Function at 0x49c290
Capabilities:
Check if file exists
Create process on windows
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4da62f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4ac
push esi
lea ecx, [ebp - 0xb8]
call fcn.004917a0
push 0
push 0
push 0
push dword [0x510930]
lea ecx, [ebp - 0xb8]
mov dword [ebp - 4], 0
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x18], 0x200
call fcn.004948e0
test eax, eax
je 0x49c30a
push 0
push 0x4db8b8
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x2b8]
push eax
push str.DuplicitySharedStorageExe
lea ecx, [ebp - 0xb4]
call fcn.004a1110
lea ecx, [ebp - 0x2b8]
mov dword [ebp - 0x18], 0x200
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x49c320
sub ecx, edx
sar ecx, 1
je 0x49c893
lea eax, [ebp - 0x2b8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x49c791
push 0x3c
lea eax, [ebp - 0xa0]
push 0
push eax
call fcn.004a4860
add esp, 0xc
mov dword [ebp - 0xa0], 0x3c
lea eax, [ebp - 0x2b8]
mov dword [ebp - 0x9c], 0x240
mov dword [ebp - 0x90], eax
lea eax, [ebp - 0xa0]
mov dword [ebp - 0x98], 0
push eax
mov dword [ebp - 0x94], str.open
mov dword [ebp - 0x8c], str._status
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x84], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x49c791
push 0x7d0
push dword [ebp - 0x68]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
je 0x49c791
push dword [ebp - 0x68]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x64]
call fcn.004917a0
push 0
push 0
push 0
push dword [0x510944]
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 1
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004948e0
test eax, eax
je 0x49c785
push 0
push 0x4db8b8
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x4b8]
push eax
push str.status
lea ecx, [ebp - 0x60]
call fcn.004a1110
lea eax, [ebp - 0x4b8]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00406c50
push fcn.004036b0
push fcn.004057f0
push 3
push 4
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 2
push eax
call fcn.004a608d
push fcn.004036b0
push fcn.004057f0
push 2
push 4
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 3
push eax
call fcn.004a608d
push fcn.004036b0
push fcn.004057f0
push 2
push 4
lea eax, [ebp - 0x34]
mov byte [ebp - 4], 4
push eax
call fcn.004a608d
push fcn.004036b0
push fcn.004057f0
push 2
push 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 5
push eax
call fcn.004a608d
push 3
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 6
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0x4ebc04
call fcn.00406c50
mov eax, dword [ebp - 0x1c]
push ecx
add eax, 0xfffffff0
mov byte [ebp - 4], 7
mov esi, esp
push eax
call fcn.00407430
add esp, 4
add eax, 0x10
mov dword [esi], eax
mov ecx, 0x515d60
mov byte [ebp - 4], 6
call fcn.004285f0
push 2
lea eax, [ebp - 0x24]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0x4e34b8
call fcn.00406c50
push ecx
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 8
mov ecx, esp
push eax
call fcn.00406ac0
mov ecx, 0x515d60
mov byte [ebp - 4], 6
call fcn.004285f0
push 2
lea eax, [ebp - 0x34]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0x4e34b8
call fcn.00406c50
push ecx
lea eax, [ebp - 0x3c]
mov byte [ebp - 4], 9
mov ecx, esp
push eax
call fcn.00406ac0
mov ecx, 0x515d60
mov byte [ebp - 4], 6
call fcn.004285f0
push 2
lea eax, [ebp - 0x2c]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0x4e34b8
call fcn.00406c50
push ecx
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 0xa
mov ecx, esp
push eax
call fcn.00406ac0
mov ecx, 0x515d60
mov byte [ebp - 4], 6
call fcn.004285f0
lea eax, [ebp - 0x20]
push 0x4ebc08
push eax
call fcn.0049c230
add esp, 8
test al, al
je 0x49c725
lea eax, [ebp - 0x30]
push str.mounted
push eax
call fcn.0049c230
add esp, 8
test al, al
je 0x49c725
push 0x4dbeb4
lea ecx, [ebp - 0x10]
call fcn.00406c50
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 0xb
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0046e0e0
add esp, 0xc
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0xc
call fcn.00406fe0
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0xb
call fcn.004036b0
mov eax, dword [0x517d84]
test eax, eax
je 0x49c60d
push eax
call fcn.004a6088
add esp, 4
mov ecx, dword [0x510928]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x49c616
mov eax, dword [ebp - 0x10]
sub ecx, edx
sar ecx, 1
mov edx, 2
mov eax, dword [eax - 0xc]
add eax, 2
add eax, ecx
xor ecx, ecx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004a3ac6
mov ecx, dword [ebp - 0x10]
add esp, 4
mov dword [0x517d84], eax
cmp dword [ecx - 4], 1
jle 0x49c66a
push dword [ecx - 0xc]
lea ecx, [ebp - 0x10]
call fcn.00405a50
mov eax, dword [0x517d84]
mov ecx, dword [ebp - 0x10]
push ecx
push eax
call fcn.004a6894
mov edx, dword [0x517d84]
add esp, 8
mov ecx, edx
lea esi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x49c680
push dword [0x510928]
sub ecx, esi
sar ecx, 1
push 0x4ebc2c
lea eax, [edx + ecx*2]
push eax
call fcn.004a6894
mov esi, dword [0x517d84]
lea ecx, [ebp - 0x10]
add esp, 0xc
call fcn.004036b0
push fcn.004036b0
push 2
push 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 5
push eax
call fcn.004a60ef
push fcn.004036b0
push 2
push 4
lea eax, [ebp - 0x34]
mov byte [ebp - 4], 4
push eax
call fcn.004a60ef
push fcn.004036b0
push 2
push 4
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 3
push eax
call fcn.004a60ef
push fcn.004036b0
push 3
push 4
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 2
push eax
call fcn.004a60ef
lea ecx, [ebp - 0x1c]
call fcn.004036b0
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0
call fcn.00491a30
jmp 0x49c899
push fcn.004036b0
push 2
push 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 5
push eax
call fcn.004a60ef
push fcn.004036b0
push 2
push 4
lea eax, [ebp - 0x34]
mov byte [ebp - 4], 4
push eax
call fcn.004a60ef
push fcn.004036b0
push 2
push 4
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 3
push eax
call fcn.004a60ef
push fcn.004036b0
push 3
push 4
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 2
push eax
call fcn.004a60ef
lea ecx, [ebp - 0x1c]
call fcn.004036b0
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0
call fcn.00491a30
mov eax, dword [0x517d84]
test eax, eax
je 0x49c7a3
push eax
call fcn.004a6088
add esp, 4
push 0x208
call fcn.004a3ac6
add esp, 4
mov dword [0x517d84], eax
push eax
push 0
push 0
push 5
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x49c87b
mov edx, dword [0x517d84]
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x49c7d7
push dword [0x51092c]
sub ecx, esi
sar ecx, 1
push 0x4ebc2c
lea eax, [edx + ecx*2]
push eax
call fcn.004a6894
add esp, 0xc
lea ecx, [ebp - 0x4c]
push dword [0x517d84]
call fcn.00406df0
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 0xd
push 0
push eax
call fcn.0049d550
add esp, 8
mov esi, eax
cmp dword [ebp - 0x38], 8
jb 0x49c830
push dword [ebp - 0x4c]
call fcn.004a46e7
add esp, 4
xor eax, eax
mov dword [ebp - 0x38], 7
mov dword [ebp - 0x3c], 0
mov word [ebp - 0x4c], ax
test esi, esi
je 0x49c87b
mov edx, dword [0x517d84]
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x49c853
push dword [0x510928]
sub ecx, esi
sar ecx, 1
push 0x4ebc2c
lea eax, [edx + ecx*2]
push eax
call fcn.004a6894
add esp, 0xc
jmp 0x49c893
push dword [0x517d84]
call fcn.004a6088
mov dword [0x517d84], 0
add esp, 4
mov esi, dword [0x517d84]
lea ecx, [ebp - 0xb8]
mov dword [ebp - 4], 0xffffffff
call fcn.00491a30
mov ecx, dword [ebp - 0xc]
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret