Function at 0x18002f250
Capabilities:
Execute command
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xd0]
sub rsp, 0x1d0
mov rax, qword [0x1801eef68]
xor rax, rsp
mov qword [rbp + 0xc0], rax
imul r15d, ecx, 0xc18
mov r13, rdx
mov r14d, ecx
mov ebx, ecx
cmp ecx, r15d
ja 0x18002f5af
mov esi, dword [rsp + 0x50]
mov edx, 0x6d
mov rdi, qword [rsp + 0x40]
lea ecx, [rdx - 0x33]
lea r12d, [rdx + 5]
lea r9d, [rdx + 7]
lea r10d, [rdx + 2]
lea r8d, [rdx - 0xa]
mov eax, 0x726f
cmp ebx, 0x2b8a4
ja 0x18002f466
je 0x18002f44d
cmp ebx, 0xc774
ja 0x18002f3b9
je 0x18002f3a6
mov eax, ebx
sub eax, 0x37
je 0x18002f395
sub eax, 0x5d
je 0x18002f35f
sub eax, 0x2497
je 0x18002f647
cmp eax, 0x3ed9
jne 0x18002f630
mov eax, dword [str.ySys]
lea rcx, [rbp - 0x78]
mov word [rbp - 0x73], r12w
dec rcx
mov dword [rbp - 0x72], eax
mov word [rbp - 0x6e], r9w
nop word [rax + rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x18002f330
movzx eax, word [0x1801e16f4]
mov word [rcx], ax
movzx eax, byte [0x1801e16f6]
mov byte [rcx + 2], al
mov ecx, 0x3a
mov dword [rbp - 0x6b], 0x666e49
jmp 0x18002f630
mov r8d, 5
lea rdx, [0x1801e1799]
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov eax, dword [str.NtQue]
mov dword [rbp - 0x78], eax
movzx eax, word [0x1801e17a8]
mov word [rbp - 0x74], ax
mov byte [rsp + 0x55], 0
jmp 0x18002f616
lea rdi, str.create
mov esi, 0x12
jmp 0x18002f630
mov word [rbp - 0x68], r10w
mov word [rbp - 0x67], r12w
mov word [rbp - 0x66], dx
jmp 0x18002f630
cmp ebx, 0x12ae4
je 0x18002f434
cmp ebx, 0x18e54
je 0x18002f420
cmp ebx, 0x1f1c4
je 0x18002f406
cmp ebx, 0x25534
jne 0x18002f630
mov r8d, 2
mov word [rsp + 0x60], 0x61
lea rdx, [0x1801e172f]
lea rcx, [rsp + 0x61]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov byte [rsp + 0x63], 0
jmp 0x18002f616
mov eax, dword [0x1801e174b]
mov dword [rsp + 0x5b], eax
movzx eax, byte [0x1801e174f]
mov byte [rsp + 0x5f], al
jmp 0x18002f630
mov byte [rsp + 0x58], 0x42
mov word [rsp + 0x59], ax
mov byte [rsp + 0x5b], 0
jmp 0x18002f630
mov eax, dword [str.ation]
mov dword [rbp - 0x65], eax
movzx eax, word [0x1801e16e4]
mov word [rbp - 0x61], ax
jmp 0x18002f630
mov dword [rsp + 0x68], 0x3a3876
mov word [rsp + 0x6b], cx
mov word [rsp + 0x63], 0x69
jmp 0x18002f630
cmp ebx, 0x4a9d4
ja 0x18002f585
je 0x18002f565
cmp ebx, 0x31c14
je 0x18002f509
cmp ebx, 0x37f84
je 0x18002f4ee
cmp ebx, 0x3e2f4
je 0x18002f4bd
cmp ebx, 0x44664
jne 0x18002f630
mov r8d, 2
lea rdx, [0x1801df7a4]
lea rcx, [rsp + 0x7f]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp 0x18002f616
lea rcx, [rsp + 0x68]
mov word [rsp + 0x7d], r8w
dec rcx
nop dword [rax + rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x18002f4d0
movzx eax, word [0x1801df7a0]
mov word [rcx], ax
mov ecx, 0x3a
jmp 0x18002f630
mov eax, dword [str.AsFun]
mov dword [rsp + 0x78], eax
movzx eax, word [0x1801e17b0]
mov word [rsp + 0x7c], ax
jmp 0x18002f630
movzx eax, word [0x1801e17b4]
lea rdx, [0x1801e17b8]
mov dword [rsp + 0x6c], 0x6a624f
lea rcx, [rsp + 0x68]
mov dword [rsp + 0x6f], 0x746365
mov r8d, 2
mov word [rsp + 0x72], ax
movzx eax, byte [0x1801e17b6]
mov byte [rsp + 0x74], al
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov r8d, 2
lea rdx, [0x1801e17bc]
lea rcx, [rsp + 0x68]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp 0x18002f616
mov r8d, 2
lea rdx, [0x1801df7b8]
lea rcx, [rbp - 0x80]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov byte [rbp - 0x7f], 0x6e
jmp 0x18002f616
cmp ebx, 0x50d44
je 0x18002f62c
cmp ebx, 0x570b4
je 0x18002f5e3
cmp ebx, 0x5d424
jne 0x18002f630
cmp qword [r13 + 0x20], 0
setne byte [rsp + 0x50]
mov eax, dword [rsp + 0x50]
mov rcx, qword [rbp + 0xc0]
xor rcx, rsp
call fcn.1800d7250
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea r9, [rbp - 0x50]
xor r8d, r8d
lea rdx, [rsp + 0x58]
mov qword [r13 + 0x20], rax
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov ecx, 0x3a
lea edx, [rcx + 0x33]
lea r8d, [rcx + 0x29]
lea r9d, [rcx + 0x3a]
lea r10d, [rcx + 0x35]
jmp 0x18002f630
mov byte [rbp - 0x7e], 0
imul eax, r14d, 0xac
add ebx, eax
cmp ebx, r15d
ja 0x18002f5af
jmp 0x18002f2c1
mov rdx, qword [0x1801f3328]
test rdx, rdx
je 0x18002f673
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp byte [rdx + rax], 0
jne 0x18002f660
test rax, rax
jne 0x18002f673
lea esi, [rax + 0xf]
jmp 0x18002f6b6
mov rcx, qword [rdi]
test rcx, rcx
je 0x18002f6b6
nop dword [rax + rax]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x18002f687
movsxd r8, eax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
je 0x18002f6b3
mov rcx, qword [rdi + 0x10]
add rdi, 0x10
test rcx, rcx
je 0x18002f6b6
mov rdx, qword [0x1801f3328]
jmp 0x18002f680
mov esi, dword [rdi + 8]
mov ecx, esi
test esi, esi
je 0x18002fa53
sub ecx, 1
je 0x18002fa2e
sub ecx, 0xf
je 0x18002fa18
cmp ecx, 1
je 0x18002fa0e
mov r10, qword [0x1801f3770]
xor ebx, ebx
test r10, r10
jne 0x18002f755
mov edi, 0x112
nop
mov eax, edi
sub eax, 0x111
je case.0x18002f772.0
cmp eax, 1
jne 0x18002f744
lea r9, str.V1268_invAngTable
mov dword [0x1801f3350], ebx
xor r8d, r8d
mov edx, 0xc1
xor ecx, ecx
call fcn.1800b9450
mov qword [rsp + 0x38], rbx
xor r9d, r9d
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov dword [rsp + 0x28], 0x7b
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.180098520
dec edi
cmp edi, 0x110
ja 0x18002f6f0
mov r10, qword [0x1801f3770]
cmp esi, 0x12
ja case.0x18002f772.0
lea rdx, [0x180000000]
movsxd rax, esi
mov ecx, dword [rdx + rax*4 + 0x2fa78]
add rcx, rdx
jmp rcx
lea rax, [0x18002fad0]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov dword [0x1801f3350], ebx
mov qword [rsp + 0x38], rax
xor edx, edx
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov qword [rsp + 0x28], rbx
mov r8, r10
mov qword [rsp + 0x20], rbx
lea ecx, [rdx + 0x61]
call fcn.1800ce8c0
mov eax, ebx
jmp 0x18002f5b3
lea rax, [0x1800bd880]
jmp 0x18002f77b
mov rax, qword [0x1801f3348]
lea r8, [rsp + 0x48]
mov r9, qword [0x1801f3338]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
mov ecx, 0xd2
mov rax, qword [0x1801f3340]
mov qword [rsp + 0x48], rax
mov rax, qword [0x1801f3330]
mov qword [rsp + 0x20], rax
mov dword [0x1801f3350], ebx
call fcn.18004a500
mov eax, ebx
jmp 0x18002f5b3
mov rax, qword [0x1801f3340]
lea rcx, [rsp + 0x40]
mov r9, qword [0x1801f3330]
xor r8d, r8d
mov qword [rsp + 0x38], rbx
mov edx, 0xdd
mov qword [rsp + 0x40], rax
mov rax, qword [0x1801f3338]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
mov dword [0x1801f3350], ebx
call fcn.180094960
mov eax, ebx
jmp 0x18002f5b3
mov rax, qword [0x1801f3348]
lea r9, [rsp + 0x48]
mov r8, qword [0x1801f3330]
mov edx, 0xc0
mov rcx, qword [0x1801f3338]
mov qword [rsp + 0x48], rax
mov rax, qword [0x1801f3340]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov dword [0x1801f3350], ebx
call fcn.1800c83d0
mov eax, ebx
jmp 0x18002f5b3
mov rax, qword [0x1801f3340]
lea rcx, [rsp + 0x40]
mov rdx, qword [0x1801f3330]
mov r8d, 0x102
mov qword [rsp + 0x40], rax
mov dword [0x1801f3350], ebx
call fcn.1800c5600
mov eax, ebx
jmp 0x18002f5b3
lea rax, [0x1800bd850]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x40]
jmp 0x18002f78b
lea rax, [0x1800bd820]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x40]
jmp 0x18002f78b
mov rax, qword [0x1801f3340]
lea r8, [rsp + 0x40]
mov rcx, qword [0x1801f3330]
xor r9d, r9d
mov edx, 0xdc
mov qword [rsp + 0x40], rax
mov dword [0x1801f3350], ebx
call fcn.1800d1b00
mov eax, ebx
jmp 0x18002f5b3
mov qword [rsp + 0x38], rbx
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov r8, r10
mov qword [rsp + 0x28], rbx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
lea edx, [r9 + 0x48]
call fcn.180092970
mov eax, ebx
jmp 0x18002f5b3
xor r9d, r9d
mov qword [rsp + 0x20], r10
xor edx, edx
xor ecx, ecx
lea r8d, [r9 + 0x6f]
call fcn.180028d10
mov eax, ebx
jmp 0x18002f5b3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xdc
xor ecx, ecx
call fcn.180068330
mov eax, ebx
jmp 0x18002f5b3
lea r8, [0x1801f3360]
mov dword [0x1801f3350], 1
mov edx, 0x85
mov rcx, r10
call fcn.1800b5e80
mov eax, ebx
jmp 0x18002f5b3
cmp dword [0x1801f3350], ebx
je case.0x18002f772.0
xor r9d, r9d
lea rcx, [0x1801f3360]
mov r8, r10
lea edx, [r9 + 3]
call fcn.1800c9bf0
mov eax, ebx
jmp 0x18002f5b3
mov qword [rsp + 0x38], rbx
xor r9d, r9d
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov dword [rsp + 0x28], 0x7b
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.180098520
mov eax, ebx
jmp 0x18002f5b3
mov eax, 1
jmp 0x18002f5b3
mov rcx, qword [0x1801f3330]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor ebx, ebx
mov eax, ebx
jmp 0x18002f5b3
mov r9, qword [0x1801f3330]
xor ebx, ebx
xor edx, edx
mov dword [0x1801f3350], ebx
xor ecx, ecx
mov r8d, reloc.SHELL32.dll_SHSetFolderPathA
call fcn.180060ed0
mov eax, ebx
jmp 0x18002f5b3
mov rcx, qword [0x1801f3330]
xor ebx, ebx
xor edx, edx
mov dword [0x1801f3350], ebx
mov r8d, 0xd4
call fcn.18002a1b0
mov eax, ebx
jmp 0x18002f5b3