Function at 0x140005b50
Capabilities:
Check os version
Get common file path
Get file system object information

Disassembly:
mov rax, rsp
sub rsp, 0x398
mov qword [rsp + 0xb0], 0xfffffffffffffffe
mov qword [rax - 8], rbx
mov qword [rax - 0x10], rbp
mov qword [rax - 0x18], rsi
mov qword [rax - 0x20], rdi
mov qword [rax - 0x28], r12
mov qword [rax - 0x30], r13
mov qword [rax - 0x38], r14
mov qword [rax - 0x40], r15
mov rax, qword [0x140028ee0]
mov qword [rsp + 0x340], rax
mov r15, rdx
mov rdi, rcx
mov rbp, qword [rsp + 0x3c0]
mov rsi, qword [rsp + 0x3c8]
mov rbx, qword [rsp + 0x3d0]
mov qword [rcx + 0x120], r8
mov dword [rcx + 0x128], r9d
add rcx, 0x38
mov dword [rcx], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x14000680a
mov qword [rdi + 8], r15
call fcn.14000b310
xor r13d, r13d
test rbp, rbp
je 0x140005c69
cmp qword [rdi + 0x10], r13
jne 0x140005bf8
mov rax, qword [rdi + 8]
mov qword [rdi + 0x10], rax
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8d, [r9 + 1]
mov rdx, rbp
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.USER32.dll_LoadImageA]
mov qword [rdi + 0x108], rax
test rax, rax
je 0x14000680c
cmp qword [rdi + 0x10], r13
jne 0x140005c34
mov rax, qword [rdi + 8]
mov qword [rdi + 0x10], rax
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], InitCommonControls
mov r9d, InitCommonControls
lea r8d, [r9 - 0xf]
mov rdx, rbp
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.USER32.dll_LoadImageA]
mov qword [rdi + 0x110], rax
test rax, rax
jne 0x140005c84
jmp 0x14000680c
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadIconA]
mov qword [rdi + 0x110], rax
mov qword [rdi + 0x108], rax
mov dword [rdi + 4], r13d
mov dword [rdi], r13d
lea rcx, str.comctl32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x140005ce8
lea rdx, str.DllGetVersion
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140005ce8
xor ecx, ecx
mov dword [rsp + 0x48], ecx
mov dword [rsp + 0x4c], ecx
mov dword [rsp + 0x50], ecx
mov dword [rsp + 0x54], ecx
mov dword [rsp + 0x58], ecx
mov dword [rsp + 0x48], 0x14
lea rcx, [rsp + 0x48]
call rax
test eax, eax
js 0x140005ce8
mov eax, dword [rsp + 0x4c]
mov dword [rdi], eax
mov eax, dword [rsp + 0x50]
mov dword [rdi + 4], eax
test rsi, rsi
je 0x140005d1f
mov rax, rsi
shr rax, 0x10
test ax, ax
jne 0x140005d10
lea rcx, [rdi + 0xd0]
mov edx, esi
call fcn.140003d70
test eax, eax
jne 0x140005d1f
jmp 0x14000680c
lea rcx, [rdi + 0xd0]
mov rdx, rsi
call fcn.140003f30
mov edx, 0x104
lea rcx, [rsp + 0x230]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov dword [rsp + 0x20], 0x4001
mov r9d, 0x168
lea r8, [rsp + 0xc0]
xor edx, edx
lea rcx, [rsp + 0x230]
call qword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov qword [rdi + 0x18], rax
test rax, rax
je 0x14000680c
mov rcx, qword [0x14002a9c8]
test rcx, rcx
jne 0x140005db8
lea rcx, [0x140004820]
call fcn.14000e778
mov ecx, 0x1c0
call fcn.14000cda8
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140005d9b
mov rcx, rax
call fcn.140005490
jmp 0x140005d9e
mov rax, r13
mov qword [0x14002a9c8], rax
lea rcx, [0x1400058a0]
call fcn.14000e760
mov rcx, qword [0x14002a9c8]
lea rsi, [rdi + 0x20]
lea rax, [0x140028530]
mov qword [rsp + 0x30], rax
lea rax, [0x1400285b0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x20
mov r9d, 0x20
xor r8d, r8d
lea edx, [r9 - 0x1b]
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_CreateCursor]
mov qword [rsi], rax
mov rcx, qword [0x14002a9c8]
test rcx, rcx
jne 0x140005e49
lea rcx, [0x140004820]
call fcn.14000e778
mov ecx, 0x1c0
call fcn.14000cda8
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140005e2c
mov rcx, rax
call fcn.140005490
jmp 0x140005e2f
mov rax, r13
mov qword [0x14002a9c8], rax
lea rcx, [0x1400058a0]
call fcn.14000e760
mov rcx, qword [0x14002a9c8]
lea rax, [0x140028330]
mov qword [rsp + 0x30], rax
lea rax, [0x1400283b0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x20
mov edx, InitCommonControls
lea r9d, [rdx + 0x11]
mov r8d, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_CreateCursor]
mov qword [rdi + 0x28], rax
mov rcx, qword [0x14002a9c8]
test rcx, rcx
jne 0x140005ed6
lea rcx, [0x140004820]
call fcn.14000e778
mov ecx, 0x1c0
call fcn.14000cda8
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140005eb9
mov rcx, rax
call fcn.140005490
jmp 0x140005ebc
mov rax, r13
mov qword [0x14002a9c8], rax
lea rcx, [0x1400058a0]
call fcn.14000e760
mov rcx, qword [0x14002a9c8]
lea rax, [0x140028430]
mov qword [rsp + 0x30], rax
lea rax, [0x1400284b0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x20
mov edx, InitCommonControls
lea r9d, [rdx + 0x11]
mov r8d, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_CreateCursor]
mov qword [rdi + 0x30], rax
mov rcx, qword [0x14002a9c8]
test rcx, rcx
jne 0x140005f63
lea rcx, [0x140004820]
call fcn.14000e778
mov ecx, 0x1c0
call fcn.14000cda8
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140005f46
mov rcx, rax
call fcn.140005490
jmp 0x140005f49
mov rax, r13
mov qword [0x14002a9c8], rax
lea rcx, [0x1400058a0]
call fcn.14000e760
mov rcx, qword [0x14002a9c8]
lea rbp, [rdi + 0x160]
lea rax, [0x14002a4c0]
mov qword [rsp + 0x30], rax
lea rax, [0x140028630]
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x20], 1
mov r9b, 1
mov edx, 0x20
mov r8d, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_CreateIcon]
mov qword [rbp], rax
mov rcx, qword [0x14002a9c8]
test rcx, rcx
jne 0x140005ff3
lea rcx, [0x140004820]
call fcn.14000e778
mov ecx, 0x1c0
call fcn.14000cda8
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140005fd6
mov rcx, rax
call fcn.140005490
jmp 0x140005fd9
mov rax, r13
mov qword [0x14002a9c8], rax
lea rcx, [0x1400058a0]
call fcn.14000e760
mov rcx, qword [0x14002a9c8]
lea rax, [0x14002a540]
mov qword [rsp + 0x30], rax
lea rax, [0x1400286b0]
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x20], 1
mov r9b, 1
mov edx, 0x20
mov r8d, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_CreateIcon]
mov qword [rdi + 0x168], rax
mov rcx, qword [0x14002a9c8]
test rcx, rcx
jne 0x14000607f
lea rcx, [0x140004820]
call fcn.14000e778
mov ecx, 0x1c0
call fcn.14000cda8
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140006062
mov rcx, rax
call fcn.140005490
jmp 0x140006065
mov rax, r13
mov qword [0x14002a9c8], rax
lea rcx, [0x1400058a0]
call fcn.14000e760
mov rcx, qword [0x14002a9c8]
lea rax, [0x14002a5c0]
mov qword [rsp + 0x30], rax
lea rax, [0x140028730]
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x20], 1
mov r9b, 1
mov edx, 0x20
mov r8d, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_CreateIcon]
mov qword [rdi + 0x170], rax
mov rcx, qword [0x14002a9c8]
test rcx, rcx
jne 0x14000610b
lea rcx, [0x140004820]
call fcn.14000e778
mov ecx, 0x1c0
call fcn.14000cda8
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1400060ee
mov rcx, rax
call fcn.140005490
jmp 0x1400060f1
mov rax, r13
mov qword [0x14002a9c8], rax
lea rcx, [0x1400058a0]
call fcn.14000e760
mov rcx, qword [0x14002a9c8]
lea rax, [0x14002a640]
mov qword [rsp + 0x30], rax
lea rax, [0x1400287b0]
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x20], 1
mov r9b, 1
mov edx, 0x20
mov r8d, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_CreateIcon]
mov qword [rdi + 0x178], rax
mov rcx, qword [0x14002a9c8]
test rcx, rcx
jne 0x140006197
lea rcx, [0x140004820]
call fcn.14000e778
mov ecx, 0x1c0
call fcn.14000cda8
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14000617a
mov rcx, rax
call fcn.140005490
jmp 0x14000617d
mov rax, r13
mov qword [0x14002a9c8], rax
lea rcx, [0x1400058a0]
call fcn.14000e760
mov rcx, qword [0x14002a9c8]
lea rax, [0x14002a740]
mov qword [rsp + 0x30], rax
lea rax, [0x1400288b0]
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x20], 1
mov r9b, 1
mov edx, 0x20
mov r8d, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_CreateIcon]
mov qword [rdi + 0x180], rax
mov rcx, qword [0x14002a9c8]
test rcx, rcx
jne 0x140006223
lea rcx, [0x140004820]
call fcn.14000e778
mov ecx, 0x1c0
call fcn.14000cda8
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140006206
mov rcx, rax
call fcn.140005490
jmp 0x140006209
mov rax, r13
mov qword [0x14002a9c8], rax
lea rcx, [0x1400058a0]
call fcn.14000e760
mov rcx, qword [0x14002a9c8]
lea rax, [0x14002a840]
mov qword [rsp + 0x30], rax
lea rax, [0x1400289b0]
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x20], 1
mov r9b, 1
mov edx, 0x20
mov r8d, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_CreateIcon]
mov qword [rdi + 0x188], rax
mov rcx, qword [0x14002a9c8]
test rcx, rcx
jne 0x1400062af
lea rcx, [0x140004820]
call fcn.14000e778
mov ecx, 0x1c0
call fcn.14000cda8
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140006292
mov rcx, rax
call fcn.140005490
jmp 0x140006295
mov rax, r13
mov qword [0x14002a9c8], rax
lea rcx, [0x1400058a0]
call fcn.14000e760
mov rcx, qword [0x14002a9c8]
lea rax, [0x14002a6c0]
mov qword [rsp + 0x30], rax
lea rax, [0x140028830]
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x20], 1
mov r9b, 1
mov edx, 0x20
mov r8d, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_CreateIcon]
mov qword [rdi + 0x190], rax
mov rcx, qword [0x14002a9c8]
test rcx, rcx
jne 0x14000633b
lea rcx, [0x140004820]
call fcn.14000e778
mov ecx, 0x1c0
call fcn.14000cda8
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14000631e
mov rcx, rax
call fcn.140005490
jmp 0x140006321
mov rax, r13
mov qword [0x14002a9c8], rax
lea rcx, [0x1400058a0]
call fcn.14000e760
mov rcx, qword [0x14002a9c8]
lea rax, [0x14002a7c0]
mov qword [rsp + 0x30], rax
lea rax, [0x140028930]
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x20], 1
mov r9b, 1
mov edx, 0x20
mov r8d, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_CreateIcon]
mov qword [rdi + 0x198], rax
mov rcx, qword [0x14002a9c8]
test rcx, rcx
jne 0x1400063c7
lea rcx, [0x140004820]
call fcn.14000e778
mov ecx, 0x1c0
call fcn.14000cda8
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1400063aa
mov rcx, rax
call fcn.140005490
jmp 0x1400063ad
mov rax, r13
mov qword [0x14002a9c8], rax
lea rcx, [0x1400058a0]
call fcn.14000e760
mov rcx, qword [0x14002a9c8]
lea rax, [0x14002a8c0]
mov qword [rsp + 0x30], rax
lea rax, [0x140028a30]
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x20], 1
mov r9b, 1
mov edx, 0x20
mov r8d, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_CreateIcon]
mov qword [rdi + 0x1a0], rax
mov rcx, qword [0x14002a9c8]
test rcx, rcx
jne 0x140006453
lea rcx, [0x140004820]
call fcn.14000e778
mov ecx, 0x1c0
call fcn.14000cda8
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140006436
mov rcx, rax
call fcn.140005490
jmp 0x140006439
mov rax, r13
mov qword [0x14002a9c8], rax
lea rcx, [0x1400058a0]
call fcn.14000e760
mov rcx, qword [0x14002a9c8]
lea rax, [0x14002a940]
mov qword [rsp + 0x30], rax
lea rax, [0x140028ab0]
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x20], 1
mov r9b, 1
mov edx, 0x20
mov r8d, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_CreateIcon]
mov qword [rdi + 0x1a8], rax
mov rax, r13
nop
cmp qword [rsi], 0
je 0x140006806
inc rax
add rsi, 8
cmp rax, 3
jl 0x140006490
mov rdx, r13
mov rax, rbp
nop
cmp qword [rax], 0
je 0x140006806
inc rdx
add rax, 8
cmp rdx, 0xa
jl 0x1400064b0
mov dword [rsp + 0x20], r13d
mov edx, InitCommonControls
mov ecx, edx
lea r9d, [rdx - 6]
lea r8d, [rdx - 0xf]
call qword [sym.imp.COMCTL32.dll_ImageList_Create]
mov qword [rdi + 0x1b0], rax
test rax, rax
je 0x14000680c
mov rsi, r13
nop
nop
nop
mov r8, qword [rbp]
mov edx, 0xffffffff
mov rcx, qword [rdi + 0x1b0]
call qword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
test eax, eax
js 0x140006529
inc rsi
add rbp, 8
cmp rsi, 0xa
jl 0x140006500
jmp 0x140006530
xor eax, eax
jmp 0x14000680c
mov dword [rsp + 0x60], 0x50
mov dword [rsp + 0x70], r13d
mov dword [rsp + 0x74], r13d
mov qword [rsp + 0x98], r13
mov ecx, 5
call qword [sym.imp.USER32.dll_GetSysColorBrush]
mov qword [rsp + 0x90], rax
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorA]
mov qword [rsp + 0x88], rax
mov rax, qword [rdi + 0x108]
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x78], r15
lea r12, [0x140006ed0]
mov qword [rsp + 0x68], r12
lea rsi, str.CWindowClass
mov qword [rsp + 0xa0], rsi
mov dword [rsp + 0x64], InitCommonControls
lea rcx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_RegisterClassExA]
test ax, ax
jne 0x1400065c8
xor eax, eax
jmp 0x14000680c
lea rbp, str.CMDIChildClass
mov qword [rsp + 0xa0], rbp
lea rax, [0x14000bc90]
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_RegisterClassExA]
test ax, ax
jne 0x140006606
mov rdx, r15
mov rcx, rsi
call qword [sym.imp.USER32.dll_UnregisterClassA]
xor eax, eax
jmp 0x14000680c
lea rax, str.CDSWindowClass
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x68], r12
bts dword [rsp + 0x64], 0x11
lea rcx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_RegisterClassExA]
test ax, ax
jne 0x140006665
btr dword [rsp + 0x64], 0x11
lea rcx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_RegisterClassExA]
test ax, ax
jne 0x140006665
mov rdx, r15
mov rcx, rsi
call qword [sym.imp.USER32.dll_UnregisterClassA]
mov rdx, r15
mov rcx, rbp
call qword [sym.imp.USER32.dll_UnregisterClassA]
xor eax, eax
jmp 0x14000680c
mov dword [rdi + 0x118], 1
test rbx, rbx
je 0x14000674f
mov esi, r13d
mov r14d, dword [rsp + 0x3d8]
test r14d, r14d
jle 0x14000674f
nop
mov qword [rbx + 0x18], r15
cmp qword [rbx + 8], 0
jne 0x14000669f
mov qword [rbx + 8], r12
cmp qword [rbx + 0x20], 0
jne 0x1400066b1
mov rax, qword [rdi + 0x108]
mov qword [rbx + 0x20], rax
cmp qword [rbx + 0x48], 0
jne 0x1400066c3
mov rax, qword [rdi + 0x108]
mov qword [rbx + 0x48], rax
mov rcx, rbx
call qword [sym.imp.USER32.dll_RegisterClassExA]
test ax, ax
je 0x140006748
mov r8d, 0xffffffff
mov rdx, qword [rbx + 0x40]
lea rcx, [rsp + 0x48]
call fcn.140004300
nop
movsxd r12, dword [rdi + 0x138]
lea edx, [r12 + 1]
mov r9d, 1
lea r8d, [r9 - 2]
lea rcx, [rdi + 0x130]
call fcn.140004ff0
test eax, eax
je 0x140006726
lea rcx, [r12 + r12*2]
mov rax, qword [rdi + 0x148]
lea rcx, [rax + rcx*8]
lea rdx, [rsp + 0x48]
call fcn.1400037a0
nop
lea rcx, [rsp + 0x48]
call fcn.1400034d0
inc esi
add rbx, 0x50
cmp esi, r14d
lea r12, [0x140006ed0]
jl 0x140006690
jmp 0x14000674f
xor eax, eax
jmp 0x14000680c
mov ebx, dword [rsp + 0x3e0]
test ebx, ebx
je 0x1400067bc
mov eax, dword [0x14002a9c0]
and eax, ebx
cmp eax, ebx
je 0x1400067bc
lea rcx, str.comctl32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1400067bc
lea rdx, [0x14001c808]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400067ac
mov dword [rsp + 0x40], 8
mov dword [rsp + 0x44], ebx
lea rcx, [rsp + 0x40]
call qword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
or dword [0x14002a9c0], ebx
jmp 0x1400067bc
call qword [sym.imp.COMCTL32.dll_InitCommonControls]
mov dword [0x14002a9c0], 0xffffffff
lea rax, [0x140028d38]
mov qword [rsp + 0x20], rax
mov edx, 8
mov ecx, edx
mov r9d, 1
mov r8d, r9d
call qword [sym.imp.GDI32.dll_CreateBitmap]
mov qword [rdi + 0x150], rax
test rax, rax
je 0x14000680c
mov rcx, rax
call qword [sym.imp.GDI32.dll_CreatePatternBrush]
mov qword [rdi + 0x158], rax
test rax, rax
setne r13b
mov eax, r13d
jmp 0x14000680c
xor eax, eax
jmp 0x14000680c
xor eax, eax
mov rcx, qword [rsp + 0x340]
call fcn.14000d8c0
mov rbx, qword [rsp + 0x390]
mov rbp, qword [rsp + 0x388]
mov rsi, qword [rsp + 0x380]
mov rdi, qword [rsp + 0x378]
mov r12, qword [rsp + 0x370]
mov r13, qword [rsp + 0x368]
mov r14, qword [rsp + 0x360]
mov r15, qword [rsp + 0x358]
add rsp, 0x398
ret