Function at 0x140003b50
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x4e0
mov rax, qword [0x14009b010]
xor rax, rsp
mov qword [rsp + 0x4d0], rax
mov rdi, rdx
mov ebx, ecx
xor esi, esi
mov r15d, esi
mov dword [rsp + 0x20], esi
mov qword [rsp + 0x190], rsi
lea rcx, [rsp + 0x190]
call fcn.140038ce0
nop
mov byte [rsp + 0x20], sil
cmp ebx, 1
jle 0x140003f3e
mov rdx, qword [rdi + 8]
mov qword [rsp + 0x1d0], rsi
mov qword [rsp + 0x1e0], rsi
mov qword [rsp + 0x1e8], SafeArrayGetLBound
mov byte [rsp + 0x1d0], sil
mov r14, 0xffffffffffffffff
mov r8, r14
inc r8
cmp byte [rdx + r8], 0
jne 0x140003be0
lea rcx, [rsp + 0x1d0]
call fcn.140005460
nop
mov r8, qword [rsp + 0x1e0]
test r8, r8
je 0x140003d8a
lea rax, [rsp + 0x1d0]
mov rdx, qword [rsp + 0x1e8]
cmp rdx, 0x10
setae r9b
mov rcx, qword [rsp + 0x1d0]
cmovae rax, rcx
cmp byte [rax], 0x2d
je 0x140003c4a
lea rax, [rsp + 0x1d0]
test r9b, r9b
cmovne rax, rcx
cmp byte [rax], 0x2f
jne 0x140003d9a
mov qword [rsp + 0x1b0], rsi
mov qword [rsp + 0x1c0], rsi
mov qword [rsp + 0x1c8], SafeArrayGetLBound
cmp r8, 1
jb 0x1400046e2
lea rax, [r8 - 1]
mov r8, r14
cmp rax, r14
cmovb r8, rax
lea rdx, [rsp + 0x1d0]
test r9b, r9b
cmovne rdx, rcx
inc rdx
lea rcx, [rsp + 0x1b0]
call fcn.140005460
mov r15d, 1
lea r12, [rsp + 0x1b0]
mov r13, qword [rsp + 0x1c8]
mov rsi, qword [rsp + 0x1b0]
mov rax, qword [rsp + 0x1c0]
cmp r13, 0x10
jb 0x140003cd5
lea rbx, [rsi + rax]
mov rdi, rsi
mov r12, rsi
jmp 0x140003ce8
lea rbx, [rsp + 0x1b0]
add rbx, rax
lea rdi, [rsp + 0x1b0]
cmp rdi, rbx
je 0x140003d1c
sub r12, rdi
movsx ecx, byte [rdi]
call fcn.14004e6e0
mov byte [rdi + r12], al
inc rdi
cmp rdi, rbx
jne 0x140003cf0
mov r13, qword [rsp + 0x1c8]
mov rax, qword [rsp + 0x1c0]
mov rsi, qword [rsp + 0x1b0]
lea rcx, [rsp + 0x1b0]
cmp r13, 0x10
setae bl
cmovae rcx, rsi
cmp rax, 0xb
jne 0x140003d55
mov r8, rax
lea rdx, str.currenthour
call fcn.14004acf0
mov ecx, dword [rsp + 0x20]
movzx ecx, cl
test eax, eax
cmove ecx, r15d
mov dword [rsp + 0x20], ecx
test bl, bl
je 0x140003d8a
lea rdx, [r13 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140003d82
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400046e7
mov rcx, rsi
call fcn.1400452ac
mov rcx, qword [rsp + 0x1d0]
mov rdx, qword [rsp + 0x1e8]
cmp rdx, 0x10
jb 0x140003dcd
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003dc8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400046ed
call fcn.1400452ac
xor esi, esi
movzx edx, byte [rsp + 0x20]
lea rcx, [rsp + 0x250]
call fcn.14001ebc0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x230], xmm0
movups xmmword [rsp + 0x240], xmm0
movups xmmword [rsp + 0x1f0], xmm0
mov r13d, 3
mov word [rsp + 0x1fe], r13w
movdqa xmmword [rsp + 0x200], xmm0
xorps xmm1, xmm1
movdqa xmmword [rsp + 0x210], xmm1
movdqa xmmword [rsp + 0x220], xmm0
mov qword [rsp + 0x230], rsi
mov qword [rsp + 0x238], 0x400
mov dword [rsp + 0x240], esi
mov qword [rsp + 0x248], rsi
lea ecx, [r13 + 0x15]
call fcn.140045020
mov qword [rsp + 0x190], rax
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [rax], xmm0
mov qword [rax + 0x10], rcx
mov rcx, rax
call fcn.140005030
nop
mov qword [rsp + 0x200], rax
mov qword [rsp + 0x208], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x470], xmm0
movups xmmword [rsp + 0x480], xmm0
movups xmmword [rsp + 0x490], xmm0
movups xmmword [rsp + 0x4a0], xmm0
movups xmmword [rsp + 0x4b0], xmm0
movups xmmword [rsp + 0x4c0], xmm0
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], si
lea r8d, [r13 + 0x41]
lea rdx, str.SOFTWARESophosSophos_Network_Threat_ProtectionTelemetryHeartbeat
lea rcx, [rsp + 0x28]
call fcn.140005330
nop
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x470]
lea rcx, [rsp + 0x250]
call fcn.14001eec0
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x140003f4f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003f4a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400046f3
jmp 0x140003f4a
mov r14, 0xffffffffffffffff
jmp 0x140003dcf
call fcn.1400452ac
mov r9, qword [rsp + 0x200]
test r9, r9
je 0x1400046f9
xorps xmm0, xmm0
movups xmmword [rsp + 0x1a0], xmm0
mov edi, 0x405
mov word [rsp + 0x1ae], di
mov rax, qword [rsp + 0x1a8]
movabs r12, 0xffff000000000000
and rax, r12
lea rcx, str.heartbeat
or rax, rcx
mov qword [rsp + 0x1a8], rax
mov dword [rsp + 0x1a0], 9
lea r8, [rsp + 0x470]
lea rdx, [rsp + 0x1a0]
lea rcx, [rsp + 0x1f0]
call fcn.140005120
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x410], xmm0
movups xmmword [rsp + 0x420], xmm0
movups xmmword [rsp + 0x430], xmm0
movups xmmword [rsp + 0x440], xmm0
movups xmmword [rsp + 0x450], xmm0
movups xmmword [rsp + 0x460], xmm0
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], si
mov r8d, 0x3e
lea rdx, str.SOFTWARESophosSophos_Network_Threat_ProtectionTelemetryMTD
lea rcx, [rsp + 0x28]
call fcn.140005330
nop
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x410]
lea rcx, [rsp + 0x250]
call fcn.14001f480
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x140004088
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004083
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004748
call fcn.1400452ac
mov r9, qword [rsp + 0x200]
test r9, r9
je 0x14000474e
xorps xmm0, xmm0
movups xmmword [rsp + 0x1a0], xmm0
mov word [rsp + 0x1ae], di
mov rax, qword [rsp + 0x1a8]
and rax, r12
lea rcx, [0x14008728c]
or rax, rcx
mov qword [rsp + 0x1a8], rax
mov dword [rsp + 0x1a0], r13d
lea r8, [rsp + 0x410]
lea rdx, [rsp + 0x1a0]
lea rcx, [rsp + 0x1f0]
call fcn.140005120
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x350], xmm0
movups xmmword [rsp + 0x360], xmm0
movups xmmword [rsp + 0x370], xmm0
movups xmmword [rsp + 0x380], xmm0
movups xmmword [rsp + 0x390], xmm0
mov qword [rsp + 0x3a0], rax
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], 7
lea r8d, [rax + 0x25]
lea rdx, str.SOFTWAREWOW6432NodeSophosTelemetry
lea rcx, [rsp + 0x48]
call fcn.140005330
lea r8, [rsp + 0x48]
lea rcx, [rsp + 0x350]
call fcn.14003bf60
nop
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], 7
mov r8d, reloc.OLEAUT32.dll_SafeArrayGetElemsize
lea rdx, [0x140087290]
lea rcx, [rsp + 0x48]
call fcn.140005330
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x350]
call fcn.14003c0c0
or r15d, 2
lea rcx, [rsp + 0x68]
call fcn.140039b90
mov eax, eax
imul rbx, rax, 0x989680
lea rcx, [rsp + 0x70]
call fcn.1400024b0
xorps xmm0, xmm0
movups xmmword [rsp + 0x3b0], xmm0
movups xmmword [rsp + 0x3c0], xmm0
movups xmmword [rsp + 0x3d0], xmm0
movups xmmword [rsp + 0x3e0], xmm0
movups xmmword [rsp + 0x3f0], xmm0
movups xmmword [rsp + 0x400], xmm0
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], si
mov r8d, reloc.OLEAUT32.dll_SafeArrayLock
lea rdx, str.DetectedFailures.log
lea rcx, [rsp + 0x48]
call fcn.140005330
or r15d, 0xc
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0xa8], 7
mov word [rsp + 0x90], si
mov r8d, 4
lea rdx, str.Logs
lea rcx, [rsp + 0x90]
call fcn.140005330
or r15d, 0x30
mov dword [rsp + 0x20], r15d
lea rax, [0x140086f20]
mov qword [rsp + 0x1a0], rax
mov qword [rsp + 0x1a8], 0x20
movaps xmm0, xmmword [rsp + 0x1a0]
movdqa xmmword [rsp + 0x1d0], xmm0
mov qword [rsp + 0x190], rsi
lea rax, [rsp + 0x190]
mov qword [rsp + 0xd0], rax
mov byte [rsp + 0xd8], 1
lea r9, [rsp + 0x190]
xor r8d, r8d
xor edx, edx
lea rcx, [0x140077d20]
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
js 0x14000479d
mov rdx, qword [rsp + 0x190]
test rdx, rdx
je 0x140004897
cmp word [rdx], 0
je 0x140004897
nop word [rax + rax]
inc r14
cmp word [rdx + r14*2], 0
jne 0x140004300
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], si
mov r8, r14
lea rcx, [rsp + 0x28]
call fcn.140005330
or r15d, 0x1c0
mov dword [rsp + 0x20], r15d
lea rcx, [rsp + 0x28]
call fcn.14003e230
lea rdx, [rsp + 0x1d0]
lea rcx, [rsp + 0x28]
call fcn.14003e190
nop
mov rcx, qword [rsp + 0x190]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea r8, [rsp + 0x90]
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x68]
call fcn.140002420
nop
lea r8, [rsp + 0x48]
mov rdx, rax
lea rcx, [rsp + 0xb0]
call fcn.140002420
nop
mov r9, rbx
mov r8, rax
lea rdx, [rsp + 0x3b0]
call fcn.14001fa10
nop
lea rcx, [rsp + 0xb0]
call fcn.1400024b0
nop
lea rcx, [rsp + 0x68]
call fcn.1400024b0
nop
lea rcx, [rsp + 0x28]
call fcn.1400024b0
nop
lea rcx, [rsp + 0x90]
call fcn.1400024b0
nop
lea rcx, [rsp + 0x48]
call fcn.1400024b0
mov r9, qword [rsp + 0x200]
test r9, r9
je 0x1400047f6
xorps xmm0, xmm0
movups xmmword [rsp + 0x1a0], xmm0
mov word [rsp + 0x1ae], di
mov rax, qword [rsp + 0x1a8]
and rax, r12
lea rcx, str.detectedFailures
or rax, rcx
mov qword [rsp + 0x1a8], rax
mov dword [rsp + 0x1a0], SafeArrayGetLBound
lea r8, [rsp + 0x3b0]
lea rdx, [rsp + 0x1a0]
lea rcx, [rsp + 0x1f0]
call fcn.140005120
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x2f0], xmm0
movups xmmword [rsp + 0x300], xmm0
movups xmmword [rsp + 0x310], xmm0
movups xmmword [rsp + 0x320], xmm0
movups xmmword [rsp + 0x330], xmm0
mov qword [rsp + 0x340], rax
mov qword [rsp + 0x1b0], rsi
mov qword [rsp + 0x1c0], rsi
mov qword [rsp + 0x1c8], 7
lea r8d, [rax + 0x3e]
lea rdx, str.SOFTWARESophosSophos_Network_Threat_ProtectionTelemetryWeb
lea rcx, [rsp + 0x1b0]
call fcn.140005330
lea r8, [rsp + 0x1b0]
lea rcx, [rsp + 0x2f0]
call fcn.14003bf60
nop
lea rdx, [rsp + 0x2f0]
lea rcx, [rsp + 0x68]
call fcn.14000be60
nop
lea rdx, [rsp + 0x268]
mov rcx, rax
call fcn.1400100d0
nop
lea rcx, [rsp + 0x68]
call fcn.14000f660
mov qword [rsp + 0x68], rsi
lea rcx, [rsp + 0x78]
call fcn.14000e820
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x290], xmm0
movups xmmword [rsp + 0x2a0], xmm0
movups xmmword [rsp + 0x2b0], xmm0
movups xmmword [rsp + 0x2c0], xmm0
movups xmmword [rsp + 0x2d0], xmm0
movups xmmword [rsp + 0x2e0], xmm0
lea rcx, [rsp + 0x290]
call fcn.140004aa0
nop
lea rax, [rsp + 0x268]
cmp qword [rsp + 0x280], 0x10
cmovae rax, qword [rsp + 0x268]
mov qword [rsp + 0x1a0], rax
mov qword [rsp + 0x1a8], rax
lea rdx, [rsp + 0x1a0]
lea rcx, [rsp + 0x290]
call fcn.140007d90
mov r9, qword [rsp + 0x200]
test r9, r9
je 0x140004848
xorps xmm0, xmm0
movups xmmword [rsp + 0x1a0], xmm0
mov word [rsp + 0x1ae], di
mov rax, qword [rsp + 0x1a8]
and rax, r12
lea rcx, [0x14008730c]
or rax, rcx
mov qword [rsp + 0x1a8], rax
mov dword [rsp + 0x1a0], r13d
lea r8, [rsp + 0x290]
lea rdx, [rsp + 0x1a0]
lea rcx, [rsp + 0x1f0]
call fcn.140005120
nop
lea rdx, [rsp + 0x1f0]
lea rcx, [rsp + 0x68]
call fcn.1400037f0
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0x10
jb 0x140004614
mov rax, qword [rax]
mov rdx, rax
lea rcx, [0x14009d800]
call fcn.1400078a0
nop
lea rcx, [rsp + 0x68]
call fcn.140004ec0
nop
lea rcx, [rsp + 0x290]
call fcn.1400049d0
nop
lea rcx, [rsp + 0x268]
call fcn.140004ec0
nop
lea rcx, [rsp + 0x2f0]
call fcn.14003c030
nop
lea rcx, [rsp + 0x3b0]
call fcn.1400049d0
nop
lea rcx, [rsp + 0x350]
call fcn.14003c030
nop
lea rcx, [rsp + 0x410]
call fcn.1400049d0
nop
lea rcx, [rsp + 0x470]
call fcn.1400049d0
nop
lea rcx, [rsp + 0x1f0]
call fcn.1400049d0
nop
lea rcx, [rsp + 0x250]
call fcn.1400052a0
xor eax, eax
jmp 0x1400046b5
mov rcx, qword [rsp + 0x4d0]
xor rcx, rsp
call fcn.140045000
lea r11, [rsp + 0x4e0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.140005760
call fcn.14004eb2c
nop
call fcn.14004eb2c
nop
call fcn.14004eb2c
int3
lea rdx, str.rapidjson:_assertion_failed:
lea rcx, [rsp + 0x68]
call fcn.140004f20
nop
lea r8, str.allocator_
mov rdx, rax
lea rcx, [rsp + 0xb0]
call fcn.1400058c0
nop
mov rdx, rax
lea rcx, [rsp + 0xe0]
call fcn.1400019e0
lea rdx, [0x140098ce8]
lea rcx, [rsp + 0xe0]
call fcn.14004a344
nop
call fcn.14004eb2c
int3
lea rdx, str.rapidjson:_assertion_failed:
lea rcx, [rsp + 0x68]
call fcn.140004f20
nop
lea r8, str.allocator_
mov rdx, rax
lea rcx, [rsp + 0xb0]
call fcn.1400058c0
nop
mov rdx, rax
lea rcx, [rsp + 0xf8]
call fcn.1400019e0
lea rdx, [0x140098ce8]
lea rcx, [rsp + 0xf8]
call fcn.14004a344
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
call fcn.1400170a0
mov r8, rax
lea rcx, [rsp + 0x1b0]
call fcn.140001b10
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x1a0], xmm0
lea r8, str.SHGetKnownFolderPathW___failed
lea rdx, [rsp + 0x1a0]
lea rcx, [rsp + 0x140]
call fcn.140001de0
lea rdx, [0x1400990b0]
lea rcx, [rsp + 0x140]
call fcn.14004a344
nop
lea rdx, str.rapidjson:_assertion_failed:
lea rcx, [rsp + 0x1b0]
call fcn.140004f20
nop
lea r8, str.allocator_
mov rdx, rax
lea rcx, [rsp + 0x1d0]
call fcn.1400058c0
nop
mov rdx, rax
lea rcx, [rsp + 0x110]
call fcn.1400019e0
lea rdx, [0x140098ce8]
lea rcx, [rsp + 0x110]
call fcn.14004a344
nop
lea rdx, str.rapidjson:_assertion_failed:
lea rcx, [rsp + 0x68]
call fcn.140004f20
nop
lea r8, str.allocator_
mov rdx, rax
lea rcx, [rsp + 0xb0]
call fcn.1400058c0
nop
mov rdx, rax
lea rcx, [rsp + 0x128]
call fcn.1400019e0
lea rdx, [0x140098ce8]
lea rcx, [rsp + 0x128]
call fcn.14004a344
nop
call fcn.1400170a0
mov r8, rax
mov edx, r13d
lea rcx, [rsp + 0x1a0]
call fcn.140001b10
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x1d0], xmm0
lea r8, str.SHGetKnownFolderPathW___returned_null_path
lea rdx, [rsp + 0x1d0]
lea rcx, [rsp + 0x168]
call fcn.140001de0
lea rdx, [0x1400990b0]
lea rcx, [rsp + 0x168]
call fcn.14004a344
int3