Function at 0x14002a3e0
Capabilities:
Get common file path
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
xor r14d, r14d
mov r12d, 5
test byte [0x1401923e0], 1
mov r13, 0xffffffffffffffff
jne 0x14002a801
mov rcx, qword [0x1401923e8]
test rcx, rcx
je 0x14002a444
mov rcx, qword [rcx + 8]
xor edx, edx
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhGetFullPath
mov rsi, rax
mov qword [0x14018cd78], rax
jmp 0x14002a44b
mov rsi, qword [0x14018cd78]
test rsi, rsi
jne 0x14002a694
mov rdi, qword [0x140192448]
mov rbx, qword [0x140188430]
mov rdx, qword [0x140191180]
add rbx, qword [rdi]
lea rcx, [rbx + 0x12]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhCreateObject
mov rsi, rax
mov qword [rax], rbx
add rax, 0x10
mov qword [rsi + 8], rax
mov word [rax + rbx], r14w
mov r8, qword [rdi]
mov rdx, qword [rdi + 8]
mov rcx, qword [rsi + 8]
call fcn.1401317c0
mov rcx, qword [rsi + 8]
add rcx, qword [rdi]
mov r8, qword [0x140188430]
mov rdx, qword [str..settings.xml]
call fcn.1401317c0
mov rcx, qword [rsi + 8]
call qword [sym.imp.ntdll.dll_RtlDoesFileExists_U]
test al, al
je 0x14002a4c9
mov qword [0x14018cd78], rsi
jmp 0x14002a4e6
lea rcx, [rsi - 0x10]
mov eax, r13d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14002a4df
call fcn.1400d9400
mov rsi, qword [0x14018cd78]
test rsi, rsi
jne 0x14002a694
cmp byte [0x14018dbaa], 1
lea r15, str.ProcessChecker_2_settings.xml
jb 0x14002a578
mov rdx, r15
mov rcx, r15
and rdx, 0xfffffffffffffff1
xorps xmm1, xmm1
and ecx, 0xf
je 0x14002a531
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
sar eax, cl
bsf ecx, eax
mov dword [rbp + 0x40], ecx
je 0x14002a52d
mov edx, ecx
shr rdx, 1
jmp 0x14002a57d
add rdx, 0x10
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rbp + 0x40], ecx
jne 0x14002a568
nop dword [rax]
nop dword [rax + rax]
add rdx, 0x10
movdqa xmm0, xmm1
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rbp + 0x40], ecx
je 0x14002a550
sub rdx, r15
mov eax, ecx
sar rdx, 1
shr rax, 1
add rdx, rax
jmp 0x14002a57d
mov edx, 0x1e
lea rdi, [rdx + rdx]
mov rdx, qword [0x140191180]
lea rbx, [rdi + 0x208]
lea rcx, [rbx + 0x12]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhCreateObject
mov rsi, rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1a
xor ecx, ecx
mov qword [rax], rbx
add rax, 0x10
mov qword [rsi + 8], rax
mov word [rax + rbx], r14w
mov rax, qword [rsi + 8]
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14002a7d7
cmp byte [0x14018dbaa], 1
mov r9, qword [rsi + 8]
jb 0x14002a658
mov rdx, r9
mov ecx, r9d
and rdx, 0xfffffffffffffff1
xorps xmm1, xmm1
and ecx, 0xf
je 0x14002a60e
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
sar eax, cl
bsf ecx, eax
mov dword [rbp + 0x40], ecx
je 0x14002a60a
mov edx, ecx
shr rdx, 1
jmp 0x14002a66a
add rdx, 0x10
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rbp + 0x40], ecx
jne 0x14002a648
nop dword [rax]
nop word [rax + rax]
add rdx, 0x10
movdqa xmm0, xmm1
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rbp + 0x40], ecx
je 0x14002a630
sub rdx, r9
mov eax, ecx
sar rdx, 1
shr rax, 1
add rdx, rax
jmp 0x14002a66a
mov rdx, r13
nop dword [rax + rax]
inc rdx
cmp word [r9 + rdx*2], r14w
jne 0x14002a660
lea rax, [rdx + rdx]
mov rdx, r15
lea rcx, [rax + r9]
mov qword [rsi], rax
lea r8, [rdi + 2]
call fcn.1401317c0
add qword [rsi], rdi
mov qword [0x14018cd78], rsi
test rsi, rsi
je 0x14002a801
mov rcx, qword [rsi + 8]
call fcn.1400ae6a0
cmp eax, 0xc0000102
jne 0x14002a801
lea r8, str.ProcessCheckers_settings_file_is_corrupt._Do_you_want_to_reset_it__nIf_you_select_No__the_settings_system_will_not_function_properly.
mov edx, 0x34
xor ecx, ecx
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhShowMessage
cmp eax, 6
jne 0x14002a7dd
mov eax, dword [0x14015ca70]
lea rdx, [rbp - 0x70]
movups xmm0, xmmword [str._settings___settings_]
mov dword [rbp - 0x50], eax
xor r9d, r9d
movzx eax, word [0x14015ca74]
xor r8d, r8d
mov word [rbp - 0x4c], ax
mov rax, qword [0x14018cd78]
movups xmmword [rbp - 0x60], xmm0
mov rcx, qword [rax + 8]
call qword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U]
test al, al
je 0x14002a801
mov dword [rsp + 0x50], r14d
lea rax, [rbp - 0x70]
mov qword [rsp + 0x48], r14
lea r9, [rbp - 0x18]
mov dword [rsp + 0x40], 0x60
lea r8, [rsp + 0x60]
mov dword [rsp + 0x38], 4
lea rcx, [rbp + 0x40]
mov dword [rsp + 0x30], r12d
xorps xmm0, xmm0
mov dword [rsp + 0x28], 0x80
mov edx, 0x120116
mov qword [rsp + 0x20], r14
mov dword [rsp + 0x60], 0x30
mov qword [rsp + 0x68], r14
mov dword [rsp + 0x78], 0x40
mov qword [rsp + 0x70], rax
movdqu xmmword [rbp - 0x80], xmm0
call qword [sym.imp.ntdll.dll_NtCreateFile]
mov rcx, qword gs:[0x30]
xor edx, edx
mov r8, qword [rbp - 0x68]
mov ebx, eax
mov rcx, qword [rcx + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
test ebx, ebx
js 0x14002a801
mov rbx, qword [rbp + 0x40]
lea rax, [rbp - 0x60]
mov qword [rsp + 0x40], r14
xor r9d, r9d
mov qword [rsp + 0x38], r14
xor r8d, r8d
mov dword [rsp + 0x30], 0x15
xor edx, edx
mov qword [rsp + 0x28], rax
mov rcx, rbx
lea rax, [rbp - 8]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtWriteFile]
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtClose]
jmp 0x14002a801
lea rcx, [rsi - 0x10]
jmp 0x14002a7e8
mov rcx, qword [0x14018cd78]
add rcx, 0xfffffffffffffff0
mov eax, r13d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14002a7fa
call fcn.1400d9400
mov qword [0x14018cd78], r14
xor eax, eax
lock cmpxchg qword [0x14018d8b0], r12
je 0x14002a81a
lea rcx, [0x14018d8b0]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhfAcquireQueuedLockShared
mov rsi, qword [0x140191a30]
lea rax, str.MaxSizeUnit
lea rcx, [rbp - 0x48]
mov qword [rbp - 0x40], 0x16
mov qword [rbp - 0x38], rax
call qword [rsi + 0x10]
mov ecx, dword [rsi + 0x18]
btr eax, 0x1f
mov r15d, eax
dec ecx
mov rax, qword [rsi + 0x20]
and rcx, r15
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x14002a88f
nop word [rax + rax]
mov ebx, dword [rsi]
add ebx, 8
imul ebx, edx
add rbx, qword [rsi + 0x30]
cmp dword [rbx], r15d
jne 0x14002a887
lea rdi, [rbx + 8]
mov rcx, rdi
lea rdx, [rbp - 0x48]
call qword [rsi + 8]
test al, al
jne 0x14002aa2d
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x14002a860
mov ebx, dword [rbp + 0x40]
mov rdi, r14
mov rax, r12
lock cmpxchg qword [0x14018d8b0], r14
je 0x14002a8af
lea rcx, [0x14018d8b0]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhfReleaseQueuedLockShared
test rdi, rdi
je 0x14002aaa9
mov dword [0x14018b710], ebx
xor eax, eax
lock cmpxchg qword [0x14018d8b0], r12
je 0x14002a8d7
lea rcx, [0x14018d8b0]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhfAcquireQueuedLockShared
mov rsi, qword [0x140191a30]
lea rax, str.SampleCountAutomatic
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x68], 0x28
mov qword [rsp + 0x70], rax
call qword [rsi + 0x10]
mov ecx, dword [rsi + 0x18]
btr eax, 0x1f
mov r15d, eax
dec ecx
mov rax, qword [rsi + 0x20]
and rcx, r15
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x14002a950
nop word [rax + rax]
mov ebx, dword [rsi]
add ebx, 8
imul ebx, edx
add rbx, qword [rsi + 0x30]
cmp dword [rbx], r15d
jne 0x14002a948
lea rdi, [rbx + 8]
mov rcx, rdi
lea rdx, [rsp + 0x60]
call qword [rsi + 8]
test al, al
jne 0x14002aa47
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x14002a920
mov ebx, dword [rbp + 0x40]
mov rdi, r14
mov rax, r12
lock cmpxchg qword [0x14018d8b0], r14
je 0x14002a970
lea rcx, [0x14018d8b0]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhfReleaseQueuedLockShared
test rdi, rdi
je 0x14002aaa9
test ebx, ebx
je 0x14002aab5
mov ecx, 0x4e
call qword [sym.imp.USER32.dll_GetSystemMetrics]
inc eax
cdq
sub eax, edx
sar eax, 1
mov r12d, eax
mov eax, 0x800
cmp r12d, eax
cmova r12d, eax
lock bts qword [0x14018d8b0], 0
setb cl
test cl, cl
je 0x14002a9bf
lea rcx, [0x14018d8b0]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhfAcquireQueuedLockExclusive
mov rsi, qword [0x140191a30]
lea rax, str.SampleCount
lea rcx, [rbp - 0x48]
mov qword [rbp - 0x40], 0x16
mov qword [rbp - 0x38], rax
call qword [rsi + 0x10]
mov ecx, dword [rsi + 0x18]
btr eax, 0x1f
mov r15d, eax
dec ecx
mov rax, qword [rsi + 0x20]
and rcx, r15
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x14002aa72
nop dword [rax + rax]
mov ebx, dword [rsi]
add ebx, 8
imul ebx, edx
add rbx, qword [rsi + 0x30]
cmp dword [rbx], r15d
jne 0x14002aa23
lea rdi, [rbx + 8]
mov rcx, rdi
lea rdx, [rbp - 0x48]
call qword [rsi + 8]
test al, al
jne 0x14002aa61
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x14002aa00
jmp 0x14002aa72
test rdi, rdi
je 0x14002a88f
cmp dword [rdi], 1
jne 0x14002a88f
mov ebx, dword [rdi + 0x28]
jmp 0x14002a895
test rdi, rdi
je 0x14002a950
cmp dword [rdi], 1
jne 0x14002a950
mov ebx, dword [rdi + 0x28]
jmp 0x14002a956
mov r14, rdi
test rdi, rdi
je 0x14002aa72
cmp dword [rdi], 1
jne 0x14002aa72
mov dword [rdi + 0x28], r12d
lock xadd qword [0x14018d8b0], r13
movzx eax, r13b
and al, 6
cmp al, 2
jne 0x14002aaa4
lea rax, [r13 - 1]
lea rdx, [rax + 4]
lock cmpxchg qword [0x14018d8b0], rdx
jne 0x14002aaa4
lea rcx, [0x14018d8b0]
call fcn.1400ee3a0
test r14, r14
jne 0x14002aab5
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret