Function at 0x465060
Capabilities:
Get file system object information
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x495586
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4cc
mov eax, dword [esp + 0x4e8]
push ebx
mov ebx, dword [esp + 0x4e4]
push ebp
push esi
push edi
xor esi, esi
mov ebp, ecx
xor edi, edi
cmp ebx, esi
mov dword [esp + 0x30], ebp
mov dword [esp + 0x1c], edi
jne 0x4650be
cmp eax, esi
jne 0x4650ca
mov ecx, dword [esp + 0x4ec]
lea eax, [esp + 0x1d0]
push eax
push ecx
push esi
call fcn.00464bf0
add esp, 0xc
jmp 0x4650f5
cmp eax, esi
jne 0x4650ca
push ebx
mov ecx, ebp
call fcn.00482589
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x4ec]
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x1d0]
push edx
push eax
mov edx, dword [ecx + 0x114]
push edx
call fcn.00464bf0
mov edi, dword [esp + 0x28]
add esp, 0xc
lea eax, [esp + 0x3d8]
lea ecx, [esp + 0x28]
push eax
call fcn.004840e7
lea ecx, [esp + 0x2d4]
mov dword [esp + 0x4e4], esi
push ecx
lea ecx, [esp + 0x1c]
call fcn.004840e7
push 2
lea edx, [esp + 0x2d8]
push 0x5c6e08
push edx
mov byte [esp + 0x4f0], 1
call fcn.00472970
add esp, 0xc
cmp edi, esi
mov dword [esp + 0x10], 0xe0030000
je 0x465168
mov eax, dword [edi + 0x114]
lea edx, [esp + 0x10]
push edx
lea edx, [esp + 0x4f0]
mov ecx, dword [eax]
push edx
push 1
push eax
call dword [ecx + 0x24]
test eax, eax
je 0x465170
xor eax, eax
mov dword [esp + 0x10], eax
jmp 0x465174
mov eax, dword [esp + 0x10]
not eax
shr eax, 0x1e
and eax, 1
cmp ebx, esi
mov dword [esp + 0x20], eax
je 0x465198
cmp eax, esi
je 0x465198
cmp dword [ebp + 0xb4], esi
je 0x465198
cmp dword [ebp + 0xb8], esi
jne 0x4651c3
cmp edi, esi
je 0x4651b6
mov ecx, dword [edi + 0x110]
dec ecx
je 0x4651aa
sub ecx, 4
jne 0x4651b6
mov dword [esp + 0x20], 1
mov eax, dword [esp + 0x20]
cmp dword [esp + 0x4f4], esi
jne 0x4651ef
cmp eax, esi
je 0x4651ef
lea ecx, [esp + 0x18]
mov byte [esp + 0x4e4], 0
call fcn.00484079
lea ecx, [esp + 0x28]
mov dword [esp + 0x4e4], 0xffffffff
call fcn.00484079
xor eax, eax
jmp 0x465561
cmp edi, esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x14], esi
je 0x465215
mov ax, word [edi + 0x11c]
mov ecx, dword [edi + 0x118]
mov word [esp + 0x24], ax
mov dword [esp + 0x14], ecx
mov esi, dword [esp + 0x24]
mov edx, dword [esp + 0x4ec]
mov eax, dword [ebp + 0xd0]
mov ebx, esi
mov di, word [edx]
and ebx, 0xffff
mov dword [esp + 0x38], edi
and edi, 0xffff
mov edx, dword [eax]
mov dword [esp + 0x34], edi
lea ecx, [ebx + edi]
mov dword [esp + 0x2c], ecx
add ecx, 2
push ecx
push eax
call dword [edx + 0xc]
test si, si
mov ebp, eax
je 0x465282
mov esi, dword [esp + 0x14]
mov ecx, ebx
mov eax, ecx
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x34]
mov esi, dword [esp + 0x4ec]
mov edx, ecx
lea edi, [ebx + ebp]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
jmp 0x465296
mov esi, dword [esp + 0x4ec]
mov ecx, edi
mov eax, ecx
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push 0x4008
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x30]
mov esi, dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
lea edx, [esp + 0x74]
push 0x160
push edx
push 0x20000
push ebp
mov word [ecx + ebp], 0
call esi
mov eax, dword [esp + 0x74]
mov dword [esp + 0x14], eax
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x10]
and eax, 0x20000000
cmp eax, 0x20000000
jne 0x4652fd
push 0x400a
lea ecx, [esp + 0x74]
push 0x160
push ecx
push 0x20000
push ebp
call esi
mov edx, dword [esp + 0x74]
mov dword [esp + 0x14], edx
mov eax, dword [esp + 0x30]
push 0x124
mov eax, dword [eax + 0xd0]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov edx, dword [esp + 0x38]
mov ebx, eax
mov ecx, 0x49
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x24]
mov dword [ebx + 0x118], ebp
add edx, eax
or ecx, 0xffffffff
mov word [ebx + 0x11c], dx
mov edi, dword [esp + 0x18]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, dword [esp + 0x4f0]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor ecx, ecx
mov edi, str.::20D04FE0_3AEA_1069_A2D8_08002B30309D
cmp edx, ecx
setne al
mov dword [ebx + 0x104], eax
mov ebp, dword [esp + 0x18]
mov esi, ebp
mov dl, byte [esi]
mov al, dl
cmp dl, byte [edi]
jne 0x46539a
test al, al
je 0x465396
mov dl, byte [esi + 1]
mov al, dl
cmp dl, byte [edi + 1]
jne 0x46539a
add esi, 2
add edi, 2
test al, al
jne 0x465376
xor eax, eax
jmp 0x46539f
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ecx
jne 0x4653b2
mov dword [ebx + 0x110], 3
jmp 0x465438
mov edi, str.::208D2C60_3AEA_1069_A2D7_08002B30309D
mov esi, ebp
mov dl, byte [esi]
mov al, dl
cmp dl, byte [edi]
jne 0x4653dd
test al, al
je 0x4653d9
mov dl, byte [esi + 1]
mov al, dl
cmp dl, byte [edi + 1]
jne 0x4653dd
add esi, 2
add edi, 2
test al, al
jne 0x4653b9
xor eax, eax
jmp 0x4653e2
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ecx
jne 0x4653f2
mov dword [ebx + 0x110], 1
jmp 0x465438
mov edi, str.::645FF040_5081_101B_9F08_00AA002F954E
mov esi, ebp
mov dl, byte [esi]
mov al, dl
cmp dl, byte [edi]
jne 0x46541d
test al, al
je 0x465419
mov dl, byte [esi + 1]
mov al, dl
cmp dl, byte [edi + 1]
jne 0x46541d
add esi, 2
add edi, 2
test al, al
jne 0x4653f9
xor eax, eax
jmp 0x465422
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ecx
jne 0x465432
mov dword [ebx + 0x110], 2
jmp 0x465438
mov dword [ebx + 0x110], ecx
mov eax, dword [esp + 0x10]
mov dword [ebx + 0x120], ecx
mov dword [ebx + 0x10c], eax
mov eax, dword [esp + 0x1c]
cmp eax, ecx
je 0x465473
mov eax, dword [eax + 0x114]
lea esi, [ebx + 0x114]
push esi
push 0x5aac00
mov edx, dword [eax]
push ecx
mov ecx, dword [esp + 0x4f8]
push ecx
push eax
call dword [edx + 0x14]
jmp 0x465480
lea edx, [ebx + 0x114]
push edx
call dword [sym.imp.SHELL32.dll_SHGetDesktopFolder]
mov edi, dword [esp + 0x30]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x44], 0x2f
mov eax, dword [edi + 0x68]
neg eax
sbb eax, eax
and eax, 0x20000000
or eax, 0x80000000
test ecx, eax
je 0x4654bd
mov eax, dword [esp + 0x20]
mov dword [esp + 0x44], 0x6f
test eax, eax
je 0x4654bd
mov dword [esp + 0x64], 0xffffffff
test ecx, 0x20000
je 0x4654cf
mov dword [esp + 0x4c], 0x100
jmp 0x4654dc
shr ecx, 7
and ecx, 0x200
mov dword [esp + 0x4c], ecx
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x60], ecx
lea edx, [esp + 0x1d0]
lea ecx, [esp + 0x3c]
mov dword [esp + 0x54], edx
mov edx, dword [edi + 0x1c]
push ecx
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x4f4]
push 0
push 0x1100
push edx
mov dword [esp + 0x60], 0xf00
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], 0xffff0002
mov dword [esp + 0x78], ebx
call dword [sym.imp.USER32.dll_SendMessageA]
mov esi, eax
test esi, esi
jne 0x46553a
push ebx
mov ecx, edi
call fcn.00466030
lea ecx, [esp + 0x18]
mov byte [esp + 0x4e4], 0
call fcn.00484079
lea ecx, [esp + 0x28]
mov dword [esp + 0x4e4], 0xffffffff
call fcn.00484079
mov eax, esi
mov ecx, dword [esp + 0x4dc]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x4d8
ret 0x10