Function at 0x41e5e0
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2ac
mov eax, dword [0x4b9430]
xor eax, esp
mov dword [esp + 0x2a8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0x10], eax
mov eax, dword [edi]
xor ebx, ebx
mov dword [esp + 0x14], edi
cmp eax, ebx
je 0x41e623
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x41e79d
mov dword [edi], ebx
cmp dword [edi + 0x1c], ebx
jne 0x41e682
push 0x103
lea ecx, [esp + 0x1ad]
push ebx
push ecx
mov byte [esp + 0x1b4], bl
call fcn.00463ac0
add esp, 0xc
push 0x104
lea edx, [esp + 0x1ac]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x101
push 0x160
lea eax, [esp + 0x50]
push eax
push 0x80
lea ecx, [esp + 0x1b8]
push ecx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov edx, dword [esp + 0x48]
mov dword [edi + 0x1c], edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x30
mov esi, eax
lea eax, [esp + 0x1c]
push ebx
push eax
call fcn.00463ac0
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
push str.Adbyby_popupwnd
push ebx
mov dword [esp + 0x24], 0x30
call dword [sym.imp.USER32.dll_GetClassInfoExA]
test eax, eax
jne 0x41e70e
push 0x7f00
push ebx
mov dword [esp + 0x24], 3
mov dword [esp + 0x28], 0x41f950
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], ebx
call dword [sym.imp.USER32.dll_LoadCursorA]
mov edx, dword [edi + 0x1c]
mov dword [esp + 0x34], eax
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x3c], 0x10
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], str.Adbyby_popupwnd
mov dword [esp + 0x48], edx
call dword [sym.imp.USER32.dll_RegisterClassExA]
mov ecx, dword [esp + 0x10]
push ebx
push esi
push ebx
push ebx
push 0xb4
push 0xfa
push ebx
push ebx
push 0x80080000
push ecx
push str.Adbyby_popupwnd
push 0x88
call dword [sym.imp.USER32.dll_CreateWindowExA]
cmp eax, ebx
je 0x41e79d
push edi
push str.CometClassPtr
push eax
mov dword [edi], eax
call dword [sym.imp.USER32.dll_SetPropA]
xor ecx, ecx
mov eax, 5
mov dword [edi + 0xc], eax
mov edx, 0x28
mul edx
seto cl
neg ecx
or ecx, eax
xor eax, eax
add ecx, 4
setb al
neg eax
or eax, ecx
push eax
call fcn.004605d5
add esp, 4
cmp eax, ebx
je 0x41e7b6
push 0x41e920
push 0x41e900
push 5
lea esi, [eax + 4]
push 0x28
push esi
mov dword [eax], 5
call fcn.00461a99
mov eax, esi
jmp 0x41e7b8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2a8]
xor ecx, esp
call fcn.0045d3b4
mov esp, ebp
pop ebp
ret 4
xor eax, eax
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push ecx
mov esi, 0x4ab595
mov dword [edi + 8], eax
call fcn.0041f990
mov esi, dword [edi + 8]
push 0x12
push 0x28
push 0xd2
push ebx
mov ebx, 1
call fcn.0041eab0
push ecx
mov edx, esp
mov dword [esp + 0x14], esp
push edx
mov esi, 0x4ab595
call fcn.0041f990
mov esi, dword [edi + 8]
push 0x14
push 0x32
push 0xc3
push ebx
add esi, 0x28
mov ebx, 0x9b
call fcn.0041eab0
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
push eax
mov esi, 0x4ab595
call fcn.0041f990
mov esi, dword [edi + 8]
push 0x14
push 0x32
push 0xa
push 4
add esi, 0xa0
mov ebx, 0x9e
call fcn.0041eab0
mov eax, dword [edi + 8]
add eax, 0xa0
push 0x4b1b20
mov edi, 8
call fcn.0041fac0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push ecx
mov esi, 0x4ab595
call fcn.0041f990
push 0x14
push 0xea
push edi
mov edi, dword [esp + 0x24]
mov esi, dword [edi + 8]
push 2
add esi, 0x50
mov ebx, 0x1a
call fcn.0041eab0
push ecx
mov edx, esp
mov dword [esp + 0x18], esp
push edx
mov esi, 0x4ab595
call fcn.0041f990
mov esi, dword [edi + 8]
push 0x5e
push 0xea
push 8
push 3
add esi, 0x78
mov ebx, 0x33
call fcn.0041eab0
push 5
push 5
push 0xb5
push 0xfb
push 0
push 0
call dword [sym.imp.GDI32.dll_CreateRoundRectRgn]
mov esi, eax
mov eax, dword [edi]
push 0
push esi
push eax
call dword [sym.imp.USER32.dll_SetWindowRgn]
push esi
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, dword [esp + 0x2b4]
pop edi
pop esi
lea eax, [ebx - 0x32]
pop ebx
xor ecx, esp
call fcn.0045d3b4
mov esp, ebp
pop ebp
ret 4