Function at 0x48f9b0
Capabilities:
Get file system object information
Hide graphical window
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4f3dd7
mov eax, dword fs:[0]
push eax
sub esp, 0x338
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x330], eax
push ebx
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x348]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [edi + 4]
xor edx, edx
push 0
call fcn.004a1c70
cmp dword [edi + 0x68], 0
je 0x48fa10
push dword [edi + 0x64]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x64
push dword [edi + 4]
call esi
push 0x67
push dword [edi + 4]
mov dword [edi + 8], eax
call esi
push 0x66
push dword [edi + 4]
mov dword [edi + 0x10], eax
call esi
cmp byte [edi + 0x60], 0
push 0x67
push dword [edi + 4]
mov dword [edi + 0xc], eax
je 0x48fa4c
call esi
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x48fa57
call esi
push 0
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 1
push 0x2005
push dword [edi + 8]
call ebx
lea ecx, [esp + 0x14]
call fcn.004cd930
cmp byte [esp + 0x18], 0
je 0x48fa89
push 0x48
push 0
push 0x1036
push dword [edi + 8]
call ebx
mov al, byte [esp + 0x14]
xorps xmm0, xmm0
movq qword [esp + 0x5c], xmm0
push 8
mov byte [edi + 0x45], al
mov dword [esp + 0x68], 0
mov dword [esp + 0x60], 0
call fcn.004df9b3
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x48facc
mov byte [esp + 0x10], al
lea eax, [esp + 0x10]
push 0x51c2c8
push eax
call fcn.004ea58e
xor esi, esi
mov dword [esp + 0x5c], ebx
mov eax, 3
mov dword [esp + 0x60], esi
xor ecx, ecx
mov dword [esp + 0x64], eax
mov word [ebx], cx
mov dword [esp + 0x350], ecx
cmp dword [edi + 0x90], ecx
je 0x48fb0c
lea eax, [edi + 0x8c]
push eax
lea ecx, [esp + 0x60]
call fcn.004128e0
mov ebx, dword [esp + 0x5c]
jmp 0x48fbfc
cmp byte [edi + 0x7c], 0
je 0x48fb29
push 0x504b68
lea ecx, [esp + 0x60]
call fcn.00412a60
mov ebx, dword [esp + 0x5c]
jmp 0x48fbfc
xor ecx, ecx
mov dword [esp + 0x1c], ecx
cmp dword [edi + 0x84], ecx
jbe 0x48fbfc
lea edx, [ecx + 0x20]
mov edi, edi
test ecx, ecx
je 0x48fb7f
cmp eax, esi
jne 0x48fb70
mov eax, esi
lea ecx, [esp + 0x5c]
shr eax, 1
add esi, 0x10
add eax, esi
and eax, 0xfffffff0
dec eax
push eax
call fcn.00412180
mov esi, dword [esp + 0x60]
mov edx, 0x20
mov ebx, dword [esp + 0x5c]
mov ecx, dword [esp + 0x1c]
mov word [ebx + esi*2], dx
inc esi
xor eax, eax
mov dword [esp + 0x60], esi
mov word [ebx + esi*2], ax
mov eax, dword [edi + 0x80]
mov edx, dword [eax + ecx*4]
mov eax, dword [esp + 0x64]
sub eax, esi
mov dword [esp + 0x14], edx
mov ecx, dword [edx + 4]
cmp ecx, eax
jbe 0x48fbbe
add ecx, esi
mov eax, ecx
shr eax, 1
add eax, 0x10
add eax, ecx
lea ecx, [esp + 0x5c]
and eax, 0xfffffff0
dec eax
push eax
call fcn.00412180
mov esi, dword [esp + 0x60]
mov ebx, dword [esp + 0x5c]
mov edx, dword [esp + 0x14]
mov eax, dword [edx + 4]
lea ecx, [ebx + esi*2]
inc eax
add eax, eax
push eax
push dword [edx]
push ecx
call fcn.004e4930
mov eax, dword [esp + 0x20]
add esp, 0xc
mov ecx, dword [esp + 0x1c]
mov edx, 0x20
inc ecx
mov dword [esp + 0x1c], ecx
add esi, dword [eax + 4]
mov eax, dword [esp + 0x64]
mov dword [esp + 0x60], esi
cmp ecx, dword [edi + 0x84]
jb 0x48fb40
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push ebx
push 0
push 0x143
push dword [edi + 0x10]
call esi
push 0
push 0
push 0x14e
push dword [edi + 0x10]
call esi
push ebx
mov dword [esp + 0x354], 0xffffffff
call fcn.004df97b
mov esi, dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea eax, [esp + 0x88]
add esp, 4
push 0x4011
push 0x2b4
push eax
push 0x90
push 0x501180
call esi
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push eax
push 1
push 0x1003
push dword [edi + 8]
call ebx
push 0x4110
push 0x2b4
lea eax, [esp + 0x8c]
push eax
push 0x90
push 0x501180
call esi
push eax
push 0
push 0x1003
push dword [edi + 8]
call ebx
mov edx, 0x3ec
lea ecx, [esp + 0x68]
call fcn.004a1ed0
mov dword [esp + 0x20], 0xe
mov dword [esp + 0x34], 0
mov dword [esp + 0x28], 0x64
mov eax, dword [eax]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x20]
push eax
push 0
push 0x1061
push dword [edi + 8]
call ebx
push dword [esp + 0x68]
call fcn.004df97b
add esp, 4
lea ecx, [esp + 0x68]
mov edx, 0x3f4
call fcn.004a1ed0
mov dword [esp + 0x20], 0xe
mov dword [esp + 0x34], 1
mov dword [esp + 0x28], 0x64
mov eax, dword [eax]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x20]
push eax
push 1
push 0x1061
push dword [edi + 8]
call ebx
push dword [esp + 0x68]
call fcn.004df97b
xorps xmm0, xmm0
mov dword [esp + 0x38], 2
add esp, 4
mov dword [esp + 0x20], 0xf
mov dword [esp + 0x24], 1
mov dword [esp + 0x28], 0x64
movq qword [esp + 0x68], xmm0
mov edx, 0x3ef
mov dword [esp + 0x70], 0
lea ecx, [esp + 0x68]
call fcn.004a1ed0
mov esi, dword [esp + 0x68]
lea eax, [esp + 0x20]
push eax
push 2
push 0x1061
push dword [edi + 8]
mov dword [esp + 0x3c], esi
call ebx
push esi
call fcn.004df97b
add esp, 4
mov dword [esp + 0x20], 5
lea eax, [esp + 0x20]
mov dword [esp + 0x24], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x34], 0x504b6c
push eax
push 0
push 0x104d
push dword [edi + 8]
mov dword [esp + 0x38], 0
call ebx
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 1
push eax
push 0
push 0x104c
push dword [edi + 8]
mov dword [esp + 0x34], 0
mov dword [esp + 0x44], str.2009_09_09_09:09
mov dword [esp + 0x38], 1
call ebx
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 1
push eax
push 0
push 0x104c
push dword [edi + 8]
mov dword [esp + 0x34], 0
mov dword [esp + 0x44], str.9999_MB
mov dword [esp + 0x38], 2
call ebx
xor esi, esi
push 0xffff
push esi
push 0x101e
push dword [edi + 8]
call ebx
inc esi
cmp esi, 3
jl 0x48fe23
push 0
push 0
push 0x1009
push dword [edi + 8]
call ebx
push 0
lea eax, [esp + 0x24]
mov byte [edi + 0x44], 1
push eax
push 0
push 0x30
mov dword [edi + 0x40], 0
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov ebx, dword [esp + 0x28]
lea eax, [esp + 0x68]
mov esi, dword [esp + 0x2c]
sub ebx, dword [esp + 0x20]
sub esi, dword [esp + 0x24]
push eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [esp + 0x70]
mov ecx, dword [esp + 0x74]
sub edx, dword [esp + 0x68]
sub ecx, dword [esp + 0x6c]
cmp edx, ebx
jg 0x48fe9e
mov byte [esp + 0x10], 0
cmp ecx, esi
jle 0x48fea3
mov byte [esp + 0x10], 1
cmp edx, ebx
jle 0x48feb9
mov eax, dword [esp + 0x20]
mov edx, ebx
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x70], eax
cmp ecx, esi
jle 0x48fecf
mov eax, dword [esp + 0x24]
mov ecx, esi
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x74], eax
cmp byte [esp + 0x10], 0
je 0x48feeb
push 1
push ecx
push edx
push dword [esp + 0x78]
push dword [esp + 0x78]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_MoveWindow]
mov eax, dword [edi + 0x48]
xor ecx, ecx
mov dword [edi + 0x4c], 0
mov word [eax], cx
mov esi, dword [edi + 0x70]
movzx eax, word [esi]
cmp eax, 0x5c
je 0x48ff0a
cmp eax, 0x2f
jne 0x48ff37
movzx ecx, word [esi + 2]
cmp ecx, 0x5c
je 0x48ff18
cmp ecx, 0x2f
jne 0x48ff37
cmp word [esi + 4], 0x2e
jne 0x48ff37
movzx ecx, word [esi + 6]
cmp ecx, 0x5c
je 0x48ff2d
cmp ecx, 0x2f
jne 0x48ff37
mov ebx, 4
jmp 0x48ffda
cmp eax, 0x5c
je 0x48ff41
cmp eax, 0x2f
jne 0x48ff6f
movzx ecx, word [esi + 2]
cmp ecx, 0x5c
je 0x48ff4f
cmp ecx, 0x2f
jne 0x48ff6f
cmp word [esi + 4], 0x3f
jne 0x48ff6f
movzx ecx, word [esi + 6]
cmp ecx, 0x5c
je 0x48ff64
cmp ecx, 0x2f
jne 0x48ff6f
mov ecx, esi
call fcn.0041b740
mov ebx, eax
jmp 0x48ffda
cmp eax, 0x61
jb 0x48ff79
cmp eax, 0x7a
jbe 0x48ff83
cmp eax, 0x41
jb 0x48ff9f
cmp eax, 0x5a
ja 0x48ff9f
cmp word [esi + 2], 0x3a
jne 0x48ff9f
movzx ecx, word [esi + 4]
cmp ecx, 0x5c
je 0x48ff98
cmp ecx, 0x2f
jne 0x48ff9f
mov ebx, 3
jmp 0x48ffda
cmp eax, 0x5c
je 0x48ffad
cmp eax, 0x2f
je 0x48ffad
xor ebx, ebx
jmp 0x48ffda
movzx eax, word [esi + 2]
test ax, ax
je 0x48ffd5
cmp eax, 0x5c
je 0x48ffc0
cmp eax, 0x2f
jne 0x48ffd5
lea ecx, [esi + 4]
call fcn.0041b680
test eax, eax
jne 0x48ffd0
xor ebx, ebx
jmp 0x48ffda
lea ebx, [eax + 2]
jmp 0x48ffda
mov ebx, 1
movzx eax, word [esi]
cmp eax, 0x61
jb 0x48ffe7
cmp eax, 0x7a
jbe 0x48fff1
cmp eax, 0x41
jb 0x49000a
cmp eax, 0x5a
ja 0x49000a
cmp word [esi + 2], 0x3a
jne 0x49000a
movzx eax, word [esi + 4]
cmp eax, 0x5c
je 0x490006
cmp eax, 0x2f
jne 0x49000a
xor ebx, ebx
jmp 0x49006c
movzx eax, word [esi]
cmp eax, 0x5c
je 0x490017
cmp eax, 0x2f
jne 0x49006c
movzx eax, word [esi + 2]
cmp eax, 0x5c
je 0x490025
cmp eax, 0x2f
jne 0x49006c
cmp word [esi + 4], 0x3f
jne 0x49006c
movzx eax, word [esi + 6]
cmp eax, 0x5c
je 0x49003a
cmp eax, 0x2f
jne 0x49006c
movzx eax, word [esi + 8]
cmp eax, 0x61
jb 0x490048
cmp eax, 0x7a
jbe 0x490052
cmp eax, 0x41
jb 0x49006c
cmp eax, 0x5a
ja 0x49006c
cmp word [esi + 0xa], 0x3a
jne 0x49006c
movzx eax, word [esi + 0xc]
cmp eax, 0x5c
je 0x490067
cmp eax, 0x2f
jne 0x49006c
mov ebx, 4
lea ecx, [edi + 0x48]
mov edx, 2
cmp ebx, dword [ecx + 8]
jbe 0x4900c2
xor ecx, ecx
lea eax, [ebx + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004df9b3
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
jne 0x4900ab
mov byte [esp + 0x10], al
lea eax, [esp + 0x10]
push 0x51c2c8
push eax
call fcn.004ea58e
push dword [edi + 0x48]
call fcn.004df97b
mov eax, dword [esp + 0x18]
lea ecx, [edi + 0x48]
add esp, 4
mov dword [ecx], eax
mov dword [ecx + 8], ebx
test ebx, ebx
je 0x4900d5
lea eax, [ebx + ebx]
push eax
push esi
push dword [ecx]
call fcn.004e4930
add esp, 0xc
mov eax, dword [edi + 0x48]
xor edx, edx
xorps xmm0, xmm0
mov dword [esp + 0x64], edx
movq qword [esp + 0x5c], xmm0
push 8
mov word [eax + ebx*2], dx
mov dword [edi + 0x4c], ebx
mov dword [esp + 0x60], edx
call fcn.004df9b3
add esp, 4
test eax, eax
jne 0x490113
mov byte [esp + 0x10], al
lea eax, [esp + 0x10]
push 0x51c2c8
push eax
call fcn.004ea58e
xor ecx, ecx
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], 0
mov dword [esp + 0x64], 3
mov word [eax], cx
lea eax, [esp + 0x5c]
mov dword [esp + 0x350], 1
push eax
lea esi, [edi + 0x54]
mov ecx, edi
push esi
lea eax, [edi + 0x70]
push eax
call fcn.00490980
test al, al
jne 0x49015a
lea eax, [edi + 0x48]
mov ecx, esi
push eax
call fcn.004128e0
mov eax, dword [esi + 4]
xor ecx, ecx
mov ebx, eax
mov dword [esp + 0x14], eax
mov edx, 2
mov dword [esp + 0x28], 0
xorps xmm0, xmm0
movq qword [esp + 0x20], xmm0
lea eax, [ebx + 1]
mov dword [esp + 0x20], 0
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004df9b3
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x49038d
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
lea eax, [eax*2 + 2]
push eax
push dword [esi]
push ecx
call fcn.004e4930
add esp, 0xc
lea eax, [esp + 0x5c]
mov byte [esp + 0x350], 2
push eax
lea eax, [esp + 0x24]
mov ecx, edi
push eax
call fcn.00490c40
test eax, eax
je 0x4903f3
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x60], 0
mov word [eax], cx
cmp dword [edi + 0x58], ecx
je 0x4903dd
xorps xmm0, xmm0
mov dword [esp + 0x80], ecx
movq qword [esp + 0x78], xmm0
push 8
mov dword [esp + 0x7c], ecx
call fcn.004df9b3
add esp, 4
test eax, eax
je 0x4903c9
xor ecx, ecx
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], 0
mov dword [esp + 0x80], 3
mov word [eax], cx
mov byte [esp + 0x350], 3
xorps xmm0, xmm0
movq qword [esp + 0x68], xmm0
push 8
mov dword [esp + 0x74], ecx
mov dword [esp + 0x6c], ecx
call fcn.004df9b3
add esp, 4
test eax, eax
je 0x4903b5
xor ecx, ecx
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], 0
mov dword [esp + 0x70], 3
mov word [eax], cx
lea eax, [esp + 0x68]
mov byte [esp + 0x350], 4
push eax
lea eax, [esp + 0x7c]
mov ecx, edi
push eax
push esi
call fcn.00490980
lea eax, [esp + 0x78]
cmp eax, esi
je 0x490308
mov ebx, dword [esp + 0x7c]
cmp ebx, dword [esi + 8]
jbe 0x4902ec
xor ecx, ecx
lea eax, [ebx + 1]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004df9b3
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
je 0x4903a1
push dword [esi]
call fcn.004df97b
mov eax, dword [esp + 0x18]
add esp, 4
mov dword [esi], eax
mov dword [esi + 8], ebx
lea eax, [ebx*2 + 2]
mov dword [esi + 4], ebx
mov ebx, dword [esp + 0x78]
push eax
push ebx
push dword [esi]
call fcn.004e4930
add esp, 0xc
jmp 0x49030c
mov ebx, dword [esp + 0x78]
mov byte [esp + 0x350], 3
push dword [esp + 0x68]
call fcn.004df97b
add esp, 4
mov byte [esp + 0x350], 2
push ebx
call fcn.004df97b
add esp, 4
mov byte [esp + 0x350], 1
push dword [esp + 0x20]
call fcn.004df97b
mov eax, dword [esi + 4]
xor ecx, ecx
mov ebx, eax
mov dword [esp + 0x18], eax
add esp, 4
mov dword [esp + 0x28], 0
mov edx, 2
xorps xmm0, xmm0
movq qword [esp + 0x20], xmm0
lea eax, [ebx + 1]
mov dword [esp + 0x20], 0
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004df9b3
mov ecx, eax
add esp, 4
test ecx, ecx
jne 0x4901a2
push 0x51c2c8
lea eax, [esp + 0x17]
mov byte [esp + 0x17], 0
push eax
call fcn.004ea58e
push 0x51c2c8
lea eax, [esp + 0x15]
mov byte [esp + 0x15], 0
push eax
call fcn.004ea58e
push 0x51c2c8
lea eax, [esp + 0x16]
mov byte [esp + 0x16], 0
push eax
call fcn.004ea58e
push 0x51c2c8
lea eax, [esp + 0x15]
mov byte [esp + 0x15], 0
push eax
call fcn.004ea58e
mov byte [esp + 0x350], 1
push dword [esp + 0x20]
call fcn.004df97b
add esp, 4
jmp 0x49040f
mov byte [esp + 0x350], 1
push dword [esp + 0x20]
call fcn.004df97b
mov ecx, dword [esp + 0x64]
add esp, 4
test ecx, ecx
jne 0x490420
lea eax, [edi + 0x70]
push eax
lea ecx, [esp + 0x60]
call fcn.004128e0
mov ecx, dword [esp + 0x60]
cmp byte [edi + 0x60], 0
je 0x49046b
test ecx, ecx
je 0x49046b
mov esi, dword [esp + 0x5c]
movzx eax, word [esi + ecx*2 - 2]
cmp eax, 0x5c
je 0x49046f
cmp eax, 0x2f
je 0x49046f
cmp dword [esp + 0x64], ecx
jne 0x490462
mov eax, ecx
add ecx, 0x10
shr eax, 1
add eax, ecx
lea ecx, [esp + 0x5c]
and eax, 0xfffffff0
dec eax
push eax
call fcn.00412180
mov ecx, dword [esp + 0x60]
mov esi, dword [esp + 0x5c]
mov dword [esi + ecx*2], 0x5c
jmp 0x49046f
mov esi, dword [esp + 0x5c]
push esi
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 0
push 0x10002
push 0x128
push dword [edi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
push esi
mov dword [esp + 0x354], 0xffffffff
call fcn.004df97b
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x348]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x330]
xor ecx, esp
call fcn.004df96c
mov esp, ebp
pop ebp
ret