Function at 0x140003bb0
Capabilities:
Get file system object information

Disassembly:
push rbp
push rdi
push r12
push r14
push r15
sub rsp, 0x3f0
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x10], 0xfffffffffffffffe
mov qword [rbp + 0x3f8], rbx
mov qword [rbp + 0x400], rsi
mov rax, qword [0x14002a520]
xor rax, rbp
mov qword [rbp + 0x3b0], rax
mov rdi, rcx
xor ebx, ebx
mov qword [rbp], rbx
mov rsi, qword [0x14002c028]
mov r8d, 0x104
lea rdx, [rbp + 0x2a0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x140003c21
call fcn.140004700
nop
jmp 0x140003eda
cmp eax, 0x104
jne 0x140003c32
mov eax, 0x8007007a
jmp 0x140003eda
or r12, 0xffffffffffffffff
test rsi, rsi
je 0x140003c54
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp rsi, rax
je 0x140003c54
lea r8, [rbp + 0x2a0]
jmp 0x140003ced
mov byte [rbp + 0x190], 0x22
lea r8, [rbp + 0x2a0]
mov edx, 0x105
lea rcx, [rbp + 0x191]
call qword [sym.imp.MSVCR120.dll_strcpy_s]
test eax, eax
je 0x140003cad
cmp eax, 0xc
je 0x140003ca2
cmp eax, 0x16
je 0x140003c97
cmp eax, 0x22
je 0x140003c97
cmp eax, 0x50
je 0x140003cad
mov ecx, 0x80004005
call fcn.140004920
int3
mov ecx, 0x80070057
call fcn.140004920
int3
mov ecx, 0x8007000e
call fcn.140004920
int3
lea rax, [rbp + 0x190]
mov rcx, r12
inc rcx
cmp byte [rax + rcx], 0
jne 0x140003cb7
movsxd rax, ecx
mov byte [rbp + rax + 0x190], 0x22
lea eax, [rcx + 1]
movsxd rcx, eax
cmp rcx, 0x106
jae 0x140003ed2
mov byte [rbp + rcx + 0x190], 0
lea r8, [rbp + 0x190]
mov rax, qword [rdi]
lea rdx, [0x14001eb88]
mov rcx, rdi
call qword [rax + 0x28]
test eax, eax
js 0x140003c1c
mov rax, qword [rdi]
lea r8, [rbp + 0x2a0]
lea rdx, [0x14001eb90]
mov rcx, rdi
call qword [rax + 0x28]
test eax, eax
js 0x140003c1c
lea rdx, [rbp + 8]
lea rcx, [0x14002bc78]
call qword [sym.imp.ole32.dll_StringFromCLSID]
test eax, eax
js 0x140003c1c
mov rsi, qword [rbp + 8]
test rsi, rsi
jne 0x140003d4e
mov rax, rbx
jmp 0x140003dfe
mov rax, r12
inc rax
cmp word [rsi + rax*2], 0
jne 0x140003d51
inc eax
movsxd r14, eax
add r14, r14
mov eax, 0x80000000
add rax, r14
mov ecx, 0xffffffff
cmp rax, rcx
jbe 0x140003d7d
mov rax, rbx
jmp 0x140003dfe
cmp r14d, 0x400
jg 0x140003dbb
movsxd r15, r14d
mov rcx, r15
call fcn.14000daf0
test al, al
je 0x140003dbb
lea rax, [r15 + 0xf]
cmp rax, r15
ja 0x140003da8
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.140019e10
sub rsp, rax
lea rcx, [rsp + 0x30]
jmp 0x140003ded
movsxd rcx, r14d
sub r12, rcx
cmp r12, 0x10
jb 0x140003ec7
add rcx, 0x10
call qword [sym.imp.MSVCR120.dll_malloc]
test rax, rax
jne 0x140003ddf
mov rcx, rbx
jmp 0x140003ded
mov qword [rax], rbx
mov rbx, rax
mov qword [rbp], rax
lea rcx, [rax + 0x10]
mov r9d, 3
mov r8d, r14d
mov rdx, rsi
call fcn.140004960
mov r9, qword [rdi]
mov r8, rax
lea rdx, str.MODULEGUID
mov rcx, rdi
call qword [r9 + 0x28]
mov esi, eax
mov rcx, qword [rbp + 8]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test esi, esi
jns 0x140003e4a
test rbx, rbx
je 0x140003ed8
nop dword [rax + rax]
mov rcx, rbx
mov rbx, qword [rbx]
mov qword [rbp], rbx
call qword [sym.imp.MSVCR120.dll_free]
test rbx, rbx
jne 0x140003e30
jmp 0x140003ed8
mov dword [rsp + 0x20], 0x2000
mov r9d, 0x168
lea r8, [rbp + 0x20]
xor edx, edx
lea rcx, [rbp + 0x2a0]
call qword [sym.imp.SHELL32.dll_SHGetFileInfoA]
lea rdx, str.MODULETYPE
mov rcx, rdi
test rax, rax
mov rax, qword [rdi]
lea r8, str.InprocServer32
je 0x140003e8b
lea r8, str.LocalServer32
call qword [rax + 0x28]
mov esi, eax
test eax, eax
js 0x140003ea6
mov rcx, qword [0x14002bc70]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + 0x28]
mov esi, eax
test rbx, rbx
je 0x140003ed8
nop dword [rax + rax]
mov rcx, rbx
mov rbx, qword [rbx]
mov qword [rbp], rbx
call qword [sym.imp.MSVCR120.dll_free]
test rbx, rbx
jne 0x140003eb0
jmp 0x140003ed8
mov ecx, 0x80070216
call fcn.140004920
int3
call fcn.140019b48
nop
mov eax, esi
mov rcx, qword [rbp + 0x3b0]
xor rcx, rbp
call fcn.140019e70
mov rbx, qword [rbp + 0x3f8]
mov rsi, qword [rbp + 0x400]
lea rsp, [rbp + 0x3c0]
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret