Function at 0x4903d0
Capabilities:
Get file system object information

Disassembly:
push 0xffffffffffffffff
push 0x4f6f81
mov eax, dword fs:[0]
push eax
mov eax, 0x45e4
call fcn.004df2e0
mov eax, dword [0x50fb70]
xor eax, esp
mov dword [esp + 0x45e0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x50fb70]
xor eax, esp
push eax
lea eax, [esp + 0x45f8]
mov dword fs:[0], eax
mov eax, dword [esp + 0x4608]
inc dword [0x534434]
mov esi, ecx
mov dword [esp + 0x24], eax
xor ebp, ebp
mov dword [esp + 0x4600], ebp
mov ecx, dword [esi]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push 1
push 0xffffffffffffffff
push 0x100c
push ecx
call ebx
push 1
mov ecx, 0x5354e0
mov dword [esp + 0x24], eax
call fcn.0049d420
push 0x1c2
call fcn.004610c0
push eax
mov ecx, 0x5354e0
call fcn.0049d490
mov eax, dword [0x53443c]
cmp eax, ebp
je 0x49047e
push eax
call dword [sym.imp.KERNEL32.dll_FindCloseChangeNotification]
mov dword [0x53443c], 0xffffffff
cmp byte [esi + 0x101a], 0
mov byte [esp + 0x15], 0
je 0x49049b
mov ecx, 0x53fd00
call fcn.00476020
jmp 0x490542
lea edi, [esi + 0x101c]
push edi
call fcn.004432f0
test al, al
jne 0x4904d1
jmp 0x4904b0
push edi
call fcn.00450f20
cmp word [eax], bp
je 0x4904cc
xor edx, edx
push edi
mov word [eax], dx
call fcn.004432f0
test al, al
je 0x4904b0
jmp 0x4904d1
mov byte [esp + 0x15], 1
push edi
call fcn.00450f20
cmp word [eax], bp
jne 0x4904de
mov eax, edi
push eax
call fcn.004bf840
push edi
call fcn.00451180
mov ebp, eax
cmp ebp, 0xffffffff
je 0x49051a
call fcn.004ad3b0
mov edx, 1
mov ecx, ebp
shl edx, cl
test edx, eax
jne 0x49051a
mov dword [esp + 0x4600], 0xffffffff
cmp dword [0x534434], 0
jmp 0x490c6c
cmp byte [esp + 0x15], 0
jne 0x490540
mov ecx, 0x53fd00
call fcn.00475a70
mov ecx, 0x53fcf0
call fcn.004a2ab0
push edi
mov ecx, 0x53fcf0
call fcn.004a25a0
xor ebp, ebp
mov eax, dword [esi]
push ebp
push ebp
push 0xb
push eax
call ebx
mov ecx, esi
call fcn.0048dd90
cmp byte [esp + 0x15], 0
mov edi, dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
jne 0x49057d
push 0x4401
push 0x2b4
lea ecx, [esp + 0xe4]
push ecx
push ebp
push 0x4fa4b8
call edi
cmp eax, ebp
jne 0x4905b8
push ebp
push 0x800
lea edx, [esp + 0x35fc]
push edx
call fcn.004ad2b0
cmp byte [esp + 0x15], 0
je 0x49059b
xor eax, eax
jmp 0x4905b8
push 0x4401
push 0x2b4
lea eax, [esp + 0xe4]
push eax
push ebp
lea ecx, [esp + 0x3604]
push ecx
call edi
mov edx, dword [esi]
push eax
push 1
push 0x1003
push edx
call ebx
lea edi, [esi + 0x101c]
push edi
mov dword [esp + 0x2c], edi
call fcn.004ad3d0
push 1
push str.AllowUppercase
push str.FileList
mov byte [esp + 0x23], al
call fcn.00496520
push ebp
push str.ShowSeconds
test eax, eax
push str.FileList
setne byte [esp + 0x2b]
call fcn.00496520
test eax, eax
setne byte [esp + 0x1d]
cmp byte [esi + 0x101a], 0
je 0x49061d
mov ecx, esi
call fcn.0048e4d0
jmp 0x490b46
push 0x800
lea eax, [esp + 0x35f8]
push eax
push 0x4fa890
push edi
call fcn.00450ab0
lea ecx, [esp + 0x24c0]
call fcn.00444b50
mov byte [esp + 0x4600], 1
lea ecx, [esp + 0x35f4]
push ecx
lea ecx, [esp + 0x24c4]
call fcn.00444b90
push 0x1f4
lea ecx, [esp + 0xb0]
mov dword [esp + 0x13a4], ebp
mov dword [esp + 0x13a8], ebp
mov dword [esp + 0x13ac], ebp
mov dword [esp + 0x13b0], ebp
mov dword [esp + 0x13b4], ebp
mov dword [esp + 0x13b8], ebp
mov dword [esp + 0x1c], ebp
mov byte [esp + 0x1a], 0
call fcn.004ae150
mov byte [esp + 0x4600], 2
cmp byte [esp + 0x15], 0
jne 0x490a5b
push ebp
lea edx, [esp + 0x394]
push edx
lea ecx, [esp + 0x24c8]
call fcn.00444da0
test al, al
je 0x490a50
test byte [esp + 0x18], 0x1f
jne 0x4906e4
lea ecx, [esp + 0xac]
call fcn.004ad8c0
lea eax, [esp + 0x390]
push eax
call fcn.00450f20
mov edi, eax
mov ecx, 0x4fa4b8
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x49071e
cmp dx, bp
je 0x49071a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x49071e
add eax, 4
add ecx, 4
cmp dx, bp
jne 0x4906f8
xor eax, eax
jmp 0x490723
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebp
je 0x4906b4
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x64], ecx
mov dword [esp + 0x60], 7
mov dword [esp + 0x7c], 0xffffffff
mov dword [esp + 0x68], ebp
mov dword [esp + 0x74], edi
mov ecx, 0x4fa450
mov eax, edi
mov edi, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x490776
cmp dx, bp
je 0x490772
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x490776
add eax, 4
add ecx, 4
cmp dx, bp
jne 0x490750
xor eax, eax
jmp 0x49077b
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebp
sete al
mov byte [esp + 0x1e], al
test al, al
je 0x4907a3
cmp byte [esp + 0x17], 0
jne 0x4906b4
mov edx, dword [esp + 0xe0]
mov dword [esp + 0x7c], edx
mov byte [esp + 0x16], 1
push 0x10e8
lea eax, [esp + 0x13dc]
push ebp
push eax
call fcn.004e01d0
add esp, 0xc
push 0x800
push edi
lea ecx, [esp + 0x13e0]
push ecx
call fcn.00466930
push edi
mov ecx, esi
call fcn.0048b880
mov eax, dword [esp + 0x1394]
mov edx, dword [esp + 0x1390]
mov ecx, dword [esp + 0x1398]
mov dword [esp + 0x245c], eax
mov eax, dword [esp + 0x13a4]
mov dword [esp + 0x246c], eax
mov eax, dword [esp + 0x18]
inc eax
cmp byte [esp + 0x139d], 0
mov dword [esp + 0x2458], edx
mov edx, dword [esp + 0x13a0]
mov dword [esp + 0x2460], ebp
mov dword [esp + 0x2464], ebp
mov dword [esp + 0x2470], ecx
mov dword [esp + 0x2468], edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x24b4], eax
je 0x490858
xor ecx, ecx
cmp byte [esp + 0x139e], cl
setne cl
add ecx, 2
mov dword [esp + 0x24a0], ecx
lea edx, [esp + 0x13d8]
push edx
mov ecx, 0x55f800
call fcn.0048b3a0
cmp byte [esp + 0x1f], 0
mov dword [esp + 0x80], eax
jne 0x490882
mov eax, dword [esp + 0x74]
push eax
call fcn.00492a30
mov edx, dword [esi]
lea ecx, [esp + 0x60]
push ecx
push ebp
push 0x104d
push edx
mov dword [esp + 0x84], edi
call ebx
cmp byte [esp + 0x139c], 0
mov ebp, eax
jne 0x4908df
mov ecx, dword [esp + 0x245c]
mov edx, dword [esp + 0x2458]
push 0x32
lea eax, [esp + 0x3594]
push eax
push ecx
push edx
call fcn.0049d790
mov edx, dword [esi]
lea ecx, [esp + 0x2c]
push ecx
push ebp
lea eax, [esp + 0x3598]
push 0x1074
mov dword [esp + 0x4c], eax
push edx
jmp 0x4908f5
mov ecx, dword [esi]
lea eax, [esp + 0x2c]
push eax
push ebp
push 0x1074
mov dword [esp + 0x4c], 0x4f9a98
push ecx
mov dword [esp + 0x44], 1
call ebx
cmp byte [esp + 0x1e], 0
mov dword [esp + 0x34], 2
je 0x490929
mov ecx, dword [esi]
lea eax, [esp + 0x2c]
push eax
push ebp
lea edx, [esp + 0x2f8]
push 0x1074
mov dword [esp + 0x4c], edx
push ecx
jmp 0x49093f
mov eax, dword [esi]
lea edx, [esp + 0x2c]
push edx
push ebp
push 0x1074
mov dword [esp + 0x4c], 0x4f9a98
push eax
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea ecx, [esp + 0xcc]
push ecx
lea edx, [esp + 0x13cc]
push edx
call edi
lea eax, [esp + 0xbc]
push eax
lea ecx, [esp + 0xd0]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
lea edx, [esp + 0x94]
push edx
lea eax, [esp + 0xc0]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea ecx, [esp + 0x9c]
push ecx
lea edx, [esp + 0x98]
push edx
call edi
push 0x64
lea eax, [esp + 0x34cc]
push eax
push 0
lea ecx, [esp + 0xa8]
push ecx
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
lea edi, [esp + 0x34c8]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4909c4
mov edx, dword [0x4fc5a4]
lea eax, [esp + 0x34c8]
mov dword [edi], edx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4909e2
sub eax, edx
xor edx, edx
sar eax, 1
cmp byte [esp + 0x1d], dl
push 0x64
setne dl
lea eax, [esp + eax*2 + 0x34cc]
push eax
push 0
lea ecx, [esp + 0xa8]
push ecx
dec edx
and edx, 2
push edx
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTimeFormatW]
mov edx, dword [esi]
lea ecx, [esp + 0x2c]
push ecx
push ebp
push 0x1074
lea eax, [esp + 0x34d4]
push edx
mov dword [esp + 0x44], 3
mov dword [esp + 0x50], eax
call ebx
mov eax, dword [esp + 0x18]
mov dword [esp + 0x18], eax
xor ebp, ebp
jmp 0x4906b4
cmp byte [esp + 0x16], 0
jne 0x490b1e
cmp byte [esp + 0x17], 0
jne 0x490b1e
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0xe0]
push 0x10e8
lea eax, [esp + 0x13dc]
push ebp
push eax
mov dword [esp + 0x6c], 7
mov dword [esp + 0x70], ecx
mov dword [esp + 0x88], edx
mov dword [esp + 0x74], ebp
mov dword [esp + 0x80], 0x4fa450
call fcn.004e01d0
add esp, 0xc
xor eax, eax
jmp 0x490ab0
movzx ecx, word [eax + 0x4fa450]
mov word [esp + eax + 0x13d8], cx
add eax, 2
cmp cx, bp
jne 0x490ab0
lea ecx, [esp + 0x13d8]
push ecx
mov ecx, 0x55f800
mov dword [esp + 0x2474], 0x10
call fcn.0048b3a0
lea edx, [esp + 0x60]
push edx
push ebp
mov dword [esp + 0x88], eax
mov eax, dword [esi]
push 0x104d
push eax
call ebx
lea edx, [esp + 0x2c]
push edx
push eax
mov eax, dword [esi]
push 0x1074
lea ecx, [esp + 0x2fc]
push eax
mov dword [esp + 0x44], 2
mov dword [esp + 0x50], ecx
call ebx
mov byte [esp + 0x4600], 1
lea ecx, [esp + 0xac]
call fcn.004ad900
mov byte [esp + 0x4600], 0
lea ecx, [esp + 0x24c0]
call fcn.00444b70
mov ecx, 0x55f800
call fcn.0048b500
mov ecx, esi
call fcn.0048e120
mov edi, dword [esp + 0x24]
cmp edi, ebp
je 0x490bac
cmp word [edi], bp
jne 0x490ba0
mov ecx, dword [esi]
push ebp
push ebp
push 0x1004
push ecx
call ebx
cmp dword [esp + 0x20], eax
jl 0x490b7f
cmp eax, ebp
jle 0x490b7f
dec eax
mov dword [esp + 0x20], eax
mov ecx, dword [esi]
mov eax, 3
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x40], eax
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x24]
push eax
push 0x102b
push ecx
jmp 0x490bd6
push edi
mov ecx, esi
call fcn.0048f6b0
test al, al
jne 0x490bd8
mov eax, 3
mov dword [esp + 0x3c], eax
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x20]
cmp eax, 0xffffffff
je 0x490bc6
cmp edi, ebp
jne 0x490bc8
xor eax, eax
lea edx, [esp + 0x2c]
push edx
push eax
mov eax, dword [esi]
push 0x102b
push eax
call ebx
mov ecx, dword [esi]
push 1
push 0xffffffffffffffff
push 0x100c
push ecx
call ebx
push ebp
mov ecx, 0x5354e0
mov edi, eax
call fcn.0049d490
mov edx, dword [esi]
push ebp
push 1
push 0xb
push edx
call ebx
mov eax, dword [esi]
push ebp
push ebp
push 0x102a
push eax
call ebx
mov ecx, dword [esi]
push ebp
push edi
push 0x1013
push ecx
call ebx
mov ecx, esi
call fcn.0048e9c0
mov ecx, esi
call fcn.0048bdf0
push ebp
mov ecx, 0x5354e0
call fcn.0049d420
mov ecx, 0x545754
call fcn.0049fc50
cmp byte [esp + 0x15], 0
jne 0x490c5b
cmp byte [esi + 0x101a], 0
jne 0x490c5b
mov edx, dword [esp + 0x28]
push 3
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstChangeNotificationW]
mov dword [0x53443c], eax
mov dword [esp + 0x4600], 0xffffffff
cmp dword [0x534434], ebp
jle 0x490c74
dec dword [0x534434]
mov ecx, dword [esp + 0x45f8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x45e0]
xor ecx, esp
call fcn.004df2c4
add esp, 0x45f0
ret 4