Function at 0x1400f0810
Capabilities:
Get file system object information

Disassembly:
sub rsp, 0x418
mov eax, 0x713
mov word [rsp + 0x30], ax
mov dword [rsp + 0x3c], 0x91eb8286
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0x54], eax
cmp dword [rsp + 0x54], 0x91eb8286
je 0x1400f0847
cmp dword [rsp + 0x54], 0xdf03d8f7
je 0x1400f087e
jmp 0x1400f0884
movzx eax, word [rsp + 0x30]
add eax, 0x8e8
mov word [rsp + 0x30], ax
mov eax, 0x7077
mov word [rsp + 0x38], ax
movzx eax, word [rsp + 0x38]
mov word [rsp + 0x34], ax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0x4c], eax
jmp 0x1400f0884
call fcn.1400f0da0
nop
movsx eax, word [rsp + 0x38]
mov dword [rsp + 0x58], eax
cmp dword [rsp + 0x58], 0x6bac
je 0x1400f09d7
cmp dword [rsp + 0x58], 0x7077
je 0x1400f08aa
jmp 0x1400f0a5f
mov dword [rsp + 0x48], 0x720c5e1c
mov eax, dword [rsp + 0x4c]
mov ecx, dword [rsp + 0x50]
add ecx, eax
mov eax, ecx
cmp eax, dword [rsp + 0x3c]
ja 0x1400f0958
mov eax, dword [rsp + 0x4c]
mov ecx, dword [rsp + 0x50]
sub ecx, eax
mov eax, ecx
cmp eax, dword [rsp + 0x3c]
jb 0x1400f0956
mov qword [rsp + 0x20], 0x66
mov rax, qword [rsp + 0x40]
movzx r9d, word [rax]
mov rax, qword [rsp + 0x40]
movzx r8d, word [rax]
mov edx, dword [rsp + 0x48]
mov cl, 0xdd
call fcn.1400ef670
mov eax, dword [rsp + 0x48]
add eax, 0x458b7286
mov dword [rsp + 0x48], eax
mov rax, qword [rsp + 0x40]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x30]
sub eax, ecx
mov rcx, qword [rsp + 0x40]
mov word [rcx], ax
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x150]
call qword [sym.imp.SHELL32.dll_SHIsFileAvailableOffline]
mov dword [rsp + 0x68], eax
movzx eax, word [rsp + 0x30]
add eax, 0x74
mov rcx, qword [rsp + 0x40]
mov word [rcx], ax
movzx ecx, word [rsp + 0x34]
call fcn.1400efbc0
nop
jmp 0x1400f09a6
mov rax, qword [rsp + 0x40]
movzx eax, word [rax]
xor eax, 0xcd3
mov word [rsp + 0x30], ax
lea r8, [rsp + 0x90]
mov edx, 0x23
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.GDI32.dll_GetEnhMetaFileDescriptionW]
mov dword [rsp + 0x3c], eax
mov rax, qword [rsp + 0x40]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x30]
or eax, ecx
mov rcx, qword [rsp + 0x40]
mov word [rcx], ax
call fcn.1400f0da0
nop
lea r8, [rsp + 0x5c]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x40]
call qword [sym.imp.GDI32.dll_CombineTransform]
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x4c]
mov dword [rsp + 0x50], eax
movzx ecx, word [rsp + 0x34]
call fcn.1400efbc0
nop
jmp 0x1400f0a5f
mov edx, 0xad
mov rcx, qword [rsp + 0x88]
call sub.SHELL32.dll_SHTestTokenMembership
mov dword [rsp + 0x5c], eax
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0x8c0a0749
je 0x1400f0a01
jmp 0x1400f0a03
jmp 0x1400f0a2e
lea rax, [rsp + 0x150]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x78]
mov edx, 0xa4
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_PathMakeUniqueName]
mov dword [rsp + 0x70], eax
movzx eax, word [rsp + 0x30]
shl eax, 8
mov rcx, qword [rsp + 0x40]
mov word [rcx], ax
movsx eax, word [rsp + 0x38]
or eax, 0x6817
mov word [rsp + 0x34], ax
movzx eax, word [rsp + 0x30]
sub eax, 0xcbb
mov rcx, qword [rsp + 0x40]
mov word [rcx], ax
movzx eax, word [rsp + 0x30]
sub eax, 0x232
mov rcx, qword [rsp + 0x40]
mov word [rcx], ax
mov eax, dword [rsp + 0x4c]
mov dword [rsp + 0x64], eax
cmp dword [rsp + 0x64], 0xef4657f5
je 0x1400f0a85
jmp 0x1400f0a87
jmp 0x1400f0a8d
call fcn.1400f0da0
nop
mov eax, dword [rsp + 0x3c]
and eax, 0x9cf0c377
mov dword [rsp + 0x4c], eax
mov dword [rsp + 0x20], 0xf7
mov r9d, 0xdb
lea r8, [rsp + 0x150]
mov edx, reloc.SHELL32.dll_PathYetAnotherMakeUniqueName
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov dword [rsp + 0x50], eax
movzx eax, word [rsp + 0x30]
xor eax, 0xec8
mov rcx, qword [rsp + 0x40]
mov word [rcx], ax
movsx eax, word [rsp + 0x34]
sar eax, 0xf
mov word [rsp + 0x38], ax
mov eax, 0x6e
add rsp, 0x418
ret