Function at 0x1400f0b00
Capabilities:
Get file system object information

Disassembly:
mov word [rsp + 8], cx
sub rsp, 0x398
mov byte [rsp + 0x30], 0x93
movzx eax, word [rsp + 0x3a0]
mov word [rsp + 0x34], ax
movzx eax, byte [rsp + 0x30]
add eax, 0x66
mov byte [rsp + 0x30], al
movzx eax, byte [rsp + 0x30]
cmp eax, 0x8c
jge 0x1400f0bbf
movzx eax, byte [rsp + 0x30]
mov byte [rsp + 0x50], al
cmp byte [rsp + 0x50], 0xc8
je 0x1400f0b4c
jmp 0x1400f0bb2
mov dword [rsp + 0x20], 0xe9
lea r9, [rsp + 0x30]
mov r8d, 0x8e
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x70]
call sub.WINSPOOL.DRV_SetPrinterDataW
mov dword [rsp + 0x54], eax
call fcn.1400f0810
movzx eax, byte [rsp + 0x30]
sub eax, 0xd2
mov byte [rsp + 0x30], al
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0xa6
lea r8, [rsp + 0x70]
mov edx, 0xc6
mov rcx, qword [rsp + 0x90]
call sub.WINSPOOL.DRV_GetPrinterW
mov dword [rsp + 0x5c], eax
jmp 0x1400f0bbf
movzx eax, word [rsp + 0x34]
mov word [rsp + 0x3a0], ax
movsx eax, word [rsp + 0x34]
and eax, 0x299c
movsx ecx, word [rsp + 0x3a0]
cmp eax, ecx
jne 0x1400f0d2d
mov dword [rsp + 0x3c], 0x6a9e73bd
mov byte [rsp + 0x38], 0x3d
lea rax, [rsp + 0x30]
mov qword [rsp + 0x78], rax
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x40], eax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x88], rax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x48], rax
movsx eax, word [rsp + 0x3a0]
movsx ecx, word [rsp + 0x34]
sar eax, cl
mov rcx, qword [rsp + 0x48]
movsx ecx, word [rcx]
cmp eax, ecx
jg 0x1400f0c4d
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x98], rax
movzx eax, byte [rsp + 0x30]
mov byte [rsp + 0x39], al
lea rax, [rsp + 0x34]
mov qword [rsp + 0xa0], rax
mov dword [rsp + 0x20], 0xff
mov r9d, 0xb5
lea r8, [rsp + 0xd0]
mov edx, SHGetNewLinkInfoW
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov dword [rsp + 0x58], eax
movsx eax, byte [rsp + 0x38]
add eax, 0x63
mov byte [rsp + 0x38], al
mov rax, qword [rsp + 0x48]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x3a0]
sub eax, ecx
movsx ecx, word [rsp + 0x34]
cmp eax, ecx
jne 0x1400f0d2b
movzx eax, byte [rsp + 0x30]
and eax, 0x1f
mov rcx, qword [rsp + 0x78]
mov byte [rcx], al
mov r8, qword [rsp + 0x80]
mov rdx, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.SHELL32.dll_FindExecutableW]
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0x48]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x34]
sub eax, ecx
mov rcx, qword [rsp + 0x48]
mov word [rcx], ax
lea rdx, [rsp + 0x3c]
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.SHELL32.dll_DragQueryPoint]
mov dword [rsp + 0x68], eax
mov rax, qword [rsp + 0x48]
movzx eax, word [rax]
mov word [rsp + 0x3a0], ax
mov eax, dword [rsp + 0x58]
mov ecx, dword [rsp + 0x40]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x88]
mov dword [rcx], eax
jmp 0x1400f0d74
movsx eax, word [rsp + 0x3a0]
or eax, 0x42b4
mov word [rsp + 0x34], ax
mov r9d, 0x82
mov r8, qword [rsp + 0xc0]
lea rdx, [rsp + 0x5c]
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.SHELL32.dll_SHPathPrepareForWriteW]
mov dword [rsp + 0x6c], eax
movsx eax, word [rsp + 0x3a0]
shl eax, 2
mov word [rsp + 0x34], ax
movzx ecx, word [rsp + 0x3a0]
call fcn.1400efbc0
mov eax, 8
add rsp, 0x398
ret