Function at 0x140092380
Capabilities:
Get file system object information
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rdi
push r14
sub rsp, 0x6f0
mov rbx, r8
lea rcx, [rsp + 0x430]
mov rdi, rdx
mov r8d, 0x2b8
xor edx, edx
mov r14, r9
call fcn.14014d290
test rdi, rdi
je 0x140092646
test rbx, rbx
je 0x140092646
test r14, r14
je 0x140092646
mov qword [rsp + 0x728], r15
lea r8, [rsp + 0x430]
xor r15d, r15d
mov qword [rsp + 0x720], rsi
mov word [rbx], r15w
mov r9d, 0x2b8
xor edx, edx
mov dword [r14], 0xffffffff
mov rcx, rdi
mov dword [rsp + 0x20], 0x1000
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea rcx, [rsp + 0x440]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x14009249d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
dec eax
movsxd rcx, eax
shr rcx, 1
je 0x14009248e
cmp rcx, 0x7fffffff
jbe 0x14009244d
mov eax, dword [rsp + 0x438]
mov word [rbx], r15w
mov dword [r14], eax
jmp 0x140092636
mov esi, 0x7ffffffe
lea rdx, [rsp + 0x440]
sub rsi, rcx
sub rdx, rbx
lea rax, [rsi + rcx]
test rax, rax
je 0x14009247f
movzx eax, word [rdx + rbx]
test ax, ax
je 0x14009247f
mov word [rbx], ax
add rbx, 2
sub rcx, 1
jne 0x140092460
test rcx, rcx
lea rax, [rbx - 2]
cmovne rax, rbx
mov word [rax], r15w
mov eax, dword [rsp + 0x438]
mov dword [r14], eax
jmp 0x140092636
mov rcx, rdi
mov qword [rsp + 0x718], rbp
mov dword [rsp + 0x710], 0x200
call qword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
lea r9, [rsp + 0x710]
mov rcx, 0xffffffff80000000
mov rdx, rax
lea r8, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov r8d, 0x100
lea rax, [rsp + 0x30]
mov ecx, r8d
cmp word [rax], r15w
je 0x1400924f4
add rax, 2
sub rcx, 1
jne 0x1400924e4
mov rax, r8
mov esi, 0x7ffffffe
sub rax, rcx
test rcx, rcx
cmove rax, r15
je 0x140092550
lea rdx, [rsp + 0x30]
lea rdx, [rdx + rax*2]
sub r8, rax
je 0x140092541
lea r9, str.DefaultIcon
mov eax, esi
sub r9, rdx
test rax, rax
je 0x140092541
movzx ecx, word [r9 + rdx]
test cx, cx
je 0x140092541
mov word [rdx], cx
dec rax
add rdx, 2
sub r8, 1
jne 0x140092522
test r8, r8
lea rax, [rdx - 2]
cmovne rax, rdx
mov word [rax], r15w
lea r9, [rsp + 0x710]
mov dword [rsp + 0x710], 0x104
lea r8, [rsp + 0x230]
mov rcx, 0xffffffff80000000
lea rdx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea rdx, [0x1401b839c]
lea rcx, [rsp + 0x230]
call fcn.1400308bc
mov rbp, rax
test rax, rax
je 0x14009262e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, 1
lea rcx, [rsp + 0x230]
sub edi, eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, edi
mov rcx, rbx
movsxd rdi, eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
shr rcx, 1
lea rax, [rcx - 1]
cmp rax, rsi
ja 0x140092622
shr rdi, 1
cmp rdi, rsi
jbe 0x1400925e6
mov word [rbx], r15w
jmp 0x140092622
sub rdi, rcx
lea rdx, [rsp + 0x230]
sub rdx, rbx
lea rax, [rdi + rcx]
test rax, rax
je 0x140092613
movzx eax, word [rdx + rbx]
test ax, ax
je 0x140092613
mov word [rbx], ax
add rbx, 2
sub rcx, 1
jne 0x1400925f4
test rcx, rcx
lea rax, [rbx - 2]
cmovne rax, rbx
mov word [rax], r15w
lea rcx, [rbp + 2]
call fcn.14003df88
mov dword [r14], eax
mov rbp, qword [rsp + 0x718]
mov rsi, qword [rsp + 0x720]
mov r15, qword [rsp + 0x728]
add rsp, 0x6f0
pop r14
pop rdi
pop rbx
ret