Function at 0x140061b30
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x4c0]
sub rsp, 0x5c0
mov rax, qword [0x1400ee020]
xor rax, rsp
mov qword [rbp + 0x4b0], rax
mov r15, rdx
mov rbx, rcx
mov qword [rsp + 0x50], rdx
xor r12d, r12d
mov dword [rsp + 0x20], r12d
xor edx, edx
mov r8d, 0x180
lea rcx, [rbp - 0x60]
call fcn.140089760
lea rcx, [rbp - 0x60]
call fcn.14003c9a0
nop
xor edx, edx
mov r8d, 0x180
lea rcx, [rbp + 0x120]
call fcn.140089760
lea rcx, [rbp + 0x120]
call fcn.14003c9a0
nop
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x2a0]
call fcn.140089760
mov edx, 0x104
lea rcx, [rbp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], r12w
lea rdx, [rbp + 0x2a0]
lea rcx, [rsp + 0x60]
call fcn.1400068b8
nop
cmp byte [rbx], r12b
je 0x140061d61
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x68], 7
mov word [rbp - 0x80], r12w
mov dword [rsp + 0x20], 2
mov r8, qword [rsp + 0x70]
lea rax, [r8 + 0x13]
cmp rax, 8
jb 0x140061cd7
movabs rbx, 0x7ffffffffffffffe
cmp rax, rbx
ja 0x1400620f9
or rax, 7
cmp rax, rbx
ja 0x140061c5e
mov rbx, rax
mov r14d, 0xa
cmp rax, r14
cmovb rbx, r14
lea rcx, [rbx + 1]
movabs rsi, 0x7fffffffffffffff
cmp rcx, rsi
ja 0x14006210b
add rcx, rcx
cmp rcx, 0x1000
jb 0x140061cad
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14006210b
mov rcx, rax
call fcn.14006a79c
test rax, rax
je 0x1400620ff
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x140061cbf
test rcx, rcx
je 0x140061cbc
call fcn.14006a79c
mov rcx, rax
jmp 0x140061cbf
mov rcx, r12
mov qword [rbp - 0x68], rbx
movzx eax, word [rbp - 0x80]
mov word [rcx], ax
mov qword [rbp - 0x80], rcx
mov qword [rbp - 0x70], r12
mov r8, qword [rsp + 0x70]
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
lea rcx, [rbp - 0x80]
call fcn.1400094c0
mov r8d, 0x13
lea rdx, str.System32_ntdll.dll
lea rcx, [rbp - 0x80]
call fcn.1400094c0
mov r8b, 1
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x60]
call fcn.14003cca0
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x14006203c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061d57
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062105
call fcn.14006a794
jmp 0x14006203c
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
movzx eax, byte [rbx + 1]
mov qword [rbp - 0x80], r12
mov byte [rbp - 0x78], al
test al, al
je 0x140061d82
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
nop
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], r12w
mov dword [rsp + 0x20], 4
mov r8, qword [rsp + 0x70]
lea rdi, [r8 + 0x13]
movabs rbx, 0x7ffffffffffffffe
movabs rsi, 0x7fffffffffffffff
mov r14d, 0xa
cmp rdi, 8
jb 0x140061e5c
cmp rdi, rbx
ja 0x140062111
or rdi, 7
cmp rdi, rbx
jbe 0x140061de2
mov rdi, rbx
jmp 0x140061de9
cmp rdi, r14
cmovb rdi, r14
lea rcx, [rdi + 1]
cmp rcx, rsi
ja 0x140062123
add rcx, rcx
cmp rcx, 0x1000
jb 0x140061e2e
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140062123
mov rcx, rax
call fcn.14006a79c
test rax, rax
je 0x140062117
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x140061e40
test rcx, rcx
je 0x140061e3d
call fcn.14006a79c
mov rcx, rax
jmp 0x140061e40
mov rcx, r12
mov qword [rsp + 0x40], rdi
movzx eax, word [rsp + 0x28]
mov word [rcx], ax
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x38], r12
mov r8, qword [rsp + 0x70]
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x28]
call fcn.1400094c0
mov r8d, 0x13
lea rdx, str.System32_ntdll.dll
lea rcx, [rsp + 0x28]
call fcn.1400094c0
mov r8b, 1
lea rdx, [rsp + 0x28]
lea rcx, [rbp + 0x120]
call fcn.14003cca0
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x140061ee6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061ee0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006211d
call fcn.14006a794
nop
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], r12w
mov dword [rsp + 0x20], 8
mov r8, qword [rsp + 0x70]
lea rax, [r8 + 0x13]
cmp rax, 8
jb 0x140061fa5
cmp rax, rbx
ja 0x140062129
or rax, 7
cmp rax, rbx
ja 0x140061f32
mov rbx, rax
cmp rax, 0xa
cmovb rbx, r14
lea rcx, [rbx + 1]
cmp rcx, rsi
ja 0x14006213b
add rcx, rcx
cmp rcx, 0x1000
jb 0x140061f77
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14006213b
mov rcx, rax
call fcn.14006a79c
test rax, rax
je 0x14006212f
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x140061f89
test rcx, rcx
je 0x140061f86
call fcn.14006a79c
mov rcx, rax
jmp 0x140061f89
mov rcx, r12
mov qword [rsp + 0x40], rbx
movzx eax, word [rsp + 0x28]
mov word [rcx], ax
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x38], r12
mov r8, qword [rsp + 0x70]
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x28]
call fcn.1400094c0
mov r8d, 0x13
lea rdx, str.SysWOW64_ntdll.dll
lea rcx, [rsp + 0x28]
call fcn.1400094c0
mov r8b, 1
lea rdx, [rsp + 0x28]
lea rcx, [rbp - 0x60]
call fcn.14003cca0
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x14006202c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062026
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062135
call fcn.14006a794
nop
cmp byte [rbp - 0x78], 0
je 0x14006203c
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
lea rdx, [rbp - 0x60]
mov rcx, r15
call fcn.140062150
nop
lea rcx, [r15 + 0x180]
lea rdx, [rbp + 0x120]
call fcn.140062150
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x14006209b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062096
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400620f3
call fcn.14006a794
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], r12w
lea rcx, [rbp + 0x120]
call fcn.14003caa0
nop
lea rcx, [rbp - 0x60]
call fcn.14003caa0
mov rax, r15
mov rcx, qword [rbp + 0x4b0]
xor rcx, rsp
call fcn.14006a770
lea r11, [rsp + 0x5c0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.140095e24
nop
call fcn.1400094ac
int3
call fcn.140095e24
nop
call fcn.140095e24
nop
call fcn.1400011a0
nop
call fcn.1400094ac
int3
call fcn.140095e24
nop
call fcn.140095e24
nop
call fcn.1400011a0
nop
call fcn.1400094ac
int3
call fcn.140095e24
nop
call fcn.140095e24
nop
call fcn.1400011a0
int3