Function at 0x4eba00
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x570968
mov eax, dword fs:[0]
push eax
sub esp, 0x24c
mov eax, dword [0x5ad124]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x258]
mov eax, dword [ebp + 0xc]
push 0
push edi
mov dword [ebp - 0x23c], eax
call fcn.00401a60
push ecx
mov ecx, esp
mov dword [ebp - 4], 0
push 0x57557c
call fcn.00404c40
lea ecx, [ebp - 0x258]
call fcn.00403370
or ebx, 0xffffffff
test eax, eax
je 0x4ebabd
push ecx
mov ecx, esp
push 0x57557c
call fcn.00404c40
lea eax, [ebp - 0x22c]
push eax
lea ecx, [ebp - 0x258]
call fcn.00403670
push eax
mov ecx, 0x5b06f8
mov byte [ebp - 4], 1
call fcn.00405240
mov edx, dword [ebp - 0x22c]
mov eax, ebx
mov byte [ebp - 4], 0
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4ebabd
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.0050b5d0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea ecx, [ebp - 0x224]
call fcn.00404c40
mov eax, dword [ebp - 0x224]
mov byte [ebp - 4], 2
cmp dword [eax - 4], 1
jle 0x4ebb24
push dword [eax - 0xc]
lea ecx, [ebp - 0x224]
call fcn.00405950
mov eax, dword [ebp - 0x224]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
mov eax, dword [ebp - 0x224]
push dword [eax - 8]
push eax
call fcn.00527ede
mov edx, eax
add esp, 8
test edx, edx
js 0x4ec228
mov ecx, dword [ebp - 0x224]
cmp edx, dword [ecx - 8]
jg 0x4ec228
mov dword [ecx - 0xc], edx
xor ecx, ecx
mov eax, dword [ebp - 0x224]
mov dword [ebp - 0x22c], ecx
mov word [eax + edx*2], cx
mov dword [ebp - 0x238], ecx
mov dword [ebp - 0x234], ecx
mov dword [ebp - 0x230], ecx
push 0x58e6a0
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 3
call fcn.00404c40
lea eax, [ebp - 0x238]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.0041fa70
mov edx, dword [ebp - 0x21c]
add esp, 0xc
mov byte [ebp - 4], 3
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4ebbd3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [0x5b06f8]
cmp dword [eax - 0xc], 0
jne 0x4ebc0d
mov ecx, dword [ebp - 0x234]
mov edx, dword [ebp - 0x238]
sub ecx, edx
sar ecx, 2
cmp ecx, 3
jb 0x4ebc07
lea eax, [edx + 8]
mov ecx, 0x5b06f8
push eax
call fcn.00405240
mov eax, dword [0x5b06f8]
cmp dword [eax - 0xc], 0
je 0x4ebc55
lea eax, [ebp - 0x21c]
push eax
call fcn.0042fcd0
add esp, 4
push dword [ebp - 0x21c]
push dword [0x5b06f8]
push str.DelayPid
push str.4KScreenRecorder
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov edx, dword [ebp - 0x21c]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4ebc55
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x234]
mov edx, dword [ebp - 0x238]
sub eax, edx
sar eax, 2
cmp eax, 4
jb 0x4ebce0
mov eax, dword [edx + 0xc]
sub eax, 0x10
push eax
call fcn.00405420
add esp, 4
cmp dword [eax + 4], 0
lea esi, [eax + 0x10]
jl 0x4ebcc9
push str.SMDB
push esi
call fcn.0050b72a
add esp, 8
test eax, eax
je 0x4ebc9e
sub eax, esi
sar eax, 1
cmp eax, 0xffffffff
jne 0x4ebcbf
cmp dword [esi - 0xc], 0
jl 0x4ebcc9
push 0x58a2ac
push esi
call fcn.0050b72a
add esp, 8
test eax, eax
je 0x4ebcc9
sub eax, esi
sar eax, 1
cmp eax, 0xffffffff
je 0x4ebcc9
mov dword [ebp - 0x22c], 1
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4ebce0
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
push edi
lea ecx, [ebp - 0x220]
call fcn.00404c40
mov eax, dword [ebp - 0x220]
mov byte [ebp - 4], 5
cmp dword [eax - 0xc], 0
jl 0x4ebd54
push 0x575588
push eax
call fcn.0050b72a
mov ecx, eax
add esp, 8
mov eax, dword [ebp - 0x220]
test ecx, ecx
je 0x4ebd1f
sub ecx, eax
sar ecx, 1
cmp ecx, 0xffffffff
jne 0x4ebd48
cmp dword [eax - 0xc], 0
jl 0x4ebd54
push 0x575590
push eax
call fcn.0050b72a
mov ecx, eax
add esp, 8
mov eax, dword [ebp - 0x220]
test ecx, ecx
je 0x4ebd54
sub ecx, eax
sar ecx, 1
cmp ecx, 0xffffffff
je 0x4ebd54
mov dword [0x5b06f4], 1
jmp 0x4ebd5e
mov dword [0x5b06f4], 0
cmp dword [eax - 0xc], 0
jl 0x4ec03d
push 0x575598
push eax
call fcn.0050b72a
mov ecx, eax
add esp, 8
mov eax, dword [ebp - 0x220]
test ecx, ecx
je 0x4ebd8b
sub ecx, eax
sar ecx, 1
cmp ecx, 0xffffffff
jne 0x4ebdc0
cmp dword [eax - 0xc], 0
jl 0x4ec03d
push 0x5755a0
push eax
call fcn.0050b72a
mov ecx, eax
add esp, 8
mov eax, dword [ebp - 0x220]
test ecx, ecx
je 0x4ebfe7
sub ecx, eax
sar ecx, 1
cmp ecx, 0xffffffff
je 0x4ebfe7
push ecx
mov ecx, esp
push 0x5755a0
call fcn.00404c40
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x258]
call fcn.00403670
mov eax, dword [ebp - 0x21c]
mov byte [ebp - 4], 6
cmp dword [eax - 0xc], 0
jne 0x4ebe3f
push ecx
mov ecx, esp
push 0x575598
call fcn.00404c40
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x258]
call fcn.00403670
push eax
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 7
call fcn.00405240
mov edx, dword [ebp - 0x228]
mov eax, ebx
mov byte [ebp - 4], 6
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4ebe3f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0x21c]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4ebf52
xor ebx, ebx
nop word [eax + eax]
mov eax, dword [ebp - 0x21c]
test ebx, ebx
js 0x4ebf46
cmp ebx, dword [eax - 0xc]
jg 0x4ebe99
lea eax, [eax + ebx*2]
push 0x58b400
push eax
call fcn.0050b72a
mov edi, eax
add esp, 8
mov eax, dword [ebp - 0x21c]
test edi, edi
je 0x4ebe99
sub edi, eax
sar edi, 1
cmp edi, 0xffffffff
jne 0x4ebed0
test ebx, ebx
js 0x4ebf46
cmp ebx, dword [eax - 0xc]
jg 0x4ebf46
lea eax, [eax + ebx*2]
push 0x58c3dc
push eax
call fcn.0050b72a
mov edi, eax
add esp, 8
test edi, edi
je 0x4ebf40
mov eax, dword [ebp - 0x21c]
sub edi, eax
sar edi, 1
cmp edi, 0xffffffff
je 0x4ebf46
push edi
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x21c]
call fcn.004047c0
mov esi, dword [ebp - 0x228]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4ebefc
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov eax, dword [ebp - 0x21c]
inc edi
add esi, 0xfffffff0
mov ebx, edi
cmp edi, dword [eax - 0xc]
jge 0x4ebf2b
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4ebe60
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x4ebe60
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4ebf40
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x21c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
or ebx, 0xffffffff
push ecx
mov esi, esp
mov dword [ebp - 0x228], esp
mov dword [ebp - 0x240], esi
mov eax, dword [ebp - 0x21c]
add eax, 0xfffffff0
push eax
call fcn.00405420
add eax, 0x10
add esp, 4
mov dword [esi], eax
mov eax, dword [0x5b066c]
mov byte [ebp - 4], 8
test eax, eax
jne 0x4ebfb4
push 0x174
call fcn.00507050
add esp, 4
mov dword [ebp - 0x240], eax
mov byte [ebp - 4], 9
test eax, eax
je 0x4ebfa9
mov ecx, eax
call fcn.004c2200
jmp 0x4ebfab
xor eax, eax
mov byte [ebp - 4], 8
mov dword [0x5b066c], eax
lea ecx, [eax + 4]
mov byte [ebp - 4], 6
call fcn.004c8e90
mov edx, dword [ebp - 0x21c]
mov eax, ebx
mov byte [ebp - 4], 5
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4ebfe1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x220]
cmp dword [eax - 0xc], 0
jl 0x4ec03d
push 0x5755a8
push eax
call fcn.0050b72a
mov ecx, eax
add esp, 8
mov eax, dword [ebp - 0x220]
test ecx, ecx
je 0x4ec014
sub ecx, eax
sar ecx, 1
cmp ecx, 0xffffffff
jne 0x4ec099
cmp dword [eax - 0xc], 0
jl 0x4ec03d
push 0x5755b0
push eax
call fcn.0050b72a
mov ecx, eax
add esp, 8
mov eax, dword [ebp - 0x220]
test ecx, ecx
je 0x4ec03d
sub ecx, eax
sar ecx, 1
cmp ecx, 0xffffffff
jne 0x4ec099
cmp dword [ebp - 0x22c], 0
jne 0x4ec099
cmp dword [0x5b06f4], 0
mov dword [0x5b06f0], 0
jne 0x4ec063
call fcn.00407f80
mov dword [0x5b06f4], eax
push 0x585ddc
push str.start
push 0x575364
push 0
call fcn.00419860
add esp, 0x10
call fcn.004ea240
call fcn.004e7180
mov ecx, dword [ebp - 0x23c]
call fcn.004ec240
mov dword [ebp - 0x22c], eax
jmp 0x4ec10a
mov dword [0x5b06f0], 1
cmp dword [eax - 0xc], 0
jl 0x4ec0e0
push 0x5755b8
push eax
call fcn.0050b72a
mov ecx, eax
add esp, 8
mov eax, dword [ebp - 0x220]
test ecx, ecx
je 0x4ec0cc
sub ecx, eax
sar ecx, 1
cmp ecx, 0xffffffff
jne 0x4ec0e0
cmp dword [eax - 0xc], 0
jl 0x4ec0e0
push 0x5755c0
push eax
call fcn.0050b72a
add esp, 8
push 0x585ddc
push str.start
push 0x575364
push 0
call fcn.00419860
push 1
call fcn.004ea470
add esp, 0x14
mov dword [ebp - 0x22c], 0
mov edx, dword [ebp - 0x220]
mov eax, ebx
mov byte [ebp - 4], 3
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4ec12b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x238]
mov byte [ebp - 4], 2
test esi, esi
je 0x4ec19f
mov edi, dword [ebp - 0x234]
cmp esi, edi
je 0x4ec169
mov edx, dword [esi]
mov eax, ebx
sub edx, 0x10
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4ec15c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 4
cmp esi, edi
jne 0x4ec143
mov esi, dword [ebp - 0x238]
mov eax, dword [ebp - 0x230]
lea ecx, [ebp - 0x238]
sub eax, esi
sar eax, 2
push eax
push esi
call fcn.00413240
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x234], 0
mov dword [ebp - 0x230], 0
mov edx, dword [ebp - 0x224]
mov eax, ebx
mov byte [ebp - 4], 0
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4ec1c0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x254]
mov dword [ebp - 4], 0xffffffff
test eax, eax
je 0x4ec1eb
push dword [ebp - 0x250]
push eax
call fcn.00406220
push dword [ebp - 0x254]
call fcn.00516006
add esp, 0xc
mov edx, dword [ebp - 0x258]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x4ec206
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x22c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00507796
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00406fb0
int3