Function at 0x180002450
Capabilities:
Get common file path
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbp
push rbx
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x1e8]
sub rsp, 0x2e8
mov rax, qword [0x180068020]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
mov r14, rcx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor r13d, r13d
lea r15, [r13 - 1]
cmp byte [r14 + 0xb0], r13b
jne 0x180002506
mov dword [rbp - 0x70], 0x18
mov dword [rbp - 0x60], 1
mov qword [rbp - 0x68], r13
cmp byte [r14 + 0xb1], r13b
jne 0x18000268b
mov rcx, qword [r14 + 0x98]
lea r9, [rbp - 0x70]
mov qword [rsp + 0x30], r13
xor r8d, r8d
mov dword [rsp + 0x28], 0xa0000000
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [r14 + 0xb8], rax
cmp rax, r15
je 0x180002692
mov byte [r14 + 0xb0], 1
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [rsp + 0x40], r13d
cmp qword [r14 + 0xb8], r15
je 0x1800029e5
mov rbx, qword [rbp + 0x228]
test rbx, rbx
je 0x1800029c8
mov qword [rsp + 0x2e0], rsi
mov qword [rsp + 0x2d8], r12
lea r12, [rbp + 0x230]
call fcn.1800012c0
mov qword [rsp + 0x28], r12
mov r9, rbx
xor r8d, r8d
mov qword [rsp + 0x20], r13
xor edx, edx
mov rdi, rax
mov rcx, qword [rax]
or rcx, 1
call fcn.18002b7a8
mov esi, eax
mov eax, 0xffffffff
test esi, esi
cmovs esi, eax
mov eax, 2
lea edx, [rsi + 1]
mul rdx
mov rbx, rax
cmovo rbx, r15
mov rcx, rbx
call fcn.180011270
mov r8, rbx
xor edx, edx
mov rcx, rax
mov r15, rax
call fcn.180022f00
mov word [r15], r13w
mov r8, 0xffffffffffffffff
mov r9, qword [rbp + 0x228]
mov rdx, r15
mov rcx, qword [rdi]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r13
call fcn.18002b7a8
lea rcx, [r14 + 0x28]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r9, qword [r14 + 0x80]
test r9, r9
je 0x18000296f
lea r8, str._hs:_ls
mov qword [rsp + 0x20], r15
xor edx, edx
xor ecx, ecx
call fcn.1800020f0
mov esi, eax
mov eax, 2
lea edx, [rsi + 1]
mul rdx
mov rbx, rax
mov rax, 0xffffffffffffffff
cmovo rbx, rax
mov rcx, rbx
call fcn.180011270
mov r8, rbx
xor edx, edx
mov rcx, rax
mov rdi, rax
call fcn.180022f00
mov word [rdi], r13w
lea r8, str._hs:_ls
mov r9, qword [r14 + 0x80]
mov edx, esi
mov rcx, rdi
mov qword [rsp + 0x20], r15
call fcn.1800020f0
mov rcx, qword [r14 + 0xb8]
lea r8d, [rsi + rsi]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], r13
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [r14 + 0xb8]
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov edx, 2
mov rcx, rdi
call fcn.180010c10
jmp 0x18000299a
mov qword [r14 + 0xb8], r15
mov ecx, 0x208
call fcn.180011270
xor edx, edx
mov r8d, 0x208
mov rcx, rax
mov rbx, rax
call fcn.180022f00
mov r8, qword [r14 + 0x90]
test r8, r8
je 0x1800026df
mov ecx, dword [r14 + 0xb4]
lea rdx, str._hsoutput__hs__lu.txt
mov r9, qword [r14 + 0x88]
mov dword [rsp + 0x20], ecx
mov rcx, rbx
call qword [sym.imp.USER32.dll_wsprintfW]
jmp 0x18000271b
xor edx, edx
lea rcx, [rbp - 0x50]
mov r8d, 0x208
call fcn.180022f00
lea rdx, [rbp - 0x50]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov rcx, rbx
test eax, eax
je 0x180002961
lea r8, [rbp - 0x50]
lea rdx, str._lsglobal_apt_scenarios_output.txt
call qword [sym.imp.USER32.dll_wsprintfW]
mov edx, 4
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
lea r9, [rbp - 0x70]
mov rcx, rbx
mov dword [rsp + 0x20], 3
lea r8d, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [r14 + 0xb8], rax
cmp rax, r15
jne 0x180002947
mov qword [rsp + 0x30], r13
lea r9, [rbp - 0x70]
mov dword [rsp + 0x28], 0x80
mov edx, 0x40000000
mov r8d, 3
mov dword [rsp + 0x20], 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [r14 + 0xb8], rax
mov rcx, rbx
cmp rax, r15
je 0x180002961
xor r9d, r9d
mov qword [rsp + 0x50], r13
lea rax, [rsp + 0x58]
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], rax
lea edx, [r9 + 1]
lea r8d, [r9 + 4]
mov qword [rsp + 0x20], r13
mov qword [rsp + 0x58], r13
call qword [sym.imp.ADVAPI32.dll_GetNamedSecurityInfoW]
lea rdi, str.Everyone
test eax, eax
jne 0x18000284d
mov r8, qword [rsp + 0x50]
lea r9, [rsp + 0x48]
xorps xmm0, xmm0
mov qword [rbp - 0x80], r13
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x60], 0x1f01ff
lea ecx, [rax + 1]
mov qword [rsp + 0x64], 1
movdqu xmmword [rsp + 0x6c], xmm0
mov dword [rsp + 0x7c], 1
mov qword [rbp - 0x78], rdi
call qword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
test eax, eax
jne 0x18000284d
mov rax, qword [rsp + 0x48]
xor r9d, r9d
mov qword [rsp + 0x30], r13
mov rcx, rbx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
lea edx, [r9 + 1]
lea r8d, [r9 + 4]
call qword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x18000285d
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x18000286d
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor r9d, r9d
mov qword [rsp + 0x58], r13
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x38], rax
mov rcx, rbx
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], rax
lea edx, [r9 + 1]
lea r8d, [r9 + 4]
mov qword [rsp + 0x20], r13
mov qword [rsp + 0x50], r13
call qword [sym.imp.ADVAPI32.dll_GetNamedSecurityInfoW]
test eax, eax
jne 0x180002927
mov r8, qword [rsp + 0x58]
lea r9, [rsp + 0x48]
xorps xmm0, xmm0
mov qword [rbp - 0x80], r13
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x60], 0x1f01ff
lea ecx, [rax + 1]
mov dword [rsp + 0x64], 1
movdqu xmmword [rsp + 0x6c], xmm0
mov dword [rsp + 0x68], 3
mov dword [rsp + 0x7c], 1
mov qword [rbp - 0x78], rdi
call qword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
test eax, eax
jne 0x180002927
mov rax, qword [rsp + 0x48]
xor r9d, r9d
mov qword [rsp + 0x30], r13
mov rcx, rbx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
lea edx, [r9 + 1]
lea r8d, [r9 + 4]
call qword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x180002937
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x180002947
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov edx, 2
mov byte [r14 + 0xb1], 1
mov rcx, rbx
call fcn.180010c10
jmp 0x180002506
mov edx, 2
call fcn.180010c10
xor eax, eax
jmp 0x1800029e9
mov rcx, qword [r14 + 0xb8]
lea r8d, [rsi + rsi]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], r13
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [r14 + 0xb8]
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov edx, 2
mov rcx, r15
call fcn.180010c10
lea rcx, [r14 + 0x28]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r12, qword [rsp + 0x2d8]
mov r15, 0xffffffffffffffff
mov rsi, qword [rsp + 0x2e0]
cmp byte [r14 + 0xb1], r13b
je 0x1800029e5
mov rcx, qword [r14 + 0xb8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [r14 + 0xb8], r15
mov eax, dword [rsp + 0x40]
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.180010bf0
add rsp, 0x2e8
pop r15
pop r14
pop r13
pop rdi
pop rbx
pop rbp
ret