Function at 0x1800397e0
Capabilities:
Get common file path
Get hostname

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x420]
sub rsp, 0x520
mov rax, qword [0x18007b358]
xor rax, rsp
mov qword [rbp + 0x410], rax
mov eax, edx
mov dword [rsp + 0x74], edx
mov r13, r8
mov dword [rsp + 0x50], edx
mov r8d, edx
mov qword [rsp + 0x68], rcx
add edx, 0xfffffff6
lea r14, [0x180000000]
xor r9d, r9d
mov dword [rsp + 0x44], edx
mov r10, rcx
cmp eax, edx
jbe 0x180039b87
mov rsi, qword [rbp - 0x60]
lea edx, [rax - 0x40]
mov r12d, dword [rsp + 0x60]
mov ebx, dword [rsp + 0x60]
mov edi, dword [rsp + 0x60]
mov r15d, dword [rsp + 0x60]
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x4c], edx
movabs r9, 0x3200730077
mov r11d, 0x6c
cmp edx, 0x17
ja case.default.0x180039886
mov ecx, dword [r14 + rdx*4 + 0x3a2ac]
add rcx, r14
jmp rcx
test r10, r10
je 0x180039c29
mov eax, dword [r13]
dec eax
cmp eax, 1
ja 0x180039c3b
mov eax, dword [rsp + 0x44]
xor r9d, r9d
mov r12d, r9d
jmp 0x180039b67
mov eax, dword [r13]
lea r8, [rsp + 0x58]
mov edx, 0xca
mov dword [rsp + 0x58], eax
xor ecx, ecx
call fcn.18003ef30
mov r9, qword [rsp + 0x68]
lea r8, str._s:_Read_error_at_scanline__lu__strip__lu__got__lu_bytes__expected__lu
mov rcx, r9
mov qword [rsp + 0x20], rax
mov edx, 5
call fcn.18003c520
jmp 0x180039b57
mov r14d, 0x5b
mov eax, r14d
sub eax, 0x5b
je 0x1800399c2
sub eax, 5
je 0x1800399a9
sub eax, 1
je 0x18003997f
sub eax, 1
je 0x180039958
cmp eax, 1
jne 0x18003998d
mov ebx, 0x66
nop word [rax + rax]
mov eax, ebx
sub eax, 0x66
je 0x180039937
cmp eax, 0x26
jne 0x180039946
mov edi, r15d
mov r12d, r15d
jmp 0x1800399f2
cmp r15d, 1
jge 0x180039946
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add ebx, 0x26
cmp ebx, 0xb2
jb 0x180039920
mov r10, qword [rsp + 0x68]
jmp 0x18003998d
mov r9, rsi
mov byte [rsi + 4], 0x20
mov r8, r10
mov dword [rsi + 8], 0xfffffff9
mov edx, 0x103
xor ecx, ecx
call fcn.180047ae0
mov r10, qword [rsp + 0x68]
mov r15d, eax
jmp 0x18003998d
test rsi, rsi
je 0x18003999f
mov eax, dword [SHChangeNotifyRegister]
mov dword [rsi], eax
inc r14d
cmp r14d, 0x60
jb 0x1800398f1
mov r12d, edi
jmp 0x1800399f2
mov edi, 0xfffffffa
mov r12d, edi
jmp 0x1800399f2
test r10, r10
jne 0x1800399b8
mov edi, 0xfffffff6
mov r12d, edi
jmp 0x1800399f2
mov edi, 0xfffffffe
mov r12d, edi
jmp 0x1800399f2
xor edx, edx
mov dword [rsp + 0x58], 0xa
lea rax, [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea r8, [0x18006b9d8]
mov qword [rsp + 0x20], r10
lea ecx, [rdx + 8]
call fcn.1800374a0
mov edi, eax
mov r12d, eax
mov ebx, r12d
test r12d, r12d
js 0x180039c33
lea r14, [0x180000000]
jmp 0x180039b57
mov eax, dword [r13]
cmp eax, 1
je 0x180039c33
cmp eax, 2
jne 0x180039c3b
mov r14d, 0x124
mov eax, r14d
sub eax, 0x124
je 0x180039a4a
sub eax, 1
je 0x180039a40
cmp eax, 1
je case.0x18003a0ec.0
jmp 0x180039a76
lea eax, [rbx + r12]
mov dword [rsp + 0x54], eax
jmp 0x180039a76
mov eax, dword [r13]
lea r8, [rsp + 0x58]
mov r9, r10
mov dword [rsp + 0x58], eax
mov edx, 0xd3
mov rcx, r10
call fcn.1800393e0
mov ebx, eax
test eax, eax
js 0x180039edb
mov r10, qword [rsp + 0x68]
inc r14d
cmp r14d, 0x127
jb 0x180039a26
lea r14, [0x180000000]
jmp 0x180039b57
xor r9d, r9d
xor edx, edx
mov r8d, 0xbe
mov rcx, r10
call fcn.18000c1d0
mov rbx, rax
test eax, eax
js 0x180039edb
jmp 0x180039b57
mov eax, dword [0x18006cb2c]
mov dword [rbp + 0x1ee], eax
mov word [rbp + 0x1f2], r11w
jmp case.0x180039886.4
movzx eax, word [0x180074b38]
lea rdx, [0x180074b86]
mov word [rbp + 0x192], ax
lea rcx, [rbp + 0x195]
movzx eax, byte [0x180074b3a]
mov r8d, 5
mov byte [rbp + 0x194], al
mov byte [rbp + 0x195], 0
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp 0x180039b57
movsd xmm0, qword [str._32.]
movzx eax, word [0x18006c860]
mov qword [rbp + 0x1e0], r9
movsd qword [rbp + 0x1e6], xmm0
mov word [rbp + 0x1ee], ax
mov byte [rbp + 0x19a], 0
jmp case.0x180039886.4
mov r8d, 2
mov byte [rbp + 0x190], 0
lea rdx, [0x180074baa]
lea rcx, [rbp + 0x190]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov edx, dword [rsp + 0x4c]
mov r8d, dword [rsp + 0x50]
mov eax, dword [rsp + 0x44]
xor r9d, r9d
mov r10, qword [rsp + 0x68]
dec r8d
dec edx
mov dword [rsp + 0x50], r8d
mov dword [rsp + 0x4c], edx
cmp r8d, eax
ja 0x180039862
mov eax, dword [rsp + 0x74]
imul ecx, eax, 0x492
mov ebx, eax
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x4c], ecx
cmp eax, ecx
ja case.0x18003a0ec.0
movzx r12d, byte [rsp + 0x40]
mov edi, 0x100
mov r13, qword [rbp - 0x70]
mov ecx, 3
mov r15d, dword [rsp + 0x58]
mov r14d, dword [rsp + 0x70]
mov eax, dword [rsp + 0x4c]
mov esi, dword [rsp + 0x50]
nop word [rax + rax]
cmp ebx, 0x995e
ja 0x180039f05
je 0x180039cfc
cmp ebx, 0x43
je 0x180039cef
cmp ebx, 0x1ee2
je 0x180039ce5
cmp ebx, 0x3d81
je 0x180039cdc
cmp ebx, 0x5c20
je 0x180039c97
cmp ebx, 0x7abf
jne 0x180039eba
mov word [rsp + 0x64], cx
mov qword [rbp - 0x58], r9
jmp 0x180039eba
mov eax, 0xfffffff6
jmp 0x180039edb
mov eax, r12d
jmp 0x180039edb
mov eax, 0xffffffe8
jmp 0x180039edb
xor r9d, r9d
xor r8d, r8d
mov edx, 0x122
xor ecx, ecx
call fcn.180067b50
test eax, eax
jne 0x180039c7e
mov r10, qword [rsp + 0x68]
mov eax, 0x100
movzx edx, byte [r10 + 1]
imul edx, eax
movzx eax, byte [r10]
add dx, ax
mov word [rsp + 0x54], dx
jmp case.0x18003a0ec.0
mov rcx, qword [rsp + 0x68]
mov edx, 0xa3
call fcn.1800481f0
mov word [rsp + 0x54], ax
jmp case.0x18003a0ec.0
mov qword [rsp + 0x30], r9
lea r8, [rbp + 0x190]
mov qword [rsp + 0x28], r9
lea rcx, [rbp + 0x1e0]
xor r9d, r9d
mov dword [rsp + 0x20], 0x42
xor edx, edx
call fcn.18001a9e0
mov qword [rbp - 0x20], rax
xor eax, eax
xor r9d, r9d
mov word [rsp + 0x64], ax
mov qword [rbp - 0x50], r9
mov byte [rsp + 0x66], al
jmp 0x180039eb6
mov qword [rbp - 0x60], r9
jmp 0x180039eba
mov byte [rsp + 0x48], 1
jmp 0x180039eba
mov word [rbp + 0x1f4], r9w
jmp 0x180039eba
mov ecx, 0x202
mov dword [rsp + 0x50], r9d
lea rdx, [rbp - 0x10]
call qword [rbp - 0x20]
test eax, eax
je 0x180039eaf
mov esi, 0x41
nop word [rax + rax]
cmp esi, 0x1f7
ja 0x180039e82
je 0x180039dc9
cmp esi, 0x41
je 0x180039dbc
cmp esi, 0xd3
je 0x180039da3
cmp esi, 0x165
jne 0x180039e99
cmp dword [rsp + 0x7c], 0
jne 0x180039e99
mov ebx, 0xdf
nop
cmp ebx, 0xdf
je 0x180039d87
cmp ebx, 0x6888
jne 0x180039d8b
lea rdx, [rsp + 0x78]
lea rcx, [rbp + 0x200]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
xor r12b, r12b
jmp 0x180039d8b
mov dword [rsp + 0x78], edi
add ebx, 0x67a9
cmp ebx, 0xcf52
jbe 0x180039d60
mov byte [rsp + 0x40], r12b
jmp 0x180039e99
call qword [sym.imp.WINMM.dll_midiOutGetNumDevs]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x7c], eax
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
jmp 0x180039e99
mov r12b, 1
mov byte [rsp + 0x40], r12b
jmp 0x180039e99
test r12b, r12b
je 0x180039e99
mov edi, 0x10c
cmp edi, 0x10c
je 0x180039e53
cmp edi, 0x58fc
je 0x180039e3a
cmp edi, 0xb0ec
jne 0x180039e5b
test r12b, r12b
je 0x180039e5b
mov ebx, 0xe0
nop dword [rax]
mov eax, ebx
sub eax, 0xdf
je 0x180039e16
cmp eax, 1
jne 0x180039e29
mov r14d, 0x104
jmp 0x180039e29
mov r8d, r14d
lea rdx, [rbp + 0x200]
mov ecx, r15d
call qword [sym.imp.WINMM.dll_midiOutGetErrorTextA]
dec ebx
cmp ebx, 0xde
ja 0x180039e00
mov dword [rsp + 0x70], r14d
jmp 0x180039e5b
lea rdx, [rbp - 0x80]
mov rcx, r13
call qword [sym.imp.WINMM.dll_midiOutGetID]
mov r15d, eax
test eax, eax
jne 0x180039e5b
xor r12b, r12b
jmp 0x180039e5b
xor eax, eax
mov r13d, eax
mov dword [rbp - 0x80], eax
add edi, 0x57f0
cmp edi, 0x107d0
jbe 0x180039dd7
mov qword [rbp - 0x70], r13
mov edi, 0x100
mov byte [rsp + 0x40], r12b
mov dword [rsp + 0x58], r15d
jmp 0x180039e99
cmp esi, 0x289
je 0x180039e94
cmp esi, 0x31b
je case.0x18003a0ec.0
jmp 0x180039e99
mov byte [rsp + 0x54], 0
add esi, 0x92
cmp esi, 0x3ad
jb 0x180039d20
mov ebx, dword [rsp + 0x44]
mov esi, dword [rsp + 0x50]
xor r9d, r9d
mov eax, dword [rsp + 0x4c]
imul ecx, dword [rsp + 0x74], 0x75
mov r10, qword [rsp + 0x68]
add ebx, ecx
mov ecx, 3
mov dword [rsp + 0x44], ebx
cmp ebx, eax
jbe 0x180039bd0
mov eax, dword [rsp + 0x54]
mov rcx, qword [rbp + 0x410]
xor rcx, rsp
call fcn.180069d20
mov rbx, qword [rsp + 0x568]
add rsp, 0x520
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
cmp ebx, 0xb7fd
je 0x18003a28d
cmp ebx, 0xd69c
je 0x18003a0b0
cmp ebx, 0xf53b
je 0x180039f2f
cmp ebx, 0x113da
je case.0x18003a0ec.0
jmp 0x180039eba
mov rcx, qword [rbp - 0x30]
lea rax, [rbp - 0x28]
lea r9, [rbp - 0x18]
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x58]
lea rdx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
cmp byte [rsp + 0x48], 0
je 0x18003a096
mov esi, 0x62
mov ebx, 0x12b
lea edi, [rsi + 5]
lea r13d, [rsi + 0x12]
lea r15d, [rsi - 0xf]
nop
cmp ebx, 0x20313
ja 0x18003a01c
je 0x18003a006
cmp ebx, 0x12b
je 0x180039ff3
cmp ebx, 0x81a5
je 0x180039fdb
cmp ebx, 0x1021f
je 0x180039fc5
cmp ebx, 0x18299
jne 0x18003a063
mov word [rbp + 0x1b2], r13w
mov dword [rbp + 0x1b4], 0x6f0054
mov word [rbp + 0x1b8], r15w
jmp 0x18003a063
mov word [rbp + 0x1ac], si
mov dword [rbp + 0x1ae], 0x65006c
jmp 0x18003a063
mov eax, 0x61
mov dword [rbp + 0x1a6], 0x54005f
mov word [rbp + 0x1aa], ax
jmp 0x18003a063
mov word [rbp + 0x1a0], di
mov dword [rbp + 0x1a2], 0x740065
jmp 0x18003a063
mov dword [rbp + 0x1ba], 0x720063
mov dword [rbp + 0x1be], 0x650065
jmp 0x18003a063
cmp ebx, 0x2838d
je 0x18003a059
cmp ebx, 0x30407
je 0x18003a051
cmp ebx, 0x38481
jne 0x18003a063
mov rcx, qword [rbp - 0x48]
lea rdx, [rbp + 0x1a0]
call qword [sym.imp.GDI32.dll_CopyEnhMetaFileW]
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.SHELL32.dll_ILFree]
jmp 0x18003a063
xor eax, eax
mov qword [rbp - 0x48], rax
jmp 0x18003a063
mov dword [rbp + 0x1c2], 0x6e
add ebx, 0x807a
cmp ebx, 0x403d0
jbe 0x180039f70
mov r14d, dword [rsp + 0x70]
mov edi, 0x100
mov r15d, dword [rsp + 0x58]
movzx r12d, byte [rsp + 0x40]
mov r13, qword [rbp - 0x70]
mov ebx, dword [rsp + 0x44]
mov esi, dword [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 0x21]
call fcn.180015de0
mov byte [rsp + 0x54], al
jmp 0x180039eb3
xor r9d, r9d
mov rdx, r10
xor ecx, ecx
lea r8d, [r9 + 0x31]
call fcn.18002f120
test al, al
jne 0x18003a268
mov ebx, ILRemoveLastID
nop
cmp ebx, 0xf
ja case.default.0x18003a0ec
lea rdx, [0x180000000]
mov eax, ebx
mov ecx, dword [rdx + rax*4 + 0x3a30c]
add rcx, rdx
jmp rcx
mov r8d, 4
lea rdx, [0x180074bd2]
lea rcx, [rbp + 0x1a0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
movabs rax, 0x69006e00690020
mov qword [rbp + 0x1ba], rax
jmp case.default.0x18003a0ec
mov r9d, dword [rbp - 0x78]
lea rax, [rbp + 0x200]
mov r8, qword [rbp - 0x38]
mov edx, dword [rbp - 0x7c]
mov rcx, qword [rbp - 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
jmp case.default.0x18003a0ec
xor eax, eax
mov word [rbp + 0x1aa], ax
jmp case.default.0x18003a0ec
xor eax, eax
mov dword [rbp - 0x7c], 0x36
mov qword [rbp - 0x40], rax
jmp case.default.0x18003a0ec
xor eax, eax
mov qword [rbp - 0x38], rax
jmp case.default.0x18003a0ec
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x1a0]
call qword [sym.imp.SHELL32.dll_SHIsFileAvailableOffline]
mov byte [rsp + 0x54], 0
jmp case.default.0x18003a0ec
xor eax, eax
mov dword [rbp - 0x78], eax
mov dword [rsp + 0x60], eax
jmp case.default.0x18003a0ec
mov dword [rbp + 0x1a2], 0x650068
mov dword [rbp + 0x1a6], 0x6b0063
jmp case.default.0x18003a0ec
mov dword [rbp + 0x1a0], 0x43
jmp case.default.0x18003a0ec
xor eax, eax
mov dword [rbp + 0x1ca], 0x65006e
lea rdx, [0x180074c48]
mov word [rbp + 0x1ce], ax
lea rcx, [rbp + 0x1a0]
lea r8d, [rax + 2]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
jmp case.default.0x18003a0ec
movabs rax, 0x6f0064005f0074
mov qword [rbp + 0x1c2], rax
xor eax, eax
mov word [rbp + 0x1ca], ax
jmp case.default.0x18003a0ec
mov dword [rbp + 0x1aa], 0x660020
mov dword [rbp + 0x1ae], 0x690061
jmp case.default.0x18003a0ec
mov eax, dword [0x180074c92]
mov dword [rbp + 0x1d2], eax
movzx eax, word [0x180074c96]
mov word [rbp + 0x1d6], ax
jmp case.default.0x18003a0ec
xor eax, eax
mov word [rbp + 0x1b2], ax
jmp case.default.0x18003a0ec
mov dword [rbp + 0x1d8], 0x20
dec ebx
lea eax, [rbx + 0xab]
cmp eax, 0xaa
ja 0x18003a0d0
mov ebx, dword [rsp + 0x44]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
movzx ecx, byte [rsp + 0x48]
xor r9d, r9d
mov edx, r9d
mov qword [rbp - 0x30], rax
cmp qword [rbp - 0x68], rdx
cmovne edx, ecx
mov byte [rsp + 0x48], dl
jmp 0x180039eb6
mov rcx, qword [rbp - 0x60]
lea rdx, [rsp + 0x64]
mov r8d, esi
mov qword [rbp - 0x28], r9
call qword [sym.imp.SHELL32.dll_ILAppendID]
mov qword [rbp - 0x68], rax
jmp 0x180039eb3