Function at 0x421ff4
Capabilities:
Get file system object information

Disassembly:
mov eax, 0x4dcd7e
call fcn.004d1d50
sub esp, 0x548
mov eax, dword [0x52e400]
push ebx
push esi
mov esi, dword [ecx + 0x100]
xor eax, ebp
xor ebx, ebx
cmp esi, ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x4d4], ecx
je 0x422884
mov eax, dword [ebp + 8]
sub eax, ebx
push edi
je 0x4224a9
dec eax
jne 0x422883
cmp dword [esi + 4], ebx
jne 0x422093
push 0x10
pop edi
push edi
call fcn.004d1924
push edi
push ebx
push eax
mov dword [esi + 4], eax
call sub.MSVCR71.dll_memset
mov eax, dword [esi + 4]
mov ecx, dword [ebp - 0x4d4]
add esp, 0x10
mov dword [eax], 1
push 0x4f19f4
lea eax, [ebp - 0x534]
push eax
call fcn.0042160a
mov ecx, eax
mov dword [ebp - 4], edi
call fcn.0041e004
mov ecx, dword [esi + 4]
mov dword [ecx + 0xc], eax
mov ecx, dword [ebp - 0x534]
add ecx, 0xfffffff0
call fcn.00401572
mov eax, dword [esi + 4]
xor edi, edi
cmp dword [eax + 8], ebx
jle 0x4220cc
mov eax, dword [esi + 4]
mov eax, dword [eax + 4]
mov eax, dword [eax + edi*4]
mov eax, dword [eax + 0x14]
cmp eax, ebx
je 0x4220b4
push eax
call dword [sym.imp.USER32.dll_DestroyIcon]
mov eax, dword [esi + 4]
mov eax, dword [eax + 4]
push dword [eax + edi*4]
call sub.MSVCR71.dll_void___cdecl_operator_delete_void__
mov eax, dword [esi + 4]
inc edi
cmp edi, dword [eax + 8]
pop ecx
jl 0x42209d
mov eax, dword [esi + 4]
mov eax, dword [eax + 4]
cmp eax, ebx
je 0x4220e3
push eax
call sub.MSVCR71.dll_void___cdecl_operator_delete___void__
mov eax, dword [esi + 4]
pop ecx
mov dword [eax + 4], ebx
mov eax, dword [esi + 4]
mov dword [eax + 8], ebx
mov dword [ebp - 0x4ec], ebx
mov dword [ebp - 0x4e8], ebx
mov dword [ebp - 0x4e4], ebx
mov ecx, dword [ebp - 0x4d4]
lea eax, [ebp - 0x4f0]
push eax
mov dword [ebp - 4], 0x11
call fcn.004205e7
cmp dword [ebp - 0x4ec], ebx
je 0x422375
mov edi, dword [ebp - 0x4e8]
sub edi, dword [ebp - 0x4ec]
sar edi, 2
je 0x422375
push 0x41c917
push dword [ebp - 0x4e8]
push dword [ebp - 0x4ec]
call fcn.00421123
add esp, 0xc
cmp edi, 5
jb 0x422156
push 5
pop edi
mov eax, dword [esi + 4]
mov dword [eax + 8], edi
mov eax, dword [esi + 4]
mov eax, dword [eax + 8]
shl eax, 2
push eax
call fcn.004d1949
pop ecx
mov ecx, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 4]
xor edi, edi
cmp dword [eax + 8], ebx
jle 0x4221a9
push 0x18
call fcn.004d1924
mov ecx, dword [esi + 4]
mov ecx, dword [ecx + 4]
mov dword [ecx + edi*4], eax
mov eax, dword [esi + 4]
mov eax, dword [eax + 4]
push 0x18
push ebx
push dword [eax + edi*4]
call sub.MSVCR71.dll_memset
mov eax, dword [esi + 4]
add esp, 0x10
inc edi
cmp edi, dword [eax + 8]
jl 0x42217c
mov eax, dword [esi + 4]
cmp dword [eax + 8], ebx
mov dword [ebp - 0x4e0], ebx
jle 0x42245b
mov eax, dword [ebp - 0x4ec]
mov ecx, dword [ebp - 0x4e0]
mov edi, dword [eax + ecx*4]
push dword [edi]
lea ecx, [ebp - 0x544]
mov dword [ebp - 0x4d0], edi
call fcn.00403035
mov dword [ebp - 0x4d8], eax
push dword [edi + 4]
lea ecx, [ebp - 0x54c]
mov byte [ebp - 4], 0x12
call fcn.00403035
push dword [ebp - 0x4d8]
mov byte [ebp - 4], 0x13
push eax
lea eax, [ebp - 0x4dc]
push eax
call fcn.004075a4
add esp, 0xc
mov ecx, dword [ebp - 0x54c]
add ecx, 0xfffffff0
call fcn.00401572
mov ecx, dword [ebp - 0x544]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0x15
call fcn.00401572
cmp dword [edi + 0x1c], 2
jne 0x422275
push str.win7.jumplist.bttask
lea ecx, [ebp - 0x4f8]
call fcn.00403035
mov ecx, dword [ebp - 0x4d4]
lea eax, [ebp - 0x4f8]
push eax
mov byte [ebp - 4], 0x17
call fcn.00421be3
mov ecx, dword [ebp - 0x4f8]
add ecx, 0xfffffff0
mov dword [ebp - 0x4d8], eax
mov byte [ebp - 4], 0x15
call fcn.00401572
jmp 0x4222d6
push ebx
push dword [ebp - 0x4dc]
push ebx
call dword [sym.imp.SHELL32.dll_ExtractIconW]
cmp eax, ebx
mov dword [ebp - 0x4d8], eax
jne 0x4222d6
push 0x4511
xor eax, eax
mov dword [ebp - 0x4cc], ebx
mov ecx, 0xac
lea edi, [ebp - 0x4c8]
push 0x2b4
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x4cc]
push eax
push 0x80
push dword [ebp - 0x4dc]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov eax, dword [ebp - 0x4cc]
mov edi, dword [ebp - 0x4d0]
mov dword [ebp - 0x4d8], eax
push 0x4ec264
lea ecx, [ebp - 0x520]
call fcn.00403035
push dword [edi]
lea ecx, [ebp - 0x554]
mov byte [ebp - 4], 0x18
call fcn.00403035
push dword [ebp - 0x4d8]
add edi, 8
push edi
mov edi, dword [ebp - 0x4e0]
lea ecx, [ebp - 0x520]
push ecx
lea ecx, [ebp - 0x4dc]
push ecx
mov ecx, dword [ebp - 0x4d4]
push eax
mov eax, dword [esi + 4]
mov eax, dword [eax + 4]
push ebx
push dword [eax + edi*4]
mov byte [ebp - 4], 0x19
call fcn.0041fee7
mov ecx, dword [ebp - 0x554]
add ecx, 0xfffffff0
call fcn.00401572
mov ecx, dword [ebp - 0x520]
add ecx, 0xfffffff0
call fcn.00401572
mov ecx, dword [ebp - 0x4dc]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0x11
call fcn.00401572
mov eax, dword [esi + 4]
inc edi
cmp edi, dword [eax + 8]
mov dword [ebp - 0x4e0], edi
jl 0x4221bb
jmp 0x42245b
mov eax, dword [esi + 4]
mov dword [eax + 8], 1
mov eax, dword [esi + 4]
mov eax, dword [eax + 8]
shl eax, 2
push eax
call fcn.004d1949
pop ecx
mov ecx, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 4]
xor edi, edi
cmp dword [eax + 8], ebx
jle 0x4223cc
push 0x18
call fcn.004d1924
mov ecx, dword [esi + 4]
mov ecx, dword [ecx + 4]
mov dword [ecx + edi*4], eax
mov eax, dword [esi + 4]
mov eax, dword [eax + 4]
push 0x18
push ebx
push dword [eax + edi*4]
call sub.MSVCR71.dll_memset
mov eax, dword [esi + 4]
add esp, 0x10
inc edi
cmp edi, dword [eax + 8]
jl 0x42239f
mov edi, 0x4ec264
push edi
lea ecx, [ebp - 0x530]
call fcn.00403035
push edi
lea ecx, [ebp - 0x528]
mov byte [ebp - 4], 0x1a
call fcn.00403035
mov ecx, dword [ebp - 0x4d4]
push 0x4f19e0
lea eax, [ebp - 0x548]
push eax
mov byte [ebp - 4], 0x1b
call fcn.0042160a
push ebx
push ebx
lea ecx, [ebp - 0x530]
push ecx
lea ecx, [ebp - 0x528]
push ecx
mov ecx, dword [ebp - 0x4d4]
push eax
mov eax, dword [esi + 4]
mov eax, dword [eax + 4]
push ebx
push dword [eax]
mov byte [ebp - 4], 0x1c
call fcn.0041fee7
mov ecx, dword [ebp - 0x548]
add ecx, 0xfffffff0
call fcn.00401572
mov ecx, dword [ebp - 0x528]
add ecx, 0xfffffff0
call fcn.00401572
mov ecx, dword [ebp - 0x530]
add ecx, 0xfffffff0
call fcn.00401572
xor edi, edi
mov ecx, dword [ebp - 0x4ec]
cmp ecx, ebx
je 0x42248e
mov eax, dword [ebp - 0x4e8]
sub eax, ecx
sar eax, 2
cmp edi, eax
jae 0x42248e
mov esi, dword [ecx + edi*4]
cmp esi, ebx
je 0x42248b
mov ecx, esi
call fcn.0041cc7b
push esi
call sub.MSVCR71.dll_void___cdecl_operator_delete_void__
pop ecx
inc edi
jmp 0x42245d
lea ecx, [ebp - 0x4f0]
call fcn.004ac35d
lea ecx, [ebp - 0x4f0]
call fcn.004ac35d
jmp 0x422883
cmp dword [esi], ebx
jne 0x422883
push 0x10
pop edi
push edi
call fcn.004d1924
push edi
push ebx
push eax
mov dword [esi], eax
call sub.MSVCR71.dll_memset
mov eax, dword [esi]
add esp, 0x10
push str.User_Task
mov dword [eax], ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ecx, dword [esi]
push edi
mov dword [ecx + 0xc], eax
call fcn.004d1949
pop ecx
mov ecx, dword [esi]
mov dword [ecx + 4], eax
mov eax, dword [esi]
mov dword [eax + 8], 4
mov eax, dword [esi]
xor edi, edi
cmp dword [eax + 8], ebx
jle 0x422523
push 0x18
call fcn.004d1924
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
mov dword [ecx + edi*4], eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
push 0x18
push ebx
push dword [eax + edi*4]
call sub.MSVCR71.dll_memset
mov eax, dword [esi]
add esp, 0x10
inc edi
cmp edi, dword [eax + 8]
jl 0x4224f9
xor eax, eax
mov word [ebp - 0x218], bx
mov ecx, 0x81
lea edi, [ebp - 0x216]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea eax, [ebp - 0x218]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str.win7.jumplist.newtask
lea ecx, [ebp - 0x524]
call fcn.00403035
push str._task:newtask
lea ecx, [ebp - 0x518]
mov dword [ebp - 4], ebx
call fcn.00403035
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x4fc]
mov byte [ebp - 4], 1
call fcn.00403035
mov edi, dword [ebp - 0x4d4]
push 0x4f19bc
lea eax, [ebp - 0x540]
push eax
mov ecx, edi
mov byte [ebp - 4], 2
call fcn.0042160a
mov dword [ebp - 0x4d0], eax
lea eax, [ebp - 0x524]
push eax
mov ecx, edi
mov byte [ebp - 4], 3
call fcn.00421be3
push eax
push ebx
lea eax, [ebp - 0x518]
push eax
lea eax, [ebp - 0x4fc]
push eax
push dword [ebp - 0x4d0]
mov eax, dword [esi]
mov eax, dword [eax + 4]
push ebx
push dword [eax]
mov ecx, edi
call fcn.0041fee7
mov ecx, dword [ebp - 0x540]
add ecx, 0xfffffff0
call fcn.00401572
mov ecx, dword [ebp - 0x4fc]
add ecx, 0xfffffff0
call fcn.00401572
mov ecx, dword [ebp - 0x518]
add ecx, 0xfffffff0
call fcn.00401572
mov ecx, dword [ebp - 0x524]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.00401572
push str.win7.jumplist.startalltask
lea ecx, [ebp - 0x50c]
call fcn.00403035
push str._task:startall
lea ecx, [ebp - 0x51c]
mov dword [ebp - 4], 4
call fcn.00403035
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x504]
mov byte [ebp - 4], 5
call fcn.00403035
push 0x4f19ac
lea eax, [ebp - 0x550]
push eax
mov ecx, edi
mov byte [ebp - 4], 6
call fcn.0042160a
mov dword [ebp - 0x4d0], eax
lea eax, [ebp - 0x50c]
push eax
mov ecx, edi
mov byte [ebp - 4], 7
call fcn.00421be3
push eax
push ebx
lea eax, [ebp - 0x51c]
push eax
lea eax, [ebp - 0x504]
push eax
push dword [ebp - 0x4d0]
mov eax, dword [esi]
mov eax, dword [eax + 4]
push ebx
push dword [eax + 4]
mov ecx, edi
call fcn.0041fee7
mov ecx, dword [ebp - 0x550]
add ecx, 0xfffffff0
call fcn.00401572
mov ecx, dword [ebp - 0x504]
add ecx, 0xfffffff0
call fcn.00401572
mov ecx, dword [ebp - 0x51c]
add ecx, 0xfffffff0
call fcn.00401572
mov ecx, dword [ebp - 0x50c]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.00401572
push str.win7.jumplist.pausealltask
lea ecx, [ebp - 0x4f4]
call fcn.00403035
push str._task:pauseall
lea ecx, [ebp - 0x514]
mov dword [ebp - 4], 8
call fcn.00403035
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x52c]
mov byte [ebp - 4], 9
call fcn.00403035
push 0x4f199c
lea eax, [ebp - 0x538]
push eax
mov ecx, edi
mov byte [ebp - 4], 0xa
call fcn.0042160a
mov dword [ebp - 0x4d0], eax
lea eax, [ebp - 0x4f4]
push eax
mov ecx, edi
mov byte [ebp - 4], 0xb
call fcn.00421be3
push eax
push ebx
lea eax, [ebp - 0x514]
push eax
lea eax, [ebp - 0x52c]
push eax
push dword [ebp - 0x4d0]
mov eax, dword [esi]
mov eax, dword [eax + 4]
push ebx
push dword [eax + 8]
mov ecx, edi
call fcn.0041fee7
mov ecx, dword [ebp - 0x538]
add ecx, 0xfffffff0
call fcn.00401572
mov ecx, dword [ebp - 0x52c]
add ecx, 0xfffffff0
call fcn.00401572
mov ecx, dword [ebp - 0x514]
add ecx, 0xfffffff0
call fcn.00401572
mov ecx, dword [ebp - 0x4f4]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.00401572
push str.win7.jumplist.exit
lea ecx, [ebp - 0x510]
call fcn.00403035
push str._shell:exit
lea ecx, [ebp - 0x508]
mov dword [ebp - 4], 0xc
call fcn.00403035
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x500]
mov byte [ebp - 4], 0xd
call fcn.00403035
push 0x4f1978
lea eax, [ebp - 0x53c]
push eax
mov ecx, edi
mov byte [ebp - 4], 0xe
call fcn.0042160a
mov dword [ebp - 0x4d0], eax
lea eax, [ebp - 0x510]
push eax
mov ecx, edi
mov byte [ebp - 4], 0xf
call fcn.00421be3
push eax
push ebx
lea eax, [ebp - 0x508]
push eax
lea eax, [ebp - 0x500]
push eax
push dword [ebp - 0x4d0]
mov eax, dword [esi]
mov eax, dword [eax + 4]
push ebx
push dword [eax + 0xc]
mov ecx, edi
call fcn.0041fee7
mov ecx, dword [ebp - 0x53c]
add ecx, 0xfffffff0
call fcn.00401572
mov ecx, dword [ebp - 0x500]
add ecx, 0xfffffff0
call fcn.00401572
mov ecx, dword [ebp - 0x508]
add ecx, 0xfffffff0
call fcn.00401572
mov ecx, dword [ebp - 0x510]
add ecx, 0xfffffff0
call fcn.00401572
pop edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
xor ecx, ebp
pop ebx
call fcn.004d1da7
leave
ret 4