Function at 0x140093250
Capabilities:
Get file system object information
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rdi
push r14
sub rsp, 0x6f0
mov rbx, r8
lea rcx, [rsp + 0x430]
mov rdi, rdx
mov r8d, 0x2b8
xor edx, edx
mov r14, r9
call fcn.14014e180
test rdi, rdi
je 0x140093516
test rbx, rbx
je 0x140093516
test r14, r14
je 0x140093516
mov qword [rsp + 0x728], r15
lea r8, [rsp + 0x430]
xor r15d, r15d
mov qword [rsp + 0x720], rsi
mov word [rbx], r15w
mov r9d, 0x2b8
xor edx, edx
mov dword [r14], 0xffffffff
mov rcx, rdi
mov dword [rsp + 0x20], 0x1000
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea rcx, [rsp + 0x440]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x14009336d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
dec eax
movsxd rcx, eax
shr rcx, 1
je 0x14009335e
cmp rcx, 0x7fffffff
jbe 0x14009331d
mov eax, dword [rsp + 0x438]
mov word [rbx], r15w
mov dword [r14], eax
jmp 0x140093506
mov esi, 0x7ffffffe
lea rdx, [rsp + 0x440]
sub rsi, rcx
sub rdx, rbx
lea rax, [rsi + rcx]
test rax, rax
je 0x14009334f
movzx eax, word [rdx + rbx]
test ax, ax
je 0x14009334f
mov word [rbx], ax
add rbx, 2
sub rcx, 1
jne 0x140093330
test rcx, rcx
lea rax, [rbx - 2]
cmovne rax, rbx
mov word [rax], r15w
mov eax, dword [rsp + 0x438]
mov dword [r14], eax
jmp 0x140093506
mov rcx, rdi
mov qword [rsp + 0x718], rbp
mov dword [rsp + 0x710], 0x200
call qword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
lea r9, [rsp + 0x710]
mov rcx, 0xffffffff80000000
mov rdx, rax
lea r8, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov r8d, 0x100
lea rax, [rsp + 0x30]
mov ecx, r8d
cmp word [rax], r15w
je 0x1400933c4
add rax, 2
sub rcx, 1
jne 0x1400933b4
mov rax, r8
mov esi, 0x7ffffffe
sub rax, rcx
test rcx, rcx
cmove rax, r15
je 0x140093420
lea rdx, [rsp + 0x30]
lea rdx, [rdx + rax*2]
sub r8, rax
je 0x140093411
lea r9, str.DefaultIcon
mov eax, esi
sub r9, rdx
test rax, rax
je 0x140093411
movzx ecx, word [r9 + rdx]
test cx, cx
je 0x140093411
mov word [rdx], cx
dec rax
add rdx, 2
sub r8, 1
jne 0x1400933f2
test r8, r8
lea rax, [rdx - 2]
cmovne rax, rdx
mov word [rax], r15w
lea r9, [rsp + 0x710]
mov dword [rsp + 0x710], 0x104
lea r8, [rsp + 0x230]
mov rcx, 0xffffffff80000000
lea rdx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea rdx, [0x1401b93ac]
lea rcx, [rsp + 0x230]
call fcn.140030c6c
mov rbp, rax
test rax, rax
je 0x1400934fe
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, 1
lea rcx, [rsp + 0x230]
sub edi, eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, edi
mov rcx, rbx
movsxd rdi, eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
shr rcx, 1
lea rax, [rcx - 1]
cmp rax, rsi
ja 0x1400934f2
shr rdi, 1
cmp rdi, rsi
jbe 0x1400934b6
mov word [rbx], r15w
jmp 0x1400934f2
sub rdi, rcx
lea rdx, [rsp + 0x230]
sub rdx, rbx
lea rax, [rdi + rcx]
test rax, rax
je 0x1400934e3
movzx eax, word [rdx + rbx]
test ax, ax
je 0x1400934e3
mov word [rbx], ax
add rbx, 2
sub rcx, 1
jne 0x1400934c4
test rcx, rcx
lea rax, [rbx - 2]
cmovne rax, rbx
mov word [rax], r15w
lea rcx, [rbp + 2]
call fcn.14003e338
mov dword [r14], eax
mov rbp, qword [rsp + 0x718]
mov rsi, qword [rsp + 0x720]
mov r15, qword [rsp + 0x728]
add rsp, 0x6f0
pop r14
pop rdi
pop rbx
ret