Function at 0x442c60
Capabilities:
Get file system object information

Disassembly:
push ebp
lea ebp, [esp - 0x454c]
mov eax, 0x454c
call fcn.004ebbf0
push 0xffffffffffffffff
push 0x505c2e
mov eax, dword fs:[0]
push eax
sub esp, 0x9c
mov eax, dword [0x528af4]
xor eax, ebp
mov dword [ebp + 0x4548], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x18], edi
mov eax, dword [ebp + 0x4554]
inc dword [0x539a60]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push 1
push 0xffffffffffffffff
push 0x100c
push dword [edi + 0x28]
call ebx
push 1
mov ecx, 0x55d0a8
mov dword [ebp - 0x20], eax
call fcn.004a79e0
push 0x1c2
call fcn.00488530
push eax
mov ecx, 0x55d0a8
call fcn.004a7910
mov eax, dword [0x538a14]
test eax, eax
je 0x442d0d
push eax
call dword [sym.imp.KERNEL32.dll_FindCloseChangeNotification]
mov dword [0x538a14], 0xffffffff
cmp byte [edi + 0x1042], 0
mov byte [ebp - 0xd], 0
je 0x442d29
mov ecx, 0x55d09c
call fcn.004020b0
jmp 0x442dc0
lea esi, [edi + 0x1044]
push esi
call fcn.00469360
test al, al
jne 0x442d61
lea esp, [esp]
push esi
call fcn.00478eb0
cmp word [eax], 0
je 0x442d5d
xor ecx, ecx
push esi
mov word [eax], cx
call fcn.00469360
test al, al
je 0x442d40
jmp 0x442d61
mov byte [ebp - 0xd], 1
push esi
call fcn.00478eb0
cmp word [eax], 0
jne 0x442d6f
mov eax, esi
push eax
call fcn.004d8270
push esi
call fcn.004782d0
mov edi, eax
cmp edi, 0xffffffff
je 0x442d98
call fcn.004c3b10
mov edx, 1
mov ecx, edi
shl edx, cl
test edx, eax
je 0x443492
cmp byte [ebp - 0xd], 0
jne 0x442dbd
mov ecx, 0x55d09c
call fcn.00402840
mov ecx, 0x543e78
call fcn.004ac740
push esi
mov ecx, 0x543e78
call fcn.004aca40
mov edi, dword [ebp - 0x18]
push 0
push 0
push 0xb
push dword [edi + 0x28]
call ebx
mov ecx, edi
call fcn.0043f210
cmp byte [ebp - 0xd], 0
mov esi, dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
jne 0x442dfc
push 0x4401
push 0x2b4
lea eax, [ebp + 0x3138]
push eax
push 0
push 0x50bc14
call esi
test eax, eax
jne 0x442e35
push 0
push 0x800
lea eax, [ebp + 0x341c]
push eax
call fcn.004c3a00
cmp byte [ebp - 0xd], 0
je 0x442e19
xor eax, eax
jmp 0x442e35
push 0x4401
push 0x2b4
lea eax, [ebp + 0x3138]
push eax
push 0
lea eax, [ebp + 0x341c]
push eax
call esi
push eax
push 1
push 0x1003
push dword [edi + 0x28]
call ebx
lea esi, [edi + 0x1044]
push esi
call fcn.004c3b30
push 0
push str.ShowSeconds
push str.FileList
mov byte [ebp - 0xf], al
call fcn.0049fd30
test eax, eax
mov ecx, edi
setne byte [ebp - 0x10]
cmp byte [edi + 0x1042], 0
je 0x442e7d
call fcn.004434d0
jmp 0x44337e
push 0
push 0
push esi
call fcn.00436ec0
push 0x800
lea eax, [ebp + 0x341c]
push eax
push 0x50ba14
push esi
call fcn.004789f0
lea ecx, [ebp]
call fcn.0046abf0
mov byte [ebp - 4], 1
lea eax, [ebp + 0x341c]
push eax
lea ecx, [ebp]
call fcn.0046adf0
xor al, al
mov dword [ebp + 0x3100], 0
push 0x1f4
lea ecx, [ebp - 0xa4]
mov dword [ebp + 0x3104], 0
mov dword [ebp + 0x3108], 0
mov dword [ebp + 0x310c], 0
mov dword [ebp + 0x3110], 0
mov dword [ebp + 0x3114], 0
mov dword [ebp - 0x14], 0
mov byte [ebp - 0xe], al
call fcn.004c2fb0
mov byte [ebp - 4], 2
cmp byte [ebp - 0xd], 0
jne 0x4432ae
jmp 0x442f27
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push 0
lea eax, [ebp + 0x20f0]
push eax
lea ecx, [ebp]
call fcn.0046acd0
test al, al
je 0x4432a3
test byte [ebp - 0x14], 0x1f
jne 0x442f51
lea ecx, [ebp - 0xa4]
call fcn.004c45c0
lea eax, [ebp + 0x20f0]
push eax
call fcn.00478eb0
mov dword [ebp - 0x24], eax
mov edx, 0x50bc14
mov ecx, eax
mov si, word [ecx]
cmp si, word [edx]
jne 0x442f8d
test si, si
je 0x442f89
mov ax, word [ecx + 2]
cmp ax, word [edx + 2]
jne 0x442f8d
add ecx, 4
add edx, 4
test ax, ax
jne 0x442f67
xor eax, eax
jmp 0x442f92
sbb eax, eax
or eax, 1
test eax, eax
je 0x442f27
mov eax, dword [ebp - 0x14]
mov ecx, 0x50baf0
mov esi, dword [ebp - 0x24]
mov dword [ebp - 0x90], eax
mov eax, esi
mov dword [ebp - 0x94], 7
mov dword [ebp - 0x78], 0xffffffff
mov dword [ebp - 0x8c], 0
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x442fea
test dx, dx
je 0x442fe6
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x442fea
add eax, 4
add ecx, 4
test dx, dx
jne 0x442fc4
xor eax, eax
jmp 0x442fef
sbb eax, eax
or eax, 1
test eax, eax
sete bl
test bl, bl
je 0x44300f
cmp byte [ebp - 0xf], 0
jne 0x442f21
mov eax, dword [ebp + 0x313c]
mov dword [ebp - 0x78], eax
mov byte [ebp - 0xe], 1
push 0x10e8
lea eax, [ebp + 0x1008]
push 0
push eax
call fcn.004ee100
add esp, 0xc
lea eax, [ebp + 0x1008]
push 0x800
push esi
push eax
call fcn.0048e710
push esi
mov ecx, edi
call fcn.0043ec70
mov eax, dword [ebp + 0x30f0]
mov dword [ebp + 0x2088], eax
mov eax, dword [ebp + 0x30f4]
mov dword [ebp + 0x208c], eax
mov eax, dword [ebp + 0x30f8]
mov dword [ebp + 0x20a0], eax
mov eax, dword [ebp + 0x3100]
mov dword [ebp + 0x2098], eax
mov eax, dword [ebp + 0x3104]
mov dword [ebp + 0x209c], eax
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp + 0x2090], 0
cmp byte [ebp + 0x30fd], 0
mov dword [ebp + 0x2094], 0
mov dword [ebp - 0x14], eax
mov dword [ebp + 0x20e4], eax
je 0x4430b9
xor eax, eax
cmp byte [ebp + 0x30fe], al
setne al
add eax, 2
mov dword [ebp + 0x20d0], eax
lea eax, [ebp + 0x1008]
mov ecx, 0x562e30
push eax
call fcn.0043d430
mov dword [ebp - 0x74], eax
mov ecx, esi
lea eax, [ebp + 0x20f0]
sub ecx, eax
mov eax, 0x800
sar ecx, 1
sub eax, ecx
push eax
push esi
call fcn.004c4860
lea eax, [ebp - 0x94]
mov dword [ebp - 0x80], esi
push eax
push 0
push 0x104d
push dword [edi + 0x28]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp byte [ebp + 0x30fc], 0
mov esi, eax
jne 0x443131
push 0x32
lea eax, [ebp + 0x441c]
push eax
push dword [ebp + 0x208c]
push dword [ebp + 0x2088]
call fcn.004a7a90
lea eax, [ebp + 0x441c]
mov dword [ebp - 0x44], eax
jmp 0x443138
mov dword [ebp - 0x44], 0x50b8c4
lea eax, [ebp - 0x58]
mov dword [ebp - 0x50], 1
push eax
push esi
push 0x1074
push dword [edi + 0x28]
call dword [sym.imp.USER32.dll_SendMessageW]
test bl, bl
mov dword [ebp - 0x50], 2
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
je 0x44316e
lea eax, [ebp + 0x334c]
mov dword [ebp - 0x44], eax
jmp 0x443175
mov dword [ebp - 0x44], 0x50b8c4
lea eax, [ebp - 0x58]
push eax
push esi
push 0x1074
push dword [edi + 0x28]
call ebx
call fcn.0046bee0
cmp eax, 0x600
jae 0x4431a3
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp + 0x3128]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
jmp 0x4431de
lea eax, [ebp + 0x33fc]
push eax
lea eax, [ebp + 0x3128]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea eax, [ebp + 0x33ec]
push eax
lea eax, [ebp + 0x33fc]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp + 0x33ec]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [ebp + 0x340c]
push eax
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
push 0x64
lea eax, [ebp + 0x4480]
push eax
push 0
lea eax, [ebp + 0x340c]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
lea edi, [ebp + 0x4480]
add edi, 0xfffffffe
jmp 0x443220
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x443220
mov eax, dword [0x50db18]
lea ecx, [ebp + 0x4480]
mov dword [edi], eax
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x443240
sub ecx, edx
lea eax, [ebp + 0x4480]
sar ecx, 1
push 0x64
lea eax, [eax + ecx*2]
push eax
push 0
lea eax, [ebp + 0x340c]
push eax
xor eax, eax
cmp byte [ebp - 0x10], al
setne al
dec eax
and eax, 2
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTimeFormatW]
mov edi, dword [ebp - 0x18]
lea eax, [ebp + 0x4480]
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x58]
push eax
push esi
push 0x1074
push dword [edi + 0x28]
mov dword [ebp - 0x50], 3
call ebx
jmp 0x442f27
mov al, byte [ebp - 0xe]
test al, al
jne 0x443363
cmp byte [ebp - 0xf], 0
jne 0x443363
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x90], eax
mov eax, dword [ebp + 0x313c]
push 0x10e8
mov dword [ebp - 0x78], eax
lea eax, [ebp + 0x1008]
push 0
push eax
mov dword [ebp - 0x94], 7
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x80], 0x50baf0
call fcn.004ee100
mov eax, dword [0x50baf0]
add esp, 0xc
mov dword [ebp + 0x1008], eax
mov ecx, 0x562e30
mov ax, word [0x50baf4]
mov word [ebp + 0x100c], ax
lea eax, [ebp + 0x1008]
push eax
mov dword [ebp + 0x20a0], 0x10
call fcn.0043d430
mov dword [ebp - 0x74], eax
lea eax, [ebp - 0x94]
push eax
push 0
push 0x104d
push dword [edi + 0x28]
call ebx
lea ecx, [ebp + 0x334c]
mov dword [ebp - 0x50], 2
mov dword [ebp - 0x44], ecx
lea ecx, [ebp - 0x58]
push ecx
push eax
push 0x1074
push dword [edi + 0x28]
call ebx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xa4]
call fcn.004c2ff0
mov byte [ebp - 4], 0
lea ecx, [ebp]
call fcn.0046ac10
mov ecx, 0x562e30
call fcn.0043d690
mov ecx, edi
call fcn.00444be0
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x4433dc
cmp word [ecx], 0
jne 0x4433cd
push 0
push 0
push 0x1004
push dword [edi + 0x28]
call ebx
mov ecx, dword [ebp - 0x20]
cmp ecx, eax
jl 0x4433b8
test eax, eax
jle 0x4433b8
lea ecx, [eax - 1]
lea eax, [ebp - 0x58]
mov dword [ebp - 0x48], 3
push eax
mov dword [ebp - 0x4c], 3
push ecx
jmp 0x4433fd
push ecx
mov ecx, edi
call fcn.0043fc50
test al, al
jne 0x443407
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x48], 3
mov dword [ebp - 0x4c], 3
cmp eax, 0xffffffff
je 0x4433f6
test ecx, ecx
jne 0x4433f8
xor eax, eax
lea ecx, [ebp - 0x58]
push ecx
push eax
push 0x102b
push dword [edi + 0x28]
call ebx
push 1
push 0xffffffffffffffff
push 0x100c
push dword [edi + 0x28]
call ebx
push 0
mov ecx, 0x55d0a8
mov esi, eax
call fcn.004a7910
push 0
push 1
push 0xb
push dword [edi + 0x28]
call ebx
push 0
push 0
push 0x102a
push dword [edi + 0x28]
call ebx
push 0
push esi
push 0x1013
push dword [edi + 0x28]
call ebx
mov ecx, edi
call fcn.004447a0
mov ecx, edi
call fcn.00444a10
push 0
mov ecx, 0x55d0a8
call fcn.004a79e0
mov ecx, 0x55f624
call fcn.004a9ac0
cmp byte [ebp - 0xd], 0
jne 0x443492
cmp byte [edi + 0x1042], 0
jne 0x443492
push 3
push 0
lea eax, [edi + 0x1044]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstChangeNotificationW]
mov dword [0x538a14], eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [0x539a60]
test eax, eax
jle 0x4434a8
dec eax
mov dword [0x539a60], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x4548]
xor ecx, ebp
call fcn.004ebbd8
lea esp, [ebp + 0x454c]
pop ebp
ret 4