Function at 0x14010bcb0
Capabilities:
Get common file path

Disassembly:
push rdi
sub rsp, 0x950
mov rax, qword [0x1401ad1c0]
xor rax, rsp
mov qword [rsp + 0x940], rax
mov dword [rsp + 0x27c], 0
mov dword [rsp + Ordinal_1495], 0
mov dword [rsp + 0x278], 0
mov dword [rsp + 0x260], 0
mov dword [rsp + 0x700], 0
mov byte [rsp + 0x710], 0
lea rax, [rsp + 0x711]
mov rdi, rax
xor eax, eax
mov ecx, 0x103
rep stosb byte [rdi], al
mov byte [rsp + 0x3b0], 0
lea rax, [rsp + 0x3b1]
mov rdi, rax
xor eax, eax
mov ecx, 0x103
rep stosb byte [rdi], al
mov dword [rsp + 0x5e0], 0
mov byte [rsp + 0x4c0], 0
lea rax, [rsp + 0x4c1]
mov rdi, rax
xor eax, eax
mov ecx, 0x103
rep stosb byte [rdi], al
mov byte [rsp + 0x290], 0
lea rax, [rsp + 0x291]
mov rdi, rax
xor eax, eax
mov ecx, 0x103
rep stosb byte [rdi], al
mov dword [rsp + 0x288], 0
mov byte [rsp + 0x5f0], 0
lea rax, [rsp + 0x5f1]
mov rdi, rax
xor eax, eax
mov ecx, 0x103
rep stosb byte [rdi], al
mov byte [rsp + 0x830], 0
lea rax, [rsp + 0x831]
mov rdi, rax
xor eax, eax
mov ecx, 0x103
rep stosb byte [rdi], al
mov word [rsp + 0x50], 0
lea rax, [rsp + 0x52]
mov rdi, rax
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
lea rax, str.wkwin32.dll
mov qword [rsp + 0x270], rax
lea rax, str.wkwin64.dll
mov qword [rsp + 0x3a0], rax
lea rax, str.VeriSign_Class_3_Code_Signing_2009_2_CA
mov qword [rsp + 0x268], rax
lea rax, str.WIBU_SYSTEMS_AG
mov qword [rsp + Ordinal_1498], rax
lea rax, str.Symantec_Time_Stamping_Services_CA___G2
mov qword [rsp + 0x280], rax
lea rax, str.Symantec_Time_Stamping_Services_Signer___G4
mov qword [rsp + 0x708], rax
lea rax, str.12_20_2012_18:29
mov qword [rsp + 0x820], rax
mov edx, 0x104
lea rcx, [rsp + 0x830]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov dword [rsp + 0x28], Ordinal_266
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
lea r8, [rsp + 0x830]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rdx, qword [rsp + 0x3a0]
lea rcx, [rsp + 0x50]
call sub.MSVCR110.dll_wcscat
lea rcx, [rsp + 0x50]
call fcn.1401477d0
mov dword [rsp + 0x278], eax
lea rax, [rsp + 0x5f0]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x288]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x290]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x4c0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x5e0]
lea r8, [rsp + 0x3b0]
lea rdx, [rsp + 0x710]
lea rcx, [rsp + 0x50]
call fcn.1401479b0
mov dword [rsp + 0x260], eax
cmp dword [rsp + 0x260], 0
jne 0x14010bf26
cmp qword [0x1401d0808], 0
je 0x14010bf1f
lea rcx, str.Unable_to_get_WIBU_DLL_certificate_information__n
call qword [0x1401d0808]
xor eax, eax
jmp 0x14010c001
mov rdx, qword [rsp + 0x268]
lea rcx, [rsp + 0x710]
call sub.MSVCR110.dll_strstr
test rax, rax
je 0x14010bf72
mov rdx, qword [rsp + 0x5d8]
lea rcx, [rsp + 0x3b0]
call sub.MSVCR110.dll_strstr
test rax, rax
je 0x14010bf72
cmp dword [rsp + 0x5e0], 0x6fd
jne 0x14010bf72
mov dword [rsp + 0x27c], 1
cmp dword [rsp + 0x27c], 0
je 0x14010bfe2
mov rdx, qword [rsp + 0x280]
lea rcx, [rsp + 0x4c0]
call sub.MSVCR110.dll_strstr
test rax, rax
je 0x14010bfe2
mov rdx, qword [rsp + 0x820]
lea rcx, [rsp + 0x5f0]
call sub.MSVCR110.dll_strstr
test rax, rax
je 0x14010bfe2
mov rdx, qword [rsp + 0x708]
lea rcx, [rsp + 0x290]
call sub.MSVCR110.dll_strstr
test rax, rax
je 0x14010bfe2
cmp dword [rsp + 0x288], 0x8e0
jne 0x14010bfe2
mov dword [rsp + Ordinal_1495], 1
cmp dword [rsp + 0x278], 0
je 0x14010bfff
cmp dword [rsp + 0x5d0], 0
je 0x14010bfff
mov eax, 1
jmp 0x14010c001
xor eax, eax
mov rcx, qword [rsp + 0x940]
xor rcx, rsp
call fcn.14006b6a0
add rsp, 0x950
pop rdi
ret