Function at 0x140002a70
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x420]
sub rsp, 0x520
mov rax, qword [0x140019008]
xor rax, rsp
mov qword [rbp + 0x410], rax
mov r14, rcx
xor r15d, r15d
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x48], 0xf
mov byte [rbp - 0x60], r15b
lea r8d, [r15 + 6]
lea rdx, str.ci.dll
lea rcx, [rbp - 0x60]
call fcn.1400034d0
nop
lea rcx, [rbp - 0x60]
call fcn.1400014d0
mov rbx, rax
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x140002b21
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002b1c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002b1c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ec90
test rbx, rbx
je 0x140002bcb
lea rax, str.xxx____x_xxxxxxx
mov qword [rsp + 0x20], rax
lea r9, [0x140011b20]
mov r8, rbx
mov rcx, r14
call fcn.1400028d0
mov rsi, rax
test rax, rax
je 0x140002bcb
lea rbx, [rax - 0x32]
test rbx, rbx
je 0x140002bcb
mov ecx, 0x32
call fcn.14000f1bc
mov rdi, rax
mov r9d, 0x32
mov r8, rbx
mov rdx, rax
mov rcx, r14
call fcn.1400016e0
test al, al
je 0x140002bcb
mov r8, r15
lea r11, [0x140011b38]
mov r10, rdi
sub r10, r11
nop
lea rdx, [0x140011b34]
mov rcx, r11
mov al, 0x78
lea r9, [r8 + r10]
cmp al, 0x78
jne 0x140002bad
movzx eax, byte [rcx]
cmp byte [rcx + r9], al
jne 0x140002bfd
inc rdx
inc rcx
movzx eax, byte [rdx]
test al, al
jne 0x140002ba0
lea rax, [r8 + rdi]
test rax, rax
jne 0x140002c08
mov rcx, rdi
call fcn.14000ec90
xor al, al
mov rcx, qword [rbp + 0x410]
xor rcx, rsp
call fcn.14000ec70
lea r11, [rsp + 0x520]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
inc r8
cmp r8, 0x2f
jae 0x140002bc3
jmp 0x140002b90
add rbx, r8
mov rcx, rdi
call fcn.14000ec90
test rbx, rbx
je 0x140002bcb
mov dword [rsp + 0x70], r15d
lea r8, [rsi + 3]
mov r9d, 4
lea rdx, [rsp + 0x70]
mov rcx, r14
call fcn.1400016e0
test al, al
jne 0x140002c3d
mov r12, r15
jmp 0x140002c49
movsxd r12, dword [rsp + 0x70]
add r12, 7
add r12, rsi
mov qword [rbp - 0x68], r12
mov dword [rbp - 0x80], r15d
lea r8, [rbx + 3]
mov r9d, 4
lea rdx, [rbp - 0x80]
mov rcx, r14
call fcn.1400016e0
test al, al
jne 0x140002c70
mov r13, r15
jmp 0x140002c7b
movsxd r13, dword [rbp - 0x80]
add r13, 7
add r13, rbx
test r12, r12
je 0x140002bcb
test r13, r13
je 0x140002bcb
mov rdx, r13
mov rcx, r14
call fcn.140001f20
test al, al
je 0x140002bcb
mov qword [rsp + 0x78], r15
mov r9d, 8
mov r8, r12
lea rdx, [rsp + 0x78]
mov rcx, r14
call fcn.1400016e0
test al, al
jne 0x140002ccf
mov rdx, r13
mov rcx, r14
call fcn.140002050
jmp 0x140002bcb
cmp qword [rsp + 0x78], 0
jne 0x140002ce9
mov rdx, r13
mov rcx, r14
call fcn.140002050
mov al, 1
jmp 0x140002bcd
lea rcx, [rbp - 0x38]
call fcn.140001340
nop
xor edx, edx
mov r8d, 0x400
lea rcx, [rbp + 0x10]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp + 0x10]
mov ecx, 0x200
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x140002dd2
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], r15w
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x50]
call fcn.140003450
nop
mov r8d, 0xb
lea rdx, str.Driver.sys
lea rcx, [rsp + 0x50]
call fcn.1400032c0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x18], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 8], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x140002dbe
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002db9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002db9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ec90
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], r15w
mov rax, qword [rbp - 8]
lea rbx, [rax*2 - 4]
mov qword [rbp - 0x78], rbx
mov rax, qword [rsp + 0x78]
test rax, rax
je 0x140003063
mov rdi, 0xffffffffffffffff
nop word [rax + rax]
mov word [rsp + 0x70], r15w
lea r8, [rax + 8]
mov r9d, 2
lea rdx, [rsp + 0x70]
mov rcx, r14
call fcn.1400016e0
test al, al
je 0x140003063
movzx eax, word [rsp + 0x70]
test ax, ax
je 0x140003063
cmp rbx, rax
jne 0x140003032
mov qword [rbp - 0x70], r15
mov r8, qword [rsp + 0x78]
add r8, 0x10
mov r9d, 8
lea rdx, [rbp - 0x70]
mov rcx, r14
call fcn.1400016e0
test al, al
je 0x140003063
cmp qword [rbp - 0x70], 0
je 0x140003063
movzx ecx, word [rsp + 0x70]
shr rcx, 1
inc rcx
mov eax, 2
mul rcx
cmovo rax, rdi
mov rcx, rax
call fcn.14000f1bc
mov rbx, rax
mov qword [rsp + 0x48], rax
movzx r8d, word [rsp + 0x70]
add r8, 2
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
movzx r9d, word [rsp + 0x70]
mov r8, qword [rbp - 0x70]
mov rdx, rbx
mov rcx, r14
call fcn.1400016e0
test al, al
je 0x140003063
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x48], 7
mov rdx, rbx
lea rcx, [rbp - 0x60]
call fcn.140003450
lea r11, [rbp - 0x38]
cmp qword [rbp - 0x20], 8
cmovae r11, qword [rbp - 0x38]
lea r15, [rbp - 0x60]
mov rcx, qword [rbp - 0x48]
cmp rcx, 8
setae byte [rsp + 0x40]
mov rsi, qword [rbp - 0x60]
cmovae r15, rsi
mov rdi, qword [rbp - 0x28]
mov rax, qword [rbp - 0x50]
cmp rdi, rax
ja 0x140002fd1
test rdi, rdi
jne 0x140002f2e
xor r15d, r15d
mov ebx, r15d
lea rdi, [r15 - 1]
jmp 0x140002fde
sub rax, rdi
lea r12, [rax + 1]
lea r12, [r15 + r12*2]
mov rbx, r15
movzx r10d, word [r11]
mov rax, r12
sub rax, rbx
sar rax, 1
mov ecx, 0
je 0x140002f6c
cmp word [rbx], r10w
je 0x140002f69
cmp rax, 1
je 0x140002f6c
dec rax
add rbx, 2
cmp word [rbx], r10w
jne 0x140002f56
mov rcx, rbx
mov rbx, rcx
test rcx, rcx
je 0x140002fc9
mov r8, rdi
mov rax, r11
movzx ecx, word [rcx]
movzx edx, r10w
cmp cx, r10w
jb 0x140002fac
mov r9, rbx
sub r9, r11
cmp cx, dx
ja 0x140002fac
cmp r8, 1
je 0x140002fb2
dec r8
add rax, 2
movzx ecx, word [rax + r9]
movzx edx, word [rax]
cmp cx, dx
jae 0x140002f90
add rbx, 2
jmp 0x140002f40
sub rbx, r15
sar rbx, 1
mov rcx, qword [rbp - 0x48]
mov r12, qword [rbp - 0x68]
mov rdi, 0xffffffffffffffff
jmp 0x140002fdb
mov rcx, qword [rbp - 0x48]
mov r12, qword [rbp - 0x68]
mov rdi, 0xffffffffffffffff
mov rbx, rdi
xor r15d, r15d
cmp byte [rsp + 0x40], 0
je 0x14000301a
lea rdx, [rcx*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140003012
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400030ba
mov rcx, rsi
call fcn.14000ec90
cmp rbx, 0xffffffffffffffff
jne 0x1400030c1
mov rcx, qword [rsp + 0x48]
call fcn.14000ec90
mov rbx, qword [rbp - 0x78]
mov r12, qword [rsp + 0x78]
mov qword [rbp - 0x68], r12
mov r9d, 8
mov r8, r12
lea rdx, [rsp + 0x78]
mov rcx, r14
call fcn.1400016e0
test al, al
je 0x140003063
mov rax, qword [rsp + 0x78]
test rax, rax
jne 0x140002e00
mov rdx, r13
mov rcx, r14
call fcn.140002050
xor bl, bl
mov rdx, qword [rbp]
cmp rdx, 8
jb 0x14000326f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003269
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003269
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov qword [rbp - 0x78], r15
mov r9d, 8
mov r8, qword [rsp + 0x78]
lea rdx, [rbp - 0x78]
mov rcx, r14
call fcn.1400016e0
test al, al
je 0x140003063
test r12, r12
je 0x140003063
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x60], 0x33
lea rax, [rbp - 0x78]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], r12
mov qword [rbp - 0x40], 8
mov dword [rbp - 0x68], r15d
mov qword [rsp + 0x38], r15
lea rax, [rbp - 0x68]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
mov r9d, 0x28
lea r8, [rbp - 0x60]
mov edx, 0x80862007
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x140003063
mov rbx, qword [rsp + 0x78]
test rbx, rbx
je 0x140003063
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x140022520], eax
jle 0x140003224
lea rcx, [0x140022520]
call fcn.14000ee20
cmp dword [0x140022520], 0xffffffff
jne 0x140003224
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x48], 0xf
mov byte [rbp - 0x60], 0
mov r8d, 0xa
lea rdx, str.ExFreePool
lea rcx, [rbp - 0x60]
call fcn.1400034d0
nop
lea r8, [rbp - 0x60]
mov rcx, r14
call fcn.140001900
mov qword [0x140022568], rax
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x140003208
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003203
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003203
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ec90
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x48], 0xf
mov byte [rbp - 0x60], 0
lea rcx, [0x140022520]
call fcn.14000edc0
cmp qword [0x140022568], 0
je 0x140003063
mov r9, rbx
mov rcx, r14
call fcn.140003630
test al, al
je 0x140003063
mov rdx, r13
mov rcx, r14
call fcn.140002050
test al, al
je 0x140003063
mov rcx, qword [rsp + 0x48]
call fcn.14000ec90
mov bl, 1
jmp 0x140003070
call fcn.14000ec90
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 8
jb 0x1400032b2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400032ad
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400032ad
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ec90
movzx eax, bl
jmp 0x140002bcd