Function at 0x4810d0
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f0b51
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x2e0
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x2dc], esi
mov edi, dword [ebx + 8]
mov ecx, dword [edi + 0x68]
test ecx, ecx
je 0x481fa9
call fcn.005dd5b0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x481fa9
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
xorps xmm0, xmm0
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 0x2c]
movq qword [ebp - 0x2c], xmm0
call fcn.005dc5e0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x20]
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
movq qword [ebp - 0x20], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x48], 0
lea ecx, [ebp - 0x50]
movq qword [ebp - 0x50], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x3c], 0
lea ecx, [ebp - 0x44]
movq qword [ebp - 0x44], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x6c], 0
lea ecx, [ebp - 0x74]
movq qword [ebp - 0x74], xmm0
call fcn.005dc5e0
push 0
push str.BackupOptions
mov byte [ebp - 4], 4
mov ecx, dword [edi + 0x68]
push str.Settings
call fcn.005dd290
mov ecx, dword [edi + 0x68]
push 0
push str.SkipAttributes
push str.Settings
mov dword [edi + 8], eax
call fcn.005dd290
xorps xmm0, xmm0
mov dword [edi + 0xc], eax
lea ecx, [ebp - 0x68]
movq qword [ebp - 0x68], xmm0
mov dword [ebp - 0x60], 0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x30], 0
lea ecx, [ebp - 0x38]
movq qword [ebp - 0x38], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x54], 0
lea ecx, [ebp - 0x5c]
movq qword [ebp - 0x5c], xmm0
call fcn.005dc5e0
push 1
push 0
push 0
push 5
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 7
call fcn.005dbbc0
mov ecx, eax
call fcn.005dbf40
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x62794c
lea ecx, [ebp - 0x38]
call fcn.005dc190
push eax
push 0x62794c
lea ecx, [ebp - 0x68]
call fcn.005da780
push 1
push 0
push 0
push 0x10
lea ecx, [ebp - 0x38]
call fcn.005dbbc0
mov ecx, eax
call fcn.005dbf40
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x62794c
lea ecx, [ebp - 0x38]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x68]
call fcn.005da780
push 1
push 0
push 0
push 0xd
lea ecx, [ebp - 0x38]
call fcn.005dbbc0
mov ecx, eax
call fcn.005dbf40
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x62794c
lea ecx, [ebp - 0x38]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x68]
call fcn.005da780
push 1
push 0
push 0
push 0x27
lea ecx, [ebp - 0x38]
call fcn.005dbbc0
mov ecx, eax
call fcn.005dbf40
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x62794c
lea ecx, [ebp - 0x38]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x68]
call fcn.005da780
push 1
push 0
push 0
push 0xe
lea ecx, [ebp - 0x38]
call fcn.005dbbc0
mov ecx, eax
call fcn.005dbf40
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x62794c
lea ecx, [ebp - 0x38]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x68]
call fcn.005da780
push ecx
lea ecx, [esi + 0x1290]
call fcn.0057c330
push eax
lea eax, [ebp - 0x38]
push eax
push ecx
lea ecx, [esi + 0x1290]
call fcn.0057c2d0
mov edx, str.374DE290_123F_4565_9164_39C4925E467B
mov ecx, eax
call fcn.0059c9b0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Appdata
push 1
lea ecx, [ebp - 0x38]
call fcn.005dbf40
mov ecx, eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x68]
call fcn.005da780
push 0x250
xor esi, esi
lea eax, [ebp - 0x2d8]
xorps xmm0, xmm0
push esi
movups xmmword [ebp - 0x88], xmm0
push eax
mov dword [ebp - 0x88], 0xffffffff
call fcn.00420090
add esp, 0xc
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push 0x65c3f4
push esi
mov byte [ebp - 4], 8
mov ecx, dword [edi + 0x68]
push 1
call fcn.005dd5b0
push eax
lea ecx, [ebp - 0x50]
call fcn.005dc260
mov ecx, eax
call fcn.005dbed0
mov ecx, eax
call fcn.005da780
mov ecx, dword [edi + 0x68]
push esi
push str.UserFolders
push str.Settings
call fcn.005dd290
xor edx, edx
mov dword [ebp - 0x2e0], eax
mov dword [ebp - 0x2e4], edx
test eax, eax
je 0x48147e
mov ecx, dword [edi + 0x68]
lea eax, [ebp - 0x2e4]
push eax
push str.BackupUsers
call fcn.005dcc50
mov edx, dword [ebp - 0x2e4]
jmp 0x481480
xor eax, eax
cmp dword [edi], 0
jne 0x481f50
test eax, eax
je 0x481e29
cmp edx, eax
jbe 0x481e29
mov ecx, dword [edi + 0x68]
push edx
push eax
call fcn.005dc700
mov ecx, eax
mov dword [ebp - 0x2e8], ecx
test ecx, ecx
je 0x481e29
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x44]
push eax
push ecx
mov ecx, dword [edi + 0x68]
call fcn.005dc660
test al, al
je 0x481e05
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x44]
call fcn.005dc190
lea edx, [ebp - 0x5c]
mov ecx, eax
call fcn.0059d880
test al, al
je 0x481e05
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x44]
call fcn.005dc190
push eax
push 0x624284
lea ecx, [ebp - 0x50]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005dc200
lea ecx, [ebp - 0x20]
call fcn.005dc190
or edx, 0xffffffff
mov ecx, eax
call fcn.005e0f30
test al, al
je 0x481e05
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.AppData
lea ecx, [ebp - 0x44]
call fcn.005dc190
push eax
push 0x624284
lea ecx, [ebp - 0x50]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005dc200
mov eax, dword [ebp - 0x2e0]
and eax, 1
mov dword [ebp - 0x2ec], eax
je 0x481731
lea ecx, [ebp - 0x38]
call fcn.005dc190
push eax
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x5c]
call fcn.005dc190
mov edx, 0x62e5a4
mov ecx, eax
call fcn.0059c9b0
test al, al
je 0x481731
push 1
push edi
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2c]
call fcn.005dc190
mov ecx, dword [ebp - 0x2dc]
push eax
call fcn.00480da0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
movzx eax, al
lea ecx, [ebp - 0x20]
push str.MicrosoftWindowsThemes
add esi, eax
call fcn.005da780
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.MicrosoftWindowsThemes
lea ecx, [ebp - 0x2c]
call fcn.005da780
push 1
push edi
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2c]
call fcn.005dc190
mov ecx, dword [ebp - 0x2dc]
push eax
call fcn.00480da0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SendTo
movzx eax, al
lea ecx, [ebp - 0x20]
push 0
add esi, eax
call fcn.005dbed0
mov ecx, eax
call fcn.005da780
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SendTo
push 0
lea ecx, [ebp - 0x2c]
call fcn.005dbed0
mov ecx, eax
call fcn.005da780
push 1
push edi
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2c]
call fcn.005dc190
mov ecx, dword [ebp - 0x2dc]
push eax
call fcn.00480da0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Account_Pictures
movzx eax, al
lea ecx, [ebp - 0x20]
push 0
add esi, eax
call fcn.005dbed0
mov ecx, eax
call fcn.005da780
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Account_Pictures
push 0
lea ecx, [ebp - 0x2c]
call fcn.005dbed0
mov ecx, eax
call fcn.005da780
push 1
push edi
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2c]
call fcn.005dc190
mov ecx, dword [ebp - 0x2dc]
push eax
call fcn.00480da0
movzx eax, al
add esi, eax
cmp dword [edi], 0
jne 0x481f50
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x6cf2cc
lea ecx, [ebp - 0x44]
call fcn.005dc190
push eax
push 0x624284
lea ecx, [ebp - 0x50]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005dc200
cmp dword [ebp - 0x2ec], 0
je 0x481834
lea ecx, [ebp - 0x38]
call fcn.005dc190
push eax
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x5c]
call fcn.005dc190
mov edx, str.Local_AppData
mov ecx, eax
call fcn.0059c9b0
test al, al
je 0x481834
push 1
push edi
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2c]
call fcn.005dc190
mov ecx, dword [ebp - 0x2dc]
push eax
call fcn.00480da0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
movzx eax, al
lea ecx, [ebp - 0x20]
push str.MicrosoftWindowsThemes
add esi, eax
call fcn.005da780
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.MicrosoftWindowsThemes
lea ecx, [ebp - 0x2c]
call fcn.005da780
push 1
push edi
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2c]
call fcn.005dc190
mov ecx, dword [ebp - 0x2dc]
push eax
call fcn.00480da0
movzx eax, al
add esi, eax
cmp dword [edi], 0
jne 0x481f50
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Desktop
lea ecx, [ebp - 0x44]
call fcn.005dc190
push eax
push 0x624284
lea ecx, [ebp - 0x50]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005dc200
test byte [ebp - 0x2e0], 2
je 0x4818c4
lea ecx, [ebp - 0x38]
call fcn.005dc190
push eax
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x5c]
call fcn.005dc190
mov edx, 0x62e520
mov ecx, eax
call fcn.0059c9b0
test al, al
je 0x4818c4
push 0
push edi
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2c]
call fcn.005dc190
mov ecx, dword [ebp - 0x2dc]
push eax
call fcn.00480da0
movzx eax, al
add esi, eax
cmp dword [edi], 0
jne 0x481f50
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Documents
lea ecx, [ebp - 0x44]
call fcn.005dc190
push eax
push 0x624284
lea ecx, [ebp - 0x50]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005dc200
mov eax, dword [ebp - 0x2e0]
and eax, 4
mov dword [ebp - 0x2ec], eax
je 0x48195c
lea ecx, [ebp - 0x38]
call fcn.005dc190
push eax
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x5c]
call fcn.005dc190
mov edx, str.Personal
mov ecx, eax
call fcn.0059c9b0
test al, al
je 0x48195c
push 0
push edi
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2c]
call fcn.005dc190
mov ecx, dword [ebp - 0x2dc]
push eax
call fcn.00480da0
movzx eax, al
add esi, eax
cmp dword [edi], 0
jne 0x481f50
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x62e908
lea ecx, [ebp - 0x44]
call fcn.005dc190
push eax
push 0x624284
lea ecx, [ebp - 0x50]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005dc200
test byte [ebp - 0x2e0], 8
je 0x481a0a
mov eax, dword [ebp - 0x2dc]
movsd xmm0, qword [eax + 8]
comisd xmm0, xmmword [0x6edab0]
ja 0x4819c0
cmp dword [ebp - 0x2ec], 0
jne 0x481a0a
lea ecx, [ebp - 0x38]
call fcn.005dc190
push eax
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x5c]
call fcn.005dc190
mov edx, str.374DE290_123F_4565_9164_39C4925E467B
mov ecx, eax
call fcn.0059c9b0
test al, al
je 0x481a0a
push 0
push edi
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2c]
call fcn.005dc190
mov ecx, dword [ebp - 0x2dc]
push eax
call fcn.00480da0
movzx eax, al
add esi, eax
cmp dword [edi], 0
jne 0x481f50
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Music
lea ecx, [ebp - 0x44]
call fcn.005dc190
push eax
push 0x624284
lea ecx, [ebp - 0x50]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005dc200
test byte [ebp - 0x2e0], 0x10
je 0x481a9a
lea ecx, [ebp - 0x38]
call fcn.005dc190
push eax
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x5c]
call fcn.005dc190
mov edx, str.My_Music
mov ecx, eax
call fcn.0059c9b0
test al, al
je 0x481a9a
push 0
push edi
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2c]
call fcn.005dc190
mov ecx, dword [ebp - 0x2dc]
push eax
call fcn.00480da0
movzx eax, al
add esi, eax
cmp dword [edi], 0
jne 0x481f50
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Pictures
lea ecx, [ebp - 0x44]
call fcn.005dc190
push eax
push 0x624284
lea ecx, [ebp - 0x50]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005dc200
test byte [ebp - 0x2e0], 0x20
je 0x481b2a
lea ecx, [ebp - 0x38]
call fcn.005dc190
push eax
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x5c]
call fcn.005dc190
mov edx, str.My_Pictures
mov ecx, eax
call fcn.0059c9b0
test al, al
je 0x481b2a
push 0
push edi
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2c]
call fcn.005dc190
mov ecx, dword [ebp - 0x2dc]
push eax
call fcn.00480da0
movzx eax, al
add esi, eax
cmp dword [edi], 0
jne 0x481f50
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Videos
lea ecx, [ebp - 0x44]
call fcn.005dc190
push eax
push 0x624284
lea ecx, [ebp - 0x50]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005dc200
mov eax, dword [ebp - 0x2e0]
test al, 0x40
je 0x481bc1
lea ecx, [ebp - 0x38]
call fcn.005dc190
push eax
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x5c]
call fcn.005dc190
mov edx, str.My_Video
mov ecx, eax
call fcn.0059c9b0
test al, al
je 0x481bbb
push 0
push edi
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2c]
call fcn.005dc190
mov ecx, dword [ebp - 0x2dc]
push eax
call fcn.00480da0
movzx eax, al
add esi, eax
mov eax, dword [ebp - 0x2e0]
cmp dword [edi], 0
jne 0x481f50
test al, al
jns 0x481e05
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x6249f8
lea ecx, [ebp - 0x38]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2c]
call fcn.005dc200
lea ecx, [ebp - 0x2c]
call fcn.005dc190
mov ecx, dword [ebp - 0x88]
mov dword [ebp - 0x2ec], eax
cmp ecx, 0xffffffff
je 0x481c22
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x2ec]
lea ecx, [ebp - 0x2d8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edx, eax
mov dword [ebp - 0x88], edx
cmp edx, 0xffffffff
je 0x481e05
mov ecx, 5
mov dword [ebp - 0x84], ecx
nop dword [eax]
cmp word [ebp - 0x2ac], 0x2e
jne 0x481c7e
mov ax, word [ebp - 0x2aa]
test ax, ax
je 0x481dcc
cmp ax, 0x2e
jne 0x481c7e
cmp word [ebp - 0x2a8], 0
je 0x481dcc
test ecx, ecx
je 0x481cb0
mov eax, dword [ebp - 0x2d8]
test cl, 1
je 0x481c98
test eax, 0x400
jne 0x481dcc
test cl, 2
je 0x481dbb
test al, 0x10
jne 0x481dcc
nop dword [eax]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x62794c
lea eax, [ebp - 0x2ac]
push eax
push 0x62794c
lea ecx, [ebp - 0x2c]
call fcn.005dc200
push 0
push 1
push 1
push 0
lea ecx, [ebp - 0x2c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x68]
call fcn.005daa70
test eax, eax
jne 0x481d89
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x2ac]
push eax
push 0x624284
lea ecx, [ebp - 0x38]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2c]
call fcn.005dc200
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x2ac]
push eax
push 0x624284
lea ecx, [ebp - 0x44]
call fcn.005dc190
push eax
push 0x624284
lea ecx, [ebp - 0x50]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005dc200
push 0
push edi
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2c]
call fcn.005dc190
mov ecx, dword [ebp - 0x2dc]
push eax
call fcn.00480da0
movzx eax, al
add esi, eax
cmp dword [edi], 0
jne 0x481f50
mov eax, dword [ebp - 0x88]
cmp eax, 0xffffffff
je 0x481e05
lea ecx, [ebp - 0x2d8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x481def
lea ecx, [ebp - 0x2d8]
call fcn.004011a0
test al, al
jne 0x481cb0
jmp 0x481e05
test cl, 4
je 0x481cb0
test al, 0x10
jne 0x481cb0
lea eax, [ebp - 0x2d8]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x481def
mov ecx, dword [ebp - 0x84]
mov edx, dword [ebp - 0x88]
jmp 0x481c50
push dword [ebp - 0x88]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 0x88], 0xffffffff
push dword [ebp - 0x2e4]
mov ecx, dword [edi + 0x68]
push dword [ebp - 0x2e8]
call fcn.005dc700
mov ecx, eax
mov dword [ebp - 0x2e8], eax
test ecx, ecx
jne 0x4814b3
cmp dword [edi], 0
jne 0x481f50
push 0
lea ecx, [ebp - 0x50]
call fcn.005dbed0
mov ecx, dword [edi + 0x68]
lea eax, [ebp - 0x2e4]
push eax
push str.NewExtraFolders
mov dword [ebp - 0x2e4], 0
call fcn.005dcc50
cmp dword [edi], 0
mov ecx, eax
jne 0x481f53
test ecx, ecx
je 0x481f53
mov eax, dword [ebp - 0x2e4]
cmp eax, ecx
jbe 0x481f53
push eax
push ecx
mov ecx, dword [edi + 0x68]
call fcn.005dc700
mov dword [ebp - 0x2e8], eax
test eax, eax
je 0x481f53
lea ecx, [ebp - 0x74]
push ecx
lea ecx, [ebp - 0x44]
push ecx
mov ecx, dword [edi + 0x68]
push eax
call fcn.005dc660
test al, al
je 0x481f2c
lea ecx, [ebp - 0x44]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x481f2c
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x74]
call fcn.005dc190
push eax
push str.ExtraFolders_
lea ecx, [ebp - 0x50]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005dc200
lea ecx, [ebp - 0x20]
call fcn.005dc190
or edx, 0xffffffff
mov ecx, eax
call fcn.005e0f30
push 0
push edi
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x44]
call fcn.005dc190
mov ecx, dword [ebp - 0x2dc]
push eax
call fcn.00480da0
movzx eax, al
add esi, eax
cmp dword [edi], 0
jne 0x481f50
push dword [ebp - 0x2e4]
mov ecx, dword [edi + 0x68]
push dword [ebp - 0x2e8]
call fcn.005dc700
mov dword [ebp - 0x2e8], eax
test eax, eax
jne 0x481e93
jmp 0x481f53
or esi, 0xffffffff
mov eax, dword [ebp - 0x88]
cmp eax, 0xffffffff
je 0x481f65
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x5c]
call fcn.005dc430
lea ecx, [ebp - 0x38]
call fcn.005dc430
lea ecx, [ebp - 0x68]
call fcn.005dc430
lea ecx, [ebp - 0x74]
call fcn.005dc430
lea ecx, [ebp - 0x44]
call fcn.005dc430
lea ecx, [ebp - 0x50]
call fcn.005dc430
lea ecx, [ebp - 0x20]
call fcn.005dc430
lea ecx, [ebp - 0x2c]
call fcn.005dc430
mov eax, esi
jmp 0x481fab
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4