov byte [ebp - 0x17b], 0
mov byte [ebp - 0x17a], 0
mov byte [ebp - 0x179], 0
mov byte [ebp - 0x178], 0
mov byte [ebp - 0x177], 0
mov byte [ebp - 0x176], 0
mov byte [ebp - 0x175], 0
mov byte [ebp - 0x170], 0
mov dword [ebp - 0x168], 0xffffffff
mov byte [ebp - 0x160], 0
mov byte [ebp - 0x15f], 0
mov byte [ebp - 0x15e], 0
mov byte [ebp - 0x15d], 0
mov byte [ebp - 0x15c], 0
mov byte [ebp - 0x158], 1
mov byte [ebp - 0x157], 1
mov byte [ebp - 0x156], 0
mov byte [ebp - 0x155], 0
mov byte [ebp - 0x154], 0
mov byte [ebp - 0x153], 0
mov dword [ebp - 0x150], 0
mov dword [ebp - 0x14c], 0
mov byte [ebp - 0x164], 1
mov byte [ebp - 0x163], 1
mov byte [ebp - 0x162], 1
mov byte [ebp - 0x161], 1
mov byte [ebp - 0x15a], 1
mov byte [ebp - 0x159], 1
mov byte [ebp - 0x15b], 1
mov dword [ebp - 0x148], 0
mov dword [ebp - 0x144], 0
mov dword [ebp - 0x140], 0
mov dword [ebp - 0x138], 0
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x130], 0
mov byte [ebp - 0x12c], 1
call fcn.00472910
lea ecx, [ebp - 0x11c]
call fcn.00472910
lea ecx, [ebp - 0x110]
call fcn.00472910
lea ecx, [ebp - 0x104]
call fcn.00472910
lea ecx, [ebp - 0xf8]
call fcn.00472910
lea ecx, [ebp - 0xe8]
mov byte [ebp - 0xec], 0
call fcn.00472910
lea ecx, [ebp - 0xdc]
call fcn.00472910
lea ecx, [ebp - 0xc8]
mov dword [ebp - 0xd0], 0
mov byte [ebp - 0xcc], 0
call fcn.00472910
lea ecx, [ebp - 0xb8]
mov byte [ebp - 0xbc], 0
mov byte [ebp - 0xbb], 0
call fcn.00472910
lea ecx, [ebp - 0xa8]
mov byte [ebp - 0xac], 0
mov byte [ebp - 0xab], 0
mov byte [ebp - 0xaa], 0
call fcn.00472910
lea ecx, [ebp - 0x9c]
call fcn.00472910
lea ecx, [ebp - 0x8c]
mov dword [ebp - 0x90], 0
call fcn.00472910
lea ebx, [ebp - 0x44]
mov byte [ebp - 0x80], 0
mov byte [ebp - 0x7f], 0
mov byte [ebp - 0x7e], 0
mov byte [ebp - 0x7d], 0
mov ecx, ebx
mov byte [ebp - 0x7c], 0
mov byte [ebp - 0x7b], 0
mov byte [ebp - 0x7a], 0
mov byte [ebp - 0x79], 0
mov byte [ebp - 0x78], 0
mov byte [ebp - 0x77], 0
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 0
mov byte [ebp - 0x4c], 0
mov byte [ebp - 0x4b], 0
mov byte [ebp - 0x4a], 0
mov dword [ebp - 0x48], 0
call fcn.00472910
lea ecx, [ebp - 0x370]
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x28], 2
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x20], 0
call fcn.00492c90
lea eax, [ebp - 0x218]
lea ecx, [ebp - 0x370]
mov dword [ebp - 0x448], eax
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x44c]
mov dword [esp], eax
call fcn.00492cb0
mov eax, dword [ebp - 0x2c]
sub esp, 8
cmp eax, 1
je 0x4a7d25
cmp eax, 2
mov edx, 0
mov eax, 0x855a08
cmovne eax, edx
mov dword [0x855a04], eax
mov eax, dword [ebp - 0x28]
cmp eax, 2
je 0x4a7d42
cmp eax, 1
mov edx, 0
mov eax, 0x855a10
cmovne eax, edx
mov dword [0x855a00], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x430], 0
test eax, eax
je 0x4a7d69
cmp eax, 2
mov edx, 0x855a10
mov eax, 0x855a08
cmovne eax, edx
mov dword [ebp - 0x430], eax
movzx eax, byte [ebp - 0x218]
test al, al
mov byte [ebp - 0x441], al
jne 0x4a7fe0
mov dword [esp + 4], 1
mov dword [esp], str.SeRestorePrivilege
call fcn.004b86a0
mov dword [esp + 4], 1
mov dword [esp], str.SeCreateSymbolicLinkPrivilege
call fcn.004b86a0
cmp byte [ebp - 0x20f], 0
jne 0x4a8e82
mov eax, dword [ebp - 0x448]
lea ecx, [ebp - 0x370]
mov dword [esp], eax
call fcn.004944a0
mov esi, dword [ebp - 0x20]
sub esp, 4
mov dword [ebp - 0x450], 2
test esi, esi
je 0x4a7df0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x24], eax
setne al
movzx eax, al
add eax, 1
mov dword [ebp - 0x450], eax
mov ecx, dword [ebp - 0x430]
test ecx, ecx
je 0x4a931c
mov dword [esp], 0xfffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
lea edi, [ebp - 0x2d8]
sub esp, 4
mov dword [esp], eax
mov dword [esp + 4], edi
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
sub esp, 8
test eax, eax
mov eax, 0x50
cmovne ax, word [ebp - 0x2d8]
cwde
mov dword [ebp - 0x440], eax
mov dword [esp], 0x18
call fcn.006e98d0
mov ecx, eax
mov dword [eax], 0x75cc88
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
mov dword [eax + 4], 1
mov dword [ebp - 0x424], eax
movzx eax, byte [ebp - 0x216]
mov byte [ecx + 0x14], al
movzx eax, byte [ebp - 0x215]
mov byte [ecx + 0x15], al
call fcn.0046f440
test eax, eax
mov dword [ebp - 0x42c], eax
jne 0x4aa8b5
lea ecx, [ebp - 0x1f4]
call fcn.00492be0
mov edi, dword [ebp - 0x424]
mov byte [ebp - 0x438], al
mov edx, dword [edi + 0xc]
test edx, edx
jne 0x4a7edd
test al, al
jne 0x4a80af
cmp dword [ebp - 0x1f4], 6
je 0x4a80af
lea ecx, [ebp - 0x1f4]
call fcn.00492c10
test al, al
jne 0x4a80af
lea eax, [ebp - 0x3c8]
mov dword [esp + 4], ebx
mov dword [ebp - 0x3c8], 0
mov dword [ebp - 0x3c4], 0
mov dword [ebp - 0x3c0], 0
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x424]
mov dword [esp], eax
call fcn.0049f0b0
test al, al
je 0x4aa716
lea eax, [ebp - 0x2d8]
mov dword [ebp - 0x3bc], 0
mov dword [ebp - 0x3b8], 0
mov dword [ebp - 0x3b4], 0
mov dword [ebp - 0x410], 0
mov dword [ebp - 0x428], eax
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x4a81c5
nop
mov eax, dword [ebp - 0x428]
mov edi, dword [ebp - 0x410]
mov dword [ebp - 0x2d8], 0
mov ecx, dword [ebp - 0x424]
mov dword [ebp - 0x2d4], 0
mov dword [ebp - 0x2d0], 0
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + edi*4]
mov dword [esp], eax
call fcn.0046ef80
sub esp, 8
test al, al
je 0x4a7fb6
cmp dword [ebp - 0x2d4], 1
je 0x4a80e0
mov dword [esp], 4
call fcn.006e99f0
mov dword [eax], str.Unsupported_archive_type
mov dword [esp + 8], 0
mov dword [esp + 4], 0x75056c
mov dword [esp], eax
call fcn.006ea150
mov ebx, dword [0x855a04]
test ebx, ebx
je 0x4a8e73
mov eax, dword [ebx]
mov dword [esp + 8], 0x42
mov dword [esp + 4], 1
mov dword [esp], str._n7_Zip__r___32__16.02_:_Igor_Pavlov_:_Public_domain_:_2016_05_21_n_n
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov dword [esp], str.Usage:_7zr__command____switches_...___archive_name____file_names_...__n__________listfiles...___n_n_Commands__n__a_:_Add_files_to_archive_n__b_:_Benchmark_n__d_:_Delete_files_from_archive_n__e_:_Extract_files_from_archive__without_using_directory_names__n__h_:_Calculate_hash_values_for_files_n__i_:_Show_information_about_supported_formats_n__l_:_List_contents_of_archive_n__rn_:_Rename_files_in_archive_n__t_:_Test_integrity_of_archive_n__u_:_Update_files_to_archive_n__x_:_eXtract_files_with_full_paths_n_n_Switches__n_____:_Stop_switches_parsing_n___ai_r__0___listfile_wildcard_:_Include_archives_n___ax_r__0___listfile_wildcard_:_eXclude_archives_n___aoastu_:_set_Overwrite_mode_n___an_:_disable_archive_name_field_n___bb_0_3__:_set_output_log_level_n___bd_:_disable_progress_indicator_n___bsoep012_:_set_output_stream_for_output_error_progress_line_n___bt_:_show_execution_time_statistics_n___i_r__0___listfile_wildcard_:_Include_filenames_n___mParameters_:_set_compression_Method_n_____mmt_N__:_set_number_of_CPU_threads_n___oDirectory_:_set_Output_directory_n___r__0__:_Recurse_subdirectories_n___saaes_:_set_Archive_name_mode_n___sccUTF_8WINDOS_:_set_charset_for_for_console_input_output_n___scsUTF_8UTF_16LEUTF_16BEWINDOSid_:_set_charset_for_list_files_n___scrc_CRC32CRC64SHA1SHA256__:_set_hash_function_for_x__e__h_commands_n___sdel_:_delete_files_after_compression_n___seml_.__:_send_archive_by_email_n___sfx_name__:_Create_SFX_archive_n___si_name__:_read_data_from_stdin_n___slp_:_set_Large_Pages_mode_n___slt_:_show_technical_information_for_l__List__command_n___snh_:_store_hard_links_as_links_n___snl_:_store_symbolic_links_as_links_n___sni_:_store_NT_security_information_n___sns____:_store_NTFS_alternate_streams_n___so_:_write_data_to_stdout_n___spd_:_disable_wildcard_matching_for_file_names_n___spe_:_eliminate_duplication_of_root_folder_for_extract_command_n___spf_:_use_fully_qualified_file_paths_n___ssc____:_set_sensitive_case_mode_n___ssw_:_compress_shared_files_n___stl_:_set_archive_timestamp_from_the_most_recently_modified_file_n___stmHexMask_:_set_CPU_thread_affinity_mask__hexadecimal_number__n___stxType_:_exclude_archive_type_n___tType_:_Set_type_of_archive_n___u____p__q__r__x__y__z___newArchiveName__:_Update_options_n___vSize_bkmg__:_Create_volumes_n___w_path__:_assign_Work_directory._Empty_path_means_a_temporary_directory_n___x_r__0___listfile_wildcard_:_eXclude_filenames_n___y_:_assume_Yes_on_all_queries_n
mov ecx, ebx
call fcn.006047c0
mov dword [ebp - 0x420], 0
sub esp, 4
lea ecx, [ebp - 0x370]
call fcn.004abc60
mov ecx, dword [ebp - 0x448]
call fcn.00606f10
mov esi, dword [ebp - 0x3dc]
test esi, esi
je 0x4a855e
mov eax, dword [ebp - 0x3e0]
lea edi, [esi*4 - 4]
lea esi, [esi]
mov ebx, dword [eax + edi]
sub esi, 1
test ebx, ebx
je 0x4a808e
mov eax, dword [ebx]
test eax, eax
je 0x4a8078
mov dword [esp], eax
call fcn.006e9860
mov dword [esp + 4], 0xc
mov dword [esp], ebx
call fcn.006e98a0
mov eax, dword [ebp - 0x3e0]
sub edi, 4
test esi, esi
jne 0x4a8060
test eax, eax
je 0x4a80a1
mov dword [esp], eax
call fcn.006e9860
mov eax, dword [ebp - 0x420]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 4
call fcn.006e99f0
mov dword [eax], str.7_Zip_cannot_find_the_code_that_works_with_archives.
mov dword [esp + 8], 0
mov dword [esp + 4], 0x75056c
mov dword [esp], eax
call fcn.006ea150
lea esi, [esi]
mov eax, dword [ebp - 0x2d8]
mov edi, dword [ebp - 0x3bc]
xor ebx, ebx
mov dword [ebp - 0x420], eax
mov esi, dword [eax]
mov eax, dword [ebp - 0x3b8]
mov dword [ebp - 0x418], eax
mov ecx, eax
cmp ebx, ecx
je 0x4a8150
lea edx, [ebx + ecx]
shr edx, 1
cmp esi, dword [edi + edx*4]
je 0x4a8459
jge 0x4a850d
mov eax, dword [ebp - 0x410]
mov ecx, eax
jmp 0x4a8146
lea eax, [ebx + edx]
shr eax, 1
cmp esi, dword [edi + eax*4]
je 0x4a8453
jge 0x4a8470
mov edx, eax
cmp ebx, edx
jne 0x4a8130
mov dword [ebp - 0x410], ecx
mov eax, dword [ebp - 0x418]
cmp eax, dword [ebp - 0x3b4]
je 0x4a8480
mov edx, dword [ebp - 0x418]
lea eax, [ebx*4]
sub edx, ebx
shl edx, 2
mov dword [esp + 8], edx
lea edx, [edi + eax]
lea eax, [edi + eax + 4]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_memmove
mov eax, dword [ebp - 0x3bc]
mov dword [eax + ebx*4], esi
mov eax, dword [ebp - 0x2d8]
add dword [ebp - 0x3b8], 1
test eax, eax
mov dword [ebp - 0x420], eax
jne 0x4a845f
add dword [ebp - 0x410], 1
mov eax, dword [ebp - 0x410]
cmp eax, dword [ebp - 0x34]
jb 0x4a7f60
mov eax, dword [ebp - 0x1f4]
cmp eax, 8
je 0x4a8698
cmp eax, 6
je 0x4a81e6
cmp byte [ebp - 0x438], 0
je 0x4aa7a5
cmp byte [ebp - 0x211], 0
mov dword [ebp - 0x398], 0
mov dword [ebp - 0x394], 0
mov dword [ebp - 0x390], 0
mov dword [ebp - 0x38c], 0
mov dword [ebp - 0x388], 0
mov dword [ebp - 0x384], 0
je 0x4a8eb1
mov dword [esp], 0xc
call fcn.006e98d0
mov esi, eax
lea eax, [ebp - 0x1b8]
mov ecx, esi
mov dword [esp], eax
call fcn.00472a10
sub esp, 4
mov eax, dword [ebp - 0x394]
cmp eax, dword [ebp - 0x390]
je 0x4a862f
mov edi, dword [ebp - 0x398]
mov dword [edi + eax*4], esi
add eax, 1
mov dword [esp], 0xc
mov dword [ebp - 0x394], eax
call fcn.006e98d0
mov esi, eax
lea eax, [ebp - 0x1b8]
mov ecx, esi
mov dword [esp], eax
call fcn.00472a10
sub esp, 4
mov eax, dword [ebp - 0x388]
cmp eax, dword [ebp - 0x384]
je 0x4aa01c
mov edi, dword [ebp - 0x38c]
mov dword [edi + eax*4], esi
add eax, 1
mov dword [ebp - 0x388], eax
cmp byte [ebp - 0x438], 0
mov dword [ebp - 0x420], 0
jne 0x4a932b
mov edi, dword [ebp - 0x388]
mov eax, dword [ebp - 0x38c]
test edi, edi
je 0x4a831c
lea ebx, [edi*4 - 4]
mov esi, dword [eax + ebx]
sub edi, 1
test esi, esi
je 0x4a8315
mov eax, dword [esi]
test eax, eax
je 0x4a82ff
mov dword [esp], eax
call fcn.006e9860
mov dword [esp + 4], 0xc
mov dword [esp], esi
call fcn.006e98a0
mov eax, dword [ebp - 0x38c]
sub ebx, 4
test edi, edi
jne 0x4a82e7
test eax, eax
je 0x4a8328
mov dword [esp], eax
call fcn.006e9860
mov edi, dword [ebp - 0x394]
mov eax, dword [ebp - 0x398]
test edi, edi
je 0x4a8374
lea ebx, [edi*4 - 4]
mov esi, dword [eax + ebx]
sub edi, 1
test esi, esi
je 0x4a836d
mov eax, dword [esi]
test eax, eax
je 0x4a8357
mov dword [esp], eax
call fcn.006e9860
mov dword [esp + 4], 0xc
mov dword [esp], esi
call fcn.006e98a0
mov eax, dword [ebp - 0x398]
sub ebx, 4
test edi, edi
jne 0x4a833f
test eax, eax
je 0x4a8380
mov dword [esp], eax
call fcn.006e9860
cmp byte [ebp - 0x1e3], 0
je 0x4a83d7
mov ecx, dword [0x855a04]
test ecx, ecx
je 0x4a83d7
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call ebx
lea edx, [ebp - 0x3f0]
mov dword [esp], eax
mov dword [esp + 0x10], edx
lea edx, [ebp - 0x3f8]
mov dword [esp + 0xc], edx
lea edx, [ebp - 0x400]
mov dword [esp + 8], edx
lea edx, [ebp - 0x408]
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
sub esp, 0x14
test eax, eax
jne 0x4a91d5
mov edx, dword [ebp - 0x42c]
test edx, edx
jne 0x4aa77e
mov eax, dword [ebp - 0x3bc]
test eax, eax
je 0x4a83f7
mov dword [esp], eax
call fcn.006e9860
mov ebx, dword [ebp - 0x3c4]
test ebx, ebx
je 0x4a842b
lea esi, [ebx*4 - 4]
mov eax, dword [ebp - 0x3c8]
mov dword [esp + 4], 0x20
sub ebx, 1
mov eax, dword [eax + esi]
sub esi, 4
mov dword [esp], eax
call fcn.006e98a0
test ebx, ebx
jne 0x4a8408
mov eax, dword [ebp - 0x3c8]
test eax, eax
je 0x4a843d
mov dword [esp], eax
call fcn.006e9860
mov edi, dword [ebp - 0x424]
mov eax, dword [edi]
mov dword [esp], edi
call dword [eax + 8]
sub esp, 4
jmp 0x4a802b
mov dword [ebp - 0x410], ecx
mov eax, dword [ebp - 0x420]
mov dword [esp], eax
call fcn.006e9860
jmp 0x4a81af
mov dword [ebp - 0x410], ecx
lea ebx, [eax + 1]
mov ecx, edx
jmp 0x4a8104
mov edi, eax
shr eax, 2
lea eax, [edi + eax + 1]
cmp eax, 0x1fffffff
mov dword [ebp - 0x420], eax
ja 0x4aa8ba
shl eax, 2
mov dword [esp], eax
call fcn.006e98b0
mov edi, eax
mov eax, dword [ebp - 0x3b8]
mov edx, dword [ebp - 0x3bc]
test eax, eax
mov dword [ebp - 0x418], eax
jne 0x4a84ec
test edx, edx
je 0x4a84d5
mov dword [esp], edx
call fcn.006e9860
mov eax, dword [ebp - 0x3b8]
mov dword [ebp - 0x418], eax
mov eax, dword [ebp - 0x420]
mov dword [ebp - 0x3bc], edi
mov dword [ebp - 0x3b4], eax
jmp 0x4a8162
shl eax, 2
mov dword [esp + 4], edx
mov dword [esp], edi
mov dword [esp + 8], eax
mov dword [ebp - 0x418], edx
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0x418]
jmp 0x4a84c1
mov eax, edx
mov edx, ecx
jmp 0x4a8476
mov ebx, dword [0x855a04]
test ebx, ebx
je 0x4a8620
mov ecx, ebx
mov dword [esp], str._n7_Zip__r___32__16.02_:_Igor_Pavlov_:_Public_domain_:_2016_05_21_n_n
call fcn.006047c0
sub esp, 4
mov ecx, ebx
mov dword [esp], str.Usage:_7zr__command____switches_...___archive_name____file_names_...__n__________listfiles...___n_n_Commands__n__a_:_Add_files_to_archive_n__b_:_Benchmark_n__d_:_Delete_files_from_archive_n__e_:_Extract_files_from_archive__without_using_directory_names__n__h_:_Calculate_hash_values_for_files_n__i_:_Show_information_about_supported_formats_n__l_:_List_contents_of_archive_n__rn_:_Rename_files_in_archive_n__t_:_Test_integrity_of_archive_n__u_:_Update_files_to_archive_n__x_:_eXtract_files_with_full_paths_n_n_Switches__n_____:_Stop_switches_parsing_n___ai_r__0___listfile_wildcard_:_Include_archives_n___ax_r__0___listfile_wildcard_:_eXclude_archives_n___aoastu_:_set_Overwrite_mode_n___an_:_disable_archive_name_field_n___bb_0_3__:_set_output_log_level_n___bd_:_disable_progress_indicator_n___bsoep012_:_set_output_stream_for_output_error_progress_line_n___bt_:_show_execution_time_statistics_n___i_r__0___listfile_wildcard_:_Include_filenames_n___mParameters_:_set_compression_Method_n_____mmt_N__:_set_number_of_CPU_threads_n___oDirectory_:_set_Output_directory_n___r__0__:_Recurse_subdirectories_n___saaes_:_set_Archive_name_mode_n___sccUTF_8WINDOS_:_set_charset_for_for_console_input_output_n___scsUTF_8UTF_16LEUTF_16BEWINDOSid_:_set_charset_for_list_files_n___scrc_CRC32CRC64SHA1SHA256__:_set_hash_function_for_x__e__h_commands_n___sdel_:_delete_files_after_compression_n___seml_.__:_send_archive_by_email_n___sfx_name__:_Create_SFX_archive_n___si_name__:_read_data_from_stdin_n___slp_:_set_Large_Pages_mode_n___slt_:_show_technical_information_for_l__List__command_n___snh_:_store_hard_links_as_links_n___snl_:_store_symbolic_links_as_links_n___sni_:_store_NT_security_information_n___sns____:_store_NTFS_alternate_streams_n___so_:_write_data_to_stdout_n___spd_:_disable_wildcard_matching_for_file_names_n___spe_:_eliminate_duplication_of_root_folder_for_extract_command_n___spf_:_use_fully_qualified_file_paths_n___ssc____:_set_sensitive_case_mode_n___ssw_:_compress_shared_files_n___stl_:_set_archive_timestamp_from_the_most_recently_modified_file_n___stmHexMask_:_set_CPU_thread_affinity_mask__hexadecimal_number__n___stxType_:_exclude_archive_type_n___tType_:_Set_type_of_archive_n___u____p__q__r__x__y__z___newArchiveName__:_Update_options_n___vSize_bkmg__:_Create_volumes_n___w_path__:_assign_Work_directory._Empty_path_means_a_temporary_directory_n___x_r__0___listfile_wildcard_:_eXclude_filenames_n___y_:_assume_Yes_on_all_queries_n
call fcn.006047c0
mov esi, dword [ebp - 0x3dc]
sub esp, 4
mov dword [ebp - 0x420], 0
test esi, esi
jne 0x4a804f
mov eax, dword [ebp - 0x3e0]
jmp 0x4a8095
mov eax, dword [ebp - 0x3bc]
test eax, eax
je 0x4a8596
mov dword [esp], eax
call fcn.006e9860
mov esi, dword [ebp - 0x3c4]
test esi, esi
lea edi, [esi*4 - 4]
je 0x4a85ca
mov eax, dword [ebp - 0x3c8]
mov dword [esp + 4], 0x20
sub esi, 1
mov eax, dword [eax + edi]
sub edi, 4
mov dword [esp], eax
call fcn.006e98a0
test esi, esi
jne 0x4a85a7
mov eax, dword [ebp - 0x3c8]
test eax, eax
je 0x4a85e0
mov dword [esp], eax
call fcn.006e9860
jmp 0x4a85e0
mov edi, dword [ebp - 0x424]
mov eax, dword [edi]
mov dword [esp], edi
call dword [eax + 8]
sub esp, 4
lea ecx, [ebp - 0x370]
call fcn.004abc60
mov ecx, dword [ebp - 0x448]
call fcn.00606f10
mov ecx, dword [ebp - 0x44c]
call fcn.00603750
mov dword [esp], ebx
call fcn.005d5ce0
lea esi, [esi]
mov dword [ebp - 0x420], 0
jmp 0x4a804f
mov edx, eax
shr edx, 2
lea ebx, [eax + edx + 1]
cmp ebx, 0x1fffffff
ja 0x4aa8b0
lea eax, [ebx*4]
mov dword [esp], eax
call fcn.006e98b0
mov edi, eax
mov eax, dword [ebp - 0x394]
mov ecx, dword [ebp - 0x398]
test eax, eax
mov dword [ebp - 0x410], ecx
jne 0x4aa898
test ecx, ecx
je 0x4a8687
mov eax, dword [ebp - 0x410]
mov dword [esp], eax
call fcn.006e9860
mov eax, dword [ebp - 0x394]
mov dword [ebp - 0x398], edi
mov dword [ebp - 0x390], ebx
jmp 0x4a8268
mov edi, dword [0x855a04]
mov eax, 0x855a10
test edi, edi
cmove edi, eax
mov dword [esp], edi
call fcn.00474030
mov ecx, edi
mov dword [esp], str.Formats:
call fcn.006047c0
sub esp, 4
mov dword [esp], eax
call fcn.00474030
mov eax, dword [ebp - 0x424]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x4a8a86
mov dword [ebp - 0x428], 0
mov eax, dword [ebp - 0x424]
mov ecx, dword [ebp - 0x428]
mov eax, dword [eax + 8]
mov eax, dword [eax + ecx*4]
mov esi, eax
mov dword [ebp - 0x418], eax
mov eax, dword [edi]
mov dword [esp + 8], 2
mov dword [esp + 4], 1
mov dword [esp], 0x732dd2
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
cmp byte [esi + 0x28], 1
mov edx, dword [edi]
mov dword [esp + 4], edx
sbb eax, eax
and eax, 0xffffffdd
add eax, 0x43
mov dword [esp], eax
call sub.msvcrt.dll_fputc
xor ebx, ebx
lea esi, [esi]
mov eax, dword [ebp - 0x418]
mov edx, dword [eax]
mov eax, 0x20
bt edx, ebx
jae 0x4a8759
movzx eax, byte [ebx + str.KSNFMGOPBELH]
mov edx, dword [edi]
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_fputc
add ebx, 1
cmp ebx, 0xc
jne 0x4a8740
mov eax, dword [edi]
mov dword [esp], 0x20
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputc
mov eax, dword [ebp - 0x418]
mov ecx, edi
mov ebx, dword [eax + 0x10]
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call fcn.00474070
sub esp, 4
cmp ebx, 7
ja 0x4a87ba
nop
mov eax, dword [edi]
mov dword [esp], 0x20
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputc
add ebx, 1
cmp ebx, 8
jne 0x4a87a0
mov eax, dword [edi]
mov dword [esp], 0x20
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputc
lea ecx, [ebp - 0x2d8]
call fcn.00472910
mov eax, dword [ebp - 0x418]
mov eax, dword [eax + 0x1c]
test eax, eax
je 0x4a889b
xor ebx, ebx
lea esi, [esi]
mov eax, dword [ebp - 0x418]
lea ecx, [ebp - 0x2d8]
mov eax, dword [eax + 0x18]
mov esi, dword [eax + ebx*4]
mov dword [esp], esi
call fcn.00472f80
mov eax, dword [esi + 0x10]
sub esp, 4
test eax, eax
jne 0x4a8833
mov eax, dword [ebp - 0x418]
add ebx, 1
cmp dword [eax + 0x1c], ebx
jbe 0x4a889b
test ebx, ebx
je 0x4a87f0
lea ecx, [ebp - 0x2d8]
call fcn.00472c90
jmp 0x4a87f0
lea ecx, [ebp - 0x2d8]
mov dword [esp], 0x732de2
call fcn.00472e80
sub esp, 4
add esi, 0xc
lea ecx, [ebp - 0x2d8]
mov dword [esp], esi
call fcn.00472f80
sub esp, 4
mov eax, dword [ebp - 0x2d4]
cmp dword [ebp - 0x2d0], eax
je 0x4a8a30
mov edx, dword [ebp - 0x2d8]
xor esi, esi
mov ecx, 0x29
add ebx, 1
mov word [edx + eax*2], cx
mov word [edx + eax*2 + 2], si
add eax, 1
mov dword [ebp - 0x2d4], eax
mov eax, dword [ebp - 0x418]
cmp dword [eax + 0x1c], ebx
ja 0x4a8822
mov eax, dword [ebp - 0x2d8]
mov ecx, edi
mov ebx, dword [ebp - 0x2d4]
mov dword [esp], eax
call fcn.00474070
sub esp, 4
cmp ebx, 0xc
ja 0x4a88da
lea esi, [esi]
mov eax, dword [edi]
mov dword [esp], 0x20
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputc
add ebx, 1
cmp ebx, 0xd
jne 0x4a88c0
mov eax, dword [edi]
mov dword [esp], 0x20
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputc
mov eax, dword [ebp - 0x418]
mov ebx, dword [eax + 0x2c]
test ebx, ebx
jne 0x4a8e10
mov esi, dword [eax + 0x34]
test esi, esi
je 0x4a8a50
mov dword [ebp - 0x420], 0
mov eax, dword [ebp - 0x418]
mov ecx, dword [ebp - 0x420]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + ecx*4]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x410], eax
test ecx, ecx
je 0x4a89e2
xor esi, esi
mov esi, esi
lea edi, [edi]
mov eax, dword [eax]
movzx ebx, byte [eax + esi]
lea eax, [ebx - 0x21]
cmp al, 0x5e
jbe 0x4a89c6
mov edx, ebx
shr dl, 4
lea ecx, [edx + 0x30]
lea eax, [edx + 0x37]
cmp dl, 9
mov edx, dword [edi]
cmovbe eax, ecx
movsx eax, al
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_fputc
and ebx, 0xf
lea edx, [ebx + 0x37]
lea eax, [ebx + 0x30]
cmp bl, 0xa
cmovae eax, edx
mov edx, dword [edi]
movsx eax, al
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_fputc
mov eax, dword [ebp - 0x410]
add esi, 1
cmp esi, dword [eax + 4]
jae 0x4a89e2
test esi, esi
je 0x4a8940
mov eax, dword [edi]
mov dword [esp], 0x20
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputc
mov eax, dword [ebp - 0x410]
mov eax, dword [eax]
movzx ebx, byte [eax + esi]
lea eax, [ebx - 0x21]
cmp al, 0x5e
ja 0x4a894d
mov eax, dword [edi]
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputc
mov eax, dword [ebp - 0x410]
add esi, 1
cmp esi, dword [eax + 4]
jb 0x4a899d
mov ecx, dword [ebp - 0x418]
add dword [ebp - 0x420], 1
mov eax, dword [ebp - 0x420]
cmp eax, dword [ecx + 0x34]
jae 0x4a8a50
mov ebx, dword [ebp - 0x420]
test ebx, ebx
je 0x4a8912
mov eax, dword [edi]
mov dword [esp + 8], 6
mov dword [esp + 4], 1
mov dword [esp], 0x732df0
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
jmp 0x4a8912
lea ecx, [ebp - 0x2d8]
call fcn.004723e0
mov eax, dword [ebp - 0x2d4]
jmp 0x4a886e
mov dword [esp], edi
call fcn.00474030
mov eax, dword [ebp - 0x2d8]
test eax, eax
je 0x4a8a6a
mov dword [esp], eax
call fcn.006e9860
mov ecx, dword [ebp - 0x424]
add dword [ebp - 0x428], 1
mov eax, dword [ebp - 0x428]
cmp dword [ecx + 0xc], eax
ja 0x4a86e4
mov dword [esp], edi
call fcn.00474030
mov ecx, edi
mov dword [esp], str.Codecs:
call fcn.006047c0
sub esp, 4
mov dword [esp], eax
call fcn.00474030
mov eax, dword [0x855b80]
test eax, eax
je 0x4a8c24
mov dword [ebp - 0x410], 0
mov eax, dword [ebp - 0x410]
mov esi, dword [eax*4 + 0x855a80]
mov eax, dword [edi]
mov dword [esp + 8], 2
mov dword [esp + 4], 1
mov dword [esp], 0x732dd2
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [edi]
mov dword [esp], 0x20
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputc
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x4a8e5c
mov dword [esp], eax
mov ecx, edi
call fcn.00474310
sub esp, 4
cmp dword [esi + 4], 1
mov edx, dword [edi]
mov dword [esp + 4], edx
sbb eax, eax
and eax, 0xffffffdb
add eax, 0x45
mov dword [esp], eax
call sub.msvcrt.dll_fputc
cmp dword [esi], 1
mov edx, dword [edi]
mov dword [esp + 4], edx
sbb eax, eax
and eax, 0xffffffdc
add eax, 0x44
mov dword [esp], eax
call sub.msvcrt.dll_fputc
mov eax, dword [edi]
mov dword [esp], 0x20
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputc
lea eax, [ebp - 0x344]
mov dword [esp + 8], eax
mov eax, dword [esi + 8]
mov edx, dword [esi + 0xc]
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.004aca30
lea eax, [ebp - 0x344]
lea ecx, [ebp - 0x3a4]
mov dword [esp], eax
call fcn.00471330
mov ebx, dword [ebp - 0x3a0]
sub esp, 4
cmp ebx, 7
ja 0x4a8bba
nop
lea esi, [esi]
mov eax, dword [edi]
mov dword [esp], 0x20
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputc
add ebx, 1
cmp ebx, 8
jne 0x4a8ba0
mov eax, dword [edi]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x3a4]
mov dword [esp], eax
call sub.msvcrt.dll_fputs
mov eax, dword [ebp - 0x3a4]
test eax, eax
je 0x4a8be0
mov dword [esp], eax
call fcn.006e9860
mov eax, dword [edi]
mov ebx, dword [esi + 0x10]
mov dword [esp], 0x20
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputc
mov eax, dword [edi]
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
mov dword [esp], edi
call fcn.00474030
add dword [ebp - 0x410], 1
mov eax, dword [ebp - 0x410]
cmp dword [0x855b80], eax
ja 0x4a8ac4
mov dword [esp], edi
call fcn.00474030
mov ecx, edi
mov dword [esp], str.Hashers:
call fcn.006047c0
sub esp, 4
mov dword [esp], eax
call fcn.00474030
mov edx, dword [0x855a60]
test edx, edx
je 0x4a8de4
mov dword [ebp - 0x410], 0
mov eax, dword [ebp - 0x410]
mov esi, dword [eax*4 + 0x855a20]
mov eax, dword [edi]
mov dword [esp + 8], 2
mov dword [esp + 4], 1
mov dword [esp], 0x732dd2
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [edi]
mov dword [esp], 0x20
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputc
lea eax, [ebp - 0x380]
mov dword [esp + 4], eax
mov eax, dword [esi + 0x14]
mov dword [esp], eax
call fcn.004ac330
lea eax, [ebp - 0x380]
lea ecx, [ebp - 0x398]
mov dword [esp], eax
call fcn.00471330
mov ebx, dword [ebp - 0x394]
sub esp, 4
cmp ebx, 3
ja 0x4a8cef
mov eax, dword [edi]
mov dword [esp], 0x20
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputc
add ebx, 1
cmp ebx, 4
jne 0x4a8cd5
mov eax, dword [edi]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x398]
mov dword [esp], eax
call sub.msvcrt.dll_fputs
mov eax, dword [ebp - 0x398]
test eax, eax
je 0x4a8d15
mov dword [esp], eax
call fcn.006e9860
mov eax, dword [edi]
mov dword [esp], 0x20
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputc
lea ebx, [ebp - 0x310]
mov dword [esp + 8], ebx
mov eax, dword [esi + 8]
mov edx, dword [esi + 0xc]
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.004aca30
lea ecx, [ebp - 0x38c]
mov dword [esp], ebx
call fcn.00471330
mov ebx, dword [ebp - 0x388]
sub esp, 4
cmp ebx, 7
ja 0x4a8d7a
nop
mov eax, dword [edi]
mov dword [esp], 0x20
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputc
add ebx, 1
cmp ebx, 8
jne 0x4a8d60
mov eax, dword [edi]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38c]
mov dword [esp], eax
call sub.msvcrt.dll_fputs
mov eax, dword [ebp - 0x38c]
test eax, eax
je 0x4a8da0
mov dword [esp], eax
call fcn.006e9860
mov eax, dword [edi]
mov ebx, dword [esi + 0x10]
mov dword [esp], 0x20
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputc
mov eax, dword [edi]
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
mov dword [esp], edi
call fcn.00474030
add dword [ebp - 0x410], 1
mov eax, dword [ebp - 0x410]
cmp dword [0x855a60], eax
ja 0x4a8c63
cmp byte [ebp - 0x1e3], 0
mov dword [ebp - 0x420], 0
je 0x4a83e5
mov eax, dword [0x855a04]
test eax, eax
jne 0x4a8393
jmp 0x4a83e5
mov eax, dword [edi]
mov dword [esp + 8], 7
mov dword [esp + 4], 1
mov dword [esp], str.offset
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov dword [esp], ebx
mov ecx, edi
call fcn.00474310
mov eax, dword [eax]
sub esp, 4
mov dword [esp], 0x20
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputc
mov eax, dword [ebp - 0x418]
jmp 0x4a88fd
mov eax, dword [edi]
mov dword [esp], 0x20
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputc
jmp 0x4a8b18
mov dword [ebp - 0x420], 0
jmp 0x4a802b
mov ecx, dword [0x855a04]
test ecx, ecx
je 0x4a7db3
mov dword [esp], str._n7_Zip__r___32__16.02_:_Igor_Pavlov_:_Public_domain_:_2016_05_21_n_n
call fcn.006047c0
sub esp, 4
jmp 0x4a7db3
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ebx, eax
jmp 0x4a783b
lea ecx, [ebp - 0x2b0]
mov dword [ebp - 0x2d8], 0x75c7f8
mov dword [ebp - 0x2c8], 0
mov dword [ebp - 0x2c4], 0
mov dword [ebp - 0x2c0], 0xffffffff
mov dword [ebp - 0x2bc], 0xffffffff
mov dword [ebp - 0x2b8], 0
mov dword [ebp - 0x2b4], 0
call fcn.004712c0
lea ecx, [ebp - 0x2a4]
call fcn.00472910
lea ecx, [ebp - 0x290]
mov dword [ebp - 0x298], 0xc8
mov dword [ebp - 0x294], 0
call fcn.004712c0
lea ecx, [ebp - 0x284]
call fcn.004712c0
lea ecx, [ebp - 0x278]
call fcn.004712c0
lea ecx, [ebp - 0x26c]
call fcn.00472910
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x260], 0
mov dword [ebp - 0x25c], 0
mov dword [ebp - 0x258], 0xffffffff
mov dword [ebp - 0x254], 0xffffffff
mov dword [ebp - 0x250], 0
mov dword [ebp - 0x24c], 0
call fcn.004712c0
lea ecx, [ebp - 0x23c]
call fcn.00472910
lea ecx, [ebp - 0x230]
call fcn.004712c0
cmp byte [ebp - 0x20f], 0
mov byte [ebp - 0x220], 1
mov eax, dword [0x855a00]
je 0x4a917f
mov dword [ebp - 0x2d0], eax
mov eax, dword [ebp - 0x430]
mov ecx, dword [0x855a04]
mov dword [ebp - 0x224], eax
mov eax, dword [ebp - 0x440]
mov dword [ebp - 0x2d4], ecx
sub eax, 1
test ecx, ecx
mov dword [ebp - 0x21c], eax
je 0x4a900b
mov dword [esp], str.Scanning_the_drive_for_archives:
call fcn.006047c0
sub esp, 4
mov dword [esp], eax
call fcn.00474030
lea edi, [ebp - 0x398]
lea eax, [ebp - 0x2d8]
mov dword [ebp - 0x310], 0
mov dword [ebp - 0x30c], 0
mov dword [ebp - 0x308], 0
lea ebx, [ebp - 0x2c8]
mov dword [ebp - 0x410], edi
lea edi, [ebp - 0x38c]
mov ecx, eax
mov dword [ebp - 0x304], 0
mov dword [ebp - 0x300], 0
mov esi, eax
mov dword [ebp - 0x2fc], 0
mov dword [ebp - 0x2f8], 0
mov dword [ebp - 0x2f4], 0
mov dword [ebp - 0x2f0], 0
mov dword [ebp - 0x2ec], 0
mov dword [ebp - 0x2e8], 0
mov dword [ebp - 0x2e4], 0
mov dword [ebp - 0x428], eax
mov dword [ebp - 0x418], edi
call fcn.004d5510
lea eax, [ebp - 0x398]
lea edi, [ebp - 0x3b0]
mov dword [ebp - 0x410], eax
lea eax, [ebp - 0x38c]
mov ecx, edi
mov dword [ebp - 0x418], eax
call fcn.00472910
lea eax, [ebp - 0x38c]
mov dword [esp + 0x18], esi
lea esi, [ebp - 0x310]
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [ebp - 0x418], eax
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x398]
mov dword [esp + 0x14], esi
mov dword [ebp - 0x410], eax
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x1d0]
mov dword [esp], eax
call fcn.00493030
mov edi, eax
mov eax, dword [ebp - 0x3b0]
test eax, eax
je 0x4a9137
mov dword [esp], eax
call fcn.006e9860
mov eax, dword [ebp - 0x224]
lea ebx, [ebp - 0x2c8]
test eax, eax
je 0x4a9158
mov dword [esp], 1
mov ecx, ebx
call fcn.004aae10
sub esp, 4
test edi, edi
jne 0x4a91af
cmp byte [ebp - 0x20f], 0
jne 0x4aa87b
mov ecx, ebx
mov dword [ebp - 0x2d8], 0x75c7f8
call fcn.004aac90
jmp 0x4a82b9
mov dword [ebp - 0x2d0], eax
mov eax, dword [ebp - 0x430]
mov dword [ebp - 0x2d4], 0
mov dword [ebp - 0x224], eax
mov eax, dword [ebp - 0x440]
sub eax, 1
mov dword [ebp - 0x21c], eax
jmp 0x4a900b
mov ecx, ebx
mov dword [ebp - 0x2d8], 0x75c7f8
call fcn.004aac90
mov dword [ebp - 0x42c], edi
mov dword [ebp - 0x420], 0
jmp 0x4a82d0
lea eax, [ebp - 0x3e8]
lea edi, [ebp - 0x2d8]
mov dword [esp], eax
call fcn.004b9e80
mov ecx, 0xa
xor eax, eax
mov dword [ebp - 0x428], edi
rep stosd dword es:[edi], eax
mov dword [esp], 0x732f2e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
sub esp, 4
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 4], str.K32GetProcessMemoryInfo
mov dword [esp], eax
call edi
sub esp, 8
test eax, eax
mov esi, eax
je 0x4aaa1f
call ebx
mov edi, dword [ebp - 0x428]
mov dword [esp + 8], 0x28
mov dword [esp], eax
mov dword [esp + 4], edi
call esi
mov esi, dword [ebp - 0x3f0]
mov edi, dword [ebp - 0x3ec]
sub esp, 0xc
mov edx, dword [ebp - 0x3f4]
mov ebx, eax
mov eax, dword [ebp - 0x3f8]
mov dword [ebp - 0x410], esi
mov esi, dword [ebp - 0x3e8]
sub esi, dword [ebp - 0x408]
mov dword [ebp - 0x40c], edi
mov ecx, edx
mov edi, dword [ebp - 0x3e4]
sbb edi, dword [ebp - 0x404]
mov dword [ebp - 0x418], eax
mov dword [ebp - 0x414], edx
mov edx, eax
mov eax, str.Kernel
mov dword [esp], esi
mov dword [esp + 4], edi
call fcn.004a7430
mov edx, dword [ebp - 0x410]
mov ecx, dword [ebp - 0x40c]
mov eax, str.User
mov dword [esp], esi
mov dword [esp + 4], edi
call fcn.004a7430
mov eax, dword [ebp - 0x418]
add eax, dword [ebp - 0x410]
mov edx, dword [ebp - 0x414]
adc edx, dword [ebp - 0x40c]
mov dword [esp], esi
mov dword [esp + 4], edi
mov ecx, edx
mov edx, eax
mov eax, str.Process
call fcn.004a7430
test ebx, ebx
jne 0x4aa9e1
mov dword [esp], esi
mov dword [esp + 4], edi
mov edx, esi
mov ecx, edi
mov eax, str.Global
call fcn.004a7430
mov eax, dword [0x855a04]
mov dword [esp], eax
call fcn.00474030
jmp 0x4a83d7
mov dword [ebp - 0x440], 0x50
jmp 0x4a7e3a
mov dword [esp], 0x158
call fcn.006e98d0
mov ebx, eax
mov dword [eax], method.rrent18bt_peer_connectionE.virtual_0
mov dword [eax + 4], 0x75caf4
mov dword [eax + 8], 0x75c844
lea ecx, [ebx + 0x28]
lea eax, [eax + 0x10]
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0
mov dword [ebx + 0x18], 0xffffffff
mov dword [ebx + 0x1c], 0xffffffff
mov dword [ebx + 0x20], 0
mov dword [ebx + 0x24], 0
mov dword [ebp - 0x454], eax
call fcn.004712c0
lea ecx, [ebx + 0x34]
call fcn.00472910
lea ecx, [ebx + 0x48]
mov dword [ebx + 0x40], 0xc8
mov dword [ebx + 0x44], 0
call fcn.004712c0
lea ecx, [ebx + 0x54]
call fcn.004712c0
lea ecx, [ebx + 0x60]
call fcn.004712c0
lea ecx, [ebx + 0x6c]
call fcn.00472910
lea ecx, [ebx + 0x90]
mov dword [ebx + 0x78], 0
mov dword [ebx + 0x7c], 0
mov dword [ebx + 0x80], 0xffffffff
mov dword [ebx + 0x84], 0xffffffff
mov dword [ebx + 0x88], 0
mov dword [ebx + 0x8c], 0
call fcn.004712c0
lea ecx, [ebx + 0x9c]
call fcn.00472910
lea ecx, [ebx + 0xa8]
call fcn.004712c0
lea ecx, [ebx + 0xd0]
mov byte [ebx + 0xb8], 1
mov dword [ebx + 0xbc], 0x4f
mov byte [ebx + 0xc8], 0
mov byte [ebx + 0xc9], 0
mov byte [ebx + 0xca], 0
mov dword [ebx + 0xcc], 0
mov dword [ebx], 0x75c99c
mov dword [ebx + 4], 0x75c9dc
mov dword [ebx + 8], 0x75c9f4
call fcn.004712c0
lea ecx, [ebx + 0xdc]
call fcn.00472910
lea ecx, [ebx + 0xe8]
call fcn.00472910
mov eax, dword [ebx]
mov byte [ebx + 0x148], 0
mov dword [ebx + 0x14c], 1
mov dword [ebx + 0x150], 0
mov eax, dword [eax + 4]
cmp eax, 0x608480
jne 0x4aa2d2
add dword [ebx + 0xcc], 1
mov eax, dword [0x855a04]
cmp dword [ebp - 0x394], 1
mov edi, dword [ebp - 0x430]
mov dword [ebx + 0xf8], 0
mov dword [ebx + 0xfc], 0
mov dword [ebx + 0xc0], eax
mov eax, dword [0x855a00]
seta byte [ebx + 0xca]
test edi, edi
mov dword [ebx + 0xb4], edi
mov byte [ebx + 0x100], 0
mov byte [ebx + 0x101], 0
mov dword [ebx + 0x108], 0
mov dword [ebx + 0xc4], eax
mov eax, dword [ebp - 0x20]
mov dword [ebx + 0x10c], 0
mov dword [ebx + 0x110], 0
mov dword [ebx + 0x114], 0
mov dword [ebx + 0x118], 0
mov dword [ebx + 0x150], eax
mov eax, dword [ebp - 0x450]
mov dword [ebx + 0x11c], 0
mov dword [ebx + 0x120], 0
mov dword [ebx + 0x124], 0
mov dword [ebx + 0x128], 0
mov dword [ebx + 0x12c], 0
mov dword [ebx + 0x130], 0
mov dword [ebx + 0x134], 0
mov dword [ebx + 0x138], 0
mov dword [ebx + 0x13c], 0
mov dword [ebx + 0x140], 0
mov dword [ebx + 0x144], 0
mov dword [ebx + 0x14c], eax
je 0x4a95c6
mov eax, dword [ebp - 0x440]
sub eax, 1
mov dword [ebx + 0xbc], eax
lea ecx, [ebp - 0x338]
mov dword [ebp - 0x344], 0
mov dword [ebp - 0x340], 0
mov dword [ebp - 0x33c], 0
call fcn.00472910
movzx eax, word [ebp - 0x1a0]
lea ecx, [ebp - 0x338]
mov byte [ebp - 0x32c], 0
mov byte [ebp - 0x32b], 0
mov byte [ebp - 0x329], 0
mov byte [ebp - 0x327], 0
mov byte [ebp - 0x325], 0
mov byte [ebp - 0x324], 0
mov byte [ebp - 0x323], 0
mov word [ebp - 0x344], ax
movzx eax, byte [ebp - 0x19e]
mov byte [ebp - 0x32a], 1
mov byte [ebp - 0x328], 1
mov byte [ebp - 0x326], 1
mov byte [ebp - 0x322], 0
mov byte [ebp - 0x321], 0
mov byte [ebp - 0x320], 0
mov byte [ebp - 0x342], al
movzx eax, byte [ebp - 0x19d]
mov byte [ebp - 0x31f], 0
mov dword [ebp - 0x31c], 0
mov dword [ebp - 0x318], 0
mov dword [ebp - 0x314], 0
mov byte [ebp - 0x341], al
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0x340], eax
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0x33c], eax
lea eax, [ebp - 0x194]
mov dword [esp], eax
call fcn.00472b80
mov eax, dword [ebp - 0x188]
sub esp, 4
cmp dword [ebp - 0x1f4], 3
mov esi, dword [ebp - 0x318]
mov dword [ebp - 0x32c], eax
mov eax, dword [ebp - 0x184]
sete byte [ebp - 0x31f]
test esi, esi
lea edi, [esi*4 - 4]
mov dword [ebp - 0x328], eax
movzx eax, word [ebp - 0x180]
mov word [ebp - 0x324], ax
movzx eax, byte [ebp - 0x211]
mov byte [ebp - 0x322], al
movzx eax, byte [ebp - 0x210]
mov byte [ebp - 0x321], al
movzx eax, byte [ebp - 0x20e]
mov byte [ebp - 0x320], al
je 0x4a9788
mov eax, dword [ebp - 0x31c]
sub esi, 1
mov eax, dword [eax + edi]
test eax, eax
mov dword [ebp - 0x410], eax
je 0x4a9781
mov eax, dword [eax + 0xc]
test eax, eax
je 0x4a9757
mov dword [esp], eax
call fcn.006e9860
mov eax, dword [ebp - 0x410]
mov eax, dword [eax]
test eax, eax
je 0x4a976b
mov dword [esp], eax
call fcn.006e9860
mov eax, dword [ebp - 0x410]
mov dword [esp + 4], 0x18
mov dword [esp], eax
call fcn.006e98a0
sub edi, 4
test esi, esi
jne 0x4a9732
mov eax, dword [ebp - 0x1a8]
cmp eax, dword [ebp - 0x314]
mov dword [ebp - 0x318], 0
mov dword [ebp - 0x418], eax
jbe 0x4a97f0
cmp eax, 0x1fffffff
ja 0x4aa2ae
shl eax, 2
mov dword [esp], eax
call fcn.006e98b0
mov esi, eax
mov eax, dword [ebp - 0x318]
mov edi, dword [ebp - 0x31c]
test eax, eax
jne 0x4aa296
test edi, edi
je 0x4a97de
mov dword [esp], edi
call fcn.006e9860
mov eax, dword [ebp - 0x418]
mov dword [ebp - 0x31c], esi
mov dword [ebp - 0x314], eax
mov eax, dword [ebp - 0x418]
mov dword [ebp - 0x410], 0
test eax, eax
je 0x4a986c
mov eax, dword [ebp - 0x1ac]
mov edi, dword [ebp - 0x410]
mov edi, dword [eax + edi*4]
mov dword [esp], 0x18
call fcn.006e98d0
mov dword [esp], edi
mov ecx, eax
mov esi, eax
call fcn.00472a10
sub esp, 4
add edi, 0xc
lea ecx, [esi + 0xc]
mov dword [esp], edi
call fcn.00472a10
mov eax, dword [ebp - 0x318]
add dword [ebp - 0x410], 1
sub esp, 4
lea edx, [eax + 1]
mov dword [ebp - 0x318], edx
mov edx, dword [ebp - 0x31c]
mov dword [edx + eax*4], esi
mov eax, dword [ebp - 0x410]
cmp dword [ebp - 0x418], eax
jne 0x4a9804
lea esi, [ebp - 0x380]
mov ecx, esi
call fcn.00472910
mov eax, dword [ebp - 0x1dc]
mov dword [ebp - 0x2d8], 0x75c088
mov dword [ebp - 0x2d4], 0
mov dword [ebp - 0x2d0], 0
mov dword [ebp - 0x2cc], 0
mov dword [ebp - 0x428], 0
test eax, eax
jne 0x4aa121
lea eax, [ebp - 0x310]
mov dword [esp + 0x28], esi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], eax
mov eax, dword [ebp - 0x428]
mov dword [esp + 0x24], eax
lea eax, [ebx + 8]
mov dword [esp + 0x1c], eax
lea eax, [ebp - 0x344]
mov dword [esp + 0x18], eax
mov dword [ebp - 0x430], eax
mov eax, dword [ebp - 0x20c]
mov eax, dword [eax]
add eax, 0xc
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x38c]
mov dword [ebp - 0x418], eax
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x398]
mov dword [ebp - 0x410], eax
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x3bc]
mov dword [esp + 8], eax
lea eax, [ebp - 0x3c8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x424]
mov dword [esp], eax
call fcn.004ce0c0
mov dword [ebp - 0x42c], eax
mov eax, dword [ebx + 0xb4]
test eax, eax
je 0x4a9962
mov ecx, dword [ebp - 0x454]
mov dword [esp], 1
call fcn.004aae10
sub esp, 4
mov eax, dword [ebp - 0x37c]
test eax, eax
je 0x4a99cc
mov edi, dword [0x855a00]
test edi, edi
je 0x4a99b4
mov dword [esp], edi
mov esi, dword [ebp - 0x380]
call fcn.00474030
mov ecx, edi
mov dword [esp], 0x732e21
call fcn.006047c0
sub esp, 4
mov edi, eax
mov dword [esp], eax
call fcn.00474030
mov dword [esp], esi
mov ecx, edi
call fcn.00474070
sub esp, 4
mov dword [esp], eax
call fcn.00474030
mov edi, dword [ebp - 0x42c]
mov eax, 0x80004005
mov ecx, eax
test edi, edi
cmovne ecx, edi
mov dword [ebp - 0x42c], ecx
mov esi, dword [0x855a04]
test esi, esi
je 0x4a9ff4
mov dword [esp], esi
call fcn.00474030
mov eax, dword [ebx + 0xfc]
mov edi, dword [ebx + 0xf8]
cmp eax, 0
mov dword [ebp - 0x420], eax
jbe 0x4a9fe6
mov ecx, esi
mov dword [esp], str.Archives:
call fcn.006047c0
sub esp, 4
mov ecx, eax
mov dword [esp], edi
mov edi, dword [ebp - 0x420]
mov dword [esp + 4], edi
call fcn.00474360
sub esp, 8
mov dword [esp], eax
call fcn.00474030
mov edx, dword [ebx + 0x10c]
mov eax, dword [ebx + 0x108]
mov ecx, esi
mov dword [esp], str.OK_archives:
mov dword [ebp - 0x41c], edx
mov dword [ebp - 0x420], eax
call fcn.006047c0
mov ecx, dword [ebp - 0x41c]
mov edx, dword [ebp - 0x420]
sub esp, 4
mov dword [esp + 4], ecx
mov dword [esp], edx
mov ecx, eax
call fcn.00474360
sub esp, 8
mov dword [esp], eax
call fcn.00474030
mov eax, dword [ebx + 0x110]
mov edi, dword [ebx + 0x114]
mov dword [ebp - 0x420], eax
or eax, edi
jne 0x4aa2ec
mov eax, dword [ebx + 0x11c]
mov edi, dword [ebx + 0x118]
mov dword [ebp - 0x420], eax
or eax, edi
je 0x4a9fd0
test esi, esi
je 0x4aa3c7
mov ecx, esi
mov dword [esp], str.Archives_with_Errors:
call fcn.006047c0
sub esp, 4
mov ecx, eax
mov dword [esp], edi
mov edi, dword [ebp - 0x420]
mov dword [esp + 4], edi
call fcn.00474360
sub esp, 8
mov dword [esp], eax
call fcn.00474030
mov eax, dword [ebx + 0x120]
mov edi, dword [ebx + 0x124]
mov dword [ebp - 0x420], eax
or eax, edi
jne 0x4aa392
mov eax, dword [ebx + 0x134]
or eax, dword [ebx + 0x130]
jne 0x4aa33b
mov eax, dword [ebx + 0x12c]
or eax, dword [ebx + 0x128]
je 0x4a9fa6
test esi, esi
je 0x4aa3c7
mov dword [esp], esi
call fcn.00474030
mov eax, dword [ebx + 0x128]
mov edi, dword [ebx + 0x12c]
mov dword [ebp - 0x420], eax
or eax, edi
je 0x4a9b7b
mov ecx, esi
mov dword [esp], str.Open_Errors:
call fcn.006047c0
mov ecx, dword [ebp - 0x420]
sub esp, 4
mov dword [esp + 4], edi
mov dword [esp], ecx
mov ecx, eax
call fcn.00474360
sub esp, 8
mov dword [esp], eax
call fcn.00474030
mov dword [ebp - 0x420], 2
mov eax, dword [ebx + 0x11c]
or eax, dword [ebx + 0x118]
jne 0x4a9f30
mov eax, dword [ebx + 0x13c]
or eax, dword [ebx + 0x138]
jne 0x4a9f30
mov eax, dword [ebp - 0x42c]
test eax, eax
jne 0x4a9d7a
mov eax, dword [ebp - 0x2f0]
mov edi, dword [ebp - 0x2ec]
mov dword [ebp - 0x438], eax
or eax, edi
jne 0x4aa096
mov eax, dword [ebp - 0x2e4]
mov edi, dword [ebp - 0x2e8]
mov ecx, eax
mov dword [ebp - 0x438], eax
mov eax, edi
xor eax, 1
mov edx, eax
or edx, ecx
je 0x4aa0fb
mov ecx, esi
mov dword [esp], str.Files:
call fcn.006047c0
sub esp, 4
mov ecx, eax
mov dword [esp], edi
mov edi, dword [ebp - 0x438]
mov dword [esp + 4], edi
call fcn.00474360
sub esp, 8
mov dword [esp], eax
call fcn.00474030
mov eax, dword [ebp - 0x2e0]
mov edi, dword [ebp - 0x2dc]
mov dword [ebp - 0x438], eax
or eax, edi
je 0x4a9cb8
mov ecx, esi
mov dword [esp], str.Alternate_Streams:
call fcn.006047c0
mov ecx, dword [ebp - 0x438]
sub esp, 4
mov dword [esp + 4], edi
mov dword [esp], ecx
mov ecx, eax
call fcn.00474360
sub esp, 8
mov dword [esp], eax
call fcn.00474030
mov edx, dword [ebp - 0x2fc]
mov eax, dword [ebp - 0x300]
mov ecx, esi
mov dword [esp], str.Alternate_Streams_Size:
mov dword [ebp - 0x434], edx
mov dword [ebp - 0x438], eax
call fcn.006047c0
mov ecx, dword [ebp - 0x434]
mov edx, dword [ebp - 0x438]
sub esp, 4
mov dword [esp + 4], ecx
mov dword [esp], edx
mov ecx, eax
call fcn.00474360
sub esp, 8
mov dword [esp], eax
call fcn.00474030
mov eax, dword [ebp - 0x2f8]
mov edx, dword [ebp - 0x2f4]
mov ecx, esi
mov dword [esp], 0x732ef4
mov dword [ebp - 0x438], eax
mov dword [ebp - 0x434], edx
mov eax, dword [ebp - 0x308]
mov edx, dword [ebp - 0x304]
mov dword [ebp - 0x440], eax
mov dword [ebp - 0x43c], edx
call fcn.006047c0
mov edx, dword [ebp - 0x440]
mov ecx, dword [ebp - 0x43c]
sub esp, 4
mov dword [esp], edx
mov dword [esp + 4], ecx
mov ecx, eax
call fcn.00474360
sub esp, 8
mov edi, eax
mov dword [esp], eax
call fcn.00474030
mov ecx, edi
mov dword [esp], str.Compressed:
call fcn.006047c0
mov edx, dword [ebp - 0x438]
mov ecx, dword [ebp - 0x434]
sub esp, 4
mov dword [esp], edx
mov dword [esp + 4], ecx
mov ecx, eax
call fcn.00474360
sub esp, 8
mov dword [esp], eax
call fcn.00474030
mov edi, dword [ebp - 0x428]
test edi, edi
je 0x4a9d7a
mov dword [esp], esi
call fcn.00474030
lea eax, [ebp - 0x2d8]
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.004d7de0
mov esi, dword [ebp - 0x2d0]
mov dword [ebp - 0x2d8], 0x75c088
mov eax, dword [ebp - 0x2d4]
test esi, esi
je 0x4a9df4
lea edi, [esi*4 - 4]
mov ecx, dword [eax + edi]
sub esi, 1
test ecx, ecx
mov dword [ebp - 0x410], ecx
je 0x4a9ded
mov eax, dword [ecx + 4]
test eax, eax
je 0x4a9dba
mov dword [esp], eax
call fcn.006e9860
mov eax, dword [ebp - 0x410]
mov eax, dword [eax]
test eax, eax
je 0x4a9dd1
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
sub esp, 4
mov eax, dword [ebp - 0x410]
mov dword [esp + 4], 0x114
mov dword [esp], eax
call fcn.006e98a0
mov eax, dword [ebp - 0x2d4]
sub edi, 4
test esi, esi
jne 0x4a9d9b
test eax, eax
je 0x4a9e00
mov dword [esp], eax
call fcn.006e9860
mov eax, dword [ebp - 0x380]
test eax, eax
je 0x4a9e12
mov dword [esp], eax
call fcn.006e9860
mov esi, dword [ebp - 0x318]
mov eax, dword [ebp - 0x31c]
test esi, esi
je 0x4a9e7f
lea edi, [esi*4 - 4]
mov ecx, dword [eax + edi]
sub esi, 1
test ecx, ecx
mov dword [ebp - 0x410], ecx
je 0x4a9e78
mov eax, dword [ecx + 0xc]
test eax, eax
je 0x4a9e48
mov dword [esp], eax
call fcn.006e9860
mov eax, dword [ebp - 0x410]
mov eax, dword [eax]
test eax, eax
je 0x4a9e5c
mov dword [esp], eax
call fcn.006e9860
mov eax, dword [ebp - 0x410]
mov dword [esp + 4], 0x18
mov dword [esp], eax
call fcn.006e98a0
mov eax, dword [ebp - 0x31c]
sub edi, 4
test esi, esi
jne 0x4a9e29
test eax, eax
je 0x4a9e8b
mov dword [esp], eax
call fcn.006e9860
mov eax, dword [ebp - 0x338]
test eax, eax
je 0x4a9e9d
mov dword [esp], eax
call fcn.006e9860
mov eax, dword [ebx]
mov eax, dword [eax + 8]
cmp eax, 0x6084a0
jne 0x4aa2df
sub dword [ebx + 0xcc], 1
jne 0x4a82d0
mov eax, dword [ebx + 0xe8]
mov dword [ebx], 0x75c99c
mov dword [ebx + 4], 0x75c9dc
mov dword [ebx + 8], 0x75c9f4
test eax, eax
je 0x4a9ee0
mov dword [esp], eax
call fcn.006e9860
mov eax, dword [ebx + 0xdc]
test eax, eax
je 0x4a9ef2
mov dword [esp], eax
call fcn.006e9860
mov eax, dword [ebx + 0xd0]
test eax, eax
je 0x4a9f04
mov dword [esp], eax
call fcn.006e9860
mov ecx, dword [ebp - 0x454]
mov dword [ebx + 8], 0x75c844
call fcn.004aac90
mov dword [esp + 4], 0x158
mov dword [esp], ebx
call fcn.006e98a0
jmp 0x4a82d0
mov dword [esp], esi
call fcn.00474030
mov eax, dword [ebx + 0x13c]
mov edi, dword [ebx + 0x138]
mov dword [ebp - 0x410], eax
or eax, edi
je 0x4a9d7a
mov ecx, esi
mov dword [esp], 0x732ea2
call fcn.006047c0
sub esp, 4
mov ecx, eax
mov dword [esp], edi
mov edi, dword [ebp - 0x410]
mov dword [esp + 4], edi
call fcn.00474360
sub esp, 8
mov dword [esp], eax
call fcn.00474030
jmp 0x4a9d7a
mov eax, dword [ebx + 0x12c]
or eax, dword [ebx + 0x128]
jne 0x4aa3c7
movzx eax, byte [ebp - 0x441]
mov byte [ebp - 0x438], al
xor eax, eax
cmp byte [ebp - 0x438], 0
setne al
add eax, eax
test esi, esi
mov dword [ebp - 0x420], eax
jne 0x4a9b85
jmp 0x4a9d7a
test esi, esi
je 0x4a9f87
movzx eax, byte [ebp - 0x441]
mov byte [ebp - 0x438], al
jmp 0x4a9ae7
cmp edi, 1
jbe 0x4a9a7b
jmp 0x4a99fd
mov eax, dword [ebx + 0x114]
movzx edi, byte [ebp - 0x438]
or eax, dword [ebx + 0x110]
movzx eax, byte [ebp - 0x441]
cmovne eax, edi
mov byte [ebp - 0x441], al
jmp 0x4a9a95
mov edx, eax
shr edx, 2
lea ebx, [eax + edx + 1]
cmp ebx, 0x1fffffff
ja 0x4aa711
lea eax, [ebx*4]
mov dword [esp], eax
call fcn.006e98b0
mov edi, eax
mov eax, dword [ebp - 0x388]
mov ecx, dword [ebp - 0x38c]
test eax, eax
mov dword [ebp - 0x410], ecx
jne 0x4aa6f9
test ecx, ecx
je 0x4aa074
mov eax, dword [ebp - 0x410]
mov dword [esp], eax
call fcn.006e9860
mov eax, dword [ebp - 0x388]
mov dword [ebp - 0x38c], edi
mov dword [ebp - 0x384], ebx
jmp 0x4a82ad
cmp edx, 0xffffffff
mov dword [esp], eax
jne 0x4a8615
call fcn.006e9b80
mov ecx, esi
mov dword [esp], str.Folders:
call fcn.006047c0
mov ecx, dword [ebp - 0x438]
sub esp, 4
mov dword [esp + 4], edi
mov dword [esp], ecx
mov ecx, eax
call fcn.00474360
sub esp, 8
mov dword [esp], eax
call fcn.00474030
mov eax, dword [ebp - 0x2e4]
mov edi, dword [ebp - 0x2e8]
mov ecx, eax
mov dword [ebp - 0x438], eax
mov eax, edi
xor eax, 1
mov edx, eax
or edx, ecx
jne 0x4a9bf4
mov eax, dword [ebp - 0x2ec]
or eax, dword [ebp - 0x2f0]
jne 0x4a9bf4
mov eax, dword [ebp - 0x2dc]
or eax, dword [ebp - 0x2e0]
je 0x4a9cb8
mov edi, 1
mov dword [ebp - 0x438], 0
jmp 0x4a9bf4
lea eax, [ebp - 0x2d8]
mov ecx, eax
mov dword [ebp - 0x428], eax
lea eax, [ebp - 0x1e0]
mov dword [esp], eax
lea eax, [ebp - 0x344]
mov dword [ebp - 0x430], eax
lea eax, [ebp - 0x398]
mov dword [ebp - 0x410], eax
lea eax, [ebp - 0x38c]
mov dword [ebp - 0x418], eax
call fcn.004d1510
sub esp, 4
test eax, eax
jne 0x4aa242
mov dword [ebp - 0x2a0], 0
mov dword [ebp - 0x29c], 0
mov dword [ebp - 0x2a8], 0
mov dword [ebp - 0x2a4], 0
mov dword [ebp - 0x2b0], 0
mov dword [ebp - 0x2ac], 0
mov dword [ebp - 0x2b8], 0
mov dword [ebp - 0x2b4], 0
mov dword [ebp - 0x2c0], 0
mov dword [ebp - 0x2bc], 0
mov dword [ebp - 0x2c8], 0
mov dword [ebp - 0x2c4], 0
jmp 0x4a98b9
lea eax, [ebp - 0x344]
mov dword [ebp - 0x430], eax
lea eax, [ebp - 0x398]
mov dword [ebp - 0x410], eax
lea eax, [ebp - 0x38c]
mov dword [ebp - 0x418], eax
mov ecx, dword [ebp - 0x430]
call fcn.00605690
mov eax, dword [ebx]
mov dword [esp], ebx
mov ebx, esi
call dword [eax + 8]
mov ecx, dword [ebp - 0x418]
sub esp, 4
call fcn.00603750
mov ecx, dword [ebp - 0x410]
call fcn.00603750
jmp 0x4a8584
lea edi, [ebp - 0x344]
mov dword [ebp - 0x430], edi
lea edi, [ebp - 0x398]
mov dword [ebp - 0x410], edi
lea edi, [ebp - 0x38c]
mov dword [ebp - 0x418], edi
call fcn.006ec8f4
mov edi, eax
mov eax, dword [esi]
test eax, eax
je 0x4aa27b
mov dword [esp], eax
call fcn.006e9860
mov dword [esp], esi
mov dword [esp + 4], 0x18
mov esi, edi
call fcn.006e98a0
jmp 0x4aa1eb
shl eax, 2
mov dword [esp + 4], edi
mov dword [esp], esi
mov dword [esp + 8], eax
call sub.msvcrt.dll_memcpy
jmp 0x4a97d6
call fcn.006ea1c0
mov esi, eax
lea eax, [ebp - 0x398]
mov dword [ebp - 0x410], eax
lea eax, [ebp - 0x38c]
mov dword [ebp - 0x418], eax
jmp 0x4aa21a
mov dword [esp], ebx
call eax
sub esp, 4
jmp 0x4a94ac
mov dword [esp], ebx
call eax
sub esp, 4
jmp 0x4a82d0
mov ecx, esi
mov dword [esp], str.Cant_open_as_archive:
call fcn.006047c0
mov ecx, dword [ebp - 0x420]
sub esp, 4
mov dword [esp + 4], edi
mov dword [esp], ecx
mov ecx, eax
call fcn.00474360
sub esp, 8
mov dword [esp], eax
call fcn.00474030
mov eax, dword [ebx + 0x11c]
mov edi, dword [ebx + 0x118]
mov dword [ebp - 0x420], eax
or eax, edi
jne 0x4a9ab7
jmp 0x4a9ae7
mov dword [esp], esi
call fcn.00474030
mov eax, dword [ebx + 0x130]
mov edi, dword [ebx + 0x134]
mov dword [ebp - 0x420], eax
or eax, edi
je 0x4a9b13
mov ecx, esi
mov dword [esp], str.Warnings:
call fcn.006047c0
mov ecx, dword [ebp - 0x420]
sub esp, 4
mov dword [esp + 4], edi
mov dword [esp], ecx
mov ecx, eax
call fcn.00474360
sub esp, 8
mov dword [esp], eax
call fcn.00474030
jmp 0x4a9b13
mov ecx, esi
mov dword [esp], str.Archives_with_Warnings:
call fcn.006047c0
mov ecx, dword [ebp - 0x420]
sub esp, 4
mov dword [esp + 4], edi
mov dword [esp], ecx
mov ecx, eax
call fcn.00474360
sub esp, 8
mov dword [esp], eax
call fcn.00474030
jmp 0x4a9b01
mov dword [ebp - 0x420], 2
jmp 0x4a9d7a
lea eax, [ebp - 0x398]
mov dword [ebp - 0x410], eax
lea eax, [ebp - 0x38c]
mov dword [ebp - 0x418], eax
mov ecx, eax
jmp 0x4aa22d
shl eax, 2
mov dword [esp + 4], ecx
mov dword [esp], edi
mov dword [esp + 8], eax
call sub.msvcrt.dll_memcpy
jmp 0x4aa060
call fcn.006ea1c0
mov dword [esp], 4
call fcn.006e99f0
mov dword [eax], str.Unsupported_archive_type
mov dword [esp + 8], 0
mov dword [esp + 4], 0x75056c
mov dword [esp], eax
call fcn.006ea150
mov ebx, eax
jmp 0x4a8596
mov eax, dword [ebp - 0x42c]
call fcn.006ec8f4
mov dword [esp + 4], 0xc
mov dword [esp], esi
mov ebx, eax
call fcn.006e98a0
jmp 0x4aa422
mov ebx, dword [0x855a00]
test ebx, ebx
je 0x4aa7e1
mov dword [esp], ebx
call fcn.00474030
mov ecx, ebx
mov dword [esp], 0x732f0e
call fcn.006047c0
sub esp, 4
mov ecx, eax
mov dword [esp], str.Incorrect_command_line
call fcn.006047c0
sub esp, 4
mov dword [esp], eax
call fcn.00474030
mov dword [esp], 4
call fcn.006e99f0
mov dword [eax], 7
mov dword [esp + 8], 0
mov dword [esp + 4], 0x74fd68
mov dword [esp], eax
call fcn.006ea150
jmp 0x4aa789
mov ecx, dword [ebp - 0x428]
mov dword [esp], esi
call fcn.004d5c50
sub esp, 4
jmp 0x4a9169
shl eax, 2
mov dword [esp + 4], ecx
mov dword [esp], edi
mov dword [esp + 8], eax
call sub.msvcrt.dll_memcpy
jmp 0x4a8673
call fcn.006ea1c0
call fcn.006ec8f4
call fcn.006ea1c0
jmp 0x4aa085
mov edx, dword [ebp - 0x2b4]
xor ecx, ecx
mov eax, str.Virtual
call fcn.004a7290
mov edx, esi
mov ecx, edi
mov dword [esp], esi
mov dword [esp + 4], edi
mov eax, str.Global
call fcn.004a7430
mov edx, dword [ebp - 0x2d0]
xor ecx, ecx
mov eax, str.Physical
call fcn.004a7290
jmp 0x4a930a
mov dword [esp], str.Psapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
sub esp, 4
test eax, eax
je 0x4aaa4b
mov dword [esp + 4], str.GetProcessMemoryInfo
mov dword [esp], eax
call edi
sub esp, 8
test eax, eax
jne 0x4aaafb
mov eax, dword [ebp - 0x3f8]
mov edx, dword [ebp - 0x3f4]
mov esi, dword [ebp - 0x3e8]
sub esi, dword [ebp - 0x408]
mov edi, dword [ebp - 0x3e4]
sbb edi, dword [ebp - 0x404]
mov ecx, eax
mov ebx, edx
mov eax, dword [ebp - 0x3f0]
mov edx, dword [ebp - 0x3ec]
mov dword [ebp - 0x418], ecx
mov dword [esp], esi
mov dword [ebp - 0x414], ebx
mov dword [ebp - 0x410], eax
mov dword [esp + 4], edi
mov eax, str.Kernel
mov dword [ebp - 0x40c], edx
mov edx, ecx
mov ecx, ebx
call fcn.004a7430
mov edx, dword [ebp - 0x410]
mov ecx, dword [ebp - 0x40c]
mov eax, str.User
mov dword [esp], esi
mov dword [esp + 4], edi
call fcn.004a7430
mov eax, dword [ebp - 0x410]
add eax, dword [ebp - 0x418]
mov edx, dword [ebp - 0x40c]
adc edx, dword [ebp - 0x414]
mov dword [esp], esi
mov dword [esp + 4], edi
mov ecx, edx
mov edx, eax
mov eax, str.Process
call fcn.004a7430
jmp 0x4a92f5
mov esi, eax
jmp 0x4a9228