Function at 0x14004a320
Capabilities:
Get file system object information

Disassembly:
mov r11, rsp
push rbx
push rdi
sub rsp, 0x398
mov rax, qword [0x1400d5d58]
mov qword [r11 + 8], rbp
mov qword [r11 - 0x18], rsi
mov qword [r11 - 0x20], r12
mov qword [r11 - 0x30], r14
mov r14, rcx
mov r12d, edx
lea rcx, [r11 - 0x328]
lea rdx, [r11 + 0x10]
mov qword [rsp + 0x3c8], rax
call sym.ProcessHacker.exe_PhEnumProcessItems
mov ebx, dword [rsp + 0x3b8]
mov ecx, ebx
call sym.ProcessHacker.exe_PhCreateList
mov rdx, qword [rsp + 0x80]
mov r8d, ebx
mov rcx, rax
mov rdi, rax
call sym.ProcessHacker.exe_PhAddItemsList
xor ebx, ebx
cmp dword [rdi], ebx
jbe 0x14004a3d1
lea ebp, [rbx + 1]
xor esi, esi
mov rcx, qword [rdi + 8]
mov rax, qword [rsi + rcx]
cmp qword [rax + 0x10], 0
jg 0x14004a3c5
mov r8d, dword [rdi]
mov eax, ebp
sub r8d, ebx
lea rdx, [rcx + rax*8]
lea rcx, [rcx + rbx*8]
dec r8d
shl r8, 3
call fcn.140094930
dec dword [rdi]
dec ebx
dec ebp
sub rsi, 8
inc ebx
inc ebp
add rsi, 8
cmp ebx, dword [rdi]
jb 0x14004a390
xor ebx, ebx
cmp dword [rdi], ebx
jbe 0x14004a46e
movaps xmmword [rsp + 0x360], xmm6
xorps xmm6, xmm6
lea ebp, [rbx + 1]
xor esi, esi
nop dword [rax + rax]
cmp dword [rdi], r12d
jbe 0x14004a466
mov rax, qword [rdi + 8]
mov rcx, qword [rsi + rax]
movss xmm0, dword [rcx + 0x188]
ucomiss xmm0, xmm6
jp 0x14004a40c
je 0x14004a430
mov rcx, qword [rcx + 0x80]
test rcx, rcx
je 0x14004a430
mov rdx, qword [0x1400d6470]
add rcx, 0x10
add rdx, 0x10
call fcn.1400a6b10
test eax, eax
je 0x14004a45a
mov r8d, dword [rdi]
mov rcx, qword [rdi + 8]
mov eax, ebp
sub r8d, ebx
lea rdx, [rcx + rax*8]
lea rcx, [rcx + rbx*8]
dec r8d
shl r8, 3
call fcn.140094930
dec dword [rdi]
dec ebx
dec ebp
sub rsi, 8
inc ebx
inc ebp
add rsi, 8
cmp ebx, dword [rdi]
jb 0x14004a3f0
movaps xmm6, xmmword [rsp + 0x360]
mov edx, dword [rdi]
mov rcx, qword [rdi + 8]
lea r9, [0x14004a2c0]
mov r8d, 8
call fcn.140095e30
mov r11d, dword [rdi]
cmp r11d, r12d
jbe 0x14004a4b8
mov r9, qword [rdi + 8]
mov ebx, r11d
sub ebx, r12d
lea rcx, [r9 + r12*8]
sub r11d, ebx
lea eax, [rbx + r12]
sub r11d, r12d
lea rdx, [r9 + rax*8]
mov r8d, r11d
shl r8, 3
call fcn.140094930
sub dword [rdi], ebx
mov edx, dword [rdi]
mov rcx, qword [rdi + 8]
lea r9, [0x14004a300]
mov r8d, 8
call fcn.140095e30
xor edx, edx
mov r8d, 0x400
mov rcx, r14
call qword [sym.imp.USER32.dll_DeleteMenu]
test eax, eax
jne 0x14004a4d0
xor ebp, ebp
cmp dword [rdi], ebp
jbe 0x14004a889
mov qword [rsp + 0x380], r13
mov qword [rsp + 0x370], r15
mov qword [rsp + 0x90], rbp
lea r15, [0x1400ab628]
xor r13d, r13d
lea rsi, [0x1400b4e58]
nop dword [rax + rax]
xor edx, edx
lea rcx, [rsp + 0x34]
mov dword [rsp + 0x30], 0x50
lea r8d, [rdx + 0x4c]
call fcn.14009e740
mov r11, qword [rdi + 8]
mov r12, qword [r13 + r11]
mov dword [rsp + 0x34], 0x62
mov rax, qword [r12 + 0x10]
mov qword [rsp + 0x60], rax
call qword [sym.imp.USER32.dll_CreateMenu]
lea r9, [rsp + 0x30]
mov edx, 0x7fffffff
mov r8d, 1
mov rcx, rax
mov rbx, rax
mov dword [rsp + 0x40], 0x9c70
mov qword [rsp + 0x68], rsi
call qword [sym.imp.USER32.dll_InsertMenuItemW]
lea r9, [rsp + 0x30]
mov edx, 0x7fffffff
mov r8d, 1
mov rcx, rbx
mov dword [rsp + 0x40], 0x9c71
mov qword [rsp + 0x68], r15
call qword [sym.imp.USER32.dll_InsertMenuItemW]
lea rax, [0x1400b4e70]
lea r9, [rsp + 0x30]
mov edx, 0x7fffffff
mov r8d, 1
mov rcx, rbx
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x40], 0x9c56
call qword [sym.imp.USER32.dll_InsertMenuItemW]
lea rax, [0x1400adee8]
lea r9, [rsp + 0x30]
mov edx, 0x7fffffff
mov r8d, 1
mov rcx, rbx
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x40], 0x9c57
call qword [sym.imp.USER32.dll_InsertMenuItemW]
lea rax, [0x1400b4e90]
lea r9, [rsp + 0x30]
mov edx, 0x7fffffff
mov r8d, 1
mov rcx, rbx
mov dword [rsp + 0x40], 0x9c58
mov qword [rsp + 0x68], rax
call qword [sym.imp.USER32.dll_InsertMenuItemW]
lea rax, [0x1400b4eb0]
lea r9, [rsp + 0x30]
mov edx, 0x7fffffff
mov r8d, 1
mov rcx, rbx
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x40], 0x9c5a
call qword [sym.imp.USER32.dll_InsertMenuItemW]
xor r9d, r9d
mov r8b, 1
mov rdx, r12
mov rcx, rbx
call fcn.14004c790
call qword [sym.imp.USER32.dll_CreateMenu]
lea r9, [rsp + 0x30]
mov r15, rax
lea rax, [0x1400ad100]
mov edx, 0x7fffffff
mov r8d, 1
mov rcx, r15
mov dword [rsp + 0x40], 0x9c47
mov qword [rsp + 0x68], rax
call qword [sym.imp.USER32.dll_InsertMenuItemW]
lea rax, [0x1400b4ec0]
lea r9, [rsp + 0x30]
mov edx, 0x7fffffff
mov r8d, 1
mov rcx, r15
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x40], 0x9c48
call qword [sym.imp.USER32.dll_InsertMenuItemW]
lea rax, [0x1400b4ed0]
lea r9, [rsp + 0x30]
mov edx, 0x7fffffff
mov r8d, 1
mov rcx, r15
mov dword [rsp + 0x40], 0x9c49
mov qword [rsp + 0x68], rax
call qword [sym.imp.USER32.dll_InsertMenuItemW]
lea rax, [0x1400b4ee0]
lea r9, [rsp + 0x30]
mov edx, 0x7fffffff
mov r8d, 1
mov rcx, r15
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x34], 0x64
mov qword [rsp + 0x48], rbx
call qword [sym.imp.USER32.dll_InsertMenuItemW]
lea rax, [0x1400b4ef8]
lea r9, [rsp + 0x30]
mov edx, 0x7fffffff
mov r8d, 1
mov rcx, r15
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x34], 0x62
mov dword [rsp + 0x40], 0x9c46
call qword [sym.imp.USER32.dll_InsertMenuItemW]
cmp dword [0x1400d8fc0], 0x3c
jb 0x14004a7e9
mov rcx, qword [r12 + 0x50]
test rcx, rcx
jne 0x14004a7d7
mov rcx, qword [0x1400d60d0]
test rcx, rcx
jne 0x14004a7d7
mov qword [rsp + 0xa0], rcx
lea rcx, [rsp + 0xa8]
xor edx, edx
mov r8d, 0x2b0
call fcn.14009e740
lea r8, [rsp + 0xa0]
lea rcx, str..exe
mov r9d, 0x2b8
mov edx, 0x80
mov dword [rsp + 0x20], 0x111
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov rcx, qword [rsp + 0xa0]
mov qword [0x1400d60d0], rcx
mov edx, 0x10
mov r8d, edx
call sym.ProcessHacker.exe_PhIconToBitmap
mov rsi, rax
jmp 0x14004a7eb
xor esi, esi
mov dword [rsp + 0x34], 0xe4
mov qword [rsp + 0x78], rsi
mov rax, qword [r12 + 0x10]
mov qword [rsp + 0x60], rax
mov rax, qword [r12 + 0x10]
lea rcx, [rsp + 0x88]
mov qword [rsp + 0x88], rax
call sym.ProcessHacker.exe_PhGetClientIdName
mov rbx, rax
test rax, rax
je 0x14004a82c
mov rcx, rax
call sym.ProcessHacker.exe_PhaDereferenceObject
lea rax, [rbx + 0x10]
lea r9, [rsp + 0x30]
mov r8d, 1
mov edx, ebp
mov rcx, r14
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x68], rax
call qword [sym.imp.USER32.dll_InsertMenuItemW]
mov rax, qword [rsp + 0x3c8]
mov qword [r13 + rax], rsi
inc ebp
add r13, 8
lea rsi, [0x1400b4e58]
lea r15, [0x1400ab628]
cmp ebp, dword [rdi]
jb 0x14004a520
mov r15, qword [rsp + 0x370]
mov r13, qword [rsp + 0x380]
lea rcx, [rdi - 0x20]
or eax, 0xffffffff
lock xadd dword [rcx], eax
add eax, 0xffffffff
mov r14, qword [rsp + 0x378]
mov r12, qword [rsp + 0x388]
mov rsi, qword [rsp + 0x390]
mov rbp, qword [rsp + 0x3b0]
jne 0x14004a8be
call fcn.14001fcd0
mov eax, dword [rsp + 0x3b8]
test eax, eax
je 0x14004a902
mov rbx, qword [rsp + 0x80]
mov rdi, rax
nop word [rax + rax]
mov rcx, qword [rbx]
sub rcx, 0x20
or eax, 0xffffffff
lock xadd dword [rcx], eax
add eax, 0xffffffff
jne 0x14004a8f8
call fcn.14001fcd0
add rbx, 8
sub rdi, 1
jne 0x14004a8e0
mov r8, qword [rsp + 0x80]
mov rcx, qword [0x1400d8fb0]
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
add rsp, 0x398
pop rdi
pop rbx
ret