Function at 0x4ad0f16b
Capabilities:
Check if file exists
Copy file
Delete file
Get file attributes
Get file size
Read file on windows
Set file attributes

Disassembly:
cmp dword [0x4ad2415c], edi
jne 0x4ad18ce8
mov esi, 0x104
push esi
lea eax, [ebp - 0xa2c]
push eax
push ebx
call fcn.4ad0ec5a
cmp eax, 1
je 0x4ad18d1d
cmp dword [0x4ad24190], edi
je 0x4ad11a54
test byte [ebx + 0x1c], 8
jne 0x4ad11a15
cmp dword [0x4ad24110], 3
je 0x4ad11a15
push edi
push esi
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0xa48]
push ebx
call fcn.4ad0ed06
cmp eax, 1
je 0x4ad18d1d
cmp dword [0x4ad24110], 3
je 0x4ad120c5
cmp word [ebp - 0x20c], di
je 0x4ad0ea3f
push edi
push dword [ebx + 4]
call fcn.4ad0efc7
cmp eax, 0xffffffff
mov dword [ebp - 0xa38], eax
je 0x4ad1845a
push eax
call fcn.4ad015ca
test eax, eax
jne 0x4ad18499
cmp dword [0x4ad24104], edi
jne 0x4ad184c0
mov eax, dword [ebp - 0xa68]
mov dword [ebp - 0xa4c], eax
mov eax, dword [ebp - 0xa4c]
mov dword [ebp - 0xa7c], eax
mov eax, dword [ebx + 0x1c]
test al, 4
je 0x4ad11a66
and eax, 0xfffffffb
test al, al
mov dword [ebx + 0x1c], eax
js 0x4ad184df
or eax, 1
mov dword [ebx + 0x1c], eax
cmp byte [0x4ad24041], 0
je 0x4ad184e7
push dword [ebx + 4]
lea eax, [ebp - 0x824]
push 0x208
push eax
call fcn.4ad01a75
mov esi, eax
lea eax, [ebp - 0x20c]
push eax
call fcn.4ad0156d
push eax
push dword [ebp - 0xa30]
lea eax, [ebp - 0xa34]
push ebx
push eax
push 0x200
push dword [ebp - 0xa40]
push dword [ebp - 0xa38]
call fcn.4ad0ebc8
cmp dword [0x4ad240e0], edi
mov dword [ebp - 0xa54], eax
jne 0x4ad18516
cmp dword [0x4ad24110], 3
je 0x4ad12109
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x824]
push eax
push esi
call fcn.4ad0eb63
test eax, eax
jne 0x4ad1853a
mov eax, dword [ebp - 0xa48]
mov dword [0x4ad240a0], 1
cmp dword [eax + 0x20], edi
je 0x4ad0e7f3
cmp dword [0x4ad24190], edi
je 0x4ad0e7f3
mov dword [0x4ad240a4], 1
mov dword [0x4ad240e0], edi
push dword [eax + 0x20]
call fcn.4ad082c6
mov eax, dword [0x4ad240e0]
cmp eax, 0x15
je 0x4ad120fd
cmp eax, 0x458
je 0x4ad120fd
push 1
push 0x104
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0xa48]
push ebx
call fcn.4ad0ed06
cmp eax, 1
je 0x4ad18d12
cmp word [ebp - 0x20c], di
je 0x4ad185c6
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x824]
push eax
push esi
call fcn.4ad0eb63
test eax, eax
jne 0x4ad185d6
lea eax, [ebp - 0x20c]
xor esi, esi
push eax
inc esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [ebp - 0xa44], edi
jne 0x4ad0e894
cmp dword [ebp - 0xa78], edi
je 0x4ad0e874
cmp eax, 0xffffffff
mov dword [ebp - 0xa58], edi
jne 0x4ad120b8
mov dword [ebp - 0xa78], edi
and dword [ebx + 0x1c], 0xfffffffb
cmp byte [0x4ad24041], 0
mov ecx, dword [ebx + 0x1c]
je 0x4ad18646
cmp dword [ebp - 0xa58], edi
jne 0x4ad1868a
cmp dword [0x4ad24190], edi
je 0x4ad0e8c0
mov ecx, dword [ebp - 0xa48]
mov ecx, dword [ecx + 0x20]
cmp ecx, edi
je 0x4ad0e8b3
test byte [ecx + 0x1c], 8
jne 0x4ad0f75c
cmp dword [0x4ad24110], 3
je 0x4ad186a1
test al, 6
je 0x4ad11aa6
or dword [ebp - 0xa30], 0xffffffff
mov dword [0x4ad240e0], 5
cmp dword [ebp - 0xa30], 0xffffffff
mov dword [ebp - 0xa60], edi
jne 0x4ad11a71
mov dword [ebp - 0xa74], edi
xor esi, esi
inc esi
cmp dword [ebp - 0xa70], esi
je 0x4ad186df
mov eax, dword [ebx + 0x1c]
test al, 8
jne 0x4ad0e915
cmp dword [0x4ad24110], 3
je 0x4ad1870e
mov eax, dword [ebx + 0x1c]
test al, 8
jne 0x4ad11a42
push dword [ebx + 0x1c]
lea eax, [ebp - 0xa34]
push eax
push dword [ebp - 0xa40]
call fcn.4ad0eb37
cmp dword [0x4ad24110], 3
je 0x4ad120eb
mov eax, dword [ebx + 0x1c]
test al, 1
je 0x4ad120eb
and eax, 0x800
cmp dword [ebp - 0xa30], 0xffffffff
mov edi, eax
jne 0x4ad11a8f
test word [ebx + 0x1c], 0x400
jne 0x4ad1874e
mov eax, dword [0x4ad24194]
test eax, eax
je 0x4ad18796
mov ecx, edi
or ecx, dword [ebp - 0xa64]
push ecx
push 0x4ad2415c
push 0
push 0
lea ecx, [ebp - 0x20c]
push ecx
push dword [ebx + 4]
call eax
test eax, eax
je 0x4ad187b1
cmp dword [ebp - 0xa60], 0
jne 0x4ad0e9d9
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4ad0e9cc
and eax, 0xfffffffe
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp dword [0x4ad24104], 0
jne 0x4ad18847
push dword [ebp - 0xa38]
xor edi, edi
mov dword [0x4ad240d8], edi
mov eax, dword [ebx + 0x18]
mov ecx, dword [eax + 0x14]
mov dword [ebp - 0xa90], ecx
mov eax, dword [eax + 0x18]
mov dword [ebp - 0xa8c], eax
call fcn.4ad03ebc
cmp dword [0x4ad24110], 3
je 0x4ad0ea39
cmp dword [0x4ad2415c], edi
jne 0x4ad18c9c
lea eax, [ebp - 0xa90]
push eax
push dword [ebp - 0xa30]
push dword [ebp - 0xa48]
push ebx
call fcn.4ad0ea76
mov dword [0x4ad24198], 1
mov dword [0x4ad24190], edi
push dword [ebp - 0xa3c]
push 0x21
push dword [ebx + 0x18]
call fcn.4ad0829e
test al, al
jne 0x4ad0e62a
push dword [ebp - 0xa3c]
call fcn.4ad01c51
mov ebx, dword [ebx + 0x20]
jmp 0x4ad0f22d
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa90
mov eax, dword [0x4ad2406c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push 0x204
xor edi, edi
lea eax, [ebp - 0x410]
push edi
push eax
mov dword [ebp - 0xa48], ebx
mov dword [ebp - 0x414], 0x20
call sub.msvcrt.dll_memset
mov eax, dword [ebx + 0x20]
or dword [ebp - 0xa30], 0xffffffff
add esp, 0xc
cmp eax, edi
mov dword [ebp - 0xa50], edi
mov dword [ebp - 0xa70], edi
mov dword [ebp - 0xa44], edi
mov dword [ebp - 0xa78], 1
je 0x4ad183c5
mov eax, dword [eax + 0x1c]
shr eax, 1
and eax, 8
push edi
mov dword [ebp - 0xa64], eax
lea eax, [ebp - 0xa68]
push eax
mov ebx, 0x80
push ebx
push 0xfe00
mov dword [ebp - 0xa6c], edi
mov dword [ebp - 0xa58], edi
call fcn.4ad0f3e6
cmp eax, edi
mov dword [ebp - 0xa40], eax
je 0x4ad183cd
cmp dword [0x4ad24104], edi
jne 0x4ad183d5
mov ebx, dword [esi + 0x20]
cmp ebx, edi
jne 0x4ad0f452
cmp dword [0x4ad24110], 3
je 0x4ad18cc3
mov eax, dword [ebp - 0xa50]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.4ad013fa
leave
ret 8
lea eax, [ebp - 0xa3c]
push eax
push dword [ebx + 0x18]
push 0x21
push dword [ebx]
call fcn.4ad0156d
push eax
call fcn.4ad01c2d
test al, al
je 0x4ad183fa
jmp 0x4ad0e62a
cmp dword [ebx + 0x20], edi
jne 0x4ad0e8b3
mov dword [0x4ad24110], esi
jmp 0x4ad0e8b3
push dword [ebx + 4]
push str._s_r_n
call fcn.4ad040bf
cmp dword [0x4ad24110], 3
pop ecx
pop ecx
jne 0x4ad0e675
cmp dword [0x4ad24190], edi
jne 0x4ad0e675
jmp 0x4ad0e6ad
cmp dword [0x4ad24110], 3
jne 0x4ad0e920
jmp 0x4ad18728
cmp dword [0x4ad24110], 3
jne 0x4ad0e65e
jmp 0x4ad18446
mov dword [ebp - 0xa44], eax
jmp 0x4ad0e723
push dword [ebp - 0xa30]
mov dword [ebp - 0xa74], esi
call fcn.4ad015ca
test eax, eax
je 0x4ad0e8f2
jmp 0x4ad186bc
push dword [ebp - 0xa30]
call fcn.4ad03ebc
or dword [ebp - 0xa30], 0xffffffff
jmp 0x4ad0e961
test word [ebx + 0x1c], 0x400
jne 0x4ad0e8d9
lea eax, [ebp - 0x20c]
push eax
call fcn.4ad11ace
mov dword [ebp - 0xa30], eax
jmp 0x4ad0e8d9
test al, 0x10
je 0x4ad0e86e
jmp 0x4ad1863b
lea eax, [ebp - 0x20c]
push eax
push esi
lea eax, [ebp - 0x414]
push eax
call fcn.4ad01416
jmp 0x4ad0e6a0
test eax, eax
je 0x4ad0e65e
jmp 0x4ad0ea3f
cmp dword [ebp - 0xa30], 0xffffffff
jne 0x4ad18a5c
jmp 0x4ad18ac0
push edi
push eax
call fcn.4ad0594f
jmp 0x4ad18d10
cmp dword [0x4ad24190], edi
jne 0x4ad0e789
jmp 0x4ad0e8f2
mov eax, dword [ebx + 0x1c]
jmp 0x4ad0f1e1
xor eax, eax
inc eax
jmp 0x4ad0f248
push 1
lea eax, [ebp - 0xa7c]
push eax
push ebx
push dword [ebp - 0xa68]
call fcn.4ad0f3e6
cmp eax, edi
mov dword [ebp - 0xa5c], eax
jne 0x4ad0f22a
jmp 0x4ad183cd
cmp dword [0x4ad24110], 3
jne 0x4ad1840f
cmp dword [0x4ad24190], edi
je 0x4ad0ea62
push dword [ebx]
push 0x4ad24570
call fcn.4ad040bf
push 0x4ad24568
call fcn.4ad040bf
add esp, 0xc
push dword [0x4ad240e0]
call fcn.4ad13630
push dword [ebp - 0xa3c]
call fcn.4ad01c51
push 1
push edi
call fcn.4ad1e837
push dword [ebx + 4]
lea eax, [ebp - 0x414]
push eax
call fcn.4ad1e7bd
jmp 0x4ad120de
push dword [0x4ad240e0]
call fcn.4ad13630
cmp dword [0x4ad24110], 3
jne 0x4ad1848a
cmp dword [ebp - 0xa30], 0xffffffff
jne 0x4ad1848a
push dword [ebx + 4]
lea eax, [ebp - 0x20c]
push eax
call fcn.4ad1e7bd
test eax, eax
jne 0x4ad18433
mov dword [ebp - 0xa50], 1
jmp 0x4ad0ea3f
mov eax, 0x80
or dword [ebx + 0x1c], eax
mov dword [ebp - 0xa4c], eax
mov eax, dword [ebx + 0x1c]
test al, 1
je 0x4ad0e6f7
and eax, 0xfffffffe
or eax, 4
mov dword [ebx + 0x1c], eax
jmp 0x4ad0e6f7
mov ecx, dword [ebp - 0xa68]
mov eax, dword [ebp - 0xa7c]
cmp ecx, eax
jae 0x4ad0e6e5
mov dword [ebp - 0xa4c], ecx
jmp 0x4ad0e6eb
or eax, 2
jmp 0x4ad0e713
cmp dword [0x4ad24190], edi
je 0x4ad0e723
test al, 8
jne 0x4ad0e723
cmp dword [0x4ad24110], 3
jne 0x4ad0e723
and eax, 0xfffffffe
or eax, 2
mov dword [ebx + 0x1c], eax
jmp 0x4ad0e723
push dword [ebp - 0xa38]
call fcn.4ad03ebc
push 0x6e
call fcn.4ad13630
cmp dword [0x4ad24110], 3
jne 0x4ad1848a
jmp 0x4ad18433
test byte [ebx + 0x1c], 0x80
jne 0x4ad0e7a5
push dword [ebp - 0xa38]
call fcn.4ad03ebc
push dword [ebp - 0xa3c]
lea eax, [ebp - 0xa30]
push dword [ebp - 0xa4c]
push dword [ebp - 0xa40]
push dword [0x4ad24190]
push eax
push ebx
call fcn.4ad1eab2
cmp dword [0x4ad24190], edi
je 0x4ad185ac
cmp dword [0x4ad24110], 3
jne 0x4ad185a2
and dword [ebx + 0x1c], 0xfffffffe
cmp dword [ebp - 0xa44], edi
mov eax, dword [ebx + 0x1c]
jne 0x4ad18599
or eax, 2
jmp 0x4ad1859f
or eax, dword [ebp - 0xa44]
mov dword [ebx + 0x1c], eax
mov dword [ebp - 0xa70], 1
push dword [ebx + 0x1c]
lea eax, [ebp - 0xa34]
push eax
push dword [ebp - 0xa40]
call fcn.4ad0eb37
jmp 0x4ad0ea39
push dword [ebp - 0xa38]
call fcn.4ad03ebc
jmp 0x4ad0ea3f
test byte [ebx + 0x1c], 0x80
jne 0x4ad0e83f
push dword [ebp - 0xa38]
call fcn.4ad03ebc
mov eax, dword [0x4ad24190]
cmp eax, edi
je 0x4ad18616
mov ecx, dword [ebp - 0xa48]
mov ecx, dword [ecx + 0x20]
cmp ecx, edi
je 0x4ad18616
test byte [ecx + 0x1c], 8
je 0x4ad18616
cmp dword [ebx + 0x20], edi
jne 0x4ad18616
mov dword [0x4ad24110], 1
push dword [ebp - 0xa3c]
push dword [ebp - 0xa4c]
push dword [ebp - 0xa40]
push eax
lea eax, [ebp - 0xa30]
push eax
push ebx
call fcn.4ad1eab2
jmp 0x4ad0e83f
mov dword [ebp - 0xa58], esi
jmp 0x4ad0e86e
test cl, 8
je 0x4ad0e888
cmp dword [0x4ad24110], 3
jne 0x4ad0e888
cmp dword [ebp - 0xa58], edi
mov dword [ebp - 0xa6c], 3
jne 0x4ad0e894
mov edx, dword [ebp - 0xa48]
mov edx, dword [edx + 0x20]
cmp edx, edi
je 0x4ad18685
test byte [edx + 0x1c], 8
jne 0x4ad18697
or ecx, 2
jmp 0x4ad18699
cmp dword [ebp - 0xa6c], 3
jne 0x4ad0e894
or ecx, esi
mov dword [ebx + 0x1c], ecx
jmp 0x4ad0e894
mov ecx, dword [ebp - 0xa44]
cmp ecx, edi
jne 0x4ad186b4
mov ecx, dword [ebx + 0x1c]
and ecx, 0xfffffffe
or ecx, 2
mov dword [ebx + 0x1c], ecx
jmp 0x4ad0e8c0
cmp dword [ebp - 0xa44], edi
mov dword [ebp - 0xa60], esi
jne 0x4ad0e8f2
mov eax, dword [ebx + 0x1c]
and eax, 0xfffffffe
or eax, 2
mov dword [ebx + 0x1c], eax
jmp 0x4ad0e8f2
cmp dword [0x4ad24110], 3
jne 0x4ad0e901
and dword [ebx + 0x1c], 0xfffffffe
cmp dword [ebp - 0xa44], edi
mov eax, dword [ebx + 0x1c]
jne 0x4ad18700
or eax, 2
jmp 0x4ad18706
or eax, dword [ebp - 0xa44]
mov dword [ebx + 0x1c], eax
jmp 0x4ad0e901
cmp dword [ebp - 0xa44], edi
jne 0x4ad0e915
and eax, 0xfffffffe
or eax, 2
mov dword [ebx + 0x1c], eax
jmp 0x4ad0e915
cmp dword [ebp - 0xa58], edi
jne 0x4ad0e920
cmp dword [ebp - 0xa44], edi
jne 0x4ad0e920
and eax, 0xfffffffe
or eax, 2
mov dword [ebx + 0x1c], eax
jmp 0x4ad0e920
push dword [ebx + 4]
call fcn.4ad1f880
test eax, eax
jne 0x4ad1876a
lea eax, [ebp - 0x20c]
push eax
call fcn.4ad1f880
test eax, eax
je 0x4ad1876d
xor eax, eax
inc eax
mov ecx, edi
or ecx, dword [ebp - 0xa64]
or ecx, 2
push ecx
push 0
push eax
push 0x4ad1e71a
lea eax, [ebp - 0x20c]
push eax
push dword [ebx + 4]
call dword [0x4ad24194]
jmp 0x4ad0e998
push dword [ebp - 0xa64]
lea eax, [ebp - 0x20c]
push eax
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
jmp 0x4ad0e998
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 1
mov dword [0x4ad240e0], eax
jne 0x4ad187db
test edi, edi
je 0x4ad187db
mov eax, dword [ebx + 0x18]
test word [eax], 0x400
je 0x4ad187db
mov dword [0x4ad240e0], 0x40002730
push dword [ebp - 0xa38]
call fcn.4ad03ebc
xor edi, edi
cmp dword [ebp - 0xa60], edi
je 0x4ad187f3
push 0x1d
pop esi
cmp dword [0x4ad240e0], edi
mov dword [0x4ad240d8], edi
jne 0x4ad1880b
mov dword [0x4ad240e0], 0x70
cmp dword [0x4ad2415c], edi
je 0x4ad18817
xor esi, esi
jmp 0x4ad18826
cmp esi, edi
jne 0x4ad18826
push dword [0x4ad240e0]
call fcn.4ad13630
cmp dword [ebp - 0xa74], edi
jne 0x4ad18d2d
xor eax, eax
inc eax
mov dword [ebp - 0xa50], eax
mov dword [0x4ad24198], eax
xor edi, edi
jmp 0x4ad0ea3f
push 0
push 1
lea eax, [ebp - 0x20c]
push eax
call fcn.4ad1f545
mov esi, eax
or edi, 0xffffffff
cmp esi, edi
mov dword [ebp - 0xa30], esi
jne 0x4ad18881
lea eax, [ebp - 0x20c]
push eax
push 1
push 0x4000271f
call fcn.4ad080e2
add esp, 0xc
jmp 0x4ad0e9d9
push esi
call fcn.4ad015ca
test eax, eax
push esi
je 0x4ad1889c
call fcn.4ad03ebc
mov dword [ebp - 0xa30], edi
jmp 0x4ad0e9d9
call dword [sym.imp.msvcrt.dll__get_osfhandle]
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
test eax, eax
jne 0x4ad188c7
lea eax, [ebp - 0x20c]
push eax
push 1
push 0x4000271f
call fcn.4ad080e2
add esp, 0xc
push esi
jmp 0x4ad1888c
push esi
call fcn.4ad03ebc
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.4ad0efc7
mov esi, eax
cmp esi, edi
mov dword [ebp - 0xa30], esi
je 0x4ad18866
push esi
call fcn.4ad015ca
test eax, eax
jne 0x4ad188ae
mov edi, dword [sym.imp.msvcrt.dll__get_osfhandle]
push eax
push eax
push eax
push dword [ebp - 0xa38]
call edi
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
pop ecx
push eax
call esi
xor eax, eax
push eax
push eax
push eax
push dword [ebp - 0xa30]
call edi
pop ecx
push eax
call esi
lea eax, [ebp - 0xa88]
push eax
push dword [ebp - 0xa38]
call edi
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
lea eax, [ebp - 0xa84]
push eax
push dword [ebp - 0xa30]
call edi
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp esi, eax
jne 0x4ad18a2f
mov eax, dword [ebp - 0xa88]
cmp eax, dword [ebp - 0xa84]
jne 0x4ad18a2f
and dword [ebp - 0xa54], 0
mov edi, dword [sym.imp.msvcrt.dll__get_osfhandle]
push 0
lea eax, [ebp - 0xa34]
push eax
push dword [ebp - 0xa4c]
push dword [ebp - 0xa40]
push dword [ebp - 0xa38]
call edi
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
pop ecx
push eax
call esi
test eax, eax
je 0x4ad18a45
cmp dword [ebp - 0xa34], 0
je 0x4ad18a45
push 0
lea eax, [ebp - 0xa80]
push eax
push dword [ebp - 0xa34]
push dword [ebp - 0xa5c]
push dword [ebp - 0xa30]
call edi
pop ecx
push eax
call esi
test eax, eax
je 0x4ad18a18
mov ecx, dword [ebp - 0xa34]
cmp dword [ebp - 0xa80], ecx
jne 0x4ad18a18
cmp dword [ebp - 0xa4c], ecx
je 0x4ad189f9
mov dword [ebp - 0xa54], 1
mov edi, dword [ebp - 0xa5c]
mov esi, dword [ebp - 0xa40]
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x4ad18a18
cmp dword [ebp - 0xa54], eax
jne 0x4ad18a45
jmp 0x4ad18972
push dword [ebp - 0xa30]
call fcn.4ad03ebc
or dword [ebp - 0xa30], 0xffffffff
jmp 0x4ad18866
lea eax, [ebp - 0x20c]
push eax
push 1
push 0x4000271f
call fcn.4ad080e2
add esp, 0xc
push dword [ebp - 0xa30]
call fcn.4ad03ebc
or dword [ebp - 0xa30], 0xffffffff
jmp 0x4ad0e9d9
push dword [ebp - 0xa30]
call dword [sym.imp.msvcrt.dll__get_osfhandle]
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
cmp dword [0x4ad24190], edi
jne 0x4ad18b15
cmp dword [0x4ad24110], 3
jne 0x4ad18b15
mov eax, dword [ebx + 0x1c]
test al, 2
je 0x4ad18b15
mov esi, 0x4000
test esi, eax
je 0x4ad18b1a
mov eax, dword [ebp - 0xa40]
sub dword [ebp - 0xa34], 2
push dword [ebp - 0xa34]
lea ecx, [eax + 2]
push ecx
push eax
call dword [sym.imp.msvcrt.dll_memmove]
add esp, 0xc
jmp 0x4ad18b1a
push edi
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.4ad1f545
cmp eax, 0xffffffff
mov dword [ebp - 0xa30], eax
jne 0x4ad18a70
push dword [ebp - 0xa38]
call fcn.4ad03ebc
cmp dword [0x4ad240a8], edi
jne 0x4ad18af7
push dword [0x4ad240e0]
call fcn.4ad13630
cmp dword [0x4ad24110], 3
je 0x4ad18d35
mov dword [ebp - 0xa50], esi
mov dword [0x4ad24198], esi
jmp 0x4ad0ea3f
mov esi, 0x4000
test dword [ebx + 0x1c], esi
je 0x4ad18b34
mov ecx, dword [ebp - 0xa48]
mov eax, dword [ecx + 0x20]
cmp eax, edi
je 0x4ad18b31
or dword [eax + 0x1c], esi
jmp 0x4ad18b34
or dword [ecx + 0x1c], esi
cmp dword [0x4ad240d8], edi
je 0x4ad18b4d
cmp dword [ebp - 0xa34], edi
jg 0x4ad18c26
jmp 0x4ad0e9d9
cmp dword [ebp - 0xa54], 1
jne 0x4ad18c01
push dword [ebp - 0xa38]
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0xa34]
push dword [ebp - 0xa40]
push dword [ebp - 0xa30]
call fcn.4ad1eb71
cmp dword [0x4ad24104], edi
je 0x4ad18bc3
push dword [ebp - 0xa30]
call fcn.4ad015ca
test eax, eax
jne 0x4ad18bc3
push dword [ebp - 0xa5c]
lea eax, [ebp - 0x20c]
push dword [ebp - 0xa40]
push dword [ebp - 0xa34]
push eax
lea eax, [ebp - 0xa30]
push eax
call fcn.4ad1e9c2
cmp eax, 1
je 0x4ad18433
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0xa30]
lea eax, [ebp - 0xa34]
push ebx
push eax
push dword [ebp - 0xa4c]
push dword [ebp - 0xa40]
push dword [ebp - 0xa38]
call fcn.4ad0ebc8
cmp dword [0x4ad240d8], edi
mov dword [ebp - 0xa54], eax
je 0x4ad18b4d
cmp dword [0x4ad240d8], edi
je 0x4ad0e9d9
cmp dword [ebp - 0xa34], edi
jle 0x4ad0e9d9
cmp dword [ebp - 0xa54], 1
jne 0x4ad0e9d9
push dword [ebp - 0xa38]
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0xa34]
push dword [ebp - 0xa40]
push dword [ebp - 0xa30]
call fcn.4ad1eb71
cmp dword [0x4ad24104], edi
je 0x4ad0e9d9
push dword [ebp - 0xa30]
call fcn.4ad015ca
test eax, eax
jne 0x4ad0e9d9
push dword [ebp - 0xa5c]
lea eax, [ebp - 0x20c]
push dword [ebp - 0xa40]
push dword [ebp - 0xa34]
push eax
lea eax, [ebp - 0xa30]
push eax
call fcn.4ad1e9c2
cmp eax, 1
jne 0x4ad0e9d9
jmp 0x4ad18433
push dword [ebp - 0xa30]
call fcn.4ad03ebc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0xa50], 1
jmp 0x4ad0ea2f
cmp dword [ebp - 0xa30], 0xffffffff
je 0x4ad0f242
push edi
push dword [ebp - 0xa30]
push dword [ebp - 0xa48]
push ebx
call fcn.4ad0ea76
jmp 0x4ad0f242
push dword [ebp - 0xa3c]
call fcn.4ad01c51
cmp dword [ebp - 0xa30], 0xffffffff
je 0x4ad183cd
push dword [ebp - 0xa30]
call fcn.4ad03ebc
jmp 0x4ad183cd
pop ecx
pop ecx
push dword [ebp - 0xa38]
call fcn.4ad03ebc
push dword [ebp - 0xa3c]
call fcn.4ad01c51
jmp 0x4ad183cd
push 1
push esi
jmp 0x4ad18441
push dword [ebp - 0xa3c]
call fcn.4ad01c51
push esi
jmp 0x4ad18440