Function at 0x140018bcc
Capabilities:
Get common file path
Get file system object information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
mov eax, 0x19b0
call fcn.1400332d0
sub rsp, rax
mov rax, qword [0x140051040]
xor rax, rsp
mov qword [rsp + 0x19a0], rax
mov rdi, rcx
mov r12d, 0x32
mov ecx, r12d
call qword [sym.imp.USER32.dll_GetSystemMetrics]
lea ebp, [r12 - 1]
mov ecx, ebp
mov ebx, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
lea esi, [rbp - 0x10]
lea r9d, [r12 - 0x31]
mov r8d, esi
mov edx, ebx
mov ecx, eax
mov dword [rsp + 0x20], 1
call qword [0x140038098]
mov ecx, r12d
mov qword [rdi + 8], rax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, ebp
mov ebx, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
lea r9d, [r12 - 0x31]
mov r8d, esi
mov edx, ebx
mov ecx, eax
mov dword [rsp + 0x20], 1
call qword [0x140038098]
mov rcx, qword [rdi + 0x45858]
mov edx, 0x142
mov qword [rdi + 0x10], rax
call qword [sym.imp.USER32.dll_LoadIconW]
mov rcx, qword [rdi + 0x10]
or esi, 0xffffffff
mov r8, rax
mov edx, esi
mov rbx, rax
call qword [0x140038090]
test rbx, rbx
je 0x140018ca1
mov rcx, rbx
call qword [sym.imp.USER32.dll_DestroyIcon]
mov rcx, qword [rdi + 0x45858]
mov edx, 0x141
call qword [sym.imp.USER32.dll_LoadIconW]
mov rcx, qword [rdi + 0x10]
mov edx, esi
mov r8, rax
call qword [0x140038090]
mov rcx, qword [rdi + 0x45858]
mov edx, 0x19
call qword [sym.imp.USER32.dll_LoadIconW]
lea rcx, [rsp + 0x11a0]
mov edx, 0x400
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rdx, [rsp + 0x11a0]
lea rcx, [rsp + 0x9a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
xor ebx, ebx
cmp dword [0x1400b3dd4], ebx
jle 0x140018ef7
lea r12, [rsp + 0x50]
and dword [rsp + 0x590], 0
lea rcx, [rsp + 0x594]
xor edx, edx
mov r8d, 0x1fc
call fcn.140021ef0
movsxd r11, ebx
shl r11, 9
lea rsi, [r11 + rdi + 0x18]
test rsi, rsi
je 0x140018ef7
lea rcx, [rsp + 0x590]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcatW]
and qword [rsp + 0x30], 0
and qword [rsp + 0x40], 0
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x40]
lea rcx, [rsp + 0x590]
xor edx, edx
mov dword [rsp + 0x20], 1
call qword [sym.imp.SHELL32.dll_ExtractIconExW]
and dword [rsp + 0x790], 0
lea rcx, [rsp + 0x794]
xor edx, edx
mov r8d, 0x204
call fcn.140021ef0
lea rcx, [rsp + 0x790]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
cmp qword [rsp + 0x30], 0
jne 0x140018e9c
and qword [rsp + 0xd0], 0
lea rcx, [rsp + 0xd8]
xor edx, edx
mov r8d, 0x2b0
call fcn.140021ef0
and dword [rsp + 0x390], 0
lea rcx, [rsp + 0x394]
xor edx, edx
mov r8d, 0x1fc
call fcn.140021ef0
lea rdx, [rsp + 0x790]
lea rcx, [rsp + 0x390]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, str.System32_
lea rcx, [rsp + 0x390]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rsp + 0x390]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcatW]
cmp ebx, 5
jne 0x140018e5b
lea r8, [rsp + 0x38]
lea edx, [rbx - 2]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov rcx, qword [rsp + 0x38]
mov dword [rsp + 0x20], 0x4009
jmp 0x140018e6b
mov dword [rsp + 0x20], 0x4001
lea rcx, [rsp + 0x390]
lea r8, [rsp + 0xd0]
mov r9d, 0x2b8
xor edx, edx
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov edx, dword [rsp + 0xd8]
lea rcx, [0x1400b3de8]
xor r8d, r8d
call fcn.14002105c
mov qword [rsp + 0x30], rax
lea rdx, str.shell:::
mov rcx, rsi
call fcn.140022028
test rax, rax
je 0x140018ec9
mov rcx, qword [rdi + 0x45858]
mov edx, 0x19
call qword [sym.imp.USER32.dll_LoadIconW]
mov qword [rsp + 0x30], rax
jmp 0x140018ece
mov rax, qword [rsp + 0x30]
mov rcx, qword [rdi + 8]
test rax, rax
mov r8, rbp
cmovne r8, rax
or edx, 0xffffffff
call qword [0x140038090]
inc ebx
add r12, 8
cmp ebx, dword [0x1400b3dd4]
jl 0x140018d13
test rbp, rbp
je 0x140018f05
mov rcx, rbp
call qword [sym.imp.USER32.dll_DestroyIcon]
mov r9, qword [rdi + 8]
mov rcx, qword [rdi + 0x45848]
mov ebx, 0x430
mov edx, ebx
xor r8d, r8d
call qword [sym.imp.USER32.dll_SendMessageW]
mov r9, qword [rdi + 0x10]
mov rcx, qword [rdi + 0x45850]
xor r8d, r8d
mov edx, ebx
call qword [sym.imp.USER32.dll_SendMessageW]
lea rdx, [0x140038bd8]
lea rcx, [rsp + 0x9a0]
mov r8, rdx
call qword [sym.imp.USER32.dll_wsprintfW]
xor ebx, ebx
cmp dword [0x1400b3dd4], ebx
jle 0x140018f85
mov rcx, qword [rdi + 0x45848]
and dword [rsp + 0x20], 0
lea r8d, [rbx + 0x8016]
lea rdx, [rsp + 0x9a0]
mov r9d, ebx
call fcn.140014da8
inc ebx
cmp ebx, dword [0x1400b3dd4]
jl 0x140018f58
mov rcx, qword [rsp + 0x19a0]
xor rcx, rsp
call fcn.140021e20
lea r11, [rsp + 0x19b0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret