Function at 0x18001bef0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xd30]
sub rsp, 0xe30
mov rax, qword [0x1800f6ae8]
xor rax, rsp
mov qword [rbp + 0xd20], rax
mov r12, rdx
mov qword [rbp - 0x78], rdx
lea edx, [r8 + 0x367]
mov qword [rsp + 0x58], r9
mov rbx, qword [rsp + 0x58]
mov esi, r8d
mov dword [rsp + 0x40], r8d
mov qword [rbp - 0x60], rcx
mov dword [rsp + 0x34], edx
cmp r8d, edx
jae 0x18001c03e
movzx edx, byte [rsp + 0x30]
mov r13, qword [rsp + 0x58]
mov r15d, dword [rsp + 0x48]
movzx r14d, byte [rsp + 0x30]
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x38], edx
mov qword [rbp - 0x80], rbx
xor r8d, r8d
lea r10, [0x18001c450]
cmp esi, 0x13e
ja 0x18001c081
je 0x18001c01f
cmp esi, 0xcd
ja 0x18001bfe0
je 0x18001bfce
mov eax, esi
sub eax, 4
je 0x18001bfbf
sub eax, 0x43
je 0x18001bfb2
cmp eax, 0x43
je 0x18001c0fb
jmp 0x18001c415
mov dword [rsp + 0x64], 2
jmp 0x18001c415
mov dl, 1
mov dword [rsp + 0x38], edx
mov byte [rsp + 0x30], dl
jmp 0x18001c415
mov dword [rsp + 0x60], 1
mov qword [rsp + 0x50], r8
jmp 0x18001c419
mov eax, esi
sub eax, 0xfb
je 0x18001c010
cmp eax, 0x15
jne 0x18001c415
xor edx, edx
lea rcx, [rbp - 0x20]
mov r8d, 0xa00
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x68], 0x208
jmp 0x18001c411
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rbp - 0x70], rax
jmp 0x18001c411
cmp qword [rbp - 0x70], 0
jne 0x18001c419
mov ecx, 0xf2
nop
mov eax, ecx
sub eax, 0xf2
je 0x18001c06b
cmp eax, 1
jne 0x18001c072
mov rax, rbx
mov rcx, qword [rbp + 0xd20]
xor rcx, rsp
call fcn.1800d1090
mov rbx, qword [rsp + 0xe80]
add rsp, 0xe30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rbx, r8
mov qword [rbp - 0x80], rbx
inc ecx
cmp ecx, 0xf4
jb 0x18001c030
jmp 0x18001c415
cmp esi, 0x1d9
ja 0x18001c166
je 0x18001c13d
mov eax, esi
sub eax, 0x153
je 0x18001c130
sub eax, 0x2e
je 0x18001c0e1
cmp eax, 0x15
jne 0x18001c415
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov r8d, dword [rsp + 0x60]
lea r9, [rsp + 0x50]
mov ecx, dword [rsp + 0x64]
mov edx, r15d
mov r13, rax
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_SaferCreateLevel]
jmp 0x18001c411
mov eax, 0x2e
cmp eax, 0x2e
je 0x18001c436
add eax, 0x14d8
cmp eax, 0x14d8
jbe 0x18001c0e6
movzx eax, word [r9]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x20], rcx
mov r15d, 0x40000
mov r9d, 0x42
mov dword [rsp + 0x48], r15d
lea rcx, [rbp - 0x30]
mov word [rsp + 0x40], ax
xor r8d, r8d
call fcn.180079ae0
jmp 0x18001c411
mov qword [rcx], r10
mov dword [rsp + 0x6c], r8d
jmp 0x18001c415
cmp qword [rsp + 0x50], 0
mov ecx, r8d
movzx eax, byte [rsp + 0x30]
movzx edx, dl
cmove edx, r8d
cmp r13, 0xffffffffffffffff
mov dword [rsp + 0x38], edx
cmovne ecx, eax
mov byte [rsp + 0x30], cl
jmp 0x18001c415
mov eax, esi
sub eax, 0x21c
je 0x18001c1a3
cmp eax, 0x43
jne 0x18001c415
add rcx, 0xa
cmp rcx, r12
je 0x18001c415
cmp qword [r12 + 0x18], 0x10
mov rdx, r12
jb 0x18001c194
mov rdx, qword [r12]
mov r8, qword [r12 + 0x10]
call fcn.180035380
jmp 0x18001c411
test dl, dl
je 0x18001c283
mov r12d, dword [rsp + 0x68]
mov edi, 0x126
nop word [rax + rax]
mov eax, edi
sub eax, 0x122
je 0x18001c25f
sub eax, 1
je 0x18001c244
sub eax, 1
je 0x18001c227
sub eax, 1
je 0x18001c1fc
cmp eax, 1
jne 0x18001c26d
xorps xmm0, xmm0
movzx r14d, al
xor eax, eax
mov qword [rbp - 0x38], rax
movups xmmword [rbp - 0x58], xmm0
movups xmmword [rbp - 0x48], xmm0
jmp 0x18001c26d
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x78], r8
mov r9d, r12d
lea r8, [rbp + 0xb10]
mov qword [rsp + 0x20], rax
mov edx, 3
call qword [sym.imp.ADVAPI32.dll_SaferGetLevelInformation]
jmp 0x18001c26a
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x58]
call qword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorGroup]
test eax, eax
jne 0x18001c26a
xor r14b, r14b
jmp 0x18001c26a
test r14b, r14b
je 0x18001c26d
mov r8d, dword [rsp + 0x70]
lea rcx, [rbp - 0x58]
mov rdx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorGroup]
jmp 0x18001c26a
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_SaferCloseLevel]
xor r8d, r8d
dec edi
cmp edi, 0x121
ja 0x18001c1c0
mov r12, qword [rbp - 0x78]
mov edx, dword [rsp + 0x38]
cmp byte [rsp + 0x30], 0
je 0x18001c415
mov esi, 0x52
mov edi, 0x11e
mov ebx, 0x504f
lea r12d, [rsi - 0xe]
lea r15d, [rsi - 0xd]
nop word [rax + rax]
cmp edi, 0x12ec2
ja 0x18001c36a
je 0x18001c35e
cmp edi, 0x11e
je 0x18001c351
cmp edi, 0x3d72
je 0x18001c33e
cmp edi, 0x79c6
je 0x18001c325
cmp edi, 0xb61a
je 0x18001c310
cmp edi, 0xf26e
jne 0x18001c3ee
mov eax, dword [0x1800e657b]
mov dword [rbp + 0x9e0], eax
movzx eax, byte [0x1800e657f]
mov byte [rbp + 0x9e4], al
jmp 0x18001c3ee
mov word [rbp + 0x9fb], r15w
mov word [rbp + 0x9fc], r12w
jmp 0x18001c3ee
mov dword [rbp + 0x9f4], 0x4148532d
mov dword [rbp + 0x9f8], 0x574f44
jmp 0x18001c3ee
mov word [rbp + 0x9f1], si
mov word [rbp + 0x9f2], bx
jmp 0x18001c3ee
mov word [rbp + 0x9f0], r12w
jmp 0x18001c3ee
mov byte [rbp + 0x9e5], 0
jmp 0x18001c3ee
cmp edi, 0x16b16
je 0x18001c3ce
cmp edi, 0x1a76a
je 0x18001c3c3
cmp edi, 0x1e3be
je 0x18001c3a3
cmp edi, 0x22012
jne 0x18001c3ee
lea r9, [rbp - 0x68]
mov r8d, 0x80
lea rdx, [rbp - 0x20]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ReadConsoleInputA]
jmp 0x18001c3ee
lea r9, [rbp + 0xa00]
xor r8d, r8d
lea rdx, [rbp + 0x9f0]
lea rcx, [rbp + 0x9e0]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameA]
jmp 0x18001c3ee
mov word [rbp + 0x9ea], 0x65
jmp 0x18001c3ee
mov eax, dword [0x1800e6562]
mov dword [rbp + 0x9e5], eax
movzx eax, byte [0x1800e6566]
mov byte [rbp + 0x9e9], al
mov byte [rbp + 0x9ea], 0
add edi, 0x3c54
cmp edi, 0x25b48
jbe 0x18001c2b0
mov rbx, qword [rbp - 0x80]
mov esi, dword [rsp + 0x40]
mov r15d, dword [rsp + 0x48]
mov r12, qword [rbp - 0x78]
mov edx, dword [rsp + 0x38]
mov eax, dword [rsp + 0x34]
add esi, 0x43
mov dword [rsp + 0x40], esi
cmp esi, eax
jae 0x18001c03e
mov rcx, qword [rbp - 0x60]
mov r9, qword [rsp + 0x58]
jmp 0x18001bf72
mov rcx, qword [rbp - 0x70]
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x18001c041