Function at 0x18000f8e4
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x30
xor r12d, r12d
mov ebx, r8d
mov dword [rbp + 0x30], r12d
mov r15, rdx
mov rdi, rcx
mov r14d, r12d
test rcx, rcx
je 0x18000fb77
mov qword [rcx], r12
cmp ebx, 1
je 0x18000fa65
cmp ebx, 2
je 0x18000fa53
jbe 0x18000fb77
cmp ebx, 6
jbe 0x18000f978
cmp ebx, 7
jne 0x18000fb77
lea rdx, [rbp + 0x30]
xor ecx, ecx
call qword [sym.imp.USERENV.dll_GetProfilesDirectoryW]
nop dword [rax + rax]
test eax, eax
jne 0x18000f9ec
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 0x7a
je 0x18000f9ec
mov ecx, r12d
mov dword [rbp + 0x30], ecx
jmp 0x18000fa7a
cmp ebx, 5
jne 0x18000f98d
lea rdx, str.SystemCurrentControlSetServicesNetlogonParameters
lea r8, str.SysVol
jmp 0x18000f9be
cmp ebx, 6
jne 0x18000f9a2
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionSetup
lea r8, str.BootDir
jmp 0x18000f9be
cmp ebx, 3
lea r8, str.DSA_Working_Directory
lea rax, str.Database_log_files_path
cmovne r8, rax
lea rdx, str.SystemCurrentControlSetServicesNTDSParameters
lea rax, [rbp + 0x48]
mov qword [rsp + 0x28], r12
mov r9, rdi
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
call fcn.180010c40
mov r14d, eax
test eax, eax
jne 0x18000f9ec
cmp dword [rbp + 0x48], 1
je 0x18000f9f4
lea r14d, [rax + 2]
mov ecx, dword [rbp + 0x30]
jmp 0x18000fa7a
mov rcx, qword [rdi]
test rcx, rcx
je 0x18000f9ec
cmp ebx, 5
jne 0x18000fa3d
lea rdx, str._sysvol
call fcn.1800112c0
mov rsi, rax
test rax, rax
je 0x18000fa3d
cmp rax, qword [rdi]
je 0x18000fa3d
lea rcx, [rax - 0xe]
lea r8d, [rbx + 2]
lea rdx, str._sysvol
call qword [sym.imp.msvcrt.dll__wcsnicmp]
nop dword [rax + rax]
test eax, eax
jne 0x18000fa3d
mov word [rsi], r12w
mov rax, qword [rdi]
or rcx, 0xffffffffffffffff
inc rcx
cmp word [rax + rcx*2], r12w
jne 0x18000fa44
jmp 0x18000f970
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemDirectoryW]
nop dword [rax + rax]
jmp 0x18000fa75
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemWindowsDirectoryW]
nop dword [rax + rax]
mov dword [rbp + 0x30], eax
mov ecx, eax
test ecx, ecx
je 0x18000fb1a
lea eax, [rbx - 1]
cmp eax, 1
jbe 0x18000fa93
cmp ebx, 7
jne 0x18000fb1a
lea edx, [rcx + 1]
mov ecx, 0x40
add rdx, rdx
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
nop dword [rax + rax]
mov qword [rdi], rax
test rax, rax
jne 0x18000fabc
mov eax, 8
jmp 0x18000fb7c
sub ebx, 1
je 0x18000fb03
sub ebx, 1
je 0x18000faef
cmp ebx, 5
jne 0x18000faea
lea rdx, [rbp + 0x30]
mov rcx, rax
call qword [sym.imp.USERENV.dll_GetProfilesDirectoryW]
nop dword [rax + rax]
test eax, eax
jne 0x18000faea
mov ecx, r12d
mov dword [rbp + 0x30], ecx
jmp 0x18000fb1a
mov ecx, dword [rbp + 0x30]
jmp 0x18000fb1a
mov edx, dword [rbp + 0x30]
mov rcx, rax
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemDirectoryW]
nop dword [rax + rax]
jmp 0x18000fb15
mov edx, dword [rbp + 0x30]
mov rcx, rax
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemWindowsDirectoryW]
nop dword [rax + rax]
mov dword [rbp + 0x30], eax
mov ecx, eax
mov dword [r15], ecx
test ecx, ecx
mov rcx, qword [rdi]
jne 0x18000fb67
test rcx, rcx
je 0x18000fb35
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
mov qword [rdi], r12
test r14d, r14d
je 0x18000fb42
mov eax, r14d
jmp 0x18000fb7c
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jne 0x18000fb59
mov eax, 0xd
jmp 0x18000fb7c
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
jmp 0x18000fb7c
call qword [sym.imp.msvcrt.dll__wcsupr]
nop dword [rax + rax]
xor eax, eax
jmp 0x18000fb7c
mov eax, 0x57
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret