Function at 0x1400774d0
Capabilities:
Get common file path

Disassembly:
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x17f0]
mov eax, 0x18f0
call fcn.140247340
sub rsp, rax
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x1920], rbx
mov qword [rsp + 0x1928], rsi
mov qword [rsp + 0x1938], rdi
mov r14, r9
mov rsi, r8
mov r13, rdx
mov r12, rcx
mov r9d, 1
mov r8d, r9d
lea rdx, str.Rule:
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
mov r9d, 1
mov r8d, r9d
mov rdx, qword [r14 + 0x68]
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
mov r9d, 1
mov r8d, r9d
mov rdx, qword [r14 + 0x10]
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
mov r9d, 1
mov r8d, r9d
lea rdx, str.m_pszProcessPath:
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
mov r9d, 1
mov r8d, r9d
mov rdx, qword [rsi + 0x38]
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
mov r9d, 1
mov r8d, r9d
lea rdx, str.m_pszCLSID:
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
mov r9d, 1
mov r8d, r9d
mov rdx, qword [rsi + 0x68]
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
mov r9d, 1
mov r8d, r9d
lea rdx, str.m_pszFileDataSource:
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
mov r9d, 1
mov r8d, r9d
mov rdx, qword [rsi + 0x148]
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
mov r9d, 1
mov r8d, r9d
lea rdx, str.m_pszRegKeyRoot:
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
mov r9d, 1
mov r8d, r9d
mov rdx, qword [rsi + 0xe8]
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
mov r9d, 1
mov r8d, r9d
lea rdx, str.m_pszRegPath:
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
mov r9d, 1
mov r8d, r9d
mov rdx, qword [rsi + 0xb8]
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
mov r9d, 1
mov r8d, r9d
lea rdx, str.m_pszRegValue:
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
mov r9d, 1
mov r8d, r9d
mov rdx, qword [rsi + 0x118]
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
xor edx, edx
mov r8d, 0x410
lea rcx, [rbp + 0x13e0]
call fcn.140249b10
mov edx, 0x410
lea rcx, [rbp + 0x13e0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea rcx, [rbp + 0x13e0]
mov rdi, 0xffffffffffffffff
mov rax, rdi
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x1400776f0
cmp dword [rsi + 0x40], eax
jbe 0x140077749
mov r8d, eax
lea rdx, [rbp + 0x13e0]
mov rcx, qword [rsi + 0x38]
call qword [sym.imp.SHLWAPI.dll_StrCmpNIA]
test eax, eax
jne 0x140077749
lea rdx, [rsi + 0x30]
lea rcx, [r12 + 8]
call fcn.140025630
test eax, eax
je 0x140077749
mov r9d, 1
mov r8d, r9d
lea rdx, str.Valid_MS_Module
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
jmp 0x140077cf0
lea rcx, [rbp + 0x100]
call fcn.1400270b0
nop
lea rcx, [rbp + 0xb60]
call fcn.1400279f0
nop
lea rcx, [rsp + 0x50]
call fcn.14000cb90
nop
mov r15, qword [r14 + 0x10]
xor ebx, ebx
mov rcx, qword [rbp + 0x120]
test rcx, rcx
je 0x14007778c
call fcn.140247060
mov qword [rbp + 0x120], rbx
test r15, r15
je 0x1400777ce
mov rax, rdi
inc rax
cmp byte [r15 + rax], bl
jne 0x140077794
mov dword [rbp + 0x128], eax
lea ecx, [rax + 1]
call fcn.140247068
mov qword [rbp + 0x120], rax
test rax, rax
je 0x1400777ee
mov r8d, dword [rbp + 0x128]
inc r8d
mov rdx, r15
mov rcx, rax
call fcn.1402496a0
jmp 0x1400777ee
mov dword [rbp + 0x128], ebx
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov qword [rbp + 0x120], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov r15, qword [rsi + 0x38]
mov rcx, qword [rbp + 0x138]
test rcx, rcx
je 0x14007780a
call fcn.140247060
mov qword [rbp + 0x138], rbx
test r15, r15
je 0x14007784c
mov rax, rdi
inc rax
cmp byte [r15 + rax], bl
jne 0x140077812
mov dword [rbp + 0x140], eax
lea ecx, [rax + 1]
call fcn.140247068
mov qword [rbp + 0x138], rax
test rax, rax
je 0x14007786c
mov r8d, dword [rbp + 0x140]
inc r8d
mov rdx, r15
mov rcx, rax
call fcn.1402496a0
jmp 0x14007786c
mov dword [rbp + 0x140], ebx
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov qword [rbp + 0x138], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov r15, qword [rsi + 0x68]
mov rcx, qword [rbp + 0x168]
test rcx, rcx
je 0x140077888
call fcn.140247060
mov qword [rbp + 0x168], rbx
test r15, r15
je 0x1400778ca
mov rax, rdi
inc rax
cmp byte [r15 + rax], bl
jne 0x140077890
mov dword [rbp + 0x170], eax
lea ecx, [rax + 1]
call fcn.140247068
mov qword [rbp + 0x168], rax
test rax, rax
je 0x1400778ea
mov r8d, dword [rbp + 0x170]
inc r8d
mov rdx, r15
mov rcx, rax
call fcn.1402496a0
jmp 0x1400778ea
mov dword [rbp + 0x170], ebx
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov qword [rbp + 0x168], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov r15, qword [rsi + 0x148]
mov rcx, qword [rbp + 0x248]
test rcx, rcx
je 0x140077909
call fcn.140247060
mov qword [rbp + 0x248], rbx
test r15, r15
je 0x14007794b
mov rax, rdi
inc rax
cmp byte [r15 + rax], bl
jne 0x140077911
mov dword [rbp + 0x250], eax
lea ecx, [rax + 1]
call fcn.140247068
mov qword [rbp + 0x248], rax
test rax, rax
je 0x14007796b
mov r8d, dword [rbp + 0x250]
inc r8d
mov rdx, r15
mov rcx, rax
call fcn.1402496a0
jmp 0x14007796b
mov dword [rbp + 0x250], ebx
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov qword [rbp + 0x248], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov r15, qword [rsi + 0xe8]
mov rcx, qword [rbp + 0x1e8]
test rcx, rcx
je 0x14007798a
call fcn.140247060
mov qword [rbp + 0x1e8], rbx
test r15, r15
je 0x1400779cc
mov rax, rdi
inc rax
cmp byte [r15 + rax], bl
jne 0x140077992
mov dword [rbp + 0x1f0], eax
lea ecx, [rax + 1]
call fcn.140247068
mov qword [rbp + 0x1e8], rax
test rax, rax
je 0x1400779ec
mov r8d, dword [rbp + 0x1f0]
inc r8d
mov rdx, r15
mov rcx, rax
call fcn.1402496a0
jmp 0x1400779ec
mov dword [rbp + 0x1f0], ebx
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov qword [rbp + 0x1e8], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov r15, qword [rsi + 0xb8]
mov rcx, qword [rbp + 0x1b8]
test rcx, rcx
je 0x140077a0b
call fcn.140247060
mov qword [rbp + 0x1b8], rbx
test r15, r15
je 0x140077a4d
mov rax, rdi
inc rax
cmp byte [r15 + rax], bl
jne 0x140077a13
mov dword [rbp + 0x1c0], eax
lea ecx, [rax + 1]
call fcn.140247068
mov qword [rbp + 0x1b8], rax
test rax, rax
je 0x140077a6d
mov r8d, dword [rbp + 0x1c0]
inc r8d
mov rdx, r15
mov rcx, rax
call fcn.1402496a0
jmp 0x140077a6d
mov dword [rbp + 0x1c0], ebx
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov qword [rbp + 0x1b8], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov r15, qword [rsi + 0x118]
mov rcx, qword [rbp + 0x218]
test rcx, rcx
je 0x140077a8c
call fcn.140247060
mov qword [rbp + 0x218], rbx
test r15, r15
je 0x140077ace
mov rax, rdi
inc rax
cmp byte [r15 + rax], bl
jne 0x140077a94
mov dword [rbp + 0x220], eax
lea ecx, [rax + 1]
call fcn.140247068
mov qword [rbp + 0x218], rax
test rax, rax
je 0x140077aee
mov r8d, dword [rbp + 0x220]
inc r8d
mov rdx, r15
mov rcx, rax
call fcn.1402496a0
jmp 0x140077aee
mov dword [rbp + 0x220], ebx
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov qword [rbp + 0x218], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
lea rdx, [rbp + 0x100]
lea rcx, [rbp + 0xb70]
call fcn.1400284d0
mov eax, dword [r14 + 0x70]
mov rcx, qword [r14 + 0x68]
test rcx, rcx
je 0x140077b27
cmp eax, 0xffffffff
jne 0x140077b1e
mov rax, rdi
inc rax
cmp byte [rcx + rax], bl
jne 0x140077b16
mov dword [rbp - 0x40], eax
mov qword [rbp - 0x48], rcx
jmp 0x140077b2e
mov dword [rbp - 0x40], ebx
mov qword [rbp - 0x48], rbx
mov r15, qword [r14 + 0x10]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140077b46
call fcn.140247060
mov qword [rsp + 0x60], rbx
test r15, r15
je 0x140077b84
nop dword [rax + rax]
inc rdi
cmp byte [r15 + rdi], bl
jne 0x140077b50
mov dword [rsp + 0x68], edi
lea ecx, [rdi + 1]
call fcn.140247068
mov qword [rsp + 0x60], rax
test rax, rax
je 0x140077ba0
mov r8d, dword [rsp + 0x68]
inc r8d
mov rdx, r15
mov rcx, rax
call fcn.1402496a0
jmp 0x140077ba0
mov dword [rsp + 0x68], ebx
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov qword [rsp + 0x60], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov eax, dword [r14 + 0x104]
mov dword [rbp + 0x54], eax
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x11b8]
call fcn.14000db90
mov rax, qword [r12]
lea rdx, [rbp + 0xb60]
mov rcx, r12
call qword [rax + 0x38]
test eax, eax
jne 0x140077ccc
lea rdx, str.:WINDOWS
mov rcx, qword [rbp + 0xba8]
call qword [sym.imp.SHLWAPI.dll_StrStrIA]
test rax, rax
je 0x140077bfd
call fcn.140192ec0
mov r15d, ebx
test eax, eax
sete r15b
jmp 0x140077c2e
mov byte [0x14034cfcd], bl
mov rax, qword [rbp + 0x1220]
movzx ecx, byte [rax]
mov r15d, ebx
cmp cl, 0x2a
sete r15b
cmp byte [0x14034cfcc], bl
je 0x140077c2e
cmp cl, 0x2a
jne 0x140077c2e
mov r15d, ebx
mov byte [0x14034cfcd], 1
mov rdx, qword [rbp + 0xba8]
lea rcx, [rsp + 0x30]
call fcn.1400770f0
nop
mov rdi, qword [rsp + 0x38]
mov rdx, rdi
lea rcx, [rbp + 0x750]
call fcn.1400be890
nop
mov qword [rbp + 0x1830], rbx
test r15d, r15d
jne 0x140077d13
cmp dword [rbp + 0x13c0], r15d
jne 0x140077d13
lea rdx, [rbp + 0x1830]
lea rcx, [rbp + 0x750]
call fcn.1400c1930
cmp eax, 0xfffffffe
je 0x140077c93
cmp eax, 1
jne 0x140077d13
mov rdx, qword [rbp + 0x1830]
lea rcx, [0x14037d1a0]
call fcn.140078710
test eax, eax
je 0x140077d13
lea rcx, [rbp + 0x750]
call fcn.1400beab0
nop
cmp dword [rsp + 0x44], 1
jne 0x140077ccc
test rdi, rdi
je 0x140077ccc
mov rcx, rdi
call fcn.140247060
nop
lea rcx, [rsp + 0x50]
call fcn.14000d760
nop
lea rcx, [rbp + 0xb60]
call fcn.1400283f0
nop
lea rcx, [rbp + 0x100]
call fcn.140027e10
xor eax, eax
lea r11, [rsp + 0x18f0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea rcx, [rbp + 0x750]
call fcn.1400beab0
nop
cmp dword [rsp + 0x44], 1
jne 0x140077d35
test rdi, rdi
je 0x140077d35
mov rcx, rdi
call fcn.140247060
nop
lea rcx, [rsp + 0x50]
call fcn.14000d760
nop
lea rcx, [rbp + 0xb60]
call fcn.1400283f0
nop
lea rcx, [rbp + 0x100]
call fcn.140027e10
cmp dword [r14 + 0x104], 2
jne 0x140077e17
mov rax, qword [rsi + 0xb8]
mov r9, qword [r14 + 0x68]
mov edx, 0x410
cmp byte [rax], 0
je 0x140077dac
mov ebx, 1
mov rcx, qword [rsi + 0x118]
cmp byte [rcx], 0
je 0x140077db0
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r8, str._s_r_n_s_s
lea rcx, [rbp + 0x750]
call fcn.14000b150
jmp 0x140077dc8
mov rax, qword [rsi + 0x38]
mov qword [rsp + 0x20], rax
lea r8, [0x140296e1c]
lea rcx, [rbp + 0x750]
call fcn.14000b150
mov edx, ebx
lea rcx, [rbp + 0x750]
call fcn.1401de4a0
cmp dword [rsi + 0x40], 0
je 0x140077dfd
mov rax, qword [rbp + 0x1848]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x1840]
mov r8, r14
mov rdx, rsi
mov rcx, r13
call fcn.14002e3b0
mov rax, qword [r12]
mov r8, r14
mov rdx, rsi
mov rcx, r12
call qword [rax + 0x30]
mov eax, 1
jmp 0x140077cf2
mov r9d, 1
mov r8d, r9d
lea rdx, str.DetectedItem___Leave
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
jmp 0x140077cf0