Function at 0x140005aa0
Capabilities:
Get file system object information

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x358
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov rax, qword [0x140197b10]
xor rax, rsp
mov qword [rsp + 0x340], rax
mov r13, r9
mov rdi, r8
mov r14, rdx
mov r15, rcx
xor esi, esi
mov qword [rsp + 0x80], rsi
xor edx, edx
mov r8d, 0x2b0
lea rcx, [rsp + 0x88]
call fcn.14010c6c0
mov rdx, rdi
lea rcx, [rsp + 0x50]
call fcn.140005480
nop
lea r8d, [rsi + 1]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x50]
call fcn.140002140
mov rcx, qword [rax]
mov eax, dword [rcx - 0x10]
cmp eax, 1
jne 0x140005b40
test eax, eax
jns 0x140005b35
mov ecx, 0x80070057
call fcn.140001000
int3
cmp word [rcx], 0x5c
jne 0x140005b40
xor dil, dil
jmp 0x140005b43
mov dil, 1
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
or rbx, 0xffffffffffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140005b66
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test dil, dil
je 0x140005b7c
lea rdx, [0x14013e968]
lea rcx, [rsp + 0x50]
call fcn.140004a90
mov rcx, qword [rsp + 0x50]
movzx eax, word [rcx]
movzx edx, ax
mov edi, 0xffdf
and dx, di
test ax, ax
je 0x140005bbe
cmp word [rcx + 2], 0x3a
jne 0x140005bbe
cmp word [rcx + 4], 0x5c
jne 0x140005bbe
cmp word [rcx + 6], 0
jne 0x140005bbe
mov edi, 1
cmp dx, 0x41
jb 0x140005bba
cmp dx, 0x5a
jbe 0x140005bc0
mov eax, edi
jmp 0x140005bc2
mov edi, esi
mov eax, esi
test r13, r13
jne 0x140005c66
test eax, eax
jne 0x140005c66
test edi, edi
jne 0x140005be8
xor ecx, ecx
call fcn.140007700
mov ebp, eax
mov r12d, eax
jmp 0x140005c75
mov dword [rsp + 0x20], 0x101
mov r9d, 0x2b8
lea r8, [rsp + 0x80]
xor edx, edx
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov r12d, dword [rsp + 0x88]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.USER32.dll_DestroyIcon]
mov qword [rsp + 0x80], rsi
mov dword [rsp + 0x20], 0x103
mov r9d, 0x2b8
lea r8, [rsp + 0x80]
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov ebp, dword [rsp + 0x88]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.USER32.dll_DestroyIcon]
mov qword [rsp + 0x80], rsi
jmp 0x140005c75
mov ecx, 1
call fcn.140007700
mov ebp, eax
mov r12d, eax
mov r8d, 1
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.140002140
mov rcx, qword [rax]
mov eax, dword [rcx - 0x10]
cmp eax, 1
jne 0x140005caf
test eax, eax
jns 0x140005ca4
mov ecx, 0x80070057
call fcn.140001000
int3
cmp word [rcx], 0x5c
jne 0x140005caf
mov dil, 1
jmp 0x140005cb2
xor dil, dil
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140005cd1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test dil, dil
je 0x140005d3d
mov rax, qword [rsp + 0x50]
movsxd rdi, dword [rax - 0x10]
lea esi, [rdi - 1]
test esi, esi
js 0x140005d32
cmp esi, edi
jge 0x140005d32
cmp dword [rax - 8], 1
jle 0x140005d02
mov edx, dword [rax - 0x10]
lea rcx, [rsp + 0x50]
call fcn.140001920
mov rax, qword [rsp + 0x50]
movsxd rcx, esi
xor esi, esi
mov word [rax + rcx*2], si
test edi, edi
js 0x140005d27
mov rax, qword [rsp + 0x50]
cmp edi, dword [rax - 0xc]
jg 0x140005d27
mov dword [rax - 0x10], edi
mov rax, qword [rsp + 0x50]
mov word [rax + rdi*2], si
jmp 0x140005d3d
mov ecx, 0x80070057
call fcn.140001000
int3
mov ecx, 0x80070057
call fcn.140001000
int3
cmp r14, 0xffffffffffff0000
jne 0x140006035
call fcn.1400da76c
mov rdx, rax
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
jne 0x140005d69
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x60], rax
test r13, r13
je 0x140005ded
xor eax, eax
mov rcx, rbx
lea rdi, [0x14013f3c8]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [0x14013f3c8]
lea rcx, [rsp + 0x60]
call fcn.140002570
xor eax, eax
mov rcx, rbx
mov rdi, r13
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rdx, r13
lea rcx, [rsp + 0x60]
call fcn.140002660
xor eax, eax
mov rcx, rbx
lea rdi, [0x14013f3c4]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [0x14013f3c4]
lea rcx, [rsp + 0x60]
call fcn.140002660
mov r8d, dword [rsp + 0x3c0]
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x58]
call fcn.140005540
nop
xor eax, eax
lea rdi, [0x14013f388]
mov rdx, qword [rsp + 0x58]
mov rsi, rdx
mov ecx, 2
repe cmpsw word [rsi], word [rdi]
je 0x140005e25
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sete al
test al, al
je 0x140005e8d
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140005e49
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140005e69
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
dec ebx
test ebx, ebx
jg 0x140005e86
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x14000609b
cmp word [rdx], 0
je 0x140005f18
xor eax, eax
mov rcx, rbx
lea rdi, [0x14013f3bc]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [0x14013f3bc]
lea rcx, [rsp + 0x58]
call fcn.140002660
mov rdx, qword [rsp + 0x50]
test rdx, rdx
jne 0x140005ecc
xor ecx, ecx
jmp 0x140005edd
xor eax, eax
mov rcx, rbx
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
dec rcx
mov r8d, ecx
lea rcx, [rsp + 0x58]
call fcn.140002660
xor eax, eax
mov rcx, rbx
lea rdi, [0x14013f3b8]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [0x14013f3b8]
lea rcx, [rsp + 0x58]
call fcn.140002660
mov rdx, qword [rsp + 0x58]
jmp 0x140005f7a
mov rax, qword [rsp + 0x50]
lea rcx, [rax - 0x18]
lea rdi, [rdx - 0x18]
cmp rcx, rdi
je 0x140005f7a
cmp dword [rdi + 0x10], 0
jl 0x140005f64
mov rdx, qword [rdi]
cmp qword [rcx], rdx
jne 0x140005f64
call fcn.140001e00
mov rsi, rax
mov ecx, ebx
lock xadd dword [rdi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x140005f59
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, [rsi + 0x18]
mov qword [rsp + 0x58], rdx
jmp 0x140005f7a
mov r8d, dword [rax - 0x10]
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.140002570
mov rdx, qword [rsp + 0x58]
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x60]
call fcn.140002660
mov qword [rsp + 0x48], 0xffffffffffff0002
mov qword [rsp + 0x40], 0xffffffffffff0000
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], ebp
mov r9d, r12d
mov r8, qword [rsp + 0x60]
mov edx, 0x23
mov rcx, qword [r15 + 0xc0]
call fcn.1400d9854
mov rdi, rax
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov ecx, ebx
lock xadd dword [rdx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x140005ff3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140006013
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
dec ebx
test ebx, ebx
jg 0x140006030
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, rdi
jmp 0x14000609b
mov rdx, qword [rsp + 0x50]
mov rcx, r15
call fcn.140004cb0
mov qword [rsp + 0x48], 0xffffffffffff0002
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], ebp
mov r9d, r12d
mov r8, rax
mov edx, 0x23
mov rcx, qword [r15 + 0xc0]
call fcn.1400d9854
mov rdi, rax
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
dec ebx
test ebx, ebx
jg 0x140006098
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, rdi
mov rcx, qword [rsp + 0x340]
xor rcx, rsp
call fcn.14010bcc0
add rsp, 0x358
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret