Function at 0x4ad0db64
Capabilities:
Check if file exists
Copy file
Delete file
Get file attributes
Get file size
Read file on windows
Set file attributes

Disassembly:
cmp dword [0x4ad2b9a8], esi
jne 0x4ad17239
lea eax, [ebp - 0xa2c]
push eax
push ebx
call fcn.4ad0dd82
cmp eax, edi
je 0x4ad1726e
cmp dword [0x4ad33b10], esi
je 0x4ad0ef81
test byte [ebx + 0x18], 8
jne 0x4ad0ef93
cmp dword [0x4ad33afc], 3
je 0x4ad0ef93
push esi
push 0x104
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0xa48]
push ebx
call fcn.4ad0df57
cmp eax, edi
je 0x4ad1726e
cmp dword [0x4ad33afc], 3
je 0x4ad0f0f6
cmp word [ebp - 0x20c], si
je 0x4ad0da77
push esi
push dword [ebx + 4]
call fcn.4ad0e24c
cmp eax, 0xffffffff
mov dword [ebp - 0xa38], eax
je 0x4ad169a4
push eax
call fcn.4ad01538
test eax, eax
jne 0x4ad169df
cmp dword [0x4ad33af0], esi
jne 0x4ad16a06
mov eax, dword [ebp - 0xa68]
mov dword [ebp - 0xa4c], eax
mov eax, dword [ebp - 0xa4c]
mov dword [ebp - 0xa7c], eax
mov eax, dword [ebx + 0x18]
test al, 4
je 0x4ad0efc0
and eax, 0xfffffffb
test al, al
mov dword [ebx + 0x18], eax
js 0x4ad16a25
or eax, edi
mov dword [ebx + 0x18], eax
cmp byte [0x4ad2fa24], 0
je 0x4ad16a2d
push 0x208
push dword [ebx + 4]
lea eax, [ebp - 0x824]
push eax
call fcn.4ad02ec4
mov esi, eax
lea eax, [ebp - 0x20c]
push eax
call fcn.4ad02f54
push eax
push dword [ebp - 0xa30]
lea eax, [ebp - 0xa34]
push ebx
push eax
push 0x200
push dword [ebp - 0xa40]
push dword [ebp - 0xa38]
call fcn.4ad0dec6
cmp dword [0x4ad2b9c4], 0
mov dword [ebp - 0xa54], eax
jne 0x4ad16a5c
cmp dword [0x4ad33afc], 3
je 0x4ad0f111
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x824]
push eax
push esi
call fcn.4ad0de65
test eax, eax
jne 0x4ad16a86
mov eax, dword [ebp - 0xa48]
mov dword [0x4ad33b04], edi
cmp dword [eax + 0x1c], 0
je 0x4ad0d7fc
cmp dword [0x4ad33b10], 0
je 0x4ad0d7fc
and dword [0x4ad2b9c4], 0
mov dword [0x4ad33b00], edi
push dword [eax + 0x1c]
call fcn.4ad07d5d
mov eax, dword [0x4ad2b9c4]
cmp eax, 0x15
je 0x4ad0f3ac
cmp eax, 0x458
je 0x4ad0f3ac
push edi
push 0x104
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0xa48]
push ebx
call fcn.4ad0df57
cmp eax, edi
je 0x4ad17263
cmp word [ebp - 0x20c], 0
je 0x4ad16b10
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x824]
push eax
push esi
call fcn.4ad0de65
test eax, eax
jne 0x4ad16b20
xor esi, esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [ebp - 0xa44], esi
jne 0x4ad0d89f
cmp dword [ebp - 0xa78], esi
je 0x4ad0d87f
cmp eax, 0xffffffff
mov dword [ebp - 0xa58], esi
je 0x4ad0d879
test al, 0x10
jne 0x4ad16b83
mov dword [ebp - 0xa78], esi
and dword [ebx + 0x18], 0xfffffffb
cmp byte [0x4ad2fa24], 0
mov ecx, dword [ebx + 0x18]
je 0x4ad16b8e
cmp dword [ebp - 0xa58], esi
jne 0x4ad16bd2
cmp dword [0x4ad33b10], esi
je 0x4ad0d8d2
mov ecx, dword [ebp - 0xa48]
mov ecx, dword [ecx + 0x1c]
cmp ecx, esi
je 0x4ad0d8c5
test byte [ecx + 0x18], 8
je 0x4ad0d8c5
cmp dword [ebx + 0x1c], esi
jne 0x4ad0d8c5
mov dword [0x4ad33afc], edi
cmp dword [0x4ad33afc], 3
je 0x4ad16be9
test al, 6
jne 0x4ad0f377
test byte [ebx + 0x19], 4
jne 0x4ad0d8f2
lea eax, [ebp - 0x20c]
push eax
call fcn.4ad0e329
mov dword [ebp - 0xa30], eax
cmp dword [ebp - 0xa30], 0xffffffff
mov dword [ebp - 0xa60], esi
je 0x4ad0f3c0
push dword [ebp - 0xa30]
mov dword [ebp - 0xa74], edi
call fcn.4ad01538
test eax, eax
jne 0x4ad16c04
cmp dword [ebp - 0xa70], edi
je 0x4ad16c27
mov eax, dword [ebx + 0x18]
test al, 8
jne 0x4ad0d93e
cmp dword [0x4ad33afc], 3
je 0x4ad16c57
mov eax, dword [ebx + 0x18]
test al, 8
je 0x4ad0d952
cmp dword [0x4ad33afc], 3
je 0x4ad16c72
push dword [ebx + 0x18]
lea eax, [ebp - 0xa34]
push eax
push dword [ebp - 0xa40]
call fcn.4ad0de39
cmp dword [0x4ad33afc], 3
je 0x4ad0f39a
test byte [ebx + 0x18], 1
je 0x4ad0f39a
cmp dword [ebp - 0xa30], 0xffffffff
je 0x4ad0d999
push dword [ebp - 0xa30]
call fcn.4ad01925
or dword [ebp - 0xa30], 0xffffffff
test byte [ebx + 0x19], 4
jne 0x4ad16c9a
mov eax, dword [0x4ad2fa2c]
test eax, eax
push dword [ebp - 0xa64]
je 0x4ad16cdf
push 0x4ad2b9a8
push 0
push 0
lea ecx, [ebp - 0x20c]
push ecx
push dword [ebx + 4]
call eax
xor esi, esi
cmp eax, esi
je 0x4ad16cf4
cmp dword [ebp - 0xa60], esi
jne 0x4ad0da0c
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4ad0da00
and eax, 0xfffffffe
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp dword [0x4ad33af0], esi
jne 0x4ad16d5b
push dword [ebp - 0xa38]
xor esi, esi
mov dword [0x4ad33ad8], esi
mov eax, dword [ebx + 0x14]
mov ecx, dword [eax + 0x14]
mov dword [ebp - 0xa90], ecx
mov eax, dword [eax + 0x18]
mov dword [ebp - 0xa8c], eax
call fcn.4ad01925
cmp dword [0x4ad33afc], 3
je 0x4ad0da6f
cmp dword [0x4ad2b9a8], esi
jne 0x4ad171ea
lea eax, [ebp - 0xa90]
push eax
push dword [ebp - 0xa30]
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0xa48]
push ebx
call fcn.4ad0daa4
mov dword [0x4ad33b0c], edi
mov dword [0x4ad33b10], esi
xor esi, esi
push dword [ebp - 0xa3c]
push 0x21
push dword [ebx + 0x14]
call fcn.4ad07ecc
test al, al
jne 0x4ad0d63c
push dword [ebp - 0xa3c]
call fcn.4ad03015
jmp 0x4ad0dc19
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa90
mov eax, dword [0x4ad33b38]
mov edx, dword [ebp + 0xc]
or dword [ebp - 0xa30], 0xffffffff
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
mov ecx, 0x81
lea edi, [ebp - 0x410]
mov dword [ebp - 0x414], 0x20
rep stosd dword es:[edi], eax
mov eax, dword [edx + 0x1c]
xor esi, esi
xor edi, edi
inc edi
cmp eax, esi
mov dword [ebp - 0xa48], edx
mov dword [ebp - 0xa50], esi
mov dword [ebp - 0xa70], esi
mov dword [ebp - 0xa44], esi
mov dword [ebp - 0xa78], edi
je 0x4ad16912
mov eax, dword [eax + 0x18]
shr eax, 1
and eax, 8
push esi
mov dword [ebp - 0xa64], eax
lea eax, [ebp - 0xa68]
push eax
push 0x80
push 0xfe00
mov dword [ebp - 0xa6c], esi
mov dword [ebp - 0xa58], esi
call fcn.4ad0e395
cmp eax, esi
mov dword [ebp - 0xa40], eax
je 0x4ad0f3b9
cmp dword [0x4ad33af0], esi
jne 0x4ad1691a
mov ebx, dword [ebx + 0x1c]
cmp ebx, esi
jne 0x4ad0e442
cmp dword [0x4ad33afc], 3
je 0x4ad1720d
mov eax, dword [ebp - 0xa50]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.4ad01389
leave
ret 8
lea eax, [ebp - 0xa3c]
push eax
push dword [ebx + 0x14]
push 0x21
push dword [ebx]
call fcn.4ad02f54
push eax
call fcn.4ad02774
test al, al
je 0x4ad16945
jmp 0x4ad0d63c
cmp dword [0x4ad33afc], 3
jne 0x4ad0d669
jmp 0x4ad16990
push dword [ebx + 4]
push str._s_r_n
call fcn.4ad04115
cmp dword [0x4ad33afc], 3
pop ecx
pop ecx
jne 0x4ad0d680
cmp dword [0x4ad33b10], esi
jne 0x4ad0d680
jmp 0x4ad0d6bb
mov dword [ebp - 0xa44], eax
jmp 0x4ad0d730
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
jmp 0x4ad0d6ae
cmp dword [0x4ad33b10], 0
jne 0x4ad0d797
jmp 0x4ad0d91e
or dword [ebp - 0xa30], 0xffffffff
mov dword [0x4ad2b9c4], 5
jmp 0x4ad0d8f2
test eax, eax
je 0x4ad0d669
jmp 0x4ad0da77
cmp dword [ebp - 0xa30], 0xffffffff
jne 0x4ad16fa4
jmp 0x4ad17009
push 0
push eax
call fcn.4ad05031
jmp 0x4ad17261
mov eax, edi
jmp 0x4ad0dc37
mov dword [ebp - 0xa74], esi
jmp 0x4ad0d91e
mov eax, dword [edx + 0x18]
jmp 0x4ad0dbd1
push edi
lea eax, [ebp - 0xa7c]
push eax
push 0x80
push dword [ebp - 0xa68]
call fcn.4ad0e395
cmp eax, esi
mov dword [ebp - 0xa5c], eax
je 0x4ad0f3b9
jmp 0x4ad0dc19
cmp dword [0x4ad33afc], 3
jne 0x4ad1695a
cmp dword [0x4ad33b10], esi
je 0x4ad0dc19
push dword [ebx]
push 0x4ad3cba0
call fcn.4ad04115
push 0x4ad3cb88
call fcn.4ad04115
add esp, 0xc
push dword [0x4ad2b9c4]
call fcn.4ad0ef21
push dword [ebp - 0xa3c]
call fcn.4ad03015
push edi
push esi
jmp 0x4ad1728c
push dword [ebx + 4]
lea eax, [ebp - 0x414]
push eax
call fcn.4ad1d88d
jmp 0x4ad0f38d
push dword [0x4ad2b9c4]
call fcn.4ad0ef21
cmp dword [0x4ad33afc], 3
jne 0x4ad169d4
cmp dword [ebp - 0xa30], 0xffffffff
jne 0x4ad169d4
push dword [ebx + 4]
lea eax, [ebp - 0x20c]
push eax
call fcn.4ad1d88d
test eax, eax
jne 0x4ad1697e
mov dword [ebp - 0xa50], edi
jmp 0x4ad0da77
mov eax, 0x80
or dword [ebx + 0x18], eax
mov dword [ebp - 0xa4c], eax
mov eax, dword [ebx + 0x18]
test al, 1
je 0x4ad0d705
and eax, 0xfffffffe
or eax, 4
mov dword [ebx + 0x18], eax
jmp 0x4ad0d705
mov ecx, dword [ebp - 0xa68]
mov eax, dword [ebp - 0xa7c]
cmp ecx, eax
jae 0x4ad0d6f3
mov dword [ebp - 0xa4c], ecx
jmp 0x4ad0d6f9
or eax, 2
jmp 0x4ad0d720
cmp dword [0x4ad33b10], esi
je 0x4ad0d730
test al, 8
jne 0x4ad0d730
cmp dword [0x4ad33afc], 3
jne 0x4ad0d730
and eax, 0xfffffffe
or eax, 2
mov dword [ebx + 0x18], eax
jmp 0x4ad0d730
push dword [ebp - 0xa38]
call fcn.4ad01925
push 0x6e
call fcn.4ad0ef21
cmp dword [0x4ad33afc], 3
je 0x4ad1727e
mov dword [ebp - 0xa50], edi
jmp 0x4ad0da75
test byte [ebx + 0x18], 0x80
jne 0x4ad0d7b3
push dword [ebp - 0xa38]
call fcn.4ad01925
push dword [ebp - 0xa3c]
lea eax, [ebp - 0xa30]
push dword [ebp - 0xa4c]
push dword [ebp - 0xa40]
push dword [0x4ad33b10]
push eax
push ebx
call fcn.4ad1db7e
xor esi, esi
cmp dword [0x4ad33b10], esi
je 0x4ad16af6
cmp dword [0x4ad33afc], 3
jne 0x4ad16af0
and dword [ebx + 0x18], 0xfffffffe
cmp dword [ebp - 0xa44], esi
mov eax, dword [ebx + 0x18]
jne 0x4ad16ae7
or eax, 2
jmp 0x4ad16aed
or eax, dword [ebp - 0xa44]
mov dword [ebx + 0x18], eax
mov dword [ebp - 0xa70], edi
push dword [ebx + 0x18]
lea eax, [ebp - 0xa34]
push eax
push dword [ebp - 0xa40]
call fcn.4ad0de39
jmp 0x4ad0da6f
push dword [ebp - 0xa38]
call fcn.4ad01925
jmp 0x4ad0da75
test byte [ebx + 0x18], 0x80
jne 0x4ad0d847
push dword [ebp - 0xa38]
call fcn.4ad01925
mov eax, dword [0x4ad33b10]
xor esi, esi
cmp eax, esi
je 0x4ad16b5e
mov ecx, dword [ebp - 0xa48]
mov ecx, dword [ecx + 0x1c]
cmp ecx, esi
je 0x4ad16b5e
test byte [ecx + 0x18], 8
je 0x4ad16b5e
cmp dword [ebx + 0x1c], esi
jne 0x4ad16b5e
mov dword [0x4ad33afc], edi
push dword [ebp - 0xa3c]
push dword [ebp - 0xa4c]
push dword [ebp - 0xa40]
push eax
lea eax, [ebp - 0xa30]
push eax
push ebx
call fcn.4ad1db7e
jmp 0x4ad0d849
mov dword [ebp - 0xa58], edi
jmp 0x4ad0d879
test cl, 8
je 0x4ad0d893
cmp dword [0x4ad33afc], 3
jne 0x4ad0d893
cmp dword [ebp - 0xa58], esi
mov dword [ebp - 0xa6c], 3
jne 0x4ad0d89f
mov edx, dword [ebp - 0xa48]
mov edx, dword [edx + 0x1c]
cmp edx, esi
je 0x4ad16bcd
test byte [edx + 0x18], 8
jne 0x4ad16bdf
or ecx, 2
jmp 0x4ad16be1
cmp dword [ebp - 0xa6c], 3
jne 0x4ad0d89f
or ecx, edi
mov dword [ebx + 0x18], ecx
jmp 0x4ad0d89f
mov ecx, dword [ebp - 0xa44]
cmp ecx, esi
jne 0x4ad16bfc
mov ecx, dword [ebx + 0x18]
and ecx, 0xfffffffe
or ecx, 2
mov dword [ebx + 0x18], ecx
jmp 0x4ad0d8d2
cmp dword [ebp - 0xa44], esi
mov dword [ebp - 0xa60], edi
jne 0x4ad0d91e
mov eax, dword [ebx + 0x18]
and eax, 0xfffffffe
or eax, 2
mov dword [ebx + 0x18], eax
jmp 0x4ad0d91e
cmp dword [0x4ad33afc], 3
jne 0x4ad0d92a
and dword [ebx + 0x18], 0xfffffffe
cmp dword [ebp - 0xa44], 0
mov eax, dword [ebx + 0x18]
jne 0x4ad16c49
or eax, 2
jmp 0x4ad16c4f
or eax, dword [ebp - 0xa44]
mov dword [ebx + 0x18], eax
jmp 0x4ad0d92a
cmp dword [ebp - 0xa44], 0
jne 0x4ad0d93e
and eax, 0xfffffffe
or eax, 2
mov dword [ebx + 0x18], eax
jmp 0x4ad0d93e
cmp dword [ebp - 0xa58], 0
jne 0x4ad0d952
cmp dword [ebp - 0xa44], 0
jne 0x4ad0d952
and eax, 0xfffffffe
or eax, 2
mov dword [ebx + 0x18], eax
jmp 0x4ad0d952
push dword [ebx + 4]
call fcn.4ad1e47a
test eax, eax
jne 0x4ad16cb6
lea eax, [ebp - 0x20c]
push eax
call fcn.4ad1e47a
test eax, eax
je 0x4ad16cb8
mov eax, edi
mov ecx, dword [ebp - 0xa64]
or ecx, 2
push ecx
push 0
push eax
push 0x4ad1d7e9
lea eax, [ebp - 0x20c]
push eax
push dword [ebx + 4]
call dword [0x4ad2fa2c]
jmp 0x4ad0d9cb
lea eax, [ebp - 0x20c]
push eax
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
jmp 0x4ad0d9cb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0xa38]
mov dword [0x4ad2b9c4], eax
call fcn.4ad01925
cmp dword [ebp - 0xa60], esi
je 0x4ad16d15
push 0x1d
pop esi
xor eax, eax
cmp dword [0x4ad2b9c4], eax
mov dword [0x4ad33ad8], eax
jne 0x4ad16d2e
mov dword [0x4ad2b9c4], 0x70
cmp dword [0x4ad2b9a8], eax
je 0x4ad16d3a
xor esi, esi
jmp 0x4ad16d49
cmp esi, eax
jne 0x4ad16d49
push dword [0x4ad2b9c4]
call fcn.4ad0ef21
cmp dword [ebp - 0xa74], 0
je 0x4ad1704f
jmp 0x4ad16989
push esi
push edi
lea eax, [ebp - 0x20c]
push eax
call fcn.4ad1e3e8
mov esi, eax
cmp esi, 0xffffffff
mov dword [ebp - 0xa30], esi
je 0x4ad16f34
push esi
call fcn.4ad01538
test eax, eax
push esi
jne 0x4ad16f93
call dword [sym.imp.msvcrt.dll__get_osfhandle]
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
test eax, eax
jne 0x4ad16db6
lea eax, [ebp - 0x20c]
push eax
push edi
push 0x271f
call fcn.4ad050c9
add esp, 0xc
push esi
jmp 0x4ad16f93
push esi
call fcn.4ad01925
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.4ad0e24c
mov esi, eax
cmp esi, 0xffffffff
mov dword [ebp - 0xa30], esi
je 0x4ad16f34
push esi
call fcn.4ad01538
test eax, eax
jne 0x4ad16d9b
mov esi, dword [sym.imp.msvcrt.dll__get_osfhandle]
push eax
push eax
push eax
push dword [ebp - 0xa38]
call esi
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
xor eax, eax
push eax
push eax
push eax
push dword [ebp - 0xa30]
call esi
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp - 0xa88]
push eax
push dword [ebp - 0xa38]
call esi
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
lea eax, [ebp - 0xa84]
push eax
push dword [ebp - 0xa30]
call dword [sym.imp.msvcrt.dll__get_osfhandle]
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp esi, eax
jne 0x4ad16f78
mov eax, dword [ebp - 0xa88]
cmp eax, dword [ebp - 0xa84]
jne 0x4ad16f78
and dword [ebp - 0xa54], 0
mov edi, dword [sym.imp.msvcrt.dll__get_osfhandle]
push 0
lea eax, [ebp - 0xa34]
push eax
push dword [ebp - 0xa4c]
push dword [ebp - 0xa40]
push dword [ebp - 0xa38]
call edi
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
pop ecx
push eax
call esi
test eax, eax
je 0x4ad16f05
cmp dword [ebp - 0xa34], 0
je 0x4ad16f05
push 0
lea eax, [ebp - 0xa80]
push eax
push dword [ebp - 0xa34]
push dword [ebp - 0xa5c]
push dword [ebp - 0xa30]
call edi
pop ecx
push eax
call esi
test eax, eax
je 0x4ad16f1f
mov ecx, dword [ebp - 0xa34]
cmp dword [ebp - 0xa80], ecx
jne 0x4ad16f1f
cmp dword [ebp - 0xa4c], ecx
je 0x4ad16ee7
mov dword [ebp - 0xa54], 1
mov edi, dword [ebp - 0xa5c]
mov esi, dword [ebp - 0xa40]
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x4ad16f4e
cmp dword [ebp - 0xa54], eax
je 0x4ad16e68
push dword [ebp - 0xa30]
call fcn.4ad01925
or dword [ebp - 0xa30], 0xffffffff
xor edi, edi
inc edi
jmp 0x4ad0da0c
push dword [ebp - 0xa30]
call fcn.4ad01925
or dword [ebp - 0xa30], 0xffffffff
xor edi, edi
inc edi
lea eax, [ebp - 0x20c]
push eax
push edi
push 0x271f
call fcn.4ad050c9
add esp, 0xc
jmp 0x4ad0da0c
push dword [ebp - 0xa30]
call fcn.4ad01925
or dword [ebp - 0xa30], 0xffffffff
lea eax, [ebp - 0x20c]
push eax
push 1
push 0x271f
call fcn.4ad050c9
add esp, 0xc
jmp 0x4ad16f17
lea eax, [ebp - 0x20c]
push eax
push edi
push 0x271f
call fcn.4ad050c9
add esp, 0xc
push dword [ebp - 0xa30]
call fcn.4ad01925
or dword [ebp - 0xa30], 0xffffffff
jmp 0x4ad0da0c
push dword [ebp - 0xa30]
call dword [sym.imp.msvcrt.dll__get_osfhandle]
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
cmp dword [0x4ad33b10], 0
jne 0x4ad17060
cmp dword [0x4ad33afc], 3
jne 0x4ad17060
mov eax, dword [ebx + 0x18]
test al, 2
je 0x4ad17060
mov esi, 0x4000
test esi, eax
je 0x4ad17065
mov eax, dword [ebp - 0xa40]
sub dword [ebp - 0xa34], 2
push dword [ebp - 0xa34]
lea ecx, [eax + 2]
push ecx
push eax
call dword [sym.imp.msvcrt.dll_memmove]
add esp, 0xc
jmp 0x4ad17065
xor esi, esi
push esi
push edi
lea eax, [ebp - 0x20c]
push eax
call fcn.4ad1e3e8
cmp eax, 0xffffffff
mov dword [ebp - 0xa30], eax
jne 0x4ad16fb8
push dword [ebp - 0xa38]
call fcn.4ad01925
cmp dword [0x4ad33af8], esi
jne 0x4ad17042
push dword [0x4ad2b9c4]
call fcn.4ad0ef21
cmp dword [0x4ad33afc], 3
je 0x4ad1697e
mov dword [ebp - 0xa50], edi
mov dword [0x4ad33b0c], edi
jmp 0x4ad0da75
mov esi, 0x4000
test dword [ebx + 0x18], esi
je 0x4ad1707f
mov ecx, dword [ebp - 0xa48]
mov eax, dword [ecx + 0x1c]
test eax, eax
je 0x4ad1707c
or dword [eax + 0x18], esi
jmp 0x4ad1707f
or dword [ecx + 0x18], esi
cmp dword [0x4ad33ad8], 0
je 0x4ad1709a
cmp dword [ebp - 0xa34], 0
jg 0x4ad17174
jmp 0x4ad0da0c
cmp dword [ebp - 0xa54], edi
jne 0x4ad1714e
push dword [ebp - 0xa38]
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0xa34]
push dword [ebp - 0xa40]
push dword [ebp - 0xa30]
call fcn.4ad1dc3b
xor esi, esi
cmp dword [0x4ad33af0], esi
je 0x4ad17110
push dword [ebp - 0xa30]
call fcn.4ad01538
test eax, eax
jne 0x4ad17110
push dword [ebp - 0xa5c]
lea eax, [ebp - 0x20c]
push dword [ebp - 0xa40]
push dword [ebp - 0xa34]
push eax
lea eax, [ebp - 0xa30]
push eax
call fcn.4ad1da8e
cmp eax, edi
je 0x4ad1697e
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0xa30]
lea eax, [ebp - 0xa34]
push ebx
push eax
push dword [ebp - 0xa4c]
push dword [ebp - 0xa40]
push dword [ebp - 0xa38]
call fcn.4ad0dec6
cmp dword [0x4ad33ad8], esi
mov dword [ebp - 0xa54], eax
je 0x4ad1709a
cmp dword [0x4ad33ad8], 0
je 0x4ad0da0c
cmp dword [ebp - 0xa34], 0
jle 0x4ad0da0c
cmp dword [ebp - 0xa54], edi
jne 0x4ad0da0c
push dword [ebp - 0xa38]
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0xa34]
push dword [ebp - 0xa40]
push dword [ebp - 0xa30]
call fcn.4ad1dc3b
cmp dword [0x4ad33af0], 0
je 0x4ad0da0c
push dword [ebp - 0xa30]
call fcn.4ad01538
test eax, eax
jne 0x4ad0da0c
push dword [ebp - 0xa5c]
lea eax, [ebp - 0x20c]
push dword [ebp - 0xa40]
push dword [ebp - 0xa34]
push eax
lea eax, [ebp - 0xa30]
push eax
call fcn.4ad1da8e
cmp eax, edi
jne 0x4ad0da0c
jmp 0x4ad1727e
push dword [ebp - 0xa30]
call fcn.4ad01925
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0xa50], edi
jmp 0x4ad0da69
cmp dword [ebp - 0xa30], 0xffffffff
je 0x4ad0dc31
push esi
push dword [ebp - 0xa30]
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0xa48]
push ebx
call fcn.4ad0daa4
jmp 0x4ad0dc31
push dword [ebp - 0xa3c]
call fcn.4ad03015
cmp dword [ebp - 0xa30], 0xffffffff
je 0x4ad0f3b9
push dword [ebp - 0xa30]
call fcn.4ad01925
jmp 0x4ad0f3b9
pop ecx
pop ecx
push dword [ebp - 0xa38]
call fcn.4ad01925
push dword [ebp - 0xa3c]
call fcn.4ad03015
jmp 0x4ad0f3b9
push dword [ebp - 0xa3c]
call fcn.4ad03015
push edi
push 0
call fcn.4ad1d903
int3