Function at 0x40b050
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
sub rsp, 0x1c8
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov qword [rax - 8], rsi
mov qword [rax - 0x10], rdi
mov qword [rax - 0x18], r12
mov qword [rax - 0x20], r13
mov qword [rax - 0x28], r14
mov qword [rax - 0x30], r15
mov rax, qword [0x0045c120]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov dword [rsp + 0x20], edx
mov r15, rcx
call fcn.00418ad4
mov rcx, rax
xor eax, eax
test rcx, rcx
setne al
test eax, eax
jne 0x40b0bb
mov ecx, 0x80004005
call fcn.00401000
int3
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x30], rax
call fcn.00418ad4
mov rdx, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x40b0e9
mov ecx, 0x80004005
call fcn.00401000
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x38], rbx
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x40b16b
lea rcx, str.Error_:_Get_windows_path_error_n
call fcn.00405500
nop
lea rdx, [rbx - 0x18]
mov r12, 0xffffffffffffffff
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, r12d
test eax, eax
jg 0x40b140
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r12d
add r12d, 0xffffffff
test r12d, r12d
jg 0x40b161
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, 0x4e25
jmp 0x40b836
xor r14d, r14d
lea r12, [r14 - 1]
cmp dword [rsp + 0x20], r14d
jbe 0x40b7f6
lea rbp, str._system32drivers
mov rbx, r14
nop
nop
nop
mov rax, rbx
imul rax, rax, 0x1cc
cmp dword [rax + r15 + 0x1c8], 0
je 0x40b7de
cmp dword [rax + r15 + 0x1c0], 2
jne 0x40b1e0
mov eax, r14d
imul rax, rax, 0x1cc
lea rsi, [rax + r15 + 0x40]
lea rdi, str.FILTER
mov ecx, 7
repe cmpsb byte [rsi], byte [rdi]
jne 0x40b1e0
cmp byte [0x004aadf0], 1
je 0x40b7de
mov r10d, 0xf
mov qword [rsp + 0x68], r10
xor esi, esi
mov qword [rsp + 0x60], rsi
mov byte [rsp + 0x50], sil
xor eax, eax
mov rcx, r12
lea rdi, [rsp + 0x70]
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
cmp rcx, 0xfffffffffffffffe
jbe 0x40b222
call fcn.0043db70
mov r10, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
cmp r10, rdi
jae 0x40b243
mov r8, rsi
mov rdx, rdi
lea rcx, [rsp + 0x48]
call fcn.00402010
mov r10, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
jmp 0x40b26b
test rdi, rdi
jne 0x40b26b
mov qword [rsp + 0x60], rdi
lea rax, [rsp + 0x50]
cmp r10, 0x10
cmovae rax, qword [rsp + 0x50]
mov byte [rax], dil
mov r10, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
jmp 0x40b2b3
test rdi, rdi
je 0x40b2b3
lea rcx, [rsp + 0x50]
cmp r10, 0x10
cmovae rcx, qword [rsp + 0x50]
mov r9, rdi
lea r8, [rsp + 0x70]
mov rdx, r10
call fcn.00425d30
mov qword [rsp + 0x60], rdi
lea rax, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae rax, qword [rsp + 0x50]
mov byte [rax + rdi], 0
mov r10, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov eax, r14d
imul rax, rax, 0x1cc
add rax, r15
mov qword [rsp + 0x28], rax
lea rdx, [rax + 0x80]
xor eax, eax
mov rcx, r12
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
cmp rcx, 1
je 0x40b307
mov rcx, r12
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x48]
call fcn.00403fd0
mov r10, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
jmp 0x40b540
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x50]
cmp r10, 0x10
cmovae rax, rcx
cmp rbp, rax
jb 0x40b46b
lea rax, [rsp + 0x50]
cmp r10, 0x10
cmovae rax, rcx
add rax, rsi
cmp rax, rbp
jbe 0x40b46b
lea rax, [rsp + 0x50]
cmp r10, 0x10
cmovae rax, rcx
mov r13, rbp
sub r13, rax
cmp rsi, r13
jae 0x40b362
call fcn.0043dc40
mov r10, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov rax, rsi
sub rax, r13
mov ebp, 0x11
cmp rax, rbp
cmovb rbp, rax
mov rax, r12
sub rax, rsi
cmp rax, rbp
jbe 0x40b388
lea rax, [rsi + rbp]
cmp rax, rsi
jae 0x40b397
call fcn.0043db70
mov r10, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
test rbp, rbp
je 0x40b540
lea rdi, [rsi + rbp]
cmp rdi, 0xfffffffffffffffe
jbe 0x40b3b9
call fcn.0043db70
mov r10, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
cmp r10, rdi
jae 0x40b3da
mov r8, rsi
mov rdx, rdi
lea rcx, [rsp + 0x48]
call fcn.00402010
mov r10, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
jmp 0x40b405
test rdi, rdi
jne 0x40b405
mov qword [rsp + 0x60], rdi
lea rax, [rsp + 0x50]
cmp r10, 0x10
cmovae rax, qword [rsp + 0x50]
mov byte [rax], dil
mov r10, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
jmp 0x40b540
test rdi, rdi
je 0x40b540
lea r8, [rsp + 0x50]
mov rcx, qword [rsp + 0x50]
cmp r10, 0x10
cmovae r8, rcx
lea rax, [rsp + 0x50]
cmp r10, 0x10
cmovae rax, rcx
sub r10, rsi
lea rcx, [rax + rsi]
add r8, r13
mov r9, rbp
mov rdx, r10
call fcn.00425d30
mov qword [rsp + 0x60], rdi
lea rax, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae rax, qword [rsp + 0x50]
mov byte [rax + rdi], 0
mov r10, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
jmp 0x40b540
mov rax, r12
sub rax, rsi
cmp rax, 0x11
jbe 0x40b480
lea rax, [rsi + 0x11]
cmp rax, rsi
jae 0x40b48f
call fcn.0043db70
mov r10, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
lea rdi, [rsi + 0x11]
cmp rdi, 0xfffffffffffffffe
jbe 0x40b4a8
call fcn.0043db70
mov r10, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
cmp r10, rdi
jae 0x40b4c9
mov r8, rsi
mov rdx, rdi
lea rcx, [rsp + 0x48]
call fcn.00402010
mov r10, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
jmp 0x40b4f1
test rdi, rdi
jne 0x40b4f1
mov qword [rsp + 0x60], rdi
lea rax, [rsp + 0x50]
cmp r10, 0x10
cmovae rax, qword [rsp + 0x50]
mov byte [rax], dil
mov r10, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
jmp 0x40b540
test rdi, rdi
je 0x40b540
lea rcx, [rsp + 0x50]
cmp r10, 0x10
cmovae rcx, qword [rsp + 0x50]
sub r10, rsi
add rcx, rsi
mov r9d, 0x11
mov r8, rbp
mov rdx, r10
call fcn.00425d30
mov qword [rsp + 0x60], rdi
lea rax, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae rax, qword [rsp + 0x50]
mov byte [rax + rdi], 0
mov r10, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x50]
cmp r10, 0x10
cmovae rax, rcx
lea rdx, [0x00440e0c]
cmp rdx, rax
jb 0x40b697
lea rax, [rsp + 0x50]
cmp r10, 0x10
cmovae rax, rcx
add rax, rsi
cmp rax, rdx
jbe 0x40b697
lea rax, [rsp + 0x50]
cmp r10, 0x10
cmovae rax, rcx
mov r13, rdx
sub r13, rax
cmp rsi, r13
jae 0x40b5a2
call fcn.0043dc40
mov r10, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov rax, rsi
sub rax, r13
mov ebp, 1
cmp rax, rbp
cmovb rbp, rax
mov rax, r12
sub rax, rsi
cmp rax, rbp
jbe 0x40b5c8
lea rax, [rsi + rbp]
cmp rax, rsi
jae 0x40b5d7
call fcn.0043db70
mov r10, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
test rbp, rbp
je 0x40b75c
lea rdi, [rsi + rbp]
cmp rdi, 0xfffffffffffffffe
jbe 0x40b5f9
call fcn.0043db70
mov r10, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
cmp r10, rdi
jae 0x40b61a
mov r8, rsi
mov rdx, rdi
lea rcx, [rsp + 0x48]
call fcn.00402010
mov r10, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
jmp 0x40b63b
test rdi, rdi
jne 0x40b63b
mov qword [rsp + 0x60], rdi
lea rax, [rsp + 0x50]
cmp r10, 0x10
cmovae rax, qword [rsp + 0x50]
mov byte [rax], dil
jmp 0x40b75c
test rdi, rdi
je 0x40b75c
lea r8, [rsp + 0x50]
mov rcx, qword [rsp + 0x50]
cmp r10, 0x10
cmovae r8, rcx
lea rax, [rsp + 0x50]
cmp r10, 0x10
cmovae rax, rcx
sub r10, rsi
lea rcx, [rax + rsi]
add r8, r13
mov r9, rbp
mov rdx, r10
call fcn.00425d30
mov qword [rsp + 0x60], rdi
lea rax, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae rax, qword [rsp + 0x50]
mov byte [rax + rdi], 0
jmp 0x40b75c
mov rax, r12
sub rax, rsi
cmp rax, 1
jbe 0x40b6ac
lea rax, [rsi + 1]
cmp rax, rsi
jae 0x40b6bb
call fcn.0043db70
mov r10, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
lea rdi, [rsi + 1]
cmp rdi, 0xfffffffffffffffe
jbe 0x40b6d4
call fcn.0043db70
mov r10, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
cmp r10, rdi
jae 0x40b6f5
mov r8, rsi
mov rdx, rdi
lea rcx, [rsp + 0x48]
call fcn.00402010
mov r10, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
jmp 0x40b713
test rdi, rdi
jne 0x40b713
mov qword [rsp + 0x60], rdi
lea rax, [rsp + 0x50]
cmp r10, 0x10
cmovae rax, qword [rsp + 0x50]
mov byte [rax], dil
jmp 0x40b75c
test rdi, rdi
je 0x40b75c
lea rcx, [rsp + 0x50]
cmp r10, 0x10
cmovae rcx, qword [rsp + 0x50]
sub r10, rsi
add rcx, rsi
mov r9d, 1
lea r8, [0x00440e0c]
mov rdx, r10
call fcn.00425d30
mov qword [rsp + 0x60], rdi
lea rax, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae rax, qword [rsp + 0x50]
mov byte [rdi + rax], 0
xor eax, eax
mov rcx, r12
mov rdx, qword [rsp + 0x28]
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x48]
call fcn.00403fd0
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae rcx, qword [rsp + 0x50]
call fcn.00401b70
test al, al
jne 0x40b79e
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40b7bc
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae rdx, qword [rsp + 0x50]
lea rcx, str.Info__:_Remove_file__s__OK._n
call fcn.00405500
nop
cmp qword [rsp + 0x68], 0x10
jb 0x40b7d7
mov rcx, qword [rsp + 0x50]
call fcn.004185a4
lea rbp, str._system32drivers
jmp 0x40b7de
lea rbp, str._system32drivers
add r14d, 1
add rbx, 1
cmp r14d, dword [rsp + 0x20]
jb 0x40b190
mov rbx, qword [rsp + 0x38]
lea rdx, [rbx - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x40b813
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r12d
add r12d, 0xffffffff
test r12d, r12d
jg 0x40b834
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.004252f0
mov rbx, qword [rsp + 0x1e0]
mov rbp, qword [rsp + 0x1e8]
mov rsi, qword [rsp + 0x1c0]
mov rdi, qword [rsp + 0x1b8]
mov r12, qword [rsp + 0x1b0]
mov r13, qword [rsp + 0x1a8]
mov r14, qword [rsp + 0x1a0]
mov r15, qword [rsp + 0x198]
add rsp, 0x1c8
ret