Function at 0x48cad0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x6aae14]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov dword [ebp - 0x10c], 0
call fcn.004501f0
mov ecx, dword [0x6ae144]
mov eax, dword [0x6e91c4]
test ecx, ecx
je 0x48cb07
test eax, eax
jne 0x48cb12
test al, al
js 0x48cb12
xor esi, esi
lea edi, [esi + 1]
jmp 0x48cb19
mov edi, 1
mov esi, edi
cmp dword [0x72bcb8], edi
jne 0x48cb45
mov edx, dword [ebp + 8]
push esi
push edx
push ecx
push eax
push str._DCH__Dwlf0x_x__SMB_u__FW:_d__FinalVal:_u_
push 0x6b1620
call fcn.004f0f30
mov ecx, dword [0x6ae144]
mov eax, dword [0x6e91c4]
add esp, 0x18
test eax, eax
je 0x48cb65
test ecx, ecx
jne 0x48cb65
test al, al
js 0x48cb65
push ecx
push edi
push str._DCH__IGNORING_LogFilesCopiedToUSB::::_FEATURE_AVAILABLE_ONLY_IN_CORP_EDITION...
push 0x6aec98
call fcn.004311c0
add esp, 0x10
test esi, esi
je 0x48ce66
push 0x72bcb8
push str.DebugDirChange
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
push 0x6861e0
push str.LogFilesCopiedAllActionsNew
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
push 0x6861e4
push str.LogFilesCopiedIgnoreSystemDrive
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
push 0x6861e8
push str.LogFilesCopiedIgnoreFilesWithoutExtension
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
push 0x72d014
push str.LogFilesCopiedMonitorExtensionTypes
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
cmp dword [0x72bcb8], edi
jne 0x48cc1e
mov eax, dword [0x72d014]
mov ecx, dword [0x6861e8]
mov edx, dword [0x6861e4]
push eax
mov eax, dword [0x6861e0]
push ecx
push edx
push eax
push str._DCH__LogNew_u__Sys_u__LFIExt_u__MonExt_u
push 0x6b1620
call fcn.004f0f30
add esp, 0x18
or edi, 0xffffffff
cmp dword [0x6861e0], 0
je 0x48cd6a
cmp dword [0x7330e4], 0
mov esi, dword [sym.imp.KERNEL32.dll_ResetEvent]
jne 0x48cc9e
mov ecx, dword [0x6b030c]
push 0
push 0
push str.ESMediaRemoved
push 0
push 1
push ecx
call fcn.00507af0
mov dword [0x7330e4], eax
test eax, eax
je 0x48cc88
cmp eax, edi
je 0x48cc88
cmp dword [0x72bcb8], 1
jne 0x48cc83
push str._DCH__ESMediaRemoved_Event_Created...
push 0x6b1620
call fcn.004f0f30
mov eax, dword [0x7330e4]
add esp, 8
push eax
call esi
jmp 0x48cc9e
push 0
push 1
push str._DCH__ERROR:_Unable_To_Create_The_hMediaRemoved_Event_
push 0x6aec98
call fcn.004311c0
add esp, 0x10
cmp dword [0x7330e8], 0
jne 0x48cd08
mov edx, dword [0x6b030c]
push 0
push 0
push str.ESMediaAdded
push 0
push 1
push edx
call fcn.00507af0
mov dword [0x7330e8], eax
test eax, eax
je 0x48ccf2
cmp eax, edi
je 0x48ccf2
cmp dword [0x72bcb8], 1
jne 0x48cced
push str._DCH__hMediaAdded_Event_Created...
push 0x6b1620
call fcn.004f0f30
mov eax, dword [0x7330e8]
add esp, 8
push eax
call esi
jmp 0x48cd08
push 0
push 1
push str._DCH__ERROR:_Unable_To_Create_The_hMediaAdded_Event_
push 0x6aec98
call fcn.004311c0
add esp, 0x10
push 2
call fcn.00477130
add esp, 4
cmp dword [0x72d010], 0
jne 0x48cd6a
push 0
push 0
push 0x48c790
mov dword [0x72d010], 1
call fcn.005e07ac
push 0
push eax
push str.CBD_6s
call fcn.00420720
add esp, 0x18
cmp dword [0x7330e8], 0
je 0x48cd6a
push 0
push 0
push 0x48ad60
call fcn.005e07ac
push 0
push eax
push str.CBD_6t
call fcn.00420720
add esp, 0x18
cmp dword [0x685bcc], 0
jne 0x48cdb5
push 0
push 1
push 0
push 0x2000d14
call dword [0x6e9118]
add esp, 0x10
test eax, eax
jl 0x48cef7
push 0
push 1
push str.Previous_Exclude_File_Extensions_Successfully_Cleared
push 0x6aec98
call fcn.004311c0
add esp, 0x10
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005dfbbe
mov esp, ebp
pop ebp
ret
cmp dword [0x72c24c], 1
je 0x48cef7
mov eax, dword [0x72c124]
test eax, eax
je 0x48cef7
cmp byte [eax], 0
je 0x48cef7
call fcn.00456ba0
mov edx, dword [0x72c124]
push 1
push 0
push 0x2c
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x108]
push ecx
push edx
mov dword [ebp - 0x10c], 0
call fcn.004e1380
add esp, 0x18
cmp dword [ebp - 0x10c], edi
je 0x48cef7
jmp 0x48ce20
lea eax, [ebp - 0x108]
push eax
call fcn.00456f70
mov eax, dword [0x72c124]
push 1
push 0
push 0x2c
lea ecx, [ebp - 0x10c]
push ecx
lea edx, [ebp - 0x108]
push edx
push eax
call fcn.004e1380
add esp, 0x1c
cmp dword [ebp - 0x10c], edi
jne 0x48ce20
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005dfbbe
mov esp, ebp
pop ebp
ret
cmp dword [0x72c244], edi
je 0x48cef7
mov eax, dword [0x72c22c]
test eax, eax
je 0x48cef7
cmp byte [eax], 0
je 0x48cef7
call fcn.00456ba0
mov eax, dword [0x72c22c]
push edi
push 0
push 0x2c
lea ecx, [ebp - 0x10c]
push ecx
lea edx, [ebp - 0x108]
push edx
push eax
mov dword [ebp - 0x10c], 0
call fcn.004e1380
or edi, 0xffffffff
add esp, 0x18
cmp dword [ebp - 0x10c], edi
je 0x48cef7
jmp 0x48cec0
lea ecx, [ebp - 0x108]
push ecx
call fcn.00456f70
mov ecx, dword [0x72c22c]
push 1
push 0
push 0x2c
lea edx, [ebp - 0x10c]
push edx
lea eax, [ebp - 0x108]
push eax
push ecx
call fcn.004e1380
add esp, 0x1c
cmp dword [ebp - 0x10c], edi
jne 0x48cec0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.005dfbbe
mov esp, ebp
pop ebp
ret