Function at 0x140042e08
Capabilities:
Get file system object information

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x45b0]
mov eax, 0x46b0
call fcn.1400ec1b0
sub rsp, rax
mov qword [rbp - 0x10], 0xfffffffffffffffe
mov qword [rsp + 0x4700], rbx
mov rax, qword [0x14013b1d0]
xor rax, rsp
mov qword [rbp + 0x45a8], rax
mov r12, rdx
mov qword [rbp - 0x68], rdx
mov rdi, rcx
mov esi, 1
add dword [0x140143d5c], esi
mov r9d, esi
or rbx, 0xffffffffffffffff
mov r8, rbx
mov edx, 0x100c
mov rcx, qword [rcx + 0x60]
call qword [sym.imp.USER32.dll_SendMessageW]
mov r14, rax
mov qword [rbp - 0x70], rax
mov edx, esi
lea rcx, [0x140167bf0]
call fcn.1400a632c
mov ecx, 0x1c2
call fcn.1400868b8
mov rdx, rax
lea rcx, [0x140167bf0]
call fcn.1400a6258
mov rcx, qword [0x140142cd0]
xor r13d, r13d
test rcx, rcx
je 0x140042ec2
call qword [sym.imp.KERNEL32.dll_FindCloseChangeNotification]
mov qword [0x140142cd0], rbx
mov r15b, r13b
mov byte [rsp + 0x30], r13b
cmp byte [rdi + 0x1082], r13b
je 0x140042ee4
lea rcx, [0x140167be0]
call fcn.140001f60
jmp 0x140042f9a
lea rbx, [rdi + 0x1084]
jmp 0x140042eff
mov rcx, rbx
call fcn.140078d7c
cmp word [rax], r13w
je 0x140042f0d
mov word [rax], r13w
mov rcx, rbx
call fcn.140068a84
test al, al
je 0x140042eed
jmp 0x140042f15
mov r15b, sil
mov byte [rsp + 0x30], sil
xor r8d, r8d
lea rdx, str.FullPathsTitle
lea rcx, [0x14010aca0]
call fcn.14009dbd0
test eax, eax
setne al
test al, al
je 0x140042f39
mov rax, rbx
jmp 0x140042f41
mov rcx, rbx
call fcn.140078d7c
mov rcx, rbx
cmp word [rax], r13w
cmovne rcx, rax
call fcn.1400d85e4
mov rcx, rbx
call fcn.1400781c0
mov esi, eax
cmp eax, 0xffffffff
je 0x140042f6e
call fcn.1400c2b4c
bt eax, esi
jae 0x140043681
test r15b, r15b
jne 0x140042f9a
lea rcx, [0x140167be0]
call fcn.14000260c
lea rcx, [0x14014e5f8]
call fcn.1400ab4d8
mov rdx, rbx
lea rcx, [0x14014e5f8]
call fcn.1400ab87c
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xb]
mov rcx, qword [rdi + 0x60]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, rdi
call fcn.14003f850
mov ebx, 0x4401
mov esi, 0x2b8
test r15b, r15b
jne 0x140042fe4
mov dword [rsp + 0x20], ebx
mov r9d, esi
lea r8, [rbp + 0x40]
xor edx, edx
lea rcx, [0x14010a890]
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test rax, rax
jne 0x14004301c
xor r8d, r8d
mov edx, 0x800
lea rcx, [rbp + 0x35a0]
call fcn.1400c2a30
test r15b, r15b
je 0x140043002
mov rax, r13
jmp 0x14004301c
mov dword [rsp + 0x20], ebx
mov r9d, esi
lea r8, [rbp + 0x40]
xor edx, edx
lea rcx, [rbp + 0x35a0]
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov r9, rax
mov edx, 0x1003
mov r8d, 1
mov rcx, qword [rdi + 0x60]
call qword [sym.imp.USER32.dll_SendMessageW]
lea rsi, [rdi + 0x1084]
mov rcx, rsi
call fcn.1400c2b7c
mov bl, al
mov byte [rsp + 0x31], al
xor r8d, r8d
lea rdx, str.ShowSeconds
lea rcx, str.FileList
call fcn.14009dbd0
test eax, eax
setne byte [rsp + 0x33]
mov rcx, rdi
cmp byte [rdi + 0x1082], r13b
je 0x14004307c
call fcn.1400436c0
jmp 0x140043535
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
call fcn.140036d88
mov r9d, 0x800
lea r8, [rbp + 0x35a0]
lea rdx, [0x14010a4a8]
mov rcx, rsi
call fcn.140078870
lea rcx, [rbp + 0x2450]
call fcn.140069f28
nop
lea rdx, [rbp + 0x35a0]
lea rcx, [rbp + 0x2450]
call fcn.14006a0dc
mov qword [rbp + 0x1310], r13
mov qword [rbp + 0x1318], r13
mov qword [rbp + 0x1320], r13
xor esi, esi
mov byte [rsp + 0x32], sil
mov edx, 0x1f4
lea rcx, [rbp - 8]
call fcn.1400c1fbc
nop
test r15b, r15b
jne 0x140043458
mov r12b, byte [rsp + 0x31]
mov r14b, sil
mov r15b, byte [rsp + 0x33]
jmp 0x14004310b
xor esi, esi
xor r8d, r8d
lea rdx, [rbp + 0x300]
lea rcx, [rbp + 0x2450]
call fcn.140069fe0
test al, al
je 0x14004343e
test r13b, 0x1f
jne 0x140043138
lea rcx, [rbp - 8]
call fcn.1400c3664
lea rcx, [rbp + 0x300]
call fcn.140078d7c
mov rbx, rax
movzx ecx, word [rax]
cmp cx, word [0x14010a890]
jne 0x140043160
movzx ecx, word [rax + 2]
cmp cx, word [0x14010a892]
je 0x14004310b
mov dword [rbp - 0x60], 7
mov dword [rbp - 0x5c], r13d
or dword [rbp - 0x3c], 0xffffffff
mov dword [rbp - 0x58], esi
movzx ecx, word [rax]
movzx eax, word [0x14010a598]
sub ecx, eax
jne 0x14004319c
movzx ecx, word [rbx + 2]
movzx eax, word [0x14010a59a]
sub ecx, eax
jne 0x14004319c
movzx ecx, word [rbx + 4]
movzx eax, word [0x14010a59c]
sub ecx, eax
test ecx, ecx
sete sil
test sil, sil
je 0x1400431b9
test r12b, r12b
jne 0x140043109
mov eax, dword [rbp + 0x48]
mov dword [rbp - 0x3c], eax
mov r14b, 1
xor edx, edx
mov r8d, 0x1100
lea rcx, [rbp + 0x1350]
call fcn.1400ed430
mov r8d, 0x800
mov rdx, rbx
lea rcx, [rbp + 0x1350]
call fcn.14008c7ec
mov rdx, rbx
mov rcx, rdi
call fcn.14003f0f4
mov rax, qword [rbp + 0x1300]
mov qword [rbp + 0x23d0], rax
and qword [rbp + 0x23d8], 0
mov eax, dword [rbp + 0x1308]
mov dword [rbp + 0x23f8], eax
mov rax, qword [rbp + 0x1310]
mov qword [rbp + 0x23e0], rax
inc r13d
mov dword [rbp + 0x243c], r13d
cmp byte [rbp + 0x130d], 0
je 0x140043245
mov al, byte [rbp + 0x130e]
neg al
sbb ecx, ecx
neg ecx
add ecx, 2
mov dword [rbp + 0x2428], ecx
lea rdx, [rbp + 0x1350]
lea rcx, [0x14016dbf0]
call fcn.14003d918
mov qword [rbp - 0x38], rax
lea rcx, [rbp + 0x300]
mov rax, rbx
sub rax, rcx
sar rax, 1
mov edx, 0x800
sub rdx, rax
mov rcx, rbx
call fcn.1400c3a1c
mov qword [rbp - 0x48], rbx
lea r9, [rbp - 0x60]
xor r8d, r8d
mov edx, 0x104d
mov rcx, qword [rdi + 0x60]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbx, rax
cmp byte [rbp + 0x130c], 0
jne 0x1400432c4
mov r8d, 0x32
lea rdx, [rbp + 0x3530]
mov rcx, qword [rbp + 0x23d0]
call fcn.1400a63b4
lea rax, [rbp + 0x3530]
jmp 0x1400432cb
lea rax, [0x14010a100]
mov dword [rsp + 0x48], 1
mov qword [rsp + 0x58], rax
lea r9, [rsp + 0x40]
mov r8, rbx
mov edx, 0x1074
mov rcx, qword [rdi + 0x60]
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsp + 0x48], 2
lea r9, [rsp + 0x40]
mov r8, rbx
mov edx, 0x1074
mov rcx, qword [rdi + 0x60]
test sil, sil
lea rax, [rbp + 0x258]
jne 0x14004331b
lea rax, [0x14010a100]
mov qword [rsp + 0x58], rax
call qword [sym.imp.USER32.dll_SendMessageW]
call fcn.14006bbc0
lea rcx, [rbp + 0x1338]
cmp eax, 0x600
jae 0x140043346
lea rdx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
jmp 0x14004336f
lea rdx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea r8, [rbp + 0x30]
lea rdx, [rbp + 0x20]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov dword [rsp + 0x28], reloc.SHELL32.dll_SHRestricted
lea rax, [rbp + 0x3460]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rbp + 0x10]
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetDateFormatW]
lea rcx, [rbp + 0x3460]
sub rcx, 2
xor esi, esi
lea rcx, [rcx + 2]
cmp word [rcx], si
jne 0x1400433b3
mov eax, dword [0x14010eb64]
mov dword [rcx], eax
lea rcx, [rbp + 0x3460]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], si
jne 0x1400433cf
lea rcx, [rbp + 0x3460]
lea rcx, [rcx + rax*2]
mov al, r15b
neg al
sbb edx, edx
not edx
and edx, 2
mov dword [rsp + 0x28], reloc.SHELL32.dll_SHRestricted
mov qword [rsp + 0x20], rcx
xor r9d, r9d
lea r8, [rbp + 0x10]
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetTimeFormatW]
mov dword [rsp + 0x48], 3
lea rax, [rbp + 0x3460]
mov qword [rsp + 0x58], rax
lea r9, [rsp + 0x40]
mov r8, rbx
mov edx, 0x1074
mov rcx, qword [rdi + 0x60]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x14004310b
test r14b, r14b
mov r14, qword [rbp - 0x70]
mov r15b, byte [rsp + 0x30]
mov r12, qword [rbp - 0x68]
jne 0x140043515
mov bl, byte [rsp + 0x31]
test bl, bl
jne 0x140043515
mov dword [rbp - 0x60], 7
mov dword [rbp - 0x5c], r13d
mov eax, dword [rbp + 0x48]
mov dword [rbp - 0x3c], eax
xor r13d, r13d
mov dword [rbp - 0x58], r13d
lea rax, [0x14010a598]
mov qword [rbp - 0x48], rax
xor edx, edx
mov r8d, 0x1100
lea rcx, [rbp + 0x1350]
call fcn.1400ed430
mov eax, dword [0x14010a598]
mov dword [rbp + 0x1350], eax
movzx eax, word [0x14010a59c]
mov word [rbp + 0x1354], ax
mov dword [rbp + 0x23f8], 0x10
lea rdx, [rbp + 0x1350]
lea rcx, [0x14016dbf0]
call fcn.14003d918
mov qword [rbp - 0x38], rax
lea r9, [rbp - 0x60]
xor r8d, r8d
mov edx, 0x104d
mov rcx, qword [rdi + 0x60]
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsp + 0x48], 2
lea rcx, [rbp + 0x258]
mov qword [rsp + 0x58], rcx
movsxd r8, eax
lea r9, [rsp + 0x40]
mov edx, 0x1074
mov rcx, qword [rdi + 0x60]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x140043518
xor r13d, r13d
lea rcx, [rbp - 8]
call fcn.1400c1ff8
nop
lea rcx, [rbp + 0x2450]
call fcn.140069f40
lea rsi, [rdi + 0x1084]
lea rcx, [0x14016dbf0]
call fcn.1400150dc
mov rcx, rdi
call fcn.1400451dc
test r12, r12
je 0x140043598
cmp word [r12], r13w
jne 0x140043589
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1004
mov rcx, qword [rdi + 0x60]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp r14d, eax
jl 0x140043577
test eax, eax
jle 0x140043577
lea r14d, [rax - 1]
mov dword [rsp + 0x50], 3
mov dword [rsp + 0x4c], 3
jmp 0x1400435b3
mov rdx, r12
mov rcx, rdi
call fcn.1400401d0
test al, al
jne 0x1400435ca
mov eax, 3
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x4c], eax
cmp r14d, 0xffffffff
je 0x1400435b0
test r12, r12
jne 0x1400435b3
mov r14d, r13d
lea r9, [rsp + 0x40]
movsxd r8, r14d
mov edx, 0x102b
mov rcx, qword [rdi + 0x60]
call qword [sym.imp.USER32.dll_SendMessageW]
mov r9d, 1
or r8, 0xffffffffffffffff
mov edx, 0x100c
mov rcx, qword [rdi + 0x60]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbx, rax
xor edx, edx
lea rcx, [0x140167bf0]
call fcn.1400a6258
xor r9d, r9d
lea edx, [r9 + 0xb]
lea r8d, [r9 + 1]
mov rcx, qword [rdi + 0x60]
call qword [sym.imp.USER32.dll_SendMessageW]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x102a
mov rcx, qword [rdi + 0x60]
call qword [sym.imp.USER32.dll_SendMessageW]
movsxd r8, ebx
xor r9d, r9d
mov edx, 0x1013
mov rcx, qword [rdi + 0x60]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, rdi
call fcn.140044dd0
mov rcx, rdi
call fcn.14004501c
xor edx, edx
lea rcx, [0x140167bf0]
call fcn.1400a632c
lea rcx, [0x14016a2c0]
call fcn.1400a845c
test r15b, r15b
jne 0x140043681
cmp byte [rdi + 0x1082], r13b
jne 0x140043681
xor edx, edx
lea r8d, [rdx + 3]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindFirstChangeNotificationW]
mov qword [0x140142cd0], rax
mov eax, dword [0x140143d5c]
test eax, eax
jle 0x140043693
dec eax
mov dword [0x140143d5c], eax
mov rcx, qword [rbp + 0x45a8]
xor rcx, rsp
call fcn.1400ec220
mov rbx, qword [rsp + 0x4700]
add rsp, 0x46b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret