Function at 0x48a430
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4c48fb
mov eax, dword fs:[0]
push eax
sub esp, 0x9ac
mov eax, dword [0x4d98f0]
xor eax, esp
mov dword [esp + 0x9a8], eax
push ebx
push esi
push edi
mov eax, dword [0x4d98f0]
xor eax, esp
push eax
lea eax, [esp + 0x9bc]
mov dword fs:[0], eax
xor ebx, ebx
mov edi, 1
cmp byte [esp + 0x9d4], bl
je 0x48a495
cmp word [0x5258e2], bx
je 0x48a4fc
cmp dword [0x53b4d4], ebx
je 0x48a4fc
xor eax, eax
mov word [0x5258e2], ax
jmp 0x48a4fc
push edi
call fcn.00487a20
mov al, byte [esp + 0x9d0]
mov dword [0x527220], 3
cmp al, bl
je 0x48a4b5
mov byte [0x52725a], al
mov dword [0x51b010], ebx
mov dword [0x51b014], ebx
cmp byte [0x51a779], bl
jne 0x48a60f
mov ecx, dword [0x52a494]
push edi
push ecx
mov ecx, 0x5210a8
call fcn.00446320
cmp byte [0x5218c2], bl
je 0x48a4fc
mov edx, dword [0x52a494]
cmp dword [edx + 0x20], edi
jbe 0x48a4fc
mov dword [0x52721c], 4
cmp byte [0x51a779], bl
jne 0x48a60f
cmp word [0x529c92], bx
jne 0x48a60f
mov esi, 0x529c92
mov byte [esp + 0x9cc], bl
call fcn.00484e80
push 0x400
push 0x4c6d80
lea eax, [esp + 0x1c0]
push eax
push str.DefFolder
push str.Compression
call fcn.00460470
cmp word [esp + 0x1b8], bx
jne 0x48a579
cmp byte [0x5218c2], bl
je 0x48a5e7
push 0x400
lea ecx, [esp + 0x1bc]
push ecx
call fcn.0048c140
cmp word [esp + 0x1b8], bx
je 0x48a5e7
lea edx, [esp + 0x1b8]
push edx
call fcn.00455810
mov eax, 0x529c92
mov edx, eax
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x48a590
lea edi, [esp + 0x1b8]
sub eax, edx
add edi, 0xfffffffe
jmp 0x48a5b0
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x48a5b0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor eax, eax
mov edi, edi
movzx ecx, word [esp + eax + 0x1b8]
mov word [eax + 0x529c92], cx
add eax, 2
cmp cx, bx
jne 0x48a5d0
cmp word [0x5240e0], bx
mov eax, dword [0x527c24]
setne cl
push eax
movzx edx, cl
push edx
push 0x400
push 0x529c92
call fcn.00485020
mov edi, 1
cmp dword [0x52721c], ebx
jne 0x48a621
mov dword [0x52721c], 5
cmp byte [0x51a779], bl
je 0x48a703
mov esi, dword [0x521bdc]
cmp esi, ebx
je 0x48a661
cmp esi, edi
je 0x48a661
push 0x30
push 0x65
call fcn.00466860
push eax
push 0x1fd
call fcn.00466860
push eax
mov eax, dword [0x51b8cc]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x48aa0a
push 0x400
push 0x529c92
mov ecx, 0x5219d0
call fcn.00413210
push 0x400
push 0x5264ec
mov ecx, 0x5219d0
call fcn.004131f0
cmp word [0x5264ec], bx
je 0x48a69c
push 0x5264ec
call fcn.00455810
lea ecx, [esp + 0x18]
push ecx
mov ecx, 0x5219d0
mov byte [0x52725e], bl
call fcn.00413240
mov edx, dword [esp + 0x98]
mov dword [0x527c24], edx
cmp esi, ebx
jne 0x48a6cb
cmp dword [esp + 0x120], ebx
je 0x48a6d7
mov eax, dword [esp + 0x14c]
mov dword [0x52720c], eax
cmp dword [esp + 0x138], ebx
je 0x48a6fa
xor eax, eax
movzx ecx, word [eax + 0x4c6f44]
mov word [eax + 0x5240e0], cx
add eax, 2
cmp cx, bx
jne 0x48a6e2
jmp 0x48a703
xor ecx, ecx
mov word [0x5240e0], cx
mov edx, dword [0x51b8cc]
push edx
call dword [sym.imp.USER32.dll_IsWindowVisible]
mov ecx, dword [esp + 0x9cc]
neg eax
sbb eax, eax
and eax, dword [0x51b8cc]
push ebx
push ecx
push eax
call fcn.0048a140
test al, al
je 0x48a9eb
mov eax, dword [0x53b4dc]
cmp eax, edi
je 0x48a73f
cmp eax, 2
jne 0x48a791
mov edx, dword [0x53b4e8]
mov eax, dword [0x53b4e4]
mov ecx, dword [0x53b4e0]
push edx
push eax
push ecx
lea edx, [esp + 0x174]
push str._dd_dh_dm
push edx
call fcn.004b002b
add esp, 0x14
cmp dword [0x53b4dc], edi
jne 0x48a77f
lea eax, [esp + 0x168]
push eax
mov ecx, 0x5272e4
jmp 0x48a78c
lea ecx, [esp + 0x168]
push ecx
mov ecx, 0x527308
call fcn.004730d0
cmp word [0x5240e0], bx
je 0x48a837
cmp word [0x5258e2], bx
jne 0x48a837
mov eax, dword [0x53b4d4]
cmp eax, ebx
jne 0x48a840
lea ecx, [esp + 0x13]
call fcn.0046c330
mov dword [esp + 0x9c4], ebx
lea ecx, [esp + 0x13]
call fcn.0046d2a0
mov esi, eax
cmp esi, ebx
je 0x48a823
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x48a7e0
sub eax, edx
sar eax, 1
xor ecx, ecx
inc eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004af997
add esp, 4
mov dword [0x53b4d4], eax
mov ecx, esi
mov edx, eax
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
cmp ax, bx
jne 0x48a812
mov dword [esp + 0x9c4], 0xffffffff
lea ecx, [esp + 0x13]
call fcn.0046a9a0
mov eax, dword [0x53b4d4]
cmp eax, ebx
je 0x48a848
push eax
call fcn.00482800
jmp 0x48a86b
cmp byte [0x51a779], bl
je 0x48a86b
cmp dword [esp + 0x138], ebx
je 0x48a86b
cmp word [0x5240e0], 0x2a
jne 0x48a86b
xor eax, eax
mov word [0x5240e0], ax
mov ecx, dword [0x52a494]
cmp dword [ecx + 0x20], ebx
jne 0x48a89d
push 0x30
push 0x65
call fcn.00466860
push eax
push 0x14b
call fcn.00466860
mov edx, dword [0x51b8cc]
push eax
push edx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x48a9eb
cmp word [0x5258e2], bx
je 0x48a912
cmp dword [0x5260e4], ebx
jne 0x48a912
push ebx
push 0x4c8358
push 0x5258e2
call fcn.00435dd0
mov esi, eax
cmp esi, ebx
je 0x48a912
push esi
push 0x400
lea eax, [esp + 0x1c0]
push edi
push eax
call fcn.004b2cda
add esp, 0x10
mov dword [esp + 0x14], 0x30c
cmp eax, ebx
jbe 0x48a909
lea ecx, [esp + 0x14]
push ecx
push eax
lea edx, [esp + 0x1c0]
push edx
call dword [sym.imp.ADVAPI32.dll_IsTextUnicode]
test eax, eax
je 0x48a909
mov dword [0x5260e4], 3
push esi
call fcn.004b2d6e
add esp, 4
cmp word [0x526cec], bx
mov ecx, 0x51b8d0
setne al
mov byte [0x51b8fc], al
call fcn.0046f8a0
cmp byte [0x53b4ee], bl
je 0x48a93a
call fcn.00488770
jmp 0x48a94c
movzx ecx, byte [0x528c2b]
push ecx
mov ecx, 0x5219d0
call fcn.00417940
cmp dword [0x53b4d4], ebx
je 0x48a95e
push 0x5258e2
call fcn.00435910
cmp dword [0x51af94], edi
je 0x48a9eb
cmp byte [0x51a779], bl
je 0x48a97e
mov ecx, 0x5210a8
call fcn.0044a650
jmp 0x48a9eb
cmp byte [0x52725a], bl
je 0x48a990
mov ecx, 0x521088
call fcn.00475fd0
push 0x400
lea edx, [esp + 0x1bc]
push edx
call fcn.0048c140
lea eax, [esp + 0x1b8]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x48a9b0
sub eax, edx
sar eax, 1
push eax
push 0x529c92
lea eax, [esp + 0x1c0]
push eax
call fcn.00477530
push 0x529c92
test eax, eax
jne 0x48a9e1
call fcn.00455e90
push eax
mov ecx, 0x5210a8
call fcn.00448c00
mov ecx, dword [0x53b4d4]
push ecx
call fcn.004b0855
add esp, 4
mov ecx, 0x51b8d0
mov byte [0x51b8fc], bl
call fcn.0046f8a0
mov ecx, dword [esp + 0x9bc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x9a8]
xor ecx, esp
call fcn.004affec
add esp, 0x9b8
ret 0xc