Function at 0x14000377c
Capabilities:
Get common file path
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x480
mov rax, qword [0x1400592a0]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov rbx, qword [0x140059d68]
xor r12d, r12d
mov rbp, rcx
mov edi, 1
test rbx, rbx
je 0x1400037db
mov rcx, rbx
call fcn.140016a48
lea edx, [rdi + 0x47]
mov rcx, rbx
call fcn.140001818
mov ebx, r12d
mov qword [0x140059d68], rbx
cmp qword [0x14005a6d0], r12
je 0x1400039f6
call fcn.140017524
test rax, rax
je 0x1400039f6
call fcn.140017524
mov esi, 0x104
lea rbx, [0x1400486c8]
mov edx, esi
lea rcx, [rsp + 0x50]
cmp qword [rax + 0x60], r12
cmovne rbx, qword [rax + 0x60]
call qword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
nop dword [rax + rax]
test eax, eax
je 0x1400039ef
lea r8, str._notepad.exe
mov edx, esi
lea rcx, [rsp + 0x50]
call fcn.140010d0c
or r14d, 0xffffffff
test eax, eax
js 0x14000388b
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, r14d
je 0x140003860
test al, 0x10
je 0x14000388b
mov edx, esi
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
nop dword [rax + rax]
test eax, eax
je 0x14000388b
lea r8, str._notepad.exe
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.140010d0c
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, r14d
je 0x1400039ef
test al, 0x10
jne 0x1400039ef
test rbx, rbx
je 0x1400039ef
lea rdx, [0x1400486c8]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wcsicmp]
nop dword [rax + rax]
test eax, eax
je 0x1400039ef
mov rcx, rbx
call fcn.14001ab20
test eax, eax
je 0x1400039ef
mov rcx, qword [0x140059d90]
lea r8, [rsp + 0x260]
mov r9d, 0xff
lea edx, [r9 - 0x55]
call qword [sym.imp.USER32.dll_LoadStringW]
nop dword [rax + rax]
test eax, eax
je 0x1400039ef
movsxd rax, dword [0x140059d58]
lea rcx, [rax + rax*2]
mov rax, qword [str.6ij]
add rcx, rcx
mov r14d, dword [rax + rcx*8 + 0x2c]
mov rcx, rbp
call qword [sym.imp.USER32.dll_GetParent]
nop dword [rax + rax]
mov rcx, rax
mov edx, r14d
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax + rax]
mov edx, 0x402
mov rcx, rbp
mov r15, rax
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
jne 0x140003991
mov rcx, rbp
call qword [sym.imp.USER32.dll_GetParent]
nop dword [rax + rax]
mov rcx, rax
mov edx, 0x402
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax + rax]
mov rsi, rax
mov ecx, 0x48
call fcn.140001460
test rax, rax
je 0x1400039e3
mov qword [rsp + 0x40], r15
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x38], r14d
mov r9, rsi
mov qword [rsp + 0x30], rbx
mov r8d, 0x402
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x260]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.140016808
mov rbx, rax
mov qword [0x140059d68], rax
jmp 0x1400039f6
mov rbx, r12
mov qword [0x140059d68], rbx
jmp 0x1400039f6
mov rbx, qword [0x140059d68]
test rbx, rbx
cmove edi, r12d
mov eax, edi
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.1400017f0
lea r11, [rsp + 0x480]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret