Function at 0x494b40
Capabilities:
Move file
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4b8867
mov eax, dword fs:[0]
push eax
mov eax, 0x87f8
call fcn.004a5100
mov eax, dword [0x4cc3b0]
xor eax, esp
mov dword [esp + 0x87f4], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4cc3b0]
xor eax, esp
push eax
lea eax, [esp + 0x880c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x881c]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
mov eax, dword [str.InterfaceConvertProfile]
push eax
push str._s_u
push 0x511c48
mov edx, 0xc8
call fcn.004a29f0
add esp, 0x10
lea ecx, [esp + 0x390]
call fcn.0043f400
mov ebx, 1
mov dword [esp + 0x8814], ebx
xor ebp, ebp
cmp byte [0x4e9b89], 0
mov byte [esp + 0xc64], 0
je 0x494ca8
push 0x400
lea ecx, [esp + 0x77dc]
push ecx
mov ecx, 0x4f0da0
call fcn.004130e0
push 0x830
lea edx, [esp + 0x210c]
push ebp
push edx
call fcn.004a5130
add esp, 0xc
xor eax, eax
jmp 0x494c10
movzx ecx, word [esp + eax + 0x77d8]
mov word [esp + eax + 0x2108], cx
add eax, 2
cmp cx, bp
jne 0x494c10
lea ecx, [esp + 0x187c]
call fcn.00412750
lea ecx, [esp + 0x18a0]
call fcn.00412750
lea ecx, [esp + 0x18c4]
call fcn.00412750
push ebp
lea eax, [esp + 0xc6c]
push eax
lea ecx, [esp + 0x77e0]
push ecx
push ebp
call fcn.00435490
test al, al
je 0x494c83
mov edx, dword [esp + 0x1868]
mov eax, dword [esp + 0x186c]
mov dword [esp + 0x2908], edx
mov dword [esp + 0x290c], eax
lea ecx, [esp + 0x2108]
push ecx
lea ecx, [esp + 0x394]
call fcn.0043f010
lea ecx, [esp + 0x390]
call fcn.0043f280
jmp 0x494d5c
lea ecx, [esp + 0x48]
call fcn.0046afd0
mov byte [esp + 0x8814], 2
lea edi, [esp + 0x48]
cmp esi, ebp
je 0x494cc5
mov edi, esi
jmp 0x494cd5
push ebp
lea edx, [esp + 0x4c]
push edx
mov ecx, 0x4f0478
call fcn.00440890
push ebp
push ebp
push ebx
push ebx
push ebx
lea eax, [esp + 0x3a4]
push eax
push 3
push edi
call fcn.00463760
test al, al
jne 0x494d1b
mov byte [esp + 0x8814], 1
lea ecx, [esp + 0x48]
call fcn.00401b00
mov dword [esp + 0x8814], 0xffffffff
lea ecx, [esp + 0x390]
call fcn.00491a30
jmp 0x495f12
xor esi, esi
cmp dword [esp + 0x444], ebp
jbe 0x494d4b
jmp 0x494d30
push esi
lea ecx, [esp + 0x394]
call fcn.0043f3a0
add esi, ebx
mov dword [eax + 4], ebp
cmp esi, dword [esp + 0x444]
jb 0x494d30
mov byte [esp + 0x8814], 1
lea ecx, [esp + 0x48]
call fcn.00401b00
mov ecx, dword [str.InterfaceConvertProfile]
push 0x511c48
push ecx
call fcn.0045bc60
mov edx, dword [0x4eacd4]
push edx
mov byte [esp + 0x1a], 0
call dword [sym.imp.USER32.dll_IsWindowVisible]
mov edx, dword [0x4d76b0]
neg eax
lea ecx, [esp + 0x390]
push ecx
sbb eax, eax
and eax, dword [0x4eacd4]
push 0x491a80
push eax
push str.CONVERTARC
push edx
mov dword [esp + 0x38], ebp
call dword [sym.imp.USER32.dll_DialogBoxParamW]
test eax, eax
je 0x495eca
push ebp
push str.Background
push 0x511c48
call fcn.0045b940
test eax, eax
jne 0x494de0
cmp dword [0x4ea3a4], ebx
jne 0x494dd9
cmp byte [0x4f7fc3], al
jne 0x494de0
mov byte [esp + 0x1c], 0
jmp 0x494de5
mov byte [esp + 0x1c], 1
mov eax, dword [esp + 0x1c]
push ebp
push eax
push ebp
push 8
call fcn.004885c0
push 0x400
lea ecx, [esp + 0x210c]
push ecx
call fcn.00485b10
xor esi, esi
xor edi, edi
mov dword [esp + 0x38], ebp
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ebp
mov dword [0x4ea420], ebp
mov dword [0x4ea424], ebp
cmp dword [esp + 0x444], ebp
jbe 0x494e62
mov edi, edi
push edi
lea ecx, [esp + 0x394]
call fcn.0043f3a0
test byte [eax + 4], 8
je 0x494e57
mov edx, dword [eax + 8]
add dword [0x4ea420], edx
mov eax, dword [eax + 0xc]
adc dword [0x4ea424], eax
add esi, ebx
add edi, ebx
cmp edi, dword [esp + 0x444]
jb 0x494e30
push 0x480
lea ecx, [esp + 0x3ddc]
push ecx
push ebp
push esi
call fcn.004467a0
mov eax, dword [0x4e9b84]
mov edi, dword [sym.imp.USER32.dll_SetDlgItemTextW]
lea edx, [esp + 0x3dd8]
push edx
push 0x65
push eax
call edi
or esi, 0xffffffff
cmp byte [0x4eac4c], 0
mov dword [0x4eac40], ebp
mov dword [0x4eac44], ebp
mov dword [esp + 0x20], ebp
jne 0x495677
cmp byte [0x4e9b88], 0
jne 0x49568e
mov edx, dword [esp + 0x24]
push 0x480
lea ecx, [esp + 0x3ddc]
push ecx
push ebp
push edx
call fcn.004467a0
mov ecx, dword [0x4e9b84]
lea eax, [esp + 0x3dd8]
push eax
push 0x66
push ecx
call edi
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
push 0x480
lea edx, [esp + 0x3ddc]
push edx
push eax
push ecx
call fcn.004467a0
mov eax, dword [0x4e9b84]
lea edx, [esp + 0x3dd8]
push edx
push 0x67
push eax
call edi
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
push 0x480
lea ecx, [esp + 0x3ddc]
push ecx
push edx
push eax
call fcn.004467a0
mov edx, dword [0x4e9b84]
lea ecx, [esp + 0x3dd8]
push ecx
push 0x68
push edx
call edi
cmp esi, 0xffffffff
je 0x494f78
push esi
lea eax, [esp + 0x7fdc]
push eax
lea ecx, [esp + 0x398]
call fcn.0043f1d0
mov ecx, dword [eax + 0x800]
add dword [0x4eac40], ecx
mov edx, dword [eax + 0x804]
adc dword [0x4eac44], edx
or esi, 0xffffffff
call fcn.00487750
mov eax, dword [esp + 0x20]
cmp eax, dword [esp + 0x444]
jge 0x495677
mov ecx, eax
push ecx
lea ecx, [esp + 0x394]
call fcn.0043f3a0
mov ebx, eax
test byte [ebx + 4], 8
mov dword [esp + 0x18], ebx
je 0x495666
mov edx, dword [ebx]
mov esi, dword [esp + 0x20]
push 1
push ebp
push edx
mov ecx, 0x4f0da0
mov dword [esp + 0x50], esi
call fcn.00416320
cmp eax, 1
jne 0x495666
lea eax, [esp + 0xf0]
push eax
mov ecx, 0x4f0da0
call fcn.00413110
lea ecx, [esp + 0x187c]
call fcn.00412750
lea ecx, [esp + 0x18a0]
call fcn.00412750
lea ecx, [esp + 0x18c4]
call fcn.00412750
mov edx, dword [ebx]
push ebp
lea ecx, [esp + 0xc6c]
push ecx
push edx
push ebp
call fcn.00435490
test al, al
je 0x495666
cmp word [0x4f60b8], bp
jne 0x49504b
cmp dword [esp + 0x22c], ebp
je 0x49504b
push 0x50e
call fcn.004611c0
push eax
mov eax, dword [ebx]
push eax
call fcn.00493840
add esp, 8
jmp 0x495666
lea ecx, [esp + 0x67d8]
push ecx
push str.Rar_CVXXXXXX
call fcn.00485420
test al, al
je 0x495666
lea edx, [esp + 0x67d8]
push edx
call fcn.00485af0
mov esi, 1
cmp dword [0x4ea3a4], esi
jne 0x495089
mov ecx, 0x4f2ca0
call fcn.0041e5d0
call fcn.004816c0
push 0x400
push 0x4f901c
mov ecx, 0x4f0da0
call fcn.004130e0
mov eax, dword [0x4f0fac]
mov ecx, dword [0x4f981c]
mov dword [0x4f6fbc], eax
mov eax, 4
push 0x4ba77c
mov dword [0x4f65c4], esi
mov dword [0x4f6ba8], eax
mov dword [0x4f6bac], eax
call fcn.0046b070
push 0x4f901c
push 0x20a
call fcn.004611c0
push eax
lea ecx, [esp + 0x3de0]
push ecx
mov edx, 0x480
call fcn.004a29f0
add esp, 0xc
lea edx, [esp + 0x3dd8]
push edx
call fcn.00485f20
cmp byte [0x4f6ba2], 0
mov eax, dword [0x5135e0]
mov dword [esp + 0x1c], eax
je 0x495121
mov byte [0x4f6ba2], 0
mov byte [esp + 0x16], 1
push ebp
push ebp
mov ecx, 0x4f0da0
call fcn.00417a60
cmp byte [0x4e9b88], 0
jne 0x495642
mov ecx, dword [esp + 0x1c]
cmp ecx, dword [0x5135e0]
jne 0x495642
push 0x511c48
call fcn.00481a70
mov edx, dword [0x4f660c]
mov dword [esp + 0x40], edx
mov byte [0x4f66da], 0
cmp word [0x4f4cb0], bp
jne 0x4951ce
push ebp
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x34]
push ecx
mov ecx, 0x4f0da0
mov dword [esp + 0x38], ebp
mov dword [esp + 0x34], ebp
call fcn.004132c0
cmp dword [esp + 0x28], ebp
jbe 0x4951c1
push 0x4f4cb0
push str.Rar_CMXXXXXX
call fcn.00485330
mov esi, eax
cmp esi, ebp
je 0x4951c1
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
push esi
push edx
push 1
push eax
call fcn.004a6bc4
push esi
call fcn.004a6995
add esp, 0x14
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.004a5515
add esp, 4
mov esi, dword [esp + 0x18]
mov eax, dword [esi]
push 0x400
lea edx, [esp + 0x7fdc]
push edx
push eax
call fcn.00452170
xor eax, eax
lea esp, [esp]
movzx ecx, word [esp + eax + 0x45c]
mov word [esp + eax + 0x5fd8], cx
add eax, 2
cmp cx, bp
jne 0x4951f0
cmp word [esp + 0x5fd8], bp
je 0x49521f
lea ecx, [esp + 0x5fd8]
push ecx
call fcn.004516d0
mov edx, dword [esi]
push edx
call fcn.00440080
mov byte [esp + 0x17], al
mov ebx, 0x4bae00
cmp dword [0x4f6fbc], ebp
je 0x49523d
mov ebx, 0x4baa98
cmp word [0x4f34b0], bp
je 0x49524b
mov ebx, 0x4badc8
mov esi, dword [esp + 0x18]
mov eax, dword [esi]
push ebx
push eax
call fcn.00452030
test al, al
je 0x4953b4
cmp word [esp + 0x5fd8], bp
je 0x495287
lea ecx, [esp + 0x7fd8]
push ecx
lea edx, [esp + 0x5fdc]
push edx
call fcn.00473340
test eax, eax
jne 0x4953b4
mov byte [esp + 0x15], 1
xor eax, eax
mov edi, edi
movzx ecx, word [esp + eax + 0x67d8]
mov word [eax + 0x4f901c], cx
add eax, 2
cmp cx, bp
jne 0x495290
push 0x4f901c
call fcn.004516d0
mov eax, dword [esi]
push eax
call fcn.00451c30
mov edx, eax
jmp 0x4952c0
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x4952c0
mov edi, 0x4f901c
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
cmp cx, bp
jne 0x4952d5
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push 0x4f901c
rep movsb byte es:[edi], byte [esi]
call fcn.00451fc0
mov esi, eax
cmp esi, ebp
je 0x4954cb
xor ecx, ecx
push 0x4f901c
mov word [esi], cx
call fcn.00451fc0
mov edx, 0x2e
mov word [esi], dx
cmp eax, ebp
je 0x4954cb
cmp byte [esp + 0x17], 0
je 0x4954cb
cmp dword [esp + 0x170], ebp
jne 0x4954cb
cmp dword [esp + 0x214], ebp
je 0x4954cb
mov edx, eax
mov ecx, esi
sub edx, esi
nop
movzx eax, word [ecx]
mov word [edx + ecx], ax
add ecx, 2
cmp ax, bp
jne 0x495350
push 0x4f901c
call fcn.00451fc0
mov esi, eax
cmp esi, ebp
je 0x4954cb
xor eax, eax
push 0x4f901c
mov word [esi], ax
call fcn.00451fc0
mov ecx, 0x2e
mov word [esi], cx
cmp eax, ebp
je 0x4954cb
mov edx, eax
mov ecx, esi
sub edx, esi
jmp 0x4953a0
movzx eax, word [ecx]
mov word [edx + ecx], ax
add ecx, 2
cmp ax, bp
jne 0x4953a0
jmp 0x4954cb
mov byte [esp + 0x15], 0
cmp word [esp + 0x5fd8], bp
je 0x495424
xor eax, eax
jmp 0x4953d0
movzx ecx, word [esp + eax + 0x5fd8]
mov word [eax + 0x4f901c], cx
add eax, 2
cmp cx, bp
jne 0x4953d0
mov edx, dword [esi]
push edx
call fcn.00451c30
mov edx, eax
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x4953f1
mov edi, 0x4f901c
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
cmp cx, bp
jne 0x495406
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x495441
mov ecx, dword [esi]
mov edx, 0x4f901c
jmp 0x495430
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
cmp ax, bp
jne 0x495430
push 0x4f901c
call fcn.00451fc0
mov esi, eax
cmp esi, ebp
je 0x495494
xor eax, eax
push 0x4f901c
mov word [esi], ax
call fcn.00451fc0
cmp eax, ebp
je 0x49548c
push str..tar
push eax
call fcn.00473340
test eax, eax
je 0x495494
cmp byte [esp + 0x17], 0
je 0x49548c
cmp dword [esp + 0x170], ebp
jne 0x49548c
cmp dword [esp + 0x214], ebp
jne 0x495494
mov ecx, 0x2e
mov word [esi], cx
push ebx
push 0x4f901c
call fcn.00453bf0
push 0x4f901c
push ebp
call fcn.00431770
test al, al
je 0x4954cb
push 0x50d
call fcn.004611c0
push eax
push 0x4f901c
call fcn.00493840
add esp, 8
mov byte [esp + 0x15], 1
mov esi, dword [esp + 0x1c]
cmp esi, dword [0x5135e0]
jne 0x495572
lea edx, [esp + 0x67d8]
push edx
call fcn.00485af0
mov ecx, dword [0x4f981c]
push 0x4ba77c
mov dword [0x4f65ec], 3
mov dword [0x4f65e8], 2
mov byte [0x4f6622], 0
mov byte [0x4f6626], 0
call fcn.0046b070
push 0x4f901c
call fcn.00451c30
push eax
push 0x208
call fcn.004611c0
push eax
lea eax, [esp + 0x3de0]
push eax
mov edx, 0x480
call fcn.004a29f0
add esp, 0xc
lea ecx, [esp + 0x3dd8]
push ecx
call fcn.00485f20
cmp byte [0x4f6ba2], 0
je 0x495567
mov byte [0x4f6ba2], 0
mov byte [esp + 0x16], 1
push ebp
mov ecx, 0x4f0da0
call fcn.00417240
cmp word [0x4f4cb0], bp
je 0x495585
push 0x4f4cb0
call fcn.004855c0
cmp byte [0x4e9b88], 0
jne 0x495630
cmp esi, dword [0x5135e0]
jne 0x495630
push 1
push ebp
push 0x4f901c
mov ecx, 0x4f0da0
call fcn.00416320
cmp eax, 1
jne 0x495630
lea edx, [esp + 0x240]
push edx
mov ecx, 0x4f0da0
call fcn.00413110
mov eax, dword [esp + 0x200]
mov ecx, dword [esp + 0x204]
cmp eax, dword [esp + 0x350]
jne 0x4955eb
cmp ecx, dword [esp + 0x354]
je 0x4956bd
or eax, ecx
je 0x4956bd
push 0x4babb4
lea eax, [esp + 0xf4]
push eax
call fcn.00473340
test eax, eax
jne 0x495616
cmp dword [esp + 0x214], ebp
jne 0x4956bd
push 0x50a
call fcn.004611c0
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx]
push eax
push edx
call fcn.00493840
add esp, 8
cmp byte [esp + 0x15], 0
jne 0x495642
push 0x4f901c
push ebp
call fcn.00431a60
lea ecx, [esp + 0x2108]
push ecx
call fcn.00485af0
lea edx, [esp + 0x67d8]
push edx
call fcn.00485830
mov esi, dword [esp + 0x44]
mov edi, dword [sym.imp.USER32.dll_SetDlgItemTextW]
inc dword [esp + 0x20]
cmp byte [0x4eac4c], 0
je 0x494eae
cmp byte [0x4e9b88], 0
jne 0x49568e
cmp byte [0x4eac4c], 0
mov eax, 0x4d0
je 0x495693
mov eax, 0x271
push eax
call fcn.004611c0
push eax
call fcn.00485f20
cmp byte [0x4eac4c], 0
je 0x495e62
mov eax, dword [0x4e9b84]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
jmp 0x495e76
mov eax, dword [esp + 0xc60]
cmp eax, ebp
je 0x495747
mov ecx, dword [esp + 0x20c]
push ecx
mov ecx, dword [esp + 0x20c]
cdq
push ecx
push edx
push eax
call fcn.004a5730
push ebp
mov esi, edx
mov edx, dword [esp + 0x360]
push 0x64
mov edi, eax
mov eax, dword [esp + 0x360]
push edx
push eax
call fcn.004a5730
cmp esi, edx
jg 0x495747
jl 0x49570a
cmp edi, eax
jae 0x495747
push 0x4f901c
call fcn.00451c30
push eax
push 0x50f
call fcn.004611c0
push eax
lea ecx, [esp + 0x3de0]
push ecx
mov edx, 0x480
call fcn.004a29f0
add esp, 0xc
lea edx, [esp + 0x3dd8]
push edx
call fcn.00485f20
jmp 0x495630
xor eax, eax
lea esp, [esp]
movzx ecx, word [eax + 0x4f60b8]
mov word [esp + eax + 0x46d8], cx
add eax, 2
cmp cx, bp
jne 0x495750
mov esi, 1
cmp dword [0x4ea3a4], esi
jne 0x49577e
mov ecx, 0x4f2ca0
call fcn.0041e5d0
call fcn.004816c0
xor eax, eax
jmp 0x495790
movzx ecx, word [esp + eax + 0x46d8]
mov word [eax + 0x4f60b8], cx
add eax, 2
cmp cx, bp
jne 0x495790
push 0x400
push 0x4f901c
mov ecx, 0x4f0da0
call fcn.004130e0
mov eax, dword [0x4f0fac]
mov ecx, dword [0x4f981c]
push 0x4ba77c
mov dword [0x4f6fbc], eax
mov byte [0x4f66da], 1
mov dword [0x4f667c], ebp
mov dword [0x4f66a0], ebp
call fcn.0046b070
push 0x4f901c
call fcn.00451c30
push eax
push 0x20b
call fcn.004611c0
push eax
lea ecx, [esp + 0x3de0]
push ecx
mov edx, 0x480
call fcn.004a29f0
add esp, 0xc
lea edx, [esp + 0x3dd8]
push edx
call fcn.00485f20
cmp byte [0x4f6ba2], 0
je 0x495835
mov byte [0x4f6ba2], 0
mov byte [esp + 0x16], 1
push ebp
push ebp
mov ecx, 0x4f0da0
call fcn.00417a60
cmp byte [0x4e9b88], 0
jne 0x495630
mov eax, dword [esp + 0x1c]
cmp eax, dword [0x5135e0]
jne 0x495630
mov ecx, dword [esp + 0x350]
or ecx, dword [esp + 0x354]
jne 0x495893
cmp dword [esp + 0x186c], ebp
jl 0x495893
jg 0x495886
cmp dword [esp + 0x1868], 0x200
jb 0x495893
cmp dword [esp + 0x1f8], esi
jbe 0x495630
mov eax, dword [esp + 0xc60]
cmp eax, ebp
je 0x4958e4
mov ecx, dword [esp + 0x20c]
push ecx
mov ecx, dword [esp + 0x20c]
cdq
push ecx
push edx
push eax
call fcn.004a5730
push ebp
mov esi, edx
mov edx, dword [esp + 0x360]
push 0x64
mov edi, eax
mov eax, dword [esp + 0x360]
push edx
push eax
call fcn.004a5730
cmp esi, edx
jl 0x495630
jg 0x4958e4
cmp edi, eax
jb 0x495630
push 0x4f901c
call fcn.00451c30
push eax
push 0x25a
call fcn.004611c0
push eax
lea ecx, [esp + 0x3de0]
push ecx
mov edx, 0x480
call fcn.004a29f0
add esp, 0xc
lea edx, [esp + 0x3dd8]
push edx
call fcn.00485f20
mov eax, dword [esp + 0x1868]
inc dword [esp + 0x24]
add dword [esp + 0x38], eax
mov ecx, dword [esp + 0x186c]
adc dword [esp + 0x3c], ecx
lea ecx, [esp + 0x2938]
call fcn.00401190
push ebp
lea edx, [esp + 0x293c]
push edx
push 0x4f901c
push ebp
call fcn.00435490
test al, al
je 0x495970
mov eax, dword [esp + 0x3538]
add dword [esp + 0x30], eax
mov ecx, dword [esp + 0x353c]
adc dword [esp + 0x34], ecx
cmp byte [esp + 0x15], 0
je 0x495cdb
mov edx, dword [esp + 0x18]
mov eax, dword [edx]
push ebp
push 1
push eax
mov ecx, 0x4f0da0
call fcn.00416320
cmp eax, 1
jne 0x495642
lea ecx, [esp + 0x48]
call fcn.0046afd0
mov byte [esp + 0x8814], 3
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx]
lea edx, [esp + 0x4fd8]
sub edx, eax
jmp 0x4959c0
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
cmp cx, bp
jne 0x4959c0
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileW]
mov byte [esp + 0x15], 0
lea ebx, [ebx]
lea edx, [esp + 0x4fd8]
push edx
lea eax, [esp + 0x57dc]
push str._s._cvtbackup_
push eax
mov edx, 0x400
call fcn.004a29f0
add esp, 0xc
lea ecx, [esp + 0x57d8]
push ecx
lea edx, [esp + 0x4fdc]
push edx
call esi
test eax, eax
je 0x495b8b
lea eax, [esp + 0x4fd8]
push eax
lea ecx, [esp + 0x4c]
call fcn.0046b080
lea ecx, [esp + 0x57d8]
push ecx
lea ecx, [esp + 0x4c]
call fcn.0046b080
push 0x400
lea edx, [esp + 0x4fdc]
push edx
mov ecx, 0x4f0da0
call fcn.00413510
test al, al
je 0x495a6f
lea eax, [esp + 0x4fd8]
push eax
push ebp
call fcn.00431770
test al, al
jne 0x4959e0
push ebp
push 1
push 0x4f901c
mov ecx, 0x4f0da0
call fcn.00416320
cmp eax, 1
jne 0x495b90
xor eax, eax
lea esp, [esp]
movzx ecx, word [eax + 0x4f901c]
mov word [esp + eax + 0x4fd8], cx
add eax, 2
cmp cx, bp
jne 0x495a90
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, dword [esp + 0x40]
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx]
lea edx, [esp + 0x57d8]
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
cmp cx, bp
jne 0x495ac0
lea edx, [esp + 0x4fd8]
push edx
call fcn.00451c30
mov esi, eax
lea eax, [esp + 0x57d8]
push eax
call fcn.00451c30
jmp 0x495af0
movzx ecx, word [esi]
mov word [eax], cx
add esi, 2
add eax, 2
cmp cx, bp
jne 0x495af0
lea ecx, [esp + 0x57d8]
push ecx
lea edx, [esp + 0x4fdc]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x495b8b
cmp ebx, ebp
je 0x495b24
cmp ebx, 1
jne 0x495b58
push ebp
push ebp
push 3
push ebp
push ebp
push 0x40000000
lea eax, [esp + 0x57f0]
push eax
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x495b58
lea ecx, [esp + 0x20f8]
push ecx
push ebp
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x400
lea edx, [esp + 0x4fdc]
push edx
mov ecx, 0x4f0da0
call fcn.00413510
test al, al
je 0x495b90
lea eax, [esp + 0x4fd8]
push eax
push ebp
call fcn.00431770
test al, al
jne 0x495ab1
jmp 0x495b90
mov byte [esp + 0x15], 1
xor bl, bl
cmp byte [esp + 0xc5c], bl
jne 0x495c13
push 0x400
lea ecx, [esp + 0x47dc]
push ecx
lea ecx, [esp + 0x50]
mov bl, 1
call fcn.0046b390
test al, al
je 0x495c0a
jmp 0x495bc0
push 0x400
lea edx, [esp + 0x6fdc]
push edx
lea ecx, [esp + 0x50]
call fcn.0046b390
test al, al
je 0x495c0a
lea eax, [esp + 0x47d8]
push eax
push ebp
call fcn.00431770
test al, al
jne 0x495c08
push 0x400
lea ecx, [esp + 0x47dc]
push ecx
lea ecx, [esp + 0x50]
call fcn.0046b390
test al, al
jne 0x495bc0
jmp 0x495c0a
xor bl, bl
lea ecx, [esp + 0x48]
call fcn.0046ac30
push 0x400
lea edx, [esp + 0x47dc]
push edx
lea ecx, [esp + 0x50]
call fcn.0046b390
test al, al
je 0x495cc5
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileW]
jmp 0x495c40
push 0x400
lea eax, [esp + 0x6fdc]
push eax
lea ecx, [esp + 0x50]
call fcn.0046b390
test al, al
je 0x495cc5
cmp byte [esp + 0x15], 0
jne 0x495c83
test bl, bl
jne 0x495c95
lea ecx, [esp + 0x6fd8]
push ecx
push ebp
call fcn.004326c0
lea edx, [esp + 0x6fd8]
push edx
push ebp
call fcn.00431a60
jmp 0x495ca7
test bl, bl
jne 0x495c95
lea eax, [esp + 0x47d8]
push eax
push ebp
call fcn.00431a60
lea ecx, [esp + 0x47d8]
push ecx
lea edx, [esp + 0x6fdc]
push edx
call esi
push 0x400
lea eax, [esp + 0x47dc]
push eax
lea ecx, [esp + 0x50]
call fcn.0046b390
test al, al
jne 0x495c40
mov byte [esp + 0x8814], 1
lea ecx, [esp + 0x48]
call fcn.00401b00
jmp 0x495642
cmp byte [esp + 0xc5c], 0
je 0x495da8
mov esi, dword [esp + 0x18]
mov ecx, dword [esi]
push ebp
push 1
push ecx
mov ecx, 0x4f0da0
call fcn.00416320
cmp eax, 1
jne 0x495da8
mov eax, dword [esi]
lea edx, [esp + 0x47d8]
sub edx, eax
movzx ecx, word [eax]
mov word [eax + edx], cx
add eax, 2
cmp cx, bp
jne 0x495d11
lea edx, [esp + 0x47d8]
push edx
call fcn.00451c30
push eax
push 0x258
call fcn.004611c0
push eax
lea eax, [esp + 0x3de0]
push eax
mov edx, 0x480
call fcn.004a29f0
add esp, 0xc
lea ecx, [esp + 0x3dd8]
push ecx
call fcn.00485f20
lea edx, [esp + 0x47d8]
push edx
push ebp
call fcn.004326c0
lea eax, [esp + 0x47d8]
push eax
push ebp
call fcn.00431a60
push 0x400
lea ecx, [esp + 0x47dc]
push ecx
mov ecx, 0x4f0da0
call fcn.00413510
test al, al
je 0x495da8
lea edx, [esp + 0x47d8]
push edx
push ebp
call fcn.00431770
test al, al
jne 0x495d20
push ebp
push 1
push 0x4f901c
mov ecx, 0x4f0da0
call fcn.00416320
cmp eax, 1
jne 0x495642
xor eax, eax
jmp 0x495dd0
movzx ecx, word [eax + 0x4f901c]
mov word [esp + eax + 0x57d8], cx
add eax, 2
cmp cx, bp
jne 0x495dd0
mov eax, dword [esp + 0x40]
cmp eax, ebp
je 0x495df4
cmp eax, 1
jne 0x495e2c
push ebp
push ebp
push 3
push ebp
push ebp
push 0x40000000
lea eax, [esp + 0x57f0]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x495e2c
lea ecx, [esp + 0x20f8]
push ecx
push ebp
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x400
lea edx, [esp + 0x57dc]
push edx
mov ecx, 0x4f0da0
call fcn.00413510
test al, al
je 0x495642
lea eax, [esp + 0x57d8]
push eax
push ebp
call fcn.00431770
test al, al
jne 0x495de7
jmp 0x495642
push ebp
push ebp
push ebp
push ebp
push ebp
push 1
push ebp
push 1
call fcn.00486b40
call fcn.00485fc0
cmp byte [0x4e9b89], 0
je 0x495eaf
push ebp
push ebp
lea ecx, [esp + 0x77e0]
push ecx
mov ecx, 0x4f0da0
call fcn.00416320
cmp eax, 1
je 0x495ea6
mov ecx, 0x4f0478
call fcn.00442a20
test al, al
jne 0x495eb5
cmp byte [0x4e9b89], 0
jne 0x495eca
cmp dword [esp + 0x24], ebp
jbe 0x495eca
push 0x4f901c
call fcn.00451c30
push eax
mov ecx, 0x4f0478
call fcn.004430d0
cmp byte [esp + 0xc64], 0
je 0x495ee5
mov edx, dword [str.InterfaceConvertProfile]
push edx
push 0x511c48
call fcn.0045bc60
push 0x511c48
call fcn.0045bd40
cmp byte [esp + 0x16], 0
je 0x495efb
call fcn.00484f00
mov dword [esp + 0x8814], 0xffffffff
lea ecx, [esp + 0x390]
call fcn.004147f0
mov ecx, dword [esp + 0x880c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x87f4]
xor ecx, esp
call fcn.004a48d3
add esp, 0x8804
ret 4