Function at 0x49c8a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d43b8
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x1608
call fcn.004bfc70
mov eax, dword [0x4ea93c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor ebx, ebx
cmp byte [ebp + 0x10], bl
je 0x49c8f8
cmp word [0x54790e], bx
je 0x49c958
cmp dword [0x56b768], ebx
je 0x49c958
xor eax, eax
mov word [0x54790e], ax
jmp 0x49c958
push 1
call fcn.0049b330
mov dword [0x54aa50], 3
mov al, byte [ebp + 0xc]
cmp al, bl
je 0x49c915
mov byte [0x54aa8e], al
mov dword [0x533488], ebx
mov dword [0x53348c], ebx
cmp byte [0x5323f1], bl
jne 0x49ca24
push ebx
push 0x550d14
mov ecx, 0x53ed88
call fcn.0044c850
cmp byte [0x53fda2], bl
je 0x49c958
cmp dword [0x550d28], 1
jbe 0x49c958
mov dword [0x54aa4c], 4
cmp byte [0x5323f1], bl
jne 0x49ca24
cmp word [0x54fd12], bx
jne 0x49ca24
mov byte [ebp + 8], bl
mov esi, 0x54fd12
call fcn.00498700
push 0x800
push 0x4d69fc
lea ecx, [ebp - 0x10b4]
push ecx
push str.DefFolder
push str.Compression
call fcn.0046bcb0
cmp word [ebp - 0x10b4], bx
jne 0x49c9c4
cmp byte [0x53fda2], bl
je 0x49ca01
lea edx, [ebp - 0x10b4]
push edx
call fcn.00448a50
cmp word [ebp - 0x10b4], bx
je 0x49ca01
push 0x800
lea eax, [ebp - 0x10b4]
push eax
call fcn.0045f4a0
push 0x800
push 0x54fd12
lea ecx, [ebp - 0x10b4]
push ecx
call fcn.0047e380
push 0x800
lea edx, [ebp - 0x10b4]
push edx
push 0x54fd12
call fcn.0047e340
mov eax, dword [0x54ccb0]
push eax
cmp word [0x545908], bx
setne cl
movzx edx, cl
push edx
push 0x800
push 0x54fd12
call fcn.00496a10
cmp dword [0x54aa4c], ebx
jne 0x49ca36
mov dword [0x54aa4c], 5
cmp byte [0x5323f1], bl
je 0x49cb3e
mov esi, dword [0x5410bc]
cmp esi, ebx
je 0x49ca77
cmp esi, 1
je 0x49ca77
push 0x30
push 0x65
call fcn.004744a0
push eax
push 0x1fd
call fcn.004744a0
push eax
mov eax, dword [0x534544]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x49ce56
push 0x800
push 0x54fd12
mov ecx, 0x540eb0
call fcn.00414de0
push 0x800
push 0x548918
mov ecx, 0x540eb0
call fcn.00414dc0
cmp word [0x548918], bx
je 0x49cab7
push 0x800
push 0x548918
call fcn.0045f4a0
mov byte [0x54aaa8], bl
lea ecx, [ebp - 0x1614]
push ecx
mov ecx, 0x540eb0
call fcn.00414e10
mov eax, dword [ebp - 0x1594]
mov dword [0x54ccb0], eax
cmp eax, ebx
jne 0x49caec
cmp byte [ebp - 0x1590], bl
mov byte [0x54aa8f], 1
jne 0x49caf2
mov byte [0x54aa8f], bl
cmp esi, ebx
jne 0x49cafe
cmp dword [ebp - 0x1508], ebx
je 0x49cb0a
mov edx, dword [ebp - 0x14cc]
mov dword [0x54aa3c], edx
xor eax, eax
cmp dword [ebp - 0x14ec], ebx
je 0x49cb38
jmp 0x49cb20
movzx ecx, word [eax + 0x4d67f0]
mov word [eax + 0x545908], cx
add eax, 2
cmp cx, bx
jne 0x49cb20
jmp 0x49cb3e
mov word [0x545908], ax
mov ecx, dword [0x534544]
push ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
neg eax
sbb eax, eax
and eax, dword [0x534544]
push ebx
mov edx, dword [ebp + 8]
push edx
push eax
call fcn.0049c5a0
test al, al
je 0x49ce37
mov eax, dword [0x56b770]
cmp eax, 1
je 0x49cb77
cmp eax, 2
jne 0x49cbcc
mov eax, dword [0x56b77c]
push eax
mov ecx, dword [0x56b778]
push ecx
mov edx, dword [0x56b774]
push edx
push str._dd_dh_dm
lea eax, [ebp - 0xb4]
push eax
mov edx, 0x50
call fcn.0043a6e0
add esp, 0x14
cmp dword [0x56b770], 1
jne 0x49cbbb
lea ecx, [ebp - 0xb4]
push ecx
mov ecx, 0x54abb0
jmp 0x49cbc7
lea edx, [ebp - 0xb4]
push edx
mov ecx, 0x54abb8
call fcn.004819d0
cmp byte [0x54aa8f], bl
je 0x49cbde
mov eax, dword [0x56b784]
mov dword [0x544904], eax
mov eax, dword [0x56b768]
cmp eax, ebx
je 0x49cbef
push eax
call fcn.004947a0
jmp 0x49cc12
cmp byte [0x5323f1], bl
je 0x49cc12
cmp dword [ebp - 0x14ec], ebx
je 0x49cc12
cmp word [0x545908], 0x2a
jne 0x49cc12
xor ecx, ecx
mov word [0x545908], cx
cmp dword [0x550d28], ebx
jne 0x49cc41
push 0x30
push 0x65
call fcn.004744a0
push eax
push 0x14b
call fcn.004744a0
push eax
mov edx, dword [0x534544]
push edx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x49ce37
cmp word [0x54790e], bx
je 0x49ccb8
cmp dword [0x548910], ebx
jne 0x49ccb8
push 0x4d8484
push 0x54790e
call fcn.0043c420
mov esi, eax
cmp esi, ebx
je 0x49ccb8
push esi
push 0x400
push 1
lea eax, [ebp - 0x14b4]
push eax
call fcn.004c2fc6
add esp, 0x10
mov dword [ebp - 0x1618], 0x30c
cmp eax, ebx
jbe 0x49ccaf
lea ecx, [ebp - 0x1618]
push ecx
push eax
lea edx, [ebp - 0x14b4]
push edx
call dword [sym.imp.ADVAPI32.dll_IsTextUnicode]
test eax, eax
je 0x49ccaf
mov dword [0x548910], 3
push esi
call fcn.004c2398
add esp, 4
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x70]
call fcn.0047e890
mov byte [ebp - 4], 1
mov ecx, 0x550d14
call fcn.0047e680
mov ecx, 0x550d14
call fcn.0047ea80
cmp eax, ebx
je 0x49cd07
push 0x800
lea ecx, [ebp - 0x10b4]
push ecx
push eax
mov ecx, 0x53ed88
call fcn.0044b4e0
lea edx, [ebp - 0x10b4]
push edx
lea ecx, [ebp - 0x70]
call fcn.0047e700
jmp 0x49ccd1
lea eax, [ebp - 0x70]
push eax
mov ecx, 0x550d14
call fcn.0042d750
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x70]
call fcn.004104a0
mov dword [ebp - 4], 0xffffffff
jmp 0x49cd42
push 0x800
push 0x54fd12
push 0x54fd12
mov ecx, 0x53ed88
call fcn.0044b4e0
mov cl, byte [0x549a18]
mov byte [0x534574], cl
mov ecx, 0x534548
call fcn.0047dd10
cmp byte [0x54ecd1], bl
je 0x49cd80
call fcn.004998b0
jmp 0x49cd92
movzx edx, byte [0x54ecb7]
push edx
mov ecx, 0x540eb0
call fcn.00419370
cmp dword [0x56b768], ebx
je 0x49cda4
push 0x54790e
call fcn.0043c090
cmp dword [0x53340c], 1
je 0x49ce37
cmp byte [0x5323f1], bl
je 0x49cdc5
mov ecx, 0x53ed88
call fcn.00450a10
jmp 0x49ce37
cmp byte [0x54aa8e], bl
je 0x49cdd7
mov ecx, 0x53ed68
call fcn.00484890
push 0x800
lea eax, [ebp - 0x10b4]
push eax
mov ecx, 0x53ed88
call fcn.0044b4b0
lea eax, [ebp - 0x10b4]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x49cdf6
sub eax, edx
sar eax, 1
push eax
push 0x54fd12
lea ecx, [ebp - 0x10b4]
push ecx
call fcn.00485e20
test eax, eax
jne 0x49ce27
push 0x54fd12
call fcn.0045f900
jmp 0x49ce2c
mov eax, 0x4d69fc
push eax
mov ecx, 0x53ed88
call fcn.0044ee30
mov edx, dword [0x56b768]
push edx
call fcn.004c061a
add esp, 4
mov byte [0x534574], bl
mov ecx, 0x534548
call fcn.0047dd10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004bfc52
mov esp, ebp
pop ebp
ret 0xc