Function at 0x1800022e0
Capabilities:
Get common file path
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbp
push rbx
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x1e8]
sub rsp, 0x2e8
mov rax, qword [0x18004e020]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
mov r14, rcx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor r13d, r13d
lea r15, [r13 - 1]
cmp byte [r14 + 0xb0], r13b
jne 0x180002396
mov dword [rbp - 0x70], 0x18
mov dword [rbp - 0x60], 1
mov qword [rbp - 0x68], r13
cmp byte [r14 + 0xb1], r13b
jne 0x18000251b
mov rcx, qword [r14 + 0x98]
lea r9, [rbp - 0x70]
mov qword [rsp + 0x30], r13
xor r8d, r8d
mov dword [rsp + 0x28], 0xa0000000
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [r14 + 0xb8], rax
cmp rax, r15
je 0x180002522
mov byte [r14 + 0xb0], 1
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [rsp + 0x40], r13d
cmp qword [r14 + 0xb8], r15
je 0x180002875
mov rbx, qword [rbp + 0x228]
test rbx, rbx
je 0x180002858
mov qword [rsp + 0x2e0], rsi
mov qword [rsp + 0x2d8], r12
lea r12, [rbp + 0x230]
call fcn.180001490
mov qword [rsp + 0x28], r12
mov r9, rbx
xor r8d, r8d
mov qword [rsp + 0x20], r13
xor edx, edx
mov rdi, rax
mov rcx, qword [rax]
or rcx, 1
call fcn.180019888
mov esi, eax
mov eax, 0xffffffff
test esi, esi
cmovs esi, eax
mov eax, 2
lea edx, [rsi + 1]
mul rdx
mov rbx, rax
cmovo rbx, r15
mov rcx, rbx
call fcn.18000ef40
mov r8, rbx
xor edx, edx
mov rcx, rax
mov r15, rax
call fcn.1800111d0
mov word [r15], r13w
mov r8, 0xffffffffffffffff
mov r9, qword [rbp + 0x228]
mov rdx, r15
mov rcx, qword [rdi]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r13
call fcn.180019888
lea rcx, [r14 + 0x28]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r9, qword [r14 + 0x80]
test r9, r9
je 0x1800027ff
lea r8, str._hs:_ls
mov qword [rsp + 0x20], r15
xor edx, edx
xor ecx, ecx
call fcn.180002050
mov esi, eax
mov eax, 2
lea edx, [rsi + 1]
mul rdx
mov rbx, rax
mov rax, 0xffffffffffffffff
cmovo rbx, rax
mov rcx, rbx
call fcn.18000ef40
mov r8, rbx
xor edx, edx
mov rcx, rax
mov rdi, rax
call fcn.1800111d0
mov word [rdi], r13w
lea r8, str._hs:_ls
mov r9, qword [r14 + 0x80]
mov edx, esi
mov rcx, rdi
mov qword [rsp + 0x20], r15
call fcn.180002050
mov rcx, qword [r14 + 0xb8]
lea r8d, [rsi + rsi]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], r13
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [r14 + 0xb8]
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov edx, 2
mov rcx, rdi
call fcn.18000e8e0
jmp 0x18000282a
mov qword [r14 + 0xb8], r15
mov ecx, 0x208
call fcn.18000ef40
xor edx, edx
mov r8d, 0x208
mov rcx, rax
mov rbx, rax
call fcn.1800111d0
mov r8, qword [r14 + 0x90]
test r8, r8
je 0x18000256f
mov ecx, dword [r14 + 0xb4]
lea rdx, str._hsoutput__hs__lu.txt
mov r9, qword [r14 + 0x88]
mov dword [rsp + 0x20], ecx
mov rcx, rbx
call qword [sym.imp.USER32.dll_wsprintfW]
jmp 0x1800025ab
xor edx, edx
lea rcx, [rbp - 0x50]
mov r8d, 0x208
call fcn.1800111d0
lea rdx, [rbp - 0x50]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov rcx, rbx
test eax, eax
je 0x1800027f1
lea r8, [rbp - 0x50]
lea rdx, str._lsglobal_apt_scenarios_output.txt
call qword [sym.imp.USER32.dll_wsprintfW]
mov edx, 4
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
lea r9, [rbp - 0x70]
mov rcx, rbx
mov dword [rsp + 0x20], 3
lea r8d, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [r14 + 0xb8], rax
cmp rax, r15
jne 0x1800027d7
mov qword [rsp + 0x30], r13
lea r9, [rbp - 0x70]
mov dword [rsp + 0x28], 0x80
mov edx, 0x40000000
mov r8d, 3
mov dword [rsp + 0x20], 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [r14 + 0xb8], rax
mov rcx, rbx
cmp rax, r15
je 0x1800027f1
xor r9d, r9d
mov qword [rsp + 0x50], r13
lea rax, [rsp + 0x58]
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], rax
lea edx, [r9 + 1]
lea r8d, [r9 + 4]
mov qword [rsp + 0x20], r13
mov qword [rsp + 0x58], r13
call qword [sym.imp.ADVAPI32.dll_GetNamedSecurityInfoW]
lea rdi, str.Everyone
test eax, eax
jne 0x1800026dd
mov r8, qword [rsp + 0x50]
lea r9, [rsp + 0x48]
xorps xmm0, xmm0
mov qword [rbp - 0x80], r13
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x60], 0x1f01ff
lea ecx, [rax + 1]
mov qword [rsp + 0x64], 1
movdqu xmmword [rsp + 0x6c], xmm0
mov dword [rsp + 0x7c], 1
mov qword [rbp - 0x78], rdi
call qword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
test eax, eax
jne 0x1800026dd
mov rax, qword [rsp + 0x48]
xor r9d, r9d
mov qword [rsp + 0x30], r13
mov rcx, rbx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
lea edx, [r9 + 1]
lea r8d, [r9 + 4]
call qword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1800026ed
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1800026fd
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor r9d, r9d
mov qword [rsp + 0x58], r13
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x38], rax
mov rcx, rbx
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], rax
lea edx, [r9 + 1]
lea r8d, [r9 + 4]
mov qword [rsp + 0x20], r13
mov qword [rsp + 0x50], r13
call qword [sym.imp.ADVAPI32.dll_GetNamedSecurityInfoW]
test eax, eax
jne 0x1800027b7
mov r8, qword [rsp + 0x58]
lea r9, [rsp + 0x48]
xorps xmm0, xmm0
mov qword [rbp - 0x80], r13
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x60], 0x1f01ff
lea ecx, [rax + 1]
mov dword [rsp + 0x64], 1
movdqu xmmword [rsp + 0x6c], xmm0
mov dword [rsp + 0x68], 3
mov dword [rsp + 0x7c], 1
mov qword [rbp - 0x78], rdi
call qword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
test eax, eax
jne 0x1800027b7
mov rax, qword [rsp + 0x48]
xor r9d, r9d
mov qword [rsp + 0x30], r13
mov rcx, rbx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
lea edx, [r9 + 1]
lea r8d, [r9 + 4]
call qword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1800027c7
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1800027d7
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov edx, 2
mov byte [r14 + 0xb1], 1
mov rcx, rbx
call fcn.18000e8e0
jmp 0x180002396
mov edx, 2
call fcn.18000e8e0
xor eax, eax
jmp 0x180002879
mov rcx, qword [r14 + 0xb8]
lea r8d, [rsi + rsi]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], r13
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [r14 + 0xb8]
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov edx, 2
mov rcx, r15
call fcn.18000e8e0
lea rcx, [r14 + 0x28]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r12, qword [rsp + 0x2d8]
mov r15, 0xffffffffffffffff
mov rsi, qword [rsp + 0x2e0]
cmp byte [r14 + 0xb1], r13b
je 0x180002875
mov rcx, qword [r14 + 0xb8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [r14 + 0xb8], r15
mov eax, dword [rsp + 0x40]
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.18000e8c0
add rsp, 0x2e8
pop r15
pop r14
pop r13
pop rdi
pop rbx
pop rbp
ret