Function at 0x4a4210
Capabilities:
Accept command line arguments
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x5e8
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_SetFileApisToOEM]
test rbx, rbx
mov qword [rsp + 0x100], 0
mov dword [rsp + 0x108], 0
mov dword [rsp + 0x10c], 0
je 0x4a580a
lea rsi, [rsp + 0x110]
mov rdx, rbx
mov rcx, rsi
call fcn.00477fd0
lea rax, [rsp + 0x100]
mov rcx, rsi
mov rdx, rax
mov qword [rsp + 0x90], rax
call fcn.004a7da0
mov rcx, qword [rsp + 0x110]
test rcx, rcx
je 0x4a4297
call fcn.007da030
mov eax, dword [rsp + 0x108]
cmp eax, 1
je 0x4a5005
mov rcx, qword [rsp + 0x100]
mov rbx, qword [rcx]
test rbx, rbx
je 0x4a42e0
mov rcx, qword [rbx]
test rcx, rcx
je 0x4a42c4
call fcn.007da030
mov rcx, rbx
mov edx, 0x10
call fcn.007da070
mov rcx, qword [rsp + 0x100]
mov eax, dword [rsp + 0x108]
lea r8d, [rax - 1]
lea rdx, [rcx + 8]
shl r8, 3
call sub.msvcrt.dll_memmove
lea rax, [rsp + 0x340]
mov byte [rsp + 0x341], 0
lea rcx, [rax + 0x38]
mov byte [rsp + 0x342], 0
mov rdi, rax
sub dword [rsp + 0x108], 1
mov byte [rsp + 0x343], 0
mov byte [rsp + 0x347], 0
mov byte [rsp + 0x348], 0
mov qword [rsp + 0x350], 0
mov dword [rsp + 0x358], 0
mov dword [rsp + 0x35c], 0
mov qword [rsp + 0x360], 0
mov dword [rsp + 0x368], 0
mov dword [rsp + 0x36c], 0
mov qword [rsp + 0x70], rax
call fcn.00477f50
lea rcx, [rdi + 0x88]
mov qword [rsp + 0x390], 0
mov dword [rsp + 0x398], 0
mov dword [rsp + 0x39c], 0
mov qword [rsp + 0x3a8], 0
mov dword [rsp + 0x3b0], 0
mov dword [rsp + 0x3b4], 0
mov qword [rsp + 0x3b8], 0
mov dword [rsp + 0x3c0], 0
mov dword [rsp + 0x3c4], 0
call fcn.00477f50
lea rcx, [rdi + 0xb8]
mov qword [rsp + 0x3d8], 0
mov dword [rsp + 0x3e0], 0
mov dword [rsp + 0x3e4], 0
mov byte [rsp + 0x3e8], 0
mov byte [rsp + 0x3e9], 0
mov byte [rsp + 0x3ea], 0
mov byte [rsp + 0x3eb], 0
mov dword [rsp + 0x3ec], 0
mov dword [rsp + 0x3f0], 0
call fcn.00477f50
lea rcx, [rdi + 0x130]
mov byte [rsp + 0x408], 0
mov byte [rsp + 0x409], 0
mov byte [rsp + 0x40b], 0
mov byte [rsp + 0x40d], 0
mov byte [rsp + 0x40f], 0
mov byte [rsp + 0x410], 0
mov byte [rsp + 0x411], 0
mov byte [rsp + 0x40a], 1
mov byte [rsp + 0x40c], 1
mov byte [rsp + 0x40e], 1
mov byte [rsp + 0x418], 0
mov byte [rsp + 0x419], 0
mov byte [rsp + 0x41a], 0
mov byte [rsp + 0x41b], 0
mov byte [rsp + 0x41c], 0
mov byte [rsp + 0x41d], 0
mov byte [rsp + 0x41e], 0
mov byte [rsp + 0x41f], 0
mov byte [rsp + 0x420], 0
mov dword [rsp + 0x428], 0xffffffff
mov byte [rsp + 0x430], 0
mov byte [rsp + 0x431], 0
mov byte [rsp + 0x432], 0
mov byte [rsp + 0x433], 0
mov byte [rsp + 0x434], 0
mov byte [rsp + 0x438], 1
mov byte [rsp + 0x439], 1
mov byte [rsp + 0x43a], 0
mov byte [rsp + 0x43b], 0
mov byte [rsp + 0x43c], 0
mov byte [rsp + 0x43d], 0
mov qword [rsp + 0x440], 0
mov byte [rsp + 0x42c], 1
mov byte [rsp + 0x42d], 1
mov byte [rsp + 0x42e], 1
mov byte [rsp + 0x42f], 1
mov byte [rsp + 0x436], 1
mov byte [rsp + 0x437], 1
mov byte [rsp + 0x435], 1
mov qword [rsp + 0x448], 0
mov dword [rsp + 0x450], 0
mov dword [rsp + 0x454], 0
mov qword [rsp + 0x458], 0
mov dword [rsp + 0x460], 0
mov dword [rsp + 0x464], 0
mov byte [rsp + 0x468], 1
call fcn.00477f50
lea rcx, [rdi + 0x140]
call fcn.00477f50
lea rcx, [rdi + 0x150]
call fcn.00477f50
lea rcx, [rdi + 0x160]
call fcn.00477f50
lea rcx, [rdi + 0x170]
call fcn.00477f50
lea rcx, [rdi + 0x188]
mov byte [rsp + 0x4c0], 0
call fcn.00477f50
lea rcx, [rdi + 0x198]
call fcn.00477f50
mov rdi, qword [rsp + 0x70]
mov byte [rsp + 0x4ec], 0
mov dword [rsp + 0x4e8], 0
lea rcx, [rdi + 0x1b0]
call fcn.00477f50
lea rcx, [rdi + 0x1c8]
mov byte [rsp + 0x500], 0
mov byte [rsp + 0x501], 0
call fcn.00477f50
lea rcx, [rdi + 0x1e0]
mov byte [rsp + 0x518], 0
mov byte [rsp + 0x519], 0
mov byte [rsp + 0x51a], 0
call fcn.00477f50
lea rcx, [rdi + 0x1f0]
call fcn.00477f50
lea rcx, [rdi + 0x208]
mov dword [rsp + 0x540], 0
call fcn.00477f50
lea rcx, [rdi + 0x260]
mov byte [rsp + 0x558], 0
mov byte [rsp + 0x559], 0
mov byte [rsp + 0x55a], 0
mov byte [rsp + 0x55b], 0
mov byte [rsp + 0x55c], 0
mov byte [rsp + 0x55d], 0
mov byte [rsp + 0x55e], 0
mov byte [rsp + 0x55f], 0
mov byte [rsp + 0x560], 0
mov byte [rsp + 0x561], 0
mov qword [rsp + 0x568], 0
mov dword [rsp + 0x570], 0
mov dword [rsp + 0x574], 0
mov qword [rsp + 0x578], 0
mov dword [rsp + 0x580], 0
mov dword [rsp + 0x584], 0
mov qword [rsp + 0x588], 0
mov dword [rsp + 0x590], 0
mov dword [rsp + 0x594], 0
mov byte [rsp + 0x598], 0
mov byte [rsp + 0x599], 0
mov byte [rsp + 0x59a], 0
mov dword [rsp + 0x59c], 0
call fcn.00477f50
lea rax, [rsp + 0x1d0]
mov qword [rsp + 0x5b0], 0
mov rcx, rax
mov dword [rsp + 0x5b8], 0
mov dword [rsp + 0x5bc], 0
mov dword [rsp + 0x5c0], 1
mov dword [rsp + 0x5c4], 2
mov dword [rsp + 0x5c8], 1
mov dword [rsp + 0x5cc], 0
mov qword [rsp + 0x88], rax
call fcn.00490000
mov r8, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x88]
call fcn.00490010
mov eax, dword [rsp + 0x5c0]
cmp eax, 1
je 0x4a484d
mov rdx, qword [0x00828ba0]
cmp eax, 2
mov eax, 0
cmove rax, qword [0x00828b70]
mov qword [rdx], rax
mov eax, dword [rsp + 0x5c4]
cmp eax, 2
je 0x4a4873
mov rdx, qword [0x00828b30]
cmp eax, 1
mov eax, 0
cmove rax, qword [0x00828b90]
mov qword [rdx], rax
mov qword [rsp + 0x68], 0
mov eax, dword [rsp + 0x5c8]
test eax, eax
je 0x4a489e
cmp eax, 2
mov rax, qword [0x00828b70]
cmovne rax, qword [0x00828b90]
mov qword [rsp + 0x68], rax
movzx eax, byte [rsp + 0x340]
test al, al
mov byte [rsp + 0x9b], al
jne 0x4a4b25
lea rcx, str.SeRestorePrivilege
mov edx, 1
call fcn.004b3a60
lea rcx, str.SeCreateSymbolicLinkPrivilege
mov edx, 1
call fcn.004b3a60
cmp byte [rsp + 0x349], 0
jne 0x4a57d8
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x88]
call fcn.004916d0
mov r9d, dword [rsp + 0x5cc]
mov dword [rsp + 0x9c], 2
test r9d, r9d
je 0x4a492d
mov eax, dword [rsp + 0x5c0]
cmp dword [rsp + 0x5c8], eax
setne al
movzx eax, al
add eax, 1
mov dword [rsp + 0x9c], eax
cmp qword [rsp + 0x68], 0
je 0x4a66e6
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rsi, [rsp + 0x250]
mov rcx, rax
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
mov eax, 0x50
cmovne ax, word [rsp + 0x250]
cwde
mov dword [rsp + 0x84], eax
mov ecx, 0x28
call fcn.007da0a0
lea rdi, [0x00842020]
mov rcx, rax
mov qword [rax + 0x10], 0
mov qword [rax], rdi
mov dword [rax + 0x18], 0
mov dword [rax + 0x1c], 0
mov dword [rax + 8], 1
mov qword [rsp + 0x60], rax
movzx eax, byte [rsp + 0x342]
mov byte [rcx + 0x20], al
movzx eax, byte [rsp + 0x343]
mov byte [rcx + 0x21], al
call fcn.00474b10
test eax, eax
mov dword [rsp + 0x80], eax
jne 0x4a6c52
mov rdi, qword [rsp + 0x70]
lea rcx, [rdi + 0x30]
call fcn.0048ff40
mov r14d, eax
mov rax, qword [rsp + 0x60]
mov r8d, dword [rax + 0x18]
test r8d, r8d
jne 0x4a4a1a
test r14b, r14b
jne 0x4a4bf6
cmp dword [rsp + 0x370], 6
je 0x4a4bf6
lea rcx, [rdi + 0x30]
call fcn.0048ff70
test al, al
jne 0x4a4bf6
mov rdi, qword [rsp + 0x70]
lea rax, [rsp + 0x120]
mov qword [rsp + 0x120], 0
mov rcx, qword [rsp + 0x60]
mov r8, rax
mov dword [rsp + 0x128], 0
mov dword [rsp + 0x12c], 0
mov qword [rsp + 0xa8], rax
lea rdx, [rdi + 0x260]
call fcn.0049c660
test al, al
je 0x4a6708
mov ecx, dword [rsp + 0x5b8]
xor ebp, ebp
mov qword [rsp + 0x130], 0
mov dword [rsp + 0x138], 0
lea rsi, [rsp + 0x250]
mov dword [rsp + 0x13c], 0
test ecx, ecx
je 0x4a4cde
nop dword [rax + rax]
mov rdx, qword [rsp + 0x5b0]
mov eax, ebp
mov r8, rsi
mov qword [rsp + 0x250], 0
mov dword [rsp + 0x258], 0
mov rcx, qword [rsp + 0x60]
mov dword [rsp + 0x25c], 0
mov rdx, qword [rdx + rax*8]
call fcn.00474630
test al, al
je 0x4a4aff
cmp dword [rsp + 0x258], 1
je 0x4a4c20
lea rdi, str.Unsupported_archive_type
mov ecx, 8
call fcn.007da1c0
mov rdx, qword [0x00827cf0]
xor r8d, r8d
mov qword [rax], rdi
mov rcx, rax
call fcn.007da930
mov rax, qword [0x00828ba0]
mov rbx, qword [rax]
test rbx, rbx
je 0x4a4b68
mov r9, qword [rbx]
mov r8d, 0x42
mov edx, 1
lea rcx, str._n7_Zip__r___64__16.02_:_Igor_Pavlov_:_Public_domain_:_2016_05_21_n_n
call sub.msvcrt.dll_fwrite
mov r9, qword [rbx]
mov r8d, 0x9a3
mov edx, 1
lea rcx, str.Usage:_7zr__command____switches_...___archive_name____file_names_...__n__________listfiles...___n_n_Commands__n__a_:_Add_files_to_archive_n__b_:_Benchmark_n__d_:_Delete_files_from_archive_n__e_:_Extract_files_from_archive__without_using_directory_names__n__h_:_Calculate_hash_values_for_files_n__i_:_Show_information_about_supported_formats_n__l_:_List_contents_of_archive_n__rn_:_Rename_files_in_archive_n__t_:_Test_integrity_of_archive_n__u_:_Update_files_to_archive_n__x_:_eXtract_files_with_full_paths_n_n_Switches__n_____:_Stop_switches_parsing_n___ai_r__0___listfile_wildcard_:_Include_archives_n___ax_r__0___listfile_wildcard_:_eXclude_archives_n___aoastu_:_set_Overwrite_mode_n___an_:_disable_archive_name_field_n___bb_0_3__:_set_output_log_level_n___bd_:_disable_progress_indicator_n___bsoep012_:_set_output_stream_for_output_error_progress_line_n___bt_:_show_execution_time_statistics_n___i_r__0___listfile_wildcard_:_Include_filenames_n___mParameters_:_set_compression_Method_n_____mmt_N__:_set_number_of_CPU_threads_n___oDirectory_:_set_Output_directory_n___r__0__:_Recurse_subdirectories_n___saaes_:_set_Archive_name_mode_n___sccUTF_8WINDOS_:_set_charset_for_for_console_input_output_n___scsUTF_8UTF_16LEUTF_16BEWINDOSid_:_set_charset_for_list_files_n___scrc_CRC32CRC64SHA1SHA256__:_set_hash_function_for_x__e__h_commands_n___sdel_:_delete_files_after_compression_n___seml_.__:_send_archive_by_email_n___sfx_name__:_Create_SFX_archive_n___si_name__:_read_data_from_stdin_n___slp_:_set_Large_Pages_mode_n___slt_:_show_technical_information_for_l__List__command_n___snh_:_store_hard_links_as_links_n___snl_:_store_symbolic_links_as_links_n___sni_:_store_NT_security_information_n___sns____:_store_NTFS_alternate_streams_n___so_:_write_data_to_stdout_n___spd_:_disable_wildcard_matching_for_file_names_n___spe_:_eliminate_duplication_of_root_folder_for_extract_command_n___spf_:_use_fully_qualified_file_paths_n___ssc____:_set_sensitive_case_mode_n___ssw_:_compress_shared_files_n___stl_:_set_archive_timestamp_from_the_most_recently_modified_file_n___stmHexMask_:_set_CPU_thread_affinity_mask__hexadecimal_number__n___stxType_:_exclude_archive_type_n___tType_:_Set_type_of_archive_n___u____p__q__r__x__y__z___newArchiveName__:_Update_options_n___vSize_bkmg__:_Create_volumes_n___w_path__:_assign_Work_directory._Empty_path_means_a_temporary_directory_n___x_r__0___listfile_wildcard_:_eXclude_filenames_n___y_:_assume_Yes_on_all_queries_n
call sub.msvcrt.dll_fwrite
xor r12d, r12d
mov rcx, qword [rsp + 0x88]
call fcn.004a81e0
mov rcx, qword [rsp + 0x70]
call fcn.006b3f80
mov eax, dword [rsp + 0x108]
test eax, eax
je 0x4a5053
mov rcx, qword [rsp + 0x100]
lea ebx, [rax - 1]
shl rbx, 3
mov rsi, qword [rcx + rbx]
test rsi, rsi
je 0x4a4bcb
mov rcx, qword [rsi]
test rcx, rcx
je 0x4a4bb6
call fcn.007da030
mov rcx, rsi
mov edx, 0x10
call fcn.007da070
mov rcx, qword [rsp + 0x100]
sub rbx, 8
cmp rbx, 0xfffffffffffffff8
jne 0x4a4ba0
test rcx, rcx
je 0x4a4bdf
call fcn.007da030
mov eax, r12d
add rsp, 0x5e8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rdi, str.7_Zip_cannot_find_the_code_that_works_with_archives.
mov ecx, 8
call fcn.007da1c0
mov rdx, qword [0x00827cf0]
xor r8d, r8d
mov qword [rax], rdi
mov rcx, rax
call fcn.007da930
nop dword [rax]
mov rcx, qword [rsp + 0x250]
xor ebx, ebx
mov r8d, dword [rsp + 0x138]
mov r13, qword [rsp + 0x130]
mov edi, dword [rcx]
mov r9d, r8d
cmp ebx, r9d
je 0x4a4c7f
lea edx, [rbx + r9]
shr edx, 1
mov eax, edx
cmp edi, dword [r13 + rax*4]
je 0x4a4f80
jl 0x4a4c7b
jmp 0x4a4f8a
lea eax, [rbx + rdx]
shr eax, 1
mov r9d, eax
cmp edi, dword [r13 + r9*4]
je 0x4a4f80
jge 0x4a4f90
mov edx, eax
cmp ebx, edx
jne 0x4a4c60
cmp r8d, dword [rsp + 0x13c]
je 0x4a4f9b
lea eax, [rbx + 1]
mov r12d, ebx
sub r8d, ebx
lea rcx, [r13 + rax*4]
shl r8, 2
lea rdx, [r13 + r12*4]
call sub.msvcrt.dll_memmove
mov rax, qword [rsp + 0x130]
mov rcx, qword [rsp + 0x250]
mov dword [rax + r12*4], edi
add dword [rsp + 0x138], 1
test rcx, rcx
jne 0x4a4f80
add ebp, 1
cmp ebp, dword [rsp + 0x5b8]
jb 0x4a4ab0
mov eax, dword [rsp + 0x370]
cmp eax, 8
je 0x4a5118
cmp eax, 6
je 0x4a4cfc
test r14b, r14b
je 0x4a6e08
cmp byte [rsp + 0x347], 0
mov qword [rsp + 0x160], 0
mov dword [rsp + 0x168], 0
mov dword [rsp + 0x16c], 0
mov qword [rsp + 0x170], 0
mov dword [rsp + 0x178], 0
mov dword [rsp + 0x17c], 0
je 0x4a5818
mov ecx, 0x10
call fcn.007da0a0
mov rbx, rax
mov rax, qword [rsp + 0x70]
mov rcx, rbx
lea rdx, [rax + 0x88]
call fcn.00478040
mov eax, dword [rsp + 0x168]
cmp eax, dword [rsp + 0x16c]
je 0x4a6c68
mov rdi, qword [rsp + 0x160]
mov edx, eax
mov ecx, 0x10
add eax, 1
mov qword [rdi + rdx*8], rbx
mov dword [rsp + 0x168], eax
call fcn.007da0a0
mov rbx, rax
mov rax, qword [rsp + 0x70]
mov rcx, rbx
lea rdx, [rax + 0x88]
call fcn.00478040
mov eax, dword [rsp + 0x178]
cmp eax, dword [rsp + 0x17c]
je 0x4a6bdd
mov rdi, qword [rsp + 0x170]
mov edx, eax
xor r12d, r12d
add eax, 1
test r14b, r14b
mov qword [rdi + rdx*8], rbx
mov dword [rsp + 0x178], eax
jne 0x4a5a5f
mov eax, dword [rsp + 0x178]
mov rcx, qword [rsp + 0x170]
test eax, eax
je 0x4a4e43
lea ebx, [rax - 1]
shl rbx, 3
mov rsi, qword [rcx + rbx]
test rsi, rsi
je 0x4a4e39
mov rcx, qword [rsi]
test rcx, rcx
je 0x4a4e24
call fcn.007da030
mov rcx, rsi
mov edx, 0x10
call fcn.007da070
mov rcx, qword [rsp + 0x170]
sub rbx, 8
cmp rbx, 0xfffffffffffffff8
jne 0x4a4e0e
test rcx, rcx
je 0x4a4e4d
call fcn.007da030
mov eax, dword [rsp + 0x168]
mov rcx, qword [rsp + 0x160]
test eax, eax
je 0x4a4e9c
lea ebx, [rax - 1]
shl rbx, 3
mov rsi, qword [rcx + rbx]
test rsi, rsi
je 0x4a4e92
mov rcx, qword [rsi]
test rcx, rcx
je 0x4a4e7d
call fcn.007da030
mov rcx, rsi
mov edx, 0x10
call fcn.007da070
mov rcx, qword [rsp + 0x160]
sub rbx, 8
cmp rbx, 0xfffffffffffffff8
jne 0x4a4e67
test rcx, rcx
je 0x4a4ea6
call fcn.007da030
cmp byte [rsp + 0x389], 0
je 0x4a4f01
mov rax, qword [0x00828ba0]
cmp qword [rax], 0
mov qword [rsp + 0x78], rax
je 0x4a4f01
mov rbp, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rbp
lea rcx, [rsp + 0xe0]
mov qword [rsp + 0x20], rcx
lea rdx, [rsp + 0xb0]
mov rcx, rax
lea r9, [rsp + 0xd0]
lea r8, [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
test eax, eax
jne 0x4a6603
mov eax, dword [rsp + 0x80]
test eax, eax
jne 0x4a6bc4
mov rcx, qword [rsp + 0x130]
test rcx, rcx
je 0x4a4f22
call fcn.007da030
mov eax, dword [rsp + 0x128]
test eax, eax
je 0x4a4f54
lea ebx, [rax - 1]
shl rbx, 3
mov rax, qword [rsp + 0x120]
mov edx, 0x20
mov rcx, qword [rax + rbx]
sub rbx, 8
call fcn.007da070
cmp rbx, 0xfffffffffffffff8
jne 0x4a4f34
mov rcx, qword [rsp + 0x120]
test rcx, rcx
je 0x4a4f66
call fcn.007da030
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x4a4b6b
call fcn.007da030
jmp 0x4a4cce
mov eax, edx
mov edx, r9d
nop
lea ebx, [rax + 1]
mov r9d, edx
jmp 0x4a4c3f
mov eax, r8d
shr eax, 2
lea ecx, [r8 + rax + 1]
mov r12, rcx
shl rcx, 2
call fcn.007da080
mov r8d, dword [rsp + 0x138]
mov r13, rax
mov r15, qword [rsp + 0x130]
test r8d, r8d
jne 0x4a4ff4
test r15, r15
je 0x4a4fdf
mov rcx, r15
call fcn.007da030
mov r8d, dword [rsp + 0x138]
mov qword [rsp + 0x130], r13
mov dword [rsp + 0x13c], r12d
jmp 0x4a4c8d
shl r8, 2
mov rdx, r15
mov rcx, rax
call sub.msvcrt.dll_memcpy
jmp 0x4a4fcf
mov rdx, qword [0x00828ba0]
mov rbx, qword [rdx]
test rbx, rbx
je 0x4a5110
mov r9, qword [rbx]
mov r8d, 0x42
mov edx, 1
lea rcx, str._n7_Zip__r___64__16.02_:_Igor_Pavlov_:_Public_domain_:_2016_05_21_n_n
call sub.msvcrt.dll_fwrite
lea rdx, str.Usage:_7zr__command____switches_...___archive_name____file_names_...__n__________listfiles...___n_n_Commands__n__a_:_Add_files_to_archive_n__b_:_Benchmark_n__d_:_Delete_files_from_archive_n__e_:_Extract_files_from_archive__without_using_directory_names__n__h_:_Calculate_hash_values_for_files_n__i_:_Show_information_about_supported_formats_n__l_:_List_contents_of_archive_n__rn_:_Rename_files_in_archive_n__t_:_Test_integrity_of_archive_n__u_:_Update_files_to_archive_n__x_:_eXtract_files_with_full_paths_n_n_Switches__n_____:_Stop_switches_parsing_n___ai_r__0___listfile_wildcard_:_Include_archives_n___ax_r__0___listfile_wildcard_:_eXclude_archives_n___aoastu_:_set_Overwrite_mode_n___an_:_disable_archive_name_field_n___bb_0_3__:_set_output_log_level_n___bd_:_disable_progress_indicator_n___bsoep012_:_set_output_stream_for_output_error_progress_line_n___bt_:_show_execution_time_statistics_n___i_r__0___listfile_wildcard_:_Include_filenames_n___mParameters_:_set_compression_Method_n_____mmt_N__:_set_number_of_CPU_threads_n___oDirectory_:_set_Output_directory_n___r__0__:_Recurse_subdirectories_n___saaes_:_set_Archive_name_mode_n___sccUTF_8WINDOS_:_set_charset_for_for_console_input_output_n___scsUTF_8UTF_16LEUTF_16BEWINDOSid_:_set_charset_for_list_files_n___scrc_CRC32CRC64SHA1SHA256__:_set_hash_function_for_x__e__h_commands_n___sdel_:_delete_files_after_compression_n___seml_.__:_send_archive_by_email_n___sfx_name__:_Create_SFX_archive_n___si_name__:_read_data_from_stdin_n___slp_:_set_Large_Pages_mode_n___slt_:_show_technical_information_for_l__List__command_n___snh_:_store_hard_links_as_links_n___snl_:_store_symbolic_links_as_links_n___sni_:_store_NT_security_information_n___sns____:_store_NTFS_alternate_streams_n___so_:_write_data_to_stdout_n___spd_:_disable_wildcard_matching_for_file_names_n___spe_:_eliminate_duplication_of_root_folder_for_extract_command_n___spf_:_use_fully_qualified_file_paths_n___ssc____:_set_sensitive_case_mode_n___ssw_:_compress_shared_files_n___stl_:_set_archive_timestamp_from_the_most_recently_modified_file_n___stmHexMask_:_set_CPU_thread_affinity_mask__hexadecimal_number__n___stxType_:_exclude_archive_type_n___tType_:_Set_type_of_archive_n___u____p__q__r__x__y__z___newArchiveName__:_Update_options_n___vSize_bkmg__:_Create_volumes_n___w_path__:_assign_Work_directory._Empty_path_means_a_temporary_directory_n___x_r__0___listfile_wildcard_:_eXclude_filenames_n___y_:_assume_Yes_on_all_queries_n
mov rcx, rbx
xor r12d, r12d
call fcn.006b19a0
mov eax, dword [rsp + 0x108]
test eax, eax
jne 0x4a4b91
mov rcx, qword [rsp + 0x100]
jmp 0x4a4bd5
mov rcx, qword [rsp + 0x130]
test rcx, rcx
je 0x4a5087
call fcn.007da030
mov eax, dword [rsp + 0x128]
lea esi, [rax - 1]
shl rsi, 3
test eax, eax
je 0x4a50b9
mov rax, qword [rsp + 0x120]
mov edx, 0x20
mov rcx, qword [rax + rsi]
sub rsi, 8
call fcn.007da070
cmp rsi, 0xfffffffffffffff8
jne 0x4a5099
mov rcx, qword [rsp + 0x120]
test rcx, rcx
je 0x4a50d0
call fcn.007da030
jmp 0x4a50d0
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x88]
call fcn.004a81e0
mov rcx, qword [rsp + 0x70]
call fcn.006b3f80
mov rcx, qword [rsp + 0x90]
call fcn.006b09c0
mov rcx, rbx
call fcn.0067d310
nop word [rax + rax]
xor r12d, r12d
jmp 0x4a4b91
mov rax, qword [0x00828ba0]
mov rdi, qword [rax]
mov qword [rsp + 0x78], rax
test rdi, rdi
cmove rdi, qword [0x00828b90]
mov rcx, rdi
call fcn.00479d10
mov r9, qword [rdi]
mov r8d, 8
mov edx, 1
lea rcx, str.Formats:
call sub.msvcrt.dll_fwrite
mov rcx, rdi
call fcn.00479d10
mov rax, qword [rsp + 0x60]
mov edx, dword [rax + 0x18]
test edx, edx
je 0x4a5475
mov dword [rsp + 0x68], 0
lea r15, str.KSNFMGOPBELH
mov rsi, rax
lea r13, [rsp + 0x250]
nop word cs:[rax + rax]
mov rdx, qword [rsi + 0x10]
mov r8d, 2
mov eax, dword [rsp + 0x68]
lea rcx, [0x008110ce]
mov r9, qword [rdi]
mov r12, qword [rdx + rax*8]
mov edx, 1
call sub.msvcrt.dll_fwrite
cmp byte [r12 + 0x40], 1
mov rdx, qword [rdi]
sbb ecx, ecx
and ecx, 0xffffffdd
add ecx, 0x43
call sub.msvcrt.dll_fputc
xor ebx, ebx
nop
mov eax, dword [r12]
mov ecx, 0x20
bt eax, ebx
jae 0x4a51e3
movzx ecx, byte [r15 + rbx]
mov rdx, qword [rdi]
call sub.msvcrt.dll_fputc
add rbx, 1
cmp rbx, 0xc
jne 0x4a51d0
mov rdx, qword [rdi]
mov ecx, 0x20
call sub.msvcrt.dll_fputc
mov rdx, qword [r12 + 0x18]
mov rcx, rdi
mov ebx, dword [r12 + 0x20]
call fcn.00479d50
cmp ebx, 7
ja 0x4a5235
nop dword [rax]
mov rdx, qword [rdi]
mov ecx, 0x20
call sub.msvcrt.dll_fputc
add ebx, 1
cmp ebx, 8
jne 0x4a5220
mov rdx, qword [rdi]
mov ecx, 0x20
call sub.msvcrt.dll_fputc
mov rcx, r13
call fcn.00477f50
mov eax, dword [r12 + 0x30]
test eax, eax
je 0x4a52ef
lea rbp, [0x008110d2]
xor ebx, ebx
mov rdx, qword [r12 + 0x28]
mov eax, ebx
mov rcx, r13
mov rsi, qword [rdx + rax*8]
mov rdx, rsi
call fcn.00478550
mov eax, dword [rsi + 0x18]
test eax, eax
jne 0x4a5295
add ebx, 1
cmp dword [r12 + 0x30], ebx
jbe 0x4a52ef
test ebx, ebx
je 0x4a5260
mov rcx, r13
call fcn.00478270
jmp 0x4a5260
mov rdx, rbp
mov rcx, r13
call fcn.00478460
lea rdx, [rsi + 0x10]
mov rcx, r13
call fcn.00478550
mov eax, dword [rsp + 0x258]
cmp dword [rsp + 0x25c], eax
je 0x4a5430
mov rcx, qword [rsp + 0x250]
lea edx, [rax + 1]
mov esi, 0x29
xor r14d, r14d
add ebx, 1
mov word [rcx + rax*2], si
mov eax, edx
mov word [rcx + rax*2], r14w
mov dword [rsp + 0x258], edx
cmp dword [r12 + 0x30], ebx
ja 0x4a5287
mov rdx, qword [rsp + 0x250]
mov rcx, rdi
mov ebx, dword [rsp + 0x258]
call fcn.00479d50
cmp ebx, 0xc
ja 0x4a5325
nop dword [rax + rax]
mov rdx, qword [rdi]
mov ecx, 0x20
call sub.msvcrt.dll_fputc
add ebx, 1
cmp ebx, 0xd
jne 0x4a5310
mov rdx, qword [rdi]
mov ecx, 0x20
call sub.msvcrt.dll_fputc
mov ebx, dword [r12 + 0x44]
test ebx, ebx
jne 0x4a5790
mov r11d, dword [r12 + 0x50]
test r11d, r11d
je 0x4a5444
xor r14d, r14d
mov rdx, qword [r12 + 0x48]
mov eax, r14d
mov rbp, qword [rdx + rax*8]
cmp qword [rbp + 8], 0
je 0x4a53f4
xor esi, esi
nop dword [rax]
mov rax, qword [rbp]
movzx ebx, byte [rax + rsi]
lea eax, [rbx - 0x21]
cmp al, 0x5e
jbe 0x4a53df
mov eax, ebx
shr al, 4
lea edx, [rax + 0x30]
cmp al, 9
lea ecx, [rax + 0x37]
cmovbe ecx, edx
mov rdx, qword [rdi]
movsx ecx, cl
call sub.msvcrt.dll_fputc
and ebx, 0xf
mov rdx, qword [rdi]
lea eax, [rbx + 0x37]
cmp bl, 0xa
lea ecx, [rbx + 0x30]
cmovae ecx, eax
movsx ecx, cl
call sub.msvcrt.dll_fputc
add rsi, 1
cmp rsi, qword [rbp + 8]
jae 0x4a53f4
test rsi, rsi
je 0x4a5370
mov rdx, qword [rdi]
mov ecx, 0x20
call sub.msvcrt.dll_fputc
mov rax, qword [rbp]
movzx ebx, byte [rax + rsi]
lea eax, [rbx - 0x21]
cmp al, 0x5e
ja 0x4a537f
mov rdx, qword [rdi]
movzx ecx, bl
call sub.msvcrt.dll_fputc
add rsi, 1
cmp rsi, qword [rbp + 8]
jb 0x4a53be
add r14d, 1
cmp r14d, dword [r12 + 0x50]
jae 0x4a5444
test r14d, r14d
je 0x4a5350
mov r9, qword [rdi]
mov r8d, 6
mov edx, 1
lea rcx, [0x008110e0]
call sub.msvcrt.dll_fwrite
jmp 0x4a5350
mov rcx, r13
call fcn.00477b00
mov eax, dword [rsp + 0x258]
jmp 0x4a52c0
mov rcx, rdi
call fcn.00479d10
mov rcx, qword [rsp + 0x250]
test rcx, rcx
je 0x4a545e
call fcn.007da030
mov rsi, qword [rsp + 0x60]
add dword [rsp + 0x68], 1
mov eax, dword [rsp + 0x68]
cmp dword [rsi + 0x18], eax
ja 0x4a5190
mov rcx, rdi
call fcn.00479d10
mov r9, qword [rdi]
mov r8d, 7
mov edx, 1
lea rcx, str.Codecs:
call sub.msvcrt.dll_fwrite
mov rcx, rdi
call fcn.00479d10
mov r15, qword [0x00828b50]
mov r10d, dword [r15]
test r10d, r10d
je 0x4a55d7
lea r14, [0x008110ce]
xor ebp, ebp
lea r12, [rsp + 0x190]
lea r13, [rsp + 0x150]
mov r9, qword [rdi]
mov eax, ebp
mov r8d, 2
mov edx, 1
mov rsi, qword [0x00828b20]
mov rcx, r14
mov rsi, qword [rsi + rax*8]
call sub.msvcrt.dll_fwrite
mov rdx, qword [rdi]
mov ecx, 0x20
call sub.msvcrt.dll_fputc
mov edx, dword [rsi + 0x20]
cmp edx, 1
je 0x4a57c6
mov rcx, rdi
call fcn.00479fe0
cmp qword [rsi + 8], 1
mov rdx, qword [rdi]
sbb ecx, ecx
and ecx, 0xffffffdb
add ecx, 0x45
call sub.msvcrt.dll_fputc
cmp qword [rsi], 1
mov rdx, qword [rdi]
sbb ecx, ecx
and ecx, 0xffffffdc
add ecx, 0x44
call sub.msvcrt.dll_fputc
mov rdx, qword [rdi]
mov ecx, 0x20
call sub.msvcrt.dll_fputc
mov rcx, qword [rsi + 0x10]
mov rdx, r12
call fcn.004a8f80
mov rdx, r12
mov rcx, r13
call fcn.00476800
mov ebx, dword [rsp + 0x158]
cmp ebx, 7
ja 0x4a5585
nop dword [rax + rax]
mov rdx, qword [rdi]
mov ecx, 0x20
call sub.msvcrt.dll_fputc
add ebx, 1
cmp ebx, 8
jne 0x4a5570
mov rdx, qword [rdi]
mov rcx, qword [rsp + 0x150]
call sub.msvcrt.dll_fputs
mov rcx, qword [rsp + 0x150]
test rcx, rcx
je 0x4a55a7
call fcn.007da030
mov rdx, qword [rdi]
mov ecx, 0x20
mov rbx, qword [rsi + 0x18]
call sub.msvcrt.dll_fputc
mov rdx, qword [rdi]
mov rcx, rbx
call sub.msvcrt.dll_fputs
mov rcx, rdi
add ebp, 1
call fcn.00479d10
cmp dword [r15], ebp
ja 0x4a54cb
mov rcx, rdi
call fcn.00479d10
mov r9, qword [rdi]
mov r8d, 8
mov edx, 1
lea rcx, str.Hashers:
call sub.msvcrt.dll_fwrite
mov rcx, rdi
call fcn.00479d10
mov r14, qword [0x00828b60]
mov r9d, dword [r14]
test r9d, r9d
je 0x4a5767
lea rax, [rsp + 0x170]
xor esi, esi
lea r13, [rsp + 0x160]
mov qword [rsp + 0x68], rax
lea r12, [rsp + 0x210]
lea r15, [rsp + 0x180]
mov rdx, qword [0x00828b40]
mov eax, esi
mov r8d, 2
mov r9, qword [rdi]
lea rcx, [0x008110ce]
mov rbp, qword [rdx + rax*8]
mov edx, 1
call sub.msvcrt.dll_fwrite
mov rdx, qword [rdi]
mov ecx, 0x20
call sub.msvcrt.dll_fputc
mov ecx, dword [rbp + 0x18]
mov rdx, r13
call fcn.004a8830
mov rcx, qword [rsp + 0x68]
mov rdx, r13
call fcn.00476800
mov ebx, dword [rsp + 0x178]
cmp ebx, 3
ja 0x4a56a8
mov rdx, qword [rdi]
mov ecx, 0x20
call sub.msvcrt.dll_fputc
add ebx, 1
cmp ebx, 4
jne 0x4a5693
mov rdx, qword [rdi]
mov rcx, qword [rsp + 0x170]
call sub.msvcrt.dll_fputs
mov rcx, qword [rsp + 0x170]
test rcx, rcx
je 0x4a56ca
call fcn.007da030
mov rdx, qword [rdi]
mov ecx, 0x20
call sub.msvcrt.dll_fputc
mov rcx, qword [rbp + 8]
mov rdx, r12
call fcn.004a8f80
mov rdx, r12
mov rcx, r15
call fcn.00476800
mov ebx, dword [rsp + 0x188]
cmp ebx, 7
ja 0x4a5715
nop word [rax + rax]
mov rdx, qword [rdi]
mov ecx, 0x20
call sub.msvcrt.dll_fputc
add ebx, 1
cmp ebx, 8
jne 0x4a5700
mov rdx, qword [rdi]
mov rcx, qword [rsp + 0x180]
call sub.msvcrt.dll_fputs
mov rcx, qword [rsp + 0x180]
test rcx, rcx
je 0x4a5737
call fcn.007da030
mov rdx, qword [rdi]
mov ecx, 0x20
mov rbx, qword [rbp + 0x10]
call sub.msvcrt.dll_fputc
mov rdx, qword [rdi]
mov rcx, rbx
call sub.msvcrt.dll_fputs
mov rcx, rdi
add esi, 1
call fcn.00479d10
cmp dword [r14], esi
ja 0x4a563b
xor r12d, r12d
cmp byte [rsp + 0x389], 0
je 0x4a4f10
mov rax, qword [rsp + 0x78]
cmp qword [rax], 0
jne 0x4a4ec2
jmp 0x4a4f10
mov r9, qword [rdi]
mov r8d, 7
mov edx, 1
lea rcx, str.offset
call sub.msvcrt.dll_fwrite
mov edx, ebx
mov rcx, rdi
call fcn.00479fe0
mov ecx, 0x20
mov rdx, qword [rax]
call sub.msvcrt.dll_fputc
jmp 0x4a533f
mov rdx, qword [rdi]
mov ecx, 0x20
call sub.msvcrt.dll_fputc
jmp 0x4a550f
mov rax, qword [0x00828ba0]
mov rax, qword [rax]
test rax, rax
je 0x4a48e5
mov r9, qword [rax]
mov r8d, 0x42
mov edx, 1
lea rcx, str._n7_Zip__r___64__16.02_:_Igor_Pavlov_:_Public_domain_:_2016_05_21_n_n
call sub.msvcrt.dll_fwrite
jmp 0x4a48e5
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rbx, rax
jmp 0x4a4257
mov rdi, qword [0x00827e50]
lea rsi, [rsp + 0x250]
mov qword [rsp + 0x268], 0
mov qword [rsp + 0x270], 0xffffffffffffffff
lea rcx, [rsi + 0x30]
mov qword [rsp + 0x278], 0
lea rax, [rdi + 0x10]
mov qword [rsp + 0x250], rax
call fcn.00476780
lea rcx, [rsi + 0x40]
call fcn.00477f50
mov dword [rsp + 0x2a0], 0xc8
lea rcx, [rsi + 0x58]
mov dword [rsp + 0x2a4], 0
call fcn.00476780
lea rcx, [rsi + 0x68]
call fcn.00476780
lea rcx, [rsi + 0x78]
call fcn.00476780
lea rcx, [rsi + 0x88]
call fcn.00477f50
lea rcx, [rsi + 0xb0]
mov qword [rsp + 0x2e8], 0
mov qword [rsp + 0x2f0], 0xffffffffffffffff
mov qword [rsp + 0x2f8], 0
call fcn.00476780
lea rcx, [rsi + 0xc0]
call fcn.00477f50
lea rcx, [rsi + 0xd0]
call fcn.00476780
mov rax, qword [0x00828b30]
mov byte [rsp + 0x338], 1
cmp byte [rsp + 0x349], 0
mov dword [rsp + 0x33c], 0x4f
mov rax, qword [rax]
je 0x4a6500
mov rdx, qword [0x00828ba0]
mov qword [rsp + 0x260], rax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rdx]
mov qword [rsp + 0x330], rax
mov eax, dword [rsp + 0x84]
mov qword [rsp + 0x258], rcx
sub eax, 1
test rcx, rcx
mov dword [rsp + 0x33c], eax
je 0x4a596a
lea rdx, str.Scanning_the_drive_for_archives:
call fcn.006b19a0
mov rcx, rax
call fcn.00479d10
pxor xmm0, xmm0
mov rcx, rsi
movaps xmmword [rsp + 0x210], xmm0
movaps xmmword [rsp + 0x220], xmm0
lea rbp, [rsp + 0x160]
movaps xmmword [rsp + 0x230], xmm0
lea r13, [rsp + 0x170]
call fcn.004cf0d0
lea rbx, [rsp + 0x140]
lea rbp, [rsp + 0x160]
mov rcx, rbx
lea r13, [rsp + 0x170]
call fcn.00477f50
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x30], rsi
mov r8, rbx
xor edx, edx
lea rbp, [rsp + 0x160]
lea r15, [rsp + 0x210]
mov r9, rbp
lea r13, [rsp + 0x170]
mov qword [rsp + 0x28], r15
lea rcx, [rax + 0x68]
mov qword [rsp + 0x20], r13
call fcn.00490370
mov rcx, qword [rsp + 0x140]
mov ebx, eax
test rcx, rcx
je 0x4a5a0f
call fcn.007da030
cmp qword [rsp + 0x330], 0
je 0x4a5a28
lea rcx, [rsi + 0x18]
mov edx, 1
call fcn.004a7440
test ebx, ebx
jne 0x4a6537
cmp byte [rsp + 0x349], 0
jne 0x4a6bb4
lea rcx, [rsi + 0x18]
add rdi, 0x10
xor r12d, r12d
mov qword [rsp + 0x250], rdi
call fcn.004a72c0
test r14b, r14b
je 0x4a4df4
mov ecx, 0x198
call fcn.007da0a0
mov rbx, rax
lea rax, [0x008415d0]
mov qword [rbx + 0x18], 0
mov qword [rbx], rax
lea rax, [0x00841ce0]
mov qword [rbx + 8], rax
mov rax, qword [0x00827e60]
lea rcx, [rbx + 0x30]
mov qword [rbx + 0x20], 0xffffffffffffffff
mov qword [rbx + 0x28], 0
add rax, 0x10
mov qword [rbx + 0x10], rax
lea rax, [rbx + 0x18]
mov qword [rsp + 0xa0], rax
call fcn.00476780
lea rcx, [rbx + 0x40]
call fcn.00477f50
mov dword [rbx + 0x50], 0xc8
lea rcx, [rbx + 0x58]
mov dword [rbx + 0x54], 0
call fcn.00476780
lea rcx, [rbx + 0x68]
call fcn.00476780
lea rcx, [rbx + 0x78]
call fcn.00476780
lea rcx, [rbx + 0x88]
call fcn.00477f50
mov qword [rbx + 0x98], 0
lea rcx, [rbx + 0xb0]
mov qword [rbx + 0xa0], 0xffffffffffffffff
mov qword [rbx + 0xa8], 0
call fcn.00476780
lea rcx, [rbx + 0xc0]
call fcn.00477f50
lea rcx, [rbx + 0xd0]
call fcn.00476780
mov rax, qword [0x00827e90]
mov byte [rbx + 0xe8], 1
lea rcx, [rbx + 0x108]
mov dword [rbx + 0xec], 0x4f
mov byte [rbx + 0x100], 0
mov byte [rbx + 0x101], 0
add rax, 0x10
mov byte [rbx + 0x102], 0
mov qword [rbx], rax
mov rax, qword [0x00827e90]
mov dword [rbx + 0x104], 0
add rax, 0x90
mov qword [rbx + 8], rax
mov rax, qword [0x00827e90]
add rax, 0xc0
mov qword [rbx + 0x10], rax
call fcn.00476780
lea rcx, [rbx + 0x118]
call fcn.00477f50
lea rcx, [rbx + 0x128]
call fcn.00477f50
mov rax, qword [rbx]
lea rdx, [0x006b52c0]
mov byte [rbx + 0x188], 0
mov dword [rbx + 0x18c], 1
mov dword [rbx + 0x190], 0
mov rax, qword [rax + 8]
cmp rax, rdx
jne 0x4a682e
add dword [rbx + 0x104], 1
mov rax, qword [0x00828b30]
mov qword [rbx + 0x138], 0
mov rdi, qword [0x00828ba0]
cmp dword [rsp + 0x168], 1
mov byte [rbx + 0x140], 0
mov byte [rbx + 0x141], 0
mov qword [rbx + 0x148], 0
mov rax, qword [rax]
mov rdx, qword [rdi]
mov qword [rsp + 0x78], rdi
seta byte [rbx + 0x102]
mov rdi, qword [rsp + 0x68]
mov qword [rbx + 0x150], 0
mov qword [rbx + 0xf8], rax
mov eax, dword [rsp + 0x5cc]
mov qword [rbx + 0xf0], rdx
test rdi, rdi
mov qword [rbx + 0xe0], rdi
mov qword [rbx + 0x158], 0
mov dword [rbx + 0x190], eax
mov eax, dword [rsp + 0x9c]
mov qword [rbx + 0x160], 0
mov qword [rbx + 0x168], 0
mov qword [rbx + 0x170], 0
mov qword [rbx + 0x178], 0
mov qword [rbx + 0x180], 0
mov dword [rbx + 0x18c], eax
je 0x4a5cdf
mov eax, dword [rsp + 0x84]
sub eax, 1
mov dword [rbx + 0xec], eax
lea r15, [rsp + 0x210]
mov byte [rsp + 0x210], 0
lea rcx, [r15 + 0x10]
mov byte [rsp + 0x211], 0
mov byte [rsp + 0x212], 0
mov byte [rsp + 0x213], 0
mov dword [rsp + 0x214], 0
mov dword [rsp + 0x218], 0
call fcn.00477f50
movzx eax, word [rsp + 0x3e8]
lea rcx, [r15 + 0x10]
mov byte [rsp + 0x230], 0
mov byte [rsp + 0x231], 0
mov byte [rsp + 0x233], 0
mov byte [rsp + 0x235], 0
mov word [rsp + 0x210], ax
movzx eax, byte [rsp + 0x3ea]
mov byte [rsp + 0x237], 0
mov byte [rsp + 0x238], 0
mov byte [rsp + 0x239], 0
mov byte [rsp + 0x212], al
movzx eax, byte [rsp + 0x3eb]
mov byte [rsp + 0x232], 1
mov byte [rsp + 0x234], 1
mov byte [rsp + 0x236], 1
mov byte [rsp + 0x213], al
mov eax, dword [rsp + 0x3ec]
mov byte [rsp + 0x23a], 0
mov byte [rsp + 0x23b], 0
mov byte [rsp + 0x23c], 0
mov dword [rsp + 0x214], eax
mov eax, dword [rsp + 0x3f0]
mov byte [rsp + 0x23d], 0
mov qword [rsp + 0x240], 0
mov dword [rsp + 0x248], 0
mov dword [rsp + 0x218], eax
mov rax, qword [rsp + 0x70]
mov dword [rsp + 0x24c], 0
lea rdx, [rax + 0xb8]
call fcn.00478190
mov rax, qword [rsp + 0x408]
cmp dword [rsp + 0x370], 3
mov qword [rsp + 0x230], rax
movzx eax, word [rsp + 0x410]
sete byte [rsp + 0x23d]
mov word [rsp + 0x238], ax
movzx eax, byte [rsp + 0x347]
mov byte [rsp + 0x23a], al
movzx eax, byte [rsp + 0x348]
mov byte [rsp + 0x23b], al
movzx eax, byte [rsp + 0x34a]
mov byte [rsp + 0x23c], al
mov eax, dword [rsp + 0x248]
lea esi, [rax - 1]
shl rsi, 3
test eax, eax
je 0x4a5ec9
mov rax, qword [rsp + 0x240]
mov rdi, qword [rax + rsi]
test rdi, rdi
je 0x4a5ebf
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x4a5ea5
call fcn.007da030
mov rcx, qword [rdi]
test rcx, rcx
je 0x4a5eb2
call fcn.007da030
mov edx, 0x20
mov rcx, rdi
call fcn.007da070
sub rsi, 8
cmp rsi, 0xfffffffffffffff8
jne 0x4a5e86
mov esi, dword [rsp + 0x3e0]
mov dword [rsp + 0x248], 0
cmp esi, dword [rsp + 0x24c]
ja 0x4a692f
test esi, esi
je 0x4a5f50
lea eax, [rsi - 1]
xor ebp, ebp
lea r12, [rax*8 + 8]
mov rax, qword [rsp + 0x3d8]
mov ecx, 0x20
mov rdi, qword [rax + rbp]
call fcn.007da0a0
mov rdx, rdi
mov rcx, rax
mov rsi, rax
call fcn.00478040
lea rdx, [rdi + 0x10]
lea rcx, [rsi + 0x10]
call fcn.00478040
mov eax, dword [rsp + 0x248]
add rbp, 8
cmp rbp, r12
lea edx, [rax + 1]
mov dword [rsp + 0x248], edx
mov rdx, qword [rsp + 0x240]
mov qword [rdx + rax*8], rsi
jne 0x4a5ef9
lea rdi, [rsp + 0x180]
mov rcx, rdi
call fcn.00477f50
mov rax, qword [0x00827d30]
mov qword [rsp + 0x258], 0
mov r8d, dword [rsp + 0x398]
mov dword [rsp + 0x260], 0
mov dword [rsp + 0x264], 0
mov qword [rsp + 0x68], 0
add rax, 0x10
test r8d, r8d
mov qword [rsp + 0x250], rax
jne 0x4a68ac
lea rax, [rsp + 0x190]
mov qword [rsp + 0x50], rdi
mov rdx, qword [rsp + 0xa8]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x68]
lea rbp, [rsp + 0x160]
mov qword [rsp + 0x40], rbx
mov rcx, qword [rsp + 0x60]
lea r13, [rsp + 0x170]
mov r9, rbp
mov qword [rsp + 0x30], r15
lea r8, [rsp + 0x130]
lea rsi, [rsp + 0x250]
mov qword [rsp + 0x48], rax
lea rax, [rbx + 0x10]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x350]
mov rax, qword [rax]
mov qword [rsp + 0x20], r13
add rax, 0x10
mov qword [rsp + 0x28], rax
call fcn.004c8130
cmp qword [rbx + 0xe0], 0
mov dword [rsp + 0x80], eax
je 0x4a6057
mov rcx, qword [rsp + 0xa0]
mov edx, 1
lea rsi, [rsp + 0x250]
call fcn.004a7440
mov ecx, dword [rsp + 0x188]
test ecx, ecx
je 0x4a60d0
mov rax, qword [0x00828b30]
mov rsi, qword [rax]
test rsi, rsi
je 0x4a60b6
mov rcx, rsi
mov rdi, qword [rsp + 0x180]
call fcn.00479d10
lea rdx, [0x00811111]
mov rcx, rsi
call fcn.006b19a0
lea rsi, [rsp + 0x250]
mov r12, rax
mov rcx, rax
call fcn.00479d10
mov rdx, rdi
mov rcx, r12
call fcn.00479d50
mov rcx, rax
call fcn.00479d10
mov edi, dword [rsp + 0x80]
mov eax, 0x80004005
mov esi, eax
test edi, edi
cmovne esi, edi
mov dword [rsp + 0x80], esi
mov rax, qword [rsp + 0x78]
mov rdi, qword [rax]
test rdi, rdi
je 0x4a65e3
mov rcx, rdi
call fcn.00479d10
mov rsi, qword [rbx + 0x138]
cmp rsi, 1
jbe 0x4a6141
lea rdx, str.Archives:
mov rcx, rdi
call fcn.006b19a0
mov rdx, rsi
mov rcx, rax
call fcn.0047a030
mov rcx, rax
call fcn.00479d10
mov rsi, qword [rbx + 0x148]
lea rdx, str.OK_archives:
mov rcx, rdi
call fcn.006b19a0
mov rcx, rax
mov rdx, rsi
call fcn.0047a030
mov rcx, rax
call fcn.00479d10
mov rsi, qword [rbx + 0x150]
test rsi, rsi
jne 0x4a69ca
mov rsi, qword [rbx + 0x158]
test rsi, rsi
je 0x4a65d0
test rdi, rdi
je 0x4a69bf
lea rdx, str.Archives_with_Errors:
mov rcx, rdi
call fcn.006b19a0
mov rdx, rsi
mov rcx, rax
call fcn.0047a030
mov rcx, rax
call fcn.00479d10
mov rsi, qword [rbx + 0x160]
test rsi, rsi
jne 0x4a6dcf
cmp qword [rbx + 0x170], 0
jne 0x4a6d90
cmp qword [rbx + 0x168], 0
je 0x4a65b1
test rdi, rdi
je 0x4a69bf
mov rcx, rdi
call fcn.00479d10
mov rsi, qword [rbx + 0x168]
test rsi, rsi
je 0x4a61f7
lea rdx, str.Open_Errors:
mov rcx, rdi
call fcn.006b19a0
mov rdx, rsi
mov rcx, rax
call fcn.0047a030
mov rcx, rax
call fcn.00479d10
mov r12d, 2
cmp qword [rbx + 0x158], 0
jne 0x4a655b
cmp qword [rbx + 0x178], 0
jne 0x4a655b
mov edx, dword [rsp + 0x80]
test edx, edx
jne 0x4a6340
mov rsi, qword [rsp + 0x1b0]
test rsi, rsi
jne 0x4a6d34
mov rsi, qword [rsp + 0x1b8]
cmp rsi, 1
je 0x4a6d77
lea rdx, str.Files:
mov rcx, rdi
call fcn.006b19a0
mov rdx, rsi
mov rcx, rax
call fcn.0047a030
mov rcx, rax
call fcn.00479d10
mov rsi, qword [rsp + 0x1c0]
test rsi, rsi
je 0x4a62c6
lea rdx, str.Alternate_Streams:
mov rcx, rdi
call fcn.006b19a0
mov rdx, rsi
mov rcx, rax
call fcn.0047a030
mov rcx, rax
call fcn.00479d10
mov rsi, qword [rsp + 0x1a0]
lea rdx, str.Alternate_Streams_Size:
mov rcx, rdi
call fcn.006b19a0
mov rcx, rax
mov rdx, rsi
call fcn.0047a030
mov rcx, rax
call fcn.00479d10
mov rsi, qword [rsp + 0x198]
lea rdx, [0x008111e4]
mov rcx, rdi
mov r14, qword [rsp + 0x1a8]
call fcn.006b19a0
mov rcx, rax
mov rdx, rsi
call fcn.0047a030
mov rsi, rax
mov rcx, rax
call fcn.00479d10
lea rdx, str.Compressed:
mov rcx, rsi
call fcn.006b19a0
mov rdx, r14
mov rcx, rax
call fcn.0047a030
mov rcx, rax
call fcn.00479d10
cmp qword [rsp + 0x68], 0
je 0x4a6340
lea rsi, [rsp + 0x250]
mov rcx, rdi
call fcn.00479d10
mov rdx, rsi
mov rcx, rdi
call fcn.004d18f0
mov rax, qword [0x00827d30]
mov rcx, qword [rsp + 0x258]
add rax, 0x10
mov qword [rsp + 0x250], rax
mov eax, dword [rsp + 0x260]
test eax, eax
je 0x4a63b1
lea esi, [rax - 1]
shl rsi, 3
mov rdi, qword [rcx + rsi]
test rdi, rdi
je 0x4a63a7
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x4a6384
call fcn.007da030
mov rcx, qword [rdi]
test rcx, rcx
je 0x4a6392
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, rdi
mov edx, 0x120
call fcn.007da070
mov rcx, qword [rsp + 0x258]
sub rsi, 8
cmp rsi, 0xfffffffffffffff8
jne 0x4a636d
test rcx, rcx
je 0x4a63bb
call fcn.007da030
mov rcx, qword [rsp + 0x180]
test rcx, rcx
je 0x4a63cd
call fcn.007da030
mov eax, dword [rsp + 0x248]
mov rcx, qword [rsp + 0x240]
test eax, eax
je 0x4a642a
lea esi, [rax - 1]
shl rsi, 3
mov rdi, qword [rcx + rsi]
test rdi, rdi
je 0x4a6420
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x4a63fe
call fcn.007da030
mov rcx, qword [rdi]
test rcx, rcx
je 0x4a640b
call fcn.007da030
mov rcx, rdi
mov edx, 0x20
call fcn.007da070
mov rcx, qword [rsp + 0x240]
sub rsi, 8
cmp rsi, 0xfffffffffffffff8
jne 0x4a63e7
test rcx, rcx
je 0x4a6434
call fcn.007da030
mov rcx, qword [rsp + 0x220]
test rcx, rcx
je 0x4a6446
call fcn.007da030
mov rax, qword [rbx]
lea rdx, [0x006b52d0]
mov rax, qword [rax + 0x10]
cmp rax, rdx
jne 0x4a69b5
sub dword [rbx + 0x104], 1
jne 0x4a4df4
mov rax, qword [0x00827e90]
mov rcx, qword [rbx + 0x128]
add rax, 0x10
mov qword [rbx], rax
mov rax, qword [0x00827e90]
add rax, 0x90
mov qword [rbx + 8], rax
mov rax, qword [0x00827e90]
add rax, 0xc0
test rcx, rcx
mov qword [rbx + 0x10], rax
je 0x4a64ab
call fcn.007da030
mov rcx, qword [rbx + 0x118]
test rcx, rcx
je 0x4a64bc
call fcn.007da030
mov rcx, qword [rbx + 0x108]
test rcx, rcx
je 0x4a64cd
call fcn.007da030
mov rax, qword [0x00827e60]
mov rcx, qword [rsp + 0xa0]
add rax, 0x10
mov qword [rbx + 0x10], rax
call fcn.004a72c0
mov edx, 0x198
mov rcx, rbx
call fcn.007da070
jmp 0x4a4df4
mov qword [rsp + 0x260], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x258], 0
mov qword [rsp + 0x330], rax
mov eax, dword [rsp + 0x84]
sub eax, 1
mov dword [rsp + 0x33c], eax
jmp 0x4a596a
lea rcx, [rsi + 0x18]
add rdi, 0x10
xor r12d, r12d
mov qword [rsp + 0x250], rdi
call fcn.004a72c0
mov dword [rsp + 0x80], ebx
jmp 0x4a4df4
mov rcx, rdi
call fcn.00479d10
mov rsi, qword [rbx + 0x178]
test rsi, rsi
je 0x4a6340
lea rdx, [0x00811192]
mov rcx, rdi
call fcn.006b19a0
mov rdx, rsi
mov rcx, rax
call fcn.0047a030
mov rcx, rax
call fcn.00479d10
jmp 0x4a6340
cmp qword [rbx + 0x168], 0
jne 0x4a69bf
movzx r14d, byte [rsp + 0x9b]
xor r12d, r12d
test r14b, r14b
setne r12b
add r12d, r12d
test rdi, rdi
jne 0x4a61fd
jmp 0x4a6340
test rdi, rdi
je 0x4a659a
movzx r14d, byte [rsp + 0x9b]
jmp 0x4a618c
movzx eax, byte [rsp + 0x9b]
cmp qword [rbx + 0x150], 0
cmovne eax, r14d
mov byte [rsp + 0x9b], al
jmp 0x4a6151
lea rcx, [rsp + 0xf0]
call fcn.004b5180
lea rsi, [rsp + 0x250]
mov ecx, 9
xor eax, eax
mov rdi, rsi
rep stosq qword [rdi], rax
lea rcx, [0x0081121e]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.K32GetProcessMemoryInfo
mov rcx, rax
mov rdi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rdi
test rax, rax
mov rbx, rax
je 0x4a70e8
call rbp
mov r8d, 0x48
mov rdx, rsi
mov rcx, rax
call rbx
mov rdi, qword [rsp + 0xd0]
lea rcx, str.Kernel
mov ebp, eax
mov rbx, qword [rsp + 0xf0]
sub rbx, qword [rsp + 0xb0]
mov rsi, qword [rsp + 0xe0]
mov rdx, rdi
mov r8, rbx
call fcn.004a3eb0
mov r8, rbx
mov rdx, rsi
lea rcx, str.User
call fcn.004a3eb0
lea rdx, [rdi + rsi]
mov r8, rbx
lea rcx, str.Process
call fcn.004a3eb0
test ebp, ebp
jne 0x4a70a9
lea rcx, str.Global
mov r8, rbx
mov rdx, rbx
call fcn.004a3eb0
mov rax, qword [rsp + 0x78]
mov rcx, qword [rax]
call fcn.00479d10
jmp 0x4a4f01
mov dword [rsp + 0x84], 0x50
jmp 0x4a4970
cmp rdx, 0xffffffffffffffff
mov rcx, rax
jne 0x4a5102
call fcn.007da360
lea rdi, str.Unsupported_archive_type
mov ecx, 8
call fcn.007da1c0
mov rdx, qword [0x00827cf0]
xor r8d, r8d
mov qword [rax], rdi
mov rcx, rax
call fcn.007da930
mov rbx, rax
jmp 0x4a5087
mov rcx, rbx
call rax
jmp 0x4a5bfd
mov rax, qword [rsp + 0x70]
lea rsi, [rsp + 0x250]
lea rbp, [rsp + 0x160]
mov rcx, rsi
lea r13, [rsp + 0x170]
lea rdx, [rax + 0x50]
call fcn.004cb380
test eax, eax
jne 0x4a699e
mov qword [rsp + 0x290], 0
mov qword [rsp + 0x288], 0
mov qword [rsp + 0x280], 0
mov qword [rsp + 0x278], 0
mov qword [rsp + 0x270], 0
mov qword [rsp + 0x268], 0
mov qword [rsp + 0x68], rsi
jmp 0x4a5faf
mov ecx, esi
shl rcx, 3
call fcn.007da080
mov rdi, rax
mov eax, dword [rsp + 0x248]
mov rbp, qword [rsp + 0x240]
test eax, eax
jne 0x4a6971
test rbp, rbp
je 0x4a695d
mov rcx, rbp
call fcn.007da030
mov qword [rsp + 0x240], rdi
mov dword [rsp + 0x24c], esi
jmp 0x4a5ee8
lea r8, [rax*8]
mov rdx, rbp
mov rcx, rdi
call sub.msvcrt.dll_memcpy
jmp 0x4a6955
lea rbp, [rsp + 0x160]
mov ecx, eax
lea r13, [rsp + 0x170]
call fcn.007dca40
mov rcx, rbx
call rax
jmp 0x4a4df4
mov r12d, 2
jmp 0x4a6340
lea rdx, str.Cant_open_as_archive:
mov rcx, rdi
call fcn.006b19a0
mov rdx, rsi
mov rcx, rax
call fcn.0047a030
mov rcx, rax
call fcn.00479d10
mov rsi, qword [rbx + 0x158]
test rsi, rsi
jne 0x4a616a
jmp 0x4a618c
mov rdx, r15
mov rcx, rsi
call fcn.004cf890
jmp 0x4a5a3e
mov ecx, dword [rsp + 0x80]
call fcn.007dca40
mov rbx, rax
jmp 0x4a5075
mov edx, eax
shr edx, 2
lea ecx, [rax + rdx + 1]
mov rsi, rcx
shl rcx, 3
call fcn.007da080
mov rdi, rax
mov eax, dword [rsp + 0x178]
mov rbp, qword [rsp + 0x170]
test eax, eax
jne 0x4a6c30
test rbp, rbp
je 0x4a6c1c
mov rcx, rbp
call fcn.007da030
mov eax, dword [rsp + 0x178]
mov qword [rsp + 0x170], rdi
mov dword [rsp + 0x17c], esi
jmp 0x4a4dd8
lea r8, [rax*8]
mov rdx, rbp
mov rcx, rdi
call sub.msvcrt.dll_memcpy
jmp 0x4a6c0d
mov ecx, eax
call fcn.007dca40
jmp 0x4a66f6
mov edx, eax
shr edx, 2
lea ecx, [rax + rdx + 1]
mov rsi, rcx
shl rcx, 3
call fcn.007da080
mov rdi, rax
mov eax, dword [rsp + 0x168]
mov rbp, qword [rsp + 0x160]
test eax, eax
jne 0x4a6cbb
test rbp, rbp
je 0x4a6ca7
mov rcx, rbp
call fcn.007da030
mov eax, dword [rsp + 0x168]
mov qword [rsp + 0x160], rdi
mov dword [rsp + 0x16c], esi
jmp 0x4a4d8b
lea r8, [rax*8]
mov rdx, rbp
mov rcx, rdi
call sub.msvcrt.dll_memcpy
jmp 0x4a6c98
lea rdx, str.Folders:
mov rcx, rdi
call fcn.006b19a0
mov rdx, rsi
mov rcx, rax
call fcn.0047a030
mov rcx, rax
call fcn.00479d10
mov rsi, qword [rsp + 0x1b8]
cmp rsi, 1
jne 0x4a624b
cmp qword [rsp + 0x1b0], 0
jne 0x4a624b
cmp qword [rsp + 0x1c0], 0
je 0x4a62c6
mov esi, 1
jmp 0x4a624b
mov rcx, rdi
call fcn.00479d10
mov rsi, qword [rbx + 0x170]
test rsi, rsi
je 0x4a61aa
lea rdx, str.Warnings:
mov rcx, rdi
call fcn.006b19a0
mov rdx, rsi
mov rcx, rax
call fcn.0047a030
mov rcx, rax
call fcn.00479d10
jmp 0x4a61aa
lea rdx, str.Archives_with_Warnings:
mov rcx, rdi
call fcn.006b19a0
mov rdx, rsi
mov rcx, rax
call fcn.0047a030
mov rcx, rax
call fcn.00479d10
jmp 0x4a619c
mov rax, qword [0x00828b30]
mov rbx, qword [rax]
test rbx, rbx
je 0x4a6e45
mov rcx, rbx
call fcn.00479d10
lea rdx, [0x008111fe]
mov rcx, rbx
call fcn.006b19a0
lea rdx, str.Incorrect_command_line
mov rcx, rax
call fcn.006b19a0
mov rcx, rax
call fcn.00479d10
mov ecx, 4
call fcn.007da1c0
lea rdx, [0x00839410]
xor r8d, r8d
mov dword [rax], 7
mov rcx, rax
call fcn.007da930
jmp 0x4a66f6
mov rdx, qword [rsp + 0x290]
lea rcx, str.Virtual
call fcn.004a3d30
mov rdx, rbx
mov r8, rbx
lea rcx, str.Global
call fcn.004a3eb0
mov rdx, qword [rsp + 0x258]
lea rcx, str.Physical
call fcn.004a3d30
jmp 0x4a66d4
lea rcx, str.Psapi.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x4a7112
lea rdx, str.GetProcessMemoryInfo
mov rcx, rax
call rdi
test rax, rax
mov rbx, rax
jne 0x4a6651
mov rdi, qword [rsp + 0xd0]
lea rcx, str.Kernel
mov rbx, qword [rsp + 0xf0]
sub rbx, qword [rsp + 0xb0]
mov rsi, qword [rsp + 0xe0]
mov rdx, rdi
mov r8, rbx
call fcn.004a3eb0
mov r8, rbx
mov rdx, rsi
lea rcx, str.User
call fcn.004a3eb0
lea rdx, [rsi + rdi]
mov r8, rbx
lea rcx, str.Process
call fcn.004a3eb0
jmp 0x4a66c2