Function at 0x1400058e0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0xb0]
sub rsp, 0x1b0
mov rax, qword [0x140010040]
xor rax, rsp
mov qword [rbp + 0xa0], rax
mov word [rsp + 0x3e], 0
mov qword [rsp + 0x40], 0xe
mov qword [rsp + 0x48], 0xf
movsd xmm0, qword [0x14000b830]
movsd qword [rsp + 0x30], xmm0
mov eax, dword [0x14000b838]
mov dword [rsp + 0x38], eax
movzx eax, word [0x14000b83c]
mov word [rsp + 0x3c], ax
lea rdx, [rsp + 0x30]
call fcn.140005570
mov r15, rax
test rax, rax
je 0x140005c10
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp - 0x70]
call sub.VCRUNTIME140.dll_memset
mov edx, 0x104
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x140005c10
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
xor r14d, r14d
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], r14
lea rax, [rbp - 0x70]
mov rbx, 0xffffffffffffffff
nop
inc rbx
cmp byte [rax + rbx], r14b
jne 0x1400059b0
movabs rdi, 0x7fffffffffffffff
cmp rbx, rdi
ja 0x140005c3e
mov qword [rsp + 0x70], 0xf
cmp rbx, 0xf
ja 0x1400059fb
mov qword [rsp + 0x68], rbx
mov r8, rbx
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x58]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rbx + 0x58], r14b
jmp 0x140005a93
mov rax, rbx
or rax, 0xf
cmp rax, rdi
jbe 0x140005a34
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140008bb0
test rax, rax
je 0x140005bff
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140005a71
mov rdi, rax
mov ecx, 0x16
cmp rax, rcx
cmovb rdi, rcx
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x140005a5f
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140005c44
jmp 0x140005a15
test rcx, rcx
je 0x140005a6e
call fcn.140008bb0
mov rsi, rax
jmp 0x140005a71
mov rsi, r14
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rdi
mov r8, rbx
lea rdx, [rbp - 0x70]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + rbx], r14b
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
mov rax, rdx
sub rax, rcx
cmp rax, 0xf
jb 0x140005adf
lea rax, [rcx + 0xf]
mov qword [rsp + 0x68], rax
lea rbx, [rsp + 0x58]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0x58]
add rbx, rcx
mov r8d, 0xf
lea rdx, str.win32kfull.sys
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0xf], 0
jmp 0x140005afe
mov qword [rsp + 0x20], 0xf
lea r9, str.win32kfull.sys
mov edx, 0xf
lea rcx, [rsp + 0x58]
call fcn.140006180
lea rcx, [rsp + 0x58]
cmp qword [rsp + 0x70], 0xf
cmova rcx, qword [rsp + 0x58]
xor edx, edx
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rbx, rax
test rax, rax
je 0x140005bc5
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov r9d, 0x18
lea r8, [rsp + 0x78]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
test eax, eax
je 0x140005bcb
mov r10d, dword [rbp - 0x80]
add r10, 0xfffffffffffffff5
je 0x140005bc5
mov r8, rbx
lea r11, str.x____xxxxxx
nop word [rax + rax]
lea rdx, [0x14000b860]
mov al, 0x78
mov rcx, r11
mov r9, r8
sub r9, r11
cmp al, 0x78
jne 0x140005b8f
movzx eax, byte [rdx]
cmp byte [r9 + rcx], al
jne 0x140005bb7
inc rdx
inc rcx
movzx eax, byte [rcx]
test al, al
jne 0x140005b82
test r8, r8
je 0x140005bc5
mov eax, dword [r8 + 1]
add eax, 5
cdqe
add r8, rax
je 0x140005bcb
sub r8, rbx
add r8, r15
jmp 0x140005bc8
inc r8
mov rax, r8
sub rax, rbx
cmp rax, r10
jb 0x140005b70
mov r8, r14
mov r14, r8
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x140005c0b
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005c06
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005c06
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140008bec
mov rax, r14
jmp 0x140005c12
xor eax, eax
mov rcx, qword [rbp + 0xa0]
xor rcx, rsp
call fcn.140008b90
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.1400038e0
int3
call fcn.140001260
int3