Function at 0x14018ee70
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x230]
sub rsp, 0x330
mov rax, qword [0x1405f98c0]
xor rax, rsp
mov qword [rbp + 0x220], rax
mov rdi, rdx
mov rbx, rcx
xor r15d, r15d
call fcn.1401a9780
mov rsi, rax
mov rax, qword [rbx + 0x10]
movabs r14, 0x7ffffffffffffffe
mov rcx, r14
sub rcx, rax
cmp rcx, 0xb
jb 0x14018f38b
mov r9, rbx
cmp qword [rbx + 0x18], 7
jbe 0x14018eed8
mov r9, qword [rbx]
mov qword [rsp + 0x30], recv
lea rcx, str.databases_
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea rcx, [rbp - 0x58]
call fcn.1400d6400
nop
lea rdx, [rbp - 0x58]
cmp qword [rbp - 0x40], 7
cmova rdx, qword [rbp - 0x58]
mov rcx, rsi
call fcn.1401a98c0
mov rax, qword [rbx + 0x10]
sub r14, rax
cmp r14, 0x11
jb 0x14018f391
cmp qword [rbx + 0x18], 7
jbe 0x14018ef2d
mov rbx, qword [rbx]
mov qword [rsp + 0x30], setsockopt
lea rcx, str._shadow_crash.exe
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
mov r9, rbx
lea rcx, [rbp - 0x78]
call fcn.1400d6400
nop
lea rdx, [rbp - 0x78]
cmp qword [rbp - 0x60], 7
cmova rdx, qword [rbp - 0x78]
mov rcx, rsi
call fcn.1401a9920
lea rdx, str.ShadowProcessator_3.2.3
mov rcx, rsi
call fcn.1401a9950
cmp qword [rdi + 0x18], 0xf
jbe 0x14018ef83
mov rdi, qword [rdi]
mov rdx, rdi
mov rcx, rsi
call fcn.1401a98f0
mov edx, 0x208
lea rcx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r15
mov qword [rbp - 0x80], r15
lea rax, [rbp + 0x10]
mov rdi, 0xffffffffffffffff
mov r8, rdi
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14018efc0
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x68]
call fcn.1400c71d0
nop
mov r14, qword [rsp + 0x78]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
sub rax, r14
cmp rax, 0x20
jb 0x14018f025
lea rax, [r14 + 0x20]
mov qword [rsp + 0x78], rax
lea rbx, [rsp + 0x68]
cmp rcx, 7
cmova rbx, qword [rsp + 0x68]
lea rcx, [rbx + r14*2]
mov r8d, 0x40
lea rdx, str.winevtLogsShadowServices.evtx
call fcn.14043cc20
mov word [rbx + r14*2 + 0x40], r15w
jmp 0x14018f044
mov qword [rsp + 0x20], 0x20
lea r9, str.winevtLogsShadowServices.evtx
mov edx, 0x20
lea rcx, [rsp + 0x68]
call fcn.1400d65d0
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], r15
lea rax, [rbp + 0x10]
nop word [rax + rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x14018f060
mov r8, rdi
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x48]
call fcn.1400c71d0
nop
mov rdi, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
sub rax, rdi
cmp rax, 0x1d
jb 0x14018f0c8
lea rax, [rdi + 0x1d]
mov qword [rsp + 0x58], rax
lea rbx, [rsp + 0x48]
cmp rcx, 7
cmova rbx, qword [rsp + 0x48]
lea rcx, [rbx + rdi*2]
mov r8d, 0x3a
lea rdx, str.winevtLogsApplication.evtx
call fcn.14043cc20
mov word [rbx + rdi*2 + 0x3a], r15w
jmp 0x14018f0e7
mov qword [rsp + 0x20], 0x1d
lea r9, str.winevtLogsApplication.evtx
mov edx, 0x1d
lea rcx, [rsp + 0x48]
call fcn.1400d65d0
lea rdx, [rsp + 0x48]
cmp qword [rsp + 0x60], 7
cmova rdx, qword [rsp + 0x48]
mov rcx, rsi
call fcn.1401a9610
lea rdx, [rsp + 0x68]
cmp qword [rbp - 0x80], 7
cmova rdx, qword [rsp + 0x68]
mov rcx, rsi
call fcn.1401a9610
lea rcx, [rbp - 0x18]
call fcn.14010e650
nop
mov rdx, rax
lea rcx, [rbp - 0x38]
call fcn.1401845b0
cmp qword [rax + 0x18], 7
jbe 0x14018f138
mov rax, qword [rax]
mov rdx, rax
mov rcx, rsi
call fcn.1401a9610
mov rdx, qword [rbp - 0x20]
cmp rdx, 7
jbe 0x14018f183
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14018f17e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14018f397
call fcn.1403e3650
movdqa xmm0, xmmword [0x14057a8b0]
movdqu xmmword [rbp - 0x28], xmm0
mov word [rbp - 0x38], r15w
mov rdx, qword [rbp]
cmp rdx, 0xf
jbe 0x14018f1d0
inc rdx
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14018f1cb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14018f39d
call fcn.1403e3650
mov rcx, rsi
call fcn.1401ab450
test eax, eax
je 0x14018f1ec
lea rcx, str.could_not_setup_crashpad_logger__aborting
call fcn.1400d5230
xor bl, bl
jmp 0x14018f224
lea rcx, str.ffacc14
call fcn.1401aaa80
mov rdx, rax
lea rcx, [0x140578d90]
call fcn.1401ab7f0
lea rcx, [0x140578d98]
call fcn.1401aaa80
mov rdx, rax
lea rcx, str.cmake_ver
call fcn.1401ab7f0
mov bl, 1
mov rdx, qword [rsp + 0x60]
cmp rdx, 7
jbe 0x14018f266
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14018f261
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14018f3a3
call fcn.1403e3650
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], r15w
mov rdx, qword [rbp - 0x80]
cmp rdx, 7
jbe 0x14018f2bb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14018f2b6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14018f3a9
call fcn.1403e3650
mov qword [rsp + 0x78], r15
mov qword [rbp - 0x80], 7
mov word [rsp + 0x68], r15w
mov rdx, qword [rbp - 0x60]
cmp rdx, 7
jbe 0x14018f30e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14018f309
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14018f3af
call fcn.1403e3650
movdqa xmm0, xmmword [0x14057a8b0]
movdqu xmmword [rbp - 0x68], xmm0
mov word [rbp - 0x78], r15w
mov rdx, qword [rbp - 0x40]
cmp rdx, 7
jbe 0x14018f35c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14018f357
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14018f385
call fcn.1403e3650
movzx eax, bl
mov rcx, qword [rbp + 0x220]
xor rcx, rsp
call fcn.1403e3630
mov rbx, qword [rsp + 0x370]
add rsp, 0x330
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.1403fd768
int3
call fcn.1400c4f10
nop
call fcn.1400c4f10
nop
call fcn.1403fd768
nop
call fcn.1403fd768
nop
call fcn.1403fd768
nop
call fcn.1403fd768
nop
call fcn.1403fd768
int3