Function at 0x4b678c
Capabilities:
Get file size
Get file system object information

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x7a
push 0
push 0
dec ecx
jne 0x4b6794
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4b71f3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x358]
mov eax, dword [eax + 0x218]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x4b71a8
mov esi, dword [ebx + 0x358]
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0xc8]
mov edx, eax
lea ecx, [ebp - 0x2c]
mov eax, dword [esi + 0x218]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x2c]
call fcn.00405204
mov edi, eax
mov esi, edi
mov eax, dword [ebp - 0x2c]
call fcn.00409ed0
test al, al
jne 0x4b681a
push 0
mov cx, word [0x4b7204]
mov dl, 2
mov eax, 0x4b7210
call fcn.0044371c
jmp 0x4b71a8
mov eax, dword [0x51c1fc]
mov eax, dword [eax]
call fcn.0046c048
mov eax, dword [0x51c1fc]
mov eax, dword [eax]
call fcn.0046c048
mov dl, 1
mov eax, dword [0x4233f4]
call fcn.0042a074
mov dword [ebp - 0x20], eax
mov dl, 6
mov eax, dword [ebp - 0x20]
call fcn.0042b78c
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 0x2c]
call fcn.0040a060
mov eax, dword [ebp - 0x21c]
lea edx, [ebp - 0x218]
call fcn.004094bc
mov eax, dword [ebp - 0x218]
mov edx, 0x4b7278
call fcn.00405150
jne 0x4b68a5
mov eax, dword [ebx + 0x310]
mov ecx, dword [ebp - 0x20]
xor edx, edx
call fcn.00459184
mov eax, dword [ebx + 0x318]
mov eax, dword [eax + 0x168]
mov edx, dword [ebp - 0x20]
mov ecx, dword [eax]
call dword [ecx + 8]
jmp 0x4b69cc
lea edx, [ebp - 0x224]
mov eax, dword [ebp - 0x2c]
call fcn.0040a060
mov eax, dword [ebp - 0x224]
lea edx, [ebp - 0x220]
call fcn.004094bc
mov eax, dword [ebp - 0x220]
mov edx, 0x4b7288
call fcn.00405150
jne 0x4b6902
mov eax, dword [ebx + 0x310]
mov ecx, dword [ebp - 0x20]
mov edx, 1
call fcn.00459184
mov eax, dword [ebx + 0x318]
mov eax, dword [eax + 0x168]
mov edx, dword [ebp - 0x20]
mov ecx, dword [eax]
call dword [ecx + 8]
jmp 0x4b69cc
lea edx, [ebp - 0x22c]
mov eax, dword [ebp - 0x2c]
call fcn.0040a060
mov eax, dword [ebp - 0x22c]
lea edx, [ebp - 0x228]
call fcn.004094bc
mov eax, dword [ebp - 0x228]
mov edx, 0x4b7298
call fcn.00405150
jne 0x4b695c
mov eax, dword [ebx + 0x310]
mov ecx, dword [ebp - 0x20]
mov edx, 2
call fcn.00459184
mov eax, dword [ebx + 0x318]
mov eax, dword [eax + 0x168]
mov edx, dword [ebp - 0x20]
mov ecx, dword [eax]
call dword [ecx + 8]
jmp 0x4b69cc
lea edx, [ebp - 0x230]
mov eax, dword [ebp - 0x2c]
call fcn.0040a060
mov eax, dword [ebp - 0x230]
mov edx, 0x4b72a8
call fcn.00405150
jne 0x4b69a5
mov eax, dword [ebx + 0x310]
mov ecx, dword [ebp - 0x20]
mov edx, 3
call fcn.00459184
mov eax, dword [ebx + 0x318]
mov eax, dword [eax + 0x168]
mov edx, dword [ebp - 0x20]
mov ecx, dword [eax]
call dword [ecx + 8]
jmp 0x4b69cc
mov eax, dword [ebx + 0x310]
mov ecx, dword [ebp - 0x20]
mov edx, 4
call fcn.00459184
mov eax, dword [ebx + 0x318]
mov eax, dword [eax + 0x168]
mov edx, dword [ebp - 0x20]
mov ecx, dword [eax]
call dword [ecx + 8]
push 0x500
push 0x160
lea eax, [ebp - 0x214]
push eax
push 0
push esi
call sub.shell32.dll_SHGetFileInfoA
mov dl, 1
mov eax, dword [0x423538]
call fcn.0042bda0
mov dword [ebp - 0x44], eax
mov edx, dword [ebp - 0x214]
mov eax, dword [ebp - 0x44]
call fcn.0042c170
mov eax, dword [ebx + 0x344]
mov eax, dword [eax + 0x168]
mov edx, dword [ebp - 0x44]
mov ecx, dword [eax]
call dword [ecx + 8]
lea eax, [ebp - 0x238]
lea edx, [ebp - 0x104]
mov ecx, 0x50
call fcn.00404fbc
push dword [ebp - 0x238]
push 0x4b72b8
push 0x4b72c4
mov eax, dword [ebp - 0x5c]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x23c]
call fcn.00409b40
push dword [ebp - 0x23c]
push 0x4b72d4
lea eax, [ebp - 0x234]
mov edx, 5
call fcn.004050cc
mov edx, dword [ebp - 0x234]
mov eax, dword [ebx + 0x320]
call fcn.0044b730
mov dword [ebp - 0x50], 0xc
xor eax, eax
mov dword [ebp - 0x48], eax
push 0
push 0x80
push 3
lea eax, [ebp - 0x50]
push eax
push 0
push 0x80000000
push edi
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 4], eax
mov eax, dword [0x51c1fc]
mov eax, dword [eax]
call fcn.0046c048
cmp dword [ebp - 4], 0xffffffff
je 0x4b7193
xor eax, eax
push ebp
push 0x4b718c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x84]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetFileInformationByHandle
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
call fcn.0040a028
mov eax, dword [ebp - 0x28]
call fcn.0040500c
mov edx, eax
sub edx, 3
lea eax, [ebp - 0x28]
mov ecx, 4
call fcn.004052a4
mov eax, dword [ebp - 0x28]
call fcn.0040500c
cmp eax, 0x1e
jle 0x4b6be3
lea eax, [ebp - 0x33c]
mov edx, dword [ebp - 0x28]
mov ecx, 0xff
call fcn.00404fe8
lea edx, [ebp - 0x33c]
lea eax, [ebp - 0xb3]
mov cl, 0x1e
call fcn.00403068
lea edx, [ebp - 0xb3]
lea eax, [ebp - 0x368]
call fcn.0040305c
mov edx, 0x4b72ec
lea eax, [ebp - 0x368]
mov cl, 0x21
call fcn.0040302c
lea edx, [ebp - 0x368]
lea eax, [ebp - 0x3a4]
call fcn.0040305c
mov edx, 0x4b72f0
lea eax, [ebp - 0x3a4]
mov cl, 0x3a
call fcn.0040302c
lea edx, [ebp - 0x3a4]
lea eax, [ebp - 0x344]
call fcn.00404fb0
push dword [ebp - 0x344]
mov eax, dword [ebp - 0x58]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x3a8]
call fcn.00409b40
push dword [ebp - 0x3a8]
mov eax, dword [ebp - 0x54]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x3ac]
call fcn.00409b40
push dword [ebp - 0x3ac]
lea eax, [ebp - 0x340]
mov edx, 3
call fcn.004050cc
mov edx, dword [ebp - 0x340]
mov eax, dword [ebx + 0x314]
call fcn.0044b730
jmp 0x4b6c3c
push dword [ebp - 0x28]
push 0x4b7314
mov eax, dword [ebp - 0x58]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x3b4]
call fcn.00409b40
push dword [ebp - 0x3b4]
mov eax, dword [ebp - 0x54]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x3b8]
call fcn.00409b40
push dword [ebp - 0x3b8]
lea eax, [ebp - 0x3b0]
mov edx, 4
call fcn.004050cc
mov edx, dword [ebp - 0x3b0]
mov eax, dword [ebx + 0x314]
call fcn.0044b730
push 0
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetFileSize_1
mov edx, eax
lea ecx, [ebp - 0x3bc]
mov eax, ebx
call fcn.004b58ac
mov edx, dword [ebp - 0x3bc]
mov eax, dword [ebx + 0x328]
call fcn.0044b730
mov eax, dword [ebp - 0x84]
and eax, 0x1000
test al, al
je 0x4b6c88
mov eax, dword [ebx + 0x348]
mov edx, 0x4b7338
call fcn.0044b730
jmp 0x4b6c98
mov eax, dword [ebx + 0x348]
mov edx, 0x4b7348
call fcn.0044b730
mov eax, dword [ebp - 0x84]
and eax, 2
test al, al
je 0x4b6cb7
mov eax, dword [ebx + 0x34c]
mov edx, 0x4b7358
call fcn.0044b730
jmp 0x4b6cc7
mov eax, dword [ebx + 0x34c]
mov edx, 0x4b7368
call fcn.0044b730
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80]
push eax
call sub.kernel32.dll_FileTimeToLocalFileTime
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0xc]
push eax
call sub.kernel32.dll_FileTimeToSystemTime
mov si, word [ebp - 0x8c]
cmp si, 0xb
jbe 0x4b6d00
lea eax, [ebp - 0x24]
mov edx, 0x4b7378
call fcn.00404dec
jmp 0x4b6d0d
lea eax, [ebp - 0x24]
mov edx, 0x4b7384
call fcn.00404dec
cmp si, 0xc
jbe 0x4b6d1b
sub word [ebp - 0x8c], 0xc
lea edx, [ebp - 0x30]
movzx eax, word [ebp - 0x8c]
call fcn.00409b10
lea edx, [ebp - 0x34]
movzx eax, word [ebp - 0x8a]
call fcn.00409b10
lea edx, [ebp - 0x38]
movzx eax, word [ebp - 0x88]
call fcn.00409b10
lea edx, [ebp - 0x3c]
movzx eax, word [ebp - 0x92]
call fcn.00409b10
lea edx, [ebp - 0x40]
movzx eax, word [ebp - 0x8e]
call fcn.00409b10
cmp word [ebp - 0x8c], 0xa
jae 0x4b6d80
lea eax, [ebp - 0x30]
mov ecx, dword [ebp - 0x30]
mov edx, 0x4b7390
call fcn.00405058
cmp word [ebp - 0x8a], 0xa
jae 0x4b6d9a
lea eax, [ebp - 0x34]
mov ecx, dword [ebp - 0x34]
mov edx, 0x4b7390
call fcn.00405058
cmp word [ebp - 0x88], 0xa
jae 0x4b6db4
lea eax, [ebp - 0x38]
mov ecx, dword [ebp - 0x38]
mov edx, 0x4b7390
call fcn.00405058
cmp word [ebp - 0x92], 0xa
jae 0x4b6dce
lea eax, [ebp - 0x3c]
mov ecx, dword [ebp - 0x3c]
mov edx, 0x4b7390
call fcn.00405058
cmp word [ebp - 0x8e], 0xa
jae 0x4b6de8
lea eax, [ebp - 0x40]
mov ecx, dword [ebp - 0x40]
mov edx, 0x4b7390
call fcn.00405058
push dword [ebp - 0x30]
push 0x4b739c
push dword [ebp - 0x34]
push 0x4b739c
push dword [ebp - 0x38]
push 0x4b72b8
push dword [ebp - 0x24]
push 0x4b73a8
lea edx, [ebp - 0x3c4]
movzx eax, word [ebp - 0x94]
call fcn.00409b10
push dword [ebp - 0x3c4]
push 0x4b73b4
push dword [ebp - 0x3c]
push 0x4b73b4
push dword [ebp - 0x40]
lea eax, [ebp - 0x3c0]
mov edx, 0xd
call fcn.004050cc
mov edx, dword [ebp - 0x3c0]
mov eax, dword [ebx + 0x330]
call fcn.0044b730
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x78]
push eax
call sub.kernel32.dll_FileTimeToLocalFileTime
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0x14]
push eax
call sub.kernel32.dll_FileTimeToSystemTime
mov si, word [ebp - 0x8c]
cmp si, 0xb
jbe 0x4b6e8a
lea eax, [ebp - 0x24]
mov edx, 0x4b7378
call fcn.00404dec
jmp 0x4b6e97
lea eax, [ebp - 0x24]
mov edx, 0x4b7384
call fcn.00404dec
cmp si, 0xc
jbe 0x4b6ea5
sub word [ebp - 0x8c], 0xc
lea edx, [ebp - 0x30]
movzx eax, word [ebp - 0x8c]
call fcn.00409b10
lea edx, [ebp - 0x34]
movzx eax, word [ebp - 0x8a]
call fcn.00409b10
lea edx, [ebp - 0x38]
movzx eax, word [ebp - 0x88]
call fcn.00409b10
lea edx, [ebp - 0x3c]
movzx eax, word [ebp - 0x92]
call fcn.00409b10
lea edx, [ebp - 0x40]
movzx eax, word [ebp - 0x8e]
call fcn.00409b10
cmp word [ebp - 0x8c], 0xa
jae 0x4b6f0a
lea eax, [ebp - 0x30]
mov ecx, dword [ebp - 0x30]
mov edx, 0x4b7390
call fcn.00405058
cmp word [ebp - 0x8a], 0xa
jae 0x4b6f24
lea eax, [ebp - 0x34]
mov ecx, dword [ebp - 0x34]
mov edx, 0x4b7390
call fcn.00405058
cmp word [ebp - 0x88], 0xa
jae 0x4b6f3e
lea eax, [ebp - 0x38]
mov ecx, dword [ebp - 0x38]
mov edx, 0x4b7390
call fcn.00405058
cmp word [ebp - 0x92], 0xa
jae 0x4b6f58
lea eax, [ebp - 0x3c]
mov ecx, dword [ebp - 0x3c]
mov edx, 0x4b7390
call fcn.00405058
cmp word [ebp - 0x8e], 0xa
jae 0x4b6f72
lea eax, [ebp - 0x40]
mov ecx, dword [ebp - 0x40]
mov edx, 0x4b7390
call fcn.00405058
push dword [ebp - 0x30]
push 0x4b739c
push dword [ebp - 0x34]
push 0x4b739c
push dword [ebp - 0x38]
push 0x4b72b8
push dword [ebp - 0x24]
push 0x4b73a8
lea edx, [ebp - 0x3cc]
movzx eax, word [ebp - 0x94]
call fcn.00409b10
push dword [ebp - 0x3cc]
push 0x4b73b4
push dword [ebp - 0x3c]
push 0x4b73b4
push dword [ebp - 0x40]
lea eax, [ebp - 0x3c8]
mov edx, 0xd
call fcn.004050cc
mov edx, dword [ebp - 0x3c8]
mov eax, dword [ebx + 0x340]
call fcn.0044b730
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x70]
push eax
call sub.kernel32.dll_FileTimeToLocalFileTime
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0x1c]
push eax
call sub.kernel32.dll_FileTimeToSystemTime
mov si, word [ebp - 0x8c]
cmp si, 0xb
jbe 0x4b7014
lea eax, [ebp - 0x24]
mov edx, 0x4b7378
call fcn.00404dec
jmp 0x4b7021
lea eax, [ebp - 0x24]
mov edx, 0x4b7384
call fcn.00404dec
cmp si, 0xc
jbe 0x4b702f
sub word [ebp - 0x8c], 0xc
lea edx, [ebp - 0x30]
movzx eax, word [ebp - 0x8c]
call fcn.00409b10
lea edx, [ebp - 0x34]
movzx eax, word [ebp - 0x8a]
call fcn.00409b10
lea edx, [ebp - 0x38]
movzx eax, word [ebp - 0x88]
call fcn.00409b10
lea edx, [ebp - 0x3c]
movzx eax, word [ebp - 0x92]
call fcn.00409b10
lea edx, [ebp - 0x40]
movzx eax, word [ebp - 0x8e]
call fcn.00409b10
cmp word [ebp - 0x8c], 0xa
jae 0x4b7094
lea eax, [ebp - 0x30]
mov ecx, dword [ebp - 0x30]
mov edx, 0x4b7390
call fcn.00405058
cmp word [ebp - 0x8a], 0xa
jae 0x4b70ae
lea eax, [ebp - 0x34]
mov ecx, dword [ebp - 0x34]
mov edx, 0x4b7390
call fcn.00405058
cmp word [ebp - 0x88], 0xa
jae 0x4b70c8
lea eax, [ebp - 0x38]
mov ecx, dword [ebp - 0x38]
mov edx, 0x4b7390
call fcn.00405058
cmp word [ebp - 0x92], 0xa
jae 0x4b70e2
lea eax, [ebp - 0x3c]
mov ecx, dword [ebp - 0x3c]
mov edx, 0x4b7390
call fcn.00405058
cmp word [ebp - 0x8e], 0xa
jae 0x4b70fc
lea eax, [ebp - 0x40]
mov ecx, dword [ebp - 0x40]
mov edx, 0x4b7390
call fcn.00405058
push dword [ebp - 0x30]
push 0x4b739c
push dword [ebp - 0x34]
push 0x4b739c
push dword [ebp - 0x38]
push 0x4b72b8
push dword [ebp - 0x24]
push 0x4b73a8
lea edx, [ebp - 0x3d4]
movzx eax, word [ebp - 0x94]
call fcn.00409b10
push dword [ebp - 0x3d4]
push 0x4b73b4
push dword [ebp - 0x3c]
push 0x4b73b4
push dword [ebp - 0x40]
lea eax, [ebp - 0x3d0]
mov edx, 0xd
call fcn.004050cc
mov edx, dword [ebp - 0x3d0]
mov eax, dword [ebx + 0x338]
call fcn.0044b730
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b71a8
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle_1
lea eax, [ebp - 0x44]
call fcn.0040f2f0
lea eax, [ebp - 0x20]
call fcn.0040f2f0
ret
push 0
mov cx, word [0x4b7204]
mov dl, 2
mov eax, 0x4b73c0
call fcn.0044371c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b71fa
lea eax, [ebp - 0x3d4]
mov edx, 0xc
call fcn.00404d78
lea eax, [ebp - 0x344]
mov edx, 2
call fcn.00404d78
lea eax, [ebp - 0x23c]
mov edx, 0xa
call fcn.00404d78
lea eax, [ebp - 0x40]
mov edx, 8
call fcn.00404d78
ret