Function at 0x1400427bc
Capabilities:
Get file system object information

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x5ba0]
mov eax, 0x5ca0
call fcn.1400eeb60
sub rsp, rax
mov qword [rbp], 0xfffffffffffffffe
mov qword [rsp + 0x5cf0], rbx
mov rax, qword [0x14013f2b0]
xor rax, rsp
mov qword [rbp + 0x5b98], rax
mov r12, rdx
mov qword [rbp - 0x68], rdx
mov rdi, rcx
mov r15d, 1
add dword [0x140145ca0], r15d
mov r9d, r15d
or r8, 0xffffffffffffffff
mov edx, 0x100c
mov rcx, qword [rcx + 0x60]
call qword [sym.imp.USER32.dll_SendMessageW]
mov r13, rax
mov qword [rbp - 0x60], rax
mov edx, r15d
lea rcx, [0x14016bce0]
call fcn.1400a8158
mov ecx, 0x1c4
call fcn.140088044
mov rdx, rax
xor r8d, r8d
lea rcx, [0x14016bce0]
call fcn.1400a8080
xor r9d, r9d
xor r8d, r8d
lea edx, [r15 + 0xa]
mov rcx, qword [rdi + 0x60]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, rdi
call fcn.14003fcb0
mov dword [rsp + 0x20], 0x4011
mov r9d, 0x2b8
lea r8, [rbp + 0x1610]
xor edx, edx
lea rcx, [0x1401134d8]
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov r9, rax
mov r8d, r15d
mov edx, 0x1003
mov rcx, qword [rdi + 0x60]
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, [0x14016bcd0]
call fcn.140002408
lea rdx, [rbp + 0x1150]
lea rcx, [0x140169340]
call fcn.1400053f4
lea edx, [r15 + 3]
xor r14d, r14d
cmp byte [rbp + 0x11d0], r14b
je 0x14004290a
cmp byte [rbp + 0x1348], r14b
je 0x14004290a
cmp byte [rbp + 0x1293], r14b
jne 0x14004290a
mov ecx, dword [rbp + 0x1328]
lea eax, [rcx - 2]
cmp eax, r15d
cmovbe ecx, edx
mov dword [rbp + 0x1328], ecx
jmp 0x140042910
mov ecx, dword [rbp + 0x1328]
mov dword [rbp + 0x20], edx
mov edx, 0x73
sub ecx, 1
je 0x140042933
sub ecx, 2
je 0x14004292c
cmp ecx, 1
jne 0x140042938
lea edx, [rcx + 0x75]
jmp 0x140042938
mov edx, 0x75
jmp 0x140042938
mov edx, 0x74
mov ecx, edx
call fcn.140088044
mov qword [rbp + 0x30], rax
lea r9, [rbp + 0x20]
mov esi, 5
mov r8d, esi
mov edx, 0x1060
mov rcx, qword [rdi + 0x60]
call qword [sym.imp.USER32.dll_SendMessageW]
mov ebx, 0x800
mov r8d, ebx
lea rdx, [rbp + 0x4b90]
lea rcx, [0x140169340]
call fcn.140005000
mov r8d, ebx
lea rdx, [rbp + 0x2b90]
lea rcx, [0x140169340]
call fcn.1400053d4
xor r9d, r9d
lea r8, [rbp + 0x4b90]
lea rdx, [rbp + 0x2b90]
mov rcx, rdi
call fcn.140037154
lea rdx, [rbp + 0x2b90]
mov rcx, rdi
call fcn.14003f554
lea rax, [rbp + 0x2b90]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], r14w
jne 0x1400429c2
test rbx, rbx
je 0x1400429d4
add rbx, r15
lea rdx, [rbp + 0x2b90]
lea rcx, [0x1401526e8]
call fcn.1400adab8
mov r15d, r14d
xor r8d, r8d
lea rdx, str.FlatView
lea rcx, str.FileList
call fcn.14009f660
test eax, eax
setne r14b
xor r8d, r8d
lea rdx, str.ShowSeconds
lea rcx, str.FileList
call fcn.14009f660
xor ecx, ecx
test eax, eax
setne byte [rsp + 0x30]
mov qword [rbp + 0x10e0], rcx
mov qword [rbp + 0x10e8], rcx
mov qword [rbp + 0x10f0], rcx
mov word [rbp + 0x3b90], cx
mov edx, 0x1f4
lea rcx, [rbp + 8]
call fcn.1400c47ac
nop
mov r8b, r14b
lea rdx, [rbp + 0x50]
lea rcx, [0x140169340]
call fcn.140005450
xor r9d, r9d
test al, al
je 0x140042f7e
lea r13, [rbp + 0x50]
lea r13, [r13 + rbx*2]
mov r12b, byte [rsp + 0x30]
test r15b, 0x1f
jne 0x140042a8e
lea rcx, [rbp + 8]
call fcn.1400c5dd8
xor r9d, r9d
mov rbx, r13
mov esi, dword [rbp + 0x10f8]
shr esi, 4
and sil, 1
test r14b, r14b
je 0x140042ab2
lea rcx, [rbp + 0x50]
call fcn.140079330
mov rbx, rax
xor r9d, r9d
test sil, sil
je 0x140042bb9
test r14b, r14b
jne 0x140042bb9
test byte [rbp + 0x1138], 0x20
je 0x140042b31
mov rcx, rbx
lea r8, [rbp + 0x3b90]
sub r8, rbx
movzx edx, word [rcx]
movzx eax, word [rcx + r8]
sub edx, eax
jne 0x140042aee
add rcx, 2
test eax, eax
jne 0x140042ada
test edx, edx
je 0x140042f54
mov r8d, 0x800
mov rdx, rbx
lea rcx, [rbp + 0x3b90]
call fcn.14008e130
mov r9b, 1
xor r8d, r8d
lea rdx, [rbp + 0x50]
lea rcx, [0x140171cc0]
call fcn.14003e004
xor r9d, r9d
test al, al
jne 0x140042f54
jmp 0x140042bb9
mov r9b, 1
lea r8, [rbp - 0x70]
lea rdx, [rbp + 0x50]
lea rcx, [0x140171cc0]
call fcn.14003e004
xor r9d, r9d
test al, al
je 0x140042bb9
cmp qword [rbp + 0x10e0], r9
je 0x140042f54
mov rdx, qword [rbp - 0x70]
lea rcx, [0x140171cc0]
call fcn.14003dc60
mov rcx, qword [rbp + 0x10e0]
mov qword [rax + 0x28], rcx
mov ecx, dword [rbp + 0x10f8]
mov dword [rax + 0x20], ecx
mov dword [rsp + 0x20], reloc.SHELL32.dll_SHRestricted
lea r9, [rbp + 0x29f0]
mov r8b, r12b
lea rdx, [rbp + 0x10e0]
mov rcx, rdi
call fcn.1400458c8
mov dword [rsp + 0x48], 4
lea rax, [rbp + 0x29f0]
mov r8, qword [rbp - 0x70]
jmp 0x140042f3b
mov dword [rbp - 0x50], 7
mov dword [rbp - 0x4c], r15d
or dword [rbp - 0x2c], 0xffffffff
mov dword [rbp - 0x48], r9d
mov word [rbp + 0x29d0], r9w
mov edx, dword [rbp + 0x1138]
test dl, 1
je 0x140042c07
lea rcx, [rbp + 0x29d0]
sub rcx, 2
lea rcx, [rcx + 2]
cmp word [rcx], r9w
jne 0x140042bea
mov eax, dword [0x1401134e4]
mov dword [rcx], eax
movzx eax, word [0x1401134e8]
mov word [rcx + 4], ax
and edx, 6
je 0x140042c97
cmp edx, 2
je 0x140042c6b
cmp edx, 4
je 0x140042c45
cmp edx, 6
jne 0x140042c97
lea rcx, [rbp + 0x29d0]
sub rcx, 2
lea rcx, [rcx + 2]
cmp word [rcx], r9w
jne 0x140042c2a
movsd xmm0, qword [0x140113510]
movzx eax, word [0x140113518]
jmp 0x140042c8f
lea rcx, [rbp + 0x29d0]
sub rcx, 2
lea rcx, [rcx + 2]
cmp word [rcx], r9w
jne 0x140042c50
movsd xmm0, qword [0x140113500]
movzx eax, word [0x140113508]
jmp 0x140042c8f
lea rcx, [rbp + 0x29d0]
sub rcx, 2
lea rcx, [rcx + 2]
cmp word [rcx], r9w
jne 0x140042c76
movsd xmm0, qword [0x1401134f0]
movzx eax, word [0x1401134f8]
movsd qword [rcx], xmm0
mov word [rcx + 8], ax
inc r15d
mov dword [rbp + 0x113c], r15d
lea rdx, [rbp + 0x50]
lea rcx, [0x140171cc0]
call fcn.14003dd78
mov qword [rbp - 0x28], rax
lea rdx, [rbp + 0x50]
mov rcx, rdi
call fcn.14003f554
lea rcx, [rbp + 0x50]
mov rax, rbx
sub rax, rcx
sar rax, 1
mov edx, 0x800
sub rdx, rax
mov rcx, rbx
call fcn.1400c6314
mov qword [rbp - 0x38], rbx
xor eax, eax
cmp word [rbp + 0x29d0], ax
je 0x140042d03
mov r8d, 0x800
lea rdx, [rbp + 0x29d0]
lea rcx, [rbp + 0x50]
call fcn.14008e0f8
lea r9, [rbp - 0x50]
xor r8d, r8d
mov edx, 0x104d
mov rcx, qword [rdi + 0x60]
call qword [sym.imp.USER32.dll_SendMessageW]
movsxd rbx, eax
test sil, sil
jne 0x140042de3
mov rcx, qword [rbp + 0x10d0]
movabs rax, 0x7fffffff7fffffff
cmp rcx, rax
jne 0x140042d47
mov dword [rbp + 0x29f0], 0x3f
jmp 0x140042d59
mov r8d, 0x32
lea rdx, [rbp + 0x29f0]
call fcn.1400a81e0
mov dword [rsp + 0x48], 1
lea rax, [rbp + 0x29f0]
mov qword [rsp + 0x58], rax
lea r9, [rsp + 0x40]
mov r8, rbx
mov edx, 0x1074
mov rcx, qword [rdi + 0x60]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbp + 0x10d8]
movabs rax, 0x7fffffff7fffffff
cmp rcx, rax
jne 0x140042da6
mov dword [rbp + 0x29f0], 0x3f
jmp 0x140042db8
mov r8d, 0x32
lea rdx, [rbp + 0x29f0]
call fcn.1400a81e0
mov dword [rsp + 0x48], 2
lea rax, [rbp + 0x29f0]
mov qword [rsp + 0x58], rax
lea r9, [rsp + 0x40]
mov r8, rbx
mov edx, 0x1074
mov rcx, qword [rdi + 0x60]
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsp + 0x48], 3
or qword [rsp + 0x58], 0xffffffffffffffff
lea r9, [rsp + 0x40]
mov r8, rbx
mov edx, 0x1074
mov rcx, qword [rdi + 0x60]
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
cmp qword [rbp + 0x10e0], rax
je 0x140042e36
mov dword [rsp + 0x20], reloc.SHELL32.dll_SHRestricted
lea r9, [rbp + 0x2ac0]
mov r8b, r12b
lea rdx, [rbp + 0x10e0]
mov rcx, rdi
call fcn.1400458c8
jmp 0x140042e3d
mov word [rbp + 0x2ac0], ax
mov dword [rsp + 0x48], 4
lea rax, [rbp + 0x2ac0]
mov qword [rsp + 0x58], rax
lea r9, [rsp + 0x40]
mov r8, rbx
mov edx, 0x1074
mov rcx, qword [rdi + 0x60]
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [rbp + 0x1104]
xor ecx, ecx
test eax, eax
je 0x140042f0e
test sil, sil
jne 0x140042f0e
cmp dword [rbp + 0x1128], ecx
jne 0x140042f0e
cmp eax, 3
jne 0x140042eb6
mov qword [rsp + 0x20], 0x41
lea r9, [rbp + 0x29f0]
xor r8d, r8d
lea edx, [rax + 0x1d]
lea rcx, [rbp + 0x1108]
call fcn.14008d6c0
jmp 0x140042ee3
lea rcx, str._04X
lea r8, str._08X
cmp eax, 1
cmove r8, rcx
mov r9d, dword [rbp + 0x1108]
mov edx, 0x41
lea rcx, [rbp + 0x29f0]
call fcn.1400026d0
mov dword [rsp + 0x48], 5
lea rax, [rbp + 0x29f0]
mov qword [rsp + 0x58], rax
lea r9, [rsp + 0x40]
mov r8, rbx
mov edx, 0x1074
mov rcx, qword [rdi + 0x60]
call qword [sym.imp.USER32.dll_SendMessageW]
test r14b, r14b
je 0x140042f54
mov r8d, 0x800
lea rdx, [rbp + 0x18d0]
lea rcx, [rbp + 0x50]
call fcn.1400786f4
mov dword [rsp + 0x48], 6
lea rax, [rbp + 0x18d0]
mov r8, rbx
mov qword [rsp + 0x58], rax
lea r9, [rsp + 0x40]
mov edx, 0x1074
mov rcx, qword [rdi + 0x60]
call qword [sym.imp.USER32.dll_SendMessageW]
mov r8b, r14b
lea rdx, [rbp + 0x50]
lea rcx, [0x140169340]
call fcn.140005450
xor r9d, r9d
test al, al
jne 0x140042a7c
mov r12, qword [rbp - 0x68]
mov r13, qword [rbp - 0x60]
lea esi, [r9 + 5]
mov dword [rsp + 0x20], 0x4411
mov r9d, 0x2b8
lea r8, [rbp + 0x1350]
mov r14d, 0x10
mov edx, r14d
lea rcx, [0x140113540]
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov rbx, rax
test rax, rax
lea eax, [r14 - 9]
cmovne esi, eax
mov dword [rbp - 0x50], esi
mov dword [rbp - 0x4c], r15d
mov ecx, dword [rbp + 0x1358]
mov dword [rbp - 0x2c], ecx
xor esi, esi
mov dword [rbp - 0x48], esi
lea rax, [0x14010d628]
mov qword [rbp - 0x38], rax
xor edx, edx
mov r8d, 0x1100
lea rcx, [rbp + 0x18d0]
call fcn.1400efdf0
mov eax, dword [0x14010d628]
mov dword [rbp + 0x18d0], eax
movzx eax, word [0x14010d62c]
mov word [rbp + 0x18d4], ax
mov dword [rbp + 0x2978], r14d
lea rdx, [rbp + 0x18d0]
lea rcx, [0x140171cc0]
call fcn.14003dd78
mov qword [rbp - 0x28], rax
lea r9, [rbp - 0x50]
xor r8d, r8d
mov edx, 0x104d
mov rcx, qword [rdi + 0x60]
call qword [sym.imp.USER32.dll_SendMessageW]
test rbx, rbx
lea ebx, [rsi + 3]
je 0x140043067
mov dword [rsp + 0x48], ebx
lea rdx, [rbp + 0x1568]
mov qword [rsp + 0x58], rdx
movsxd r8, eax
lea r9, [rsp + 0x40]
mov edx, 0x1074
mov rcx, qword [rdi + 0x60]
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, [0x140171cc0]
call fcn.140068324
mov rcx, rdi
call fcn.14004557c
test r12, r12
je 0x1400430bd
cmp word [r12], si
je 0x1400430bd
mov rdx, r12
mov rcx, rdi
call fcn.140040630
test al, al
jne 0x1400430dc
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1004
mov rcx, qword [rdi + 0x60]
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jle 0x1400430b8
cmp r13d, eax
jl 0x1400430b8
lea r13d, [rax - 1]
movsxd r8, r13d
jmp 0x1400430c0
xor r8d, r8d
mov dword [rsp + 0x50], ebx
mov dword [rsp + 0x4c], ebx
lea r9, [rsp + 0x40]
mov edx, 0x102b
mov rcx, qword [rdi + 0x60]
call qword [sym.imp.USER32.dll_SendMessageW]
xor r9d, r9d
lea edx, [r9 + 0xb]
lea r8d, [r9 + 1]
mov rcx, qword [rdi + 0x60]
call qword [sym.imp.USER32.dll_SendMessageW]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x102a
mov rcx, qword [rdi + 0x60]
call qword [sym.imp.USER32.dll_SendMessageW]
xor r8d, r8d
xor edx, edx
lea rcx, [0x14016bce0]
call fcn.1400a8080
mov rcx, rdi
call fcn.140045170
mov rcx, rdi
call fcn.1400453bc
lea rcx, [0x14016e3b0]
call fcn.1400aa980
xor edx, edx
lea rcx, [0x14016bce0]
call fcn.1400a8158
nop
lea rcx, [rbp + 8]
call fcn.1400c47f0
nop
mov eax, dword [0x140145ca0]
test eax, eax
jle 0x14004315e
dec eax
mov dword [0x140145ca0], eax
mov rcx, qword [rbp + 0x5b98]
xor rcx, rsp
call fcn.1400eebd0
mov rbx, qword [rsp + 0x5cf0]
add rsp, 0x5ca0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret