Function at 0x4b59b0
Capabilities:
Create thread
Delete directory
Get common file path

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f240f
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x340
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x1c], edi
mov eax, dword [ebx + 8]
mov dword [ebp - 0x344], eax
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x33c], eax
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x340], eax
call fcn.0043e530
test al, al
je 0x4b68fb
mov esi, dword [edi + 0x14e4]
lea eax, [ebp - 0x308]
push 0x270
push 0
push eax
call fcn.00420090
add esp, 8
mov ecx, esi
push 0
call fcn.005c5730
push eax
push 0xffffffffffffffff
push SysReAllocString
push 0
push 0
push 0x163
push 0x258
push 0x62439c
push str.QUM_MsgBox
lea eax, [edi + 0x14a8]
push eax
lea ecx, [ebp - 0x308]
call fcn.005c6220
push 0
push str.Arial
push 1
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x308]
movsd xmm1, qword [0x6edaf8]
push 0x190
call fcn.005c42b0
mov eax, dword [edi + 0x54]
lea ecx, [ebp - 0x308]
push 4
push 0xc
or eax, 0xff000000
push eax
push eax
mov eax, dword [edi + 0x60]
or eax, 0xff000000
push eax
push 0x163
push 0x258
call fcn.005b9530
push 0
lea ecx, [ebp - 0x308]
call fcn.005c5730
push 0
push 0
mov ecx, esi
mov dword [ebp - 0x348], eax
call fcn.005c5730
mov ecx, dword [ebp - 0x348]
mov edx, eax
call fcn.005d3010
push dword [ebp - 0x348]
mov ecx, esi
call fcn.005c6150
sub esp, 8
lea ecx, [ebp - 0x308]
push 0x30
push 0x30
push 0xa
push 0xa
push dword [ebp - 0x344]
call fcn.005c0b10
movsd xmm1, qword [0x6edb38]
lea ecx, [ebp - 0x308]
push 0
push str.Arial
push 1
push 0x320
call fcn.005c42b0
push 0xffffffffffffffff
push 0x10000001
push 0x19
push 0x19c
push 0x14
push 0x44
push str.Move_account_folders
lea ecx, [ebp - 0x308]
call fcn.005c0890
mov eax, dword [edi + 0x60]
lea ecx, [ebp - 0x308]
or eax, 0xff000000
push eax
push 0x20
push 0x20
push 0xa
push 0x22e
call fcn.005c1810
movsd xmm1, qword [0x6edb08]
lea ecx, [ebp - 0x308]
push 0
push str.Arial
push 1
push 0x190
mov dword [ebp - 0x350], eax
call fcn.005c42b0
xorps xmm0, xmm0
mov dword [ebp - 0x6c], 0
lea ecx, [ebp - 0x74]
movq qword [ebp - 0x74], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x3c], 0
lea ecx, [ebp - 0x44]
movq qword [ebp - 0x44], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 0x28]
movq qword [ebp - 0x28], xmm0
call fcn.005dc5e0
sub esp, 8
mov byte [ebp - 4], 3
xorps xmm0, xmm0
mov dword [ebp - 0x2c], 0
lea ecx, [ebp - 0x34]
movq qword [ebp - 0x34], xmm0
push 0
push 0
push 0
push 0
push 0
push 0
push str.s_personal_folders._Here_you_can_also_restore_those_folders_to_their_original_locations._r_nDouble_click_any_item_in_the_list_to_open_its_current_location.
push dword [ebp - 0x340]
push str.location_of_some_of
push str.This_feature_lets_you_change_the
call fcn.005dc520
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x3c
push 0x21c
push 0x4b
push 0x14
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 4
call fcn.005dc190
push eax
lea ecx, [ebp - 0x308]
call fcn.005c0890
movsd xmm1, qword [0x6edaf8]
lea ecx, [ebp - 0x308]
push 0
push str.Arial
push 1
push 0x190
call fcn.005c42b0
push 0xffffffffffffffff
push 0x1080000d
push 0xa0
push 0x244
push 0x8c
push 0xa
push 0x62794c
push str._Folder_name_Current_location_Default_location
lea ecx, [ebp - 0x308]
call fcn.005c0620
push eax
lea ecx, [ebp - 0x308]
mov dword [ebp - 0x334], eax
call fcn.005c5730
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
mov edi, eax
push 0x64
push 0
push 0x101e
push edi
call esi
push 0xf0
push 1
push 0x101e
push edi
call esi
push 0xeb
push 2
push 0x101e
push edi
call esi
xorps xmm0, xmm0
mov dword [ebp - 0x60], 0
lea ecx, [ebp - 0x68]
movq qword [ebp - 0x68], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x54], 0
lea ecx, [ebp - 0x5c]
movq qword [ebp - 0x5c], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x48], 0
lea ecx, [ebp - 0x50]
movq qword [ebp - 0x50], xmm0
call fcn.005dc5e0
mov ecx, dword [ebp - 0x33c]
lea eax, [ebp - 0x68]
push eax
lea edx, [ebp - 0x5c]
mov byte [ebp - 4], 7
call fcn.0059d880
test al, al
je 0x4b68b8
push 0x104
push 0
push 0
push 0x104
lea ecx, [ebp - 0x50]
call fcn.005db9a0
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Shell32.dll
lea ecx, [ebp - 0x50]
call fcn.005da780
push 0x10
push 3
lea ecx, [ebp - 0x50]
call fcn.005dc190
push eax
push 1
push 0xffffffffffffffff
lea ecx, [ebp - 0x308]
call fcn.005bea70
mov esi, dword [ebp - 0x334]
lea eax, [ebp - 0x308]
mov edi, dword [ebp - 0x1c]
mov ecx, edi
push esi
push eax
call fcn.004b6920
sub esp, 8
lea ecx, [ebp - 0x308]
push 0x12
push 0xb4
push 0x136
push 0x64
push str.Also_move_folder_contents
call fcn.005c19a0
push 0x186a0
push ecx
push str.Whether_to_move_files_fom_the_current_location_into_the_new_one
push 0xffffffffffffffff
lea ecx, [ebp - 0x308]
mov dword [ebp - 0x344], eax
call fcn.005bcaf0
push 4
push 0xffffffffffffffff
lea ecx, [ebp - 0x308]
call fcn.005bd3f0
sub esp, 8
lea ecx, [ebp - 0x308]
push 0x12
push 0xb4
push 0x14a
push 0x64
push str.Overwrite_existing_files
call fcn.005c19a0
push 0x186a0
push ecx
push str.When_moving_files__overwrite_same_named_ones_in_the_new_location_r_nIf_this_option_is_not_selected__those_files_will_be_skipped
push 0xffffffffffffffff
lea ecx, [ebp - 0x308]
mov dword [ebp - 0x340], eax
call fcn.005bcaf0
movsd xmm1, qword [0x6edb08]
lea ecx, [ebp - 0x308]
push 0
push str.Arial
push 1
push 0x190
call fcn.005c42b0
push ecx
push 0xffffffffffffffff
push 0x1a
push 0x82
push 0x13a
push 0x12c
push str.Move_selected
lea ecx, [ebp - 0x308]
call fcn.005c1a50
push 0x186a0
push ecx
push str.Move_the_selected_folder_to_a_new_location
push 0xffffffffffffffff
lea ecx, [ebp - 0x308]
mov dword [ebp - 0x33c], eax
call fcn.005bcaf0
push 0x40
push 0xffffffffffffffff
lea ecx, [ebp - 0x308]
call fcn.005bd3f0
push ecx
push 0xffffffffffffffff
push 0x1a
push 0x82
push 0x13a
push 0x1c2
push str.Restore_default
lea ecx, [ebp - 0x308]
call fcn.005c1a50
push 0x186a0
push ecx
push str.Restore_the_selected_folder_to_its_default_location
push 0xffffffffffffffff
lea ecx, [ebp - 0x308]
mov dword [ebp - 0x338], eax
call fcn.005bcaf0
push 0x40
push 0xffffffffffffffff
lea ecx, [ebp - 0x308]
call fcn.005bd3f0
push ecx
lea ecx, [edi + 0x1290]
call fcn.0057c2d0
push eax
lea ecx, [ebp - 0x30c]
call fcn.005d81e0
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0
call fcn.005d80d0
push 3
push 0xa0000000
push 1
push 1
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 9
call fcn.005d7f80
push 3
push 0x10000000
push 1
push dword [ebp - 0x30c]
lea ecx, [ebp - 0x18]
call fcn.005d7f50
push 3
push 0x10000000
push 1
push 0x16
lea ecx, [ebp - 0x18]
call fcn.005d7f80
push 3
push 0x10000000
push 1
push 0x1a
lea ecx, [ebp - 0x18]
call fcn.005d7f80
push 1
push 5
lea ecx, [ebp - 0x308]
call fcn.005c3f80
xor dl, dl
lea ecx, [edi + 0x14a8]
call fcn.005c8820
test eax, eax
je 0x4b68a5
nop dword [eax]
mov eax, dword [edi + 0x14a8]
lea edx, [edi + 0x14a8]
cmp eax, 0xfffffffa
je 0x4b68a5
lea ecx, [ebp - 0x308]
cmp dword [edx + 0x30], ecx
jne 0x4b6890
cmp eax, dword [ebp - 0x350]
je 0x4b68a5
cmp eax, 0xffffffd3
je 0x4b67f0
cmp eax, 0xffffffd2
je 0x4b67f0
cmp eax, 0xfffffff2
jne 0x4b6042
cmp dword [edx + 0xc], esi
jne 0x4b6042
push 2
push 0xffffffffffffffff
push esi
call fcn.005bb4c0
cmp eax, 0xffffffff
je 0x4b6890
push 1
push eax
push esi
lea ecx, [ebp - 0x308]
call fcn.005bb510
push eax
lea ecx, [ebp - 0x34]
call fcn.005dc1c0
push ecx
push 5
push 0
lea ecx, [ebp - 0x34]
call fcn.005dc190
xor edx, edx
mov ecx, eax
call fcn.005e2950
jmp 0x4b6890
cmp eax, dword [ebp - 0x33c]
jne 0x4b63f7
push 2
push 0xffffffffffffffff
push esi
lea ecx, [ebp - 0x308]
call fcn.005bb4c0
mov dword [ebp - 0x330], eax
cmp eax, 0xffffffff
je 0x4b6890
push 1
push eax
push esi
lea ecx, [ebp - 0x308]
call fcn.005bb510
push eax
lea ecx, [ebp - 0x44]
call fcn.005dc1c0
push dword [ebp - 0x348]
lea ecx, [ebp - 0x44]
call fcn.005dc190
push eax
push 1
push ecx
mov edx, str.Select_new_folder_location
lea ecx, [ebp - 0x28]
call fcn.005e1b00
test al, al
je 0x4b6890
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x44]
call fcn.005dc4a0
test al, al
jne 0x4b6890
push 0xd
push 0
push dword [ebp - 0x338]
xorps xmm0, xmm0
lea eax, [ebp - 0x308]
push esi
push eax
lea ecx, [ebp - 0x94]
movups xmmword [ebp - 0x94], xmm0
movups xmmword [ebp - 0x84], xmm0
call fcn.005b8800
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x328], edi
call fcn.005dc190
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x324], eax
call fcn.005dc190
push 3
push 1
push 1
xorps xmm0, xmm0
mov dword [ebp - 0x320], eax
push 0
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x31c], 0
movlpd qword [ebp - 0x318], xmm0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x28]
call fcn.005daa70
mov ecx, dword [ebp - 0x31c]
test eax, eax
mov eax, 2
cmove ecx, eax
push 4
push dword [ebp - 0x340]
mov dword [ebp - 0x31c], ecx
lea ecx, [ebp - 0x308]
call fcn.005bc500
test eax, eax
je 0x4b6176
or dword [ebp - 0x31c], 1
push str.Moving_user_files__please_cancel_shutdown
mov ecx, edi
call fcn.0043dbb0
push 0
push dword [ebp - 0x330]
lea ecx, [ebp - 0x308]
push esi
call fcn.005bb510
push eax
lea ecx, [ebp - 0x34]
call fcn.005dc1c0
lea ecx, [ebp - 0x28]
call fcn.005dc190
or ecx, 0xffffffff
mov edx, ecx
mov ecx, eax
call fcn.005e0f30
movzx eax, al
mov dword [ebp - 0x38], eax
test eax, eax
je 0x4b61ed
lea ecx, [ebp - 0x28]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x34]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x68]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x5c]
call fcn.005dc190
push eax
call fcn.004b5410
mov dword [ebp - 0x38], eax
test eax, eax
jne 0x4b622e
sub esp, 8
lea eax, [ebp - 0x308]
mov ecx, edi
push 0x8c
push 0x190
push 0
push eax
push 0
push str.Sorry__this_folder_could_not_be_moved_this_time.
call fcn.0043e2e0
push 0
mov ecx, edi
call fcn.0043dbb0
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 9
call fcn.005b8790
jmp 0x4b6890
push dword [ebp - 0x30c]
lea ecx, [ebp - 0x28]
push 5
push 1
call fcn.005dc190
push eax
lea ecx, [ebp - 0x18]
call fcn.005d7810
push 4
push dword [ebp - 0x344]
lea ecx, [ebp - 0x308]
call fcn.005bc500
mov dword [ebp - 0x34c], eax
test eax, eax
je 0x4b62de
push 0
push 0
lea eax, [ebp - 0x328]
push eax
push 0x469b90
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
mov eax, 0xffffffff
test esi, esi
cmove esi, eax
mov dword [ebp - 0x32c], esi
xor edx, edx
mov byte [ebp - 4], 0xb
mov ecx, esi
call fcn.005cca30
test al, al
je 0x4b62b9
push 0
mov ecx, edi
call fcn.004771c0
xor edx, edx
mov ecx, esi
call fcn.005cca30
test al, al
jne 0x4b62a3
lea eax, [ebp - 0x38]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov byte [ebp - 4], 0xa
cmp esi, 0xffffffff
je 0x4b62d8
test esi, esi
je 0x4b62d8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x334]
cmp dword [ebp - 0x38], 0
je 0x4b62f3
push esi
lea eax, [ebp - 0x308]
mov ecx, edi
push eax
call fcn.004b6920
push 0
mov ecx, edi
call fcn.0043dbb0
cmp dword [ebp - 0x38], 0
jne 0x4b633a
sub esp, 8
lea eax, [ebp - 0x308]
mov ecx, edi
push 0x8c
push 0x190
push 0
push eax
push 0
push str.Sorry__this_folder_could_not_be_moved_to_the_selected_location.
call fcn.0043e2e0
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 9
call fcn.005b8790
jmp 0x4b6890
mov ecx, dword [ebp - 0x314]
test ecx, ecx
jl 0x4b63b8
mov eax, dword [ebp - 0x318]
jg 0x4b6350
test eax, eax
je 0x4b63b8
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._file_objects_could_not_be_moved_because_they_are_neing_used_by_another_application._r_n_r_nYou_can_manually_move_them_later.
push ecx
push eax
lea ecx, [ebp - 0x34]
call fcn.005db580
mov ecx, eax
call fcn.005da780
sub esp, 8
lea eax, [ebp - 0x308]
lea ecx, [ebp - 0x34]
push 0x8c
push 0x190
push 0
push eax
push 0
call fcn.005dc190
push eax
mov ecx, edi
call fcn.0043e2e0
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 9
call fcn.005b8790
jmp 0x4b6890
push 1
lea ecx, [ebp - 0x28]
call fcn.005dc190
push eax
push dword [ebp - 0x330]
lea ecx, [ebp - 0x308]
push esi
call fcn.005ba4f0
sub esp, 8
lea eax, [ebp - 0x308]
push 0x8c
push 0x190
push 0
push eax
push 0
push str.The_selected_folder_was_successfully_moved.
jmp 0x4b67af
cmp eax, dword [ebp - 0x338]
jne 0x4b6890
push 2
push 0xffffffffffffffff
push esi
lea ecx, [ebp - 0x308]
call fcn.005bb4c0
mov dword [ebp - 0x330], eax
cmp eax, 0xffffffff
je 0x4b6890
push 0xd
push 0
push dword [ebp - 0x338]
xorps xmm0, xmm0
lea eax, [ebp - 0x308]
push esi
push eax
lea ecx, [ebp - 0x94]
movups xmmword [ebp - 0x94], xmm0
movups xmmword [ebp - 0x84], xmm0
call fcn.005b8800
push 1
push dword [ebp - 0x330]
lea ecx, [ebp - 0x308]
mov byte [ebp - 4], 0xc
push esi
call fcn.005bb510
push eax
lea ecx, [ebp - 0x44]
call fcn.005dc1c0
sub esp, 8
lea eax, [ebp - 0x308]
mov ecx, edi
push 0x8c
push 0x190
push 0
push eax
push 1
push str.Are_you_sure_you_want_to_restore_the_selected_folder_to_its_original_location_
call fcn.0043e2e0
test eax, eax
jne 0x4b64ad
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 9
call fcn.005b8790
jmp 0x4b6890
push 2
push dword [ebp - 0x330]
lea ecx, [ebp - 0x308]
push esi
call fcn.005bb510
push eax
lea ecx, [ebp - 0x28]
call fcn.005dc1c0
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x328], edi
call fcn.005dc190
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x324], eax
call fcn.005dc190
push 3
push 1
push 1
xorps xmm0, xmm0
mov dword [ebp - 0x320], eax
push 0
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x31c], 0
movlpd qword [ebp - 0x318], xmm0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x28]
call fcn.005daa70
mov ecx, dword [ebp - 0x31c]
test eax, eax
mov eax, 2
cmove ecx, eax
push 4
push dword [ebp - 0x340]
mov dword [ebp - 0x31c], ecx
lea ecx, [ebp - 0x308]
call fcn.005bc500
test eax, eax
je 0x4b654e
or dword [ebp - 0x31c], 1
push str.Moving_user_files__please_cancel_shutdown
mov ecx, edi
call fcn.0043dbb0
push 0
push dword [ebp - 0x330]
lea ecx, [ebp - 0x308]
push esi
call fcn.005bb510
push eax
lea ecx, [ebp - 0x34]
call fcn.005dc1c0
lea ecx, [ebp - 0x28]
call fcn.005dc190
or ecx, 0xffffffff
mov edx, ecx
mov ecx, eax
call fcn.005e0f30
movzx eax, al
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x4b65c5
lea ecx, [ebp - 0x28]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x34]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x68]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x5c]
call fcn.005dc190
push eax
call fcn.004b5410
mov dword [ebp - 0x1c], eax
test eax, eax
jne 0x4b6606
sub esp, 8
lea eax, [ebp - 0x308]
mov ecx, edi
push 0x8c
push 0x190
push 0
push eax
push 0
push str.Sorry__this_folder_could_not_be_restored_this_time.
call fcn.0043e2e0
push 0
mov ecx, edi
call fcn.0043dbb0
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 9
call fcn.005b8790
jmp 0x4b6890
push 4
push dword [ebp - 0x344]
lea ecx, [ebp - 0x308]
call fcn.005bc500
mov dword [ebp - 0x34c], eax
test eax, eax
je 0x4b669b
push 0
push 0
lea eax, [ebp - 0x328]
push eax
push 0x469b90
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
mov eax, 0xffffffff
test esi, esi
cmove esi, eax
mov dword [ebp - 0x32c], esi
xor edx, edx
mov byte [ebp - 4], 0xd
mov ecx, esi
call fcn.005cca30
test al, al
je 0x4b6676
push 0
mov ecx, edi
call fcn.004771c0
xor edx, edx
mov ecx, esi
call fcn.005cca30
test al, al
jne 0x4b6660
lea eax, [ebp - 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov byte [ebp - 4], 0xc
cmp esi, 0xffffffff
je 0x4b6695
test esi, esi
je 0x4b6695
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x334]
cmp dword [ebp - 0x1c], 0
je 0x4b66b0
push esi
lea eax, [ebp - 0x308]
mov ecx, edi
push eax
call fcn.004b6920
push 0
mov ecx, edi
call fcn.0043dbb0
cmp dword [ebp - 0x1c], 0
jne 0x4b66f7
sub esp, 8
lea eax, [ebp - 0x308]
mov ecx, edi
push 0x8c
push 0x190
push 0
push eax
push 0
push str.Sorry__this_folder_could_not_be_restored_this_time.
call fcn.0043e2e0
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 9
call fcn.005b8790
jmp 0x4b6890
mov ecx, dword [ebp - 0x314]
test ecx, ecx
jl 0x4b6775
mov eax, dword [ebp - 0x318]
jg 0x4b670d
test eax, eax
je 0x4b6775
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._file_objects_could_not_be_moved_because_they_are_being_used_by_another_application._r_n_r_nYou_can_manually_move_them_later.
push ecx
push eax
lea ecx, [ebp - 0x34]
call fcn.005db580
mov ecx, eax
call fcn.005da780
sub esp, 8
lea eax, [ebp - 0x308]
lea ecx, [ebp - 0x34]
push 0x8c
push 0x190
push 0
push eax
push 0
call fcn.005dc190
push eax
mov ecx, edi
call fcn.0043e2e0
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 9
call fcn.005b8790
jmp 0x4b6890
push 1
lea ecx, [ebp - 0x28]
call fcn.005dc190
push eax
push dword [ebp - 0x330]
lea ecx, [ebp - 0x308]
push esi
call fcn.005ba4f0
sub esp, 8
lea eax, [ebp - 0x308]
push 0x8c
push 0x190
push 0
push eax
push 0
push str.The_selected_folder_was_successfully_restored.
mov ecx, edi
call fcn.0043e2e0
cmp dword [ebp - 0x34c], 0
je 0x4b67ce
lea ecx, [ebp - 0x44]
call fcn.005dc190
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
cmp dword [ebp - 0x330], 0
jne 0x4b67dc
call fcn.00437df0
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 9
call fcn.005b8790
jmp 0x4b6890
push 2
push 0xffffffffffffffff
push esi
lea ecx, [ebp - 0x308]
call fcn.005bb4c0
mov dword [ebp - 0x330], eax
lea ecx, [ebp - 0x308]
cmp eax, 0xffffffff
jne 0x4b6822
push 0x40
push dword [ebp - 0x33c]
call fcn.005bd3f0
push 0x40
jmp 0x4b687f
push 0x20
push dword [ebp - 0x33c]
call fcn.005bd3f0
push 1
push dword [ebp - 0x330]
lea ecx, [ebp - 0x308]
push esi
call fcn.005bb510
push eax
lea ecx, [ebp - 0x34]
call fcn.005dc1c0
push 2
push dword [ebp - 0x330]
lea ecx, [ebp - 0x308]
push esi
call fcn.005bb510
push eax
lea ecx, [ebp - 0x74]
call fcn.005dc1c0
lea eax, [ebp - 0x74]
push eax
lea ecx, [ebp - 0x34]
call fcn.005dc4a0
test al, al
je 0x4b687d
push 0x40
jmp 0x4b687f
push 0x20
push dword [ebp - 0x338]
lea ecx, [ebp - 0x308]
call fcn.005bd3f0
xor dl, dl
lea ecx, [edi + 0x14a8]
call fcn.005c8820
test eax, eax
jne 0x4b5fb0
lea ecx, [ebp - 0x18]
call fcn.005d80c0
lea ecx, [ebp - 0x30c]
call fcn.005d8100
lea ecx, [ebp - 0x50]
call fcn.005dc430
lea ecx, [ebp - 0x5c]
call fcn.005dc430
lea ecx, [ebp - 0x68]
call fcn.005dc430
lea ecx, [ebp - 0x34]
call fcn.005dc430
lea ecx, [ebp - 0x28]
call fcn.005dc430
lea ecx, [ebp - 0x44]
call fcn.005dc430
lea ecx, [ebp - 0x74]
call fcn.005dc430
lea ecx, [ebp - 0x308]
call fcn.005c1c60
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0xc