Function at 0x499fc0
Capabilities:
Check if file exists
Create directory
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58d997
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x2240
call fcn.004c3410
mov eax, dword [0x5f4760]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x201c], 0xf
xor ebx, ebx
mov dword [ebp - 0x2020], ebx
mov byte [ebp - 0x2030], bl
mov dword [ebp - 4], ebx
mov dword [ebp - 0x20f4], ebx
lea eax, [ebp - 0x20f4]
push eax
push 0x20019
push ebx
push str.SOFTWARE360Safe360EntSecurity
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x49a104
mov esi, dword [ebp - 0x20f4]
cmp esi, ebx
je 0x49a104
push 0x2000
push ebx
lea ecx, [ebp - 0x2018]
push ecx
call fcn.004add60
add esp, 0xc
mov dword [ebp - 0x2100], ebx
mov dword [ebp - 0x20f8], 0x1ff8
lea edx, [ebp - 0x20f8]
push edx
lea eax, [ebp - 0x2018]
push eax
lea ecx, [ebp - 0x2100]
push ecx
push ebx
push str.ProxyConfig
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x49a0f7
lea edx, [ebp - 0x20dc]
mov dword [ebp - 0x20e0], edx
push 3
lea eax, [ebp - 0x2018]
push eax
lea eax, [ebp - 0x20e0]
call fcn.00420020
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x20e0]
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x49a0c4
sub eax, esi
push eax
push edx
lea ecx, [ebp - 0x2034]
call fcn.004027e0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20dc]
mov eax, dword [ebp - 0x20e0]
cmp eax, ecx
je 0x49a0f7
push eax
call fcn.004a4132
add esp, 4
mov edx, dword [ebp - 0x20f4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x2020], ebx
je 0x49a48d
lea eax, [ebp - 0x20f0]
push eax
call fcn.00484880
mov byte [ebp - 4], 2
xor edi, edi
lea esi, [ebp - 0x2120]
call fcn.0048d630
mov byte [ebp - 4], 3
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2034]
push ecx
mov edx, esi
lea ecx, [ebp - 0x20f0]
call fcn.00484980
test al, al
je 0x49a456
mov edx, esi
push edx
mov edx, str.localbackup
call fcn.0048e730
test al, al
je 0x49a199
mov eax, esi
push eax
mov edx, str.localbackup
call fcn.0048e6c0
mov ecx, eax
call fcn.0048e790
test al, al
je 0x49a199
mov ecx, esi
push ecx
mov edx, str.localbackup
call fcn.0048e6c0
mov esi, eax
call fcn.0048de70
neg eax
sbb eax, eax
neg eax
mov dword [0x601fdc], eax
lea edx, [ebp - 0x2120]
push edx
mov edx, str.backuppath
call fcn.0048e730
test al, al
je 0x49a26a
lea eax, [ebp - 0x2120]
push eax
mov edx, str.backuppath
call fcn.0048e6c0
mov ecx, eax
call fcn.0048e820
test al, al
je 0x49a26a
lea ecx, [ebp - 0x2058]
push ecx
push ecx
lea edx, [ebp - 0x2120]
push edx
mov edx, str.backuppath
call fcn.0048e6c0
add esp, 4
push eax
call fcn.0048dce0
mov bl, 5
mov byte [ebp - 4], bl
cmp dword [ebp - 0x2040], 0x10
mov eax, dword [ebp - 0x2054]
jae 0x49a20e
lea eax, [ebp - 0x2054]
lea ecx, [ebp - 0x2248]
mov dword [ebp - 0x224c], ecx
push 0xfde9
push eax
lea eax, [ebp - 0x224c]
call fcn.004084d0
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x224c]
mov edi, 0x6047b0
call fcn.00408470
mov byte [ebp - 4], bl
lea edx, [ebp - 0x2248]
mov eax, dword [ebp - 0x224c]
cmp eax, edx
je 0x49a25b
push eax
call fcn.004a4132
add esp, 4
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2058]
call fcn.00403ce0
lea eax, [ebp - 0x2120]
push eax
mov edx, str.backupexpire
call fcn.0048e730
test al, al
je 0x49a2b8
lea ecx, [ebp - 0x2120]
push ecx
mov edx, str.backupexpire
call fcn.0048e6c0
mov ecx, eax
call fcn.0048e790
test al, al
je 0x49a2b8
lea edx, [ebp - 0x2120]
push edx
mov edx, str.backupexpire
call fcn.0048e6c0
mov esi, eax
call fcn.0048de70
mov dword [0x601fe0], eax
lea eax, [ebp - 0x2120]
push eax
mov edx, str.backupspechost
call fcn.0048e730
test al, al
je 0x49a3e0
lea ecx, [ebp - 0x2120]
push ecx
mov edx, str.backupspechost
call fcn.0048e6c0
mov ecx, eax
call fcn.0048e830
test al, al
je 0x49a3e0
lea edx, [ebp - 0x2120]
push edx
mov edx, str.backupspechost
call fcn.0048e6c0
push eax
lea ecx, [ebp - 0x2058]
call fcn.0048d820
mov byte [ebp - 4], 7
lea eax, [ebp - 0x2108]
lea edx, [ebp - 0x2058]
call fcn.0048e940
mov bl, 8
jmp 0x49a330
lea eax, [ebp - 0x212c]
lea edx, [ebp - 0x2058]
call fcn.0048e980
mov edi, eax
lea esi, [ebp - 0x2108]
call fcn.0048cda0
test al, al
jne 0x49a3d1
call fcn.0048cd60
mov ecx, eax
call fcn.0048e820
test al, al
je 0x49a3c1
call fcn.0048cd60
lea ecx, [ebp - 0x2148]
push ecx
push eax
call fcn.0048dce0
mov byte [ebp - 4], bl
cmp dword [eax + 0x18], 0x10
jb 0x49a382
mov eax, dword [eax + 4]
jmp 0x49a385
add eax, 4
lea edx, [ebp - 0x20f8]
push edx
mov ecx, eax
call fcn.00402fe0
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x2148]
call fcn.00403ce0
lea eax, [ebp - 0x20f8]
push eax
call fcn.00499cc0
add esp, 4
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x20f8]
push ecx
call fcn.00403090
lea esi, [ebp - 0x2108]
call fcn.0048cd90
jmp 0x49a330
mov byte [ebp - 4], 4
lea esi, [ebp - 0x2058]
call fcn.0048da30
lea esi, [ebp - 0x2104]
mov edi, 0x6047b4
call fcn.00437c30
mov ebx, eax
lea esi, [ebp - 0x20fc]
call fcn.00437c10
mov edx, dword [ebx + 4]
push edx
mov ecx, dword [ebx]
push ecx
mov edx, dword [eax + 4]
push edx
mov eax, dword [eax]
push eax
call fcn.0041f3b0
add esp, 0x10
mov ecx, dword [0x6047b0]
push ecx
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
call esi
test eax, eax
jne 0x49a434
push eax
mov edx, dword [0x6047b0]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov eax, dword [0x6047b0]
push eax
call esi
test eax, eax
jne 0x49a454
mov dword [0x601fdc], eax
mov edx, 0x5d3ab0
mov edi, 0x6047b0
call fcn.00408470
xor ebx, ebx
mov dword [ebp - 4], 3
jmp 0x49a46e
mov byte [ebp - 4], 2
lea esi, [ebp - 0x2120]
call fcn.0048da30
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20f0]
push ecx
call fcn.0049a4e0
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x201c], 0x10
jb 0x49a4ac
mov edx, dword [ebp - 0x2030]
push edx
call fcn.004a3142
add esp, 4
mov dword [ebp - 0x201c], 0xf
mov dword [ebp - 0x2020], ebx
mov byte [ebp - 0x2030], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004a314d
mov esp, ebp
pop ebp
ret