Function at 0x1400a4730
Capabilities:
Get common file path

Disassembly:
xchg rsp, r11
mov rsp, r11
xchg r11, rsp
jmp 0x1400a4796
mov rdi, rdx
xor r14d, r14d
movzx eax, r8b
mov dword [rsp + 0x48], r14d
mov rdi, rdi
mov edx, 0x28413d92
jmp 0x1400a4878
movzx eax, byte [0x14011d2ec]
mov byte [rbp - 0x20], al
xchg rdi, rdi
nop dword [rax + rax]
cmp byte [rcx + 1], r14b
jmp 0x1400a485e
mov dword [rsp + 0x50], r9d
test r8b, r8b
mov dword [rsp - 0x38], 0x324c6d7f
je 0x1400a48a7
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x1400a481a
nop
sub rsp, 8
mov qword [rsp], rbp
lea rbp, [r11 - 0x3f8]
sub rsp, 0x4f0
mov rbx, rbx
jmp 0x1400a47dd
xchg r14, rax
mov qword [r11 - 0x18], rsi
mov rdx, rdx
mov rsi, rcx
mov qword [r11 - 0x20], rdi
jmp 0x1400a47ca
lea rcx, [rbp + 0x120]
mov qword [r11 - 0x28], r14
xchg r11, r11
jmp 0x1400a473e
mov rax, qword [0x1402557f0]
xor rax, rsp
xchg r14, rax
mov qword [rbp + 0x3c0], r14
jmp 0x1400a47b5
xor edx, edx
mov dword [rsp - 0x3c], ebp
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
mov dword [rsp - 0x2c], 0x1e19b100
jmp 0x1400a488f
mov eax, dword [0x14011d2e8]
lea rcx, [rbp - 0x24]
mov dword [rsp - 0x24], 0x8851e1a
mov dword [rbp - 0x24], eax
dec rcx
jmp 0x1400a475a
xor edx, 0x5db8f43e
sub edx, 0x9b1f633
add edx, 0x118aeb28
add edx, 0x210642ec
sub edx, 0x5bf8f41f
mov dword [rsp + 0x54], eax
jmp 0x1400a4775
lea rcx, [rcx + 1]
mov dword [rsp - 0x2c], ebp
jne 0x1400a476c
lea r8, [rbp + 0x120]
jmp 0x1400a47f5
add edx, 0x94d37c1
sub edx, 0x1afe2288
add edx, 0x5810f5b5
jmp 0x1400a4837
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
mov dword [rsp - 0x10], esi
jne 0x1400a4808
jmp 0x1400a4903
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryA]
mov eax, dword [0x14011d2e8]
lea rcx, [rbp - 0x24]
xchg r12, r12
mov dword [rbp - 0x24], eax
dec rcx
jmp 0x1400a493b
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jmp 0x1400a48f5
lea r8, [rbp + 0x120]
xor edx, edx
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
mov dword [rsp - 0x10], ecx
jmp 0x1400a48c5
jne 0x1400a48e7
mov dword [rsp - 0x30], 0x554554c
lea rcx, [rbp - 0x24]
jmp 0x1400a490c
dec rcx
nop word [rax + rax]
mov dword [rsp - 0x40], 0x1ca99f7
cmp byte [rcx + 1], r14b
lea rcx, [rcx + 1]
jne 0x1400a4920
mov dword [rsp - 0x38], 0x30607ca9
jmp 0x1400a495f
movzx eax, byte [0x14011d2ec]
xchg r15, r15
mov byte [rbp - 0x20], al
cmp byte [rcx + 1], r14b
lea rcx, [rcx + 1]
jne 0x1400a4948
mov dword [rsp - 0x1c], ecx
jmp 0x1400a48d3
movzx eax, word [0x14011d2f0]
mov word [rcx], ax
mov eax, dword [rbp + 0x438]
mov dword [rsp - 0x24], 0x65153457
cmp eax, 0xffffffff
jmp 0x1400a497f
je 0x1400a4993
mov dword [rbp + 0xd0], eax
mov rbx, rbx
jmp 0x1400a4c46
mov qword [rsp + 0x4e8], rbx
nop
movabs rbx, 0xffffffff6792d940
jmp 0x1400a4b0a
sub byte [rsp + 0x40], 0x33
add byte [rsp + 0x40], 0x2d
add byte [rsp + 0x40], 0x24
xor byte [rsp + 0x40], 3
call fcn.14000ee70
xchg r8, r8
lea r8, [0x140257c10]
jmp 0x1400a4da8
inc r8
lea rcx, [rsp + 0x58]
xchg rdi, rdx
mov rdi, rdx
xchg rdx, rdi
jmp 0x1400a4d6c
inc rbx
cmp byte [rdi + rbx], r14b
jne 0x1400a49e9
mov dword [rsp - 0x40], 0x15a7d8e4
jmp 0x1400a4aa0
xchg r13, rsi
mov r13, qword [rsp + 0x4e0]
xchg r13, rsi
test eax, eax
mov dword [rsp - 0x28], edi
jmp 0x1400a4e05
xchg r14, rdi
mov rdi, qword [rsp + 0x4d0]
xchg r14, rdi
jmp 0x1400a4a03
xor dword [rbp + 0xd0], 0x27a49dd
xor dword [rbp + 0xd0], 0x22bf4f3f
xor dword [rbp + 0xd0], 0x5f31727e
xor dword [rbp + 0xd0], 0x71fff637
add dword [rbp + 0xd0], 0x344161d8
sub dword [rbp + 0xd0], 0x2b2d188
xor dword [rbp + 0xd0], 0x66f4c5e
jmp 0x1400a4c3c
mov dword [rbp + 0x114], eax
xchg rsi, rsi
call fcn.1400e9eb8
mov rdi, qword [rsp + 0x4d8]
test rax, rax
mov dword [rsp - 0x18], 0xe2d6c65
jmp 0x1400a4b32
mov dword [rbp - 0x28], ebx
xchg rdx, rbx
mov rdx, qword [rsp + 0x4e8]
xchg rbx, rdx
mov dword [rbp + 0xd0], 0x3c04c163
jmp 0x1400a4a2f
lea r8, [rbp + 0x2b3]
mov dword [rsp + 0x40], eax
lea rdx, [rsp + 0x40]
mov dword [rsp - 0x38], 0x7a85f70a
jmp 0x1400a4d80
xchg r11, r11
movsxd rax, dword [rbp + 0x428]
lea rdx, [rbp + 0x1a0]
mov ecx, 0x786e0709
sub ecx, 0x37ff5b67
sub ecx, 0x6e0cf47
xor ecx, 0x166cab5a
jmp 0x1400a4bbe
xor rbx, 0x5ec4e136
add rbx, 0x2240b8ba
sub rbx, 0x36ad77d
sub rbx, 0x20a9df99
xor rbx, 0x58d10f77
jmp 0x1400a4e2c
je 0x1400a4b3c
mov word [rax], r14w
xchg r13, rax
jmp 0x1400a4d09
add r9d, 0x3c50f75c
sub r9d, 0x46ca752c
add r9d, 0x561d240b
sub r9d, 0xf92350d
sub r9d, 0x1504025b
xor r9d, 0x4b51b915
jmp 0x1400a4cc5
mov eax, dword [0x140257c30]
lea rcx, [rbp + 0xd4]
mov edx, 0x2f9a55d2
add edx, 0x2fd4a8c8
xor edx, 0x3b9ac5ba
jmp 0x1400a4b95
sub edx, 0x319644e2
sub edx, 0x306d4a80
add edx, 0x7ec79f5
add edx, 0x1d0e5b33
sub edx, 0x983ae34
xor edx, 0x1e67d29c
jmp 0x1400a4a7a
add ecx, 0x3c81a0d5
xor ecx, 0x77eb79b8
sub ecx, 0x1b886d6a
mov qword [rbp + 0x20], rax
mov byte [rbp + 0xc8], 3
jmp 0x1400a4c97
mov r8d, 0x50727866
sub r8d, 0x25c26bf7
xor r8d, 0x6ce6757e
add r8d, 0xe6c3464
xor r8d, 0x6274d3a
xor r8d, 0x1167bae3
sub r8d, 0x410b75a4
jmp 0x1400a4dc4
xchg r13, rbx
nop dword [rax]
mov dword [rsp - 0x30], 0x21c34461
inc r8
cmp byte [rdi + r8], r14b
jne 0x1400a4c27
mov r15, r15
jmp 0x1400a49d3
xor dword [rbp + 0xd0], 0x9a0d67b9
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp - 0x30], 0x14a3fcdc
mov ecx, eax
lea rdx, [rbp + 0xcc]
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
jmp 0x1400a4add
mov qword [rsp + 0x20], r14
mov dword [rsp - 0x28], 0x70f67e4e
call rax
jmp 0x1400a4a1c
movzx eax, byte [0x14011d2e6]
mov dword [rsp - 0x44], 0xd1f4785
xor byte [rsp + 0x44], 0x36
xor al, 0x38
jmp 0x1400a4de5
add byte [rbp + 0xc8], 0x1f
add byte [rbp + 0xc8], 0x29
sub byte [rbp + 0xc8], 0x15
sub byte [rbp + 0xc8], 5
xor byte [rbp + 0xc8], 0x30
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
jmp 0x1400a4e16
xchg r15, rcx
mov r15, qword [rax + 0x98]
xchg rcx, r15
jmp 0x1400a4cf2
mov qword [rsp + 0x30], rdx
mov edx, 0x276252e
add edx, 0x6b31b2fd
sub edx, 0x646e4f3e
jmp 0x1400a4e4c
mov rax, qword [0x1402585a0]
xor rax, rdx
mov rsp, rsp
lea rdx, [rsp + 0x48]
jmp 0x1400a4cd7
mov r13, qword [rsi + 0x30]
xchg r13, rax
lea r8, [rsp + 0x50]
mov dword [rsp - 0x20], 0x3824715b
mov qword [rsp + 0x38], r14
movabs rdx, 0x9024ae7f007a8690
xor rdx, 0x4991e3e7
jmp 0x1400a4d37
sub rdx, 0x14f4313a
xor rdx, 0x145567fc
add rdx, 0x2658ee06
sub rdx, 0x3f1b0ab2
add rdx, 0x7fffffff
add rdx, 0x25e402e0
mov r9d, 0x24444a0a
jmp 0x1400a4b43
call fcn.1400f6440
xchg r8, r8
nop dword [rax]
jmp 0x1400a49e9
movzx eax, word [0x14011d2e4]
lea rcx, [rbp + 0x28]
xor byte [rsp + 0x41], 0x33
xor byte [rsp + 0x42], 0x34
mov dword [rsp - 0x3c], esi
xor byte [rsp + 0x43], 0x35
mov word [rsp + 0x44], ax
jmp 0x1400a4c7c
lea rdx, [0x14011d2d8]
lea rcx, [rbp + 0xd4]
call fcn.1400a25a0
mov dword [rsp - 0x34], ebp
jmp 0x1400a4b72
add r8d, 0x23f35b5a
xor r8d, 0x266a4166
call fcn.1400af160
xchg rcx, rcx
mov eax, dword [str.n_f_vi]
jmp 0x1400a4ac0
xor byte [rsp + 0x45], 0x37
xchg rsi, rsi
mov byte [rsp + 0x46], al
mov byte [rsp + 0x40], 0x5b
xor byte [rsp + 0x40], 0x31
sub byte [rsp + 0x40], 0x29
jmp 0x1400a49ab
jne 0x1400a4e7a
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400a4e7c
movzx ecx, byte [rbp + 0x1a0]
mov r15, r15
lea rdx, [rbp + 0x2b0]
jmp 0x1400a4be0
sub rbx, 0x67406514
add rbx, 0x7fffffff
add rbx, 0x77ed2fa7
xchg r13, rbx
mov r8, r13
jmp 0x1400a4c15
sub edx, 0x912f124
add edx, 0x5edf5895
sub edx, 0x1d4cfbb2
xor edx, 0x6cb4a7a4
xor edx, 0x29ad4286
add edx, 0xbb60b272
mov dword [rsp + 0x28], r14d
jmp 0x1400a4c68
xor eax, eax
mov rcx, qword [rbp + 0x3c0]
xor rcx, rsp
mov dword [rsp - 0x3c], edi
call fcn.1400e8cf0
neg rsp
jmp 0x1400a4e97
add rsp, 0xfffffffffffffb10
neg rsp
nop
add rsp, 8
jmp 0x1400a4eab
mov rbp, qword [rsp - 8]
ret