Function at 0x1800022a0
Capabilities:
Get common file path
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbp
push rbx
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x1e8]
sub rsp, 0x2e8
mov rax, qword [0x18004d020]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
mov r14, rcx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor r13d, r13d
lea r15, [r13 - 1]
cmp byte [r14 + 0xb0], r13b
jne 0x180002356
mov dword [rbp - 0x70], 0x18
mov dword [rbp - 0x60], 1
mov qword [rbp - 0x68], r13
cmp byte [r14 + 0xb1], r13b
jne 0x1800024db
mov rcx, qword [r14 + 0x98]
lea r9, [rbp - 0x70]
mov qword [rsp + 0x30], r13
xor r8d, r8d
mov dword [rsp + 0x28], 0xa0000000
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [r14 + 0xb8], rax
cmp rax, r15
je 0x1800024e2
mov byte [r14 + 0xb0], 1
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [rsp + 0x40], r13d
cmp qword [r14 + 0xb8], r15
je 0x180002835
mov rbx, qword [rbp + 0x228]
test rbx, rbx
je 0x180002818
mov qword [rsp + 0x2e0], rsi
mov qword [rsp + 0x2d8], r12
lea r12, [rbp + 0x230]
call fcn.180001490
mov qword [rsp + 0x28], r12
mov r9, rbx
xor r8d, r8d
mov qword [rsp + 0x20], r13
xor edx, edx
mov rdi, rax
mov rcx, qword [rax]
or rcx, 1
call fcn.180018ab8
mov esi, eax
mov eax, 0xffffffff
test esi, esi
cmovs esi, eax
mov eax, 2
lea edx, [rsi + 1]
mul rdx
mov rbx, rax
cmovo rbx, r15
mov rcx, rbx
call fcn.18000e170
mov r8, rbx
xor edx, edx
mov rcx, rax
mov r15, rax
call fcn.180010400
mov word [r15], r13w
mov r8, 0xffffffffffffffff
mov r9, qword [rbp + 0x228]
mov rdx, r15
mov rcx, qword [rdi]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r13
call fcn.180018ab8
lea rcx, [r14 + 0x28]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r9, qword [r14 + 0x80]
test r9, r9
je 0x1800027bf
lea r8, str._hs:_ls
mov qword [rsp + 0x20], r15
xor edx, edx
xor ecx, ecx
call fcn.180002010
mov esi, eax
mov eax, 2
lea edx, [rsi + 1]
mul rdx
mov rbx, rax
mov rax, 0xffffffffffffffff
cmovo rbx, rax
mov rcx, rbx
call fcn.18000e170
mov r8, rbx
xor edx, edx
mov rcx, rax
mov rdi, rax
call fcn.180010400
mov word [rdi], r13w
lea r8, str._hs:_ls
mov r9, qword [r14 + 0x80]
mov edx, esi
mov rcx, rdi
mov qword [rsp + 0x20], r15
call fcn.180002010
mov rcx, qword [r14 + 0xb8]
lea r8d, [rsi + rsi]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], r13
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [r14 + 0xb8]
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov edx, 2
mov rcx, rdi
call fcn.18000db10
jmp 0x1800027ea
mov qword [r14 + 0xb8], r15
mov ecx, 0x208
call fcn.18000e170
xor edx, edx
mov r8d, 0x208
mov rcx, rax
mov rbx, rax
call fcn.180010400
mov r8, qword [r14 + 0x90]
test r8, r8
je 0x18000252f
mov ecx, dword [r14 + 0xb4]
lea rdx, str._hsoutput__hs__lu.txt
mov r9, qword [r14 + 0x88]
mov dword [rsp + 0x20], ecx
mov rcx, rbx
call qword [sym.imp.USER32.dll_wsprintfW]
jmp 0x18000256b
xor edx, edx
lea rcx, [rbp - 0x50]
mov r8d, 0x208
call fcn.180010400
lea rdx, [rbp - 0x50]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov rcx, rbx
test eax, eax
je 0x1800027b1
lea r8, [rbp - 0x50]
lea rdx, str._lsglobal_apt_scenarios_output.txt
call qword [sym.imp.USER32.dll_wsprintfW]
mov edx, 4
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
lea r9, [rbp - 0x70]
mov rcx, rbx
mov dword [rsp + 0x20], 3
lea r8d, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [r14 + 0xb8], rax
cmp rax, r15
jne 0x180002797
mov qword [rsp + 0x30], r13
lea r9, [rbp - 0x70]
mov dword [rsp + 0x28], 0x80
mov edx, 0x40000000
mov r8d, 3
mov dword [rsp + 0x20], 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [r14 + 0xb8], rax
mov rcx, rbx
cmp rax, r15
je 0x1800027b1
xor r9d, r9d
mov qword [rsp + 0x50], r13
lea rax, [rsp + 0x58]
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], rax
lea edx, [r9 + 1]
lea r8d, [r9 + 4]
mov qword [rsp + 0x20], r13
mov qword [rsp + 0x58], r13
call qword [sym.imp.ADVAPI32.dll_GetNamedSecurityInfoW]
lea rdi, str.Everyone
test eax, eax
jne 0x18000269d
mov r8, qword [rsp + 0x50]
lea r9, [rsp + 0x48]
xorps xmm0, xmm0
mov qword [rbp - 0x80], r13
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x60], 0x1f01ff
lea ecx, [rax + 1]
mov qword [rsp + 0x64], 1
movdqu xmmword [rsp + 0x6c], xmm0
mov dword [rsp + 0x7c], 1
mov qword [rbp - 0x78], rdi
call qword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
test eax, eax
jne 0x18000269d
mov rax, qword [rsp + 0x48]
xor r9d, r9d
mov qword [rsp + 0x30], r13
mov rcx, rbx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
lea edx, [r9 + 1]
lea r8d, [r9 + 4]
call qword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1800026ad
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1800026bd
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor r9d, r9d
mov qword [rsp + 0x58], r13
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x38], rax
mov rcx, rbx
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], rax
lea edx, [r9 + 1]
lea r8d, [r9 + 4]
mov qword [rsp + 0x20], r13
mov qword [rsp + 0x50], r13
call qword [sym.imp.ADVAPI32.dll_GetNamedSecurityInfoW]
test eax, eax
jne 0x180002777
mov r8, qword [rsp + 0x58]
lea r9, [rsp + 0x48]
xorps xmm0, xmm0
mov qword [rbp - 0x80], r13
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x60], 0x1f01ff
lea ecx, [rax + 1]
mov dword [rsp + 0x64], 1
movdqu xmmword [rsp + 0x6c], xmm0
mov dword [rsp + 0x68], 3
mov dword [rsp + 0x7c], 1
mov qword [rbp - 0x78], rdi
call qword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
test eax, eax
jne 0x180002777
mov rax, qword [rsp + 0x48]
xor r9d, r9d
mov qword [rsp + 0x30], r13
mov rcx, rbx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
lea edx, [r9 + 1]
lea r8d, [r9 + 4]
call qword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x180002787
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x180002797
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov edx, 2
mov byte [r14 + 0xb1], 1
mov rcx, rbx
call fcn.18000db10
jmp 0x180002356
mov edx, 2
call fcn.18000db10
xor eax, eax
jmp 0x180002839
mov rcx, qword [r14 + 0xb8]
lea r8d, [rsi + rsi]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], r13
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [r14 + 0xb8]
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov edx, 2
mov rcx, r15
call fcn.18000db10
lea rcx, [r14 + 0x28]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r12, qword [rsp + 0x2d8]
mov r15, 0xffffffffffffffff
mov rsi, qword [rsp + 0x2e0]
cmp byte [r14 + 0xb1], r13b
je 0x180002835
mov rcx, qword [r14 + 0xb8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [r14 + 0xb8], r15
mov eax, dword [rsp + 0x40]
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.18000daf0
add rsp, 0x2e8
pop r15
pop r14
pop r13
pop rdi
pop rbx
pop rbp
ret