Function at 0x140004ec0
Capabilities:
Get common file path

Disassembly:
push rbp
lea rbp, [rsp - 0x2e0]
sub rsp, 0x3e0
mov rax, qword [0x14003c040]
xor rax, rsp
mov qword [rbp + 0x2b0], rax
cmp dword [0x140043580], 0
je 0x140004f0d
lea r8, str.KfInit__:_Already_initialized_n
mov edx, 0xd0
lea rcx, str.C:Users_adminDocumentsKforge2kforge_librarykforge_library.cpp
call fcn.140007260
mov eax, 1
jmp 0x1400054d1
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.RtlGetVersion
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140004f40
lea r8, str.ERROR:_Unable_to_obtain_needed_functions_n
mov edx, 0xd8
jmp 0x1400054c3
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], 0x114
call rax
and eax, 0xc0000000
cmp eax, 0xc0000000
jne 0x140004f6c
lea r8, str.KfInit___ERROR:_RtlGetVersion___fails_n
mov edx, 0xe1
jmp 0x1400054c3
cmp dword [rsp + 0x74], 0xa
jne 0x14000549f
mov eax, dword [rsp + 0x7c]
cmp eax, 0x6ad
jb 0x14000549f
mov qword [rsp + 0x3f8], rsi
lea r8, str.NT_version:__d._d._d_n
mov qword [rsp + 0x3f0], rbx
lea rcx, str.C:Users_adminDocumentsKforge2kforge_librarykforge_library.cpp
mov qword [rsp + 0x400], rdi
mov r9d, 0xa
mov dword [rsp + 0x28], eax
mov edx, 0xf1
mov eax, dword [rsp + 0x78]
mov qword [rsp + 0x3d8], r12
mov qword [rsp + 0x3c8], r14
mov qword [rsp + 0x3c0], r15
mov dword [rsp + 0x20], eax
call fcn.140007260
call fcn.140007600
xor esi, esi
test eax, eax
jne 0x140004ffc
lea r8, str.KfInit___ERROR:_DriverInit___fails_n
mov edx, 0xf9
jmp 0x14000542a
lea rcx, str.here_n
call fcn.1400016e0
mov ecx, 0xb
call fcn.1400070d0
mov rbx, rax
test rax, rax
je 0x14000541e
cmp dword [rax], esi
jbe 0x14000541e
mov rcx, qword [rax + 0x18]
mov edx, 0x104
mov qword [0x140043500], rcx
mov ecx, dword [rax + 0x20]
mov dword [0x140043508], ecx
lea rcx, [rbp + 0x1a0]
movzx r8d, word [rax + 0x2e]
add r8, 0x30
add r8, rax
call fcn.14001450c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov edx, 0x104
lea rcx, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea r8, [0x140036754]
mov edx, 0x104
lea rcx, [rbp + 0x90]
call fcn.140014600
lea r8, [rbp + 0x1a0]
mov edx, 0x104
lea rcx, [rbp + 0x90]
call fcn.140014600
lea r8, [rsp + 0x30]
mov qword [rsp + 0x38], rsi
lea rdx, [rsp + 0x38]
mov dword [rsp + 0x30], esi
lea rcx, [rbp + 0x90]
call fcn.140006ed0
test eax, eax
je 0x140005410
mov r15, qword [rsp + 0x38]
mov ecx, 0x40
mov edi, dword [r15 + 0x3c]
add rdi, r15
mov r12d, dword [rdi + 0x50]
movzx ebx, word [rdi + 0x14]
mov edx, r12d
add rbx, 0x20
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r14, rax
test rax, rax
je 0x140005169
mov r8d, r12d
xor edx, edx
mov rcx, rax
call fcn.140029240
mov r8d, dword [rdi + 0x54]
mov rdx, r15
mov rcx, r14
call fcn.140029600
xor eax, eax
cmp ax, word [rdi + 6]
jae 0x14000514a
add rbx, rdi
nop
mov ecx, dword [rbx + 8]
cmp ecx, dword [rbx]
mov edx, dword [rbx + 0xc]
cmovae ecx, dword [rbx]
add rdx, r15
mov r8d, ecx
mov ecx, dword [rbx + 4]
add rcx, r14
call fcn.140029600
movzx eax, word [rdi + 6]
lea rbx, [rbx + 0x28]
inc esi
cmp esi, eax
jb 0x140005120
mov rdx, qword [0x140043500]
mov rcx, r14
mov qword [0x140043578], r14
mov dword [0x14004350c], r12d
call fcn.140006dd0
jmp 0x1400051a2
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.M_ALLOC___ERROR__d_n_n
mov edx, 0x9d
mov r9d, eax
lea rcx, str.C:Users_adminDocumentsKforge2commonpeimage.cpp
call fcn.140007260
lea r8, str.KfInit___ERROR:_LdrMapImage___fails_n
mov edx, 0x11b
lea rcx, str.C:Users_adminDocumentsKforge2kforge_librarykforge_library.cpp
call fcn.140007260
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r10, qword [0x140043578]
xor esi, esi
test r10, r10
je 0x14000543d
mov eax, dword [r10 + 0x3c]
add rax, r10
movzx ecx, word [rax + 0x14]
movzx edx, word [rax + 6]
add rcx, 0x20
cmp si, dx
jae 0x14000539d
mov rbx, qword [0x140043500]
lea r14, [rcx + rax]
movzx r15d, byte [0x1400367c8]
mov r12d, edx
movups xmm0, xmmword [0x1400367b8]
mov qword [rsp + 0x3d0], r13
movzx r13d, word [0x1400367d0]
movups xmm1, xmmword [0x1400367a8]
nop dword [rax]
mov eax, dword [r14 + 0x1c]
and eax, 0x22000000
cmp eax, 0x20000000
jne 0x140005387
mov edi, dword [r14]
mov r11d, esi
sub edi, 0x100
je 0x140005387
mov eax, dword [0x1400367cc]
mov esi, dword [r14 + 4]
mov dword [rsp + 0x38], eax
movzx eax, word [0x1400367d4]
mov word [rsp + 0x30], ax
movzx eax, byte [0x1400367d6]
mov byte [rsp + 0x32], al
mov eax, dword [0x1400367d8]
mov dword [rsp + 0x40], eax
movzx eax, byte [0x1400367dc]
mov word [rsp + 0x3c], r13w
xor r13d, r13d
mov byte [rsp + 0x44], al
nop dword [rax]
lea r9d, [rsi + r11]
mov byte [rsp + 0x68], r15b
movups xmmword [rsp + 0x48], xmm1
mov rdx, r13
movups xmmword [rsp + 0x58], xmm0
nop word [rax + rax]
movzx r8d, byte [rsp + rdx + 0x48]
cmp r8b, 0xff
je 0x1400052b8
mov ecx, r9d
add rcx, rdx
cmp r8b, byte [rcx + r10]
jne 0x1400052ce
inc rdx
cmp rdx, 0x20
jl 0x1400052a0
mov ecx, r9d
add rcx, rbx
mov qword [0x140043510], rcx
mov rdx, r13
movzx r8d, byte [rsp + rdx + 0x38]
cmp r8b, 0xff
je 0x1400052e9
mov ecx, r9d
add rcx, rdx
cmp r8b, byte [rcx + r10]
jne 0x1400052ff
inc rdx
cmp rdx, 5
jl 0x1400052d1
mov ecx, r9d
add rcx, rbx
mov qword [0x140043560], rcx
mov rdx, r13
movzx r8d, byte [rsp + rdx + 0x30]
cmp r8b, 0xff
je 0x14000531a
mov ecx, r9d
add rcx, rdx
cmp r8b, byte [rcx + r10]
jne 0x140005330
inc rdx
cmp rdx, 2
jl 0x140005302
mov ecx, r9d
add rcx, rbx
mov qword [0x140043570], rcx
mov rax, r13
movzx r8d, byte [rsp + rax + 0x40]
cmp r8b, 0xff
je 0x14000534b
mov edx, r9d
add rdx, rax
cmp r8b, byte [rdx + r10]
jne 0x140005371
inc rax
cmp rax, 4
jl 0x140005333
mov ecx, r9d
add rcx, rbx
mov qword [0x140043588], rcx
lea ecx, [r11 + 3]
add ecx, esi
add rcx, rbx
mov qword [0x140043568], rcx
inc r11d
cmp r11d, edi
jb 0x140005280
movzx r13d, word [0x1400367d0]
xor esi, esi
add r14, 0x28
sub r12, 1
jne 0x140005210
mov r13, qword [rsp + 0x3d0]
cmp qword [0x140043510], 0
je 0x140005402
cmp qword [0x140043560], 0
je 0x140005402
cmp qword [0x140043570], 0
je 0x140005402
cmp qword [0x140043588], 0
je 0x140005402
cmp qword [0x140043568], 0
je 0x140005402
lea rcx, str.ZwTerminateThread
call fcn.140004c90
mov qword [0x140043518], rax
test rax, rax
jne 0x1400053f5
lea r8, str.KfInit___ERROR:_Unable_to_find_nt_ZwTerminateThread___address_n
mov edx, 0x190
jmp 0x14000542a
mov eax, 1
mov dword [0x140043580], eax
jmp 0x14000546d
lea r8, str.KfInit___ERROR:_Unable_to_find_needed_ROP_gadgets_n
mov edx, 0x180
jmp 0x14000542a
lea r8, str.KfInit___ERROR:_ReadFromFile___fails_n
mov edx, 0x122
jmp 0x14000542a
lea r8, str.KfInit___ERROR:_GetKernelImageInfo___fails_n
mov edx, 0x103
lea rcx, str.C:Users_adminDocumentsKforge2kforge_librarykforge_library.cpp
call fcn.140007260
mov r10, qword [0x140043578]
mov eax, dword [0x140043580]
test eax, eax
jne 0x14000546d
test r10, r10
je 0x140005462
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [0x140043578], rsi
mov dword [0x14004350c], esi
call fcn.140007af0
mov eax, dword [0x140043580]
mov r15, qword [rsp + 0x3c0]
mov r14, qword [rsp + 0x3c8]
mov r12, qword [rsp + 0x3d8]
mov rdi, qword [rsp + 0x400]
mov rsi, qword [rsp + 0x3f8]
mov rbx, qword [rsp + 0x3f0]
jmp 0x1400054d1
lea r8, str.KfInit__:_Unsupported_NT_version_n
mov edx, 0xe8
lea rcx, str.C:Users_adminDocumentsKforge2kforge_librarykforge_library.cpp
call fcn.140007260
lea r8, str.KfInit__:_Well__maybe_its_actually_supported_but_it_has_no_HVCI_so_theres_no_sense_to_use_this_project_n
mov edx, 0xe9
lea rcx, str.C:Users_adminDocumentsKforge2kforge_librarykforge_library.cpp
call fcn.140007260
xor eax, eax
mov rcx, qword [rbp + 0x2b0]
xor rcx, rsp
call fcn.140008700
add rsp, 0x3e0
pop rbp
ret