Function at 0x140035900
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x318
lea rbp, [rsp + 0x80]
mov rdi, r9
mov r12, r8
mov r13, rdx
mov rbx, rcx
mov r14, qword [rbp + 0x330]
mov r15, qword [rbp + 0x320]
call fcn.1400405b0
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x10]
cmp byte [rax + 4], 0
je 0x14003599a
mov rax, qword [rbp + 0x328]
mov rcx, qword [rbp + 0x318]
mov edx, dword [rbp + 0x310]
mov esi, dword [rbp + 0x308]
mov r9, qword [rbp + 0x300]
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], esi
mov rcx, r13
mov rdx, r12
mov r8, rdi
call rbx
mov edi, 1
test eax, eax
jne 0x1400359d9
mov rax, qword [0x140055c08]
test rax, rax
je 0x1400359c4
mov dword [rsp + 0x20], 2
lea rcx, str.BLOCKED
lea rdx, str.CreateProcessA
mov r8, r13
mov r9b, 1
call rax
call fcn.1400405b0
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x10]
xor edi, edi
cmp dword [rax], 2
jge 0x1400359ef
mov eax, edi
add rsp, 0x318
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov edx, 0x18
mov rcx, r14
mov r8d, 1
call fcn.14003a7d0
call fcn.14003a670
test al, al
je 0x140035d4c
mov rsi, qword [0x1400577e8]
test rsi, rsi
je 0x140035d4c
test r12, r12
je 0x140035a41
mov rcx, r12
call fcn.14003adc0
mov r12, rax
test rax, rax
jne 0x140035a44
jmp 0x140035d4c
xor r12d, r12d
test r13, r13
je 0x140035a5b
mov rcx, r13
call fcn.14003adc0
test rax, rax
jne 0x140035a5d
mov rcx, r12
jmp 0x140035a87
xor eax, eax
mov qword [rbp + 0x280], rax
test r15, r15
je 0x140035a93
mov rcx, r15
call fcn.14003adc0
test rax, rax
jne 0x140035a95
mov rcx, r12
xor edx, edx
call fcn.14003ae70
mov rcx, qword [rbp + 0x280]
xor edx, edx
call fcn.14003ae70
jmp 0x140035d4c
xor eax, eax
test r12, r12
je 0x140035aa1
mov rdx, qword [r12 + 8]
jmp 0x140035aa3
xor edx, edx
mov rcx, qword [rbp + 0x280]
test rcx, rcx
je 0x140035ab5
mov rcx, qword [rcx + 8]
jmp 0x140035ab7
xor ecx, ecx
mov qword [rbp + 0x278], rcx
mov qword [rbp + 0x258], r12
test rax, rax
mov dword [rbp + 0x274], ebx
mov qword [rbp + 0x250], rax
mov r12, rdx
je 0x140035ae0
mov rax, qword [rax + 8]
jmp 0x140035ae2
xor eax, eax
mov qword [rbp + 0x288], rax
lea r15, [rbp - 0x30]
mov ecx, 0x104
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add eax, 0xffffffff
xor ebx, ebx
cmp eax, 0x103
cmovae r15, rbx
mov qword [rbp + 0x260], rsi
add rsi, qword [rsi + 0x10]
mov qword [rbp + 0x268], rsi
xorps xmm0, xmm0
movaps xmmword [rbp + 0x220], xmm0
movaps xmmword [rbp + 0x210], xmm0
movaps xmmword [rbp + 0x200], xmm0
movaps xmmword [rbp + 0x1f0], xmm0
movaps xmmword [rbp + 0x1e0], xmm0
mov qword [rbp + 0x230], 0
lea rcx, [rbp + 0x260]
call fcn.14003d2f0
mov dword [rbp + 0x294], 4
test rax, rax
je 0x140035d11
mov rsi, rax
mov qword [rax], 0xd
mov dword [rax + 0x60], 5
mov dword [rax + 0x6c], 0xb0
mov rdx, qword [rbp + 0x278]
test rdx, rdx
je 0x140035bb7
mov rcx, rdx
call fcn.140026080
mov rbx, rax
add ebx, ebx
cmp ebx, 0x400
ja 0x140035d11
mov r8d, ebx
mov eax, dword [rsi + 0x6c]
mov rdx, qword [rbp + 0x278]
jmp 0x140035bbf
mov eax, 0xb0
xor r8d, r8d
mov ecx, eax
mov eax, 0x400
sub rax, r8
cmp rax, rcx
jb 0x140035d11
add rcx, rsi
call sub.ntdll.dll_memcpy
mov eax, dword [rsi + 0x6c]
lea eax, [rbx + rax]
add eax, 7
and eax, 0xfffffff8
mov dword [rsi + 0x78], eax
mov dword [rsi + 0x70], ebx
mov dword [rsi + 0x68], 1
mov rdx, r12
test r12, r12
je 0x140035c22
mov r12, rdx
mov rcx, rdx
call fcn.140026080
mov rbx, rax
add ebx, ebx
cmp ebx, 0x400
ja 0x140035d11
mov r8d, ebx
mov eax, dword [rsi + 0x78]
mov rdx, r12
jmp 0x140035c27
xor r8d, r8d
xor ebx, ebx
mov ecx, eax
mov eax, 0x400
sub rax, r8
cmp rax, rcx
jb 0x140035d11
add rcx, rsi
call sub.ntdll.dll_memcpy
mov eax, dword [rsi + 0x78]
lea eax, [rbx + rax]
add eax, 7
and eax, 0xfffffff8
mov dword [rsi + 0x84], eax
mov dword [rsi + 0x7c], ebx
mov dword [rsi + 0x74], 1
test r15, r15
je 0x140035c87
mov rcx, r15
call fcn.140026080
mov rbx, rax
add ebx, ebx
cmp ebx, 0x400
ja 0x140035d11
mov r8d, ebx
mov eax, dword [rsi + 0x84]
jmp 0x140035c8c
xor r8d, r8d
xor ebx, ebx
mov ecx, eax
mov eax, 0x400
sub rax, r8
cmp rax, rcx
jb 0x140035d11
add rcx, rsi
mov rdx, r15
call sub.ntdll.dll_memcpy
mov eax, dword [rsi + 0x84]
lea eax, [rbx + rax]
add eax, 7
and eax, 0xfffffff8
mov dword [rsi + 0x90], eax
mov dword [rsi + 0x88], ebx
mov dword [rsi + 0x80], 1
cmp qword [rbp + 0x288], 0
je 0x140035cf9
mov rcx, qword [rbp + 0x288]
call fcn.140026080
mov rbx, rax
add ebx, ebx
cmp ebx, 0x400
ja 0x140035d11
mov r8d, ebx
mov eax, dword [rsi + 0x90]
jmp 0x140035cfe
xor r8d, r8d
xor ebx, ebx
mov ecx, eax
mov eax, 0x400
sub rax, r8
cmp rax, rcx
jae 0x140035da4
xor esi, esi
mov rcx, qword [rbp + 0x258]
xor edx, edx
call fcn.14003ae70
mov rcx, qword [rbp + 0x280]
xor edx, edx
call fcn.14003ae70
mov rcx, qword [rbp + 0x250]
xor edx, edx
call fcn.14003ae70
cmp dword [rbp + 0x294], 0
je 0x140035d59
mov ebx, dword [rbp + 0x274]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1400359d9
mov ecx, dword [rbp + 0x1e8]
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [rbp + 0x1e8], 0
jne 0x140035d9d
mov rax, qword [0x140055c08]
mov esi, 1
test rax, rax
je 0x140035d9d
mov dword [rsp + 0x20], 0
lea rcx, str.Broker_ALLOWED
lea rdx, str.CreateProcessA
mov r8, r13
xor r9d, r9d
call rax
mov edi, esi
jmp 0x1400359d9
add rcx, rsi
mov rdx, qword [rbp + 0x288]
call sub.ntdll.dll_memcpy
mov eax, dword [rsi + 0x90]
lea eax, [rbx + rax]
add eax, 7
and eax, 0xfffffff8
mov dword [rsi + 0x9c], eax
mov dword [rsi + 0x94], ebx
mov dword [rsi + 0x8c], 1
mov dword [rbp + 0x240], 0x18
mov qword [rbp + 0x248], r14
mov dword [rbp + 0x294], 4
test r14, r14
je 0x140035d11
cmp eax, 0x3e8
ja 0x140035d11
mov eax, eax
mov rcx, qword [r14 + 0x10]
mov qword [rsi + rax + 0x10], rcx
movups xmm0, xmmword [r14]
movups xmmword [rsi + rax], xmm0
mov dword [rsi + 4], 1
mov eax, dword [rsi + 0x9c]
add eax, 0x1f
and eax, 0xfffffff8
mov dword [rsi + 0xa8], eax
mov dword [rsi + 0xa0], 0x18
mov dword [rsi + 0x98], 6
lea rcx, [rbp + 0x260]
lea r8, [rbp + 0x1e0]
mov rdx, rsi
call fcn.14003d430
mov dword [rbp + 0x294], 0xa
cmp eax, 0xa
je 0x140035d11
mov ebx, eax
mov r15d, dword [rsi + 0x9c]
lea rcx, [rbp + 0x240]
call fcn.1400260c0
mov r14, rax
lea rcx, [rbp + 0x240]
call fcn.1400260b0
mov rdx, rsi
add rdx, r15
mov r8d, eax
mov rcx, r14
call sub.ntdll.dll_memcpy
lea rcx, [rbp + 0x260]
mov rdx, rsi
call fcn.14003d3f0
mov dword [rbp + 0x294], ebx
jmp 0x140035d11