Function at 0x140009150
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xcc8
xor r9d, r9d
lea rdi, [0x14001e33a]
xor edx, edx
mov word [0x140031120], r9w
mov r15d, 0x1000
mov eax, 0x25
lea rsi, [0x140031120]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x28], rcx
jmp 0x1400091b8
test rdx, rdx
je 0x140009248
mov word [rdx], ax
add rdx, 2
movzx eax, word [rdi]
add rdi, 2
test ax, ax
je 0x140009268
cmp ax, 0x25
jne 0x140009198
test rdx, rdx
je 0x140009278
xor ecx, ecx
lea r14, [rsp + 0x4c0]
mov word [rdx], cx
lea rdx, str.TEMP
mov rcx, r14
call sub.msvcrt.dll__wcsicmp
test eax, eax
je 0x14000936b
lea rdx, str.PROGRAM
mov rcx, r14
call sub.msvcrt.dll__wcsicmp
test eax, eax
je 0x14000946b
lea rdx, [0x14001e38a]
mov rcx, r14
call sub.msvcrt.dll__wcsicmp
test eax, eax
je 0x140009398
lea rdx, str.TIME
mov rcx, r14
call sub.msvcrt.dll__wcsicmp
test eax, eax
je 0x140009291
xor eax, eax
add rsp, 0xcc8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
test r15, r15
je 0x14000922c
mov word [rsi], ax
movzx eax, word [rdi]
sub r15, 1
add rsi, 2
add rdi, 2
test ax, ax
jne 0x1400091b8
xor eax, eax
mov word [rsi], ax
mov eax, 1
jmp 0x14000922e
xor r8d, r8d
lea rdx, [rsp + 0x4c0]
mov word [rsp + 0x4c0], r8w
jmp 0x1400091a8
lea rcx, [rsp + 0x38]
lea rbx, [rsp + 0xc0]
mov rbp, r15
mov r14, rsi
mov qword [rsp + 0x38], 0
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov r9, qword [rsp + 0x38]
mov edx, 0x400
mov rcx, rbx
lea r8, str._lld
call fcn.140001a20
movzx eax, word [rsi]
test ax, ax
je 0x1400092e7
nop dword [rax]
add r14, 2
sub rbp, 1
cmp word [r14], 0
jne 0x1400092d8
movzx r13d, byte [rsp + 0xc0]
xor ecx, ecx
mov r9, rbx
add rbp, rbx
test r13b, r13b
je 0x14000937a
nop dword [rax]
mov rax, rbp
mov rbx, r14
sub rax, r9
test cx, cx
je 0x14000931e
nop
add rbx, 2
sub rax, 1
cmp word [rbx], 0
jne 0x140009310
mov qword [rsp + 0x20], r9
test rax, rax
je 0x14001cc60
mov rcx, rbx
call sub.msvcrt.dll_wcslen
mov rdx, qword [rsp + 0x28]
mov r8d, 2
mov byte [rsp + 0x40], r13b
lea rcx, [rbx + rax*2]
mov byte [rsp + 0x41], 0
call sub.msvcrt.dll_mbstowcs
mov r9, qword [rsp + 0x20]
movzx r13d, byte [r9 + 1]
add r9, 1
test r13b, r13b
je 0x140009377
movzx ecx, word [r14]
jmp 0x140009300
mov rdx, rsi
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
movzx eax, word [rsi]
test ax, ax
je 0x14000938e
nop
add rsi, 2
sub r15, 1
cmp word [rsi], 0
jne 0x140009380
xor edx, edx
jmp 0x1400091a8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [rsp + 0x28]
mov rbp, r15
mov r14, rsi
mov r9d, eax
lea r8, [0x14001e392]
mov edx, pe_nt_image_headers64
call fcn.140001a20
movzx eax, word [rsi]
test ax, ax
je 0x1400093d7
nop dword [rax]
add r14, 2
sub rbp, 1
cmp word [r14], 0
jne 0x1400093c8
mov rdx, qword [rsp + 0x28]
movzx r13d, byte [rsp + 0x40]
xor ecx, ecx
mov r12, rdx
add rbp, rdx
lea rdx, [rsp + 0xc0]
mov qword [rsp + 0x20], rdx
test r13b, r13b
je 0x14000937a
mov rax, rbp
mov rbx, r14
sub rax, r12
test cx, cx
je 0x14000941e
nop
add rbx, 2
sub rax, 1
cmp word [rbx], 0
jne 0x140009410
test rax, rax
je 0x14001cc60
mov rcx, rbx
add r12, 1
call sub.msvcrt.dll_wcslen
mov rdx, qword [rsp + 0x20]
mov r8d, 2
mov byte [rsp + 0xc0], r13b
lea rcx, [rbx + rax*2]
mov byte [rsp + 0xc1], 0
call sub.msvcrt.dll_mbstowcs
movzx r13d, byte [r12]
test r13b, r13b
je 0x140009377
movzx ecx, word [r14]
jmp 0x140009400
mov rax, qword [sym.imp.msvcrt.dll___wargv]
cmp word [rsi], 0
mov rdx, r15
mov rax, qword [rax]
mov rax, qword [rax]
mov rcx, qword [rax]
mov rax, rsi
je 0x14000949e
nop word [rax + rax]
add rax, 2
sub rdx, 1
cmp word [rax], 0
jne 0x140009490
movzx r8d, word [rcx]
test r8w, r8w
je 0x1400094d3
test rdx, rdx
jne 0x1400094b9
jmp 0x1400094e0
test rdx, rdx
je 0x14001cc60
add rcx, 2
mov word [rax], r8w
add rax, 2
sub rdx, 1
movzx r8d, word [rcx]
test r8w, r8w
jne 0x1400094b0
xor edx, edx
mov word [rax], dx
movzx eax, word [rsi]
jmp 0x14000937a
jmp 0x14001cc60
call sub.msvcrt.dll_abort
nop