Function at 0x281b755e0
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x448
movaps xmmword [rsp + 0x430], xmm6
xor edx, edx
mov r8d, ecx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r12, rax
test rax, rax
je 0x281b75ad8
lea r13, [rsp + 0x80]
mov r8d, 0x104
mov rcx, rax
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x281b75aac
lea r14, [rsp + 0x320]
lea rsi, [rsp + 0x2a0]
mov rcx, r14
mov qword [rsp + 0x58], rsi
call fcn.281c317f0
mov rax, qword [0x281ca67e0]
mov rdi, qword [0x281ca62c0]
pxor xmm0, xmm0
movups xmmword [rsp + 0x408], xmm0
add rax, 0x10
mov rbx, qword [rdi + 0x10]
movups xmmword [rsp + 0x418], xmm0
mov qword [rsp + 0x320], rax
xor eax, eax
mov word [rsp + 0x400], ax
mov rax, qword [rdi + 0x18]
mov qword [rsp + 0x3f8], 0
mov rdx, rax
mov qword [rsp + 0x30], rax
mov rax, qword [rbx - 0x18]
mov qword [rsp + 0x2a0], rbx
mov qword [rsp + rax + 0x2a0], rdx
xor edx, edx
mov qword [rsp + 0x2a8], 0
add rsi, qword [rbx - 0x18]
mov rcx, rsi
call fcn.281c328e0
mov rsi, qword [rdi + 0x20]
mov rax, qword [rdi + 0x28]
lea r15, [rsp + 0x2b0]
xor edx, edx
mov rcx, qword [rsi - 0x18]
mov qword [rsp + 0x2b0], rsi
mov qword [rsp + 0x38], rax
add rcx, r15
mov qword [rcx], rax
call fcn.281c328e0
mov rax, qword [0x281ca6360]
lea rbp, [rsp + 0x2b8]
add rax, 0x40
movq xmm6, rax
mov rax, qword [rdi + 8]
mov rdi, qword [rdi + 0x30]
movdqa xmm0, xmm6
mov qword [rsp + 0x40], rax
mov rax, qword [rax - 0x18]
mov qword [rsp + 0x48], rdi
mov qword [rsp + rax + 0x2a0], rdi
mov rax, qword [0x281ca6360]
lea rdi, [rsp + 0x2f0]
mov rcx, rdi
add rax, 0x18
mov qword [rsp + 0x2a0], rax
mov rax, qword [0x281ca6360]
add rax, 0x68
mov qword [rsp + 0x320], rax
mov rax, qword [0x281ca6590]
add rax, 0x10
movq xmm1, rax
punpcklqdq xmm0, xmm1
movaps xmmword [rsp + 0x2b0], xmm0
pxor xmm0, xmm0
movaps xmmword [rsp + 0x2c0], xmm0
movaps xmmword [rsp + 0x2d0], xmm0
movaps xmmword [rsp + 0x2e0], xmm0
call fcn.281c19640
mov rax, qword [0x281ca6350]
mov rdx, rbp
mov rcx, r14
mov dword [rsp + 0x2f8], 0x18
add rax, 0x10
mov byte [rsp + 0x310], 0
mov qword [rsp + 0x2b8], rax
lea rax, [rsp + 0x310]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x300], rax
mov qword [rsp + 0x308], 0
call fcn.281c328e0
lea rcx, [rsp + 0x190]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, eax
mov rcx, r15
call fcn.281bef290
mov rcx, rax
mov r8d, 9
lea rdx, str.Windows_
call fcn.281c34b50
lea rbp, [rsp + 0x70]
mov byte [rsp + 0x70], 0
lea rcx, [rsp + 0x60]
mov rax, qword [rsp + 0x2e0]
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], 0
test rax, rax
je 0x281b75b00
mov rdx, qword [rsp + 0x2d0]
mov r9, qword [rsp + 0x2d8]
cmp rax, rdx
ja 0x281b75ae0
sub rdx, r9
xor r8d, r8d
mov qword [rsp + 0x20], rdx
xor edx, edx
call fcn.281c1afd0
mov r15, qword [rsp + 0x60]
mov rcx, r13
mov rdx, r15
call sub.msvcrt.dll_strstr
mov r13, rax
cmp r15, rbp
je 0x281b758b4
mov rax, qword [rsp + 0x70]
mov rcx, r15
lea rdx, [rax + 1]
call fcn.281c3b050
test r13, r13
je 0x281b759c0
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x281ca6360]
mov rcx, qword [rsp + 0x300]
add rax, 0x18
mov qword [rsp + 0x2a0], rax
mov rax, qword [0x281ca6360]
add rax, 0x68
mov qword [rsp + 0x320], rax
mov rax, qword [0x281ca6350]
add rax, 0x10
movq xmm2, rax
punpcklqdq xmm6, xmm2
movaps xmmword [rsp + 0x2b0], xmm6
cmp rcx, qword [rsp + 0x50]
je 0x281b75928
mov rax, qword [rsp + 0x310]
lea rdx, [rax + 1]
call fcn.281c3b050
mov rax, qword [0x281ca6590]
mov rcx, rdi
add rax, 0x10
mov qword [rsp + 0x2b8], rax
call fcn.281c19740
mov rax, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov rcx, r14
mov rax, qword [rax - 0x18]
mov qword [rsp + rax + 0x2a0], rdi
mov rax, qword [rsi - 0x18]
mov qword [rsp + 0x2b0], rsi
mov rsi, qword [rsp + 0x38]
mov qword [rsp + rax + 0x2b0], rsi
mov rax, qword [rbx - 0x18]
mov qword [rsp + 0x2a0], rbx
mov rbx, qword [rsp + 0x30]
mov qword [rsp + rax + 0x2a0], rbx
mov rax, qword [0x281ca67e0]
mov qword [rsp + 0x2a8], 0
add rax, 0x10
mov qword [rsp + 0x320], rax
call fcn.281c318a0
mov eax, 1
jmp 0x281b75ab7
mov rax, qword [0x281ca6360]
mov rcx, qword [rsp + 0x300]
add rax, 0x18
mov qword [rsp + 0x2a0], rax
mov rax, qword [0x281ca6360]
add rax, 0x68
mov qword [rsp + 0x320], rax
mov rax, qword [0x281ca6350]
add rax, 0x10
movq xmm3, rax
punpcklqdq xmm6, xmm3
movaps xmmword [rsp + 0x2b0], xmm6
cmp rcx, qword [rsp + 0x50]
je 0x281b75a22
mov rax, qword [rsp + 0x310]
lea rdx, [rax + 1]
call fcn.281c3b050
mov rax, qword [0x281ca6590]
mov rcx, rdi
add rax, 0x10
mov qword [rsp + 0x2b8], rax
call fcn.281c19740
mov rax, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov rcx, r14
mov rax, qword [rax - 0x18]
mov qword [rsp + rax + 0x2a0], rdi
mov rax, qword [rsi - 0x18]
mov qword [rsp + 0x2b0], rsi
mov rsi, qword [rsp + 0x38]
mov qword [rsp + rax + 0x2b0], rsi
mov rax, qword [rbx - 0x18]
mov qword [rsp + 0x2a0], rbx
mov rbx, qword [rsp + 0x30]
mov qword [rsp + rax + 0x2a0], rbx
mov rax, qword [0x281ca67e0]
mov qword [rsp + 0x2a8], 0
add rax, 0x10
mov qword [rsp + 0x320], rax
call fcn.281c318a0
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
movaps xmm6, xmmword [rsp + 0x430]
add rsp, 0x448
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
xor eax, eax
jmp 0x281b75ab7
sub rax, r9
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call fcn.281c1afd0
jmp 0x281b7588b
lea rdx, [rsp + 0x300]
call fcn.281c1d390
jmp 0x281b7588b