Function at 0x14002d310
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x318
lea rbp, [rsp + 0x80]
mov rsi, r9
mov r15, r8
mov rdi, rdx
mov rbx, rcx
mov rcx, qword [0x140064970]
test rcx, rcx
jne 0x14002d370
lea rax, [0x140056980]
mov qword [0x140064980], rax
lea rcx, [0x140064980]
mov dword [0x140064988], 0
mov byte [0x14006498c], 1
mov qword [0x140064970], rcx
mov r14, qword [rbp + 0x330]
mov r12, qword [rbp + 0x320]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140068010]
cmp byte [rax + 4], 0
je 0x14002d401
mov rax, qword [rbp + 0x328]
mov rcx, qword [rbp + 0x318]
mov edx, dword [rbp + 0x310]
mov r8d, dword [rbp + 0x308]
mov r9, qword [rbp + 0x300]
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], r8d
mov rcx, rdi
mov rdx, r15
mov r8, rsi
mov rax, rbx
call qword [0x140068010]
mov esi, 1
test eax, eax
je 0x14002d401
mov eax, esi
add rsp, 0x318
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rcx, str.CreateProcessA
mov rdx, rdi
call fcn.14003aae0
mov rcx, qword [0x140064970]
test rcx, rcx
jne 0x14002d449
lea rax, [0x140056980]
mov qword [0x140064980], rax
lea rcx, [0x140064980]
mov dword [0x140064988], 0
mov byte [0x14006498c], 1
mov qword [0x140064970], rcx
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140068010]
xor esi, esi
cmp dword [rax], 0
jle 0x14002d3eb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov edx, 0x18
mov rcx, r14
mov r8d, 1
call fcn.14004c540
call fcn.14004c3e0
test al, al
je 0x14002d48d
mov r13, qword [0x1400648f8]
test r13, r13
jne 0x14002d49a
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14002d3eb
test r15, r15
jne 0x14002d4d9
xor eax, eax
mov qword [rbp + 0x288], rax
test rdi, rdi
jne 0x14002d4f2
xor eax, eax
mov qword [rbp + 0x280], rax
test r12, r12
jne 0x14002d525
xor eax, eax
mov qword [rbp + 0x278], rax
cmp qword [rbp + 0x288], 0
jne 0x14002d575
xor eax, eax
jmp 0x14002d580
mov rcx, r15
call fcn.14004cdc0
mov rcx, rax
mov qword [rbp + 0x288], rax
test rax, rax
je 0x14002d48d
jmp 0x14002d4a8
mov rcx, rdi
call fcn.14004cdc0
mov rcx, rax
mov qword [rbp + 0x280], rax
test rax, rax
jne 0x14002d4b6
mov rax, qword [0x140064a28]
mov rcx, qword [0x1400648e8]
xor edx, edx
mov r8, qword [rbp + 0x288]
jmp 0x14002d8cb
mov rcx, r12
call fcn.14004cdc0
mov rcx, rax
mov qword [rbp + 0x278], rax
test rax, rax
jne 0x14002d4c4
mov rax, qword [0x140064a28]
mov rcx, qword [0x1400648e8]
xor edx, edx
mov r8, qword [rbp + 0x288]
call qword [0x140068010]
mov rax, qword [0x140064a28]
mov rcx, qword [0x1400648e8]
xor edx, edx
mov r8, qword [rbp + 0x280]
jmp 0x14002d8cb
mov rax, qword [rbp + 0x288]
mov rax, qword [rax + 8]
mov qword [rbp + 0x268], rax
cmp qword [rbp + 0x280], 0
jne 0x14002d596
xor r15d, r15d
jmp 0x14002d5a1
mov rax, qword [rbp + 0x280]
mov r15, qword [rax + 8]
cmp qword [rbp + 0x278], 0
jne 0x14002d5af
xor eax, eax
jmp 0x14002d5ba
mov rax, qword [rbp + 0x278]
mov rax, qword [rax + 8]
mov qword [rbp + 0x270], rax
lea r12, [rbp - 0x30]
mov ecx, 0x104
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add eax, 0xfffffefc
xor ecx, ecx
mov dword [rbp + 0x264], eax
cmp eax, 0xfffffefd
cmovae rcx, r12
mov qword [rbp + 0x258], rcx
lea rcx, [rbp + 0x240]
mov qword [rcx], r13
mov rax, qword [r13 + 0x10]
add rax, r13
mov qword [rbp + 0x250], rax
mov qword [rcx + 8], rax
xorps xmm0, xmm0
movaps xmmword [rbp + 0x220], xmm0
movaps xmmword [rbp + 0x210], xmm0
movaps xmmword [rbp + 0x200], xmm0
movaps xmmword [rbp + 0x1f0], xmm0
movaps xmmword [rbp + 0x1e0], xmm0
mov qword [rbp + 0x230], 0
call fcn.14004e150
mov qword [rbp + 0x290], rax
test rax, rax
je 0x14002d87a
mov rax, qword [rbp + 0x290]
mov qword [rax], 0xd
mov dword [rax + 0x60], 5
mov dword [rax + 0x6c], 0xb0
test r15, r15
je 0x14002d69c
mov rcx, r15
call fcn.140040040
mov r12, rax
add r12d, r12d
cmp r12d, 0x400
ja 0x14002d87a
cmp r12d, 0x350
jbe 0x14002d69f
jmp 0x14002d87a
xor r12d, r12d
mov rax, qword [rbp + 0x290]
lea rcx, [rax + 0xb0]
mov rdx, r15
mov r8, r12
call fcn.14002c6e0
mov rcx, qword [rbp + 0x290]
mov eax, dword [rcx + 0x6c]
lea r15d, [r12 + rax]
add r15d, 7
and r15d, 0xfffffff8
mov dword [rcx + 0x78], r15d
mov dword [rcx + 0x70], r12d
mov dword [rcx + 0x68], 1
cmp qword [rbp + 0x268], 0
je 0x14002d70b
mov rcx, qword [rbp + 0x268]
call fcn.140040040
mov r12, rax
add r12d, r12d
cmp r12d, 0x400
ja 0x14002d87a
mov r8d, r12d
jmp 0x14002d711
xor r8d, r8d
xor r12d, r12d
mov ecx, r15d
mov eax, 0x400
sub rax, r8
cmp rax, rcx
jb 0x14002d87a
add rcx, qword [rbp + 0x290]
mov rdx, qword [rbp + 0x268]
call fcn.14002c6e0
mov rcx, qword [rbp + 0x290]
mov eax, dword [rcx + 0x78]
lea r15d, [r12 + rax]
add r15d, 7
and r15d, 0xfffffff8
mov dword [rcx + 0x84], r15d
mov dword [rcx + 0x7c], r12d
mov dword [rcx + 0x74], 1
cmp dword [rbp + 0x264], 0xfffffefd
jae 0x14002d774
xor r8d, r8d
xor r12d, r12d
jmp 0x14002d796
mov rcx, qword [rbp + 0x258]
call fcn.140040040
mov r12, rax
add r12d, r12d
cmp r12d, 0x400
ja 0x14002d87a
mov r8d, r12d
mov ecx, r15d
mov eax, 0x400
sub rax, r8
cmp rax, rcx
jb 0x14002d87a
add rcx, qword [rbp + 0x290]
mov rdx, qword [rbp + 0x258]
call fcn.14002c6e0
mov rcx, qword [rbp + 0x290]
mov eax, dword [rcx + 0x84]
lea r15d, [r12 + rax]
add r15d, 7
and r15d, 0xfffffff8
mov dword [rcx + 0x90], r15d
mov dword [rcx + 0x88], r12d
mov dword [rcx + 0x80], 1
cmp qword [rbp + 0x270], 0
je 0x14002d818
mov rcx, qword [rbp + 0x270]
call fcn.140040040
mov r12, rax
add r12d, r12d
cmp r12d, 0x400
ja 0x14002d87a
mov r8d, r12d
jmp 0x14002d81e
xor r8d, r8d
xor r12d, r12d
mov ecx, r15d
mov eax, 0x400
sub rax, r8
cmp rax, rcx
jb 0x14002d87a
add rcx, qword [rbp + 0x290]
mov rdx, qword [rbp + 0x270]
call fcn.14002c6e0
mov rcx, qword [rbp + 0x290]
mov eax, dword [rcx + 0x90]
add eax, r12d
add eax, 7
and eax, 0xfffffff8
mov dword [rcx + 0x9c], eax
mov dword [rcx + 0x94], r12d
mov dword [rcx + 0x8c], 1
test r14, r14
je 0x14002d87a
cmp eax, 0x3e8
jbe 0x14002d8d6
mov rax, qword [0x140064a28]
mov rcx, qword [0x1400648e8]
xor edx, edx
mov r8, qword [rbp + 0x288]
call qword [0x140068010]
mov rax, qword [0x140064a28]
mov rcx, qword [0x1400648e8]
xor edx, edx
mov r8, qword [rbp + 0x280]
call qword [0x140068010]
mov rax, qword [0x140064a28]
mov rcx, qword [0x1400648e8]
xor edx, edx
mov r8, qword [rbp + 0x278]
call qword [0x140068010]
jmp 0x14002d48d
mov ecx, eax
add rcx, qword [rbp + 0x290]
mov r8d, 0x18
mov rdx, r14
call fcn.14002c6e0
mov rdx, qword [rbp + 0x290]
mov dword [rdx + 4], 1
mov eax, dword [rdx + 0x9c]
add eax, 0x1f
and eax, 0xfffffff8
mov dword [rdx + 0xa8], eax
mov dword [rdx + 0xa0], 0x18
mov dword [rdx + 0x98], 6
lea rcx, [rbp + 0x240]
lea r8, [rbp + 0x1e0]
call fcn.14004e290
cmp eax, 0xa
je 0x14002d87a
mov r12d, eax
add r13, 0x10
mov r15, qword [rbp + 0x290]
mov r8d, dword [r15 + 0x9c]
add r8, r15
mov ecx, 0x18
mov rdx, r14
call fcn.14003b6c0
sub r15, qword [rbp + 0x250]
lea rcx, [r15 + 0x3ff]
test r15, r15
cmovns rcx, r15
sar rcx, 0xa
lea rcx, [rcx + rcx*4]
mov edx, 1
xchg dword [r13 + rcx*8 + 8], edx
mov r14d, eax
mov rax, qword [0x140064a28]
mov rcx, qword [0x1400648e8]
xor edx, edx
mov r8, qword [rbp + 0x288]
call qword [0x140068010]
mov rax, qword [0x140064a28]
mov rcx, qword [0x1400648e8]
xor edx, edx
mov r8, qword [rbp + 0x280]
call qword [0x140068010]
mov rax, qword [0x140064a28]
mov rcx, qword [0x1400648e8]
xor edx, edx
mov r8, qword [rbp + 0x278]
call qword [0x140068010]
test r14b, r14b
je 0x14002d48d
test r12d, r12d
jne 0x14002d48d
mov ecx, dword [rbp + 0x1e8]
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
cmp dword [rbp + 0x1e8], 0
jne 0x14002d3eb
mov rax, qword [0x140062dc0]
mov esi, 1
test rax, rax
je 0x14002d3eb
mov qword [rsp + 0x20], 0
lea rcx, str.Broker_ALLOWED
lea rdx, str.CreateProcessA
mov r8, rdi
xor r9d, r9d
call qword [0x140068010]
jmp 0x14002d3eb