Function at 0x140038da0
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x308
lea rbp, [rsp + 0x80]
mov rdi, r9
mov r13, r8
mov r12, rdx
mov rbx, rcx
mov r14, qword [rbp + 0x320]
mov r15, qword [rbp + 0x310]
call fcn.140045350
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x10]
cmp byte [rax + 4], 0
je 0x140038e3a
mov rax, qword [rbp + 0x318]
mov rcx, qword [rbp + 0x308]
mov edx, dword [rbp + 0x300]
mov esi, dword [rbp + 0x2f8]
mov r9, qword [rbp + 0x2f0]
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], esi
mov rcx, r12
mov rdx, r13
mov r8, rdi
call rbx
mov edi, 1
test eax, eax
jne 0x140038e79
mov rax, qword [0x14005bc58]
test rax, rax
je 0x140038e64
mov dword [rsp + 0x20], 2
lea rcx, str.BLOCKED
lea rdx, str.CreateProcessA
mov r8, r12
mov r9b, 1
call rax
call fcn.140045350
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x10]
xor edi, edi
cmp dword [rax], 0
jg 0x140038e8f
mov eax, edi
add rsp, 0x308
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov edx, 0x18
mov rcx, r14
mov r8d, 1
call fcn.14003e940
call fcn.14003e7e0
test al, al
je 0x14003916c
mov rbx, qword [0x14005d878]
test rbx, rbx
je 0x14003916c
test r13, r13
je 0x140038ee1
mov rcx, r13
call fcn.14003ef50
mov r13, rax
test rax, rax
jne 0x140038ee4
jmp 0x14003916c
xor r13d, r13d
test r12, r12
je 0x140038efb
mov rcx, r12
call fcn.14003ef50
test rax, rax
jne 0x140038efd
mov rcx, r13
jmp 0x140038f27
xor eax, eax
mov qword [rbp + 0x270], rax
test r15, r15
je 0x140038f33
mov rcx, r15
call fcn.14003ef50
test rax, rax
jne 0x140038f35
mov rcx, r13
xor edx, edx
call fcn.14003f000
mov rcx, qword [rbp + 0x270]
xor edx, edx
call fcn.14003f000
jmp 0x14003916c
xor eax, eax
test r13, r13
je 0x140038f40
mov rdx, qword [r13 + 8]
jmp 0x140038f42
xor edx, edx
mov rcx, qword [rbp + 0x270]
test rcx, rcx
je 0x140038f54
mov rcx, qword [rcx + 8]
jmp 0x140038f56
xor ecx, ecx
mov qword [rbp + 0x268], rcx
mov qword [rbp + 0x248], r13
test rax, rax
mov dword [rbp + 0x264], esi
mov qword [rbp + 0x280], rax
mov r13, rdx
je 0x140038f7f
mov rax, qword [rax + 8]
jmp 0x140038f81
xor eax, eax
mov qword [rbp + 0x278], rax
lea r15, [rbp - 0x30]
mov ecx, 0x104
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add eax, 0xffffffff
xor esi, esi
cmp eax, 0x103
cmovae r15, rsi
mov qword [rbp + 0x250], rbx
add rbx, qword [rbx + 0x10]
mov qword [rbp + 0x258], rbx
xorps xmm0, xmm0
movaps xmmword [rbp + 0x220], xmm0
movaps xmmword [rbp + 0x210], xmm0
movaps xmmword [rbp + 0x200], xmm0
movaps xmmword [rbp + 0x1f0], xmm0
movaps xmmword [rbp + 0x1e0], xmm0
mov qword [rbp + 0x230], 0
lea rcx, [rbp + 0x250]
call fcn.1400417a0
test rax, rax
je 0x14003912c
mov rbx, rax
mov qword [rax], 0xd
mov dword [rax + 0x60], 5
mov dword [rax + 0x6c], 0xb0
mov rdx, qword [rbp + 0x268]
test rdx, rdx
je 0x14003904c
mov rcx, rdx
call fcn.140029260
mov rsi, rax
add esi, esi
cmp esi, 0x400
ja 0x14003912c
mov r8d, esi
mov eax, dword [rbx + 0x6c]
mov rdx, qword [rbp + 0x268]
jmp 0x140039054
mov eax, 0xb0
xor r8d, r8d
mov ecx, eax
mov eax, 0x400
sub rax, r8
cmp rax, rcx
jb 0x14003912c
add rcx, rbx
call fcn.140029240
mov eax, dword [rbx + 0x6c]
lea eax, [rsi + rax]
add eax, 7
and eax, 0xfffffff8
mov dword [rbx + 0x78], eax
mov dword [rbx + 0x70], esi
mov dword [rbx + 0x68], 1
mov rdx, r13
test r13, r13
je 0x1400390b7
mov r13, rdx
mov rcx, rdx
call fcn.140029260
mov rsi, rax
add esi, esi
cmp esi, 0x400
ja 0x14003912c
mov r8d, esi
mov eax, dword [rbx + 0x78]
mov rdx, r13
jmp 0x1400390bc
xor r8d, r8d
xor esi, esi
mov ecx, eax
mov eax, 0x400
sub rax, r8
cmp rax, rcx
jb 0x14003912c
add rcx, rbx
call fcn.140029240
mov eax, dword [rbx + 0x78]
lea eax, [rsi + rax]
add eax, 7
and eax, 0xfffffff8
mov dword [rbx + 0x84], eax
mov dword [rbx + 0x7c], esi
mov dword [rbx + 0x74], 1
test r15, r15
je 0x140039114
mov rcx, r15
call fcn.140029260
mov rsi, rax
add esi, esi
cmp esi, 0x400
ja 0x14003912c
mov r8d, esi
mov eax, dword [rbx + 0x84]
jmp 0x140039119
xor r8d, r8d
xor esi, esi
mov ecx, eax
mov eax, 0x400
sub rax, r8
cmp rax, rcx
jae 0x1400391c4
mov r15d, 4
mov rbx, qword [rbp + 0x280]
xor esi, esi
mov rcx, qword [rbp + 0x248]
xor edx, edx
call fcn.14003f000
mov rcx, qword [rbp + 0x270]
xor edx, edx
call fcn.14003f000
mov rcx, rbx
xor edx, edx
call fcn.14003f000
test r15d, r15d
je 0x140039179
mov esi, dword [rbp + 0x264]
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140038e79
mov ecx, dword [rbp + 0x1e8]
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [rbp + 0x1e8], 0
jne 0x1400391bd
mov rax, qword [0x14005bc58]
mov esi, 1
test rax, rax
je 0x1400391bd
mov dword [rsp + 0x20], 0
lea rcx, str.Broker_ALLOWED
lea rdx, str.CreateProcessA
mov r8, r12
xor r9d, r9d
call rax
mov edi, esi
jmp 0x140038e79
add rcx, rbx
mov rdx, r15
call fcn.140029240
mov eax, dword [rbx + 0x84]
lea eax, [rsi + rax]
add eax, 7
and eax, 0xfffffff8
mov dword [rbx + 0x90], eax
mov dword [rbx + 0x88], esi
mov dword [rbx + 0x80], 1
cmp qword [rbp + 0x278], 0
je 0x14003922c
mov r15d, 4
mov rcx, qword [rbp + 0x278]
call fcn.140029260
mov rsi, rax
add esi, esi
cmp esi, 0x400
ja 0x140039132
mov r8d, esi
mov eax, dword [rbx + 0x90]
jmp 0x140039237
mov r15d, 4
xor r8d, r8d
xor esi, esi
mov ecx, eax
mov eax, 0x400
sub rax, r8
cmp rax, rcx
jb 0x140039132
add rcx, rbx
mov rdx, qword [rbp + 0x278]
call fcn.140029240
mov rcx, rbx
mov eax, dword [rbx + 0x90]
lea eax, [rsi + rax]
add eax, 7
and eax, 0xfffffff8
mov dword [rbx + 0x9c], eax
mov dword [rbx + 0x94], esi
mov dword [rbx + 0x8c], 1
mov dword [rbp + 0x238], 0x18
mov qword [rbp + 0x240], r14
mov r15d, 4
test r14, r14
je 0x140039132
cmp eax, 0x3e8
ja 0x140039132
mov ecx, eax
add rcx, rbx
mov r8d, 0x18
mov rdx, r14
call fcn.140029240
mov rdx, rbx
mov dword [rbx + 4], 1
mov eax, dword [rbx + 0x9c]
add eax, 0x1f
and eax, 0xfffffff8
mov dword [rbx + 0xa8], eax
mov dword [rbx + 0xa0], 0x18
mov dword [rbx + 0x98], 6
lea rcx, [rbp + 0x250]
lea r8, [rbp + 0x1e0]
call fcn.140041940
mov r15d, 0xa
cmp eax, 0xa
je 0x140039132
mov esi, eax
mov r14d, dword [rbx + 0x9c]
lea rcx, [rbp + 0x238]
call fcn.140029440
mov r15d, eax
lea rcx, [rbp + 0x238]
call fcn.140029450
mov rdx, rbx
add rdx, r14
mov r8d, r15d
mov rcx, rax
call fcn.140029240
lea rcx, [rbp + 0x250]
mov rdx, rbx
call fcn.140041900
mov r15d, esi
jmp 0x140039132