Function at 0x1002ecc0
Capabilities:
Get file system object information
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f8b62
mov eax, dword fs:[0]
push eax
sub esp, 0x82c
mov eax, dword [0x1013c014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x7e8], edi
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x824], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x820], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x838], esi
mov dword [ebp - 0x81c], eax
test esi, esi
je 0x1002f89c
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x7e4], 0
test ebx, 0x10000
je 0x1002ef42
mov dword [ebp - 0x7ec], 0
lea ecx, [ebp - 0x7ec]
mov dword [ebp - 4], 0
mov eax, dword [esi]
push ecx
push 0x10103c00
push 0x10103cc0
push 0
push esi
call dword [eax + 0xc]
test eax, eax
js 0x1002ef2b
mov eax, dword [ebp - 0x7ec]
lea edx, [ebp - 0x7e4]
push edx
push 0x104
lea edx, [ebp - 0x218]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x40]
test eax, eax
js 0x1002ef2b
cmp word [ebp - 0x218], 0
je 0x1002ee78
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1014ad7c]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10159190]
cmp eax, dword [ecx + 4]
jle 0x1002edeb
push 0x10159190
call fcn.100d4fed
add esp, 4
cmp dword [0x10159190], 0xffffffff
jne 0x1002edeb
push 0x10159190
mov dword [0x10159194], 0
call fcn.100d4fa3
add esp, 4
mov byte [ebp - 0x7f9], 0
lea eax, [ebp - 0x834]
mov byte [ebp - 4], 1
push eax
call fcn.100d3b01
add esp, 4
lea eax, [ebp - 0x834]
mov dword [ebp - 0x7f8], eax
lea eax, [ebp - 0x7f9]
mov dword [ebp - 0x7f4], eax
lea eax, [ebp - 0x7f8]
push eax
push 0x10036280
push 0x10159194
call fcn.100d3ea8
add esp, 0xc
test eax, eax
je 0x1002eec6
lea eax, [ebp - 0x834]
mov byte [ebp - 4], 3
push eax
call fcn.100d3b10
add esp, 4
mov byte [ebp - 4], 0
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push 0x10158f54
push eax
call fcn.100dc721
add esp, 8
test eax, eax
jne 0x1002ef2b
mov edx, 0x811c9dc5
mov ecx, str.startscreen.lnk
call fcn.100b3790
xor esi, esi
mov dword [ebp - 0x830], eax
xor edi, edi
test bl, 0x10
je 0x1002eea3
mov ecx, dword [0x1014b4c8]
call fcn.1001f130
mov esi, eax
test bl, 0x20
je 0x1002eeb5
mov ecx, dword [0x1014b4c4]
call fcn.1001f130
mov edi, eax
test bl, 0x40
je 0x1002eeea
mov ecx, 0x40
call fcn.1001f130
jmp 0x1002eeec
lea eax, [ebp - 0x834]
mov byte [ebp - 4], 4
push eax
call fcn.100d3b31
add esp, 4
mov byte [ebp - 4], 2
test al, al
je 0x1002f8d0
jmp 0x1002f8ba
xor eax, eax
push 0
mov ecx, dword [ebp - 0x7e8]
push 0
push dword [ebp - 0x81c]
push dword [ebp - 0x820]
push dword [ebp - 0x824]
push ebx
push eax
push edi
push esi
push 0
push dword [ebp - 0x830]
call fcn.1002fe90
mov dword [ebp - 4], 6
mov eax, dword [ebp - 0x7ec]
jmp 0x1002f892
mov dword [ebp - 4], 7
mov eax, dword [ebp - 0x7ec]
test eax, eax
je 0x1002ef42
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 0x810], 0
mov dword [ebp - 4], 8
mov dword [ebp - 0x80c], 0
lea ecx, [ebp - 0x810]
mov byte [ebp - 4], 9
mov eax, dword [esi]
push ecx
push 0x10103ab0
push 0x10103cc0
push 0
push esi
call dword [eax + 0xc]
test eax, eax
js 0x1002efbd
mov eax, dword [ebp - 0x810]
lea edx, [ebp - 0x7f4]
push edx
lea edx, [ebp - 0x7e4]
mov dword [ebp - 0x7f4], 0
push edx
mov ecx, dword [eax]
lea edx, [ebp - 0x218]
push 0x104
push edx
push 0
push eax
call dword [ecx + 0xc]
test eax, eax
jne 0x1002f871
jmp 0x1002f081
mov eax, dword [esi]
lea ecx, [ebp - 0x80c]
push ecx
push 0x10103c20
push 0x10103cc0
push 0
push esi
call dword [eax + 0xc]
test eax, eax
js 0x1002f871
mov eax, dword [ebp - 0x80c]
lea edx, [ebp - 0x7f4]
push edx
lea edx, [ebp - 0x7e4]
mov dword [ebp - 0x7f4], 0
push edx
mov ecx, dword [eax]
lea edx, [ebp - 0x528]
push 0x104
push edx
push 0
push eax
call dword [ecx + 0xc]
test eax, eax
jne 0x1002f871
lea ecx, [ebp - 0x528]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002f021
xor eax, eax
sub ecx, edx
push 0x103
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x218]
push eax
push ecx
lea eax, [ebp - 0x528]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x1002f05e
xor ecx, ecx
mov word [ebp + eax*2 - 0x218], cx
jmp 0x1002f081
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x1002f074
xor eax, eax
mov word [ebp - 0x218], ax
jmp 0x1002f081
cmp word [ebp - 0x14], 0
je 0x1002f081
xor eax, eax
mov word [ebp - 0x12], ax
mov ecx, dword [ebp - 0x7f4]
mov eax, ecx
shr eax, 4
shr ecx, 3
mov dl, al
and cl, 1
and dl, 1
mov dword [ebp - 0x830], ecx
mov dword [ebp - 0x808], edx
je 0x1002f0bf
mov ecx, dword [edi + 0x1a0]
mov dword [ebp - 0x804], ecx
lea eax, [ecx + 1]
mov dword [edi + 0x1a0], eax
jmp 0x1002f1ab
cmp word [ebp - 0x218], 0
je 0x1002f11e
mov edx, dword [ebp - 0x7e4]
movzx eax, dl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, dh
xor ecx, eax
movzx eax, byte [ebp - 0x7e2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebp - 0x7e1]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul edx, ecx, 0x1000193
lea ecx, [ebp - 0x218]
call fcn.100b3790
mov ecx, eax
mov dword [ebp - 0x804], ecx
jmp 0x1002f1a5
mov dword [ebp - 0x7f4], 0
lea ecx, [ebp - 0x7f4]
mov byte [ebp - 4], 0x10
mov eax, dword [esi]
push ecx
push 0x80028000
push esi
call dword [eax + 0x14]
mov edx, dword [ebp - 0x7e4]
movzx eax, dl
xor eax, 0x811c9dc5
mov esi, dword [ebp - 0x7f4]
imul ecx, eax, 0x1000193
movzx eax, dh
xor ecx, eax
movzx eax, byte [ebp - 0x7e2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebp - 0x7e1]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul edx, ecx, 0x1000193
mov ecx, esi
call fcn.100b3790
mov byte [ebp - 4], 9
mov ecx, eax
mov dword [ebp - 0x804], ecx
test esi, esi
je 0x1002f1a5
push esi
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov ecx, dword [ebp - 0x804]
mov edx, dword [ebp - 0x808]
mov edi, dword [ebp + 0x1c]
test edi, edi
je 0x1002f1e7
movzx eax, byte [edi]
xor eax, ecx
imul ecx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor ecx, eax
movzx eax, byte [edi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul ecx, ecx, 0x1000193
mov dword [ebp - 0x804], ecx
test dl, dl
jne 0x1002f210
push dword [ebp - 0x81c]
lea eax, [ebp + 0xc]
push dword [ebp - 0x820]
push dword [ebp - 0x824]
push eax
push ecx
mov ecx, dword [ebp - 0x7e8]
call fcn.1002fd70
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x1002f871
lea eax, [ebp - 0x218]
mov dword [ebp - 0x800], 0
xor esi, esi
mov dword [ebp - 0x7f0], 0
push eax
mov edx, 0x104
mov dword [ebp - 0x7f4], esi
lea ecx, [ebp - 0x420]
call fcn.100a4780
add esp, 4
test edi, edi
je 0x1002f2c7
lea esi, [ebp - 0x420]
mov eax, esi
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
mov eax, esi
push str.SCALE_
push eax
call fcn.100d62b4
mov ecx, eax
add esp, 8
test ecx, ecx
je 0x1002f2c7
cmp ecx, esi
je 0x1002f28e
movzx eax, word [ecx - 2]
cmp eax, 0x5c
je 0x1002f28e
cmp eax, 0x2e
je 0x1002f28e
add ecx, 0xc
jmp 0x1002f2b1
mov ax, word [ecx + 0xc]
add ecx, 0xc
sub ax, 0x30
cmp ax, 9
ja 0x1002f2b1
movzx eax, word [ecx + 2]
cmp eax, 0x30
jb 0x1002f2b1
cmp eax, 0x39
jbe 0x1002f38a
push str.SCALE_
push ecx
mov esi, ecx
call fcn.100d62b4
mov ecx, eax
add esp, 8
test ecx, ecx
jne 0x1002f277
lea eax, [ebp - 0x218]
mov edx, 0x104
push eax
lea ecx, [ebp - 0x420]
call fcn.100a4780
add esp, 4
test edi, edi
je 0x1002f524
call fcn.100b0560
mov ecx, 0xa00
cmp ax, cx
jb 0x1002f524
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
lea eax, [ebp - 0x420]
push str..PNG_
push eax
call fcn.100d62b4
mov esi, eax
add esp, 8
test esi, esi
je 0x1002f524
push 0x24
push str..TARGETSIZE__d.PNG
push esi
call fcn.100d7080
xor eax, eax
add esp, 0xc
mov word [esi + 0x24], ax
test bl, 0x10
je 0x1002f35e
push dword [edi]
mov edx, dword [0x1014b4c8]
lea ecx, [ebp - 0x420]
call fcn.10028d80
add esp, 4
mov dword [ebp - 0x800], eax
test bl, 0x20
je 0x1002f4a9
push dword [edi]
mov edx, dword [0x1014b4c4]
lea ecx, [ebp - 0x420]
call fcn.10028d80
mov esi, eax
add esp, 4
mov dword [ebp - 0x7f0], esi
jmp 0x1002f4af
lea edx, [ecx + 4]
mov eax, 2
mov dword [ebp - 0x814], edx
movzx edx, word [edx]
cmp edx, 0x30
jb 0x1002f3b1
cmp dx, 0x39
ja 0x1002f3b1
movzx edx, word [ecx + eax*2 + 2]
inc eax
cmp edx, 0x30
jae 0x1002f3a0
mov dword [ecx], 0x640025
cmp eax, 2
jle 0x1002f3ea
lea edx, [ecx + eax*2]
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1002f3c4
sub ecx, esi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push dword [ebp - 0x814]
call fcn.100d6930
add esp, 0xc
test bl, 0x10
je 0x1002f40b
push dword [edi]
mov edx, dword [0x1014b4c8]
lea ecx, [ebp - 0x420]
call fcn.10028c50
add esp, 4
mov dword [ebp - 0x800], eax
test bl, 0x20
je 0x1002f42c
push dword [edi]
mov edx, dword [0x1014b4c4]
lea ecx, [ebp - 0x420]
call fcn.10028c50
add esp, 4
mov dword [ebp - 0x7f0], eax
test bl, 0x40
je 0x1002f450
push dword [edi]
mov edx, 0x40
lea ecx, [ebp - 0x420]
call fcn.10028c50
mov esi, eax
add esp, 4
mov dword [ebp - 0x7f4], esi
jmp 0x1002f452
xor esi, esi
mov ecx, dword [ebp - 0x800]
mov eax, dword [ebp - 0x7f0]
test ecx, ecx
jne 0x1002f46e
test eax, eax
jne 0x1002f46e
test esi, esi
je 0x1002f2c7
push 1
push dword [ebp - 0x808]
mov edx, 0x23
push dword [ebp - 0x81c]
mov word [ebp - 0x41e], dx
push dword [ebp - 0x820]
push dword [ebp - 0x824]
push ebx
push esi
push eax
push ecx
mov ecx, dword [ebp - 0x7e8]
lea eax, [ebp - 0x420]
jmp 0x1002f865
mov esi, dword [ebp - 0x7f0]
test bl, 0x40
je 0x1002f4d1
push dword [edi]
mov edx, 0x40
lea ecx, [ebp - 0x420]
call fcn.10028d80
add esp, 4
mov dword [ebp - 0x7f4], eax
jmp 0x1002f4d7
mov eax, dword [ebp - 0x7f4]
mov ecx, dword [ebp - 0x800]
test ecx, ecx
jne 0x1002f4e9
test esi, esi
jne 0x1002f4e9
test eax, eax
je 0x1002f524
push 1
push dword [ebp - 0x808]
mov edx, 0x23
push dword [ebp - 0x81c]
mov word [ebp - 0x41e], dx
push dword [ebp - 0x820]
push dword [ebp - 0x824]
push ebx
push eax
push esi
push ecx
mov ecx, dword [ebp - 0x7e8]
lea eax, [ebp - 0x420]
jmp 0x1002f865
call fcn.100b0560
mov ecx, 0xa00
cmp ax, cx
mov eax, dword [0x1014b4c8]
mov dword [ebp - 0x818], eax
mov eax, dword [0x1014b4c4]
sbb esi, esi
and esi, edi
mov dword [ebp - 0x7ec], eax
xor eax, eax
xor edi, edi
mov dword [ebp - 0x82c], eax
mov dword [ebp - 0x814], eax
cmp byte [ebp - 0x830], al
je 0x1002f6cd
mov dword [ebp - 0x828], eax
lea eax, [ebp - 0x828]
mov byte [ebp - 4], 0x17
push eax
push dword [ebp - 0x838]
call dword [sym.imp.SHELL32.dll_SHGetIDListFromObject]
test eax, eax
js 0x1002f60f
push 0x4008
push 0x2b4
lea eax, [ebp - 0x7e0]
push eax
push edi
push dword [ebp - 0x828]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x1002f60f
test bl, 0x10
je 0x1002f5cc
push dword [ebp - 0x818]
mov ecx, dword [ebp - 0x7e8]
push dword [ebp - 0x7dc]
call fcn.1002ead0
mov edi, eax
test bl, 0x20
je 0x1002f5ee
push dword [ebp - 0x7ec]
mov ecx, dword [ebp - 0x7e8]
push dword [ebp - 0x7dc]
call fcn.1002ead0
mov dword [ebp - 0x82c], eax
test bl, 0x40
je 0x1002f6a9
mov ecx, dword [ebp - 0x7e8]
push 0x40
push dword [ebp - 0x7dc]
call fcn.1002ead0
jmp 0x1002f6a3
test bl, 0x10
je 0x1002f641
push dword [ebp - 0x7e4]
lea eax, [ebp - 0x528]
push eax
push dword [ebp - 0x80c]
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x810]
push dword [ebp - 0x818]
call fcn.1002ec30
mov edi, eax
test bl, 0x20
je 0x1002f677
push dword [ebp - 0x7e4]
lea eax, [ebp - 0x528]
push eax
push dword [ebp - 0x80c]
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x810]
push dword [ebp - 0x7ec]
call fcn.1002ec30
mov dword [ebp - 0x82c], eax
test bl, 0x40
je 0x1002f6a9
push dword [ebp - 0x7e4]
lea eax, [ebp - 0x528]
push eax
push dword [ebp - 0x80c]
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x810]
push 0x40
call fcn.1002ec30
mov dword [ebp - 0x814], eax
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x828]
test eax, eax
je 0x1002f6be
push eax
call dword [sym.imp.SHELL32.dll_ILFree]
mov dword [ebp - 0x828], 0
jmp 0x1002f75e
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHELL32.dll_DoEnvironmentSubstW]
test bl, 0x10
je 0x1002f708
mov edx, dword [ebp - 0x7e4]
lea ecx, [ebp - 0x218]
push dword [ebp - 0x818]
xor eax, eax
cmp edx, 0xffffffff
cmove edx, eax
call fcn.100af4f0
add esp, 4
mov edi, eax
test bl, 0x20
je 0x1002f735
mov edx, dword [ebp - 0x7e4]
lea ecx, [ebp - 0x218]
push dword [ebp - 0x7ec]
xor eax, eax
cmp edx, 0xffffffff
cmove edx, eax
call fcn.100af4f0
add esp, 4
mov dword [ebp - 0x82c], eax
test bl, 0x40
je 0x1002f75e
mov edx, dword [ebp - 0x7e4]
lea ecx, [ebp - 0x218]
xor eax, eax
cmp edx, 0xffffffff
push 0x40
cmove edx, eax
call fcn.100af4f0
add esp, 4
mov dword [ebp - 0x814], eax
test edi, edi
je 0x1002f785
push ecx
test esi, esi
je 0x1002f7b4
push dword [esi]
mov edx, dword [0x1014b4c8]
mov ecx, edi
push dword [ebp - 0x818]
call fcn.100286b0
add esp, 0xc
mov dword [ebp - 0x800], eax
mov edi, dword [ebp - 0x7e8]
mov eax, dword [ebp - 0x82c]
test eax, eax
je 0x1002f7e4
push ecx
test esi, esi
je 0x1002f7d0
push dword [esi]
mov edx, dword [0x1014b4c4]
mov ecx, eax
push dword [ebp - 0x7ec]
call fcn.100286b0
add esp, 0xc
jmp 0x1002f7de
push dword [ebp - 0x818]
push edi
mov edi, dword [ebp - 0x7e8]
mov ecx, edi
call fcn.1002e850
mov dword [ebp - 0x800], eax
jmp 0x1002f78b
push dword [ebp - 0x7ec]
mov ecx, edi
push eax
call fcn.1002e850
mov dword [ebp - 0x7f0], eax
mov eax, dword [ebp - 0x814]
test eax, eax
je 0x1002f814
push ecx
test esi, esi
je 0x1002f808
push dword [esi]
mov edx, 0x40
mov ecx, eax
push 0x40
call fcn.100286b0
add esp, 0xc
jmp 0x1002f81a
push 0x40
push eax
mov ecx, edi
call fcn.1002e850
jmp 0x1002f82a
mov eax, dword [ebp - 0x7f4]
test esi, esi
je 0x1002f82a
mov ecx, 0x23
mov word [ebp - 0x216], cx
push 0
push dword [ebp - 0x808]
xor ecx, ecx
push dword [ebp - 0x81c]
cmp byte [ebp - 0x830], cl
push dword [ebp - 0x820]
push dword [ebp - 0x824]
push ebx
push eax
push dword [ebp - 0x7f0]
lea eax, [ebp - 0x218]
push dword [ebp - 0x800]
cmovne eax, ecx
mov ecx, edi
push eax
push dword [ebp - 0x804]
call fcn.1002fe90
mov byte [ebp - 4], 0x18
mov eax, dword [ebp - 0x80c]
test eax, eax
je 0x1002f885
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 4], 0x19
mov eax, dword [ebp - 0x810]
test eax, eax
je 0x1002f89c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100d4906
mov esp, ebp
pop ebp
ret 0x18
sub esp, 8
lea eax, [ebp - 0x834]
mov ecx, esp
push eax
call fcn.10037f40
call fcn.10037fa0
call fcn.100d3f31
int3