Function at 0x14009f070
Capabilities:
Get common file path

Disassembly:
xchg r11, rsi
mov rsi, rsp
xchg rsi, r11
push rbp
lea rbp, [r11 - 0x3f8]
mov dword [rsp - 0x34], 0x5e6667b7
jmp 0x14009f0d0
xchg rsi, r15
mov qword [r11 - 0x20], rdi
lea rcx, [rbp + 0x120]
mov qword [r11 - 0x28], r14
mov dword [rsp - 0x3c], 0x53424c67
jmp 0x14009f11c
test al, al
jne 0x14009f0f4
jmp 0x14009f2d0
mov dword [rsp + 0x50], r9d
test r8b, r8b
je 0x14009f1fc
mov r11, r11
jmp 0x14009f154
sub rsp, 0x5c5ffa1e
add rsp, 0x5c5ff52e
mov rax, qword [0x14024f2e0]
xchg rdi, rdi
xor rax, rsp
jmp 0x14009f1c6
mov dword [rsp - 0x40], ecx
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
mov dword [rsp - 0x10], ebx
jmp 0x14009f0ad
sub edx, 0x4fea9e16
mov dword [rsp + 0x54], eax
mov dword [rsp - 0x20], ebx
jmp 0x14009f0ba
xchg rdx, r8
mov rdi, r8
xchg r8, rdx
xor r14d, r14d
movzx eax, r8b
mov dword [rsp + 0x48], r14d
mov rcx, rcx
jmp 0x14009f1e0
lea r8, [rbp + 0x120]
xor edx, edx
nop dword [rax]
nop word [rax + rax]
jmp 0x14009f0f0
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov eax, dword [0x140117d88]
lea rcx, [rbp - 0x24]
mov r8, r8
jmp 0x14009f18c
nop dword [rax + rax]
cmp byte [rcx + 1], r14b
lea rcx, [rcx + 1]
jne 0x14009f171
mov dword [rsp - 0x10], 0x5fd13fb2
jmp 0x14009f139
mov dword [rbp - 0x24], eax
dec rcx
movzx eax, byte [0x140117d8c]
mov byte [rbp - 0x20], al
mov dword [rsp - 0x28], 0x158434de
jmp 0x14009f16c
add edx, 0x63a58840
sub edx, 0x768b3326
add edx, 0x341b162a
add edx, 0x14c0db00
jmp 0x14009f109
mov qword [rbp + 0x3c0], rax
mov qword [r11 - 0x18], rsi
mov dword [rsp - 0x40], esi
xchg r15, rsi
mov r15, rcx
jmp 0x14009f08e
mov edx, 0x6c4699db
add edx, 0xb8726c5
sub edx, 0x5e359ee2
add edx, 0x5c3694
jmp 0x14009f1a9
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryA]
mov eax, dword [0x140117d88]
lea rcx, [rbp - 0x24]
jmp 0x14009f246
dec rcx
nop word [rax + rax]
xchg r15, r15
cmp byte [rcx + 1], r14b
lea rcx, [rcx + 1]
jne 0x14009f220
jmp 0x14009f266
cmp byte [rcx + 1], r14b
lea rcx, [rcx + 1]
jne 0x14009f233
jmp 0x14009f295
xchg r12, r12
mov dword [rbp - 0x24], eax
dec rcx
movzx eax, byte [0x140117d8c]
mov byte [rbp - 0x20], al
mov dword [rsp - 0x28], 0x3a85e2ad
jmp 0x14009f233
mov dword [rsp - 0x40], 0xa964f1
movzx eax, word [0x140117d90]
mov word [rcx], ax
mov eax, dword [rbp + 0x438]
jmp 0x14009f283
mov dword [rsp - 0x3c], edx
cmp eax, 0xffffffff
je 0x14009f2ec
jmp 0x14009f2d9
lea r8, [rbp + 0x120]
mov r10, r10
xor edx, edx
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
jmp 0x14009f2b6
mov r9, r9
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x14009f2ac
mov dword [rsp - 0x24], 0x120c2a13
lea rcx, [rbp - 0x24]
jmp 0x14009f211
mov dword [rbp + 0xd0], eax
mov dword [rsp - 0x18], 0x214990f2
jmp 0x14009f6b9
mov qword [rsp + 0x4e8], rbx
nop
movabs rbx, 0xffffffff75ad1da5
jmp 0x14009f5f0
add ecx, 0x14141f2
add ecx, 0x47fae9f6
xor ecx, 0x5e1230ad
add ecx, 0x3da0d171
sub ecx, 0x79a3cfa6
jmp 0x14009f46c
xor edx, 0x616a982b
sub edx, 0x1a2598a6
xor edx, 0x240e3146
add edx, 0x3649295a
jmp 0x14009f344
xor edx, 0x1f3425ce
add edx, 0x633ddce0
mov dword [rsp + 0x28], r14d
mov dword [rsp - 0x24], ebp
xchg r14, r11
mov qword [rsp + 0x20], r11
jmp 0x14009f766
sub r8d, 0x2170f2ab
add r8d, 0x2db1ae20
sub r8d, 0x3f9435f7
jmp 0x14009f520
mov dword [rsp - 0x3c], 0x371b0554
xor byte [rsp + 0x42], 0x34
xor byte [rsp + 0x43], 0x35
mov word [rsp + 0x44], ax
movzx eax, byte [0x140117d86]
xchg r13, r13
xor byte [rsp + 0x44], 0x36
jmp 0x14009f40a
sub edx, 0x1c95b941
mov dword [rbp + 0x114], eax
mov dword [rsp - 0x3c], 0x4e2e2c0
call fcn.1400e4868
xchg r9, rdi
jmp 0x14009f737
mov dword [rsp - 0x1c], ebx
mov byte [rsp + 0x40], socket
add byte [rsp + 0x40], 0x3f
add byte [rsp + 0x40], 0x21
sub byte [rsp + 0x40], 0x3b
add byte [rsp + 0x40], 0x40
xor byte [rsp + 0x40], 0x79
jmp 0x14009f773
xor rax, rdx
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x30], rdx
mov edx, 0x22acd953
jmp 0x14009f327
xor al, 0x38
xor byte [rsp + 0x45], 0x37
mov byte [rsp + 0x46], al
jmp 0x14009f3cc
add byte [rbp + 0xc8], 5
xor byte [rbp + 0xc8], 0x6d
xor byte [rbp + 0xc8], 0x43
jmp 0x14009f63c
xchg rbp, rbx
mov rbp, qword [rsp + 0x4e8]
xchg rbx, rbp
mov dword [rbp + 0xd0], 0x42a20777
add dword [rbp + 0xd0], 0x34990c67
jmp 0x14009f48e
mov r10, r10
jne 0x14009f690
mov dword [rbp - 0x28], ebx
jmp 0x14009f434
xchg r10, rax
mov qword [rbp + 0x20], r10
xchg r10, rax
mov byte [rbp + 0xc8], 0x26
add byte [rbp + 0xc8], 0x4c
xor byte [rbp + 0xc8], 0x7d
jmp 0x14009f41a
sub dword [rbp + 0xd0], 0x58d60bf5
add dword [rbp + 0xd0], 0x2de92bfd
sub dword [rbp + 0xd0], 0x2951e8ae
add dword [rbp + 0xd0], 0x30fbbb19
add dword [rbp + 0xd0], 0x14a2e26b
xor dword [rbp + 0xd0], 0x97651743
jmp 0x14009f6b9
xchg rbp, rbp
lea r8, [rsp + 0x50]
mov qword [rsp + 0x38], r14
movabs rdx, 0x9024ae7f12f4e7b8
jmp 0x14009f622
sub rdx, 0x192e738f
sub rdx, 0x349d4bf2
add rdx, 0x2a34959a
add rdx, 0x5b77e419
mov r9d, 0xeb624d5
add r9d, 0x11761708
add r9d, 0x5df8e50e
jmp 0x14009f57d
xor r8d, 0x3f0d9dcf
xor r8d, 0x7fa72c76
sub r8d, 0x11a71e3c
xor r8d, 0xf2e384d
sub r8d, 0x33d17451
call fcn.1400a9ad0
jmp 0x14009f5a8
call fcn.14009cdc0
mov dword [rsp - 0x24], 0x7223ce6f
mov eax, dword [0x140251720]
lea rcx, [rbp + 0xd4]
mov edx, 0x157256b8
add edx, 0x4d4f1088
sub edx, 0x2dc833b9
jmp 0x14009f69c
sub r9d, 0x2a898e1c
xor r9d, 0x12983d8d
sub r9d, 0x4103ad7a
mov rcx, qword [rax + 0x98]
mov rax, qword [0x140252090]
mov r8, r8
jmp 0x14009f3f3
mov r11, r11
mov eax, dword [str.n_f_vi]
lea r8, [rbp + 0x2b3]
mov dword [rsp + 0x40], eax
mov r9, r9
lea rdx, [rsp + 0x40]
jmp 0x14009f666
mov r14, qword [rsp + 0x4d0]
xchg rsi, r15
mov r15, qword [rsp + 0x4e0]
xchg rsi, r15
test eax, eax
mov dword [rsp - 0x14], esi
jne 0x14009f79f
jmp 0x14009f75b
xor rbx, 0x49fd3587
add rbx, 0x2c02b07f
xor rbx, 0x73299cd2
xor rbx, 0x71adcc66
add rbx, 0x7fffffff
add rbx, 0x152977eb
xchg rbx, rsi
jmp 0x14009f6ce
xor rdx, 0x12f90e52
add rdx, 0x60ef5c09
add rdx, 0x14e639cf
jmp 0x14009f4eb
sub byte [rbp + 0xc8], 0x39
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
movzx ecx, byte [rbp + 0x1a0]
mov dword [rsp - 0x28], ebp
lea rdx, [rbp + 0x2b0]
mov r8d, 0x4160556f
jmp 0x14009f366
movzx eax, word [0x140117d84]
lea rcx, [rbp + 0x28]
xor byte [rsp + 0x41], 0x33
jmp 0x14009f380
mov rdi, rdx
xchg rdx, rdi
call fcn.1400f0df0
mov r11, r11
nop dword [rax]
inc rbx
cmp byte [rdi + rbx], r14b
jmp 0x14009f45b
sub edx, 0x1f08cc26
add edx, 0x2ffb0ec8
sub edx, 0x6dd924b
xor edx, 0x23985ab1
jmp 0x14009f3ab
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp - 0xc], 0xc551915
mov ecx, eax
jmp 0x14009f708
mov r8, rsi
xchg rbx, rsi
nop dword [rax]
mov dword [rsp - 0x10], 0x72575d82
inc r8
cmp byte [rdi + r8], r14b
jne 0x14009f6e3
jmp 0x14009f6f5
xchg r15, r15
inc r8
lea rcx, [rsp + 0x58]
xchg rdx, rdi
jmp 0x14009f67b
lea rdx, [rbp + 0xcc]
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
mov dword [rsp - 0x1c], ecx
movsxd rax, dword [rbp + 0x428]
lea rdx, [rbp + 0x1a0]
mov ecx, 0x60733bcb
sub ecx, 0x479e981f
jmp 0x14009f304
mov r9, qword [rsp + 0x4d8]
xchg r9, rdi
test rax, rax
xchg r10, r10
je 0x14009f752
mov word [rax], r14w
mov rax, qword [rsi + 0x30]
jmp 0x14009f4cf
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14009f7a1
xchg r14, r11
call rax
xchg rcx, rcx
jmp 0x14009f5c9
add byte [rsp + 0x40], 0x63
sub byte [rsp + 0x40], 7
call fcn.14000ed10
lea r8, [0x140251700]
mov r8, r8
lea rdx, [0x140117d78]
lea rcx, [rbp + 0xd4]
jmp 0x14009f54d
xor eax, eax
xchg rdx, rcx
mov rdx, qword [rbp + 0x3c0]
xchg rdx, rcx
xor rcx, rsp
call fcn.1400e36a0
jmp 0x14009f7bc
ret
sub rsp, 0xfffffffffffffb10
mov r11, r11
nop
add rsp, 8
mov rbp, qword [rsp - 8]
jmp 0x14009f7bb