Function at 0x450010
Capabilities:
Get file system object information
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4d4df1
mov eax, dword fs:[0]
push eax
mov eax, 0x4530
call fcn.004c1c40
mov eax, dword [0x4ec0b4]
xor eax, esp
mov dword [esp + 0x452c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4ec0b4]
xor eax, esp
push eax
lea eax, [esp + 0x4544]
mov dword fs:[0], eax
mov eax, dword [esp + 0x4554]
inc dword [0x534c04]
mov esi, ecx
mov dword [esp + 0x2c], eax
xor ebp, ebp
mov dword [esp + 0x454c], ebp
mov ecx, dword [esi]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push 1
push 0xffffffffffffffff
push 0x100c
push ecx
call ebx
push 1
mov ecx, 0x535cb0
mov dword [esp + 0x28], eax
call fcn.0047f420
push 0x1c2
call fcn.00475cc0
push eax
mov ecx, 0x535cb0
call fcn.0047f490
mov eax, dword [0x534c0c]
cmp eax, ebp
je 0x4500be
push eax
call dword [sym.imp.KERNEL32.dll_FindCloseChangeNotification]
mov dword [0x534c0c], 0xffffffff
cmp byte [esi + 0x101a], 0
mov byte [esp + 0x18], 0
je 0x4500db
mov ecx, 0x5404e0
call fcn.00407d40
jmp 0x450182
lea edi, [esi + 0x101c]
push edi
call fcn.0043d340
test al, al
jne 0x450111
jmp 0x4500f0
push edi
call fcn.00460c50
cmp word [eax], bp
je 0x45010c
xor edx, edx
push edi
mov word [eax], dx
call fcn.0043d340
test al, al
je 0x4500f0
jmp 0x450111
mov byte [esp + 0x18], 1
push edi
call fcn.00460c50
cmp word [eax], bp
jne 0x45011e
mov eax, edi
push eax
call fcn.004b15d0
push edi
call fcn.00460eb0
mov ebp, eax
cmp ebp, 0xffffffff
je 0x45015a
call fcn.0049f2e0
mov edx, 1
mov ecx, ebp
shl edx, cl
test edx, eax
jne 0x45015a
mov dword [esp + 0x454c], 0xffffffff
cmp dword [0x534c04], 0
jmp 0x45088c
cmp byte [esp + 0x18], 0
jne 0x450180
mov ecx, 0x5404e0
call fcn.00407770
mov ecx, 0x5404d0
call fcn.00486750
push edi
mov ecx, 0x5404d0
call fcn.00486240
xor ebp, ebp
mov eax, dword [esi]
push ebp
push ebp
push 0xb
push eax
call ebx
mov ecx, esi
call fcn.0044f600
cmp byte [esp + 0x18], 0
mov edi, dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
jne 0x4501bd
push 0x4401
push 0x2b4
lea ecx, [esp + 0xc8]
push ecx
push ebp
push 0x4d9468
call edi
cmp eax, ebp
jne 0x4501f8
push ebp
push 0x800
lea edx, [esp + 0x3548]
push edx
call fcn.0049f1e0
cmp byte [esp + 0x18], 0
je 0x4501db
xor eax, eax
jmp 0x4501f8
push 0x4401
push 0x2b4
lea eax, [esp + 0xc8]
push eax
push ebp
lea ecx, [esp + 0x3550]
push ecx
call edi
mov edx, dword [esi]
push eax
push 1
push 0x1003
push edx
call ebx
lea edi, [esi + 0x101c]
push edi
mov dword [esp + 0x2c], edi
call fcn.0049f300
push 1
push str.AllowUppercase
push str.FileList
mov byte [esp + 0x26], al
call fcn.0046cee0
push ebp
push str.ShowSeconds
test eax, eax
push str.FileList
setne byte [esp + 0x2e]
call fcn.0046cee0
test eax, eax
setne byte [esp + 0x1b]
cmp byte [esi + 0x101a], 0
je 0x45025d
mov ecx, esi
call fcn.0044c0d0
jmp 0x450766
push 0x800
lea eax, [esp + 0x3544]
push eax
push 0x4d8800
push edi
call fcn.00460820
lea ecx, [esp + 0x240c]
call fcn.00441aa0
mov byte [esp + 0x454c], 1
lea ecx, [esp + 0x3540]
push ecx
lea ecx, [esp + 0x2410]
call fcn.00441ae0
lea ecx, [esp + 0x23d4]
call fcn.00482f00
lea ecx, [esp + 0x23dc]
call fcn.00482f00
lea ecx, [esp + 0x23e4]
call fcn.00482f00
push 0x1f4
lea ecx, [esp + 0xb4]
mov dword [esp + 0x20], ebp
mov byte [esp + 0x1d], 0
call fcn.004a0090
mov byte [esp + 0x454c], 2
cmp byte [esp + 0x18], 0
jne 0x450679
push ebp
lea edx, [esp + 0x13c8]
push edx
lea ecx, [esp + 0x2414]
call fcn.00441cf0
test al, al
je 0x45066e
test byte [esp + 0x1c], 0x1f
jne 0x45031e
lea ecx, [esp + 0xb0]
call fcn.0049f7f0
lea eax, [esp + 0x13c4]
push eax
call fcn.00460c50
mov edi, eax
mov ecx, 0x4d9468
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x450358
cmp dx, bp
je 0x450354
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x450358
add eax, 4
add ecx, 4
cmp dx, bp
jne 0x450332
xor eax, eax
jmp 0x45035d
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebp
je 0x4502ee
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x68], ecx
mov dword [esp + 0x64], 7
mov dword [esp + 0x80], 0xffffffff
mov dword [esp + 0x6c], ebp
mov dword [esp + 0x78], edi
mov ecx, 0x4d8bb4
mov eax, edi
jmp 0x450390
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4503b6
cmp dx, bp
je 0x4503b2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4503b6
add eax, 4
add ecx, 4
cmp dx, bp
jne 0x450390
xor eax, eax
jmp 0x4503bb
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebp
sete al
mov byte [esp + 0x23], al
test al, al
je 0x4503e6
cmp byte [esp + 0x1a], 0
jne 0x4502ee
mov edx, dword [esp + 0xc4]
mov dword [esp + 0x80], edx
mov byte [esp + 0x19], 1
push 0x1050
lea eax, [esp + 0x378]
push ebp
push eax
call fcn.004c2670
add esp, 0xc
push 0x800
push edi
lea ecx, [esp + 0x37c]
push ecx
call fcn.0047fbe0
push edi
mov ecx, esi
call fcn.0044c360
mov eax, dword [esp + 0x23c8]
mov edx, dword [esp + 0x23c4]
mov ecx, dword [esp + 0x23cc]
mov dword [esp + 0x1378], eax
mov eax, dword [esp + 0x2400]
mov dword [esp + 0x138c], eax
mov eax, dword [esp + 0x1c]
inc eax
cmp byte [esp + 0x23d1], 0
mov dword [esp + 0x1374], edx
mov edx, dword [esp + 0x23fc]
mov dword [esp + 0x137c], ebp
mov dword [esp + 0x1380], ebp
mov dword [esp + 0x1384], ecx
mov dword [esp + 0x1388], edx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x13b8], eax
je 0x45049e
movzx ecx, byte [esp + 0x23d2]
neg ecx
sbb ecx, ecx
and ecx, 0xffffffc0
sub ecx, 0xffffff80
or dword [esp + 0x1390], ecx
lea edx, [esp + 0x374]
push edx
mov ecx, 0x560120
call fcn.0044bc10
cmp byte [esp + 0x22], 0
mov dword [esp + 0x84], eax
jne 0x4504c8
mov eax, dword [esp + 0x78]
push eax
call fcn.00453930
mov edx, dword [esi]
lea ecx, [esp + 0x64]
push ecx
push ebp
push 0x104d
push edx
mov dword [esp + 0x88], edi
call ebx
cmp byte [esp + 0x23d0], 0
mov ebp, eax
jne 0x450525
mov ecx, dword [esp + 0x1378]
mov edx, dword [esp + 0x1374]
push 0x32
lea eax, [esp + 0x34e0]
push eax
push ecx
push edx
call fcn.0047ff20
mov edx, dword [esi]
lea ecx, [esp + 0x30]
push ecx
push ebp
lea eax, [esp + 0x34e4]
push 0x1074
mov dword [esp + 0x50], eax
push edx
jmp 0x45053b
mov ecx, dword [esi]
lea eax, [esp + 0x30]
push eax
push ebp
push 0x1074
mov dword [esp + 0x50], 0x4d89fc
push ecx
mov dword [esp + 0x48], 1
call ebx
cmp byte [esp + 0x23], 0
mov dword [esp + 0x38], 2
je 0x45056f
mov ecx, dword [esi]
lea eax, [esp + 0x30]
push eax
push ebp
lea edx, [esp + 0x2dc]
push 0x1074
mov dword [esp + 0x50], edx
push ecx
jmp 0x450585
mov eax, dword [esi]
lea edx, [esp + 0x30]
push edx
push ebp
push 0x1074
mov dword [esp + 0x50], 0x4d89fc
push eax
call ebx
lea ecx, [esp + 0x98]
push ecx
lea edx, [esp + 0x2400]
push edx
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea eax, [esp + 0xa0]
push eax
lea ecx, [esp + 0x9c]
push ecx
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
push 0x64
lea edx, [esp + 0x3418]
push edx
push 0
lea eax, [esp + 0xac]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
lea edi, [esp + 0x3414]
add edi, 0xfffffffe
mov edi, edi
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4505e0
mov ecx, dword [0x4da6ec]
lea eax, [esp + 0x3414]
mov dword [edi], ecx
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x450600
sub eax, edx
xor ecx, ecx
sar eax, 1
cmp byte [esp + 0x1b], cl
push 0x64
setne cl
lea edx, [esp + eax*2 + 0x3418]
push edx
push 0
lea eax, [esp + 0xac]
push eax
dec ecx
and ecx, 2
push ecx
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTimeFormatW]
mov ecx, dword [esi]
lea eax, [esp + 0x30]
push eax
push ebp
push 0x1074
lea edx, [esp + 0x3420]
push ecx
mov dword [esp + 0x48], 3
mov dword [esp + 0x54], edx
call ebx
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x1c], edx
xor ebp, ebp
jmp 0x4502ee
cmp byte [esp + 0x19], 0
jne 0x45073e
cmp byte [esp + 0x1a], 0
jne 0x45073e
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0xc4]
push 0x1050
lea edx, [esp + 0x378]
push ebp
push edx
mov dword [esp + 0x70], 7
mov dword [esp + 0x74], eax
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x78], ebp
mov dword [esp + 0x84], 0x4d8bb4
call fcn.004c2670
add esp, 0xc
xor eax, eax
lea esp, [esp]
movzx ecx, word [eax + 0x4d8bb4]
mov word [esp + eax + 0x374], cx
add eax, 2
cmp cx, bp
jne 0x4506d0
lea eax, [esp + 0x374]
push eax
mov ecx, 0x560120
mov dword [esp + 0x1388], 0x10
call fcn.0044bc10
mov edx, dword [esi]
lea ecx, [esp + 0x64]
push ecx
push ebp
push 0x104d
push edx
mov dword [esp + 0x94], eax
call ebx
lea edx, [esp + 0x30]
push edx
push eax
mov eax, dword [esi]
push 0x1074
lea ecx, [esp + 0x2e0]
push eax
mov dword [esp + 0x48], 2
mov dword [esp + 0x54], ecx
call ebx
mov byte [esp + 0x454c], 1
lea ecx, [esp + 0xb0]
call fcn.0049f830
mov byte [esp + 0x454c], 0
lea ecx, [esp + 0x240c]
call fcn.00441ac0
mov ecx, 0x560120
call fcn.0044bf00
mov ecx, esi
call fcn.0044fc60
mov edi, dword [esp + 0x2c]
cmp edi, ebp
je 0x4507cc
cmp word [edi], bp
jne 0x4507c0
mov ecx, dword [esi]
push ebp
push ebp
push 0x1004
push ecx
call ebx
cmp dword [esp + 0x24], eax
jl 0x45079f
cmp eax, ebp
jle 0x45079f
dec eax
mov dword [esp + 0x24], eax
mov ecx, dword [esi]
mov eax, 3
lea edx, [esp + 0x30]
push edx
mov dword [esp + 0x44], eax
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x28]
push eax
push 0x102b
push ecx
jmp 0x4507f6
push edi
mov ecx, esi
call fcn.0044f990
test al, al
jne 0x4507f8
mov eax, 3
mov dword [esp + 0x40], eax
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x24]
cmp eax, 0xffffffff
je 0x4507e6
cmp edi, ebp
jne 0x4507e8
xor eax, eax
lea edx, [esp + 0x30]
push edx
push eax
mov eax, dword [esi]
push 0x102b
push eax
call ebx
mov ecx, dword [esi]
push 1
push 0xffffffffffffffff
push 0x100c
push ecx
call ebx
push ebp
mov ecx, 0x535cb0
mov edi, eax
call fcn.0047f490
mov edx, dword [esi]
push ebp
push 1
push 0xb
push edx
call ebx
mov eax, dword [esi]
push ebp
push ebp
push 0x102a
push eax
call ebx
mov ecx, dword [esi]
push ebp
push edi
push 0x1013
push ecx
call ebx
mov ecx, esi
call fcn.0044e3e0
mov ecx, esi
call fcn.0044c8d0
push ebp
mov ecx, 0x535cb0
call fcn.0047f420
mov ecx, 0x546044
call fcn.004838f0
cmp byte [esp + 0x18], 0
jne 0x45087b
cmp byte [esi + 0x101a], 0
jne 0x45087b
mov edx, dword [esp + 0x28]
push 3
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstChangeNotificationW]
mov dword [0x534c0c], eax
mov dword [esp + 0x454c], 0xffffffff
cmp dword [0x534c04], ebp
jle 0x450894
dec dword [0x534c04]
mov ecx, dword [esp + 0x4544]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x452c]
xor ecx, esp
call fcn.004c1c22
add esp, 0x453c
ret 4