Function at 0x1800272e0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x4e0]
sub rsp, 0x5e0
mov rax, qword [0x1801044f8]
xor rax, rsp
mov qword [rbp + 0x4d0], rax
mov qword [rsp + 0x68], rdx
mov rdi, rcx
mov qword [rsp + 0x70], rdx
xor esi, esi
xor edx, edx
mov r8d, 0x180
lea rcx, [rbp - 0x40]
call fcn.180095d50
lea rcx, [rbp - 0x40]
call fcn.180016db0
nop
xor edx, edx
mov r8d, 0x180
lea rcx, [rbp + 0x140]
call fcn.180095d50
lea rcx, [rbp + 0x140]
call fcn.180016db0
nop
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x2c0]
call fcn.180095d50
mov edx, 0x104
lea rcx, [rbp + 0x2c0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov qword [rbp - 0x60], rsi
mov qword [rbp - 0x50], rsi
mov ebx, 7
mov qword [rbp - 0x48], rbx
mov word [rbp - 0x60], si
lea rax, [rbp + 0x2c0]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1800273b0
lea rdx, [rbp + 0x2c0]
lea rcx, [rbp - 0x60]
call fcn.180005760
nop
cmp byte [rdi], 0
je 0x180027510
movabs rdi, 0x7ffffffffffffffe
mov rax, rdi
mov r12, qword [rbp - 0x50]
sub rax, r12
cmp rax, 0x13
jb 0x18002785c
lea rax, [rbp - 0x60]
mov r14, qword [rbp - 0x60]
mov r15, qword [rbp - 0x48]
cmp r15, 8
cmovae rax, r14
mov qword [rsp + 0x48], rax
mov qword [rbp - 0x80], rsi
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x68], rsi
lea r13, [r12 + 0x13]
lea rsi, [rbp - 0x80]
cmp r13, 7
jbe 0x18002746b
mov rbx, r13
or rbx, 7
cmp rbx, rdi
jbe 0x180027438
mov rbx, rdi
jmp 0x180027444
mov eax, 0xa
cmp rbx, rax
cmovb rbx, rax
mov rdx, rbx
add rdx, 1
mov rax, 0xffffffffffffffff
cmovb rdx, rax
lea rcx, [rbp - 0x80]
call fcn.180005c50
mov rsi, rax
mov qword [rbp - 0x80], rax
mov rax, qword [rsp + 0x48]
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], rbx
lea rbx, [r12 + r12]
mov r8, rbx
mov rdx, rax
mov rcx, rsi
call fcn.1800956b0
movups xmm0, xmmword [str.System32_ntdll.dll]
movups xmmword [rsi + rbx], xmm0
movups xmm1, xmmword [0x1800e3b28]
movups xmmword [rsi + rbx + 0x10], xmm1
mov eax, dword [0x1800e3b38]
mov dword [rsi + rbx + 0x20], eax
movzx eax, word [0x1800e3b3c]
mov word [rsi + rbx + 0x24], ax
xor eax, eax
mov word [rsi + r13*2], ax
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x40]
call fcn.180017130
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x1800277af
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180027506
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180027862
call fcn.180093588
jmp 0x1800277af
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
movzx eax, byte [rdi + 1]
mov qword [rbp - 0x80], rsi
mov byte [rbp - 0x78], al
test al, al
je 0x180027531
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
nop
movabs rdi, 0x7ffffffffffffffe
mov rax, rdi
mov rcx, qword [rbp - 0x50]
sub rax, rcx
cmp rax, 0x13
jb 0x180027868
lea rax, [rbp - 0x60]
mov r15, qword [rbp - 0x48]
cmp r15, 8
setae byte [rsp + 0x20]
mov r14, qword [rbp - 0x60]
cmovae rax, r14
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rsi
lea r12, [rcx + 0x13]
mov rsi, rbx
lea rax, [rsp + 0x28]
mov qword [rsp + 0x58], rax
mov r13d, 0xa
cmp r12, rbx
jbe 0x1800275da
mov rsi, r12
or rsi, 7
cmp rsi, rdi
jbe 0x1800275a9
mov rsi, rdi
jmp 0x1800275b0
cmp rsi, r13
cmovb rsi, r13
mov rdx, rsi
add rdx, 1
mov rax, 0xffffffffffffffff
cmovb rdx, rax
lea rcx, [rsp + 0x28]
call fcn.180005c50
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x28], rax
mov rcx, qword [rbp - 0x50]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x40], rsi
lea r8, [rcx + rcx]
mov qword [rsp + 0x48], r8
mov rdx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rcx, rsi
call fcn.1800956b0
movups xmm0, xmmword [str.System32_ntdll.dll]
mov rcx, qword [rsp + 0x48]
movups xmmword [rsi + rcx], xmm0
movups xmm1, xmmword [0x1800e3b28]
movups xmmword [rsi + rcx + 0x10], xmm1
mov eax, dword [0x1800e3b38]
mov dword [rsi + rcx + 0x20], eax
movzx eax, word [0x1800e3b3c]
mov word [rsi + rcx + 0x24], ax
xor eax, eax
mov word [rsi + r12*2], ax
lea rdx, [rsp + 0x28]
lea rcx, [rbp + 0x140]
call fcn.180017130
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x18002768c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180027687
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002786e
call fcn.180093588
lea rax, [rbp - 0x60]
cmp byte [rsp + 0x20], 0
cmovne rax, r14
mov qword [rsp + 0x50], rax
xor ecx, ecx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rcx
lea rsi, [rsp + 0x28]
cmp r12, 7
jbe 0x1800276fc
mov rbx, r12
or rbx, 7
cmp rbx, rdi
jbe 0x1800276cb
mov rbx, rdi
jmp 0x1800276d3
cmp rbx, 0xa
cmovb rbx, r13
mov rdx, rbx
add rdx, 1
mov rax, 0xffffffffffffffff
cmovb rdx, rax
lea rcx, [rsp + 0x28]
call fcn.180005c50
mov rsi, rax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x40], rbx
mov rbx, qword [rsp + 0x48]
mov r8, rbx
mov rdx, rax
mov rcx, rsi
call fcn.1800956b0
movups xmm0, xmmword [str.SysWOW64_ntdll.dll]
movups xmmword [rsi + rbx], xmm0
movups xmm1, xmmword [0x1800e3b78]
movups xmmword [rsi + rbx + 0x10], xmm1
mov eax, dword [0x1800e3b88]
mov dword [rsi + rbx + 0x20], eax
movzx eax, word [0x1800e3b8c]
mov word [rsi + rbx + 0x24], ax
xor eax, eax
mov word [rsi + r12*2], ax
lea rdx, [rsp + 0x28]
lea rcx, [rbp - 0x40]
call fcn.180017130
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x18002779f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180027799
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180027874
call fcn.180093588
nop
cmp byte [rbp - 0x78], 0
je 0x1800277af
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
lea rdx, [rbp - 0x40]
mov rbx, qword [rsp + 0x68]
mov rcx, rbx
call fcn.180027880
nop
lea rcx, [rbx + 0x180]
lea rdx, [rbp + 0x140]
call fcn.180027880
nop
cmp r15, 8
jb 0x18002780d
lea rdx, [r15*2 + 2]
mov rax, r14
cmp rdx, 0x1000
jb 0x180027804
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180027856
mov rcx, r14
call fcn.180093588
nop
lea rcx, [rbp + 0x140]
call fcn.180016f30
nop
lea rcx, [rbp - 0x40]
call fcn.180016f30
mov rax, rbx
mov rcx, qword [rbp + 0x4d0]
xor rcx, rsp
call fcn.180093c30
lea r11, [rsp + 0x5e0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.18009a4c4
nop
call fcn.180001ee0
int3
call fcn.18009a4c4
nop
call fcn.180001ee0
int3
call fcn.18009a4c4
int3
call fcn.18009a4c4
int3