Function at 0x14001561c
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x170]
sub rsp, 0x270
mov rax, qword [0x14002a0a8]
xor rax, rsp
mov qword [rbp + 0x160], rax
and qword [rsp + 0x40], 0
mov eax, 0x8004250b
mov ebx, ecx
mov esi, 0x1fff0000
cmp ecx, eax
jg 0x140015714
je 0x1400156da
mov eax, 0x80042453
cmp ecx, eax
jg 0x1400156b6
je 0x1400156da
cmp ecx, 0x80042400
je 0x1400156af
cmp ecx, 0x80042413
je 0x1400156a8
cmp ecx, 0x80042419
je 0x14001581b
cmp ecx, 0x8004241f
je 0x1400156da
cmp ecx, 0x80042448
jne 0x140015774
mov edi, 0x1c4
jmp 0x1400156df
mov edi, 0x23b
jmp 0x140015701
mov edi, 0x1c6
jmp 0x140015701
cmp ebx, 0x8004245f
je 0x14001570d
cmp ebx, 0x80042503
je 0x1400156da
cmp ebx, 0x80042505
je 0x1400156a1
cmp ebx, 0x80042509
jne 0x140015774
mov edi, 0x1c2
mov eax, ebx
and eax, esi
cmp eax, 0x40000
jne 0x140015916
movzx eax, bx
sub eax, 0x2400
cmp eax, 0xc00
ja 0x140015839
lea rcx, str.vdsutil.dll
jmp 0x140015879
mov edi, 0x1c2
jmp 0x140015701
cmp ebx, 0x8004252a
je 0x1400156da
cmp ebx, 0x80042538
je 0x14001582f
cmp ebx, 0x80042539
je 0x1400156da
cmp ebx, 0x80042556
je 0x1400156da
cmp ebx, 0x8004255a
je 0x140015825
cmp ebx, 0x80042572
je 0x1400156a1
cmp ebx, 0x80042575
je 0x14001581b
cmp ebx, 0x8004280a
je 0x140015825
cmp ebx, 0x8007000e
je 0x140015811
mov eax, ebx
and eax, esi
cmp eax, 0x70000
je 0x14001578e
mov eax, ebx
and eax, esi
cmp eax, 0x3a0000
jne 0x140015825
and qword [rsp + 0x30], 0
lea rax, [rsp + 0x40]
and dword [rsp + 0x28], 0
xor r9d, r9d
mov r8d, ebx
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0x1100
mov edi, 0xf423f
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
nop dword [rax + rax]
cmp qword [rsp + 0x40], 0
je 0x1400156df
mov ecx, 0x230
call fcn.140015e44
mov ecx, 0x231
call fcn.140015e44
mov rcx, qword [rsp + 0x40]
call fcn.1400154d0
mov ecx, 0x232
call fcn.140015e44
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop dword [rax + rax]
and qword [rsp + 0x40], 0
jmp 0x1400156df
mov edi, 0x6e
jmp 0x140015916
mov edi, 0x1c3
jmp 0x1400156df
mov edi, 0xf423f
jmp 0x1400156df
mov edi, 0x1c5
jmp 0x140015701
mov esi, 0x104
lea rcx, [rsp + 0x50]
mov edx, esi
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
nop dword [rax + rax]
test eax, eax
je 0x140015916
lea r8, str._system32wbemwmiutils.dll
mov edx, esi
lea rcx, [rsp + 0x50]
call fcn.14000f670
test eax, eax
js 0x140015916
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
je 0x140015916
and qword [rsp + 0x30], 0
lea rax, [rsp + 0x40]
and dword [rsp + 0x28], 0
xor r9d, r9d
mov r8d, ebx
mov qword [rsp + 0x20], rax
mov rdx, rsi
mov ecx, 0x900
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
nop dword [rax + rax]
cmp qword [rsp + 0x40], 0
je 0x140015907
mov ecx, 0x230
call fcn.140015e44
mov ecx, 0x233
call fcn.140015e44
mov rcx, qword [rsp + 0x40]
call fcn.1400154d0
mov ecx, 0x230
call fcn.140015e44
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop dword [rax + rax]
and qword [rsp + 0x40], 0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop dword [rax + rax]
mov eax, edi
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.140001e90
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret