Function at 0x49d0d0
Capabilities:
Delete file
Get thread local storage value
Read file on windows

Disassembly:
mov eax, dword [0x526ad4]
sub esp, 0x10
push ebx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x49d0f4
pop edi
pop esi
mov eax, 4
pop ebx
add esp, 0x10
ret
mov eax, dword [esi + 0x44]
mov ecx, dword [esi + 0xb08]
mov edx, dword [esi + 0xb0c]
mov dword [esi + 0xab2], ecx
test eax, eax
mov dword [esi + 0xab6], edx
jne 0x49d211
mov al, byte [esi + 0xafc]
mov bl, 8
test bl, al
je 0x49d153
mov eax, dword [esi + 0xc4a]
mov ecx, dword [esi + 0xc52]
mov dword [esi + 0xb04], eax
mov eax, dword [esi + 0xc4e]
mov dword [esi + 0xb08], eax
mov dword [esi + 0xb0c], ecx
mov dword [esi + 0xab2], eax
mov dword [esi + 0xab6], ecx
mov eax, dword [esi + 0xc64]
xor ecx, ecx
mov cx, word [esi + 0xb12]
xor edx, edx
mov dx, word [esi + 0xb10]
mov edi, 0x2800
add ecx, edx
xor edx, edx
push 0
push 0
lea ecx, [ecx + eax + 0x1e]
mov eax, ecx
div edi
mov edi, edx
sub ecx, edi
push ecx
mov ecx, dword [esi + 0x8cf8]
push ecx
call fcn.004a2ed0
mov ecx, dword [esi + 0x8cf8]
add esp, 0x10
lea edx, [esp + 0x14]
mov dword [esi + 0x8f4c], eax
mov eax, dword [esi + 0x8ce2]
push 0
push edx
push 0x2800
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x49d1fb
mov eax, dword [esp + 0x14]
test eax, eax
je 0x49d1fb
mov edx, dword [esi + 0x8ce2]
and eax, 0xffff
sub eax, edi
add edx, edi
mov dword [esi + 0x8cea], eax
mov al, byte [esi + 0xc60]
test bl, al
mov dword [esi + 0x8ce6], edx
je case.0x49d2a2.1
pop edi
pop esi
mov eax, 0x2e
pop ebx
add esp, 0x10
ret
mov dword [esi + 0x8cea], 0
pop edi
pop esi
mov eax, 2
pop ebx
add esp, 0x10
ret
mov eax, 3
push ebp
mov dword [esp + 0x10], eax
mov ecx, dword [esi + 0x4c]
mov ebp, dword [esi + 0x8ce2]
mov ebx, dword [esi + 0x50]
xor edi, edi
mov dword [esp + 0x18], ecx
cmp eax, 3
jne 0x49d298
mov edx, 0x2800
lea eax, [esp + 0x10]
sub edx, edi
push eax
mov dword [esp + 0x18], edx
mov ecx, dword [esi + 0xada]
mov eax, dword [esi + 0x54]
mov edx, dword [esi + 0x58]
push ecx
mov ecx, 0x20
call fcn.004b4f70
mov edx, dword [esi + 0x54]
mov ecx, dword [esp + 0x20]
push eax
push edx
push ebx
lea edx, [esp + 0x28]
push ecx
mov eax, ebx
push edx
push ebp
sar eax, 0x1f
push 0
call dword [esi + 0xad6]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
add edi, eax
add ebp, eax
add edx, eax
mov eax, dword [esp + 0x10]
adc ebx, 0
cmp edi, 0x2800
mov dword [esp + 0x18], edx
jb 0x49d22d
cmp eax, 3
mov dword [esp + 0x14], edi
pop ebp
ja case.0x49d2a2.1
jmp dword [eax*4 + 0x49d380]
mov eax, dword [esi + 0x8ce2]
and edi, 0xffff
mov dword [esi + 0x8cea], edi
mov dword [esi + 0x8ce6], eax
je 0x49d2e4
mov edx, dword [esi + 0x4c]
add edx, edi
mov dword [esi + 0x4c], edx
mov ecx, dword [esi + 0x50]
adc ecx, 0
mov dword [esi + 0x50], ecx
mov eax, dword [esp + 0xc]
xor ecx, ecx
test eax, eax
sete cl
mov dword [esi + 0x48], ecx
jmp case.0x49d2a2.1
mov dword [esi + 0x48], 1
mov eax, dword [esi + 0xc84]
test eax, eax
je 0x49d2fe
call fcn.0049d050
test eax, eax
jne 0x49d36c
mov eax, dword [esi + 0x99e]
mov ebx, dword [esp + 0x20]
test eax, eax
jne 0x49d373
mov eax, dword [esi + 0x3c]
test eax, eax
jne 0x49d373
mov eax, dword [esi + 0x44]
test eax, eax
jne 0x49d373
push ebx
call fcn.004a23f0
mov edi, eax
add esp, 4
test edi, edi
jne 0x49d339
call fcn.004a2f90
mov edi, eax
test edi, edi
jne 0x49d339
cmp dword [esi], 0
je 0x49d36a
mov eax, dword [esi + 0x9068]
cmp eax, 0xffffffff
je 0x49d34b
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [esi + 0x99e]
test eax, eax
jne 0x49d36a
mov eax, dword [esi + 0x3c]
test eax, eax
jne 0x49d36a
mov eax, dword [esi + 0x44]
test eax, eax
jne 0x49d36a
push ebx
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0x10
ret
mov dword [esi + 0x9068], 0xffffffff
jmp 0x49d329