Function at 0x406dd0
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x724
mov eax, dword [0x448ad0]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x724], ecx
call fcn.00401d90
mov dword [ebp - 0x2cc], eax
lea ecx, [ebp - 0x4e0]
call fcn.0041c7b0
mov ecx, 0x44a46c
call fcn.00401df0
mov dword [ebp - 0x2c8], eax
push 0x104
lea eax, [ebp - 0x4d8]
push eax
mov ecx, dword [ebp - 0x2c8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [ebp - 0x4e4], eax
cmp dword [ebp - 0x4e4], 0
jne 0x406e5a
call fcn.00401e10
mov dword [ebp - 0x708], eax
lea ecx, [ebp - 0x4e0]
call fcn.00405ee0
mov eax, dword [ebp - 0x708]
jmp 0x40712e
cmp dword [ebp - 0x4e4], 0x104
jne 0x406e8c
push 0x7a
call fcn.00401d50
add esp, 4
mov dword [ebp - 0x70c], eax
lea ecx, [ebp - 0x4e0]
call fcn.00405ee0
mov eax, dword [ebp - 0x70c]
jmp 0x40712e
cmp dword [ebp - 0x2c8], 0
je 0x406ea9
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp dword [ebp - 0x2c8], eax
jne 0x406f2e
mov edx, 0x22
mov word [ebp - 0x700], dx
lea eax, [ebp - 0x4d8]
push eax
push 0x105
lea ecx, [ebp - 0x6fe]
push ecx
call fcn.004054b0
add esp, 0xc
lea edx, [ebp - 0x700]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x704], eax
mov eax, 0x22
mov ecx, dword [ebp - 0x704]
mov word [ebp + ecx*2 - 0x700], ax
xor edx, edx
mov eax, dword [ebp - 0x704]
mov word [ebp + eax*2 - 0x6fe], dx
lea ecx, [ebp - 0x700]
push ecx
push 0x43c754
mov edx, dword [ebp - 0x724]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x724]
push ecx
mov edx, dword [eax + 0xc]
call edx
mov dword [ebp - 0x4e8], eax
jmp 0x406f54
lea eax, [ebp - 0x4d8]
push eax
push 0x43c754
mov ecx, dword [ebp - 0x724]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x724]
push eax
mov ecx, dword [edx + 0xc]
call ecx
mov dword [ebp - 0x4e8], eax
cmp dword [ebp - 0x4e8], 0
jge 0x406f7f
mov edx, dword [ebp - 0x4e8]
mov dword [ebp - 0x710], edx
lea ecx, [ebp - 0x4e0]
call fcn.00405ee0
mov eax, dword [ebp - 0x710]
jmp 0x40712e
lea eax, [ebp - 0x4d8]
push eax
push str.Module_Raw
mov ecx, dword [ebp - 0x724]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x724]
push eax
mov ecx, dword [edx + 0xc]
call ecx
mov dword [ebp - 0x4e8], eax
cmp dword [ebp - 0x4e8], 0
jge 0x406fd0
mov edx, dword [ebp - 0x4e8]
mov dword [ebp - 0x714], edx
lea ecx, [ebp - 0x4e0]
call fcn.00405ee0
mov eax, dword [ebp - 0x714]
jmp 0x40712e
lea eax, [ebp - 0x4ec]
push eax
push 0x44a3b4
call dword [sym.imp.ole32.dll_StringFromCLSID]
mov dword [ebp - 0x4e8], eax
cmp dword [ebp - 0x4e8], 0
jge 0x407013
mov ecx, dword [ebp - 0x4e8]
mov dword [ebp - 0x718], ecx
lea ecx, [ebp - 0x4e0]
call fcn.00405ee0
mov eax, dword [ebp - 0x718]
jmp 0x40712e
mov edx, dword [ebp - 0x4ec]
push edx
call fcn.004054a0
add esp, 4
push eax
push str.MODULEGUID
mov eax, dword [ebp - 0x724]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x724]
push edx
mov eax, dword [ecx + 0xc]
call eax
mov dword [ebp - 0x4e8], eax
mov ecx, dword [ebp - 0x4ec]
push ecx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
cmp dword [ebp - 0x4e8], 0
jge 0x40707a
mov edx, dword [ebp - 0x4e8]
mov dword [ebp - 0x71c], edx
lea ecx, [ebp - 0x4e0]
call fcn.00405ee0
mov eax, dword [ebp - 0x71c]
jmp 0x40712e
push 0x2000
push 0x2b4
lea eax, [ebp - 0x2c0]
push eax
push 0
lea ecx, [ebp - 0x4d8]
push ecx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
jne 0x4070c4
push str.InprocServer32
push str.MODULETYPE
mov edx, dword [ebp - 0x724]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x724]
push ecx
mov edx, dword [eax + 0xc]
call edx
mov dword [ebp - 0x4e8], eax
jmp 0x4070e8
push str.LocalServer32
push str.MODULETYPE
mov eax, dword [ebp - 0x724]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x724]
push edx
mov eax, dword [ecx + 0xc]
call eax
mov dword [ebp - 0x4e8], eax
cmp dword [ebp - 0x4e8], 0
jl 0x407111
mov ecx, dword [ebp - 0x724]
push ecx
mov edx, dword [0x44a3b0]
mov eax, dword [edx]
mov ecx, dword [0x44a3b0]
mov edx, dword [eax + 0x14]
call edx
mov dword [ebp - 0x4e8], eax
mov eax, dword [ebp - 0x4e8]
mov dword [ebp - 0x720], eax
lea ecx, [ebp - 0x4e0]
call fcn.00405ee0
mov eax, dword [ebp - 0x720]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0041d78c
mov esp, ebp
pop ebp
ret