Function at 0x49cf00
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4f7876
mov eax, dword fs:[0]
push eax
mov eax, 0x3074
call fcn.004df840
mov eax, dword [0x50fb70]
xor eax, esp
mov dword [esp + 0x3070], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x50fb70]
xor eax, esp
push eax
lea eax, [esp + 0x3088]
mov dword fs:[0], eax
mov esi, dword [esp + 0x3098]
mov ebx, ecx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x1c], esi
call fcn.00441f10
mov dword [esp + 0x3090], 0
push 0x800
lea eax, [esp + 0x1088]
push eax
lea ecx, [esp + 0x208c]
push ecx
mov ecx, 0x5446c8
mov byte [ebx + 0x3028], 0
call fcn.0049e6e0
cmp word [esi + 0x83c2], 0
lea eax, [esi + 0x83c2]
je 0x49cfaf
lea edx, [esp + 0x2084]
sub edx, eax
nop
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x49cfa0
cmp word [esi + 0x93c2], 0
lea eax, [esi + 0x93c2]
je 0x49cfdf
lea edx, [esp + 0x1084]
sub edx, eax
jmp 0x49cfd0
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x49cfd0
push 6
lea ebp, [esi + 0x1010]
push str.WinCon
push ebp
mov dword [esp + 0x3c], ebp
call fcn.00451140
push eax
call fcn.00469f30
test eax, eax
jne 0x49d00a
xor edx, edx
mov word [esp + 0x1084], dx
xor eax, eax
mov word [ebx + 0x1024], ax
cmp word [ebp], ax
je 0x49d32b
cmp word [esp + 0x2084], ax
jne 0x49d03d
cmp word [esp + 0x1084], ax
jne 0x49d03d
cmp byte [esi + 0xa3c2], al
je 0x49d32b
push ebp
call fcn.00443510
test al, al
je 0x49d32b
lea edx, [ebx + 0x2024]
mov eax, ebp
sub edx, ebp
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x49d055
push 0x800
lea edi, [ebx + 0x1024]
push edi
push str.Rar_SF
mov dword [ebx + 0x3024], ebp
call fcn.004adf10
mov esi, eax
test esi, esi
je 0x49d30f
push ebp
mov ecx, ebx
call fcn.0049a4a0
test al, al
je 0x49d0ba
push 0x5f5
call fcn.004612b0
push eax
call fcn.004bc000
add esp, 4
push 1
mov ecx, 0x5275b8
call fcn.0043d430
jmp 0x49d30f
push esi
push ebp
mov ecx, ebx
call fcn.0049a550
test al, al
je 0x49d32b
push esi
call fcn.004e0da1
add esp, 4
push 0x10000
lea ecx, [esp + 0x24]
call fcn.00401c80
mov byte [esp + 0x3090], 1
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push ecx
push edx
push ebp
mov ecx, ebx
call fcn.0049a600
push 0
push edi
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
mov esi, eax
test esi, esi
je 0x49d277
push 3
push 0
push edi
mov byte [esp + 0x22], 0
mov byte [esp + 0x23], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x49d1b8
cmp word [esp + 0x2084], 0
mov ebp, dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
je 0x49d16f
push esi
push 0x49a470
push 3
push edi
call ebp
push esi
push 0x49a470
push 0xe
push edi
call ebp
push 0x64
lea eax, [esp + 0x2088]
push eax
push esi
mov ecx, ebx
call fcn.0049a130
mov byte [esp + 0x16], al
cmp word [esp + 0x1084], 0
je 0x49d1ad
cmp word [esp + 0x2084], 0
je 0x49d18c
cmp byte [esp + 0x16], 0
je 0x49d1ad
push esi
push 0x49a470
push 2
push edi
call ebp
push 0x65
lea ecx, [esp + 0x1088]
push ecx
push esi
mov ecx, ebx
call fcn.0049a330
mov byte [esp + 0x17], al
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ebp, dword [esp + 0x30]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceW]
test eax, eax
je 0x49d277
cmp word [esp + 0x1084], 0
je 0x49d1df
cmp byte [esp + 0x17], 0
je 0x49d277
cmp byte [esp + 0x16], 0
jne 0x49d1fe
cmp byte [esp + 0x17], 0
jne 0x49d1fe
mov edx, dword [esp + 0x1c]
cmp byte [edx + 0xa3c2], 0
je 0x49d2a5
mov eax, dword [esp + 0x1c]
cmp byte [eax + 0xa3c2], 0
je 0x49d219
lea eax, [ebx + 0x1024]
push eax
mov ecx, ebx
call fcn.0049a7c0
lea ecx, [esp + 0x3c]
call fcn.00403500
push 0
lea ecx, [esp + 0x40]
push ecx
lea esi, [ebx + 0x1024]
push esi
call fcn.004450e0
test al, al
je 0x49d299
mov eax, dword [esp + 0x18]
xor edx, edx
add eax, dword [esp + 0x103c]
adc edx, dword [esp + 0x1040]
mov dword [esp + 0x34], edx
jne 0x49d25a
cmp eax, 0x100000
jbe 0x49d299
push 0x100000
push 0x5a0
call fcn.004612b0
push eax
push 0x550b7a
call fcn.004bc660
add esp, 0xc
mov byte [esp + 0x3090], 0
mov eax, dword [esp + 0x20]
test eax, eax
je 0x49d32b
push eax
call fcn.004df66f
add esp, 4
jmp 0x49d32b
push 0x800
push esi
push ebp
call fcn.00466b20
cmp dword [esp + 0x18], 0
mov edi, dword [esp + 0x20]
je 0x49d2fa
mov eax, dword [esp + 0x24]
push eax
push edi
lea esi, [ebx + 0x1024]
push esi
mov ecx, ebx
call fcn.0049a600
test eax, eax
jne 0x49d2fa
push 0x4fe404
push esi
call fcn.004adee0
mov esi, eax
test esi, esi
je 0x49d2fa
push 2
push 0
push esi
call fcn.004e1268
mov ecx, dword [esp + 0x24]
push esi
push ecx
push 1
push edi
call fcn.004e450e
push esi
call fcn.004e0da1
add esp, 0x20
mov byte [esp + 0x3090], 0
test edi, edi
je 0x49d30f
push edi
call fcn.004df66f
add esp, 4
cmp word [ebx + 0x1024], 0
lea eax, [ebx + 0x1024]
je 0x49d32b
mov edx, dword [ebx]
push 4
push eax
mov eax, dword [edx + 4]
mov ecx, ebx
call eax
mov dword [esp + 0x3090], 0xffffffff
mov eax, ebx
mov ecx, dword [esp + 0x3088]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x3070]
xor ecx, esp
call fcn.004df824
add esp, 0x3080
ret 4