Function at 0x140009ad0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x450
mov rax, qword [0x140030118]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rsi, rcx
lea rcx, [rsp + 0x22]
xor ebx, ebx
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], bx
call fcn.14000fdf0
lea rcx, [rsp + 0x232]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x230], bx
call fcn.14000fdf0
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x140009d10
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x20]
repne scasw ax, word [rdi]
not rcx
dec rcx
je 0x140009d10
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.IsWow64Process
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x20]
test rax, rax
jne 0x140009bdd
repne scasw ax, word [rdi]
mov rax, qword [str._spooldriversw32x86_]
mov qword [rdi - 2], rax
mov rax, qword [0x1400268c0]
mov qword [rdi + 6], rax
mov rax, qword [0x1400268c8]
mov qword [rdi + 0xe], rax
mov rax, qword [0x1400268d0]
mov qword [rdi + 0x16], rax
mov rax, qword [0x1400268d8]
mov qword [rdi + 0x1e], rax
mov eax, dword [0x1400268e0]
mov dword [rdi + 0x26], eax
movzx eax, word [0x1400268e4]
mov word [rdi + 0x2a], ax
jmp 0x140009c71
xor eax, eax
repne scasw ax, word [rdi]
mov rax, qword [str._spooldrivers_]
mov qword [rdi - 2], rax
mov rax, qword [0x1400268a0]
mov qword [rdi + 6], rax
mov rax, qword [0x1400268a8]
mov qword [rdi + 0xe], rax
mov rax, qword [0x1400268b0]
mov qword [rdi + 0x16], rax
nop
movzx eax, word [rsp + rbx + 0x20]
add rbx, 2
mov word [rsp + rbx + 0x22e], ax
test ax, ax
jne 0x140009c10
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x20]
repne scasw ax, word [rdi]
mov rax, qword [str.x64_]
or rcx, 0xffffffffffffffff
mov qword [rdi - 2], rax
movzx eax, word [0x140026890]
mov word [rdi + 6], ax
xor eax, eax
lea rdi, [rsp + 0x230]
repne scasw ax, word [rdi]
mov rax, qword [str.w32x86_]
mov qword [rdi - 2], rax
mov rax, qword [0x140026880]
mov qword [rdi + 6], rax
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x20]
repne scasw ax, word [rdi]
lea rdx, [rsp + 0x20]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsi + 0x370]
call fcn.140007af0
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x230]
lea rdx, [rsp + 0x230]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsi + 0x410]
call fcn.140007af0
call fcn.14000aea0
test rax, rax
je 0x140009ce6
call fcn.14000aea0
lea r8, [rsp + 0x20]
lea rdx, str.PdfsInstaller.GetPrinterDriversFolders__printer_drivers_directory_is:___s_
mov rcx, rax
call fcn.14000ac50
call fcn.14000aea0
test rax, rax
je 0x140009d0c
call fcn.14000aea0
lea r8, [rsp + 0x230]
lea rdx, str.PdfsInstaller.GetPrinterDriversFolders__other_printer_drivers_directory_is:___s_
mov rcx, rax
call fcn.14000ac50
xor eax, eax
jmp 0x140009d3b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call fcn.14000aea0
test rax, rax
je 0x140009d39
call fcn.14000aea0
lea rdx, str.PdfsInstaller.GetPrinterDriversFolders__FAILED_to_get_printer_drivers_directory__Error___d
mov r8d, edi
mov rcx, rax
call fcn.14000ac50
mov eax, edi
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.14000fd60
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret