Function at 0x4048e6
Capabilities:
Check if file exists
Copy file
Delete file
Get file attributes
Get file size
Read file on windows
Resolve function by parsing pe exports
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x8d4
mov eax, dword [0x42d0b4]
xor eax, esp
mov dword [esp + 0x8d0], eax
push ebx
push esi
push edi
mov edi, edx
mov dword [esp + 0x54], 1
mov esi, ecx
mov dword [esp + 0x30], edi
xor ecx, ecx
or ebx, 0xffffffff
mov eax, ecx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x48], eax
mov dword [esp + 0x28], eax
mov eax, dword [edi + 0x20]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x40], ecx
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x2c], ecx
test eax, eax
je 0x41863d
mov eax, dword [eax + 0x1c]
shr eax, 1
and eax, 8
mov dword [esp + 0x58], ecx
mov dword [esp + 0x4c], eax
mov eax, 0x104
push eax
mov dword [esp + 0x28c], eax
lea eax, [esp + 0x7c]
push ecx
push eax
mov dword [esp + 0x48], ecx
mov dword [esp + 0x28c], ecx
mov byte [esp + 0x290], 1
call sub.msvcrt.dll_memset
add esp, 0xc
mov byte [esp + 0x8cc], 1
mov eax, 0x104
xor ecx, ecx
mov dword [esp + 0x8d0], eax
mov dword [esp + 0x8c8], ecx
push eax
push ecx
lea eax, [esp + 0x6c8]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov byte [esp + 0x6b4], 1
mov eax, 0x104
xor ecx, ecx
mov dword [esp + 0x6b8], eax
mov dword [esp + 0x6b0], ecx
push eax
push ecx
lea eax, [esp + 0x4b0]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov byte [esp + 0x49c], 1
mov eax, 0x104
xor ecx, ecx
mov dword [esp + 0x4a0], eax
mov dword [esp + 0x498], ecx
push eax
push ecx
lea eax, [esp + 0x298]
push eax
call sub.msvcrt.dll_memset
xor eax, eax
lea ecx, [esp + 0x84]
add esp, 0xc
cmp byte [esp + 0x284], al
sete al
dec eax
and eax, 0x7ee3
add eax, 0x104
push eax
call fcn.00410c70
test eax, eax
js 0x4190f8
xor eax, eax
lea ecx, [esp + 0x6c0]
cmp byte [esp + 0x8cc], al
sete al
dec eax
and eax, 0x7ee3
add eax, 0x104
push eax
call fcn.00410c70
test eax, eax
js 0x4190f8
xor eax, eax
lea ecx, [esp + 0x4a8]
cmp byte [esp + 0x6b4], al
sete al
dec eax
and eax, 0x7ee3
add eax, 0x104
push eax
call fcn.00410c70
test eax, eax
js 0x4190f8
xor eax, eax
lea ecx, [esp + 0x290]
cmp byte [esp + 0x49c], al
sete al
dec eax
and eax, 0xfdc6
add eax, 0x208
push eax
call fcn.00410c70
test eax, eax
js 0x4190f8
push 0x402178
lea ecx, [esp + 0x4ac]
call fcn.00410d89
xor eax, eax
mov ecx, 0xfe00
push eax
lea eax, [esp + 0x48]
push eax
call fcn.0040585f
mov dword [esp + 0x24], eax
test eax, eax
je 0x4190f8
cmp dword [0x42d560], 0
jne 0x418645
mov esi, dword [esi + 0x20]
mov dword [esp + 0x14], esi
test esi, esi
je 0x404f76
mov edi, dword [esp + 0x14]
mov esi, dword [esi + 0x18]
mov ecx, dword [edi]
call fcn.004122c0
lea ecx, [esp + 0x1c]
mov edx, eax
push ecx
push esi
xor ecx, ecx
push ecx
push 0x21
mov ecx, fcn.00416a00
call fcn.004168ba
test al, al
je 0x41866e
mov esi, edi
cmp dword [0x42d544], 0
jne 0x41912d
mov edx, dword [esp + 0x8c8]
test edx, edx
je 0x418691
push dword [esp + 0x8d0]
mov ecx, esi
call fcn.0040579c
cmp eax, 1
je 0x4190ef
cmp dword [0x42d564], 0
jne 0x404fd4
mov eax, dword [0x42d55c]
cmp eax, 3
je 0x41869d
test byte [esi + 0x1c], 8
je 0x4050ae
push dword [esi + 4]
push 0x4021b8
call fcn.004125d9
cmp dword [0x42d55c], 3
pop ecx
pop ecx
je 0x4186c4
mov eax, dword [esp + 0x280]
test eax, eax
je 0x4186d6
mov edx, dword [esp + 0x30]
xor edi, edi
push edi
push dword [esp + 0x28c]
mov ecx, esi
push eax
call fcn.00405226
cmp eax, 1
je 0x4190ef
cmp dword [0x42d55c], 3
je 0x4186df
mov eax, dword [esp + 0x280]
test eax, eax
je 0x418712
cmp word [eax], di
je 0x404f3f
push ecx
push ecx
mov ecx, dword [esi + 4]
xor edx, edx
call fcn.00405db5
mov dword [esp + 0x20], eax
cmp eax, 0xffffffff
je 0x41871b
mov ecx, eax
call fcn.00410178
test eax, eax
jne 0x418765
cmp dword [0x42d560], eax
jne 0x41878d
mov ecx, dword [esp + 0x44]
mov dword [esp + 0x28], ecx
mov eax, dword [esi + 0x1c]
mov dword [esp + 0x48], ecx
test al, 4
jne 0x404fde
mov dword [esp + 0x2c], eax
mov ecx, dword [esp + 0x498]
test ecx, ecx
je 0x4187d7
push dword [esi + 4]
mov edx, dword [esp + 0x4a4]
call fcn.00412d22
mov ecx, dword [esp + 0x280]
mov edi, eax
test ecx, ecx
je 0x4187e3
call fcn.004122c0
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
push eax
push ebx
push esi
lea eax, [esp + 0x24]
push eax
push 0x200
call fcn.00405712
cmp dword [0x443cf0], 0
mov dword [esp + 0x6c], eax
jne 0x4187ec
mov esi, dword [0x42d55c]
cmp esi, 3
je 0x418813
mov eax, dword [esp + 0x280]
test eax, eax
je 0x418829
mov edx, dword [esp + 0x498]
test edx, edx
je 0x418832
push eax
mov ecx, edi
call fcn.00405158
mov esi, dword [esp + 0x14]
test eax, eax
jne 0x41883e
mov ecx, dword [esp + 0x30]
xor edx, edx
inc edx
xor eax, eax
mov dword [0x42d5ac], edx
cmp dword [0x42d564], eax
jne 0x405001
mov eax, dword [esp + 0x280]
test eax, eax
je 0x4188bd
push edx
push dword [esp + 0x28c]
mov edx, ecx
mov ecx, esi
push eax
call fcn.00405226
cmp eax, 1
je 0x4190e6
mov eax, dword [esp + 0x280]
mov ecx, eax
test eax, eax
je 0x4188c6
xor edx, edx
cmp word [ecx], dx
je 0x4188cf
test eax, eax
je 0x4188dd
mov edx, dword [esp + 0x498]
test edx, edx
je 0x4188e6
push eax
mov ecx, edi
call fcn.00405158
test eax, eax
jne 0x4188f2
mov eax, dword [esp + 0x280]
test eax, eax
je 0x418951
push eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
mov ecx, dword [esp + 0x2c]
mov edx, eax
mov esi, dword [0x42d55c]
test ecx, ecx
je 0x405042
mov edi, dword [esp + 0x14]
cmp dword [0x42d564], 0
jne 0x40508b
test dl, 6
je 0x4050bc
or ebx, 0xffffffff
mov dword [0x443cf0], 5
mov dword [esp + 0x10], ebx
xor eax, eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x40], eax
cmp dword [esp + 0x5c], 1
mov edx, dword [esp + 0x2c]
je 0x418a03
mov ecx, dword [edi + 0x1c]
mov eax, ecx
test cl, 8
je 0x405112
mov ecx, eax
test al, 8
je 0x404e09
cmp esi, 3
je 0x418a40
mov edi, dword [esp + 0x24]
lea edx, [esp + 0x18]
push ecx
mov ecx, edi
call fcn.004056e5
cmp esi, 3
mov esi, dword [esp + 0x14]
je 0x418de9
mov eax, dword [esi + 0x1c]
test al, 1
je 0x418de9
mov ecx, 0x800
mov ebx, eax
and ebx, ecx
mov edi, ebx
neg edi
sbb edi, edi
and edi, ecx
mov ecx, dword [esp + 0x10]
cmp ecx, 0xffffffff
jne 0x405122
test eax, 0x400
jne 0x418a63
mov esi, dword [0x43388c]
mov eax, dword [esp + 0x280]
test esi, esi
je 0x418ac7
test eax, eax
je 0x418ae8
or edi, dword [esp + 0x4c]
xor ecx, ecx
push edi
mov edi, dword [esp + 0x18]
push 0x42d544
push ecx
push ecx
push eax
push dword [edi + 4]
mov ecx, esi
call dword [0x4494b4]
call esi
xor edi, edi
mov esi, dword [esp + 0x14]
test eax, eax
je 0x418af1
cmp dword [esp + 0x40], 0
jne 0x404eee
mov eax, dword [esp + 0x280]
test eax, eax
je 0x418b7f
push eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x404ee1
mov ecx, dword [esp + 0x280]
test ecx, ecx
je 0x418b88
and eax, 0xfffffffe
push eax
push ecx
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFileAttributesW]
cmp dword [0x42d560], 0
jne 0x418b91
mov ebx, dword [esp + 0x10]
mov ecx, dword [esi + 0x18]
mov dword [0x42d5cc], edi
mov eax, dword [ecx + 0x14]
mov dword [esp + 0x70], eax
mov eax, dword [ecx + 0x18]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x74], eax
call fcn.0040db92
cmp dword [0x42d55c], 3
je 0x404f39
cmp dword [0x42d544], 0
jne 0x41906d
mov edx, dword [esp + 0x30]
lea eax, [esp + 0x70]
push eax
push ebx
mov ecx, esi
call fcn.004056ae
mov dword [0x42d564], edi
push dword [esp + 0x1c]
mov edx, dword [esi + 0x18]
mov ecx, fcn.00416a00
push 0x21
call fcn.00416a1c
test al, al
jne 0x404b40
mov ecx, dword [esp + 0x1c]
call fcn.0040cd27
mov esi, dword [esi + 0x20]
mov dword [esp + 0x14], esi
test esi, esi
jne 0x404b11
mov edi, dword [esp + 0x30]
cmp dword [0x42d55c], 3
je 0x419144
push dword [esp + 0x498]
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
push dword [esp + 0x6b0]
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
push dword [esp + 0x8c8]
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
push dword [esp + 0x280]
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
mov eax, dword [esp + 0x3c]
pop ecx
mov ecx, dword [esp + 0x8dc]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00416fd0
mov esp, ebp
pop ebp
ret
mov eax, dword [0x42d55c]
jmp 0x404b8e
and eax, 0xfffffffb
test al, 0x80
push 0
pop ecx
setne cl
inc ecx
or ecx, eax
cmp byte [0x443cc9], 0
mov dword [esi + 0x1c], ecx
jne 0x404c56
jmp 0x4187a6
cmp dword [ecx + 0x20], eax
je 0x404d11
mov dword [0x443cf0], eax
mov ecx, dword [ecx + 0x20]
mov dword [0x42d5a8], edx
call fcn.0040c923
mov eax, dword [0x443cf0]
cmp eax, 0x15
je 0x4190db
cmp eax, 0x458
je 0x4190db
mov ecx, dword [esp + 0x30]
xor edx, edx
inc edx
jmp 0x404d11
cmp dword [esp + 0x54], 0
je 0x405061
xor eax, eax
mov dword [esp + 0x3c], eax
cmp edx, 0xffffffff
je 0x40505d
test dl, 0x10
jne 0x41895a
mov dword [esp + 0x54], eax
mov edi, dword [esp + 0x14]
mov eax, dword [edi + 0x1c]
and eax, 0xfffffffb
cmp byte [0x443cc9], 0
mov dword [edi + 0x1c], eax
je 0x418967
cmp dword [esp + 0x3c], 0
je 0x404dac
jmp 0x4189ac
mov eax, dword [esp + 0x30]
mov eax, dword [eax + 0x20]
test eax, eax
je 0x4050a0
test byte [eax + 0x1c], 8
jne 0x405136
cmp esi, 3
jne 0x404db9
jmp 0x4189c2
cmp eax, 3
jne 0x404bb4
jmp 0x404b98
test dword [edi + 0x1c], 0x400
jne 0x4050e1
mov ecx, dword [esp + 0x280]
test ecx, ecx
je 0x40514f
call fcn.004043a0
mov esi, dword [0x42d55c]
mov ebx, eax
mov dword [esp + 0x10], ebx
xor eax, eax
mov dword [esp + 0x40], eax
cmp ebx, 0xffffffff
je 0x404dd5
mov ecx, ebx
mov dword [esp + 0x50], 1
call fcn.00410178
test eax, eax
jne 0x4189df
mov esi, dword [0x42d55c]
jmp 0x404ddd
mov eax, ecx
cmp esi, 3
jne 0x404dfa
jmp 0x418a28
call fcn.0040db92
mov eax, dword [esi + 0x1c]
or ecx, 0xffffffff
mov dword [esp + 0x10], ecx
jmp 0x404e4f
xor eax, eax
cmp dword [edi + 0x20], eax
jne 0x4050a0
xor esi, esi
inc esi
mov dword [0x42d55c], esi
jmp 0x4050a0
lea ecx, [esp + 0x78]
jmp 0x4050d0
mov eax, dword [edi + 0x1c]
jmp 0x40494e
mov ecx, dword [esp + 0x44]
lea eax, [esp + 0x28]
push 1
push eax
call fcn.0040585f
mov dword [esp + 0x34], eax
test eax, eax
je 0x4190f8
mov eax, dword [esp + 0x28]
mov dword [esp + 0x48], eax
jmp 0x404b02
cmp dword [0x42d55c], 3
jne 0x419097
cmp dword [0x42d564], 0
jne 0x419097
mov esi, dword [esp + 0x14]
jmp 0x404f63
lea edx, [esp + 0x6c0]
jmp 0x404b5c
mov ecx, dword [esp + 0x6b0]
test ecx, ecx
jne 0x4186af
lea ecx, [esp + 0x4a8]
mov edx, dword [esi + 4]
call fcn.00428f66
test eax, eax
jne 0x404f3f
jmp 0x404fd4
cmp dword [0x42d564], 0
je 0x404c07
jmp 0x404bb4
lea eax, [esp + 0x78]
jmp 0x404bc3
mov eax, dword [esp + 0x280]
test eax, eax
jne 0x4186ee
lea eax, [esp + 0x78]
mov ecx, dword [esp + 0x6b0]
test ecx, ecx
jne 0x418700
lea ecx, [esp + 0x4a8]
mov edx, dword [esp + 0x6b8]
push eax
call fcn.00411040
jmp 0x404bef
lea eax, [esp + 0x78]
jmp 0x404bfe
mov ecx, dword [0x443cf0]
call fcn.0042985a
cmp dword [0x42d55c], 3
jne 0x418758
cmp ebx, 0xffffffff
jne 0x418758
mov ecx, dword [esp + 0x280]
test ecx, ecx
jne 0x418743
lea ecx, [esp + 0x78]
mov edx, dword [esi + 4]
call fcn.00428f66
test eax, eax
je 0x418758
mov ecx, dword [esp + 0x1c]
jmp 0x4190c5
mov dword [esp + 0x38], 1
jmp 0x404f3f
or dword [esi + 0x1c], 0x80
mov eax, dword [esi + 0x1c]
mov dword [esp + 0x28], 0x80
test al, 1
je 0x404c4a
and eax, 0xfffffffe
or eax, 4
mov dword [esi + 0x1c], eax
jmp 0x404c4a
mov eax, dword [esp + 0x48]
cmp dword [esp + 0x44], eax
jb 0x404c3b
mov ecx, eax
mov dword [esp + 0x28], eax
jmp 0x404c43
cmp dword [0x42d564], 0
je 0x404c56
test cl, 8
jne 0x404c56
cmp dword [0x42d55c], 3
jne 0x404c56
and ecx, 0xfffffffe
or ecx, 2
mov dword [esi + 0x1c], ecx
jmp 0x404c56
lea ecx, [esp + 0x290]
jmp 0x404c65
lea ecx, [esp + 0x78]
jmp 0x404c85
mov ecx, dword [esp + 0x20]
call fcn.0040db92
push 0x6e
pop ecx
call fcn.0042985a
cmp dword [0x42d55c], 3
jne 0x418758
mov ecx, dword [esp + 0x1c]
jmp 0x4190c5
cmp dword [0x42d564], 0
jne 0x404cc4
mov edi, dword [esp + 0x14]
jmp 0x404ddd
lea eax, [esp + 0x78]
jmp 0x404cd3
lea edx, [esp + 0x290]
jmp 0x404ce2
test byte [esi + 0x1c], 0x80
jne 0x404cf6
mov ecx, dword [esp + 0x20]
call fcn.0040db92
push dword [esp + 0x1c]
mov edi, dword [esp + 0x28]
lea edx, [esp + 0x14]
push dword [esp + 0x2c]
push edi
push ecx
mov ecx, esi
call fcn.004290ac
cmp dword [0x42d564], 0
je 0x41889f
cmp dword [0x42d55c], 3
jne 0x418897
mov eax, dword [esi + 0x1c]
mov ecx, dword [esp + 0x2c]
and eax, 0xfffffffe
mov dword [esi + 0x1c], eax
test ecx, ecx
jne 0x418892
or eax, 2
jmp 0x418894
or eax, ecx
mov dword [esi + 0x1c], eax
mov dword [esp + 0x5c], 1
push dword [esi + 0x1c]
lea edx, [esp + 0x1c]
mov ecx, edi
call fcn.004056e5
mov ebx, dword [esp + 0x10]
xor eax, eax
mov dword [0x42d564], eax
jmp 0x404f3f
lea eax, [esp + 0x78]
jmp 0x404d20
lea ecx, [esp + 0x78]
jmp 0x404d4c
mov ecx, dword [esp + 0x20]
call fcn.0040db92
jmp 0x404f3f
lea eax, [esp + 0x78]
jmp 0x404d5f
lea edx, [esp + 0x290]
jmp 0x404d6e
test byte [esi + 0x1c], 0x80
jne 0x404d7e
mov ecx, dword [esp + 0x20]
call fcn.0040db92
cmp dword [0x42d564], 0
je 0x418930
mov eax, dword [esp + 0x30]
mov eax, dword [eax + 0x20]
test eax, eax
je 0x418930
test byte [eax + 0x1c], 8
je 0x418930
xor eax, eax
cmp dword [esi + 0x20], eax
jne 0x418930
mov dword [0x42d55c], 1
push dword [esp + 0x1c]
lea edx, [esp + 0x14]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push ecx
mov ecx, esi
call fcn.004290ac
mov ebx, dword [esp + 0x10]
jmp 0x404d7e
lea eax, [esp + 0x78]
jmp 0x404d8d
mov dword [esp + 0x3c], 1
jmp 0x40505d
test al, 8
je 0x40507b
cmp esi, 3
jne 0x40507b
cmp dword [esp + 0x3c], 0
mov dword [esp + 0x58], esi
jne 0x404dac
mov ecx, dword [esp + 0x30]
mov ecx, dword [ecx + 0x20]
test ecx, ecx
je 0x41899d
test byte [ecx + 0x1c], 8
je 0x41899d
or eax, 1
jmp 0x4189a0
or eax, 2
mov ecx, dword [esp + 0x2c]
mov dword [edi + 0x1c], eax
jmp 0x404dac
cmp dword [esp + 0x58], 3
jne 0x404dac
or eax, 1
mov dword [edi + 0x1c], eax
jmp 0x404dac
test ecx, ecx
jne 0x4189d7
mov eax, dword [edi + 0x1c]
and eax, 0xfffffffe
or eax, 2
mov dword [edi + 0x1c], eax
jmp 0x404db9
mov dword [edi + 0x1c], ecx
jmp 0x404db9
cmp dword [esp + 0x2c], 0
mov dword [esp + 0x40], 1
jne 0x405107
mov eax, dword [edi + 0x1c]
and eax, 0xfffffffe
or eax, 2
mov dword [edi + 0x1c], eax
jmp 0x405107
cmp esi, 3
jne 0x404dec
mov eax, dword [edi + 0x1c]
and eax, 0xfffffffe
mov dword [edi + 0x1c], eax
test edx, edx
jne 0x418a1e
or eax, 2
jmp 0x418a20
or eax, edx
mov dword [edi + 0x1c], eax
jmp 0x404dec
mov eax, ecx
test edx, edx
jne 0x404dfa
and eax, 0xfffffffe
or eax, 2
mov dword [edi + 0x1c], eax
jmp 0x404dfa
cmp dword [esp + 0x3c], 0
mov ecx, eax
jne 0x404e09
test edx, edx
jne 0x404e09
and ecx, 0xfffffffe
or ecx, 2
mov dword [edi + 0x1c], ecx
jmp 0x404e09
mov ecx, dword [esi + 4]
call fcn.0042997c
test eax, eax
jne 0x418a8b
mov ecx, dword [esp + 0x280]
test ecx, ecx
jne 0x418a7e
lea ecx, [esp + 0x78]
call fcn.0042997c
test eax, eax
jne 0x418a8b
mov ecx, eax
jmp 0x418a8e
xor ecx, ecx
inc ecx
mov eax, dword [esp + 0x280]
test eax, eax
jne 0x418a9d
lea eax, [esp + 0x78]
or edi, dword [esp + 0x4c]
or edi, 2
push edi
xor edi, edi
push edi
push ecx
push 0x428430
push eax
push dword [esi + 4]
mov esi, dword [0x43388c]
mov ecx, esi
call dword [0x4494b4]
call esi
jmp 0x404e99
test eax, eax
jne 0x418acf
lea eax, [esp + 0x78]
push dword [esp + 0x4c]
mov esi, dword [esp + 0x18]
push eax
push dword [esi + 4]
call dword [sym.imp.api_ms_win_core_kernel32_legacy_l1_1_0.dll_CopyFileW]
xor edi, edi
jmp 0x404e9d
lea eax, [esp + 0x78]
jmp 0x404e77
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [0x443cf0], eax
cmp eax, 1
jne 0x418b1a
test ebx, ebx
je 0x418b1a
mov eax, dword [esi + 0x18]
test dword [eax], 0x400
je 0x418b1a
mov dword [0x443cf0], 0x40002730
mov ecx, dword [esp + 0x20]
call fcn.0040db92
mov eax, dword [esp + 0x40]
mov esi, eax
mov ecx, dword [0x443cf0]
neg esi
mov dword [0x42d5cc], edi
sbb esi, esi
and esi, 0x1d
test ecx, ecx
jne 0x418b49
push 0x70
pop ecx
mov dword [0x443cf0], ecx
cmp dword [0x42d544], 0
je 0x418b56
mov esi, edi
jmp 0x418b5f
test eax, eax
jne 0x418b5f
call fcn.0042985a
cmp dword [esp + 0x50], 0
jne 0x4190d1
mov ebx, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
mov dword [esp + 0x38], 1
jmp 0x404f3f
lea eax, [esp + 0x78]
jmp 0x404ebb
lea ecx, [esp + 0x78]
jmp 0x404ed6
mov ecx, dword [esp + 0x280]
test ecx, ecx
jne 0x418ba0
lea ecx, [esp + 0x78]
push ecx
xor edx, edx
push ecx
inc edx
call fcn.00405db5
mov ebx, eax
mov dword [esp + 0x10], ebx
cmp ebx, 0xffffffff
je 0x418d21
mov ecx, ebx
call fcn.00410178
test eax, eax
jne 0x418d59
push ebx
call dword [sym.imp.msvcrt.dll__get_osfhandle]
pop ecx
push eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FlushFileBuffers]
test eax, eax
je 0x418d6c
mov ecx, ebx
call fcn.0040db92
mov ecx, dword [esp + 0x280]
test ecx, ecx
jne 0x418bf5
lea ecx, [esp + 0x78]
push ecx
push ecx
xor edx, edx
call fcn.00405db5
mov ebx, eax
mov dword [esp + 0x10], ebx
cmp ebx, 0xffffffff
je 0x418d21
mov ecx, ebx
call fcn.00410178
test eax, eax
jne 0x418d6c
mov esi, dword [esp + 0x20]
push edi
push edi
push edi
push esi
call dword [sym.imp.msvcrt.dll__get_osfhandle]
pop ecx
push eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFilePointer]
push edi
push edi
push edi
push ebx
call dword [sym.imp.msvcrt.dll__get_osfhandle]
pop ecx
push eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFilePointer]
lea eax, [esp + 0x60]
push eax
push esi
call dword [sym.imp.msvcrt.dll__get_osfhandle]
pop ecx
push eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileSize]
mov esi, eax
lea eax, [esp + 0x64]
push eax
push ebx
call dword [sym.imp.msvcrt.dll__get_osfhandle]
pop ecx
push eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileSize]
cmp esi, eax
jne 0x418db3
mov eax, dword [esp + 0x60]
cmp eax, dword [esp + 0x64]
jne 0x418db3
mov esi, edi
mov edi, dword [esp + 0x28]
xor eax, eax
push eax
lea eax, [esp + 0x1c]
push eax
push edi
push dword [esp + 0x30]
push dword [esp + 0x30]
call dword [sym.imp.msvcrt.dll__get_osfhandle]
pop ecx
push eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_ReadFile]
test eax, eax
je 0x418d11
cmp dword [esp + 0x18], 0
je 0x418d11
xor eax, eax
push eax
lea eax, [esp + 0x6c]
push eax
push dword [esp + 0x20]
push dword [esp + 0x40]
push ebx
call dword [sym.imp.msvcrt.dll__get_osfhandle]
pop ecx
push eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_ReadFile]
test eax, eax
je 0x418d98
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x68], eax
jne 0x418d98
cmp edi, eax
je 0x418cf0
xor esi, esi
inc esi
push eax
push dword [esp + 0x38]
push dword [esp + 0x2c]
call sub.msvcrt.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x418d98
test esi, esi
je 0x418c8a
mov ecx, ebx
call fcn.0040db92
or ebx, 0xffffffff
mov dword [esp + 0x10], ebx
jmp 0x418d8d
mov eax, dword [esp + 0x280]
test eax, eax
jne 0x418d30
lea eax, [esp + 0x78]
push eax
push 1
push 0x4000271f
call fcn.0040c5a2
add esp, 0xc
jmp 0x404ef2
lea eax, [esp + 0x78]
push eax
push 1
push 0x4000271f
call fcn.0040c5a2
add esp, 0xc
mov ecx, ebx
call fcn.0040db92
or ebx, 0xffffffff
mov dword [esp + 0x10], ebx
jmp 0x404ef2
mov eax, dword [esp + 0x280]
test eax, eax
jne 0x418d49
jmp 0x418d45
lea eax, [esp + 0x78]
push eax
push 1
push 0x4000271f
call fcn.0040c5a2
add esp, 0xc
mov esi, dword [esp + 0x14]
xor edi, edi
jmp 0x404ef2
mov ecx, ebx
call fcn.0040db92
mov eax, dword [esp + 0x280]
or ebx, 0xffffffff
mov dword [esp + 0x10], ebx
test eax, eax
jne 0x418d7d
jmp 0x418d79
mov eax, dword [esp + 0x280]
test eax, eax
jne 0x418dc2
lea eax, [esp + 0x78]
push eax
push 1
push 0x4000271f
call fcn.0040c5a2
add esp, 0xc
mov ecx, ebx
call fcn.0040db92
or ebx, 0xffffffff
mov dword [esp + 0x10], ebx
mov esi, dword [esp + 0x14]
jmp 0x404ef2
cmp ebx, 0xffffffff
je 0x418e51
push ebx
call dword [sym.imp.msvcrt.dll__get_osfhandle]
pop ecx
push eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetEndOfFile]
cmp dword [0x42d564], 0
jne 0x418e37
cmp dword [0x42d55c], 3
jne 0x418e37
mov eax, dword [esi + 0x1c]
mov ecx, 0x4002
and eax, ecx
cmp eax, ecx
jne 0x418e37
mov eax, dword [esp + 0x18]
sub eax, 2
push eax
mov dword [esp + 0x1c], eax
lea eax, [edi + 2]
push eax
push edi
call dword [sym.imp.msvcrt.dll_memmove]
add esp, 0xc
mov edx, 0x4000
test dword [esi + 0x1c], edx
je 0x418eab
mov ecx, dword [esp + 0x30]
mov eax, dword [ecx + 0x20]
test eax, eax
je 0x418ea8
or dword [eax + 0x1c], edx
jmp 0x418eab
mov ecx, dword [esp + 0x280]
test ecx, ecx
jne 0x418e60
lea ecx, [esp + 0x78]
push ecx
xor edx, edx
push ecx
inc edx
call fcn.00405db5
mov ebx, eax
mov dword [esp + 0x10], ebx
cmp ebx, 0xffffffff
jne 0x418dfd
mov ecx, dword [esp + 0x20]
call fcn.0040db92
cmp dword [0x42d5a4], 0
jne 0x418e92
mov ecx, dword [0x443cf0]
call fcn.0042985a
cmp dword [0x42d55c], 3
jne 0x418758
mov ecx, dword [esp + 0x1c]
jmp 0x4190c5
or dword [ecx + 0x1c], edx
mov eax, dword [0x42d5cc]
test eax, eax
je 0x418f38
cmp dword [esp + 0x18], 0
jle 0x418d91
mov eax, dword [esp + 0x280]
test eax, eax
jne 0x418ed2
lea eax, [esp + 0x78]
push dword [esp + 0x20]
mov edx, edi
mov ecx, ebx
push eax
push dword [esp + 0x20]
call fcn.0042916c
cmp dword [0x42d560], 0
je 0x418d91
mov ecx, ebx
call fcn.00410178
test eax, eax
jne 0x418d91
mov edx, dword [esp + 0x280]
test edx, edx
jne 0x418f0f
lea edx, [esp + 0x78]
push dword [esp + 0x34]
lea ecx, [esp + 0x14]
push edi
push dword [esp + 0x20]
call fcn.004284fe
cmp eax, 1
jne 0x418f2f
mov ecx, dword [esp + 0x1c]
jmp 0x4190c5
mov ebx, dword [esp + 0x10]
jmp 0x418d91
mov ecx, dword [esp + 0x6c]
mov edi, dword [esp + 0x20]
cmp ecx, 1
jne 0x418fe3
mov eax, dword [esp + 0x280]
test eax, eax
jne 0x418f58
lea eax, [esp + 0x78]
mov edx, dword [esp + 0x24]
mov ecx, ebx
push edi
push eax
push dword [esp + 0x20]
call fcn.0042916c
cmp dword [0x42d560], 0
je 0x418fae
mov ecx, ebx
call fcn.00410178
test eax, eax
jne 0x418fae
mov edx, dword [esp + 0x280]
test edx, edx
jne 0x418f8c
lea edx, [esp + 0x78]
push dword [esp + 0x34]
lea ecx, [esp + 0x14]
push dword [esp + 0x28]
push dword [esp + 0x20]
call fcn.004284fe
cmp eax, 1
je 0x4190c1
mov ebx, dword [esp + 0x10]
mov eax, dword [esp + 0x280]
test eax, eax
jne 0x418fbd
lea eax, [esp + 0x78]
mov edx, dword [esp + 0x24]
mov ecx, edi
push eax
push ebx
push esi
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x38]
call fcn.00405712
mov ecx, eax
mov eax, dword [0x42d5cc]
test eax, eax
je 0x418f40
test eax, eax
je 0x418d91
cmp dword [esp + 0x18], 0
jle 0x418d91
cmp ecx, 1
jne 0x418d91
mov eax, dword [esp + 0x280]
test eax, eax
jne 0x41900e
lea eax, [esp + 0x78]
push edi
mov edi, dword [esp + 0x28]
mov ecx, ebx
push eax
push dword [esp + 0x20]
mov edx, edi
call fcn.0042916c
cmp dword [0x42d560], 0
je 0x418d91
mov ecx, ebx
call fcn.00410178
test eax, eax
jne 0x418d91
mov edx, dword [esp + 0x280]
test edx, edx
jne 0x41904c
lea edx, [esp + 0x78]
push dword [esp + 0x34]
lea ecx, [esp + 0x14]
push edi
push dword [esp + 0x20]
call fcn.004284fe
cmp eax, 1
jne 0x418f2f
mov ecx, dword [esp + 0x1c]
jmp 0x4190c5
mov ecx, ebx
call fcn.0040db92
mov eax, dword [esp + 0x280]
test eax, eax
jne 0x419083
lea eax, [esp + 0x78]
push eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
mov dword [esp + 0x38], 1
jmp 0x404f39
push dword [edi]
push 0x403848
call fcn.004125d9
push 0x401eb4
call fcn.004125d9
mov ecx, dword [0x443cf0]
add esp, 0xc
call fcn.0042985a
mov ecx, dword [esp + 0x1c]
jmp 0x4190c5
mov ecx, dword [esp + 0x1c]
call fcn.0040cd27
xor edx, edx
inc edx
xor ecx, ecx
jmp 0x4190d6
xor edx, edx
mov ecx, esi
inc edx
call fcn.004285e9
xor ecx, ecx
push ecx
push eax
call fcn.0040c108
pop ecx
pop ecx
mov ecx, dword [esp + 0x20]
call fcn.0040db92
mov ecx, dword [esp + 0x1c]
call fcn.0040cd27
lea ecx, [esp + 0x290]
call fcn.00410de8
lea ecx, [esp + 0x4a8]
call fcn.00410de8
lea ecx, [esp + 0x6c0]
call fcn.00410de8
lea ecx, [esp + 0x78]
call fcn.00410de8
xor eax, eax
inc eax
jmp 0x404fbf
mov ecx, dword [esp + 0x1c]
call fcn.0040cd27
cmp ebx, 0xffffffff
je 0x4190f8
mov ecx, ebx
call fcn.0040db92
jmp 0x4190f8
cmp ebx, 0xffffffff
je 0x404f83
xor eax, eax
mov edx, edi
push eax
push ebx
mov ecx, esi
call fcn.004056ae
jmp 0x404f83