Function at 0x489560
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x9a8
mov eax, dword [0x4d8620]
xor eax, esp
mov dword [esp + 0x9a4], eax
push ebx
xor ebx, ebx
push esi
push edi
cmp byte [esp + 0x9c0], bl
je 0x48959d
cmp word [0x531efa], bx
je 0x489607
cmp dword [0x5629dc], ebx
je 0x489607
xor eax, eax
mov word [0x531efa], ax
jmp 0x489607
push 1
call fcn.00486b70
mov al, byte [esp + 0x9bc]
mov dword [0x533838], 3
cmp al, bl
je 0x4895be
mov byte [0x533872], al
mov dword [0x527620], ebx
mov dword [0x527624], ebx
cmp byte [0x526d89], bl
jne 0x48971a
mov ecx, dword [0x536aac]
push 1
push ecx
mov ecx, 0x52d6c0
call fcn.00444ad0
cmp byte [0x52deda], bl
je 0x489607
mov edx, dword [0x536aac]
cmp dword [edx + 0x20], 1
jbe 0x489607
mov dword [0x533834], 4
cmp byte [0x526d89], bl
jne 0x48971a
cmp word [0x5362aa], bx
jne 0x48971a
mov esi, 0x5362aa
mov byte [esp + 0x9b8], bl
call fcn.00484060
push 0x400
push 0x4c5d70
lea eax, [esp + 0x1b8]
push eax
push str.DefFolder
push str.Compression
call fcn.0045fe40
cmp word [esp + 0x1b0], bx
jne 0x489684
cmp byte [0x52deda], bl
je 0x4896f7
push 0x400
lea ecx, [esp + 0x1b4]
push ecx
call fcn.0048b200
cmp word [esp + 0x1b0], bx
je 0x4896f7
lea edx, [esp + 0x1b0]
push edx
call fcn.00455790
mov eax, 0x5362aa
mov edx, eax
jmp 0x4896a0
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4896a0
lea edi, [esp + 0x1b0]
sub eax, edx
add edi, 0xfffffffe
jmp 0x4896c0
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x4896c0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor eax, eax
mov edi, edi
movzx ecx, word [esp + eax + 0x1b0]
mov word [eax + 0x5362aa], cx
add eax, 2
cmp cx, bx
jne 0x4896e0
cmp word [0x5306f8], bx
mov eax, dword [0x53423c]
setne cl
push eax
movzx edx, cl
push edx
push 0x400
push 0x5362aa
call fcn.00484200
cmp dword [0x533834], ebx
jne 0x48972c
mov dword [0x533834], 5
cmp byte [0x526d89], bl
je 0x489811
mov esi, dword [0x52e1f4]
cmp esi, ebx
je 0x48976d
cmp esi, 1
je 0x48976d
push 0x30
push 0x65
call fcn.00466160
push eax
push 0x1fd
call fcn.00466160
push eax
mov eax, dword [0x527edc]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x489a7a
push 0x400
push 0x5362aa
mov ecx, 0x52dfe8
call fcn.00412e90
push 0x400
push 0x532b04
mov ecx, 0x52dfe8
call fcn.00412e70
cmp word [0x532b04], bx
je 0x4897a8
push 0x532b04
call fcn.00455790
lea ecx, [esp + 0x10]
push ecx
mov ecx, 0x52dfe8
mov byte [0x533876], bl
call fcn.00412ec0
mov edx, dword [esp + 0x90]
mov dword [0x53423c], edx
cmp esi, ebx
jne 0x4897d7
cmp dword [esp + 0x118], ebx
je 0x4897e3
mov eax, dword [esp + 0x144]
mov dword [0x533824], eax
cmp dword [esp + 0x130], ebx
je 0x489808
xor eax, eax
mov edi, edi
movzx ecx, word [eax + 0x4c5f34]
mov word [eax + 0x5306f8], cx
add eax, 2
cmp cx, bx
jne 0x4897f0
jmp 0x489811
xor ecx, ecx
mov word [0x5306f8], cx
mov edx, dword [0x527edc]
push edx
call dword [sym.imp.USER32.dll_IsWindowVisible]
mov ecx, dword [esp + 0x9b8]
neg eax
sbb eax, eax
and eax, dword [0x527edc]
push ebx
push ecx
push eax
call fcn.00489270
test al, al
je 0x489a5b
mov eax, dword [0x5629e4]
mov edi, 1
cmp eax, edi
je 0x489852
cmp eax, 2
jne 0x4898a4
mov edx, dword [0x5629f0]
mov eax, dword [0x5629ec]
mov ecx, dword [0x5629e8]
push edx
push eax
push ecx
lea edx, [esp + 0x16c]
push str._dd_dh_dm
push edx
call fcn.004af01a
add esp, 0x14
cmp dword [0x5629e4], edi
jne 0x489892
lea eax, [esp + 0x160]
push eax
mov ecx, 0x5338fc
jmp 0x48989f
lea ecx, [esp + 0x160]
push ecx
mov ecx, 0x533920
call fcn.00472920
mov eax, dword [0x5629dc]
cmp eax, ebx
je 0x4898b5
push eax
call fcn.004819f0
jmp 0x4898d9
cmp byte [0x526d89], bl
je 0x4898d9
cmp dword [esp + 0x130], ebx
je 0x4898d9
cmp word [0x5306f8], 0x2a
jne 0x4898d9
xor edx, edx
mov word [0x5306f8], dx
mov eax, dword [0x536aac]
cmp dword [eax + 0x20], ebx
jne 0x48990a
push 0x30
push 0x65
call fcn.00466160
push eax
push 0x14b
call fcn.00466160
mov ecx, dword [0x527edc]
push eax
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x489a5b
cmp word [0x531efa], bx
je 0x48997f
cmp dword [0x5326fc], ebx
jne 0x48997f
push ebx
push 0x4c7a18
push 0x531efa
call fcn.00432c30
mov esi, eax
cmp esi, ebx
je 0x48997f
push esi
push 0x400
lea edx, [esp + 0x1b8]
push edi
push edx
call fcn.004b21ea
add esp, 0x10
mov dword [esp + 0xc], 0x30c
cmp eax, ebx
jbe 0x489976
lea ecx, [esp + 0xc]
push ecx
push eax
lea edx, [esp + 0x1b8]
push edx
call dword [sym.imp.ADVAPI32.dll_IsTextUnicode]
test eax, eax
je 0x489976
mov dword [0x5326fc], 3
push esi
call fcn.004b227e
add esp, 4
cmp word [0x533304], bx
mov ecx, 0x527ee0
setne al
mov byte [0x527f0c], al
call fcn.0046f130
cmp byte [0x5629f6], bl
je 0x4899a7
call fcn.00487890
jmp 0x4899b9
movzx ecx, byte [0x535243]
push ecx
mov ecx, 0x52dfe8
call fcn.00417650
cmp dword [0x5629dc], ebx
je 0x4899cb
push 0x531efa
call fcn.00432770
cmp dword [0x5275a4], edi
je 0x489a5b
cmp byte [0x526d89], bl
je 0x4899eb
mov ecx, 0x52d6c0
call fcn.00448e00
jmp 0x489a5b
cmp byte [0x533872], bl
je 0x4899fd
mov ecx, 0x52d698
call fcn.00475880
push 0x400
lea edx, [esp + 0x1b4]
push edx
call fcn.0048b200
lea eax, [esp + 0x1b0]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x489a20
sub eax, edx
sar eax, 1
push eax
push 0x5362aa
lea eax, [esp + 0x1b8]
push eax
call fcn.00478050
push 0x5362aa
test eax, eax
jne 0x489a51
call fcn.00455e10
push eax
mov ecx, 0x52d6c0
call fcn.004473c0
mov ecx, dword [0x5629dc]
push ecx
call fcn.004afc55
add esp, 4
mov ecx, 0x527ee0
mov byte [0x527f0c], bl
call fcn.0046f130
mov ecx, dword [esp + 0x9b0]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004af00b
add esp, 0x9a8
ret 0xc