Function at 0x14012da80
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x4d0]
sub rsp, 0x5d0
mov rax, qword [0x140713740]
xor rax, rsp
mov qword [rbp + 0x4c0], rax
mov qword [rsp + 0x50], rdx
mov rbx, rcx
mov qword [rsp + 0x60], rdx
xor edi, edi
xor edx, edx
mov r8d, 0x180
lea rcx, [rbp - 0x50]
call fcn.14041cf40
lea rcx, [rbp - 0x50]
call fcn.14011fcf0
nop
xor edx, edx
mov r8d, 0x180
lea rcx, [rbp + 0x130]
call fcn.14041cf40
lea rcx, [rbp + 0x130]
call fcn.14011fcf0
nop
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x2b0]
call fcn.14041cf40
mov edx, 0x104
lea rcx, [rbp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x78], rdi
lea rax, [rbp + 0x2b0]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14012db50
lea rdx, [rbp + 0x2b0]
lea rcx, [rsp + 0x70]
call fcn.1400fe2f0
nop
cmp byte [rbx], 0
je 0x14012dd17
movabs rsi, 0x7ffffffffffffffe
mov rax, rsi
mov rbx, qword [rbp - 0x80]
sub rax, rbx
cmp rax, 0x13
jb 0x14012e0df
lea rax, [rsp + 0x70]
mov r12, qword [rsp + 0x70]
cmp qword [rbp - 0x78], 7
cmova rax, r12
mov qword [rsp + 0x20], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x60], xmm1
lea r13, [rbx + 0x13]
mov edi, 7
lea r14, [rbp - 0x70]
cmp r13, rdi
jbe 0x14012dc6c
mov rdi, r13
or rdi, 7
movabs r15, 0x7fffffffffffffff
cmp rdi, rsi
jbe 0x14012dc2e
mov rdi, rsi
lea rcx, [r15 + r15]
cmp rcx, 0x1000
jb 0x14012dc57
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14012e0e5
mov rcx, rax
call fcn.1403e515c
test rax, rax
je 0x14012e0eb
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
xor esi, esi
mov rax, qword [rsp + 0x20]
mov qword [rbp - 0x70], r14
jmp 0x14012dc6e
mov ecx, 0xa
cmp rdi, rcx
cmovb rdi, rcx
lea rcx, [rdi + 1]
cmp rcx, r15
ja 0x14012e0e5
add rcx, rcx
jne 0x14012dbee
xor esi, esi
mov r14d, esi
mov qword [rbp - 0x70], rsi
jmp 0x14012dc6e
call fcn.1403e515c
mov r14, rax
xor esi, esi
mov rax, qword [rsp + 0x20]
mov qword [rbp - 0x70], r14
jmp 0x14012dc6e
xor esi, esi
mov qword [rbp - 0x60], r13
mov qword [rbp - 0x58], rdi
add rbx, rbx
mov r8, rbx
mov rdx, rax
mov rcx, r14
call fcn.14041c8a0
movups xmm0, xmmword [str.System32_ntdll.dll]
movups xmmword [rbx + r14], xmm0
movups xmm1, xmmword [0x140539650]
movups xmmword [rbx + r14 + 0x10], xmm1
mov eax, dword [0x140539660]
mov dword [rbx + r14 + 0x20], eax
movzx eax, word [0x140539664]
mov word [rbx + r14 + 0x24], ax
mov word [r14 + r13*2], si
mov r8b, 1
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x50]
call fcn.14011ff60
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 7
jbe 0x14012e02d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14012dd0d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14012e0eb
call fcn.1403e5198
jmp 0x14012e02d
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
movzx eax, byte [rbx + 1]
mov qword [rbp - 0x70], rdi
mov byte [rbp - 0x68], al
test al, al
je 0x14012dd38
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
nop
movabs rsi, 0x7ffffffffffffffe
mov rax, rsi
mov rdx, qword [rbp - 0x80]
sub rax, rdx
cmp rax, 0x13
jb 0x14012e0f1
lea r9, [rsp + 0x70]
mov r12, qword [rsp + 0x70]
cmp qword [rbp - 0x78], 7
cmova r9, r12
mov qword [rsp + 0x20], r9
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x38], xmm1
lea r13, [rdx + 0x13]
mov edi, 7
mov ebx, edi
lea r14, [rsp + 0x28]
mov eax, 0xa
movabs r15, 0x7fffffffffffffff
cmp r13, rdi
jbe 0x14012de2a
mov rbx, r13
or rbx, rdi
cmp rbx, rsi
jbe 0x14012ddf7
mov rbx, rsi
lea rcx, [r15 + r15]
cmp rcx, 0x1000
jb 0x14012de14
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14012e0fd
mov rcx, rax
call fcn.1403e515c
test rax, rax
je 0x14012e0f7
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
mov rdx, qword [rbp - 0x80]
mov r9, qword [rsp + 0x20]
jmp 0x14012de25
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, r15
ja 0x14012e0fd
add rcx, rcx
jne 0x14012ddb9
xor eax, eax
jmp 0x14012de22
call fcn.1403e515c
mov rdx, qword [rbp - 0x80]
mov r9, qword [rsp + 0x20]
mov r14, rax
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x40], rbx
lea rbx, [rdx + rdx]
mov r8, rbx
mov rdx, r9
mov rcx, r14
call fcn.14041c8a0
movups xmm0, xmmword [str.System32_ntdll.dll]
movups xmmword [rbx + r14], xmm0
movups xmm1, xmmword [0x140539650]
movups xmmword [rbx + r14 + 0x10], xmm1
mov eax, dword [0x140539660]
mov dword [rbx + r14 + 0x20], eax
movzx eax, word [0x140539664]
mov word [rbx + r14 + 0x24], ax
xor eax, eax
mov word [r14 + r13*2], ax
mov r8b, 1
lea rdx, [rsp + 0x28]
lea rcx, [rbp + 0x130]
call fcn.14011ff60
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 7
jbe 0x14012ded5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14012ded0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14012e0f7
call fcn.1403e5198
lea r14, [rsp + 0x70]
cmp qword [rbp - 0x78], 7
cmova r14, r12
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x38], xmm1
lea rbx, [rsp + 0x28]
cmp r13, 7
jbe 0x14012df77
mov rdi, r13
or rdi, 7
cmp rdi, rsi
jbe 0x14012df47
mov rdi, rsi
lea rcx, [r15 + r15]
cmp rcx, 0x1000
jb 0x14012df6a
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14012e109
mov rcx, rax
call fcn.1403e515c
test rax, rax
je 0x14012e103
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x14012df72
cmp rdi, 0xa
mov ecx, 0xa
cmovb rdi, rcx
lea rcx, [rdi + 1]
cmp rcx, r15
ja 0x14012e109
add rcx, rcx
jne 0x14012df12
xor eax, eax
jmp 0x14012df6f
call fcn.1403e515c
mov rbx, rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x40], rdi
mov rdi, qword [rbp - 0x80]
lea r8, [rdi + rdi]
mov rdx, r14
mov rcx, rbx
call fcn.14041c8a0
movups xmm0, xmmword [str.SysWOW64_ntdll.dll]
movups xmmword [rbx + rdi*2], xmm0
movups xmm1, xmmword [0x140539678]
movups xmmword [rbx + rdi*2 + 0x10], xmm1
mov eax, dword [0x140539688]
mov dword [rbx + rdi*2 + 0x20], eax
movzx eax, word [0x14053968c]
mov word [rbx + rdi*2 + 0x24], ax
xor eax, eax
mov word [rbx + r13*2], ax
mov r8b, 1
lea rdx, [rsp + 0x28]
lea rcx, [rbp - 0x50]
call fcn.14011ff60
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 7
jbe 0x14012e01d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14012e017
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14012e103
call fcn.1403e5198
nop
cmp byte [rbp - 0x68], 0
je 0x14012e02d
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
lea rdx, [rbp - 0x50]
mov rbx, qword [rsp + 0x50]
mov rcx, rbx
call fcn.14012e110
nop
lea rcx, [rbx + 0x180]
lea rdx, [rbp + 0x130]
call fcn.14012e110
nop
mov rax, qword [rbp - 0x78]
cmp rax, 7
jbe 0x14012e090
lea rdx, [rax*2 + 2]
mov rax, r12
cmp rdx, 0x1000
jb 0x14012e087
add rdx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14012e0d9
mov rcx, r12
call fcn.1403e5198
nop
lea rcx, [rbp + 0x130]
call fcn.14011fe10
nop
lea rcx, [rbp - 0x50]
call fcn.14011fe10
mov rax, rbx
mov rcx, qword [rbp + 0x4c0]
xor rcx, rsp
call fcn.1403e5550
lea r11, [rsp + 0x5d0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1403eb834
nop
call fcn.1400fd2a0
int3
call fcn.1400fd180
int3
call fcn.1403eb834
nop
call fcn.1400fd2a0
int3
call fcn.1403eb834
int3
call fcn.1400fd180
int3
call fcn.1403eb834
int3
call fcn.1400fd180
int3