Function at 0x1001c566
Capabilities:
Get file system object information
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
push ebx
push esi
xor ebx, ebx
push edi
test cl, cl
je 0x1001cae5
mov dword [ebp - 0x14], 0xfffffffb
mov dword [ebp - 8], 0x24adc9fe
push 2
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x1c], 0xc5df
pop esi
mov dword [ebp - 0x10], 0xad473cb3
push 1
mov dword [ebp - 0x28], 0xfffffffd
mov dword [ebp - 0x14], ebx
pop edi
jmp 0x1001c837
mov dword [ebp - 0x18], ebx
lea ecx, [ebp - 0x44]
push esi
call fcn.10018732
mov dword [ebp - 0x24], 4
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x34], 0x72f71451
mov dword [ebp - 0x18], ebx
jmp 0x1001c5e5
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x44]
mov dword [eax + ecx*4], 0x79facd4a
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1001c5d5
mov eax, dword [ebp - 0x44]
xor edx, edx
mov dword [ebp - 0x18], 0xbc5
mov dword [eax], 0xbebf0a0c
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x44]
cmp dword [eax], ecx
setl dl
mov dword [ebp - 0x2c], edx
cmp dword [ebp - 0x2c], ebx
je 0x1001c625
mov eax, edi
cmp dword [ebp - 8], ebx
jne 0x1001c627
mov eax, ebx
xor ecx, ecx
cmp eax, 0xfffffffe
mov eax, dword [ebp - 0x18]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setne cl
xor edx, edx
sub ecx, 0xf34f
cmp ecx, 0x90d790f9
setne dl
xor ecx, ecx
cmp eax, edx
setl cl
sub ecx, 0x70557c04
jne 0x1001c66d
mov ecx, ebx
cmp dword [ebp - 0x2c], ebx
je 0x1001c66f
mov ecx, edi
mov eax, dword [ebp - 0x14]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setg dl
xor ecx, ecx
cmp edx, eax
setl cl
imul eax, ecx, 0xaf19
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x14]
jg 0x1001c69b
mov eax, ebx
cmp dword [ebp - 0xc], ebx
je 0x1001c69d
mov eax, edi
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jne 0x1001c6fc
mov eax, dword [ebp - 8]
xor edx, edx
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
sub ecx, 0xa059e615
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0xe226
setg al
sub eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x1c]
mov eax, ebx
jle 0x1001c6fe
mov eax, edi
imul ecx, eax, 0xde24
xor edx, edx
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov ecx, 0xffff
setl dl
xor eax, eax
test edx, edx
sets al
cmp ecx, eax
sbb eax, eax
neg eax
cmp eax, dword [ebp - 8]
jl 0x1001c72c
mov edx, edi
cmp dword [ebp - 0x18], ebx
jne 0x1001c72e
mov edx, ebx
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp eax, edx
setne cl
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], ebx
je 0x1001c747
mov edx, edi
cmp dword [ebp - 0x14], ebx
jne 0x1001c749
mov edx, ebx
mov eax, dword [ebp - 0x34]
xor ecx, ecx
cmp edx, eax
push 0xfffffffffffffff9
setge cl
sub ecx, dword [ebp - 0x10]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0x3387dd7d
pop ecx
setl al
cmp ecx, eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0xfffffffa
setle cl
cmp ecx, dword [ebp - 0x28]
jl 0x1001c79f
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x1001c82c
push ebx
push 0xd7b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetScrollInfo]
jmp 0x1001c82c
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x10], ebx
jmp 0x1001c80c
mov dword [ebp - 0x2c], 4
mov dword [ebp - 8], 5
jmp 0x1001c804
mov dword [ebp - 0x18], edi
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
je 0x1001c7de
mov eax, dword [ebp - 0x44]
mov edx, edi
cmp dword [eax], ebx
jne 0x1001c7e0
mov edx, ebx
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setge cl
xor edx, edx
cmp ecx, eax
setl dl
add edx, 0x423d2df2
imul edx, dword [ebp - 0x2c]
mov dword [ebp - 0x34], edx
dec dword [ebp - 8]
cmp dword [ebp - 8], edi
jg 0x1001c7be
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffe7
jl 0x1001c7ae
mov dword [ebp - 0xc], ebx
jmp 0x1001c827
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x44]
mov dword [eax + ecx*4], 0x423037ff
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x1001c817
lea ecx, [ebp - 0x44]
call fcn.10018f31
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xf
jne 0x1001c5b0
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x28], 0xf8067e30
push edi
call fcn.10018732
mov dword [ebp - 8], ebx
jmp 0x1001c869
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x84], edi
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x1001c85c
mov dword [ebp - 8], ebx
jmp 0x1001c884
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x5c]
mov dword [eax + ecx*4], 0x69ec4279
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x1001c874
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x1c], ebx
jl 0x1001c8c3
push 4
pop eax
mov dword [ebp - 0x28], 0xfffffff7
mov dword [ebp - 0x28], 9
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x20], edi
inc dword [ebp - 0x20]
dec dword [ebp - 0x1c]
jns 0x1001c894
mov dword [ebp - 0x28], 0x44142b91
lea ecx, [ebp - 0x5c]
call fcn.10018f31
mov dword [ebp - 0x10], 0x638ecf54
mov dword [ebp - 0xc], 0xd8f8f576
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x18], ebx
jmp 0x1001c8fd
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x38], 0x61fc42ff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1001c8ef
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x1001c917
push 0x2401
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], 0x565e08cc
cmp dword [ebp - 0xc], ebx
je 0x1001c92c
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x10], eax
je 0x1001c9c4
mov dword [ebp - 0x24], 4
mov dword [ebp - 0x1c], 0xce7aebb
mov dword [ebp - 0x34], 0xffffffff
cmp dword [ebp - 0x24], ebx
je 0x1001c962
mov ecx, edi
cmp dword [ebp - 0x38], ebx
jne 0x1001c964
mov ecx, ebx
mov eax, dword [ebp - 0x24]
add eax, ecx
jne 0x1001c970
cmp dword [ebp - 0x24], ebx
je 0x1001c972
mov ebx, edi
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp ebx, eax
mov eax, dword [ebp - 0x24]
setge cl
xor edx, edx
cmp ecx, eax
setl dl
xor ebx, ebx
imul edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
cmp edx, eax
mov eax, dword [ebp - 0x38]
setg bl
xor edx, edx
cmp ecx, eax
setne dl
xor eax, eax
cmp edx, ebx
setge al
xor ebx, ebx
cmp eax, 0xab4d
jg 0x1001c9b9
cmp dword [ebp - 0x20], ebx
jne 0x1001c9b9
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1c], edi
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x34], edi
jmp 0x1001c9fd
mov dword [ebp - 0xc], 0xffffffe2
jmp 0x1001c9f7
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x1001c9f4
push ebx
push 0x1dd0
push 0x1dd
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharWidth32A]
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xfffffff4
jl 0x1001c9cd
mov byte [ebp - 2], bl
lea ecx, [ebp - 0x78]
push 3
call fcn.10018732
mov dword [ebp - 0x10], ebx
jmp 0x1001ca1b
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x78]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1001ca0f
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x1001ca3b
push 0xaea
push 0xa64
push ebx
call dword [sym.imp.USER32.dll_DeleteMenu]
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x1001ca5b
push 0x316
push 0x2681
push ebx
push 0x5f2
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea ecx, [ebp - 0x78]
call fcn.10018f31
cmp byte [ebp - 2], 0
je 0x1001ca70
push ebx
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
push 3
lea ecx, [ebp - 0x50]
call fcn.10018732
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x10], ebx
jmp 0x1001ca8f
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x50]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1001ca82
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x1c], ebx
jl 0x1001cab1
mov byte [ebp - 2], bl
cmp byte [ebp - 2], 0
je 0x1001caac
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
dec dword [ebp - 0x1c]
jns 0x1001ca9d
mov byte [ebp - 2], bl
cmp byte [ebp - 2], 0
je 0x1001cad8
push 0x1f03
push 0x1c4a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_LineTo]
lea ecx, [ebp - 0x50]
call fcn.10018f31
jmp 0x1001cc5c
mov dword [ebp - 8], 0xffffffff
xor edi, edi
mov dword [ebp - 0xc], 0xe0f7
inc edi
mov dword [ebp - 0x28], 0xb0badcab
mov dword [ebp - 0x10], ebx
jmp 0x1001cb10
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x30], 0xb194
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1001cb02
mov byte [ebp - 2], bl
cmp byte [ebp - 2], bl
je 0x1001cb2a
push ebx
push ebx
push 0x1cea
call dword [sym.imp.ADVAPI32.dll_CopySid]
mov dword [ebp - 8], ebx
jmp 0x1001cc4a
mov dword [ebp - 0x14], 0x8531d14
xor ecx, ecx
mov eax, dword [ebp - 0x30]
cmp eax, edi
setge cl
cmp ecx, dword [ebp - 8]
jge 0x1001cb4b
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 8], ebx
je 0x1001cb5a
mov ecx, edi
cmp dword [ebp - 0x14], ebx
jne 0x1001cb5c
mov ecx, ebx
mov eax, dword [ebp - 8]
sub eax, ecx
je 0x1001cbc7
mov dword [ebp - 0x20], 0x39e6a413
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0xc], ebx
je 0x1001cb79
mov edx, edi
cmp dword [ebp - 8], ebx
jne 0x1001cb7b
mov edx, ebx
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp edx, eax
setle cl
imul ecx, dword [ebp - 0xc]
test ecx, ecx
je 0x1001cb90
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setg cl
add eax, 0xaedcd7f0
add eax, ecx
xor ecx, ecx
cmp eax, 0x1912
setle cl
add ecx, dword [ebp - 0x20]
mov dword [ebp - 0x28], ecx
jmp 0x1001cc47
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x34], 0x1fa46b4c
mov dword [ebp - 0xc], ebx
jmp 0x1001cc32
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x30]
cmp eax, dword [ebp - 0x28]
jl 0x1001cc14
mov eax, dword [ebp - 0x30]
xor edx, edx
test eax, eax
mov eax, dword [ebp - 0xc]
setns dl
xor ecx, ecx
mov esi, dword [ebp + eax*4 - 0x30]
mov eax, dword [ebp - 0x14]
cmp edx, eax
mov eax, dword [ebp - 0x30]
setge cl
add esi, ecx
xor ecx, ecx
cmp esi, eax
mov eax, dword [ebp - 0xc]
setge cl
cmp ecx, dword [ebp + eax*4 - 0x30]
mov eax, edi
jg 0x1001cc16
mov eax, ebx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x14], ebx
jmp 0x1001cc2a
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x30], ebx
jne 0x1001cc2f
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x1001cc1e
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jle 0x1001cbd6
mov byte [ebp - 2], bl
cmp byte [ebp - 2], bl
je 0x1001cc47
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
je 0x1001cb32
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret