Function at 0x4c4120
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6240ed
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x6ec7c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push str.CPathReplacer::ReadIndexMap
lea ecx, [ebp - 0x48]
call fcn.00562ae0
mov esi, dword [edi + 8]
add edi, 8
mov ecx, edi
mov dword [ebp - 4], 0
push dword [esi + 4]
push edi
call fcn.004c3990
mov dword [esi + 4], esi
lea ecx, [ebp - 0x4c]
mov dword [esi], esi
mov dword [esi + 8], esi
push str._administrative_tools_
mov dword [edi + 4], 0
mov dword [ebp - 0x50], 0x30
call dword [0x63ea98]
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x58]
mov ecx, edi
push eax
call fcn.004c3a40
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0
call dword [0x63f5a8]
push str._altstartup_
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x50], 0x1d
call dword [0x63ea98]
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x58]
mov ecx, edi
push eax
call fcn.004c3a40
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0
call dword [0x63f5a8]
push str._Application_Data_
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x50], 0x1a
call dword [0x63ea98]
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x58]
mov ecx, edi
push eax
call fcn.004c3a40
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0
call dword [0x63f5a8]
push str._CD_Burning_
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x50], 0x3b
call dword [0x63ea98]
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x58]
mov ecx, edi
push eax
call fcn.004c3a40
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0
call dword [0x63f5a8]
push str._Common_Administrative_Tools_
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x50], 0x2f
call dword [0x63ea98]
mov byte [ebp - 4], 5
lea eax, [ebp - 0x50]
mov ecx, edi
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.004c3a40
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0
call dword [0x63f5a8]
push str._Common_AltStartup_
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x50], 0x1e
call dword [0x63ea98]
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 6
push eax
lea eax, [ebp - 0x58]
mov ecx, edi
push eax
call fcn.004c3a40
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0
call dword [0x63f5a8]
push str._Common_Application_Data_
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x50], 0x23
call dword [0x63ea98]
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 7
push eax
lea eax, [ebp - 0x58]
mov ecx, edi
push eax
call fcn.004c3a40
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0
call dword [0x63f5a8]
push str._Common_Desktop_
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x50], 0x19
call dword [0x63ea98]
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 8
push eax
lea eax, [ebp - 0x58]
mov ecx, edi
push eax
call fcn.004c3a40
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0
call dword [0x63f5a8]
push str._Common_Documents_
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x50], 0x2e
call dword [0x63ea98]
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 9
push eax
lea eax, [ebp - 0x58]
mov ecx, edi
push eax
call fcn.004c3a40
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0
call dword [0x63f5a8]
push str._Common_Favorites_
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x50], 0x1f
call dword [0x63ea98]
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 0xa
push eax
lea eax, [ebp - 0x58]
mov ecx, edi
push eax
call fcn.004c3a40
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0
call dword [0x63f5a8]
push str._Common_My_Music_
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x50], 0x35
call dword [0x63ea98]
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 0xb
push eax
lea eax, [ebp - 0x58]
mov ecx, edi
push eax
call fcn.004c3a40
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0
call dword [0x63f5a8]
push str._Common_My_Pictures_
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x50], 0x36
call dword [0x63ea98]
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 0xc
push eax
lea eax, [ebp - 0x58]
mov ecx, edi
push eax
call fcn.004c3a40
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0
call dword [0x63f5a8]
push str._Common_Programs_
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x50], 0x17
call dword [0x63ea98]
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 0xd
push eax
lea eax, [ebp - 0x58]
mov ecx, edi
push eax
call fcn.004c3a40
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0
call dword [0x63f5a8]
push str._Common_Start_Menu_
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x50], 0x16
call dword [0x63ea98]
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 0xe
push eax
lea eax, [ebp - 0x58]
mov ecx, edi
push eax
call fcn.004c3a40
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0
call dword [0x63f5a8]
push str._Common_Startup_
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x50], 0x18
call dword [0x63ea98]
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 0xf
push eax
lea eax, [ebp - 0x58]
mov ecx, edi
push eax
call fcn.004c3a40
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0
call dword [0x63f5a8]
mov dword [ebp - 0x50], 0x2d
lea ecx, [ebp - 0x4c]
push str._Common_Templates_
call dword [0x63ea98]
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 0x10
push eax
lea eax, [ebp - 0x58]
mov ecx, edi
push eax
call fcn.004c3a40
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0
call dword [0x63f5a8]
push str._Common_My_Videos_
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x50], 0x37
call dword [0x63ea98]
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 0x11
push eax
lea eax, [ebp - 0x58]
mov ecx, edi
push eax
call fcn.004c3a40
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0
call dword [0x63f5a8]
push str._Control_Panel_
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x50], 3
call dword [0x63ea98]
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 0x12
push eax
lea eax, [ebp - 0x58]
mov ecx, edi
push eax
call fcn.004c3a40
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0
call dword [0x63f5a8]
push str._cookies_
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x50], 0x21
call dword [0x63ea98]
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 0x13
push eax
lea eax, [ebp - 0x58]
mov ecx, edi
push eax
call fcn.004c3a40
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0
call dword [0x63f5a8]
push str._desktop_
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x50], 0
call dword [0x63ea98]
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 0x14
push eax
lea eax, [ebp - 0x58]
mov ecx, edi
push eax
call fcn.004c3a40
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0
call dword [0x63f5a8]
push str._favorites_
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x50], 6
call dword [0x63ea98]
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 0x15
push eax
lea eax, [ebp - 0x58]
push eax
mov ecx, edi
call fcn.004c3a40
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0
call dword [0x63f5a8]
push str._fonts_
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x50], 0x14
call dword [0x63ea98]
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 0x16
push eax
lea eax, [ebp - 0x58]
mov ecx, edi
push eax
call fcn.004c3a40
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0
call dword [0x63f5a8]
push str._history_
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x50], 0x22
call dword [0x63ea98]
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 0x17
push eax
lea eax, [ebp - 0x58]
mov ecx, edi
push eax
call fcn.004c3a40
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0
call dword [0x63f5a8]
push str._Temporary_Internet_Files_
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x50], 0x20
call dword [0x63ea98]
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 0x18
push eax
lea eax, [ebp - 0x58]
mov ecx, edi
push eax
call fcn.004c3a40
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0
call dword [0x63f5a8]
push str._Local_Application_Data_
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x50], 0x1c
call dword [0x63ea98]
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 0x19
push eax
lea eax, [ebp - 0x58]
mov ecx, edi
push eax
call fcn.004c3a40
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0
call dword [0x63f5a8]
push str._My_Music_
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x50], 0xd
call dword [0x63ea98]
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 0x1a
push eax
lea eax, [ebp - 0x58]
mov ecx, edi
push eax
call fcn.004c3a40
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0
call dword [0x63f5a8]
push str._My_Pictures_
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x50], 0x27
call dword [0x63ea98]
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 0x1b
push eax
lea eax, [ebp - 0x58]
mov ecx, edi
push eax
call fcn.004c3a40
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0
call dword [0x63f5a8]
push str._My_Videos_
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x50], 0xe
call dword [0x63ea98]
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 0x1c
push eax
lea eax, [ebp - 0x58]
mov ecx, edi
push eax
call fcn.004c3a40
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0
call dword [0x63f5a8]
push str._nethood_
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x50], 0x13
call dword [0x63ea98]
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 0x1d
push eax
lea eax, [ebp - 0x58]
mov ecx, edi
push eax
call fcn.004c3a40
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0
call dword [0x63f5a8]
push str._my_documents_
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x50], 5
call dword [0x63ea98]
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 0x1e
push eax
lea eax, [ebp - 0x58]
mov ecx, edi
push eax
call fcn.004c3a40
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0
call dword [0x63f5a8]
push str._PrintHood_
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x50], 0x1b
call dword [0x63ea98]
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 0x1f
push eax
lea eax, [ebp - 0x58]
mov ecx, edi
push eax
call fcn.004c3a40
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0
call dword [0x63f5a8]
push str._Profile_
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x50], 0x28
call dword [0x63ea98]
mov byte [ebp - 4], 0x20
lea eax, [ebp - 0x50]
mov ecx, edi
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.004c3a40
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0
call dword [0x63f5a8]
push str._Program_Files_
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x50], 0x26
call dword [0x63ea98]
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 0x21
push eax
lea eax, [ebp - 0x58]
mov ecx, edi
push eax
call fcn.004c3a40
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0
call dword [0x63f5a8]
push str._Program_Files_Common_
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x50], 0x2b
call dword [0x63ea98]
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 0x22
push eax
lea eax, [ebp - 0x58]
mov ecx, edi
push eax
call fcn.004c3a40
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0
call dword [0x63f5a8]
push str._Programs_
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x50], 2
call dword [0x63ea98]
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 0x23
push eax
lea eax, [ebp - 0x58]
mov ecx, edi
push eax
call fcn.004c3a40
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0
call dword [0x63f5a8]
push str._My_Recent_Documents_
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x50], 8
call dword [0x63ea98]
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 0x24
push eax
lea eax, [ebp - 0x58]
mov ecx, edi
push eax
call fcn.004c3a40
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0
call dword [0x63f5a8]
push str._SendTo_
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x50], 9
call dword [0x63ea98]
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 0x25
push eax
lea eax, [ebp - 0x58]
mov ecx, edi
push eax
call fcn.004c3a40
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0
call dword [0x63f5a8]
push str._Start_Menu_
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x50], 0xb
call dword [0x63ea98]
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 0x26
push eax
lea eax, [ebp - 0x58]
mov ecx, edi
push eax
call fcn.004c3a40
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0
call dword [0x63f5a8]
push str._Startup_
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x50], 7
call dword [0x63ea98]
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 0x27
push eax
lea eax, [ebp - 0x58]
mov ecx, edi
push eax
call fcn.004c3a40
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0
call dword [0x63f5a8]
push str._System32_
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x50], 0x25
call dword [0x63ea98]
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 0x28
push eax
lea eax, [ebp - 0x58]
mov ecx, edi
push eax
call fcn.004c3a40
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0
call dword [0x63f5a8]
push str._Templates_
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x50], 0x15
call dword [0x63ea98]
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 0x29
push eax
lea eax, [ebp - 0x58]
mov ecx, edi
push eax
call fcn.004c3a40
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0
call dword [0x63f5a8]
push str._Windows_
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x50], 0x24
call dword [0x63ea98]
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 0x2a
push eax
lea eax, [ebp - 0x58]
mov ecx, edi
push eax
call fcn.004c3a40
lea ecx, [ebp - 0x4c]
call dword [0x63f5a8]
lea ecx, [ebp - 0x48]
call fcn.005630c0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00604ed9
mov esp, ebp
pop ebp
ret