Function at 0x140007e00
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x538]
sub rsp, 0x620
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14003b3c0]
xor rax, rsp
mov qword [rbp + 0x510], rax
mov rsi, rcx
or r15, 0xffffffffffffffff
mov edi, r15d
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
xor r14d, r14d
test rax, rax
jne 0x140007e5f
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140007ea7
lea rdx, str.GetLspGuid
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140007e91
lea rdx, [0x140034e34]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140007e91
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140007e9a
lea rcx, [rbp - 0x30]
call rax
mov edi, r14d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test edi, edi
je 0x140007eae
xor eax, eax
jmp 0x140008116
mov dword [rsp + 0x30], 0x103
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x30]
lea rdx, [rbp + 0xf0]
lea rcx, [rbp - 0x30]
call qword [sym.imp.WS2_32.dll_WSCGetProviderPath]
cmp eax, r15d
je 0x140007ea7
call fcn.1400013e8
mov rdx, rax
mov ecx, r14d
test rax, rax
setne cl
test ecx, ecx
jne 0x140007ef6
mov ecx, 0x80004005
call fcn.140001268
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
mov rdx, rsi
lea rcx, [rsp + 0x38]
call fcn.14000b118
mov esi, 0xf
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x80], r14
mov byte [rsp + 0x70], r14b
mov qword [rbp - 0x58], rsi
mov qword [rbp - 0x60], r14
mov byte [rbp - 0x70], r14b
mov qword [rbp - 0x38], rsi
mov qword [rbp - 0x40], r14
mov byte [rbp - 0x50], r14b
mov rbx, qword [rsp + 0x38]
cmp byte [rbx], r14b
jne 0x140007f4e
mov r8, r14
jmp 0x140007f5a
mov r8, r15
inc r8
cmp byte [rbx + r8], r14b
jne 0x140007f51
mov rdx, rbx
lea rcx, [rbp - 0x50]
call fcn.140004d6c
nop
lea r9, [rsp + 0x70]
lea r8, [rbp - 0x70]
lea rdx, [rbp - 0x50]
mov cl, 0x5c
call fcn.140013eec
test al, al
sete dil
cmp qword [rbp - 0x38], 0x10
jb 0x140007f91
mov rcx, qword [rbp - 0x50]
call fcn.140014150
test dil, dil
je 0x140007fb9
cmp byte [rbx], r14b
jne 0x140007fa0
mov r8, r14
jmp 0x140007fac
mov r8, r15
inc r8
cmp byte [rbx + r8], r14b
jne 0x140007fa3
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.140004d6c
mov edi, 0x104
mov edx, edi
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x60], r14
mov byte [rsp + 0x50], r14b
cmp byte [rbp - 0x20], r14b
jne 0x140007fe4
mov r8, r14
jmp 0x140007ff4
lea rax, [rbp - 0x20]
mov r8, r15
inc r8
cmp byte [rax + r8], r14b
jne 0x140007feb
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x50]
call fcn.140004d6c
mov dl, 0x5c
lea rcx, [rsp + 0x50]
call fcn.14000b244
mov r9, r15
xor r8d, r8d
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.14000b5b0
lea r8, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae r8, qword [rsp + 0x50]
mov r9d, dword [rsp + 0x60]
inc r9d
mov dword [rsp + 0x28], edi
lea rax, [rbp + 0x300]
mov qword [rsp + 0x20], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rcx, [rbp + 0xf0]
call fcn.14001602c
lea rcx, [rbp + 0x300]
call fcn.14001602c
lea rax, [rbp + 0xf0]
lea r8, [rbp + 0x300]
sub r8, rax
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140008093
add rax, 2
test ecx, ecx
jne 0x14000807f
mov edi, r14d
test edx, edx
sete dil
cmp qword [rsp + 0x68], 0x10
jb 0x1400080ae
mov rcx, qword [rsp + 0x50]
call fcn.140014150
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x60], r14
mov byte [rsp + 0x50], r14b
cmp qword [rbp - 0x58], 0x10
jb 0x1400080cd
mov rcx, qword [rbp - 0x70]
call fcn.140014150
mov qword [rbp - 0x58], rsi
mov qword [rbp - 0x60], r14
mov byte [rbp - 0x70], r14b
cmp qword [rbp - 0x78], 0x10
jb 0x1400080ea
mov rcx, qword [rsp + 0x70]
call fcn.140014150
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x80], r14
mov byte [rsp + 0x70], r14b
lea rdx, [rbx - 0x18]
mov ecx, r15d
lock xadd dword [rdx + 0x10], ecx
add ecx, r15d
test ecx, ecx
jg 0x140008114
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rhtons + 8]
mov eax, edi
mov rcx, qword [rbp + 0x510]
xor rcx, rsp
call fcn.140014130
lea r11, [rsp + 0x620]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret