Function at 0x18001e6f0
Capabilities:
Get common file path

Disassembly:
push rdi
sub rsp, 0x170
mov rax, qword [0x1800ea530]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov edi, ecx
mov dword [rsp + 0x20], ecx
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x104
call fcn.180069880
mov r8d, 0x104
lea rdx, [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x18001e794
mov edx, eax
lea r9, [0x1800c7520]
mov rcx, 0xffffffffffffffff
nop word [rax + rax]
inc rcx
cmp byte [r9 + rcx], 0
jne 0x18001e750
cmp rcx, rdx
ja 0x18001e794
lea rcx, [rsp + 0x30]
add rcx, rdx
cmp byte [rcx], 0x5c
je 0x18001e774
dec rcx
add eax, 0xffffffff
jne 0x18001e767
mov eax, eax
lea rcx, [rsp + 0x30]
add rcx, rax
mov r8d, 7
mov rdx, r9
call fcn.18009d510
test eax, eax
je 0x18001ef07
cmp qword [0x1800eb380], 0
jne 0x18001ef07
cmp qword [0x1800eb260], 0
jne 0x18001ef07
cmp qword [0x1800eb370], 0
jne 0x18001ef07
cmp qword [0x1800eb388], 0
jne 0x18001ef07
cmp qword [0x1800eb390], 0
jne 0x18001ef07
cmp qword [0x1800eb398], 0
jne 0x18001ef07
mov qword [rsp + 0x188], rbx
mov ebx, 0x800
mov qword [rsp + 0x190], rbp
xor ebp, ebp
mov qword [rsp + 0x198], rsi
test edi, edi
mov qword [rsp + 0x168], r12
mov r12d, ebp
mov qword [rsp + 0x160], r13
cmovne ebx, ebp
mov qword [rsp + 0x158], r14
mov r13d, ebp
mov qword [rsp + 0x150], r15
mov r14d, ebp
mov dword [rsp + 0x24], ebx
mov r15d, ebp
mov dword [0x1800ea014], ebp
je 0x18001e914
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rbx, [0x1800c7530]
mov rdx, 0xffffffffffffffff
mov edi, eax
inc rdx
cmp word [rbx + rdx*2], bp
jne 0x18001e862
lea ecx, [rax + 1]
add rdx, rcx
mov ecx, 0x40
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x28], rax
mov rsi, rax
test rax, rax
jne 0x18001e89d
mov edi, dword [rsp + 0x20]
mov rsi, rbp
mov qword [rsp + 0x28], rbp
jmp 0x18001e920
mov edx, edi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov r9d, eax
lea ecx, [r9 - 1]
cmp word [rsi + rcx*2], 0x5c
je 0x18001e8c3
mov eax, 0x5c
mov word [rsi + r9*2], ax
inc r9d
mov r8d, ebp
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rbx + rax*2], bp
jne 0x18001e8d0
test rax, rax
je 0x18001e90e
mov rdx, rbp
movzx eax, word [rbx + rdx*2]
lea ecx, [r8 + r9]
inc r8d
mov word [rsi + rcx*2], ax
mov edx, r8d
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rbx + rax*2], bp
jne 0x18001e900
cmp rdx, rax
jb 0x18001e8e1
mov edi, dword [rsp + 0x20]
jmp 0x18001e920
lea rsi, [0x1800c7530]
mov qword [rsp + 0x28], rsi
mov r8d, dword [rsp + 0x24]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [0x1800eb380], rax
test rax, rax
jne 0x18001e94b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7e
jne 0x18001ee95
test edi, edi
je 0x18001ea24
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rbx, [0x1800c7550]
mov rdx, 0xffffffffffffffff
mov edi, eax
nop dword [rax]
inc rdx
cmp word [rbx + rdx*2], bp
jne 0x18001e970
lea ecx, [rax + 1]
add rdx, rcx
mov ecx, 0x40
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r14, rax
test rax, rax
jne 0x18001e9a1
mov edi, dword [rsp + 0x20]
mov r14, rbp
jmp 0x18001ea2b
mov edx, edi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov r9d, eax
lea ecx, [r9 - 1]
cmp word [r14 + rcx*2], 0x5c
je 0x18001e9c8
mov eax, 0x5c
mov word [r14 + r9*2], ax
inc r9d
mov r8d, ebp
mov rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], bp
jne 0x18001e9d2
test rax, rax
je 0x18001ea1e
mov rdx, rbp
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rbx + rdx*2]
lea ecx, [r8 + r9]
inc r8d
mov word [r14 + rcx*2], ax
mov edx, r8d
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rbx + rax*2], bp
jne 0x18001ea10
cmp rdx, rax
jb 0x18001e9f0
mov edi, dword [rsp + 0x20]
jmp 0x18001ea2b
lea r14, [0x1800c7550]
mov r8d, dword [rsp + 0x24]
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [0x1800eb378], rax
test rax, rax
jne 0x18001ea56
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7e
jne 0x18001ee95
test edi, edi
je 0x18001eb34
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rbx, [0x1800c7570]
mov rdx, 0xffffffffffffffff
mov edi, eax
nop dword [rax + rax]
inc rdx
cmp word [rbx + rdx*2], bp
jne 0x18001ea80
lea ecx, [rax + 1]
add rdx, rcx
mov ecx, 0x40
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r15, rax
test rax, rax
jne 0x18001eab1
mov edi, dword [rsp + 0x20]
mov r15, rbp
jmp 0x18001eb3b
mov edx, edi
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov r9d, eax
lea ecx, [r9 - 1]
cmp word [r15 + rcx*2], 0x5c
je 0x18001ead8
mov eax, 0x5c
mov word [r15 + r9*2], ax
inc r9d
mov r8d, ebp
mov rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], bp
jne 0x18001eae2
test rax, rax
je 0x18001eb2e
mov rdx, rbp
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rbx + rdx*2]
lea ecx, [r8 + r9]
inc r8d
mov word [r15 + rcx*2], ax
mov edx, r8d
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rbx + rax*2], bp
jne 0x18001eb20
cmp rdx, rax
jb 0x18001eb00
mov edi, dword [rsp + 0x20]
jmp 0x18001eb3b
lea r15, [0x1800c7570]
mov r8d, dword [rsp + 0x24]
xor edx, edx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [0x1800eb388], rax
test rax, rax
jne 0x18001eb66
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7e
jne 0x18001ee95
test edi, edi
je 0x18001ec44
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rbx, [0x1800c7590]
mov rdx, 0xffffffffffffffff
mov edi, eax
nop dword [rax + rax]
inc rdx
cmp word [rbx + rdx*2], bp
jne 0x18001eb90
lea ecx, [rax + 1]
add rdx, rcx
mov ecx, 0x40
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r12, rax
test rax, rax
jne 0x18001ebc1
mov edi, dword [rsp + 0x20]
mov r12, rbp
jmp 0x18001ec4b
mov edx, edi
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov r9d, eax
lea ecx, [r9 - 1]
cmp word [r12 + rcx*2], 0x5c
je 0x18001ebe8
mov eax, 0x5c
mov word [r12 + r9*2], ax
inc r9d
mov r8d, ebp
mov rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], bp
jne 0x18001ebf2
test rax, rax
je 0x18001ec3e
mov rdx, rbp
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rbx + rdx*2]
lea ecx, [r8 + r9]
inc r8d
mov word [r12 + rcx*2], ax
mov edx, r8d
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rbx + rax*2], bp
jne 0x18001ec30
cmp rdx, rax
jb 0x18001ec10
mov edi, dword [rsp + 0x20]
jmp 0x18001ec4b
lea r12, [0x1800c7590]
mov r8d, dword [rsp + 0x24]
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [0x1800eb390], rax
test rax, rax
jne 0x18001ec76
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7e
jne 0x18001ee95
test edi, edi
je 0x18001ed44
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rbx, [0x1800c75b0]
mov rdx, 0xffffffffffffffff
mov edi, eax
nop dword [rax + rax]
inc rdx
cmp word [rbx + rdx*2], bp
jne 0x18001eca0
lea ecx, [rax + 1]
add rdx, rcx
mov ecx, 0x40
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r13, rax
test rax, rax
jne 0x18001ecce
mov edi, dword [rsp + 0x20]
mov r13, rbp
jmp 0x18001ed4b
mov edx, edi
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov r9d, eax
lea ecx, [r9 - 1]
cmp word [r13 + rcx*2], 0x5c
je 0x18001ecf7
mov eax, 0x5c
mov word [r13 + r9*2], ax
inc r9d
mov r8d, ebp
mov rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], bp
jne 0x18001ed01
test rax, rax
je 0x18001ed3e
mov rdx, rbp
movzx eax, word [rbx + rdx*2]
lea ecx, [r8 + r9]
inc r8d
mov word [r13 + rcx*2], ax
mov edx, r8d
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rbx + rax*2], bp
jne 0x18001ed30
cmp rdx, rax
jb 0x18001ed12
mov edi, dword [rsp + 0x20]
jmp 0x18001ed4b
lea r13, [0x1800c75b0]
mov r8d, dword [rsp + 0x24]
xor edx, edx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [0x1800eb398], rax
test rax, rax
jne 0x18001ed76
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7e
jne 0x18001ee95
test edi, edi
je 0x18001ee5d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rbx, [0x1800c75d0]
mov rdx, 0xffffffffffffffff
mov esi, eax
nop dword [rax + rax]
inc rdx
cmp word [rbx + rdx*2], bp
jne 0x18001eda0
lea r8d, [rax + 1]
mov ecx, 0x40
add rdx, r8
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
jne 0x18001edd4
mov rsi, qword [rsp + 0x28]
mov edi, dword [rsp + 0x20]
jmp 0x18001ee64
mov edx, esi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov r8d, eax
lea ecx, [r8 - 1]
cmp word [rdi + rcx*2], 0x5c
je 0x18001edfa
mov eax, 0x5c
mov word [rdi + r8*2], ax
inc r8d
mov rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], bp
jne 0x18001ee01
test rax, rax
je 0x18001ee4f
mov rdx, rbp
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rbx + rdx*2]
lea ecx, [r8 + rbp]
inc ebp
mov word [rdi + rcx*2], ax
mov edx, ebp
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x18001ee40
cmp rdx, rax
jb 0x18001ee20
mov rsi, qword [rsp + 0x28]
mov rbp, rdi
mov edi, dword [rsp + 0x20]
jmp 0x18001ee64
lea rbp, [0x1800c75d0]
mov r8d, dword [rsp + 0x24]
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [0x1800eb370], rax
test rax, rax
jne 0x18001ee8b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7e
jne 0x18001ee95
mov dword [0x1800ea014], 1
mov rbx, qword [rsp + 0x188]
test edi, edi
je 0x18001eed7
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r14, qword [rsp + 0x158]
mov r13, qword [rsp + 0x160]
mov r12, qword [rsp + 0x168]
mov rsi, qword [rsp + 0x198]
mov rbp, qword [rsp + 0x190]
mov r15, qword [rsp + 0x150]
mov eax, dword [0x1800ea014]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.180066c30
add rsp, 0x170
pop rdi
ret