Function at 0x4952e0
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x65353b
mov eax, dword fs:[0]
push eax
sub esp, 0x594
mov eax, dword [0x6dc0b8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 0xc]
or eax, 0xffffffff
xor ecx, ecx
movzx edx, word [esi]
test dx, dx
je 0x495332
cmp dx, 0x2e
movzx edx, word [esi + ecx*2 + 2]
cmove eax, ecx
inc ecx
test dx, dx
jne 0x495320
mov ebx, dword [ebp + 8]
test bl, 0x10
jne 0x4954e9
test eax, eax
js 0x4954e9
lea eax, [esi + eax*2]
mov dword [ebp - 0x584], 0
lea ebx, [eax + 2]
mov dword [ebp - 0x588], eax
lea esi, [edi + 0xc]
mov edx, ebx
lea eax, [ebp - 0x584]
mov dword [ebp - 0x59c], esi
push eax
mov ecx, esi
call fcn.00495280
mov ecx, eax
add esp, 4
test ecx, ecx
js 0x49538b
mov eax, dword [esi]
mov eax, dword [eax + ecx*4]
mov eax, dword [eax + 0xc]
jmp 0x49558b
movzx eax, word [ebx]
xor ecx, ecx
test ax, ax
je 0x4953f3
add eax, 0xffffffd0
cmp ax, 9
ja 0x4953a9
movzx eax, word [ebx + ecx*2 + 2]
inc ecx
test ax, ax
jne 0x495395
test ecx, ecx
je 0x4953f3
cmp word [ebx + ecx*2], 0
jne 0x4953f3
cmp dword [edi + 0x1c], 0
jne 0x4953eb
push 0x4010
push 0x2b4
lea eax, [ebp - 0x2c8]
push eax
push 0x80
push str.__FILE__.001
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov ecx, dword [ebp - 0x2c4]
mov dword [edi + 0x18], ecx
mov dword [edi + 0x1c], 1
mov eax, dword [edi + 0x18]
jmp 0x49558b
push 8
call fcn.00545b74
mov ecx, eax
mov dword [ebp - 0x594], 0
xor eax, eax
mov dword [ebp - 0x598], ecx
add esp, 4
mov dword [ebp - 0x590], 3
mov word [ecx], ax
xor edi, edi
mov dword [ebp - 4], eax
cmp word [ebx], di
je 0x495472
inc edi
cmp word [ebx + edi*2], 0
jne 0x495428
cmp edi, 3
jbe 0x495472
xor ecx, ecx
lea eax, [edi + 1]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00545b74
push dword [ebp - 0x598]
mov esi, eax
call fcn.00545b61
mov ecx, esi
mov dword [ebp - 0x590], edi
mov esi, dword [ebp - 0x59c]
add esp, 8
mov dword [ebp - 0x598], ecx
lea eax, [edi*2 + 2]
mov dword [ebp - 0x594], edi
push eax
push ebx
push ecx
call fcn.005e0850
add esp, 0xc
lea eax, [ebp - 0x2c8]
push 0x4010
push 0x2b4
push eax
mov eax, dword [ebp + 8]
or eax, 0x80
push eax
push dword [ebp - 0x588]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov eax, dword [ebp - 0x2c4]
mov ecx, esi
mov dword [ebp - 0x58c], eax
lea eax, [ebp - 0x598]
push eax
push dword [ebp - 0x584]
call fcn.004955c0
push dword [ebp - 0x598]
call fcn.00545b61
mov eax, dword [ebp - 0x58c]
add esp, 4
jmp 0x49558b
mov ecx, dword [edi + 4]
xor edx, edx
mov dword [ebp - 0x584], 0
test ecx, ecx
je 0x49551f
mov esi, dword [edi]
nop
lea eax, [ecx + edx]
shr eax, 1
mov esi, dword [esi + eax*8]
cmp ebx, esi
je 0x4955a9
jae 0x495516
mov ecx, eax
jmp 0x495519
lea edx, [eax + 1]
mov esi, dword [edi]
cmp edx, ecx
jne 0x495500
mov dword [ebp - 0x584], edx
push 0x4010
push 0x2b4
lea eax, [ebp - 0x580]
push eax
mov eax, ebx
or eax, 0x80
push eax
push str.__DIR__
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov esi, dword [ebp - 0x57c]
mov ecx, edi
call fcn.004038f0
mov eax, dword [edi]
mov edx, dword [ebp - 0x584]
lea ecx, [eax + edx*8]
mov eax, dword [edi + 4]
sub eax, edx
shl eax, 3
push eax
push ecx
add ecx, 8
push ecx
call fcn.005dfab0
mov eax, dword [ebp - 0x584]
add esp, 0xc
mov ecx, dword [edi]
mov dword [ecx + eax*8], ebx
mov dword [ecx + eax*8 + 4], esi
mov eax, esi
inc dword [edi + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00545b50
mov esp, ebp
pop ebp
ret 8
test eax, eax
js 0x495525
mov ecx, dword [edi]
mov eax, dword [ecx + eax*8 + 4]
jmp 0x49558b