Function at 0x14000b0e0
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov dword [rax + 0x18], r8d
mov qword [rax + 0x10], rdx
mov dword [rax + 8], ecx
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0xe8]
sub rsp, 0x1b0
xor eax, eax
mov qword [rbp + 0xf8], 0xca0
mov rsi, r9
lea rdi, [rsp + 0x50]
xor r12d, r12d
lea r8, [rsp + 0x50]
xor edx, edx
mov qword [rsp + 0x20], r12
lea r14d, [rax + 0x40]
mov ecx, r14d
mov r9d, r14d
rep stosb byte [rdi], al
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x50], r14
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x14000b153
mov ebx, dword [rbp - 0x78]
shr ebx, 1
and bl, 1
jmp 0x14000b156
mov bl, r12b
mov edx, 0x114
lea rdi, [rbp - 0x70]
mov ecx, edx
xor eax, eax
rep stosb byte [rdi], al
lea rcx, [rbp - 0x70]
mov dword [rbp - 0x70], edx
call qword [sym.imp.ntdll.dll_RtlGetVersion]
mov r15d, dword [rbp - 0x64]
cmp r15d, 0x1db0
jb 0x14000b1c7
xor r9d, r9d
lea rcx, [rbp + 0xf8]
mov edx, 0x3000
call fcn.140009f60
mov rdi, rax
test rax, rax
je 0x14000b1c7
xor edx, edx
mov qword [rsp + 0x28], r12
xor r9d, r9d
mov qword [rsp + 0x20], r12
xor r8d, r8d
lea ecx, [rdx + 2]
call qword [sym.imp.ntdll.dll_RtlCreateHeap]
mov qword [rdi + 0x20], rax
test rax, rax
jne 0x14000b1db
mov rcx, rdi
call fcn.140009fdc
xor eax, eax
add rsp, 0x1b0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 1]
call qword [sym.imp.ntdll.dll_RtlSetHeapInformation]
mov dword [rdi + 0x10], 1
lea rcx, [rbp + 0xf0]
mov dword [rdi + 4], r12d
mov byte [rdi + 1], 1
mov dword [rdi + 0xc], r15d
mov eax, dword [0x7ffe0330]
mov dword [rbp + 0xf0], eax
call qword [sym.imp.ntdll.dll_RtlRandomEx]
mov ecx, 0x10840014
mov byte [rdi], bl
mov dword [rdi + 8], eax
cmp r15d, 0x3a95
mov eax, 0x10800010
cmovbe eax, ecx
mov rcx, rdi
mov dword [rdi + 0x14], eax
call fcn.14000ac90
test eax, eax
jne 0x14000b252
mov rcx, qword [rdi + 0x20]
call qword [sym.imp.ntdll.dll_RtlDestroyHeap]
jmp 0x14000b1bf
lea rdx, str._temp__
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rax, [rdi + 0x474]
mov dword [rsp + 0x30], 0x2080000
lea r9, [rbp + 0x100]
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x30]
mov dword [rbp + 0x100], r12d
lea rdx, [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlExpandEnvironmentStrings_U]
mov edx, 0x80000000
lea ecx, [rax + rdx]
test edx, ecx
jne 0x14000b2bb
cmp eax, 0xc0000023
je 0x14000b2bb
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosErrorNoTeb]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rbx, [rdi + 0x67e]
mov r15d, 0x104
mov rdx, rbx
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
cmp eax, r15d
jae 0x14000b314
mov rax, rbx
test rbx, rbx
je 0x14000b314
cmp word [rbx], r12w
je 0x14000b2f1
add rax, 2
cmp word [rax], r12w
jne 0x14000b2e7
sub rax, rbx
sar rax, 1
je 0x14000b314
lea rcx, [rbx + rax*2]
cmp rbx, rcx
lea rax, [rcx - 2]
cmovne rbx, rax
mov eax, 0x5c
cmp word [rbx], ax
je 0x14000b314
mov dword [rcx], eax
lea rcx, [rdi + 0xa92]
lea rdx, [rdi + 0x26a]
call fcn.140001a5c
lea rdx, str.cmd.exe
call fcn.140001a20
mov r9, qword [0x1400268c8]
test r9, r9
je 0x14000b347
mov edx, dword [r9 + 8]
test edx, edx
jne 0x14000b396
mov r9d, 4
lea rax, [rbp + 0x110]
lea r8, [rbp + 0x100]
mov qword [rsp + 0x20], rax
or rcx, 0xffffffffffffffff
lea edx, [r9 + 0x20]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
jns 0x14000b37b
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
mov rcx, qword [0x1400268c8]
test rcx, rcx
je 0x14000b390
mov eax, dword [rbp + 0x100]
mov dword [rcx + 8], eax
mov edx, dword [rbp + 0x100]
mov eax, edx
and eax, 0x3f
sub r14d, eax
mov eax, edx
mov cl, r14b
ror rsi, cl
xor rsi, rax
mov rax, rdi
mov qword [rdi + 0x28], rsi
jmp 0x14000b1c9