Function at 0x140017680
Capabilities:
Get common file path
Get file system object information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x2b0
cmp dword [rcx + 0x220], 0
mov rbp, rcx
je 0x1400177aa
cmp dword [rcx + 0x25c], 0
je 0x140017727
lea rcx, [rsp + 0x148]
xor edx, edx
mov r8d, 0x160
mov qword [rsp + 0x140], 0
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0x104
mov byte [rsp + 0x30], 0
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea r8, [rsp + 0x140]
lea rcx, [rsp + 0x30]
mov r9d, 0x168
xor edx, edx
mov dword [rsp + 0x20], 0x4001
call qword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov qword [rbp + 0x208], rax
mov r9, rax
jmp 0x140017792
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov edx, 0x5a
mov rcx, rax
mov rbx, rax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov rdx, rbx
xor ecx, ecx
mov edi, eax
call qword [sym.imp.USER32.dll_ReleaseDC]
mov eax, 0xaaaaaaab
mov r9d, 1
shl edi, 4
mov dword [rsp + 0x20], 1
lea r8d, [r9 + 0x18]
mul edi
mov ecx, edx
shr ecx, 6
mov edx, ecx
call qword [sym.imp.COMCTL32.dll_ImageList_Create]
mov edx, 1
mov rcx, rax
mov qword [rbp + 0x208], rax
call qword [sym.imp.COMCTL32.dll_ImageList_SetImageCount]
mov r9, qword [rbp + 0x208]
mov rcx, qword [rbp + 0x1f8]
mov r8d, 1
mov edx, 0x1003
call qword [sym.imp.USER32.dll_SendMessageA]
cmp dword [rbp + 0x224], 0
je 0x140017837
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov edx, 0x5a
mov rcx, rax
mov rbx, rax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov rdx, rbx
xor ecx, ecx
mov edi, eax
call qword [sym.imp.USER32.dll_ReleaseDC]
mov eax, 0xaaaaaaab
mov r9d, 1
shl edi, 5
mov dword [rsp + 0x20], 1
lea r8d, [r9 + 0x18]
mul edi
mov ecx, edx
shr ecx, 6
mov edx, ecx
call qword [sym.imp.COMCTL32.dll_ImageList_Create]
mov edx, 1
mov rcx, rax
mov qword [rbp + 0x210], rax
call qword [sym.imp.COMCTL32.dll_ImageList_SetImageCount]
mov r9, qword [rbp + 0x210]
mov rcx, qword [rbp + 0x1f8]
xor r8d, r8d
mov edx, 0x1003
call qword [sym.imp.USER32.dll_SendMessageA]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov edx, 0x5a
mov rcx, rax
mov rbx, rax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov rdx, rbx
xor ecx, ecx
mov edi, eax
call qword [sym.imp.USER32.dll_ReleaseDC]
mov eax, 0xaaaaaaab
mov r9d, 1
shl edi, 4
mov dword [rsp + 0x20], 1
lea r8d, [r9 + 0x18]
mul edi
mov ebx, edx
shr ebx, 6
mov edx, ebx
mov ecx, ebx
call qword [sym.imp.COMCTL32.dll_ImageList_Create]
xor ecx, ecx
mov qword [rbp + 0x200], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r9d, ebx
xor r8d, r8d
mov edx, 0x85
mov rcx, rax
mov dword [rsp + 0x28], 0x1000
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.dll_LoadImageA]
xor ecx, ecx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r9d, ebx
xor r8d, r8d
mov edx, 0x86
mov rcx, rax
mov dword [rsp + 0x28], 0x1000
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.dll_LoadImageA]
mov rcx, qword [rbp + 0x200]
xor edx, edx
mov rdi, rax
call qword [sym.imp.COMCTL32.dll_ImageList_SetImageCount]
mov ecx, InitCommonControls
call qword [sym.imp.USER32.dll_GetSysColor]
mov rcx, qword [rbp + 0x200]
mov rdx, rsi
mov r8d, eax
mov ebx, eax
call qword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
mov rcx, qword [rbp + 0x200]
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
mov rcx, rsi
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, rdi
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rbp + 0x1f8]
mov rbx, qword [rbp + 0x200]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x101f
call qword [sym.imp.USER32.dll_SendMessageA]
mov r9, rbx
xor r8d, r8d
mov rcx, rax
mov edx, 0x1208
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
jmp qword [sym.imp.USER32.dll_SendMessageA]