Function at 0x49d730
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d5508
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x1608
call fcn.004c0c80
mov eax, dword [0x4eb984]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor ebx, ebx
cmp byte [ebp + 0x10], bl
je 0x49d788
cmp word [0x54894e], bx
je 0x49d7e8
cmp dword [0x56c7ac], ebx
je 0x49d7e8
xor eax, eax
mov word [0x54894e], ax
jmp 0x49d7e8
push 1
call fcn.0049ab50
mov dword [0x54ba94], 3
mov al, byte [ebp + 0xc]
cmp al, bl
je 0x49d7a5
mov byte [0x54bace], al
mov dword [0x5344c8], ebx
mov dword [0x5344cc], ebx
cmp byte [0x533431], bl
jne 0x49d8b4
push ebx
push 0x551d54
mov ecx, 0x53fdc8
call fcn.0044cf70
cmp byte [0x540de2], bl
je 0x49d7e8
cmp dword [0x551d68], 1
jbe 0x49d7e8
mov dword [0x54ba90], 4
cmp byte [0x533431], bl
jne 0x49d8b4
cmp word [0x550d52], bx
jne 0x49d8b4
mov byte [ebp + 8], bl
mov esi, 0x550d52
call fcn.0049a320
push 0x800
push 0x4d79fc
lea ecx, [ebp - 0x10b4]
push ecx
push str.DefFolder
push str.Compression
call fcn.0046c5c0
cmp word [ebp - 0x10b4], bx
jne 0x49d854
cmp byte [0x540de2], bl
je 0x49d891
lea edx, [ebp - 0x10b4]
push edx
call fcn.00448f00
cmp word [ebp - 0x10b4], bx
je 0x49d891
push 0x800
lea eax, [ebp - 0x10b4]
push eax
call fcn.0045fed0
push 0x800
push 0x550d52
lea ecx, [ebp - 0x10b4]
push ecx
call fcn.0047efb0
push 0x800
lea edx, [ebp - 0x10b4]
push edx
push 0x550d52
call fcn.0047ef70
mov eax, dword [0x54dcf0]
push eax
cmp word [0x546948], bx
setne cl
movzx edx, cl
push edx
push 0x800
push 0x550d52
call fcn.004978e0
cmp dword [0x54ba90], ebx
jne 0x49d8c6
mov dword [0x54ba90], 5
cmp byte [0x533431], bl
je 0x49d9ce
mov esi, dword [0x5420fc]
cmp esi, ebx
je 0x49d907
cmp esi, 1
je 0x49d907
push 0x30
push 0x65
call fcn.004750b0
push eax
push 0x1fd
call fcn.004750b0
push eax
mov eax, dword [0x535584]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x49dce0
push 0x800
push 0x550d52
mov ecx, 0x541ef0
call fcn.00415140
push 0x800
push 0x54995c
mov ecx, 0x541ef0
call fcn.00415120
cmp word [0x54995c], bx
je 0x49d947
push 0x800
push 0x54995c
call fcn.0045fed0
mov byte [0x54bae8], bl
lea ecx, [ebp - 0x1614]
push ecx
mov ecx, 0x541ef0
call fcn.00415170
mov eax, dword [ebp - 0x1594]
mov dword [0x54dcf0], eax
cmp eax, ebx
jne 0x49d97c
cmp byte [ebp - 0x1590], bl
mov byte [0x54bacf], 1
jne 0x49d982
mov byte [0x54bacf], bl
cmp esi, ebx
jne 0x49d98e
cmp dword [ebp - 0x1508], ebx
je 0x49d99a
mov edx, dword [ebp - 0x14cc]
mov dword [0x54ba80], edx
xor eax, eax
cmp dword [ebp - 0x14ec], ebx
je 0x49d9c8
jmp 0x49d9b0
movzx ecx, word [eax + 0x4d7800]
mov word [eax + 0x546948], cx
add eax, 2
cmp cx, bx
jne 0x49d9b0
jmp 0x49d9ce
mov word [0x546948], ax
mov ecx, dword [0x535584]
push ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
neg eax
sbb eax, eax
and eax, dword [0x535584]
push ebx
mov edx, dword [ebp + 8]
push edx
push eax
call fcn.0049d430
test al, al
je 0x49dcc1
mov eax, dword [0x56c7b4]
cmp eax, 1
je 0x49da07
cmp eax, 2
jne 0x49da5c
mov eax, dword [0x56c7c0]
push eax
mov ecx, dword [0x56c7bc]
push ecx
mov edx, dword [0x56c7b8]
push edx
push str._dd_dh_dm
lea eax, [ebp - 0xb4]
push eax
mov edx, 0x50
call fcn.00495190
add esp, 0x14
cmp dword [0x56c7b4], 1
jne 0x49da4b
lea ecx, [ebp - 0xb4]
push ecx
mov ecx, 0x54bbf0
jmp 0x49da57
lea edx, [ebp - 0xb4]
push edx
mov ecx, 0x54bbf8
call fcn.00482570
mov eax, dword [0x56c7ac]
cmp eax, ebx
je 0x49da6d
push eax
call fcn.00495630
jmp 0x49da8f
cmp byte [0x533431], bl
je 0x49da8f
cmp dword [ebp - 0x14ec], ebx
je 0x49da8f
cmp word [0x546948], 0x2a
jne 0x49da8f
xor eax, eax
mov word [0x546948], ax
cmp dword [0x551d68], ebx
jne 0x49dabe
push 0x30
push 0x65
call fcn.004750b0
push eax
push 0x14b
call fcn.004750b0
push eax
mov ecx, dword [0x535584]
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x49dcc1
cmp word [0x54894e], bx
je 0x49db35
cmp dword [0x549950], ebx
jne 0x49db35
push 0x4d94b8
push 0x54894e
call fcn.0043c890
mov esi, eax
cmp esi, ebx
je 0x49db35
push esi
push 0x400
push 1
lea edx, [ebp - 0x14b4]
push edx
call fcn.004c4096
add esp, 0x10
mov dword [ebp - 0x1618], 0x30c
cmp eax, ebx
jbe 0x49db2c
lea ecx, [ebp - 0x1618]
push ecx
push eax
lea edx, [ebp - 0x14b4]
push edx
call dword [sym.imp.ADVAPI32.dll_IsTextUnicode]
test eax, eax
je 0x49db2c
mov dword [0x549950], 3
push esi
call fcn.004c34b2
add esp, 4
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x70]
call fcn.0047f4c0
mov byte [ebp - 4], 1
mov ecx, 0x551d54
call fcn.0047f2b0
mov edi, edi
mov ecx, 0x551d54
call fcn.0047f6b0
cmp eax, ebx
je 0x49db86
push 0x800
lea ecx, [ebp - 0x10b4]
push ecx
push eax
mov ecx, 0x53fdc8
call fcn.0044bbf0
lea edx, [ebp - 0x10b4]
push edx
lea ecx, [ebp - 0x70]
call fcn.0047f330
jmp 0x49db50
lea eax, [ebp - 0x70]
push eax
mov ecx, 0x551d54
call fcn.0042dae0
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x70]
call fcn.0040bde0
mov dword [ebp - 4], 0xffffffff
jmp 0x49dbc1
cmp byte [0x54fcfd], bl
jne 0x49dbe2
push 0x800
push 0x550d52
push 0x550d52
mov ecx, 0x53fdc8
call fcn.0044bbf0
mov cl, byte [0x54aa5c]
mov byte [0x5355b4], cl
mov ecx, 0x535588
call fcn.0047e940
cmp byte [0x54fd14], bl
je 0x49dc07
call fcn.0049b850
jmp 0x49dc19
movzx edx, byte [0x54fcfb]
push edx
mov ecx, 0x541ef0
call fcn.004196c0
cmp dword [0x56c7ac], ebx
je 0x49dc2b
push 0x54894e
call fcn.0043c500
cmp dword [0x53444c], 1
je 0x49dcc1
cmp byte [0x533431], bl
je 0x49dc4c
mov ecx, 0x53fdc8
call fcn.00451170
jmp 0x49dcc1
cmp byte [0x54bace], bl
je 0x49dc5e
mov ecx, 0x53fda8
call fcn.00485430
push 0x800
lea eax, [ebp - 0x10b4]
push eax
mov ecx, 0x53fdc8
call fcn.0044bbc0
lea eax, [ebp - 0x10b4]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x49dc80
sub eax, edx
sar eax, 1
push eax
push 0x550d52
lea ecx, [ebp - 0x10b4]
push ecx
call fcn.004869c0
test eax, eax
jne 0x49dcb1
push 0x550d52
call fcn.00460330
jmp 0x49dcb6
mov eax, 0x4d79fc
push eax
mov ecx, 0x53fdc8
call fcn.0044f550
mov edx, dword [0x56c7ac]
push edx
call fcn.004c172a
add esp, 4
mov byte [0x5355b4], bl
mov ecx, 0x535588
call fcn.0047e940
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004c0c62
mov esp, ebp
pop ebp
ret 0xc