Function at 0x140001ea0
Capabilities:
Get common file path

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x1e8]
sub rsp, 0x2e8
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov rax, qword [0x14003e050]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
mov r14d, r9d
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x40]
call fcn.140019e30
mov edx, 0x104
lea rcx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor r15d, r15d
mov qword [rbp - 0x78], r15
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x78], r15
mov qword [rbp - 0x70], 7
mov word [rsp + 0x78], r15w
lea r8d, [r15 + 0xb]
lea rdx, str.apphelp.dll
lea rcx, [rsp + 0x78]
call fcn.140001fe0
nop
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], 7
mov word [rsp + 0x58], r15w
lea rax, [rbp - 0x40]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140001c00
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x58]
call fcn.140001fe0
nop
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x68]
call fcn.1400024c0
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x140001c70
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001c6b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001e77
call fcn.140018450
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], 7
mov word [rsp + 0x58], r15w
mov rdx, qword [rbp - 0x70]
cmp rdx, 8
jb 0x140001cc5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001cc0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001e7d
call fcn.140018450
mov qword [rbp - 0x78], r15
mov qword [rbp - 0x70], 7
mov word [rsp + 0x78], r15w
lea rcx, [rbp - 0x68]
cmp qword [rbp - 0x50], 8
cmovae rcx, qword [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], r15
mov ecx, 0x28
call fcn.140018414
mov qword [rsp + 0x38], rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
nop
mov qword [rsp + 0x40], r15
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.140004090
test rax, rax
je 0x140001d50
lea rdx, str.ImageExplorerMain
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140001d50
mov r9d, r14d
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
call rax
mov ebx, eax
jmp 0x140001d53
mov ebx, r15d
lea rax, [rsp + 0x38]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140001d6e
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x140001dba
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [rsp + 0x20], r15
call fcn.1400172b0
mov rcx, rax
call fcn.140017280
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x140001da5
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [rsp + 0x28], r15
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140001dba
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [rsp + 0x30], r15
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140001dca
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov qword [rsp + 0x48], r15
mov rdx, qword [rsp + 0x40]
test rdx, rdx
je 0x140001ddf
call fcn.140004c00
nop
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140001e03
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov edx, 0x28
mov rcx, qword [rsp + 0x38]
call fcn.140018450
mov qword [rsp + 0x38], r15
mov rdx, qword [rbp - 0x50]
cmp rdx, 8
jb 0x140001e3f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001e3a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001e71
call fcn.140018450
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x50], 7
mov word [rbp - 0x68], r15w
mov eax, ebx
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.1400183f0
add rsp, 0x2e8
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14001c674
nop
call fcn.14001c674
nop
call fcn.14001c674
int3
jmp 0x140001b40