Function at 0x1800d0f60
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x170
mov rax, qword [0x180135928]
xor rax, rsp
mov qword [rsp + 0x160], rax
lea r15d, [rdx - 8]
mov r13, r8
mov ebp, edx
mov r12, rcx
cmp edx, r15d
jbe case.0x1800d0fd5.0
movzx edi, byte [rsp + 0x28]
lea r14d, [rdx - 0x10f]
mov rsi, qword [rsp + 0x20]
lea rdx, [0x180000000]
nop
cmp r14d, 0xe
ja case.0x1800d0fd5.7
mov ecx, dword [rdx + r14*4 + 0xd1280]
add rcx, rdx
jmp rcx
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180135a48], rax
mov byte [rsp + 0x20], 1
jmp case.0x1800d0fd5.7
xor r9d, r9d
mov r8, r13
xor edx, edx
mov ecx, 0x120
call fcn.180088610
test al, al
jne 0x1800d1243
mov ecx, 0xf5
nop
mov eax, ecx
sub eax, 0xf5
je 0x1800d1020
cmp eax, 0x71
je case.0x1800d0fd5.0
jmp 0x1800d1025
mov byte [rsp + 0x20], 0
add ecx, 0x71
cmp ecx, 0x1d7
jb 0x1800d1010
jmp 0x1800d1243
mov rdx, qword [r13 + 0x20]
mov r8d, 0xfc
mov rcx, qword [r13 + 0x30]
call fcn.18004e020
mov qword [0x180135a38], rax
jmp 0x1800d1243
mov eax, GetAcceptLanguagesA
nop dword [rax]
cmp eax, 0xb
je 0x1800d125d
add eax, 0x2d
cmp eax, 0x38
jb 0x1800d1060
cmp qword [0x180135a38], 0
jne case.0x1800d0fd5.7
mov byte [rsp + 0x20], 0
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.180106610
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rdx, qword [r13 + 0x20]
mov r8d, 0xfc
mov rcx, qword [r13 + 0x38]
call fcn.18004e020
mov qword [0x180135a40], rax
test rax, rax
jne 0x1800d1243
mov ebx, 0x44
cmp ebx, 0x1e3
ja 0x1800d1184
je 0x1800d117f
mov eax, ebx
sub eax, 0x44
je 0x1800d1176
sub eax, 0x53
je 0x1800d115c
sub eax, 0x53
je 0x1800d1139
sub eax, 0x53
je 0x1800d111e
cmp eax, 0x53
jne 0x1800d11d6
xor eax, eax
mov word [rsp + 0x44], ax
jmp 0x1800d11d6
mov eax, dword [0x180110dc4]
mov dword [rsp + 0x3e], eax
movzx eax, word [0x180110dc8]
mov word [rsp + 0x42], ax
jmp 0x1800d11d6
movzx eax, word [0x180110d3c]
movsd xmm0, qword [0x180110d34]
mov word [rsp + 0x3c], ax
xor eax, eax
mov word [rsp + 0x3e], ax
movsd qword [rsp + 0x34], xmm0
jmp 0x1800d11d6
mov r8d, 2
lea rdx, [0x180110dee]
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
jmp 0x1800d11d6
xor eax, eax
mov word [rsp + 0x30], ax
jmp 0x1800d11d6
mov dil, 1
jmp 0x1800d11d6
mov eax, ebx
sub eax, 0x289
je 0x1800d11b9
sub eax, 0x53
je 0x1800d11a9
sub eax, 0x53
je 0x1800d11a2
cmp eax, 0x53
je case.0x1800d0fd5.0
jmp 0x1800d11d6
mov byte [rsp + 0x20], 0
jmp 0x1800d11d6
test dil, dil
je 0x1800d11d6
mov rcx, rsi
call qword [sym.imp.GDI32.dll_DeleteEnhMetaFile]
jmp 0x1800d11d6
lea rcx, [rsp + 0x30]
call qword [sym.imp.GDI32.dll_GetEnhMetaFileW]
test rax, rax
movzx edi, dil
mov rsi, rax
mov eax, 0
cmove edi, eax
add ebx, 0x53
cmp ebx, 0x3d5
jb 0x1800d10e1
jmp 0x1800d1243
mov rdx, qword [r13 + 0x20]
mov r8d, 0xfc
mov rcx, qword [r13 + 0x28]
call fcn.18004e020
mov qword [0x180135a30], rax
test rax, rax
jne 0x1800d1243
mov ebx, 0x65
nop dword [rax + rax]
mov eax, ebx
sub eax, 0x63
je case.0x1800d0fd5.0
sub eax, 1
je 0x1800d1237
cmp eax, 1
jne 0x1800d123c
mov edx, 0x104
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x1800d123c
mov byte [rsp + 0x20], 0
dec ebx
cmp ebx, 0x62
ja 0x1800d1210
lea rdx, [0x180000000]
dec ebp
dec r14d
cmp ebp, r15d
ja 0x1800d0fc0
jmp case.0x1800d0fd5.0
mov eax, dword [r12]
lea rcx, [rsp + 0x20]
mov r8, qword [r13 + 8]
mov edx, 0x102
mov dword [rsp + 0x20], eax
call fcn.1800d21a0
jmp 0x1800d1088