Function at 0x140143300
Capabilities:
Get file system object information

Disassembly:
mov word [rsp + 0x20], r9w
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x258
mov dword [rsp + 0x40], 0x374c68a8
movabs rax, 0x76a924152a5caf35
cmp qword [rsp + 0x270], rax
jle 0x1401433a2
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x78]
mov edx, 0x3b
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.SHELL32.dll_SHChangeNotification_Lock]
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x260]
mov qword [rsp + 0x268], rax
mov word [rsp + 0x20], 0xc3
movzx r9d, word [rsp + 0x278]
movzx r8d, word [rsp + 0x278]
mov dl, 0xa9
mov cl, 0xc9
call fcn.140143790
mov edx, 0xf9
lea rcx, [rsp + 0x88]
call qword [sym.imp.SHELL32.dll_SHGetSettings]
nop
jmp 0x140143711
movzx eax, byte [section..data]
cmp eax, 0x84
jle 0x140143711
mov rax, qword [rsp + 0x260]
mov qword [rsp + 0x80], rax
movabs rax, 0xb459304ba5946fbb
cmp qword [rsp + 0x80], rax
je 0x1401433da
jmp 0x1401433fc
mov rax, qword [rsp + 0x260]
mov qword [rsp + 0x268], rax
mov rax, qword [rsp + 0x268]
mov qword [rsp + 0x260], rax
jmp 0x14014347b
movzx eax, word [rsp + 0x278]
mov word [rsp + 0x38], ax
mov eax, dword [rsp + 0x40]
add eax, 0xa5f7699e
mov dword [rsp + 0x40], eax
mov byte [rsp + 0x30], 0x27
cmp dword [rsp + 0x40], 0x7eae7f2a
jbe 0x14014344e
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x5c], eax
mov eax, 0xd74
mov word [rsp + 0x34], ax
mov dword [rsp + 0x44], 0x29d59019
mov rax, qword [rsp + 0x270]
mov qword [rsp + 0x48], rax
jmp 0x14014347b
mov dword [rsp + 0x20], 0xa7
mov r9d, 0xa5
lea r8, [rsp + 0xe0]
mov edx, 0x22
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov dword [rsp + 0x54], eax
movsx eax, word [rsp + 0x38]
and eax, 0x521b
movsx ecx, word [rsp + 0x278]
cmp eax, ecx
jl 0x140143576
mov rax, qword [rsp + 0x260]
shl rax, 0x9d
cmp rax, qword [rsp + 0x268]
jb 0x140143563
movzx eax, word [rsp + 0x34]
or eax, 0x964
cmp eax, 0xf14
jl 0x140143522
mov rax, qword [rsp + 0x260]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x48]
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x270]
call fcn.140144170
movzx eax, word [rsp + 0x34]
sar eax, 2
mov word [rsp + 0x34], ax
movzx r9d, word [rsp + 0x38]
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x268]
mov rcx, qword [rsp + 0x260]
call fcn.140143300
lea rcx, [rsp + 0x48]
call qword [sym.imp.SHELL32.dll_SHSetInstanceExplorer]
nop
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x58], eax
cmp dword [rsp + 0x58], 0x6c4c3d41
je 0x140143536
jmp 0x140143561
movzx eax, word [rsp + 0x38]
mov word [rsp + 0x278], ax
movzx r9d, byte [rsp + 0x30]
movzx r8d, word [rsp + 0x34]
movzx edx, byte [rsp + 0x30]
movzx ecx, byte [section..data]
call fcn.140142aa0
nop
jmp 0x140143576
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_ILGetNext]
mov qword [rsp + 0x98], rax
mov eax, dword [rsp + 0x54]
mov ecx, dword [rsp + 0x5c]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x40], eax
movzx eax, word [rsp + 0x38]
mov word [rsp + 0x3c], ax
movsx eax, word [rsp + 0x3c]
movsx ecx, word [rsp + 0x38]
sub eax, ecx
movsx ecx, word [rsp + 0x278]
cmp eax, ecx
jle 0x1401436aa
movzx eax, word [rsp + 0x34]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0x2b3
je 0x1401435d2
cmp dword [rsp + 0x50], 0xa73
je 0x14014369b
jmp 0x1401436aa
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], reloc.SHELL32.dll_ILAppendID
mov r9d, 0xed
mov r8d, 0x3d
mov edx, PathMakeUniqueName
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.SHELL32.dll_SHChangeNotifyRegister]
mov dword [rsp + 0x40], eax
movzx eax, word [rsp + 0x34]
mov word [rsp + 0x20], ax
movzx r9d, word [rsp + 0x3c]
movzx r8d, word [rsp + 0x3c]
movzx edx, byte [rsp + 0x30]
movzx ecx, byte [rsp + 0x30]
call fcn.140143790
nop
movzx eax, byte [rsp + 0x30]
mov byte [rsp + 0x60], al
cmp byte [rsp + 0x60], 0x79
je 0x14014363f
jmp 0x140143683
movzx eax, word [rsp + 0x34]
add eax, 0xfb2
mov word [rsp + 0x34], ax
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.SHELL32.dll_ILCreateFromPathA]
mov qword [rsp + 0xb0], rax
movabs rax, 0x2f85c96a8dcdd77
mov rcx, qword [rsp + 0x270]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
jmp 0x140143699
movzx r8d, word [rsp + 0x34]
movzx edx, word [rsp + 0x3c]
movzx ecx, word [rsp + 0x3c]
call fcn.140142560
nop
jmp 0x1401436aa
movzx eax, word [rsp + 0x34]
add eax, 0xccd
mov word [rsp + 0x34], ax
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x64], eax
cmp dword [rsp + 0x64], 0
je 0x1401436bb
jmp 0x140143701
cmp dword [rsp + 0x44], 0xfce7d7f
jg 0x1401436f2
mov rdx, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.SHELL32.dll_DuplicateIcon]
mov qword [rsp + 0xc8], rax
mov eax, dword [rsp + 0x44]
add eax, 0x37e49e3f
mov dword [rsp + 0x44], eax
jmp 0x1401436ff
lea rax, [rsp + 0x48]
mov qword [rsp + 0xd0], rax
jmp 0x140143711
mov rax, qword [rsp + 0x268]
mov qword [rsp + 0x260], rax
movzx eax, byte [section..data]
mov byte [rsp + 0x68], al
cmp byte [rsp + 0x68], 0xf6
je 0x140143727
jmp 0x140143734
mov eax, 0x2c52
mov word [rsp + 0x278], ax
mov rcx, qword [rsp + 0x270]
call fcn.140143980
mov eax, 0x44a1
mov word [rsp + 0x278], ax
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.SHELL32.dll_DragFinish]
mov r9b, 0x4e
mov r8w, 0x85
mov dl, 0x81
movzx ecx, byte [section..data]
call fcn.140142aa0
mov eax, 0xca
add rsp, 0x258
ret