Function at 0x404000
Capabilities:
Get file system object information
Print debug messages

Disassembly:
push ebp
push esp
pop ebp
sub esp, 0x2c
push esi
push edi
lea edi, [ebp - 0x2c]
nop
push 0xb
nop
pop ecx
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov dword [ebp - 8], 0
call fcn.00407570
call fcn.00407570
push esp
pop esi
push 3
push 0
push 0
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp esi, esp
call fcn.00407340
mov dword [ebp - 0x14], 0
call fcn.00407570
call fcn.00407570
mov dword [ebp - 0x20], 4
call fcn.00407570
call fcn.00407570
push esp
pop esi
lea eax, [ebp - 8]
push eax
push 1
push 0
push 0x45b3f4
push 0x80000002
call dword [0x45d268]
cmp esi, esp
call fcn.00407340
mov dword [ebp - 0x28], eax
push esp
pop esi
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], ecx
cmp dword [ebp - 0x2c], 0
je 0x4040bf
cmp dword [ebp - 0x2c], 5
je 0x404112
jmp 0x40414b
push esp
pop esi
push 0
push 0x44d870
push 0
push 0
push 0x44d870
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
push esp
pop esi
push str.DEBUG:__FOUND_POLICIES_REGISTRY_KEY_
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push str.FTXGgTOi4UG7zB_IktGzCN_S9_r1QBH_d5H_BfoILKM_3K_49hvhMPKGEM_t_Qxpw35_A3mAI3xIVw1XI_wu_46xTk_jUDaEkJ9pvE_b_i_UJdC334sxZzVy4bpcSdiuCj_D8tER7xPE_BET9R_yeCGVs2___cK_UInt1k__RoNx_P_dQk__e_XdDE1PWidDaeY_E_CDp3a_XUt____Ww_WTU_f495s_y8Uvq_JqH6icmqJICkZ_MiyX8Zo1_sIE5_YrSN_d2J7_nxPOg9hX4GuO_Z__L___P8tRfe8_6_RK_ibzOSkqYXvL_Jz7xxSRXuwJ_fzYHatCUD_YBwczBhWViQwbCjbllM____4AZ_YDV_P1pPSC_kuofjJWP46___r___EAtsVsIOKle_RE_HW757vdrDRvGAY_FShua_K_XLBCWRL_oz5_8TtJDnx_BXES8ff_w1sD_BlK_9LL__hhJlsSmkA_8cAIRBZ_yL_4hHi_Vz4HID3zK_i1UwV_OsBNg8_x_tTh8gV1ErrnvT__8c__zXUi__x3c35_PcGtaMBkx_GwZTMmDIIkysGJjN8OwWKB1I_ymhNf2_bCB4V_aLZrjbtvWp_pM_M4_t_R_tcSAxriXY_YCRdG_wWmPjMgt_q1_QZh69_VbXl1ig6_WyZmFYj_UsuI_j__aGT_alX_1_N____B9yqQPi_qn___eU_EeuF4C_6xBA_Enh8_jl_s6K_as_zyL1_YhEgVvMRDaP_j__9y__g1U
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp esi, esp
call fcn.00407340
jmp 0x404184
call fcn.00407570
call fcn.00407570
push esp
pop esi
push str.DEBUG:__CANNOT_ACCESS_POLICIES_REGISTRY_KEY_
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.00407340
mov esi, esp
push 2
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.00407340
pushfd
xor eax, eax
inc eax
popfd
jmp 0x40425f
call fcn.00407570
call fcn.00407570
push esp
pop esi
push str.DEBUG:__COULDNT_FIND_POLICIES_REGISTRY_KEY_
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push str._gOq_jEg__7ZGgSK_mODS_GJ73F7E_UsLA_aDSc_brnEjpiVZ3YK_2_Drtf__CroxpAFNT_IP6rNyv_o6R4KFlC___waaKPr9adGskb_uC_wsj_S3e_ZnCm_Bb_HgpfM5rRHI_VStX_JTkZ_qWexCV_oDmA_rcOQ7E_IpK5oqWNq6D4S5_nI_u5_H_R_gnc23KHpl_j8eybN_qwGCINKrukis_pbuVk_gY5KsIYMvL_9PK_ESrSRiY1XFsyipx_n3_6_n_mMNzd__6wftHSN_D_PxTA__8rg_aElXF5F_h__rST_m9ndaAVKK5CXjQ_amZ9JEH5DD_T18LXRj_tZS__u93C3ugCSVC_DYMEMxg_ivS__i6__ya_dT_chwAoO_WcHy2teq_OX6bWfh_gH_y7_Rm8KPIlS_xc
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp esi, esp
call fcn.00407340
xor eax, eax
jmp 0x40425f
call fcn.00407570
call fcn.00407570
push esp
pop esi
push 0
push 0x44d870
push 0
push 0
push 0x44d870
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp esi, esp
call fcn.00407340
push esp
pop esi
lea edx, [ebp - 0x20]
push edx
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push str.p__b_
mov ecx, dword [ebp - 8]
push ecx
call dword [0x45d26c]
cmp esi, esp
call fcn.00407340
or eax, eax
je 0x40421b
push esp
pop esi
push str.DEBUG:__COULDNT_FIND_EnableLUA_entry._Must_be_older_OS._
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push 0x60
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
push esp
pop esi
mov edx, dword [ebp - 8]
push edx
call dword [0x45d270]
cmp esi, esp
call fcn.00407340
xor eax, eax
jmp 0x40425f
call fcn.00407570
call fcn.00407570
push esp
pop esi
mov eax, dword [ebp - 8]
push eax
call dword [0x45d270]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
cmp dword [ebp - 0x14], 0
jne 0x40424e
xor eax, eax
jmp 0x40425f
pushfd
sub eax, eax
inc eax
popfd
jmp 0x40425f
push edx
push ebp
pop ecx
push eax
lea edx, [0x404280]
call fcn.00407370
pop eax
pop edx
pop edi
pop esi
add esp, 0x2c
cmp ebp, esp
call fcn.00407340
push ebp
pop esp
pop ebp
ret