Function at 0x140005910
Capabilities:
Get common file path
Get file system object information

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x968
mov qword [rsp + 0x98], 0xfffffffffffffffe
mov rax, qword [0x140126108]
xor rax, rsp
mov qword [rsp + 0x950], rax
mov qword [rsp + 0x58], r9
mov qword [rsp + 0x30], r8
mov rsi, rdx
mov r15, rcx
mov edx, 0x110a
mov r8d, 4
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbx, rax
or r14, 0xffffffffffffffff
lea ebp, [r14 + 2]
test rax, rax
je 0x140005adf
nop
nop
xor eax, eax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x68], rbx
mov dword [rsp + 0x60], socket
lea r9, [rsp + 0x60]
xor r8d, r8d
mov edx, 0x113e
mov rcx, qword [r15 + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x140005a25
mov rdx, qword [rsp + 0x90]
test rdx, rdx
je 0x140005a97
mov rdx, qword [rdx]
xor eax, eax
test rdx, rdx
setne al
test eax, eax
je 0x140005ac1
mov rax, qword [rsi]
sub rdx, rax
nop
nop
movzx ecx, word [rax]
cmp cx, word [rax + rdx]
jne 0x140005a16
add rax, 2
test cx, cx
jne 0x140005a00
xor eax, eax
jmp 0x140005a1b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x140005ab9
jmp 0x140005a97
mov r8, rbx
lea rdx, [rsp + 0x50]
mov rcx, r15
call fcn.1400768b8
nop
mov rdx, qword [rax]
xor eax, eax
test rdx, rdx
setne al
test eax, eax
je 0x140005ad4
mov rax, qword [rsi]
sub rdx, rax
nop
movzx ecx, word [rax]
cmp cx, word [rax + rdx]
jne 0x140005a66
add rax, 2
test cx, cx
jne 0x140005a50
xor eax, eax
jmp 0x140005a6b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sete dil
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140005a92
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
test dil, dil
jne 0x140005acc
mov r9, rbx
mov r8, rbp
mov edx, 0x110a
mov rcx, qword [r15 + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbx, rax
test rax, rax
je 0x140005adf
jmp 0x140005980
mov rax, rbx
jmp 0x140005fe6
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, rbx
jmp 0x140005fe6
mov ecx, 0x80004005
call fcn.140001000
nop
mov r12d, r14d
mov ecx, 8
call fcn.14006b854
mov r13, rax
mov qword [rsp + 0xa0], rax
test rax, rax
je 0x140005b6b
mov rdi, qword [rsi]
mov rcx, qword [rdi - 0x18]
mov rdx, qword [rcx]
call qword [rdx + 0x20]
mov rcx, rax
cmp dword [rdi - 8], 0
jl 0x140005b23
cmp rax, qword [rdi - 0x18]
jne 0x140005b23
lea rbx, [rdi - 0x18]
lock add dword [rdi - 8], 1
jmp 0x140005b61
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rdi - 0x10]
call qword [rax]
mov rbx, rax
test rax, rax
jne 0x140005b3f
call fcn.140006b60
int3
mov eax, dword [rdi - 0x10]
mov dword [rbx + 8], eax
mov eax, dword [rdi - 0x10]
add eax, 1
movsxd rdx, eax
lea r9, [rdx + rdx]
mov r8, rdi
add rdx, rdx
lea rcx, [rbx + 0x18]
call fcn.14009d1a0
lea rax, [rbx + 0x18]
mov qword [r13], rax
jmp 0x140005b6e
xor r13d, r13d
mov rdi, qword [rsi]
mov rcx, qword [rdi - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rdi - 8], 0
jl 0x140005b95
cmp rax, qword [rdi - 0x18]
jne 0x140005b95
lea rbx, [rdi - 0x18]
lock add dword [rdi - 8], 1
jmp 0x140005bd3
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rdi - 0x10]
call qword [rax]
mov rbx, rax
test rax, rax
jne 0x140005bb1
call fcn.140006b60
int3
mov eax, dword [rdi - 0x10]
mov dword [rbx + 8], eax
mov eax, dword [rdi - 0x10]
add eax, 1
movsxd rdx, eax
lea r9, [rdx + rdx]
mov r8, rdi
add rdx, rdx
lea rcx, [rbx + 0x18]
call fcn.14009d1a0
add rbx, 0x18
mov qword [rsp + 0x38], rbx
mov edi, dword [rsp + 0x9d8]
cmp edi, 0xffffffff
je 0x140005d11
xor esi, esi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x3d0], rsi
xor edx, edx
mov r8d, 0x2b0
lea rcx, [rsp + 0x3d8]
call fcn.1400a0a70
lea r8, [rsp + 0x48]
mov edx, edi
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
je 0x140005c28
mov r12d, r14d
jmp 0x140005c73
mov dword [rsp + 0x20], 0x4009
mov r9d, 0x2b8
lea r8, [rsp + 0x3d0]
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test rax, rax
jne 0x140005c60
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov r12d, r14d
jmp 0x140005c73
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov r12d, dword [rsp + 0x3d8]
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x690], rsi
xor edx, edx
mov r8d, 0x2b0
lea rcx, [rsp + 0x698]
call fcn.1400a0a70
lea r8, [rsp + 0x40]
mov edx, edi
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
je 0x140005cb5
mov edi, r14d
mov rsi, qword [rsp + 0x30]
jmp 0x140005ec3
mov dword [rsp + 0x20], 0x400b
mov r9d, 0x2b8
lea r8, [rsp + 0x690]
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test rax, rax
jne 0x140005cf5
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov edi, r14d
mov rsi, qword [rsp + 0x30]
jmp 0x140005ec3
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov edi, dword [rsp + 0x698]
mov rsi, qword [rsp + 0x30]
jmp 0x140005ec3
mov qword [rsp + 0x110], 0
xor edx, edx
mov r8d, 0x2b0
lea rcx, [rsp + 0x118]
call fcn.1400a0a70
mov dword [rsp + 0x20], 0x301
mov r9d, 0x2b8
lea r8, [rsp + 0x110]
xor edx, edx
mov rsi, qword [rsp + 0x30]
mov rcx, qword [rsi]
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test rax, rax
je 0x140005e7f
mov r12d, dword [rsp + 0x118]
xor eax, eax
mov rcx, r14
lea rdi, [rsp + 0x120]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
test ecx, ecx
jne 0x140005de6
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x140005e7f
cmp dword [rdx + 0x10], eax
jge 0x140005db7
cmp dword [rbx - 0xc], eax
jge 0x140005dac
mov ecx, 0x80070057
call fcn.140001000
int3
mov dword [rbx - 0x10], eax
mov word [rbx], ax
jmp 0x140005e7f
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140005dcf
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x38], rbx
jmp 0x140005e7f
mov esi, dword [rbx - 0x10]
lea rbp, [rsp + 0x120]
sub rbp, rbx
sar rbp, 1
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x140005e19
mov edx, edi
lea rcx, [rsp + 0x38]
call fcn.140006b70
mov rbx, qword [rsp + 0x38]
cmp rbp, rsi
ja 0x140005e39
movsxd rax, edi
lea rsi, [rax + rax]
lea r8, [rbx + rbp*2]
mov r9, rsi
mov rdx, rsi
mov rcx, rbx
call fcn.14009ce60
jmp 0x140005e56
movsxd rax, edi
lea rsi, [rax + rax]
mov r9, rsi
lea r8, [rsp + 0x120]
mov rdx, rsi
mov rcx, rbx
call fcn.14009d1a0
test edi, edi
js 0x140005e74
cmp edi, dword [rbx - 0xc]
jg 0x140005e74
mov dword [rbx - 0x10], edi
mov word [rsi + rbx], 0
mov ebp, 1
mov rsi, qword [rsp + 0x30]
jmp 0x140005e7f
mov ecx, 0x80070057
call fcn.140001000
int3
xor edx, edx
mov r8d, 0x2b8
lea rcx, [rsp + 0x110]
call fcn.1400a0a70
mov dword [rsp + 0x20], 0x103
mov r9d, 0x2b8
lea r8, [rsp + 0x110]
xor edx, edx
mov rcx, qword [rsi]
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov edi, r14d
test rax, rax
cmovne edi, dword [rsp + 0x118]
cmp r12d, 0xffffffff
je 0x140005fc8
cmp edi, 0xffffffff
je 0x140005fc8
xor edx, edx
lea r8d, [rdx + 0x60]
lea rcx, [rsp + 0xb0]
call fcn.1400a0a70
mov r11, qword [rsp + 0x58]
mov qword [rsp + 0xb0], r11
mov qword [rsp + 0xb8], 0xffffffffffff0002
mov dword [rsp + 0xc0], 0x67
mov edx, dword [rbx - 0x10]
sub ebp, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edx
or eax, ebp
jge 0x140005f2b
lea rcx, [rsp + 0x38]
call fcn.140006b70
mov rbx, qword [rsp + 0x38]
mov qword [rsp + 0xd8], rbx
mov qword [rsp + 0xf0], r13
mov dword [rsp + 0xe4], r12d
mov dword [rsp + 0xe8], edi
mov rdx, rsi
mov rcx, r15
call fcn.1400046f0
mov dword [rsp + 0xec], eax
lea r9, [rsp + 0xb0]
xor r8d, r8d
mov edx, 0x1132
mov rcx, qword [r15 + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdi, rax
cmp byte [rsp + 0x9d0], 0
je 0x140005fa7
mov r9, rax
mov edx, 0x110b
mov r8d, 9
mov rcx, qword [r15 + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdx, rdi
mov rcx, r15
call fcn.1400031a0
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], r14d
add r14d, 0xffffffff
test r14d, r14d
jg 0x140005fc3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rax, rdi
jmp 0x140005fe6
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], r14d
add r14d, 0xffffffff
test r14d, r14d
jg 0x140005fe4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
xor eax, eax
mov rcx, qword [rsp + 0x950]
xor rcx, rsp
call fcn.14009cca0
add rsp, 0x968
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret