Function at 0x140065af0
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5b8]
sub rsp, 0x6b0
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov rax, qword [0x1400fb088]
xor rax, rsp
mov qword [rbp + 0x5a0], rax
mov rbx, rcx
xor edi, edi
mov dword [rsp + 0x48], edi
xor edx, edx
mov r8d, 0x180
lea rcx, [rbp + 0x90]
call fcn.14008e5d0
lea rcx, [rbp + 0x90]
call fcn.14003fce0
nop
xor edx, edx
mov r8d, 0x180
lea rcx, [rbp + 0x210]
call fcn.14008e5d0
lea rcx, [rbp + 0x210]
call fcn.14003fce0
nop
xor edx, edx
mov r8d, 0x80
lea rcx, [rbp - 0x70]
call fcn.14008e5d0
lea rcx, [rbp - 0x70]
call fcn.140068ec0
nop
xor edx, edx
mov r8d, 0x80
lea rcx, [rbp + 0x10]
call fcn.14008e5d0
lea rcx, [rbp + 0x10]
call fcn.140068ec0
nop
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x390]
call fcn.14008e5d0
mov edx, 0x104
lea rcx, [rbp + 0x390]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], di
lea rdx, [rbp + 0x390]
lea rcx, [rsp + 0x50]
call fcn.1400056b0
nop
cmp byte [rbx], dil
je 0x140065cc6
movdqa xmm0, xmmword [0x1400dbe30]
movdqu xmmword [rbp - 0x80], xmm0
mov word [rsp + 0x70], di
mov dword [rsp + 0x48], 1
mov r8, qword [rsp + 0x60]
lea rdx, [r8 + 0x13]
cmp rdx, 8
jb 0x140065c35
lea rcx, [rsp + 0x70]
call fcn.14001eca0
mov qword [rbp - 0x80], rdi
mov r8, qword [rsp + 0x60]
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x70]
call fcn.14000a14c
mov r8d, 0x13
lea rdx, str.System32_ntdll.dll
lea rcx, [rsp + 0x70]
call fcn.14000a14c
mov r8b, 1
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x90]
call fcn.14003ff80
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x140065e8c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140065cbc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400664ef
call fcn.14006fa74
jmp 0x140065e8c
xor eax, eax
mov qword [rsp + 0x78], rax
movzx eax, byte [rbx + 1]
mov qword [rsp + 0x70], rdi
mov byte [rsp + 0x78], al
test al, al
je 0x140065cea
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
nop
movdqa xmm0, xmmword [0x1400dbe30]
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x20], di
mov dword [rsp + 0x48], 2
mov r8, qword [rsp + 0x60]
lea rdx, [r8 + 0x13]
cmp rdx, 8
jb 0x140065d28
lea rcx, [rsp + 0x20]
call fcn.14001eca0
mov qword [rsp + 0x30], rdi
mov r8, qword [rsp + 0x60]
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x20]
call fcn.14000a14c
mov r8d, 0x13
lea rdx, str.System32_ntdll.dll
lea rcx, [rsp + 0x20]
call fcn.14000a14c
mov r8b, 1
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x210]
call fcn.14003ff80
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x140065db2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140065dac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400664f5
call fcn.14006fa74
nop
movdqa xmm0, xmmword [0x1400dbe30]
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x20], di
mov dword [rsp + 0x48], 4
mov r8, qword [rsp + 0x60]
lea rdx, [r8 + 0x13]
cmp rdx, 8
jb 0x140065df0
lea rcx, [rsp + 0x20]
call fcn.14001eca0
mov qword [rsp + 0x30], rdi
mov r8, qword [rsp + 0x60]
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x20]
call fcn.14000a14c
mov r8d, 0x13
lea rdx, str.SysWOW64_ntdll.dll
lea rcx, [rsp + 0x20]
call fcn.14000a14c
mov r8b, 1
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x90]
call fcn.14003ff80
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x140065e7a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140065e74
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400664fb
call fcn.14006fa74
nop
cmp byte [rsp + 0x78], 0
je 0x140065e8c
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
mov r8, qword [rbp + 0xc0]
lea rdx, [rbp + 0x188]
lea rcx, [rbp - 0x70]
call fcn.140069390
cmp byte [rbx], 0
jne 0x140065ec7
test eax, eax
js 0x140066430
mov r8, qword [rbp + 0x240]
lea rdx, [rbp + 0x308]
lea rcx, [rbp + 0x10]
call fcn.140069390
test eax, eax
js 0x140066430
movdqa xmm0, xmmword [0x1400dbe30]
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x20], di
lea rdx, str.LdrpHandleTlsData
lea rcx, [rsp + 0x20]
call fcn.1400056b0
xor eax, eax
mov qword [rsp + 0x48], rax
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x30]
call fcn.1400422b0
mov rax, qword [rsp + 0x48]
cmp rax, qword [rbp - 0x28]
je 0x140065f26
mov ecx, dword [rax + 0x30]
add rcx, qword [rbp - 0x58]
mov qword [0x140100bb0], rcx
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x140065f68
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140065f63
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140066501
call fcn.14006fa74
movdqa xmm0, xmmword [0x1400dbe30]
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x20], di
lea rdx, str.LdrpHandleTlsData
lea rcx, [rsp + 0x20]
call fcn.1400056b0
xor eax, eax
mov qword [rsp + 0x48], rax
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x50]
call fcn.1400422b0
mov rax, qword [rsp + 0x48]
cmp rax, qword [rbp + 0x58]
je 0x140065fbf
mov ecx, dword [rax + 0x30]
add rcx, qword [rbp + 0x28]
mov qword [0x140100bb8], rcx
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x140066001
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140065ffc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140066507
call fcn.14006fa74
movdqa xmm0, xmmword [0x1400dbe30]
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x20], di
lea rdx, str.LdrpInvertedFunctionTable
lea rcx, [rsp + 0x20]
call fcn.1400056b0
xor eax, eax
mov qword [rsp + 0x48], rax
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x30]
call fcn.1400422b0
mov rax, qword [rsp + 0x48]
cmp rax, qword [rbp - 0x28]
je 0x140066058
mov ecx, dword [rax + 0x30]
add rcx, qword [rbp - 0x58]
mov qword [0x140100bc0], rcx
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x14006609a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140066095
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006650d
call fcn.14006fa74
movdqa xmm0, xmmword [0x1400dbe30]
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x20], di
lea rdx, str.LdrpInvertedFunctionTable
lea rcx, [rsp + 0x20]
call fcn.1400056b0
xor eax, eax
mov qword [rsp + 0x48], rax
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x50]
call fcn.1400422b0
mov rax, qword [rsp + 0x48]
cmp rax, qword [rbp + 0x58]
je 0x1400660f1
mov ecx, dword [rax + 0x30]
add rcx, qword [rbp + 0x28]
mov qword [0x140100bc8], rcx
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x140066133
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006612e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140066513
call fcn.14006fa74
movdqa xmm0, xmmword [0x1400dbe30]
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x20], di
lea rdx, str.RtlInsertInvertedFunctionTable
lea rcx, [rsp + 0x20]
call fcn.1400056b0
xor eax, eax
mov qword [rsp + 0x48], rax
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x30]
call fcn.1400422b0
mov rax, qword [rsp + 0x48]
cmp rax, qword [rbp - 0x28]
je 0x14006618a
mov ecx, dword [rax + 0x30]
add rcx, qword [rbp - 0x58]
mov qword [0x140100bd0], rcx
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x1400661cc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400661c7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140066519
call fcn.14006fa74
movdqa xmm0, xmmword [0x1400dbe30]
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x20], di
lea rdx, str.RtlInsertInvertedFunctionTable
lea rcx, [rsp + 0x20]
call fcn.1400056b0
xor eax, eax
mov qword [rsp + 0x48], rax
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x50]
call fcn.1400422b0
mov rax, qword [rsp + 0x48]
cmp rax, qword [rbp + 0x58]
je 0x140066223
mov ecx, dword [rax + 0x30]
add rcx, qword [rbp + 0x28]
mov qword [0x140100bd8], rcx
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x140066265
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140066260
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006651f
call fcn.14006fa74
movdqa xmm0, xmmword [0x1400dbe30]
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x20], di
lea rdx, str.LdrpReleaseTlsEntry
lea rcx, [rsp + 0x20]
call fcn.1400056b0
xor eax, eax
mov qword [rsp + 0x48], rax
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x30]
call fcn.1400422b0
mov rax, qword [rsp + 0x48]
cmp rax, qword [rbp - 0x28]
je 0x1400662bc
mov ecx, dword [rax + 0x30]
add rcx, qword [rbp - 0x58]
mov qword [0x140100be0], rcx
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x1400662fe
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400662f9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140066525
call fcn.14006fa74
movdqa xmm0, xmmword [0x1400dbe30]
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x20], di
lea rdx, str.LdrpReleaseTlsEntry
lea rcx, [rsp + 0x20]
call fcn.1400056b0
xor eax, eax
mov qword [rsp + 0x48], rax
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x50]
call fcn.1400422b0
mov rax, qword [rsp + 0x48]
cmp rax, qword [rbp + 0x58]
je 0x140066355
mov ecx, dword [rax + 0x30]
add rcx, qword [rbp + 0x28]
mov qword [0x140100be8], rcx
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x140066397
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140066392
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006652b
call fcn.14006fa74
movdqa xmm0, xmmword [0x1400dbe30]
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x20], di
lea rdx, str.LdrProtectMrdata
lea rcx, [rsp + 0x20]
call fcn.1400056b0
xor eax, eax
mov qword [rsp + 0x48], rax
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x30]
call fcn.1400422b0
mov rax, qword [rsp + 0x48]
cmp rax, qword [rbp - 0x28]
je 0x1400663ee
mov ecx, dword [rax + 0x30]
add rcx, qword [rbp - 0x58]
mov qword [0x140100bf0], rcx
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x140066430
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006642b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140066531
call fcn.14006fa74
lea rdx, [rbp + 0x210]
lea rcx, [rbp + 0x90]
call fcn.14006b0d0
mov ebx, eax
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x140066483
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006647e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400664e9
call fcn.14006fa74
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], di
lea rcx, [rbp + 0x10]
call fcn.140069290
nop
lea rcx, [rbp - 0x70]
call fcn.140069290
nop
lea rcx, [rbp + 0x210]
call fcn.14003fde0
nop
lea rcx, [rbp + 0x90]
call fcn.14003fde0
mov eax, ebx
mov rcx, qword [rbp + 0x5a0]
xor rcx, rsp
call fcn.14006fa50
lea r11, [rsp + 0x6b0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
call fcn.140097f2c
nop
call fcn.140097f2c
nop
call fcn.140097f2c
int3
call fcn.140097f2c
nop
call fcn.140097f2c
int3
call fcn.140097f2c
int3
call fcn.140097f2c
int3
call fcn.140097f2c
int3
call fcn.140097f2c
int3
call fcn.140097f2c
int3
call fcn.140097f2c
int3
call fcn.140097f2c
int3
call fcn.140097f2c
int3