Function at 0x14007a6b0
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x428]
sub rsp, 0x520
mov qword [rbp - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1404680d8]
xor rax, rsp
mov qword [rbp + 0x410], rax
mov rdi, rcx
lea rax, [rsp + 0x58]
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x58]
call fcn.14000b590
nop
mov rdx, rax
lea rcx, [0x14047aa00]
call fcn.14000b740
mov rcx, rax
lea rdx, str.Enter_UpdateMBUninstaller
call fcn.140036d30
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.14002c400
movzx edx, al
mov rcx, rbx
call fcn.14003af60
mov rcx, rbx
call fcn.14000bf70
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [0x1403e1a30]
movdqu xmmword [rbp - 0x20], xmm1
xor esi, esi
mov word [rbp - 0x30], si
lea r8d, [rsi + 9]
lea rdx, str.mbuns.exe
lea rcx, [rbp - 0x30]
call fcn.14000d3a0
nop
lea r8, [rbp - 0x30]
mov rdx, rdi
lea rcx, [rbp + 0x80]
call fcn.140082ed0
nop
lea rcx, [rbp - 0x30]
call fcn.14000c340
xor r8d, r8d
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x80]
call fcn.140098560
test al, al
je 0x14007ae31
cmp dword [rsp + 0x48], esi
jne 0x14007ae31
lea rax, [rsp + 0x58]
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x58]
call fcn.14000b590
nop
mov rdx, rax
lea rcx, [0x14047aa00]
call fcn.14000b740
mov rcx, rax
lea rdx, str.Found_mbuns.exe
call fcn.140036d30
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.14002c400
movzx edx, al
mov rcx, rbx
call fcn.14003af60
mov rcx, rbx
call fcn.14000bf70
mov dword [rsp + 0x48], esi
mov word [rsp + 0x58], si
mov word [rsp + 0x54], si
mov word [rsp + 0x50], si
mov word [rsp + 0x40], si
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x54]
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x80]
call fcn.140099100
lea rcx, [rsp + 0x68]
test al, al
lea rax, [rsp + 0x68]
mov qword [rsp + 0x58], rax
jne 0x14007a89d
call fcn.14000b590
nop
mov rdx, rax
lea rcx, [0x14047aa00]
call fcn.14000b740
mov rcx, rax
lea rdx, str.Error
call fcn.140036d30
mov rcx, rax
mov edx, dword [rsp + 0x48]
call fcn.1400283a0
lea rdx, str._calling_GetFileVersion
jmp 0x14007ae5c
call fcn.14000b590
nop
mov rdx, rax
lea rcx, [0x14047aa00]
call fcn.14000b740
mov rcx, rax
lea rdx, str.Build_number_of_mbuns.exe_is:
call fcn.140036d30
mov rcx, rax
movzx edi, word [rsp + 0x40]
movzx edx, di
call fcn.14005fab0
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.14002c400
movzx edx, al
mov rcx, rbx
call fcn.14003af60
mov rcx, rbx
call fcn.14000bf70
mov eax, 0x102
sub di, ax
lea rax, [rsp + 0x68]
lea rcx, [rsp + 0x68]
cmp di, 0x10
ja 0x14007ae0e
mov qword [rsp + 0x58], rax
call fcn.14000b590
nop
mov rdx, rax
lea rcx, [0x14047aa00]
call fcn.14000b740
mov rcx, rax
lea rdx, str.Updating_mbuns.exe...
call fcn.140036d30
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.14002c400
movzx edx, al
mov rcx, rbx
call fcn.14003af60
mov rcx, rbx
call fcn.14000bf70
xor edx, edx
mov r8d, 0x20a
lea rcx, [rbp + 0x200]
call fcn.140286140
lea rdx, [rbp + 0x200]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x14007a9df
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x68]
call fcn.14000b590
nop
mov rdx, rax
lea rcx, [0x14047aa00]
call fcn.14000b740
mov rcx, rax
lea rdx, str.Error
call fcn.140036d30
mov rcx, rax
mov edx, ebx
call fcn.1400283a0
lea rdx, str._calling_GetTempPath
jmp 0x14007ae5c
mov dword [rsp + 0x58], esi
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
movdqa xmm1, xmmword [0x1403e1a30]
movdqu xmmword [rbp - 0x68], xmm1
mov word [rbp - 0x78], si
mov r8d, 9
lea rdx, str.mbuns.exe
lea rcx, [rbp - 0x78]
call fcn.14000d3a0
nop
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
movdqa xmm1, xmmword [0x1403e1a30]
movdqu xmmword [rsp + 0x78], xmm1
mov word [rsp + 0x68], si
lea rax, [rbp + 0x200]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14007aa40
lea rdx, [rbp + 0x200]
lea rcx, [rsp + 0x68]
call fcn.14000d3a0
nop
lea r8, [rbp - 0x78]
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x10]
call fcn.140082ed0
nop
lea rcx, [rsp + 0x68]
call fcn.14000c340
nop
lea rcx, [rbp - 0x78]
call fcn.14000c340
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [0x1403e1a40]
movdqu xmmword [rbp - 0x20], xmm1
mov byte [rbp - 0x30], 0
mov r8d, 0x8b
lea rdx, str.https:__cdn.mwbsys.com_packages_mbam_c.installer.consumer_e_7_1_a_e71a2ac2a7571e9812f22cd6a8f58e6c_d95e2c6e_af07_4066_9430_363c94b08c31.exe
lea rcx, [rbp - 0x30]
call fcn.14000bc80
nop
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0xa0]
call fcn.14007ed70
nop
mov qword [rbp + 0x28], rsi
mov qword [rbp + 0x30], rsi
mov qword [rbp + 0x28], rsi
mov qword [rbp + 0x30], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x18], 0
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x50], xmm0
movdqa xmm1, xmmword [0x1403e1a40]
movdqa xmmword [rbp + 0x50], xmm1
mov byte [rbp + 0x40], 0
movdqa xmmword [rbp + 0x70], xmm0
movdqa xmmword [rbp + 0x70], xmm1
mov byte [rbp + 0x60], 0
mov word [rbp + 0x10], 0
mov word [rbp + 0x38], si
xor edx, edx
mov r8d, 0x138
lea rcx, [rbp + 0xc0]
call fcn.140286140
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x48], xmm0
movdqa xmm1, xmmword [0x1403e1a40]
movdqu xmmword [rbp - 0x48], xmm1
mov byte [rbp - 0x58], 0
mov r8d, 9
lea rdx, str.MBUpdater
lea rcx, [rbp - 0x58]
call fcn.14000bc80
nop
lea r9, [rbp + 0x10]
lea r8, [rbp - 0x58]
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0xc0]
call fcn.1400c4970
nop
lea rcx, [rbp - 0x58]
call fcn.14000bc00
lea rcx, [rbp + 0xd0]
call fcn.1400cadc0
test al, al
je 0x14007ab9d
lea rcx, [rbp + 0xd0]
call fcn.14000d5d0
mov rcx, rax
mov edx, 0x1388
call fcn.1400e0c10
lea rcx, [rbp + 0xd0]
call fcn.1400cadc0
test al, al
je 0x14007abc6
lea rcx, [rbp + 0xd0]
call fcn.14000d5d0
mov rcx, rax
mov edx, 0x2710
call fcn.1400e0c70
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov byte [rsp + 0x20], 0
lea r9, [rsp + 0x58]
lea r8, [rbp + 0xa0]
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0xc0]
call fcn.1400c65a0
lea rcx, [rsp + 0x68]
test al, al
lea rax, [rsp + 0x68]
je 0x14007ad56
mov qword [rsp + 0x58], rax
call fcn.14000b590
nop
mov rdx, rax
lea rcx, [0x14047aa00]
call fcn.14000b740
mov rcx, rax
lea rdx, str.Successfully_downloaded_new_mbuns.exe
call fcn.140036d30
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.14002c400
movzx edx, al
mov rcx, rbx
call fcn.14003af60
mov rcx, rbx
call fcn.14000bf70
mov byte [rsp + 0x40], 0
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 8
cmovae rcx, qword [rbp - 0x10]
mov byte [rsp + 0x20], 1
lea rdx, [rsp + 0x40]
call fcn.1400d5610
test eax, eax
jne 0x14007ad21
cmp byte [rsp + 0x40], al
je 0x14007ad21
lea r9, [rsp + 0x48]
xor r8d, r8d
lea rdx, [rbp + 0x80]
lea rcx, [rbp - 0x10]
call fcn.140092550
lea rcx, [rsp + 0x68]
test al, al
lea rax, [rsp + 0x68]
je 0x14007acdb
mov qword [rsp + 0x48], rax
call fcn.14000b590
nop
mov rdx, rax
lea rcx, [0x14047aa00]
call fcn.14000b740
mov rcx, rax
lea rdx, str.Successfully_copied_new_mbuns.exe
call fcn.140036d30
jmp 0x14007ad8b
mov qword [rsp + 0x58], rax
call fcn.14000b590
nop
mov rdx, rax
lea rcx, [0x14047aa00]
call fcn.14000b740
mov rcx, rax
lea rdx, str.Error
call fcn.140036d30
mov rcx, rax
mov edx, dword [rsp + 0x48]
call fcn.1400283a0
mov rcx, rax
lea rdx, str._calling_Copy
call fcn.140036d30
jmp 0x14007ad8b
lea rax, [rsp + 0x68]
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x68]
call fcn.14000b590
nop
mov rdx, rax
lea rcx, [0x14047aa00]
call fcn.14000b740
mov rcx, rax
lea rdx, str.Failed_to_verify_file_mbuns.exe
call fcn.140036d30
jmp 0x14007ad8b
mov qword [rsp + 0x48], rax
call fcn.14000b590
nop
mov rdx, rax
lea rcx, [0x14047aa00]
call fcn.14000b740
mov rcx, rax
lea rdx, str.Download_of_mbuns.exe_failed._Status_code:
call fcn.140036d30
mov rcx, rax
mov edx, dword [rsp + 0x58]
call fcn.140028560
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
mov rbx, rax
mov dl, 0xa
add rcx, rax
call fcn.14002c400
movzx edx, al
mov rcx, rbx
call fcn.14003af60
mov rcx, rbx
call fcn.14000bf70
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x10]
call fcn.1400927b0
nop
lea rcx, [rbp + 0xc0]
call fcn.1400c4b00
nop
lea rcx, [rbp + 0x60]
call fcn.14000bc00
nop
lea rcx, [rbp + 0x40]
call fcn.14000bc00
nop
lea rcx, [rbp + 0x18]
call fcn.14000bc00
nop
lea rcx, [rbp + 0xa0]
call fcn.14000bc00
nop
lea rcx, [rbp - 0x30]
call fcn.14000bc00
nop
lea rcx, [rbp - 0x10]
call fcn.14000c340
jmp 0x14007ae8c
mov qword [rsp + 0x48], rax
call fcn.14000b590
nop
mov rdx, rax
lea rcx, [0x14047aa00]
call fcn.14000b740
lea rdx, str.Not_updating_mbuns.exe__already_updated_
jmp 0x14007ae5c
lea rax, [rsp + 0x68]
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x68]
call fcn.14000b590
nop
mov rdx, rax
lea rcx, [0x14047aa00]
call fcn.14000b740
lea rdx, str.File_mbuns.exe_not_found
mov rcx, rax
call fcn.140036d30
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
mov rbx, rax
mov dl, 0xa
add rcx, rax
call fcn.14002c400
movzx edx, al
mov rcx, rbx
call fcn.14003af60
mov rcx, rbx
call fcn.14000bf70
nop
lea rcx, [rbp + 0x80]
call fcn.14000c340
mov rcx, qword [rbp + 0x410]
xor rcx, rsp
call fcn.140282c10
lea r11, [rsp + 0x520]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret