Function at 0x4027a1
Capabilities:
Get file system object information

Disassembly:
xor edi, dword [0x48cbcc]
dec ebx
xor ebx, ebp
xchg esi, esi
sub edi, eax
push 0x79
push 7
push 0x65
push 0x69
push 0
push 0x28
push 0x6c
push 0xb
push 0x54
push 0x74
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
xor edi, edi
mov esi, 0x160b
imul edi, esi, 0x1c
push edi
rol edi, 6
add edi, 0x6d6
jne 0x40204d
ror edi, 1
pop dword [0x4887c4]
add dword [0x488161], edi
fdivr st(7), st(0)
add eax, 0xdaa3e0f2
je 0x40205f
fidiv dword [ebp + edi*8 - 0x14]
in al, dx
insb byte es:[edi], dx
int1
hlt
lea edi, [0x7e]
mov esi, 0xa5
lea ebx, [5]
mov edx, eax
push 0xda6
pop edx
mov ebx, 0x658
imul edx, ebx, 0x61
test dword [0x488fbb], edx
jne 0x4020b1
and edx, 0xfff
sub edx, 0xe1c
mov esi, 0xff1
add edx, esi
add edx, 0x5e8
cmp edx, 0xd47
je 0x4020d4
add edx, 0xb76
mov esi, 0x9e8
add edx, esi
mov edi, 0x10f8
imul edx, edi, 0x55
sub edx, dword [0x48816c]
add edx, 0x95d
jne 0x4020f0
shl edx, 1
sub edx, 0x39e
and edx, 0xfff
add dword [0x48872d], edx
sub eax, 0x4a
jmp 0x402075
mov dword [0x488172], 0
mov eax, dword [0x488172]
mov eax, 0x171549
mov dword [0x488614], 0x31769a
add eax, dword [0x488614]
push eax
xor ecx, ecx
push ecx
call dword [sym.imp.user32.dll_LoadBitmapA]
mov dword [0x488d18], eax
mov dword [str.A_I__rle_E], 0
mov eax, dword [str.A_I__rle_E]
push 0x3b9b5d
pop ecx
mov eax, 0xcf14a
add ecx, eax
push ecx
push 0
pop ebx
push ebx
call dword [sym.imp.user32.dll_LoadBitmapA]
mov dword [0x488e2e], eax
mov dword [0x488031], 0
mov eax, dword [0x488031]
mov ebx, eax
ror ebx, 5
or ebx, 0x311
je 0x402822
ror ebx, 2
and ebx, 0xfffff
test dword [0x488300], ebx
je 0x402844
mov eax, 0x69c
or ebx, eax
and ebx, 0xf
mov eax, 0xe6a
or ebx, eax
add ebx, 0xf1f
push ebx
pop dword [0x4880e5]
add dword [0x488b79], ebx
lea eax, [ebx + ebp + 0xaee]
mov ebx, 0x1ed0
add eax, ebx
test eax, 0x16e5
jne 0x402876
ror eax, 8
mov ebx, 0x124d
or eax, ebx
sub dword [0x48860b], eax
mov edx, 0x27
sub edx, 0xf376ef99
jne 0x403327
mov dword [0x48823b], eax
mov edi, 0xb5
mov esi, edi
push esi
mov ecx, 0x1a
mov ebp, ecx
push ebp
mov dword [0x488c2c], 0
mov esi, dword [0x488c2c]
push esi
mov ecx, 3
push ecx
call dword [sym.imp.GDI32.DLL_GetPath]
xor edi, edi
mov ecx, 0x1b29
imul edi, ecx, 0x25
sub edi, 0x235
je 0x4028d7
sub edi, 0xc0b
sub dword [0x48835d], edi
leave
ret
push ebp
mov ebp, esp
sub esp, 0x74
push edi
push esi
push esi
push 0
call fcn.0040269d
push 0x286
pop eax
shr eax, 7
or dword [ebp - 0x18], eax
jne 0x403346
dec eax
mov ebx, 0xd27
imul eax, ebx, 0x61
test eax, 0x229
jne 0x403357
shl eax, 1
dec eax
test dword [ebp - 0x18], eax
je 0x403365
mov ebx, 0x26ea
or eax, ebx
dec eax
mov dword [ebp - 0x74], eax
push 0
call dword [sym.imp.user32.dll_GetDC]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x70], eax
push 0xb3e5
call fcn.00402760
or al, al
jne 0x40338c
or edi, 0x2b
add eax, ebx
mov dword [ebp - 0x2c], ebx
xor edi, edi
shr edi, 1
push edi
shl edi, 1
test dword [ebp - 0x1c], edi
je 0x4033a8
rol edi, 5
add edi, 0x95c
mov esi, 0x867
sub edi, esi
pop dword [0x488c17]
mov dword [ebp - 0x10], edi
mov edi, 0x829
rol edi, 4
push edi
mov ebx, 0x1094
or edi, ebx
add edi, 0x75b
je 0x4033cf
sub edi, dword [0x488b21]
pop dword [0x4886ac]
add dword [0x48833d], edi
push 0
push 0xf003f
push 0
push 0
push 0x80000002
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
mov dword [ebp - 0x38], 0
mov ebx, dword [ebp - 0x38]
push ebx
push 1
pop ebx
push ebx
call dword [sym.imp.GDI32.DLL_RectInRegion]
push 0x488cff
push 0x13d9
push 0xb234
push dword [str._b_t_t__]
push 0
push 0x48848b
call fcn.00402728
mov esi, 0xaa2e6
mov dword [0x488e6d], 0x3de063
add esi, dword [0x488e6d]
push esi
call dword [sym.imp.GDI32.DLL_CreateColorSpaceW]
or eax, eax
jne section..XJy
call fcn.00402490
test al, al
je 0x40345d
lea ecx, [ebx + 6]
mov dword [0x4881c2], eax
mov edi, 0x232a4e
mov dword [ebp - 0x18], 0x255fd0
add edi, dword [ebp - 0x18]
push edi
mov ebx, 0x3305a9
mov eax, ebx
mov dword [0x4883fc], 0x1586f6
add eax, dword [0x4883fc]
push eax
mov eax, 0x2483a
mov ecx, eax
mov edi, 0x463f44
add ecx, edi
push ecx
xor eax, eax
push eax
call dword [sym.imp.advapi32.dll_RegReplaceKeyW]
or eax, eax
je 0x40207b
mov esi, 0x1077
or eax, esi
cmp eax, 0xe0c
je 0x4034c3
and eax, 0xfffffff
add eax, 0xf9a
mov dword [ebp - 0x2c], eax
push 0x592a
push 0x7ac9
mov dword [ebp - 0x5c], esi
inc ebx
push 0
push 0
call fcn.004025b8
mov edi, 0x8b5
mov eax, 0x1752
imul edi, eax, 8
sub edi, 0xce3
jne 0x4034f9
add edi, 0x826
inc edi
sub edi, 0x2a3
test edi, 0x19fe
je 0x403515
mov ebx, 0x185b
sub edi, ebx
mov eax, 0xfc
xor eax, edi
shr edi, 8
cmp edi, 0x2d9
je 0x403526
sub edi, dword [0x488c36]
sub dword [0x488168], edi
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.SHELL32.DLL_SHGetFileInfoA]
xor edx, edx
add edx, 0x7e7
or edx, dword [0x48850b]
je 0x403562
mov ebx, 0x4ff
add edx, ebx
mov edi, 0x249
imul edx, edi, 0xb
mov edi, 0xd95
add edx, edi
sub edx, dword [0x4887a9]
push edx
pop dword [0x488f37]
mov dword [ebp - 0x4c], edx
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.SHELL32.DLL_SHGetDataFromIDListA]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.SHELL32.DLL_SHGetFileInfoA]
push 0x1af
pop ebx
add ebx, dword [0x4887bf]
or ebx, 0x32d
jne 0x4035a4
rol ebx, 6
and ebx, 0xfffffff
or dword [ebp - 0x6c], ebx
je 0x4035b5
and ebx, 0xffffff
and ebx, 0xfffffff
push ebx
pop dword [0x4886e0]
add dword [0x488b02], ebx
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.SHELL32.DLL_SHGetDataFromIDListA]
lea ecx, [eax + ebp + 0x2257]
mov edi, 0x130
sub ecx, edi
or ecx, 0x1e66
jne 0x4035ea
inc ecx
mov dword [0x488fdf], ecx
sub eax, 0x9a00a0
push 0x497
pop esi
mov edi, 0xbbc
add esi, edi
or esi, 0xcd0
je 0x40361b
mov ecx, 0x1d38
imul esi, ecx, 0x2b
rol esi, 1
mov edi, 0x101c
add esi, edi
dec esi
sub esi, 0xc1b
jne 0x403626
ror esi, 1
add dword [0x488951], esi
sub eax, 0x7f2cc8df
mov dword [0x48891b], eax
push 0xf8
pop edx
push edx
mov esi, 0xcd
mov edi, esi
push edi
mov dword [ebp - 0x28], 0x71327652
mov eax, dword [ebp - 0x28]
push eax
mov dword [ebp - 0x28], 0
mov ebx, dword [ebp - 0x28]
push ebx
call dword [sym.imp.user32.dll_DefWindowProcA]
mov ebx, dword [0x48891b]
push ebx
sub eax, dword [0x48823d]
sub eax, 0xeb
jne 0x40367a
rol eax, 1
dec eax
rol eax, 1
mov edi, 0x162e
xor edi, eax
or eax, dword [0x4887dd]
je 0x40369a
mov ebx, 0x1ea9
imul eax, ebx, 0xf
sub eax, 0x2c8
shl eax, 6
add dword [0x488f7a], eax
ret