Function at 0x4e2dc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6287f5
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x6ec7c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.CShellImageList::LoadPluginIcons
lea ecx, [ebp - 0x48]
call fcn.00562ae0
push str.Default
lea ecx, [ebp - 0x4c]
mov dword [ebp - 4], 0
call dword [0x63ea98]
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 1
push str.IDI_RFS_PLG_DEFAULT
push eax
call fcn.004e2c70
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call dword [0x63f5a8]
push str.Unavailable
lea ecx, [ebp - 0x4c]
call dword [0x63ea98]
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 2
push str.IDI_RFS_UNAVAILABLE_PLG
push eax
call fcn.004e2c70
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call dword [0x63f5a8]
push 0x65f7d4
lea ecx, [ebp - 0x4c]
call dword [0x63ea98]
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 3
push str.IDI_RFS_WARNING_MSG
push eax
call fcn.004e2c70
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call dword [0x63f5a8]
push 0x65f80c
lea ecx, [ebp - 0x4c]
call dword [0x63ea98]
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 4
push str.IDI_RFS_WORKSTATION
push eax
call fcn.004e2c70
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call dword [0x63f5a8]
push 0x64371c
lea ecx, [ebp - 0x4c]
call dword [0x63ea98]
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 5
push str.IDI_RFS_LINK
push eax
call fcn.004e2c70
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call dword [0x63f5a8]
push str.Category
lea ecx, [ebp - 0x4c]
call dword [0x63ea98]
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 6
push str.IDI_RFS_CATEGORY
push eax
call fcn.004e2c70
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call dword [0x63f5a8]
push str.Favourites
lea ecx, [ebp - 0x4c]
call dword [0x63ea98]
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 7
push str.IDI_RFS_CATEGORY_FAVOURITES
push eax
call fcn.004e2c70
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call dword [0x63f5a8]
push str.Amazon_S3
lea ecx, [ebp - 0x4c]
call dword [0x63ea98]
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 8
push str.IDI_RFS_PLG_AMAZON
push eax
call fcn.004e2c70
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call dword [0x63f5a8]
push 0x647b30
lea ecx, [ebp - 0x4c]
call dword [0x63ea98]
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 9
push str.IDI_RFS_PLG_DB2
push eax
call fcn.004e2c70
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call dword [0x63f5a8]
push str.Disk_Image
lea ecx, [ebp - 0x4c]
call dword [0x63ea98]
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 0xa
push str.IDI_RFS_PLG_DISCIMAGE
push eax
call fcn.004e2c70
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call dword [0x63f5a8]
push str.System_Recovery
lea ecx, [ebp - 0x4c]
call dword [0x63ea98]
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 0xb
push str.IDI_RFS_PLG_SYSTEMRECOVERY
push eax
call fcn.004e2c70
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call dword [0x63f5a8]
push str.Hyper_V
lea ecx, [ebp - 0x4c]
call dword [0x63ea98]
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 0xc
push str.IDI_RFS_PLG_HYPER_V
push eax
call fcn.004e2c70
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call dword [0x63f5a8]
push str.CD_DVD_Blu_ray
lea ecx, [ebp - 0x4c]
call dword [0x63ea98]
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 0xd
push str.IDI_RFS_PLG_DVD
push eax
call fcn.004e2c70
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call dword [0x63f5a8]
push 0x64492c
lea ecx, [ebp - 0x4c]
call dword [0x63ea98]
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 0xe
push str.IDI_RFS_PLG_FTP
push eax
call fcn.004e2c70
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call dword [0x63f5a8]
push 0x644940
lea ecx, [ebp - 0x4c]
call dword [0x63ea98]
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 0xf
push str.IDI_RFS_PLG_FTPS
push eax
call fcn.004e2c70
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call dword [0x63f5a8]
push str.Computer
lea ecx, [ebp - 0x4c]
call dword [0x63ea98]
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 0x10
push str.IDI_RFS_PLG_LOCALFS
push eax
call fcn.004e2c70
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call dword [0x63f5a8]
push str.Network
lea ecx, [ebp - 0x4c]
call dword [0x63ea98]
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 0x11
push str.IDI_RFS_PLG_NETWORK
push eax
call fcn.004e2c70
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call dword [0x63f5a8]
push str.Lotus_Notes
lea ecx, [ebp - 0x4c]
call dword [0x63ea98]
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 0x12
push str.IDI_RFS_PLG_LOTUSNOTES
push eax
call fcn.004e2c70
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call dword [0x63f5a8]
push str.MS_Exchange
lea ecx, [ebp - 0x4c]
call dword [0x63ea98]
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 0x13
push str.IDI_RFS_PLG_MSEXCHANGE
push eax
call fcn.004e2c70
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call dword [0x63f5a8]
push str.MSSQL
lea ecx, [ebp - 0x4c]
call dword [0x63ea98]
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 0x14
push str.IDI_RFS_PLG_MSSQL
push eax
call fcn.004e2c70
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call dword [0x63f5a8]
push str.MySQL
lea ecx, [ebp - 0x4c]
call dword [0x63ea98]
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 0x15
push str.IDI_RFS_PLG_MYSQL
push eax
call fcn.004e2c70
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call dword [0x63f5a8]
push str.MariaDB
lea ecx, [ebp - 0x4c]
call dword [0x63ea98]
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 0x16
push str.IDI_RFS_PLG_MARIADB
push eax
call fcn.004e2c70
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call dword [0x63f5a8]
push str.OneDrive
lea ecx, [ebp - 0x4c]
call dword [0x63ea98]
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 0x17
push str.IDI_RFS_PLG_ONEDRIVE
push eax
call fcn.004e2c70
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call dword [0x63f5a8]
push str.OneDrive_for_Business
lea ecx, [ebp - 0x4c]
call dword [0x63ea98]
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 0x18
push str.IDI_RFS_PLG_ONEDRIVE_FOR_BUSINESS
push eax
call fcn.004e2c70
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call dword [0x63f5a8]
push str.PostgreSQL
lea ecx, [ebp - 0x4c]
call dword [0x63ea98]
mov byte [ebp - 4], 0x19
lea eax, [ebp - 0x4c]
push str.IDI_RFS_PLG_PGSQL
push eax
call fcn.004e2c70
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call dword [0x63f5a8]
push str.Database
lea ecx, [ebp - 0x4c]
call dword [0x63ea98]
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 0x1a
push str.IDI_RFS_PLG_ODBC
push eax
call fcn.004e2c70
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call dword [0x63f5a8]
push str.Handy_Backup_Drive
lea ecx, [ebp - 0x4c]
call dword [0x63ea98]
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 0x1b
push str.IDI_RFS_PLG_HBDRIVE
push eax
call fcn.004e2c70
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call dword [0x63f5a8]
push str.Oracle
lea ecx, [ebp - 0x4c]
call dword [0x63ea98]
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 0x1c
push str.IDI_RFS_PLG_ORACLE
push eax
call fcn.004e2c70
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call dword [0x63f5a8]
push str.Outlook
lea ecx, [ebp - 0x4c]
call dword [0x63ea98]
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 0x1d
push str.IDI_RFS_PLG_OUTLOOK
push eax
call fcn.004e2c70
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call dword [0x63f5a8]
push 0x644934
lea ecx, [ebp - 0x4c]
call dword [0x63ea98]
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 0x1e
push str.IDI_RFS_PLG_SFTP
push eax
call fcn.004e2c70
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call dword [0x63f5a8]
push str.System_Registry
lea ecx, [ebp - 0x4c]
call dword [0x63ea98]
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 0x1f
push str.IDI_RFS_PLG_REGISTRY
push eax
call fcn.004e2c70
add esp, 8
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0
call dword [0x63f5a8]
push str.User_Folders
lea ecx, [ebp - 0x4c]
call dword [0x63ea98]
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 0x20
push str.IDI_RFS_PLG_SPECFOLDERS
push eax
call fcn.004e2c70
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call dword [0x63f5a8]
push 0x645c28
lea ecx, [ebp - 0x4c]
call dword [0x63ea98]
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 0x21
push str.IDI_RFS_PLG_1C_NEW
push eax
call fcn.004e2c70
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call dword [0x63f5a8]
push str.WebDAV
lea ecx, [ebp - 0x4c]
call dword [0x63ea98]
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 0x22
push str.IDI_RFS_PLG_WEB_DAV
push eax
call fcn.004e2c70
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call dword [0x63f5a8]
push str.Google_Drive
lea ecx, [ebp - 0x4c]
call dword [0x63ea98]
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 0x23
push str.IDI_RFS_PLG_GOOGLE_DRIVE
push eax
call fcn.004e2c70
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call dword [0x63f5a8]
push str.E_mail
lea ecx, [ebp - 0x4c]
call dword [0x63ea98]
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 0x24
push str.IDI_RFS_PLG_E_MAIL
push eax
call fcn.004e2c70
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call dword [0x63f5a8]
push 0x647bb0
lea ecx, [ebp - 0x4c]
call dword [0x63ea98]
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 0x25
push str.IDI_RFS_PLG_BOX
push eax
call fcn.004e2c70
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call dword [0x63f5a8]
push str.4shared
lea ecx, [ebp - 0x4c]
call dword [0x63ea98]
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 0x26
push str.IDI_RFS_PLG_4SHARED
push eax
call fcn.004e2c70
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call dword [0x63f5a8]
push str.Yandex_Disk
lea ecx, [ebp - 0x4c]
call dword [0x63ea98]
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 0x27
push str.IDI_RFS_PLG_YANDEX_DISK_NEW
push eax
call fcn.004e2c70
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call dword [0x63f5a8]
push str.Registry
lea ecx, [ebp - 0x4c]
call dword [0x63ea98]
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 0x28
push str.IDI_RFS_PLG_REGISTRY
push eax
call fcn.004e2c70
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call dword [0x63f5a8]
push str.Windows_Libraries
lea ecx, [ebp - 0x4c]
call dword [0x63ea98]
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 0x29
push str.IDI_RFS_PLG_WINLIBS
push eax
call fcn.004e2c70
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call dword [0x63f5a8]
push str.More_places
lea ecx, [ebp - 0x4c]
call dword [0x63ea98]
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 0x2a
push str.IDI_RFS_PLG_MORE_PLACES
push eax
call fcn.004e2c70
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call dword [0x63f5a8]
push str.Dropbox
lea ecx, [ebp - 0x4c]
call dword [0x63ea98]
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 0x2b
push str.IDI_RFS_PLG_DROPBOX_BUSINESS
push eax
call fcn.004e2c70
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call dword [0x63f5a8]
push str.Dropbox_Business
lea ecx, [ebp - 0x4c]
call dword [0x63ea98]
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 0x2c
push str.IDI_RFS_PLG_DROPBOX_BUSINESS
push eax
call fcn.004e2c70
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call dword [0x63f5a8]
push str.VMWare_Workstation
lea ecx, [ebp - 0x4c]
call dword [0x63ea98]
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 0x2d
push str.IDI_RFS_PLG_VMWARE_WORKSTATION
push eax
call fcn.004e2c70
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call dword [0x63f5a8]
push str.BackBlaze
lea ecx, [ebp - 0x4c]
call dword [0x63ea98]
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 0x2e
push str.IDI_RFS_PLG_BACKBLAZE
push eax
call fcn.004e2c70
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call dword [0x63f5a8]
push str.Mail.ru_HotBox
lea ecx, [ebp - 0x4c]
call dword [0x63ea98]
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 0x2f
push str.IDI_RFS_PLG_MAIL_HOTBOX
push eax
call fcn.004e2c70
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call dword [0x63f5a8]
push str.Mail.ru_IceBox
lea ecx, [ebp - 0x4c]
call dword [0x63ea98]
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 0x30
push str.IDI_RFS_PLG_MAIL_ICEBOX
push eax
call fcn.004e2c70
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call dword [0x63f5a8]
push str.Gmail
lea ecx, [ebp - 0x4c]
call dword [0x63ea98]
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 0x31
push str.IDI_RFS_PLG_GMAIL
push eax
call fcn.004e2c70
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call dword [0x63f5a8]
push str.S3_Cloud
lea ecx, [ebp - 0x4c]
call dword [0x63ea98]
mov byte [ebp - 4], 0x32
push str.IDI_RFS_PLG_S3_CLOUD
lea eax, [ebp - 0x4c]
push eax
call fcn.004e2c70
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call dword [0x63f5a8]
push str.My_Desktop
lea ecx, [ebp - 0x4c]
call dword [0x63ea98]
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 0x33
push str.IDI_RFS_PLG_MY_DESKTOP
push eax
call fcn.004e2c70
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call dword [0x63f5a8]
push str.My_Documents
lea ecx, [ebp - 0x50]
call dword [0x63ea98]
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 0x34
push str.IDI_RFS_PLG_MY_DOCUMENTS
push eax
call fcn.004e2c70
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x50]
call dword [0x63f5a8]
push str.My_Music
lea ecx, [ebp - 0x54]
call dword [0x63ea98]
lea eax, [ebp - 0x54]
mov byte [ebp - 4], 0x35
push str.IDI_RFS_PLG_MY_MUSIC
push eax
call fcn.004e2c70
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x54]
call dword [0x63f5a8]
push str.My_Pictures
lea ecx, [ebp - 0x58]
call dword [0x63ea98]
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 0x36
push str.IDI_RFS_PLG_MY_PICTURES
push eax
call fcn.004e2c70
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x58]
call dword [0x63f5a8]
push str.My_Videos
lea ecx, [ebp - 0x5c]
call dword [0x63ea98]
lea eax, [ebp - 0x5c]
mov byte [ebp - 4], 0x37
push str.IDI_RFS_PLG_MY_VIDEOS
push eax
call fcn.004e2c70
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x5c]
call dword [0x63f5a8]
push str.VK_Cloud
lea ecx, [ebp - 0x60]
call dword [0x63ea98]
lea eax, [ebp - 0x60]
mov byte [ebp - 4], 0x38
push str.IDI_RFS_PLG_VK_CLOUD
push eax
call fcn.004e2c70
add esp, 8
lea ecx, [ebp - 0x60]
call dword [0x63f5a8]
lea ecx, [ebp - 0x48]
call fcn.005630c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00604ed9
mov esp, ebp
pop ebp
ret