Function at 0x473350
Capabilities:
Enumerate pe sections
Get file system object information

Disassembly:
push 0xffffffffffffffff
push 0x4c238e
mov eax, dword fs:[0]
push eax
sub esp, 0x2e4
mov eax, dword [0x4f00a8]
xor eax, esp
mov dword [esp + 0x2e0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4f00a8]
xor eax, esp
push eax
lea eax, [esp + 0x2f8]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x308]
mov ebx, dword [ebp + 0x10]
mov eax, dword [esp + 0x30c]
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x310]
mov dword [esp + 0x24], ebp
mov dword [esp + 0x14], eax
mov dword [esp + 0x34], ecx
cmp ebx, dword [ebp + 0x14]
jbe 0x4733bd
call fcn.0049118f
mov edi, dword [ebp + 4]
mov dword [esp + 0x28], edi
mov esi, dword [ebp + 0x14]
cmp dword [ebp + 0x10], esi
jbe 0x4733d1
call fcn.0049118f
mov eax, dword [ebp + 4]
xor ebp, ebp
cmp edi, ebp
je 0x4733de
cmp edi, eax
je 0x4733e3
call fcn.0049118f
cmp ebx, esi
je 0x473b1e
cmp edi, ebp
jne 0x473461
call fcn.0049118f
xor eax, eax
cmp ebx, dword [eax + 0x10]
jb 0x473400
call fcn.0049118f
mov edx, dword [ebx]
test byte [edx + 0x1c], 2
je 0x47381f
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + 0x14]
mov eax, dword [eax]
mov ebp, dword [ecx]
mov dword [esp + 0x20], eax
jmp 0x473420
mov esi, dword [ecx + 0x14]
mov eax, dword [ecx]
test ebp, ebp
je 0x47342d
cmp ebp, eax
je 0x473432
call fcn.0049118f
cmp dword [esp + 0x20], esi
je 0x4734f3
test edi, edi
jne 0x473465
call fcn.0049118f
xor eax, eax
cmp ebx, dword [eax + 0x10]
jb 0x473451
call fcn.0049118f
mov eax, dword [ebx]
add eax, 0x34
cmp dword [eax + 0x18], 8
jb 0x473469
mov esi, dword [eax + 4]
jmp 0x47346c
mov eax, dword [edi]
jmp 0x4733f6
mov eax, dword [edi]
jmp 0x473447
lea esi, [eax + 4]
test ebp, ebp
jne 0x4734c3
call fcn.0049118f
xor eax, eax
mov ecx, dword [esp + 0x20]
cmp ecx, dword [eax + 0x14]
jne 0x473485
call fcn.0049118f
mov edx, dword [esp + 0x20]
mov eax, dword [edx + 8]
mov eax, dword [eax + 0x3c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x4734cd
test ebp, ebp
jne 0x4734c8
call fcn.0049118f
xor eax, eax
mov esi, dword [esp + 0x20]
cmp esi, dword [eax + 0x14]
jne 0x4734b4
call fcn.0049118f
mov ecx, dword [esi]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x14]
jmp 0x473420
mov eax, dword [ebp]
jmp 0x473477
mov eax, dword [ebp]
jmp 0x4734a6
test ebp, ebp
jne 0x473520
call fcn.0049118f
mov edx, dword [esp + 0x20]
cmp edx, dword [ebp + 0x14]
jne 0x4734e4
call fcn.0049118f
mov eax, dword [esp + 0x20]
mov esi, dword [eax + 8]
test esi, esi
jne 0x4737b8
push 0x48
call fcn.004919dd
add esp, 4
mov dword [esp + 0x18], eax
mov dword [esp + 0x300], 0
test eax, eax
je 0x473525
mov ecx, dword [esp + 0x14]
push ecx
mov ecx, eax
call fcn.0045ba70
mov ebp, eax
jmp 0x473527
mov ebp, dword [ebp]
jmp 0x4734d6
xor ebp, ebp
mov eax, dword [ebp + 0x3c]
or byte [eax + 0x6d0], 4
mov dword [esp + 0x300], 0xffffffff
mov dword [esp + 0x18], ebp
test edi, edi
jne 0x473565
call fcn.0049118f
xor eax, eax
cmp ebx, dword [eax + 0x10]
jb 0x473555
call fcn.0049118f
mov eax, dword [ebx]
add eax, 0x34
cmp dword [eax + 0x18], 8
jb 0x473569
mov eax, dword [eax + 4]
jmp 0x47356c
mov eax, dword [edi]
jmp 0x47354b
add eax, 4
mov edx, dword [ebp + 0x3c]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x3c]
mov esi, dword [ebp + 0x3c]
add ecx, 0x208
push ecx
add esi, 0x208
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edx, dword [esp + 0x14]
mov eax, dword [edx + 0x3c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x4ca150
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
test edi, edi
jne 0x473662
call fcn.0049118f
xor eax, eax
cmp ebx, dword [eax + 0x10]
jb 0x4735c9
call fcn.0049118f
mov eax, dword [ebp + 0x3c]
mov edx, dword [ebx]
lea ecx, [eax + 0x6c2]
push ecx
add eax, 0x6c0
push eax
add edx, 0x2c
push edx
call fcn.004b7c90
add esp, 0xc
push 0x4410
push 0x2b4
lea eax, [esp + 0x48]
push eax
push 0x10
push 0x4c49ac
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x473625
mov ecx, dword [esp + 0x44]
mov dword [ebp + 0x40], ecx
mov eax, dword [ebp + 0x3c]
lea edx, [esp + 0x254]
push edx
add eax, 0x620
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov esi, dword [ebp + 0x3c]
cmp dword [esi + 0x414], 0
jne 0x473671
push 0x18
call fcn.004919dd
add esp, 4
test eax, eax
je 0x473669
xor ecx, ecx
mov byte [eax], 0
mov byte [eax + 1], 0
mov byte [eax + 2], 0
mov word [eax + 4], cx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov word [eax + 0x14], cx
mov byte [eax + 0x16], cl
jmp 0x47366b
mov eax, dword [edi]
jmp 0x4735bf
xor eax, eax
mov dword [esi + 0x414], eax
mov esi, dword [esi + 0x414]
test edi, edi
jne 0x4737ea
call fcn.0049118f
xor eax, eax
cmp ebx, dword [eax + 0x10]
jb 0x473690
call fcn.0049118f
mov edx, dword [ebx]
mov al, byte [edx + 0x1c]
mov byte [esi], al
test edi, edi
jne 0x4737f1
call fcn.0049118f
xor eax, eax
cmp ebx, dword [eax + 0x10]
jb 0x4736b0
call fcn.0049118f
mov ecx, dword [ebx]
mov dl, byte [ecx + 0x1d]
mov byte [esi + 1], dl
test edi, edi
jne 0x4737f8
call fcn.0049118f
xor eax, eax
cmp ebx, dword [eax + 0x10]
jb 0x4736d1
call fcn.0049118f
mov eax, dword [ebx]
mov cl, byte [eax + 0x1e]
mov byte [esi + 2], cl
test edi, edi
jne 0x4737ff
call fcn.0049118f
xor eax, eax
cmp ebx, dword [eax + 0x10]
jb 0x4736f2
call fcn.0049118f
mov edx, dword [ebx]
mov ax, word [edx + 0x20]
mov word [esi + 4], ax
test edi, edi
jne 0x473806
call fcn.0049118f
xor eax, eax
cmp ebx, dword [eax + 0x10]
jb 0x473715
call fcn.0049118f
mov ecx, dword [ebx]
mov edx, dword [ecx + 0x24]
mov dword [esi + 8], edx
test edi, edi
jne 0x47380d
call fcn.0049118f
xor eax, eax
cmp ebx, dword [eax + 0x10]
jb 0x473736
call fcn.0049118f
mov eax, dword [ebx]
mov ecx, dword [eax + 0x28]
mov dword [esi + 0xc], ecx
test edi, edi
jne 0x473814
call fcn.0049118f
xor eax, eax
cmp ebx, dword [eax + 0x10]
jb 0x473757
call fcn.0049118f
mov eax, dword [ebx]
mov edx, dword [eax + 0x2c]
add eax, 0x2c
mov dword [esi + 0x10], edx
mov dx, word [eax + 4]
lea ecx, [esi + 0x10]
mov word [ecx + 4], dx
mov al, byte [eax + 6]
mov byte [ecx + 6], al
mov ecx, dword [esp + 0x14]
mov esi, dword [ecx + 0x14]
mov eax, dword [esi + 4]
lea edx, [esp + 0x18]
push edx
push eax
push esi
call fcn.0045aea0
mov ecx, dword [esp + 0x14]
push 1
mov edi, eax
call fcn.0045bb10
mov edx, dword [esp + 0x14]
mov dword [esi + 4], edi
mov ecx, dword [edi + 4]
mov dword [ecx], edi
mov eax, dword [edx + 0x44]
mov ecx, dword [esp + 0x30]
push ebp
push eax
call fcn.0046e830
mov edi, dword [esp + 0x28]
mov esi, dword [esp + 0x18]
test edi, edi
jne 0x47381b
call fcn.0049118f
xor eax, eax
cmp ebx, dword [eax + 0x10]
jb 0x4737cd
call fcn.0049118f
mov ecx, dword [ebx]
lea edx, [esp + 0x38]
mov dword [esp + 0x38], ecx
mov ecx, dword [esp + 0x34]
push edx
mov dword [esp + 0x40], esi
call fcn.00430bd0
jmp 0x473ac8
mov eax, dword [edi]
jmp 0x473686
mov eax, dword [edi]
jmp 0x4736a6
mov eax, dword [edi]
jmp 0x4736c7
mov eax, dword [edi]
jmp 0x4736e8
mov eax, dword [edi]
jmp 0x47370b
mov eax, dword [edi]
jmp 0x47372c
mov eax, dword [edi]
jmp 0x47374d
mov eax, dword [edi]
jmp 0x4737c3
push 0x6d8
call fcn.004919dd
add esp, 4
cmp eax, ebp
je 0x47387c
xor ecx, ecx
xor edx, edx
mov word [eax], cx
mov word [eax + 0x208], dx
mov dword [eax + 0x410], ebp
mov dword [eax + 0x414], ebp
mov word [eax + 0x418], cx
mov word [eax + 0x620], dx
mov word [eax + 0x6c0], cx
mov word [eax + 0x6c2], dx
mov dword [eax + 0x6c8], ebp
mov dword [eax + 0x6cc], ebp
mov byte [eax + 0x6d0], dl
mov esi, eax
jmp 0x47387e
xor esi, esi
or byte [esi + 0x6d0], 4
mov dword [esp + 0x18], esi
cmp edi, ebp
jne 0x4738d4
call fcn.0049118f
xor eax, eax
cmp ebx, dword [eax + 0x10]
jb 0x47389e
call fcn.0049118f
mov eax, dword [ebx]
mov ecx, dword [eax + 0x28]
mov dword [esi + 0x6c8], ecx
mov dword [esi + 0x6cc], ebp
cmp edi, ebp
jne 0x4738d8
call fcn.0049118f
xor eax, eax
cmp ebx, dword [eax + 0x10]
jb 0x4738c4
call fcn.0049118f
mov eax, dword [ebx]
add eax, 0x34
cmp dword [eax + 0x18], 8
jb 0x4738dc
mov eax, dword [eax + 4]
jmp 0x4738df
mov eax, dword [edi]
jmp 0x473894
mov eax, dword [edi]
jmp 0x4738ba
add eax, 4
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpyW]
push eax
push esi
call ebp
mov edx, dword [esp + 0x14]
mov eax, dword [edx + 0x3c]
add eax, 0x208
push eax
lea edi, [esi + 0x208]
push edi
call ebp
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 0x3c]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcatW]
push edx
push edi
call ebp
push 0x4ca150
push edi
call ebp
mov edi, dword [esp + 0x28]
xor ebp, ebp
cmp edi, ebp
jne 0x473988
call fcn.0049118f
xor eax, eax
cmp ebx, dword [eax + 0x10]
jb 0x473933
call fcn.0049118f
mov edx, dword [ebx]
lea eax, [esi + 0x6c2]
push eax
lea ecx, [esi + 0x6c0]
push ecx
add edx, 0x2c
push edx
call fcn.004b7c90
add esp, 0xc
cmp dword [esi + 0x414], ebp
jne 0x473994
push 0x18
call fcn.004919dd
add esp, 4
cmp eax, ebp
je 0x47398c
xor ecx, ecx
mov byte [eax], 0
mov byte [eax + 1], 0
mov byte [eax + 2], 0
mov word [eax + 4], cx
mov dword [eax + 8], ebp
mov dword [eax + 0xc], ebp
mov dword [eax + 0x10], ecx
mov word [eax + 0x14], cx
mov byte [eax + 0x16], cl
jmp 0x47398e
mov eax, dword [edi]
jmp 0x473929
xor eax, eax
mov dword [esi + 0x414], eax
mov esi, dword [esi + 0x414]
cmp edi, ebp
jne 0x473ae9
call fcn.0049118f
xor eax, eax
cmp ebx, dword [eax + 0x10]
jb 0x4739b3
call fcn.0049118f
mov edx, dword [ebx]
mov al, byte [edx + 0x1c]
mov byte [esi], al
cmp edi, ebp
jne 0x473af0
call fcn.0049118f
xor eax, eax
cmp ebx, dword [eax + 0x10]
jb 0x4739d3
call fcn.0049118f
mov ecx, dword [ebx]
mov dl, byte [ecx + 0x1d]
mov byte [esi + 1], dl
cmp edi, ebp
jne 0x473af7
call fcn.0049118f
xor eax, eax
cmp ebx, dword [eax + 0x10]
jb 0x4739f4
call fcn.0049118f
mov eax, dword [ebx]
mov cl, byte [eax + 0x1e]
mov byte [esi + 2], cl
cmp edi, ebp
jne 0x473afe
call fcn.0049118f
xor eax, eax
cmp ebx, dword [eax + 0x10]
jb 0x473a15
call fcn.0049118f
mov edx, dword [ebx]
mov ax, word [edx + 0x20]
mov word [esi + 4], ax
cmp edi, ebp
jne 0x473b05
call fcn.0049118f
xor eax, eax
cmp ebx, dword [eax + 0x10]
jb 0x473a38
call fcn.0049118f
mov ecx, dword [ebx]
mov edx, dword [ecx + 0x24]
mov dword [esi + 8], edx
cmp edi, ebp
jne 0x473b0c
call fcn.0049118f
xor eax, eax
cmp ebx, dword [eax + 0x10]
jb 0x473a59
call fcn.0049118f
mov eax, dword [ebx]
mov ecx, dword [eax + 0x28]
mov dword [esi + 0xc], ecx
cmp edi, ebp
jne 0x473b13
call fcn.0049118f
xor edi, edi
cmp ebx, dword [edi + 0x10]
jb 0x473a7a
call fcn.0049118f
mov eax, dword [ebx]
mov edx, dword [eax + 0x2c]
mov dword [esi + 0x10], edx
mov dx, word [eax + 0x30]
add eax, 0x2c
lea ecx, [esi + 0x10]
mov esi, dword [esp + 0x14]
mov word [ecx + 4], dx
mov al, byte [eax + 6]
mov byte [ecx + 6], al
mov edi, dword [esi + 0x30]
mov edx, dword [edi + 4]
add esi, 0x1c
lea ecx, [esp + 0x18]
push ecx
push edx
push edi
mov ecx, esi
call fcn.0045aea0
push 1
mov ecx, esi
mov ebp, eax
call fcn.0045bb10
mov dword [edi + 4], ebp
mov eax, dword [ebp + 4]
mov edi, dword [esp + 0x28]
mov dword [eax], ebp
test edi, edi
jne 0x473b1a
call fcn.0049118f
xor eax, eax
cmp ebx, dword [eax + 0x10]
jb 0x473add
call fcn.0049118f
mov ebp, dword [esp + 0x24]
add ebx, 4
jmp 0x4733c4
mov eax, dword [edi]
jmp 0x4739a9
mov eax, dword [edi]
jmp 0x4739c9
mov eax, dword [edi]
jmp 0x4739ea
mov eax, dword [edi]
jmp 0x473a0b
mov eax, dword [edi]
jmp 0x473a2e
mov eax, dword [edi]
jmp 0x473a4f
mov edi, dword [edi]
jmp 0x473a70
mov eax, dword [edi]
jmp 0x473ad3
mov ecx, dword [esp + 0x2f8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2e0]
xor ecx, esp
call fcn.004911aa
add esp, 0x2f0
ret 0xc