Function at 0x140004dbc
Capabilities:
Get common file path
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1f8]
sub rsp, 0x2d0
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x1402479e0]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
xor edi, edi
mov word [rbp - 0x50], di
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp - 0x4e]
call fcn.140183f90
lea rdx, [0x14020c0d4]
lea rcx, [rsp + 0x58]
call fcn.140005620
nop
lea rdx, [rbp - 0x50]
mov ebx, 0x104
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x58]
call fcn.140005784
mov r8d, ebx
lea rdx, [rbp - 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [rbp - 0x80], 0x6422000b
mov dword [rbp - 0x7c], 0x12eb5ebc
mov dword [rbp - 0x78], 0x6412e9b
mov dword [rbp - 0x74], 0x274844df
mov dword [rbp - 0x70], 0x62311872
mov dword [rbp - 0x6c], 0x2da839f1
mov dword [rbp - 0x68], 0x5ed8640c
mov dword [rbp - 0x64], 0x2ef81284
mov dword [rbp - 0x60], 0x44df0639
lea rcx, [rbp - 0x80]
call fcn.14000433c
lea rbx, [rbp - 0x68]
lea edx, [rdi + 0x2e]
lea rcx, [rbp - 0x50]
call fcn.140183df0
mov rcx, rax
lea rax, [rbp - 0x68]
sub rcx, rax
movzx eax, word [rbx]
mov word [rbx + rcx], ax
lea rbx, [rbx + 2]
test ax, ax
jne 0x140004eb5
mov edx, 0x5c
lea rcx, [rbp - 0x50]
call fcn.140183df0
lea rdx, [rax + 2]
lea rcx, [rsp + 0x58]
call fcn.140005784
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x58]
lea rcx, [0x140259920]
call fcn.140005980
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x40], edi
mov r8d, 0x81
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x48]
call fcn.140005d50
test eax, eax
jne 0x140004f5c
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x140004fae
mov r15d, dword [rax + 0x98]
mov r13d, dword [rax + 0x9c]
mov ebx, dword [rsp + 0x40]
add ebx, 0xffffff60
lea r12, [rax + 0xa0]
mov edx, ebx
mov ecx, 1
call fcn.140183cac
mov rsi, rax
test rax, rax
jne 0x140004f66
mov edi, 0xfffffffd
jmp 0x140005042
call fcn.140002bb8
test ebx, ebx
je 0x140004f91
mov r14, rsi
sub r12, rsi
dec ebx
shr ebx, 4
inc ebx
lea rdx, [r12 + r14]
mov rcx, r14
call fcn.140002ccc
add r14, 0x10
dec rbx
jne 0x140004f7c
mov rdx, r15
mov ecx, 1
call fcn.140183cac
mov r14, rax
mov rcx, rsi
test rax, rax
jne 0x140004fb8
call fcn.140182ff8
mov edi, 0xfffffffc
jmp 0x140005042
mov r9d, r15d
mov r8d, r13d
mov rdx, rax
call fcn.1400043fc
mov ebx, eax
mov rcx, rsi
call fcn.140182ff8
cmp ebx, r15d
je 0x140004fe4
mov rcx, r14
call fcn.140182ff8
mov edi, 0xfffffffb
jmp 0x140005042
lea rcx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rcx, qword [rsp + 0x58]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x78]
mov r8d, r15d
mov rdx, r14
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp qword [rsp + 0x70], 8
jb 0x140005054
mov rcx, qword [rsp + 0x58]
call fcn.140005e04
mov eax, edi
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.140182f30
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret