Function at 0x180026c50
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x5d0
mov qword [rsp + 0x588], 0xfffffffffffffffe
mov rax, qword [0x1800c34c8]
xor rax, rsp
mov qword [rsp + 0x5c8], rax
call fcn.1800366b0
movzx eax, al
test eax, eax
je 0x180026e16
xor eax, eax
mov word [rsp + 0x460], ax
lea rdi, [rsp + 0x462]
xor eax, eax
mov ecx, reloc.WLDAP32.dll_Ordinal_46
rep stosb byte [rdi], al
xor eax, eax
mov word [rsp + 0x250], ax
lea rdi, [rsp + 0x252]
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
xor eax, eax
mov word [rsp + 0x40], ax
lea rdi, [rsp + 0x42]
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
mov edx, 0x104
lea rcx, [rsp + 0x250]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea r8, str._rundll32.exe
mov edx, 0x104
lea rcx, [rsp + 0x250]
call fcn.18003ca58
lea r8, [0x1800a0c9c]
mov edx, 0x104
lea rcx, [rsp + 0x40]
call fcn.18003c9d4
mov rcx, qword [rsp + 0x5e8]
add rcx, 0x28
call fcn.180011f90
mov r8, rax
mov edx, 0x104
lea rcx, [rsp + 0x40]
call fcn.18003ca58
lea r8, [0x1800a0ca0]
mov edx, 0x104
lea rcx, [rsp + 0x40]
call fcn.18003ca58
mov edx, 1
mov word [rsp + 0x468], dx
mov eax, 1
mov word [rsp + 0x466], ax
mov eax, 0x7cf
mov word [rsp + 0x464], ax
mov eax, Ordinal_50
mov word [rsp + 0x460], ax
xor eax, eax
mov word [rsp + 0x470], ax
mov dword [rsp + 0x480], 1
mov eax, 1
mov word [rsp + 0x484], ax
mov dword [rsp + 0x474], 0x10e0
mov dword [rsp + 0x478], 0x3c
mov rcx, qword [rsp + 0x5e8]
add rcx, 0xa0
call fcn.180011f90
mov rcx, rax
lea rax, [0x1800a0ccc]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x460]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x250]
call fcn.180025d80
test eax, eax
jge 0x180026e0a
xor al, al
jmp 0x1800270a9
mov al, 1
jmp 0x1800270a9
lea rcx, [rsp + 0x498]
call fcn.180023e50
nop
lea rcx, [rsp + 0x498]
call fcn.180023f20
test eax, eax
jge 0x180026e56
mov byte [rsp + 0x4b8], 0
lea rcx, [rsp + 0x498]
call fcn.180023e90
mov al, byte [rsp + 0x4b8]
jmp 0x1800270a9
lea rax, [rsp + 0x4c0]
mov qword [rsp + 0x4e8], rax
lea rax, [rsp + 0x4f0]
mov qword [rsp + 0x518], rax
lea rax, [rsp + 0x520]
mov qword [rsp + 0x548], rax
lea rax, [rsp + 0x550]
mov qword [rsp + 0x578], rax
mov rcx, qword [rsp + 0x5e8]
add rcx, 0xa0
call fcn.180011f90
mov rdx, rax
mov rcx, qword [rsp + 0x4e8]
call fcn.1800118d0
mov qword [rsp + 0x590], rax
mov rax, qword [rsp + 0x590]
mov qword [rsp + 0x598], rax
mov rcx, qword [rsp + 0x5e8]
add rcx, 0x28
call fcn.180011f90
mov rdx, rax
mov rcx, qword [rsp + 0x518]
call fcn.1800118d0
mov qword [rsp + 0x5a0], rax
mov rax, qword [rsp + 0x5a0]
mov qword [rsp + 0x5a8], rax
mov rcx, qword [rsp + 0x5e8]
add rcx, 0x78
call fcn.180011f90
mov rdx, rax
mov rcx, qword [rsp + 0x548]
call fcn.1800118d0
mov qword [rsp + 0x5b0], rax
mov rax, qword [rsp + 0x5b0]
mov qword [rsp + 0x5b8], rax
mov rcx, qword [rsp + 0x5e8]
add rcx, 0x50
call fcn.180011f90
mov rdx, rax
mov rcx, qword [rsp + 0x578]
call fcn.1800118d0
mov qword [rsp + 0x5c0], rax
mov rax, qword [rsp + 0x598]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x5a8]
mov r8, qword [rsp + 0x5b8]
mov rdx, qword [rsp + 0x5c0]
mov rcx, qword [rsp + 0x5e0]
call fcn.1800270d0
movzx eax, al
test eax, eax
jne 0x180026fc7
mov byte [rsp + 0x580], 0
lea rcx, [rsp + 0x498]
call fcn.180023e90
mov al, byte [rsp + 0x580]
jmp 0x1800270a9
mov qword [rsp + 0x490], 0
mov rcx, qword [rsp + 0x5e8]
add rcx, 0xf0
call fcn.18002b780
movzx eax, al
test eax, eax
je 0x18002700c
mov rcx, qword [rsp + 0x5e8]
add rcx, 0xa0
call fcn.180011f90
mov qword [rsp + 0x490], rax
jmp 0x180027028
mov rcx, qword [rsp + 0x5e8]
add rcx, 0xf0
call fcn.180011f90
mov qword [rsp + 0x490], rax
mov rcx, qword [rsp + 0x5e8]
add rcx, 0x50
call fcn.180011f90
mov rdi, rax
mov rcx, qword [rsp + 0x5e8]
add rcx, 0xc8
call fcn.180011f90
mov r9, qword [rsp + 0x490]
mov r8, rdi
mov rdx, rax
lea rcx, [rsp + 0x498]
call fcn.1800250f0
test eax, eax
jge 0x18002708d
mov byte [rsp + 0x581], 0
lea rcx, [rsp + 0x498]
call fcn.180023e90
mov al, byte [rsp + 0x581]
jmp 0x1800270a9
mov byte [rsp + 0x582], 1
lea rcx, [rsp + 0x498]
call fcn.180023e90
mov al, byte [rsp + 0x582]
mov rcx, qword [rsp + 0x5c8]
xor rcx, rsp
call fcn.18003c690
add rsp, 0x5d0
pop rdi
ret