Function at 0x140033170
Capabilities:
Contain obfuscated stackstrings
Get common file path

Disassembly:
sub rsp, 0xb8
mov dword [rsp + 0x20], 0
mov edx, 0x105
lea rcx, [0x1400605b0]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov byte [rsp + 0x95], 0x6d
mov byte [rsp + 0x97], 0x33
mov byte [rsp + 0x96], 0x34
mov byte [rsp + 0x98], 0x2f
mov byte [rsp + 0x93], 0x6f
mov byte [rsp + 0x9a], 0x6d
mov byte [rsp + 0x94], 0x66
mov byte [rsp + 0x9c], 0
movzx eax, byte [rsp + 0x94]
sub al, 1
mov byte [rsp + 0x94], al
mov byte [rsp + 0x99], 0x65
mov byte [rsp + 0x9b], 0x6d
mov byte [rsp + 0x90], 0x4c
mov byte [rsp + 0x92], 0x73
mov byte [rsp + 0x91], 0x66
movzx eax, byte [rsp + 0x91]
sub al, 1
mov byte [rsp + 0x91], al
movzx eax, byte [rsp + 0x95]
sub al, 1
mov byte [rsp + 0x95], al
movzx eax, byte [rsp + 0x97]
sub al, 1
mov byte [rsp + 0x97], al
movzx eax, byte [rsp + 0x93]
sub al, 1
mov byte [rsp + 0x93], al
movzx eax, byte [rsp + 0x9a]
sub al, 1
mov byte [rsp + 0x9a], al
movzx eax, byte [rsp + 0x90]
sub al, 1
mov byte [rsp + 0x90], al
movzx eax, byte [rsp + 0x92]
sub al, 1
mov byte [rsp + 0x92], al
movzx eax, byte [rsp + 0x96]
sub al, 1
mov byte [rsp + 0x96], al
movzx eax, byte [rsp + 0x98]
sub al, 1
mov byte [rsp + 0x98], al
movzx eax, byte [rsp + 0x99]
sub al, 1
mov byte [rsp + 0x99], al
movzx eax, byte [rsp + 0x9b]
sub al, 1
mov byte [rsp + 0x9b], al
mov byte [rsp + 0xa4], 0x71
mov byte [rsp + 0xa5], 0x6a
movzx eax, byte [rsp + 0xa4]
sub al, 1
mov byte [rsp + 0xa4], al
movzx eax, byte [rsp + 0xa5]
sub al, 1
mov byte [rsp + 0xa5], al
mov byte [rsp + 0xa6], 0x34
mov byte [rsp + 0xa7], 0x33
movzx eax, byte [rsp + 0xa6]
sub al, 1
mov byte [rsp + 0xa6], al
movzx eax, byte [rsp + 0xa7]
sub al, 1
mov byte [rsp + 0xa7], al
mov byte [rsp + 0xa0], 0x42
mov byte [rsp + 0xa1], 0x65
movzx eax, byte [rsp + 0xa0]
sub al, 1
mov byte [rsp + 0xa0], al
movzx eax, byte [rsp + 0xa1]
sub al, 1
mov byte [rsp + 0xa1], al
mov byte [rsp + 0xa2], 0x77
mov byte [rsp + 0xa3], 0x62
movzx eax, byte [rsp + 0xa2]
sub al, 1
mov byte [rsp + 0xa2], al
movzx eax, byte [rsp + 0xa3]
sub al, 1
mov byte [rsp + 0xa3], al
mov byte [rsp + 0xa8], 0
mov byte [rsp + 0x82], 0x65
mov byte [rsp + 0x83], 0x6d
movzx eax, byte [rsp + 0x82]
sub al, 1
mov byte [rsp + 0x82], al
movzx eax, byte [rsp + 0x83]
sub al, 1
mov byte [rsp + 0x83], al
mov byte [rsp + 0x80], 0x6f
mov byte [rsp + 0x81], 0x75
movzx eax, byte [rsp + 0x80]
sub al, 1
mov byte [rsp + 0x80], al
movzx eax, byte [rsp + 0x81]
sub al, 1
mov byte [rsp + 0x81], al
mov byte [rsp + 0x84], 0x6d
mov byte [rsp + 0x85], 0
movzx eax, byte [rsp + 0x84]
sub al, 1
mov byte [rsp + 0x84], al
mov byte [rsp + 0x5c], 0x34
mov byte [rsp + 0x5d], 0x33
mov byte [rsp + 0x5c], 0x33
movzx eax, byte [rsp + 0x5d]
sub al, 1
mov byte [rsp + 0x5d], al
mov byte [rsp + 0x58], 0x56
mov byte [rsp + 0x59], 0x74
movzx eax, byte [rsp + 0x58]
sub al, 1
mov byte [rsp + 0x58], al
movzx eax, byte [rsp + 0x59]
sub al, 1
mov byte [rsp + 0x59], al
mov byte [rsp + 0x5a], 0x66
mov byte [rsp + 0x5b], 0x73
movzx eax, byte [rsp + 0x5a]
sub al, 1
mov byte [rsp + 0x5a], al
movzx eax, byte [rsp + 0x5b]
sub al, 1
mov byte [rsp + 0x5b], al
mov byte [rsp + 0x5e], 0
mov byte [rsp + 0x68], 0x48
mov byte [rsp + 0x6d], 0x65
mov byte [rsp + 0x72], 0x62
mov byte [rsp + 0x77], 0x42
movzx eax, byte [rsp + 0x68]
sub al, 1
mov byte [rsp + 0x68], al
movzx eax, byte [rsp + 0x6d]
sub al, 1
mov byte [rsp + 0x6d], al
movzx eax, byte [rsp + 0x72]
sub al, 1
mov byte [rsp + 0x72], al
movzx eax, byte [rsp + 0x77]
sub al, 1
mov byte [rsp + 0x77], al
mov byte [rsp + 0x69], 0x66
mov byte [rsp + 0x6e], 0x76
mov byte [rsp + 0x73], 0x6f
mov byte [rsp + 0x78], 0
movzx eax, byte [rsp + 0x69]
sub al, 1
mov byte [rsp + 0x69], al
movzx eax, byte [rsp + 0x6e]
sub al, 1
mov byte [rsp + 0x6e], al
movzx eax, byte [rsp + 0x73]
sub al, 1
mov byte [rsp + 0x73], al
mov byte [rsp + 0x78], 0
mov byte [rsp + 0x6a], 0x75
mov byte [rsp + 0x6f], 0x6d
mov byte [rsp + 0x74], 0x65
mov byte [rsp + 0x79], 0
movzx eax, byte [rsp + 0x6a]
sub al, 1
mov byte [rsp + 0x6a], al
movzx eax, byte [rsp + 0x6f]
sub al, 1
mov byte [rsp + 0x6f], al
movzx eax, byte [rsp + 0x74]
sub al, 1
mov byte [rsp + 0x74], al
mov byte [rsp + 0x79], 0
mov byte [rsp + 0x6b], 0x4e
mov byte [rsp + 0x70], 0x66
mov byte [rsp + 0x75], 0x6d
mov byte [rsp + 0x7a], 0
movzx eax, byte [rsp + 0x6b]
sub al, 1
mov byte [rsp + 0x6b], al
movzx eax, byte [rsp + 0x70]
sub al, 1
mov byte [rsp + 0x70], al
movzx eax, byte [rsp + 0x75]
sub al, 1
mov byte [rsp + 0x75], al
mov byte [rsp + 0x7a], 0
mov byte [rsp + 0x6c], 0x70
mov byte [rsp + 0x71], 0x49
mov byte [rsp + 0x76], 0x66
movzx eax, byte [rsp + 0x6c]
sub al, 1
mov byte [rsp + 0x6c], al
movzx eax, byte [rsp + 0x71]
sub al, 1
mov byte [rsp + 0x71], al
movzx eax, byte [rsp + 0x76]
sub al, 1
mov byte [rsp + 0x76], al
lea rcx, [0x1400605b0]
call fcn.140049d80
mov dword [rsp + 0x20], eax
mov r8d, dword [rsp + 0x20]
lea rdx, [0x1400605b0]
lea rcx, [0x1400606c0]
call fcn.140031c10
movsxd rax, dword [rsp + 0x20]
lea rcx, [0x1400606c0]
add rcx, rax
mov rax, rcx
mov r8d, 1
lea rdx, [0x14005f30c]
mov rcx, rax
call fcn.140031c10
mov eax, dword [rsp + 0x20]
add eax, 1
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x90]
call fcn.140049d80
movsxd rcx, dword [rsp + 0x20]
lea rdx, [0x1400606c0]
add rdx, rcx
mov rcx, rdx
mov r8d, eax
lea rdx, [rsp + 0x90]
call fcn.140031c10
lea rcx, [rsp + 0x90]
call fcn.140049d80
mov ecx, dword [rsp + 0x20]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
lea rcx, [0x1400606c0]
mov byte [rcx + rax], 0
lea rcx, [0x1400606c0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [0x1400607d8], rax
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0x48], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0x28], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x38]
mov qword [0x14005c838], rax
mov rax, qword [rsp + 0x30]
mov qword [0x14005c830], rax
mov rax, qword [rsp + 0x40]
mov qword [0x14005c840], rax
mov rax, qword [rsp + 0x48]
mov qword [0x14005c848], rax
mov rax, qword [rsp + 0x28]
mov qword [0x14005c828], rax
mov rax, qword [rsp + 0x50]
mov qword [0x14005c850], rax
lea rcx, [rsp + 0x28]
call fcn.1400339b0
add rsp, 0xb8
ret