Function at 0x140004a48
Capabilities:
Get common file path
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x5c0
mov rax, qword [0x14001d0a0]
xor rax, rsp
mov qword [rsp + 0x5b0], rax
mov r12, rdx
mov ebx, ecx
and dword [rsp + 0x30], 0
xor r9d, r9d
xor r8d, r8d
lea r15d, [r9 + 1]
mov edx, r15d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapSetInformation]
nop dword [rax + rax]
nop
lea r9, [rsp + 0x30]
mov rdx, r12
mov ecx, ebx
call fcn.140004520
test eax, eax
jne 0x140005048
mov esi, 0x1c0
mov ecx, esi
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
jne 0x140004aee
xor edx, edx
xor r9d, r9d
mov ebx, 0x7d5
mov r8d, ebx
xor ecx, ecx
call fcn.140007878
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
add dword [0x14001d9b8], esi
mov rcx, rdi
call fcn.1400059e8
and qword [rdi + 0x1b8], 0
mov qword [0x14001d9b0], rdi
sub bx, r15w
lea rdx, [r12 + 8]
movzx r8d, bx
mov rcx, rdi
call fcn.14000120c
lea rsi, [rdi + 0xa8]
mov r13d, 8
lea r14d, [r13 + 0x18]
cmp byte [rsi], 0
jne 0x140004b58
mov dword [rsp + 0x28], 0x26e
mov dword [rsp + 0x20], r15d
mov r9d, r13d
lea r8, str._d._02d._04d
mov edx, r14d
mov rcx, rsi
call fcn.14000118c
lea rbx, [rdi + 0x88]
cmp byte [rbx], 0
jne 0x140004c03
mov qword [rsp + 0x68], 0x7fffffff
lea rcx, [rsp + 0x68]
call qword [sym.imp.msvcrt.dll_ctime]
nop dword [rax + rax]
mov r8d, 0x7ffffffe
mov qword [rsp + 0x80], r8
mov qword [rsp + 0x70], rax
mov rdx, r14
mov qword [rsp + 0x78], rdx
mov qword [rsp + 0x50], rbx
xor ecx, ecx
mov qword [rsp + 0x58], rcx
test rdx, rdx
je 0x140004bf0
test r8, r8
je 0x140004beb
mov r9b, byte [rax]
test r9b, r9b
je 0x140004beb
mov byte [rbx], r9b
add rbx, r15
mov qword [rsp + 0x50], rbx
add rax, r15
mov qword [rsp + 0x70], rax
sub rdx, r15
mov qword [rsp + 0x78], rdx
sub r8, r15
mov qword [rsp + 0x80], r8
add rcx, r15
mov qword [rsp + 0x58], rcx
jmp 0x140004ba9
test rdx, rdx
jne 0x140004c00
sub rbx, r15
mov qword [rsp + 0x50], rbx
sub rcx, r15
mov qword [rsp + 0x58], rcx
mov byte [rbx], 0
mov al, byte [rdi + 0x2c]
mov byte [rsp + 0x34], al
test al, al
je 0x140004c6a
mov ecx, 2
call fcn.14000ca9c
mov rcx, rax
mov r8, rsi
lea rdx, str.Microsoft__R__32b_64b_MIDL_Compiler_Version__s__n
call qword [sym.imp.msvcrt.dll_fprintf]
nop dword [rax + rax]
mov ecx, 2
call fcn.14000ca9c
mov rcx, rax
lea rdx, str.Copyright__c__Microsoft_Corporation._All_rights_reserved._n
call qword [sym.imp.msvcrt.dll_fprintf]
nop dword [rax + rax]
mov ecx, 2
call fcn.14000ca9c
mov rcx, rax
call qword [sym.imp.msvcrt.dll_fflush]
nop dword [rax + rax]
mov rcx, rdi
call fcn.14000134c
mov ebx, eax
mov dword [rsp + 0x30], eax
test eax, eax
jne 0x14000500b
cmp byte [0x14001d9bc], al
jne 0x14000500b
mov edx, dword [rdi]
and edx, r14d
je 0x140004ca0
mov rcx, rdi
call fcn.140003644
jmp 0x14000500b
mov eax, dword [rdi + 4]
and eax, 0x10000
je 0x140004cb4
call fcn.140003f28
jmp 0x14000500b
mov r15d, dword [rdi + 0x74]
mov dword [rsp + 0x60], r15d
lea rdx, [rsp + 0x1a0]
mov esi, 0x104
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
nop dword [rax + rax]
test eax, eax
jne 0x140004d25
mov ebx, 0x3f8
mov dword [rsp + 0x30], ebx
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov r9d, eax
lea r8, str.Temp_Path_not_found__error__d
mov edx, esi
lea rcx, [rsp + 0x90]
call fcn.140008844
xor edx, edx
lea r9, [rsp + 0x90]
mov r8d, ebx
xor ecx, ecx
call fcn.140007878
mov eax, ebx
jmp 0x14000507e
lea r9, [rsp + 0x90]
xor r8d, r8d
lea rdx, str.MIDLC
lea rcx, [rsp + 0x1a0]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameA]
nop dword [rax + rax]
test eax, eax
jne 0x140004e06
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov esi, eax
xor ebx, ebx
mov dword [rsp + 0x40], ebx
cmp ebx, 5
jge 0x140004db9
lea r9, [rsp + 0x90]
xor r8d, r8d
lea rdx, str.MIDLC
lea rcx, [rsp + 0x1a0]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameA]
nop dword [rax + rax]
test eax, eax
jne 0x140004e06
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov esi, eax
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
nop dword [rax + rax]
inc ebx
jmp 0x140004d63
test esi, esi
je 0x140004e06
mov ebx, 0x3f8
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x20], esi
lea r9, [rsp + 0x1a0]
lea r8, str.Cant_create_temp_file_in__s__error__d
mov edx, 0x104
lea rcx, [rsp + 0x90]
call fcn.140008844
xor edx, edx
lea r9, [rsp + 0x90]
mov r8d, ebx
xor ecx, ecx
call fcn.140007878
mov eax, ebx
jmp 0x14000507e
and dword [rdi + 0x74], 0
mov rdx, rdi
lea rcx, [rsp + 0x90]
call fcn.1400050b4
lea rax, [rsp + 0x3b0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x4b0]
lea r8, [rsp + 0x2b0]
lea rdx, [rsp + 0x38]
mov rcx, qword [r12]
call qword [sym.imp.msvcrt.dll__splitpath]
nop dword [rax + rax]
lea rax, [0x140012da8]
mov qword [rsp + 0x20], rax
lea r9, str.midlc
lea r8, [rsp + 0x2b0]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x1a0]
call qword [sym.imp.msvcrt.dll__makepath]
nop dword [rax + rax]
mov eax, dword [rdi + 4]
and eax, 2
je 0x140004eb2
lea r8, [rsp + 0x90]
lea rdx, [rsp + 0x1a0]
lea rcx, str._ndebugline:__s__s_n
call qword [sym.imp.msvcrt.dll_printf]
nop dword [rax + rax]
xor eax, eax
jmp 0x14000507e
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x1a0]
call fcn.140004330
mov ebx, eax
mov dword [rsp + 0x30], eax
mov r12d, 0x95f
lea esi, [r12 + 0x14]
cmp eax, r12d
je 0x140004ef5
cmp eax, esi
je 0x140004ef5
lea rcx, [rsp + 0x90]
call qword [sym.imp.msvcrt.dll__unlink]
nop dword [rax + rax]
mov eax, dword [rdi]
and eax, 0x1000
jne 0x14000500b
test ebx, ebx
jne 0x14000502f
test r15d, r15d
je 0x14000500b
xor edx, edx
lea r9, str.append64
xor ecx, ecx
mov r8d, 0x9b4
call fcn.140007878
mov dword [rdi + 0x74], 1
or word [rdi + 0x1a], r14w
mov rcx, rdi
call fcn.140003538
cmp byte [0x14001d9bc], bl
jne 0x14000500b
mov eax, 0xffef
and word [rdi + 0x1a], ax
movzx eax, word [rdi + 0x1a]
or ax, r13w
mov word [rdi + 0x1a], ax
mov rdx, rdi
lea rcx, [rsp + 0x90]
call fcn.1400050b4
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x1a0]
call fcn.140004330
mov ebx, eax
mov dword [rsp + 0x30], eax
cmp eax, r12d
je 0x140004fa6
cmp eax, esi
je 0x140004fa6
lea rcx, [rsp + 0x90]
call qword [sym.imp.msvcrt.dll__unlink]
nop dword [rax + rax]
test ebx, ebx
jne 0x14000502f
mov eax, 0xfff7
and word [rdi + 0x1a], ax
movzx eax, word [rdi + 0x1a]
or ax, 0x10
mov word [rdi + 0x1a], ax
mov rdx, rdi
lea rcx, [rsp + 0x90]
call fcn.1400050b4
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x1a0]
call fcn.140004330
mov ebx, eax
mov dword [rsp + 0x30], eax
cmp eax, r12d
je 0x14000500b
cmp eax, esi
je 0x14000500b
lea rcx, [rsp + 0x90]
call qword [sym.imp.msvcrt.dll__unlink]
nop dword [rax + rax]
test ebx, ebx
jne 0x14000502f
cmp byte [0x14001d9bc], bl
je 0x14000502f
xor edx, edx
xor r9d, r9d
mov ebx, 0x400
mov r8d, ebx
xor ecx, ecx
call fcn.140007878
mov dword [rsp + 0x30], ebx
mov r8d, 0x95e
cmp ebx, r8d
jne 0x14000504c
xor edx, edx
xor r9d, r9d
xor ecx, ecx
call fcn.140007878
jmp 0x14000504c
mov ebx, dword [rsp + 0x30]
jmp 0x14000507c
mov eax, ebx
mov rcx, qword [rsp + 0x5b0]
xor rcx, rsp
call fcn.1400082a0
lea r11, [rsp + 0x5c0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret