Function at 0x488370
Capabilities:
Create thread
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59f5b9
mov eax, dword fs:[0]
push eax
sub esp, 0x474
mov eax, dword [0x60f520]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x438], ecx
mov ecx, dword [ecx + 0x100]
mov eax, dword [ebp + 0xc]
test ecx, ecx
jne 0x4883b8
xor eax, eax
jmp 0x488c13
push eax
call fcn.00471250
mov dword [ebp - 0x434], eax
test eax, eax
je 0x4883b1
xor eax, eax
push eax
push eax
mov dword [ebp - 0x450], eax
call fcn.0043b100
mov dword [ebp - 0x454], eax
xor ecx, ecx
mov dword [ebp - 4], 0
push ecx
push ecx
mov dword [ebp - 0x43c], ecx
call fcn.0043b100
mov dword [ebp - 0x440], eax
mov byte [ebp - 4], 1
call fcn.0040bce0
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x488419
push 0x80004005
call fcn.0040c390
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
lea ebx, [eax + 0x10]
mov dword [ebp - 0x464], ebx
push 3
mov byte [ebp - 4], 2
call fcn.00422b20
mov ecx, eax
call fcn.00484d30
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov esi, dword [eax]
cmp esi, eax
je 0x488bbe
lea ebx, [ebx]
push dword [esi + 8]
lea edi, [esi + 8]
call dword [sym.imp.SHLWAPI.dll_PathIsRootW]
push edi
test eax, eax
je 0x48849a
mov edi, dword [ebp - 0x454]
push dword [edi + 4]
push edi
call fcn.0043ac00
mov edx, dword [ebp - 0x450]
mov ecx, 0x15555554
sub ecx, edx
cmp ecx, 1
jb 0x48866d
mov dword [edi + 4], eax
inc edx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x450], edx
mov dword [ecx], eax
jmp 0x488567
mov eax, dword [ebp - 0x440]
push dword [eax + 4]
push eax
call fcn.0043ac00
mov edx, eax
mov ecx, 0x15555554
mov eax, dword [ebp - 0x43c]
sub ecx, eax
cmp ecx, 1
jb 0x48866d
inc eax
mov dword [ebp - 0x43c], eax
mov eax, dword [ebp - 0x440]
mov dword [eax + 4], edx
mov ecx, dword [edx + 4]
mov dword [ecx], edx
push dword [edi]
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea ecx, [ebp - 0x448]
call fcn.0040c2d0
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x434]
mov eax, dword [ecx]
call dword [eax + 0x13c]
mov dword [ebp - 0x460], eax
lea eax, [ebp - 0x460]
push eax
push ecx
mov ecx, dword [ebp - 0x448]
mov edi, esp
mov dword [ebp - 0x45c], 3
mov dword [ebp - 0x444], esp
lea ecx, [ecx - 0x10]
call fcn.0040c3c0
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 4
call fcn.00422b20
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.00484b80
mov byte [ebp - 4], 2
or ecx, 0xffffffff
mov edx, dword [ebp - 0x448]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x488567
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp + 8]
mov esi, dword [esi]
cmp esi, dword [eax]
jne 0x488450
mov ecx, dword [ebp - 0x43c]
test ecx, ecx
je 0x4888be
mov edi, dword [ebp - 0x438]
lea esi, [edi + 0x110]
mov ecx, esi
call fcn.0043b080
lea eax, [ebp - 0x440]
cmp esi, eax
je 0x4885af
mov eax, dword [ebp - 0x440]
mov ecx, esi
push eax
push dword [eax]
call fcn.0048a2c0
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push edi
push 0x489430
push 0
push 0
mov dword [edi + 0x118], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.USER32.dll_PeekMessageW]
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageW]
mov eax, dword [ebp - 0x438]
push 0x4ff
push 0x3e8
push 0
add eax, 0x118
push eax
push 1
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
sub eax, 0
je 0x488677
dec eax
jne 0x4885f0
mov ecx, dword [ebp - 0x438]
push eax
push dword [ecx + 0x118]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x488677
push 1
push 0
push 0
push 0
lea eax, [ebp - 0x480]
push eax
call esi
test eax, eax
je 0x4885f0
lea eax, [ebp - 0x480]
push eax
call edi
lea eax, [ebp - 0x480]
push eax
call ebx
push 1
push 0
push 0
push 0
lea eax, [ebp - 0x480]
push eax
call esi
test eax, eax
jne 0x488644
jmp 0x4885f0
push str.list_T__too_long
call fcn.005502bf
mov esi, dword [ebp - 0x438]
push dword [esi + 0x118]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x118], 0
call fcn.0040bce0
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x4886af
push 0x80004005
call fcn.0040c390
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
lea ebx, [eax + 0x10]
mov dword [ebp - 0x448], ebx
mov byte [ebp - 4], 5
mov ecx, 1
mov eax, dword [ebx - 8]
sub ecx, dword [ebx - 4]
sub eax, 0x104
or ecx, eax
jge 0x4886ed
push 0x104
lea ecx, [ebp - 0x448]
call fcn.0040c110
mov ebx, dword [ebp - 0x448]
push 0
push 0x10
push ebx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push dword [ebx - 8]
push ebx
call fcn.00551cd2
add esp, 8
test eax, eax
js 0x4888fe
cmp eax, dword [ebx - 8]
jg 0x4888fe
xor ecx, ecx
mov dword [ebx - 0xc], eax
mov word [ebx + eax*2], cx
mov ecx, dword [esi + 0x11c]
cmp dword [ecx - 0xc], 0
je 0x488753
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x488741
push 0x80004005
call fcn.0040c390
push ecx
push ebx
call fcn.00551d79
add esp, 8
test eax, eax
jne 0x48889a
mov ecx, dword [ebp - 0x434]
mov eax, dword [ecx]
call dword [eax + 0x13c]
push eax
push ecx
call fcn.00409c60
add esp, 4
mov ecx, eax
call fcn.00456380
mov dword [ebp - 0x45c], eax
mov eax, dword [ebp - 0x440]
mov edi, dword [eax]
cmp edi, eax
je 0x48889a
call fcn.0040bce0
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x48840f
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x458], esi
mov byte [ebp - 4], 6
mov ecx, 1
mov eax, dword [edi + 8]
sub ecx, dword [esi - 4]
mov dword [ebp - 0x44c], eax
mov eax, dword [esi - 8]
sub eax, 0x400
or eax, ecx
jge 0x4887e3
push 0x400
lea ecx, [ebp - 0x458]
call fcn.0040c110
mov esi, dword [ebp - 0x458]
push dword [ebp - 0x44c]
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
push ebx
push esi
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push dword [esi - 8]
push esi
call fcn.00551cd2
add esp, 8
test eax, eax
js 0x4888fe
cmp eax, dword [esi - 8]
jg 0x4888fe
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
mov ecx, dword [ebp - 0x45c]
push esi
call fcn.004509b0
mov ecx, eax
test ecx, ecx
je 0x48886e
cmp dword [ecx + 0x1c], 0
je 0x48886e
mov edx, dword [ebp - 0x434]
mov eax, dword [ecx + 0x20]
mov dword [ebp - 0x44c], eax
push 1
mov eax, dword [edx]
add eax, 0x138
mov dword [ebp - 0x444], eax
mov eax, dword [ecx]
call dword [eax + 0x20]
mov ecx, dword [ebp - 0x434]
push eax
mov eax, dword [ebp - 0x444]
push dword [ebp - 0x44c]
call dword [eax]
add esi, 0xfffffff0
mov byte [ebp - 4], 5
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x48888c
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [edi]
cmp edi, dword [ebp - 0x440]
jne 0x488788
add ebx, 0xfffffff0
mov byte [ebp - 4], 2
or ecx, 0xffffffff
lea eax, [ebx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4888b8
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
mov ebx, dword [ebp - 0x464]
mov eax, dword [ebp - 0x450]
test eax, eax
je 0x488bbe
mov edi, dword [ebp - 0x438]
mov eax, dword [edi + 0x11c]
cmp dword [eax - 0xc], 0
jne 0x4889a1
call fcn.0040bce0
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x488908
push 0x80004005
call fcn.0040c390
push 0x80070057
call fcn.0040c390
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x434], esi
mov byte [ebp - 4], 7
mov ecx, 1
mov eax, dword [esi - 8]
sub ecx, dword [esi - 4]
sub eax, 0x104
or eax, ecx
jge 0x488946
push 0x104
lea ecx, [ebp - 0x434]
call fcn.0040c110
mov esi, dword [ebp - 0x434]
push 0
push 0x10
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push dword [esi - 8]
push esi
call fcn.00551cd2
add esp, 8
test eax, eax
js 0x4888fe
cmp eax, dword [esi - 8]
jg 0x4888fe
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
lea eax, [ebp - 0x434]
push eax
lea ecx, [edi + 0x11c]
call fcn.0040b7d0
add esi, 0xfffffff0
mov byte [ebp - 4], 2
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4889a1
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x454]
mov edi, dword [eax]
cmp edi, eax
je 0x488bbe
mov esi, dword [edi + 8]
sub esi, 0x10
mov ecx, dword [esi]
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [esi + 0xc], 0
lea edx, [esi + 0xc]
mov ecx, eax
jl 0x4889d8
cmp ecx, dword [esi]
jne 0x4889d8
mov eax, 1
lock xadd dword [edx], eax
jmp 0x488a20
mov eax, dword [ecx]
push 2
push dword [esi + 4]
call dword [eax]
mov edx, eax
mov dword [ebp - 0x444], edx
test edx, edx
je 0x488c31
mov ecx, dword [esi + 4]
mov dword [edx + 4], ecx
mov ecx, dword [esi + 4]
lea eax, [ecx*2 + 2]
push eax
lea eax, [esi + 0x10]
push eax
lea eax, [ecx*2 + 2]
push eax
lea eax, [edx + 0x10]
push eax
call fcn.00551ae9
mov esi, dword [ebp - 0x444]
add esp, 0x10
add esi, 0x10
mov dword [ebp - 0x444], esi
push 0x20a
lea eax, [ebp - 0x430]
mov byte [ebp - 4], 8
push 0
push eax
call fcn.00559380
add esp, 0xc
lea eax, [ebp - 0x220]
push 0x20a
push 0
push eax
call fcn.00559380
add esp, 0xc
call fcn.0040bce0
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x48840f
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x434], eax
push 0x105
lea eax, [ebp - 0x430]
mov byte [ebp - 4], 9
push eax
lea eax, [ebp - 0x44c]
push eax
push 0
lea eax, [ebp - 0x458]
push eax
push 0x105
lea eax, [ebp - 0x220]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x488acc
lea eax, [ebp - 0x220]
push 0x105
push eax
call fcn.00551cd2
add esp, 8
test eax, eax
jne 0x488af0
cmp dword [esi - 0xc], 0
jl 0x4888fe
movzx eax, word [esi]
push eax
lea eax, [ebp - 0x434]
push str._g0W
push eax
call fcn.00422de0
add esp, 0xc
jmp 0x488b19
cmp dword [esi - 0xc], 0
jl 0x4888fe
movzx eax, word [esi]
push eax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x434]
push str._s___c___
push eax
call fcn.00422de0
add esp, 0x10
mov edx, dword [ebp - 0x438]
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x45c]
lea edx, [edx + 0x11c]
call fcn.00513e30
sub esp, 8
mov byte [ebp - 4], 0xa
mov ecx, dword [eax]
mov edx, esi
call fcn.0050b6b0
mov byte [ebp - 4], 9
add esp, 0xc
mov edx, dword [ebp - 0x45c]
or ecx, 0xffffffff
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x488b6e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 8
or ecx, 0xffffffff
mov edx, dword [ebp - 0x434]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x488b92
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 0xfffffff0
mov byte [ebp - 4], 2
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x488bb0
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [edi]
cmp edi, dword [ebp - 0x454]
jne 0x4889b1
lea edx, [ebx - 0x10]
mov byte [ebp - 4], 1
lea eax, [edx + 0xc]
or ebx, 0xffffffff
lock xadd dword [eax], ebx
dec ebx
test ebx, ebx
jg 0x488bdc
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x440]
call fcn.0043b080
push dword [ebp - 0x440]
call fcn.00551995
add esp, 4
lea ecx, [ebp - 0x454]
call fcn.0043b080
push dword [ebp - 0x454]
call fcn.00551995
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055199a
mov esp, ebp
pop ebp
ret 8
call fcn.0040c3b0
int3