Function at 0x18009d880
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xf0]
sub rsp, 0x1f0
mov rax, qword [0x1801eef68]
xor rax, rsp
mov qword [rbp + 0xe0], rax
mov ebx, dword [rsp + 0x60]
lea r15d, [rcx - 0xb]
mov qword [rsp + 0x68], rdx
mov r12, r8
mov dword [rbp - 0x78], r15d
mov rdi, rdx
cmp ecx, r15d
jbe case.0x18009d912.0
lea r14d, [rcx - 0x1f]
xor r8d, r8d
mov dword [rsp + 0x50], r14d
lea r11, [0x180000000]
mov r10d, 0x1000
mov r9d, 0x800
mov edx, 0x120
cmp r14d, 0x25
ja case.0x18009d912.10
movzx eax, byte [r11 + r14 + 0x9e030]
mov ecx, dword [r11 + rax*4 + 0x9e004]
add rcx, r11
jmp rcx
cmp dword [r12 + 0x24], 0
je 0x18009d986
mov eax, dword [r12 + 0x60]
lea r9, [rbp - 0x60]
shl eax, 2
lea rcx, [rsp + 0x58]
mov qword [rbp - 0x60], rax
mov edx, 0x36
lea rax, [rsp + 0x50]
mov dword [rsp + 0x58], r8d
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], r8
mov r8, r12
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x70], 2
mov dword [rsp + 0x50], 3
mov dword [rsp + 0x78], 0xa8
call fcn.1800980f0
xor r8d, r8d
mov dword [r12 + 0x24], r8d
cmp dword [r12 + 0x12c], 0
je case.0x18009d912.10
cmp dword [r12 + 0x2c], 0
mov esi, r8d
jle 0x18009da2f
mov qword [rbp - 0x60], 1
mov rdi, r8
mov dword [rsp + 0x50], r8d
mov dword [rsp + 0x78], 2
mov dword [rsp + 0x58], 3
nop dword [rax]
nop dword [rax + rax]
mov rax, qword [r12 + 0x30]
lea r9, [rbp - 0x60]
mov edx, 0x36
mov ecx, dword [rdi + rax]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], r8
mov r8, r12
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
lea ecx, [rcx*4 + 0xa8]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x70], ecx
lea rcx, [rsp + 0x50]
call fcn.1800980f0
inc esi
lea rdi, [rdi + 0xc]
mov r8d, 0
cmp esi, dword [r12 + 0x2c]
jl 0x18009d9d0
mov rcx, qword [r12 + 0x30]
mov dword [r12 + 0x12c], r8d
mov dword [r12 + 0x2c], r8d
test rcx, rcx
je case.0x18009d912.10
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor r8d, r8d
mov qword [r12 + 0x30], r8
jmp case.0x18009d912.10
mov rcx, qword [r12 + 0x138]
test rcx, rcx
je 0x18009da7b
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor r8d, r8d
mov qword [r12 + 0x138], r8
mov ebx, r8d
jmp case.0x18009d912.10
mov rax, qword [r12 + 0x138]
lea r13, [rsp + 0x58]
mov dword [rbp - 0x48], r8d
mov dword [rsp + 0x58], 0xa8
mov rcx, qword [rax + 8]
mov eax, 0x36
mov qword [r12 + 0x130], rcx
nop dword [rax]
cmp eax, 0x99
ja 0x18009daf6
je 0x18009dcfa
cmp eax, 0x36
je 0x18009dcc4
cmp eax, 0x58
je 0x18009dcd4
cmp eax, 0x76
jne 0x18009dcc4
mov rcx, qword [r12]
test rcx, rcx
je 0x18009dcfa
cmp dword [rcx], 0x52530a0a
jne 0x18009dcfa
jmp 0x18009dcc4
mov ecx, eax
sub ecx, 0xd9
je 0x18009dcee
sub ecx, 0x11
je 0x18009db17
cmp ecx, 0x63
je 0x18009dcfa
jmp 0x18009dcc4
mov rdi, r12
nop word [rax + rax]
movzx r15d, byte [r13]
cmp r15b, 0x20
ja 0x18009dc18
mov r14d, 0x65
nop word [rax + rax]
mov eax, r14d
sub eax, 0x63
je 0x18009dc0a
sub eax, 1
je 0x18009dbfa
cmp eax, 1
jne 0x18009dbe8
test word [rdi + 0x18], r9w
je 0x18009dcfa
cmp word [rdi + 0x14], dx
jb 0x18009dcfa
xor r9d, r9d
lea edx, [rax + 0x32]
mov r8, rdi
xor ecx, ecx
call fcn.180029710
add rdi, 0x38
mov esi, 3
nop dword [rax]
dec esi
test rdi, rdi
je 0x18009dbd7
xor ecx, ecx
mov dword [rbp - 0x70], 1
mov qword [rsp + 0x40], rcx
lea rax, [rbp - 0x70]
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rcx
xor r8d, r8d
mov dword [rsp + 0x28], 0xc9
xor edx, edx
mov qword [rsp + 0x20], rcx
mov rcx, rdi
call fcn.18001f150
mov rdi, rax
test esi, esi
jne 0x18009db90
mov r10d, 0x1000
mov r9d, 0x800
mov edx, 0x120
dec r14d
cmp r14d, 0x62
ja 0x18009db40
jmp 0x18009dca0
test rdi, rdi
je 0x18009dcfa
or word [rdi + 0x18], r10w
jmp 0x18009dbe8
test r15b, r15b
je 0x18009dcbc
mov rdi, r12
jmp 0x18009dbe8
cmp r15b, 0x2d
jne 0x18009dc48
mov qword [rsp + 0x30], r8
mov r9d, reloc.SHELL32.dll_ILFindLastID
mov qword [rsp + 0x28], r8
mov rdx, rdi
mov qword [rsp + 0x20], r8
xor ecx, ecx
xor r8d, r8d
call fcn.180067aa0
mov rdi, rax
test rax, rax
jmp 0x18009dc9e
cmp r15b, 0x30
jbe 0x18009dca3
mov qword [rsp + 0x40], r8
lea eax, [r15 - 0x30]
mov dword [rbp - 0x68], eax
xor r9d, r9d
lea rax, [rbp - 0x68]
xor edx, edx
mov qword [rsp + 0x38], rax
mov rcx, rdi
mov qword [rsp + 0x30], r8
mov dword [rsp + 0x28], 0xc9
mov qword [rsp + 0x20], r8
xor r8d, r8d
call fcn.18001f150
mov rdi, rax
test rax, rax
je 0x18009dcfa
cmp byte [r13 + 1], 0x30
jb 0x18009dca0
movzx eax, byte [rax + 0x14]
add rdi, 0x38
and al, 0x20
je 0x18009dcfa
xor r8d, r8d
inc r13
mov edx, 0x120
mov r9d, 0x800
mov r10d, 0x1000
jmp 0x18009db20
mov eax, 0xea
xor r8d, r8d
add eax, 0x63
cmp eax, 0x2eb
jb 0x18009dab0
jmp 0x18009dcfa
mov rcx, qword [rbp - 0x48]
mov rdx, qword [pe_dos_header]
mov eax, dword [rcx]
mov dword [rdx], eax
movzx eax, word [rcx + 4]
mov word [rdx + 4], ax
jmp 0x18009dcfa
mov rcx, qword [r12]
movzx eax, byte [r13]
mov byte [rcx + 0x79], al
mov r9, r12
xor edx, edx
xor ecx, ecx
mov r8d, 0x92
call fcn.1800a32d0
mov rax, qword [r12 + 0x138]
mov rcx, qword [rax]
test rcx, rcx
je 0x18009de44
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, qword [r12 + 0x138]
xor r8d, r8d
mov qword [rax], r8
jmp 0x18009de47
mov rcx, qword [r12]
mov edx, dword [rcx]
lea eax, [rdx - 0x7f2bb708]
cmp eax, 2
ja 0x18009deb5
mov eax, dword [rdi]
mov rdx, qword [rcx + 0x20]
cmp rax, rdx
jb 0x18009de6f
cmp rax, qword [rcx + 0x28]
ja 0x18009de6f
mov rcx, qword [rcx + 0x40]
lea r8, [rbp - 0x80]
sub eax, edx
mov edx, 0xa3
mov dword [rbp - 0x80], eax
call fcn.18000cd80
mov ebx, eax
xor r8d, r8d
jmp case.0x18009d912.10
mov qword [rbp - 0x58], r8
mov dword [rsp + 0x60], 0x36
mov qword [rbp - 0x40], r8
jmp case.0x18009d912.10
mov edx, dword [rsp + 0x60]
lea rax, [rbp - 0x30]
mov rcx, qword [rbp - 0x58]
xor r9d, r9d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
mov r8, qword [rbp - 0x40]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathAndSubDirA]
xor r8d, r8d
mov rcx, r12
lea edx, [r8 + 0x6a]
call fcn.18007dc00
xor r8d, r8d
jmp case.0x18009d912.10
mov rcx, qword [r12 + 0x138]
test rcx, rcx
je 0x18009df4e
cmp dword [rcx + 0x24], 0
jne 0x18009df34
mov eax, dword [rcx + 0x28]
mov dword [r12 + 0x14], eax
cmp qword [rcx + 0x10], 0
je case.0x18009d912.10
mov rdx, qword [r12 + 0x138]
mov rdi, qword [rdx + 0x10]
mov rax, qword [rdi]
mov qword [rdx + 0x10], rax
mov rcx, qword [rdi + 0x18]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, qword [r12 + 0x138]
cmp qword [rax + 0x10], 0
jne 0x18009de01
xor r8d, r8d
jmp case.0x18009d912.10
mov rax, qword [rdi]
mov qword [rbp - 0x50], rax
jmp case.0x18009d912.10
xor r8d, r8d
mov r15d, dword [rbp - 0x78]
mov r14d, dword [rsp + 0x50]
dec r14d
mov dword [rsp + 0x50], r14d
lea eax, [r14 + 0x1f]
cmp eax, r15d
jbe case.0x18009d912.0
mov rdi, qword [rsp + 0x68]
jmp 0x18009d8dc
mov qword [rsp + 0x38], r8
lea rdx, [rbp - 0x80]
mov qword [rsp + 0x68], rcx
xor r9d, r9d
mov dword [rsp + 0x30], 1
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x68]
mov qword [rsp + 0x20], rcx
xor ecx, ecx
mov dword [rsp + 0x60], eax
mov dword [rbp - 0x80], 2
call fcn.180060810
xor eax, eax
jmp 0x18009dfd9
lea eax, [rdx - 0x7f2bb76d]
cmp eax, 2
ja 0x18009df46
mov qword [rsp + 0x30], r8
xor r9d, r9d
mov qword [rsp + 0x68], rcx
xor edx, edx
mov dword [rsp + 0x28], 1
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x20], r8
lea r8, [0x1801dd539]
call fcn.180060ae0
mov eax, dword [rdi]
lea rdx, [rbp - 0x58]
mov qword [rsp + 0x68], rax
mov r9d, 0x21
mov rax, qword [r12]
xor r8d, r8d
mov qword [rbp - 0x58], rax
xor ecx, ecx
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
call fcn.180093f10
jmp 0x18009dfd9
mov dword [rcx + 0x20], 1
mov rax, qword [r12 + 0x138]
dec dword [rax + 0x24]
mov eax, r8d
jmp 0x18009dfd9
lea r8, str.application_x_vnd.google.oneclickctrl.9
mov edx, 1
mov rcx, r12
call qword [r12 + pe_nt_image_headers64]
mov eax, 0xffffffff
jmp 0x18009dfd9
mov rcx, qword [r12]
cmp byte [rcx + 0x292], 0
je 0x18009df91
mov qword [rsp + 0x68], rcx
lea r8, [rsp + 0x68]
xor ecx, ecx
mov edx, 0xf7
call fcn.1800a0200
jmp 0x18009dfd9
mov rdx, qword [rbp - 0x50]
lea r8, [rbp - 0x50]
movzx eax, byte [rdx + 0x34]
mov byte [rcx + 0x594], al
movzx eax, word [rdx + 0x30]
mov rcx, qword [r12]
mov word [rcx + 0x596], ax
movzx eax, word [rdx + 0x32]
mov edx, 0xf7
mov rcx, qword [r12]
mov word [rcx + 0x598], ax
xor ecx, ecx
mov rax, qword [r12]
mov qword [rbp - 0x50], rax
call fcn.1800a0200
jmp 0x18009dfd9
mov eax, ebx
mov rcx, qword [rbp + 0xe0]
xor rcx, rsp
call fcn.1800d7250
mov rbx, qword [rsp + 0x230]
add rsp, 0x1f0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret