Function at 0x4b7dc0
Capabilities:
Create pipe
Create process on windows
Create process suspended
Create two anonymous pipes
Get common file path
Get file size
Read file on windows
Resolve function by parsing pe exports
Write and execute a file
Write file on windows
Write pipe

Disassembly:
push 0xffffffffffffffff
push 0x564688
mov eax, dword fs:[0]
push eax
mov eax, 0x33f8
call fcn.00540b00
mov eax, dword [0x5b7b5c]
xor eax, esp
mov dword [esp + 0x33f4], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5b7b5c]
xor eax, esp
push eax
lea eax, [esp + 0x340c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x341c]
mov esi, dword [esp + 0x3424]
mov edi, ecx
mov ecx, dword [eax + 8]
lea edx, [ecx - 1]
mov ecx, dword [esp + 0x3420]
cmp ecx, edx
jg 0x4b8e48
mov eax, dword [eax + 4]
mov eax, dword [eax + ecx*4]
mov ecx, dword [eax + 4]
mov edx, dword [eax + 0xc]
mov ebp, dword [eax]
mov ebx, dword [eax + 8]
mov dword [esp + 0x18], ecx
mov ecx, dword [eax + 0x10]
mov dword [esp + 0x2c], edx
mov edx, dword [eax + 0x1c]
mov eax, dword [eax + 0x18]
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x70], ecx
mov dword [esp + 0x54], edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x30], 0
test esi, esi
je 0x4b7e87
push 0x57e3c8
mov ecx, esi
call fcn.0050b51f
test eax, eax
je 0x4b7e87
cmp dword [esi + 0x2c0], 0
mov dword [esp + 0x30], esi
je 0x4b7e87
mov dword [esp + 0x20], 0x10
call fcn.005089db
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4b7ea1
push 0x80004005
call fcn.00401340
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 0x3414], eax
mov dword [esp + 0x74], 0xc
mov dword [esp + 0x7c], 1
mov dword [esp + 0x78], eax
call fcn.005089db
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4b7ee8
push 0x80004005
call fcn.00401340
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x24], eax
lea ecx, [esp + 0x38]
push ecx
push esi
push ebp
lea edx, [esp + 0x30]
push ebx
push edx
mov byte [esp + 0x3428], 1
mov dword [edi + 0x5d0], 1
mov dword [esp + 0x4c], 0xffffffff
call fcn.004b5120
add esp, 0x14
test eax, eax
je 0x4b8df9
mov eax, dword [esp + 0x38]
cmp eax, 0xffffffff
je 0x4b7f3e
mov dword [edi + 0x5d0], eax
call fcn.005089db
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4b7f58
push 0x80004005
call fcn.00401340
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x2c]
mov byte [esp + 0x3414], 2
test eax, eax
je 0x4b7f9b
push 0
push esi
push ebp
push eax
lea ecx, [esp + 0x38]
push ecx
call fcn.004b5120
mov ecx, dword [esp + 0x3c]
mov eax, dword [ecx - 0xc]
add esp, 0x14
neg eax
sbb eax, eax
and eax, ecx
mov dword [esp + 0x2c], eax
xor eax, eax
push 0x44
push eax
lea edx, [esp + 0x88]
push edx
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
call fcn.0053ff80
mov ebx, dword [esp + 0x2c]
mov eax, 5
add esp, 0xc
and ebx, 0x10
mov word [esp + 0xb0], ax
mov dword [esp + 0x80], 0x44
mov dword [esp + 0xac], 1
mov dword [esp + 0x40], ebx
mov eax, 0x100
jne 0x4b8653
test dword [esp + 0x20], eax
jne 0x4b866a
lea ecx, [esp + 0x1c]
call fcn.00401d10
push 0
push esi
mov esi, dword [esp + 0x20]
push ebp
lea ecx, [esp + 0x28]
push esi
push ecx
mov byte [esp + 0x3428], 4
call fcn.004b5120
mov ebx, dword [esp + 0x34]
add esp, 0x14
test ebx, 0x200
jne 0x4b8201
test bl, 1
jne 0x4b8201
push esi
call fcn.004b2c10
add esp, 4
test eax, eax
jne 0x4b8201
push esi
call fcn.0044b5f0
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x4b8068
mov ebp, 0x57bc10
lea esi, [edi + 0x160]
push esi
push 0x208
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push str.epp_run.cmd
push esi
call fcn.00411c90
add esp, 8
lea ecx, [esp + 0x48]
call fcn.0044e500
push 1
push 1
push 0x40000000
push esi
lea ecx, [esp + 0x58]
mov byte [esp + 0x3424], 5
call fcn.0044f040
test eax, eax
je 0x4b81ee
push 0x22
lea ecx, [esp + 0x18]
call fcn.00429690
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x18]
call fcn.00414a70
push 0x22
lea ecx, [esp + 0x18]
call fcn.00406090
mov eax, dword [esp + 0x24]
cmp dword [eax - 0xc], 0
jle 0x4b80fb
push 0x20
lea ecx, [esp + 0x18]
call fcn.00406090
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x18]
call fcn.00414a70
push str._echo_off_r_n
lea edx, [esp + 0xcfc]
push 0x1388
push edx
call fcn.0053fe1c
push 0x583094
push ebp
call fcn.0054022e
add esp, 0x14
test eax, eax
je 0x4b813b
push 0x58308c
push ebp
call fcn.0054022e
add esp, 8
test eax, eax
mov eax, 0x57bc10
jne 0x4b8140
mov eax, str.call
push eax
lea eax, [esp + 0xcfc]
push eax
call fcn.004b2e60
mov ecx, dword [esp + 0x1c]
push ecx
lea edx, [esp + 0xd04]
push edx
call fcn.004b2e60
push str._r_npause
lea eax, [esp + 0xd0c]
push 0x1388
push eax
call fcn.0053fd9f
lea eax, [esp + 0xd14]
add esp, 0x1c
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4b8184
sub eax, edx
sar eax, 1
mov ebp, eax
lea ebx, [ebp + ebp]
lea ecx, [ebx + 1]
push ecx
call fcn.004ff95f
add esp, 4
push 0
push 0
push ebx
mov esi, eax
push esi
push ebp
lea edx, [esp + 0xd0c]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 1
push eax
push esi
lea ecx, [esp + 0x54]
mov byte [eax + esi], 0
call fcn.0044f330
push esi
call fcn.004ff96a
add esp, 4
lea eax, [edi + 0x160]
push eax
lea ecx, [esp + 0x18]
call fcn.00402230
mov ebx, dword [esp + 0x20]
lea ecx, [esp + 0x48]
mov byte [esp + 0x3414], 4
call fcn.0044e540
jmp 0x4b8232
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x18]
call fcn.004060b0
mov ecx, dword [esp + 0x24]
cmp dword [ecx - 0xc], 0
jle 0x4b8232
push 0x20
lea ecx, [esp + 0x18]
call fcn.00406090
lea edx, [esp + 0x24]
push edx
lea ecx, [esp + 0x18]
call fcn.00414a70
mov eax, ebx
and eax, 1
mov dword [esp + 0x40], eax
je 0x4b8455
cmp dword [edi + 0x5e8], 0
jne 0x4b82a6
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea esi, [edi + 0x570]
push 0x583058
push esi
call fcn.004b2e80
add esp, 0xc
push esi
push 0x1000
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [edi + 0x5e8], eax
test eax, eax
jne 0x4b82a6
push eax
push eax
push eax
push 0x53ec
call fcn.0044ef40
xor eax, eax
add esp, 0x10
lea ecx, [esp + 0x1c]
mov word [esi], ax
call fcn.00401b40
jmp 0x4b8871
cmp dword [edi + 0xb8], 0
jne 0x4b82f2
mov ecx, dword [edi + 0x5e8]
push 0
push 0
push 0
push 0xf001f
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [edi + 0xb8], eax
test eax, eax
jne 0x4b82f2
push 0
push 0
push 0
push 0x53ec
call fcn.0044ef40
add esp, 0x10
lea ecx, [esp + 0x1c]
call fcn.00401b40
jmp 0x4b8871
mov edx, dword [edi + 0xb8]
mov eax, dword [esp + 0x14]
mov ecx, dword [eax - 0xc]
push 0
push 0
push 0xff6
add edx, 3
push edx
push ecx
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, dword [edi + 0xb8]
mov byte [eax + ecx + 3], 0
mov edx, dword [edi + 0xb8]
push 0x583054
add edx, 3
push 0xff6
push edx
call fcn.00541bdf
mov ebx, dword [sym.imp.KERNEL32.dll_CreatePipe]
add esp, 0xc
push 0
lea eax, [esp + 0x4c]
push eax
lea esi, [edi + 0x5dc]
push esi
lea ecx, [edi + 0x5d8]
push ecx
mov dword [esp + 0x58], 0xc
mov dword [esp + 0x60], 1
mov dword [esp + 0x5c], 0
call ebx
push 0
test eax, eax
je 0x4b82d3
lea edx, [esp + 0x4c]
push edx
lea eax, [edi + 0x15c]
push eax
lea ebp, [edi + 0x5e0]
push ebp
mov dword [esp + 0x58], 0xc
mov dword [esp + 0x60], 1
mov dword [esp + 0x5c], 0
call ebx
test eax, eax
je 0x4b82d1
lea ecx, [esp + 0x30]
call fcn.00401d10
mov edx, dword [0x5ba378]
mov eax, dword [edx + 0xdc]
lea ecx, [edi + 0x570]
push ecx
push eax
lea ecx, [esp + 0x38]
push str._slauncher.exe__s
push ecx
mov byte [esp + 0x3424], 6
call fcn.00406130
add esp, 0x10
lea edx, [esp + 0x30]
push edx
lea ecx, [esp + 0x18]
call fcn.004060b0
mov ecx, dword [ebp]
mov esi, dword [esi]
mov edx, dword [edi + 0xb8]
or dword [esp + 0xac], 0x100
mov dword [esp + 0xb8], ecx
xor eax, eax
mov word [esp + 0xb0], ax
mov dword [esp + 0xbc], esi
mov dword [esp + 0xc0], esi
mov byte [edx + 2], 1
mov eax, dword [edi + 0xb8]
mov byte [eax + 1], 1
mov ecx, dword [edi + 0xb8]
mov byte [ecx], 1
lea ecx, [esp + 0x30]
mov byte [esp + 0x3414], 4
call fcn.00401b40
mov edx, dword [esp + 0x14]
mov ebp, dword [edx - 0xc]
inc ebp
xor ecx, ecx
mov eax, ebp
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004ff95f
mov esi, eax
mov eax, dword [esp + 0x18]
push eax
push ebp
push esi
call fcn.0053fe1c
mov eax, dword [esp + 0x3c]
add esp, 0x10
lea ecx, [esp + 0x58]
push ecx
lea edx, [esp + 0x84]
push edx
push eax
xor ebp, ebp
push ebp
push ebp
push 1
push ebp
push ebp
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push esi
mov ebx, eax
call fcn.004ff96a
mov eax, dword [edi + 0x5dc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 4
cmp eax, ebp
je 0x4b84cc
push eax
call esi
mov dword [edi + 0x5dc], ebp
mov eax, dword [edi + 0x5e0]
cmp eax, ebp
je 0x4b84df
push eax
call esi
mov dword [edi + 0x5e0], ebp
cmp ebx, ebp
je 0x4b860b
mov ecx, dword [esp + 0x58]
push ecx
call esi
mov edx, dword [esp + 0x5c]
push edx
call esi
cmp dword [esp + 0x40], ebp
je 0x4b8622
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x70]
push 1
push eax
push ecx
mov ecx, edi
call fcn.004b31b0
lea edx, [esp + 0x28]
lea ecx, [edi + 0x134]
push edx
call fcn.004060b0
lea ecx, [esp + 0x20]
call fcn.00401d10
push 0x583018
lea ecx, [esp + 0x24]
mov byte [esp + 0x3418], 7
call fcn.00402230
mov ebx, dword [esp + 0x3c]
xor esi, esi
cmp word [ebx], bp
je 0x4b856d
mov eax, ebx
mov edi, edi
movzx eax, word [eax]
cmp ax, 0x26
je 0x4b8563
push eax
lea ecx, [esp + 0x24]
call fcn.00405c40
inc esi
cmp word [ebx + esi*2], bp
lea eax, [ebx + esi*2]
jne 0x4b8550
push 0x583000
lea ecx, [esp + 0x24]
call fcn.00402270
mov eax, dword [esp + 0x20]
mov ecx, dword [eax - 0xc]
push 1
push ecx
push eax
mov ecx, edi
call fcn.004b30a0
mov ecx, dword [0x5ed0c0]
push ebp
push 1
push edi
call fcn.0050ea2e
mov eax, dword [0x5ed0c0]
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, dword [0x5ed0c0]
cmp eax, ebp
jne 0x4b85b8
xor eax, eax
jmp 0x4b85bb
mov eax, dword [eax + 0x20]
mov dword [edi + 0x5e4], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [edi + 0x11c], eax
cmp dword [esp + 0x3428], ebp
je 0x4b85ea
push edi
call fcn.004b7650
add esp, 4
lea ecx, [esp + 0x20]
call fcn.00401b40
jmp 0x4b8622
push ebp
push ebp
push ebp
push 0xfffffffffffffffe
push edi
push fcn.004b7650
call fcn.00513233
lea ecx, [esp + 0x20]
mov dword [edi + 0x5d4], eax
call fcn.00401b40
jmp 0x4b8622
mov ecx, edi
call fcn.004b2c50
push ebp
push ebp
push ebp
push 0x5b9e
call fcn.0044ef40
add esp, 0x10
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
mov byte [esp + 0x3414], 2
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4b8dd1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x4b8dd1
test dword [esp + 0x20], eax
jne 0x4b866a
mov ecx, dword [esp + 0x18]
push ecx
call fcn.004b2c10
add esp, 4
test eax, eax
jne 0x4b8674
xor edx, edx
mov word [esp + 0xb0], dx
mov eax, dword [esp + 0x18]
push 0
push esi
push ebp
push eax
lea ecx, [esp + 0x24]
push ecx
call fcn.004b5120
mov esi, dword [esp + 0x38]
add esp, 0x14
cmp dword [esi - 0xc], 0
jle 0x4b86ad
push 0x20
lea ecx, [esp + 0x18]
call fcn.00405c40
mov eax, dword [esi - 0xc]
push eax
push esi
lea ecx, [esp + 0x1c]
call fcn.00401fb0
mov edx, dword [esp + 0x14]
mov esi, dword [edx - 0xc]
inc esi
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004ff95f
mov ecx, dword [esp + 0x18]
push ecx
push esi
push eax
mov dword [esp + 0x78], eax
call fcn.0053fe1c
xor esi, esi
xor ebp, ebp
xor edx, edx
xor eax, eax
xor ecx, ecx
add esp, 0x10
mov dword [esp + 0x6c], esi
mov dword [esp + 0x44], ebp
mov word [esp + 0x8e8], dx
mov word [esp + 0x4d8], ax
mov word [esp + 0xc8], cx
test ebx, ebx
je 0x4b89cd
lea edx, [esp + 0x4d8]
push edx
push 0x208
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [esp + 0xc8]
push eax
push ebp
lea ecx, [esp + 0x4e0]
push 0x582ff8
push ecx
call fcn.0044f000
mov ecx, dword [esp + 0x40]
add esp, 0x10
mov dword [esp + 0x1c], ebp
cmp ecx, ebp
je 0x4b8863
mov eax, dword [ecx + 0x2c0]
cmp eax, ebp
je 0x4b876c
mov ebx, dword [ecx + 0x2c4]
mov dword [esp + 0x18], eax
jmp 0x4b885c
mov edx, dword [esp + 0x38]
cmp edx, 0xffffffff
je 0x4b8779
cmp edx, ebp
jne 0x4b87b2
mov eax, dword [ecx + 0xf8]
cmp eax, 0xf4240
mov dword [edi + 0x5d0], eax
jle 0x4b8797
add eax, 0xfff0bdc0
mov dword [edi + 0x5d0], eax
cmp dword [edi + 0x5d0], 0xfde9
je 0x4b87b2
cmp edx, 0xffffffff
jne 0x4b87b2
mov dword [edi + 0x5d0], 1
mov edx, dword [ecx + 0xf4]
lea eax, [esp + 0x1c]
cmp dword [ecx + 0x100], ebp
je 0x4b87d3
push 1
push 1
push 0
push edx
push eax
call fcn.0047f200
jmp 0x4b87de
push 0
push 0
push edx
push eax
call fcn.0047f0d0
mov ebx, eax
mov eax, dword [edi + 0x5d0]
cmp eax, 0x4b0
jne 0x4b87f9
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x18], ecx
add ebx, ebx
jmp 0x4b885c
mov edx, dword [esp + 0x1c]
push 0
push 0
push 0
push 0
push ebx
push edx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
lea eax, [esi + 1]
push eax
call fcn.004ff95f
mov ecx, dword [esp + 0x20]
mov edx, dword [edi + 0x5d0]
add esp, 4
push 0
push 0
push esi
mov ebp, eax
push ebp
push ebx
push ecx
push 0
push edx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
mov byte [esi + ebp], 0
mov eax, dword [esp + 0x1c]
push eax
call fcn.004ff96a
add esp, 4
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], ebp
mov ebx, esi
cmp dword [esp + 0x18], 0
jne 0x4b8891
push 0xffffffffffffffff
push 0
push 0x53eb
call fcn.0050c4d3
lea ecx, [esp + 0x28]
call fcn.00401b40
lea ecx, [esp + 0x24]
call fcn.00401b40
lea ecx, [esp + 0x14]
call fcn.00401b40
jmp 0x4b8e48
push 0
push 0x80
push 2
lea ecx, [esp + 0x80]
push ecx
push 3
push 0xc0000000
lea edx, [esp + 0xe0]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [esp + 0x6c], esi
cmp esi, 0xffffffff
jne 0x4b88e4
push eax
push 0
push 0x53ef
call fcn.0050c4d3
mov eax, dword [esp + 0x1c]
push eax
call fcn.004ff96a
push ebp
call fcn.004ff96a
add esp, 8
jmp 0x4b8871
mov edx, dword [esp + 0x18]
push 0
lea ecx, [esp + 0xc8]
push ecx
push ebx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x1c]
push eax
call fcn.004ff96a
push ebp
call fcn.004ff96a
lea ecx, [esp + 0x8f0]
push ecx
push 0
lea edx, [esp + 0x4e8]
push 0x57e810
push edx
call fcn.0044f000
add esp, 0x18
push 0
push 0x80
push 2
lea eax, [esp + 0x80]
push eax
push 3
push 0xc0000000
lea ecx, [esp + 0x900]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
mov dword [esp + 0x44], ebp
cmp ebp, 0xffffffff
jne 0x4b8991
push eax
push 0
push 0x53ef
call fcn.0050c4d3
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0xc8]
push edx
call fcn.0044be30
add esp, 4
jmp 0x4b8871
mov eax, dword [esp + 0x20]
or dword [esp + 0xac], 0x100
and eax, 0x50
mov dword [esp + 0xb8], esi
mov dword [esp + 0xbc], ebp
cmp al, 0x50
jne 0x4b89be
mov dword [esp + 0xc0], ebp
jmp 0x4b89cd
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esp + 0xc0], eax
mov ecx, dword [esp + 0x3c]
push ecx
lea edx, [esp + 0x18]
push 0x54db
push edx
call fcn.00402140
mov ecx, dword [0x5ed0c0]
add esp, 0xc
push 0
lea eax, [esp + 0x18]
push eax
call fcn.00461620
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 0x58]
push ecx
mov ecx, dword [esp + 0x6c]
lea edx, [esp + 0x84]
push edx
push eax
push 0
push 0
push 1
push 0
push 0
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x4b8d87
cmp dword [esp + 0x40], 0
je 0x4b8d77
lea ecx, [esp + 0x37]
call fcn.00409ca0
mov edx, dword [esp + 0x58]
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x7530
push edx
mov byte [esp + 0x341c], 3
call ebx
mov esi, eax
cmp esi, 0x102
jne 0x4b8a8e
push 0xffffffffffffffff
push 5
push 0x53ea
call fcn.0050c4d3
cmp eax, 2
je 0x4b8a8e
mov eax, dword [esp + 0x58]
push 0x7530
push eax
call ebx
mov esi, eax
cmp esi, 0x102
je 0x4b8a65
test esi, esi
jne 0x4b8d58
push esi
mov esi, dword [esp + 0x48]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esp + 0x18], eax
test eax, eax
jle 0x4b8d4d
inc eax
push eax
mov dword [esp + 0x30], 0
call fcn.004ff95f
add esp, 4
push 0
push 0
push 0
push esi
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [esp + 0x18]
push 0
lea ecx, [esp + 0x3c]
push ecx
push edx
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, dword [esp + 0x30]
mov eax, dword [esp + 0x18]
mov byte [eax + ebp], 0
test esi, esi
je 0x4b8b1b
mov eax, dword [esi + 0x2c0]
test eax, eax
je 0x4b8b1b
push eax
call fcn.004ff96a
mov ecx, dword [esp + 0x1c]
add esp, 4
mov dword [esi + 0x2c0], ebp
mov dword [esi + 0x2c4], ecx
jmp 0x4b8d58
cmp byte [ebp], 0xff
jne 0x4b8b3a
cmp byte [ebp + 1], 0xfe
jne 0x4b8b3a
mov eax, dword [esp + 0x18]
cdq
sub eax, edx
sar eax, 1
dec eax
lea ebx, [ebp + 2]
mov dword [esp + 0x18], eax
jmp 0x4b8ba2
mov edx, dword [esp + 0x18]
push edx
push ebp
call fcn.0044c0a0
mov esi, eax
mov eax, dword [esp + 0x20]
xor ecx, ecx
inc eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004ff95f
add esp, 0xc
mov ebx, eax
mov eax, dword [esp + 0x18]
push eax
dec esi
push ebx
neg esi
push eax
sbb esi, esi
push ebp
and esi, 0xffff0218
push 0
add esi, 0xfde9
push esi
mov dword [esp + 0x44], ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor ecx, ecx
mov dword [esp + 0x18], eax
push ebp
mov word [ebx + eax*2], cx
call fcn.004ff96a
add esp, 4
xor ebp, ebp
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x40]
push eax
push ebx
call fcn.0046d8e0
add esp, 0xc
test eax, eax
je 0x4b8bd2
mov ecx, dword [esp + 0x2c]
mov ebx, dword [esp + 0x3c]
push ecx
call fcn.004ff96a
add esp, 4
mov dword [esp + 0x2c], 0
mov eax, dword [esp + 0x20]
mov edx, eax
and edx, 0x50
cmp dl, 0x50
jne 0x4b8c25
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x70]
push 1
push eax
push ecx
mov ecx, edi
call fcn.004b31b0
mov edx, dword [esp + 0x18]
mov ecx, dword [0x5ed0c0]
push edx
push ebx
add ecx, 0x5fc
call fcn.004b33a0
mov ecx, dword [0x5ed0c0]
push 0
push 1
lea eax, [ecx + 0x5fc]
push eax
call fcn.0050ea2e
jmp 0x4b8cab
and eax, 0x12
cmp al, 0x12
jne 0x4b8c4a
mov ecx, dword [esp + 0x18]
mov edx, dword [0x5ed0c0]
mov eax, dword [edx + 0x20]
push 0
push 0
push ecx
push ebx
push eax
call fcn.004874a0
add esp, 0x14
jmp 0x4b8cab
mov edi, dword [esp + 0x30]
mov ecx, edi
call fcn.0046d760
mov esi, eax
test esi, esi
je 0x4b8cab
push 0x57f03c
mov ecx, esi
call fcn.0050b51f
test eax, eax
je 0x4b8cab
mov ecx, dword [esp + 0x20]
and ecx, 0x30
push 0
cmp cl, 0x30
jne 0x4b8cc3
push 0
mov ecx, esi
call fcn.00495430
mov edx, dword [esi + 0x8c]
mov eax, dword [esp + 0x18]
mov ecx, dword [esi + 0x70]
push edx
mov edx, dword [esi + 0x74]
push eax
push ebx
push ecx
push edx
mov ecx, edi
call fcn.0047d880
push 0
push 0
push 1
mov ecx, esi
call fcn.00495900
mov edx, dword [esp + 0x2c]
push edx
call fcn.004ff96a
push ebp
call fcn.004ff96a
add esp, 8
jmp 0x4b8d58
mov eax, dword [edi + 0x100]
test eax, eax
je 0x4b8ce9
mov edx, dword [esp + 0x1c]
xor ecx, ecx
cmp eax, 2
sete cl
push 1
push 1
push ecx
push edx
push ebx
mov ecx, esi
call fcn.0049b590
jmp 0x4b8cab
mov eax, dword [edi + 0x2e8]
mov edx, dword [edi + 0x334]
dec eax
lea ecx, [eax + eax*8]
mov ecx, dword [edx + ecx*4]
mov edx, dword [esi + 0x8c]
push edx
mov edx, dword [esp + 0x20]
push edx
push ebx
push eax
dec ecx
push ecx
push 0
push 0
mov ecx, edi
call fcn.00480ee0
mov eax, dword [esp + 0x20]
and eax, 0x90
cmp al, 0x90
jne 0x4b8c9e
push 0
push 0
push 0
mov ecx, esi
call fcn.00495900
mov eax, dword [esi + 0x70]
mov ecx, dword [esi + 0x74]
push 0
push 0
push eax
push ecx
mov ecx, esi
call fcn.00494920
jmp 0x4b8cab
mov ecx, dword [0x5ba378]
call fcn.00411c70
lea ecx, [esp + 0x37]
mov byte [esp + 0x3414], 2
call fcn.0040adf0
mov esi, dword [esp + 0x6c]
mov ebp, dword [esp + 0x44]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x58]
push eax
call ebx
mov ecx, dword [esp + 0x5c]
push ecx
call ebx
jmp 0x4b8d9a
push 0
push 0
push 0
push 0x5b9e
call fcn.0044ef40
add esp, 0x10
mov edx, dword [esp + 0x68]
push edx
call fcn.004ff96a
add esp, 4
cmp dword [esp + 0x40], 0
je 0x4b8dd1
push esi
call ebx
push ebp
call ebx
lea eax, [esp + 0xc8]
push eax
call fcn.0044be30
lea ecx, [esp + 0x8ec]
push ecx
call fcn.0044be30
add esp, 8
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
mov byte [esp + 0x3414], 1
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4b8df9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov byte [esp + 0x3414], 0
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4b8e21
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov dword [esp + 0x3414], edx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4b8e48
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x340c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x33f4]
xor ecx, esp
call fcn.0053f73f
add esp, 0x3404
ret 0x10