Function at 0x140146100
Capabilities:
Get common file path

Disassembly:
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x390]
sub rsp, 0x490
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x4b0], rbx
mov rax, qword [0x140415a10]
xor rax, rsp
mov qword [rbp + 0x380], rax
mov rsi, r8
mov rdi, rdx
xor bl, bl
mov edx, 0x104
lea rcx, [rbp + 0x170]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea r8, [0x140354160]
mov edx, 0x104
lea rcx, [rbp + 0x170]
call fcn.1402b9308
cmp dword [rdi + 0xc], 0
je 0x140146340
mov edx, 0x5c
mov rcx, qword [rdi]
call fcn.1402ba31c
test rax, rax
je 0x140146340
sub rax, qword [rdi]
sar rax, 1
test eax, eax
js 0x140146340
xor r8d, r8d
lea rdx, str.system32_
mov rcx, rdi
call fcn.1401ff2c0
test al, al
je 0x140146222
mov edx, 0x104
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1401463c4
mov r8d, 8
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.1401feab0
nop
mov r8, rax
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x30]
call fcn.1401fb6b0
nop
mov rdx, rax
mov rcx, rsi
call fcn.1401faf50
nop
cmp dword [rsp + 0x38], 0
jle 0x140146208
mov rcx, qword [rsp + 0x30]
call fcn.1402b7350
nop
cmp dword [rsp + 0x48], 0
jle 0x1401463c2
mov rcx, qword [rsp + 0x40]
call fcn.1402b7350
jmp 0x1401463c2
xor r8d, r8d
lea rdx, str.SystemRoot_
mov rcx, rdi
call fcn.1401ff2c0
test al, al
je 0x1401462af
mov edx, 0x104
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x1401463c4
mov r8d, 0xb
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.1401feab0
nop
mov r8, rax
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.1401fb6b0
nop
mov rdx, rax
mov rcx, rsi
call fcn.1401faf50
nop
cmp dword [rsp + 0x48], 0
jle 0x140146295
mov rcx, qword [rsp + 0x40]
call fcn.1402b7350
nop
cmp dword [rsp + 0x38], 0
jle 0x1401463c2
mov rcx, qword [rsp + 0x30]
call fcn.1402b7350
jmp 0x1401463c2
xor r8d, r8d
lea rdx, str.WINDOWS_
mov rcx, rdi
call fcn.1401ff2c0
test al, al
je 0x1401463c4
mov edx, 0x104
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x1401463c4
mov r8d, 8
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.1401feab0
nop
mov r8, rax
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.1401fb6b0
nop
mov rdx, rax
mov rcx, rsi
call fcn.1401faf50
nop
cmp dword [rsp + 0x48], 0
jle 0x140146326
mov rcx, qword [rsp + 0x40]
call fcn.1402b7350
nop
cmp dword [rsp + 0x38], 0
jle 0x1401463c2
mov rcx, qword [rsp + 0x30]
call fcn.1402b7350
jmp 0x1401463c2
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x104
xor r8d, r8d
mov rdx, qword [rdi]
lea rcx, [rbp + 0x170]
call qword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
je 0x1401463c4
lea rax, [rsp + 0x60]
or rbx, 0xffffffffffffffff
nop word [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140146380
test ebx, ebx
jle 0x1401463b2
mov edx, ebx
mov rcx, rsi
call fcn.1401fcb40
movsxd r9, ebx
mov eax, dword [rsi + 8]
inc eax
movsxd rdx, eax
lea r8, [rsp + 0x60]
mov rcx, qword [rsi]
call fcn.1402ba94c
jmp 0x1401463b8
cmp dword [rsi + 0xc], 0
jle 0x1401463c2
mov edx, ebx
mov rcx, rsi
call fcn.1401fde50
mov bl, 1
movzx eax, bl
mov rcx, qword [rbp + 0x380]
xor rcx, rsp
call fcn.1402b6d40
mov rbx, qword [rsp + 0x4b0]
add rsp, 0x490
pop rdi
pop rsi
pop rbp
ret