Function at 0x1801013d0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x940
mov qword [rsp + 0x8c0], 0xfffffffffffffffe
mov rax, qword [0x180157688]
mov qword [rsp + 0x930], rax
mov dword [rsp + 0x6a4], 0
mov dword [rsp + 0x6a0], 0
mov dword [rsp + 0x280], 0
mov word [rsp + 0x70], 0
lea rax, [rsp + 0x72]
mov rdi, rax
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
mov word [rsp + 0x290], 0
lea rax, [rsp + 0x292]
mov rdi, rax
xor eax, eax
mov ecx, 0x40e
rep stosb byte [rdi], al
lea rcx, [rsp + 0x6b0]
call fcn.180100180
nop
mov qword [rsp + 0x7e0], 0
mov qword [rsp + 0x7e8], 0
cmp qword [rsp + 0x958], 0
je 0x1801014b9
cmp dword [rsp + 0x960], 0
je 0x1801014b9
cmp dword [rsp + 0x988], 0
je 0x1801014b9
cmp qword [rsp + 0x968], 0
je 0x1801014b9
cmp qword [rsp + 0x978], 0
jne 0x1801014d7
mov dword [rsp + 0x6a4], 0x57
xor edx, edx
lea rcx, str.CCdmPlugin::CCdmPlugin___Invalid_Parameter_n
call fcn.1801045e0
jmp 0x180101f82
mov rax, qword [rsp + 0x950]
mov qword [rax + 0x4c8], 0
mov rax, qword [rsp + 0x950]
mov qword [rax], 0
mov rax, qword [rsp + 0x950]
mov qword [rax + 8], 0
mov rax, qword [rsp + 0x950]
mov qword [rax + 0x10], 0
mov rax, qword [rsp + 0x950]
mov qword [rax + 0x20], 0
mov rax, qword [rsp + 0x950]
mov qword [rax + 0x18], 0
mov rax, qword [rsp + 0x950]
mov qword [rax + 0x4d8], 0
mov rax, qword [rsp + 0x950]
mov qword [rax + 0x30], 0xffffffffffffffff
lea rcx, [rsp + 0x6b0]
call fcn.1801002a0
mov rcx, qword [rsp + 0x950]
mov dword [rcx + 0x4d0], eax
mov rax, qword [rsp + 0x950]
mov ecx, dword [rsp + 0x998]
mov dword [rax + 0x4e0], ecx
mov rax, qword [rsp + 0x950]
add rax, 0x448
mov r8d, 0x80
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
mov rax, qword [rsp + 0x950]
add rax, 0x448
mov r8, qword [rsp + 0x958]
mov edx, 0x40
mov rcx, rax
call fcn.180003250
mov dword [rsp + 0x6a0], eax
mov ecx, dword [rsp + 0x6a0]
call fcn.18010e5b0
mov dword [rsp + 0x6a4], eax
cmp dword [rsp + 0x6a4], 0
je 0x1801015f6
jmp 0x180101f82
mov rax, qword [rsp + 0x950]
add rax, 0x38
mov r8d, 0x410
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
mov rax, qword [rsp + 0x950]
add rax, 0x38
mov r8, qword [rsp + 0x978]
mov edx, 0x208
mov rcx, rax
call fcn.180003250
mov dword [rsp + 0x6a0], eax
mov ecx, dword [rsp + 0x6a0]
call fcn.18010e5b0
mov dword [rsp + 0x6a4], eax
cmp dword [rsp + 0x6a4], 0
je 0x18010166a
xor edx, edx
lea rcx, str.CCdmPlugin::CCdmPlugin___Cant_copy_the_m_tszModuleFullPath_n
call fcn.1801045e0
jmp 0x180101f82
mov r8, qword [rsp + 0x978]
mov edx, 0x208
lea rcx, [rsp + 0x290]
call fcn.180003250
mov dword [rsp + 0x6a0], eax
mov ecx, dword [rsp + 0x6a0]
call fcn.18010e5b0
mov dword [rsp + 0x6a4], eax
cmp dword [rsp + 0x6a4], 0
je 0x1801016bb
xor edx, edx
lea rcx, str.CCdmPlugin::CCdmPlugin___Cant_copy_the_tszTargetPath_n
call fcn.1801045e0
jmp 0x180101f82
mov dx, 0x5c
lea rcx, [rsp + 0x290]
call qword [sym.imp.msvcrt.dll_wcsrchr]
mov qword [rsp + 0x7e8], rax
cmp qword [rsp + 0x7e8], 0
je 0x1801016ef
mov rax, qword [rsp + 0x7e8]
mov word [rax], 0
jmp 0x180101702
xor edx, edx
lea rcx, str.CCdmPlugin::CCdmPlugin___Cant_find_the_delimiter_char_n
call fcn.1801045e0
jmp 0x180101f82
mov rcx, qword [rsp + 0x950]
call fcn.180103b60
mov dword [rsp + 0x6a4], eax
cmp dword [rsp + 0x6a4], 0
je 0x180101740
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6a4], eax
xor edx, edx
lea rcx, str.CCdmPlugin::CCdmPlugin___Cant_create_open_the_mutex_n
call fcn.1801045e0
jmp 0x180101f82
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov dword [rsp + 0x280], eax
cmp dword [rsp + 0x280], 0
jne 0x180101781
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6a4], eax
xor edx, edx
lea rcx, [0x1801305b0]
call fcn.1801045e0
jmp 0x180101f82
mov rax, qword [rsp + 0x950]
cmp dword [rax + 0x4e0], 0
jne 0x180101823
mov ecx, 0x58
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov qword [rsp + 0x7f8], rax
cmp qword [rsp + 0x7f8], 0
je 0x1801017d2
lea rdx, [rsp + 0x290]
mov rcx, qword [rsp + 0x7f8]
call fcn.18010d2c0
mov qword [rsp + 0x8c8], rax
jmp 0x1801017de
mov qword [rsp + 0x8c8], 0
mov rax, qword [rsp + 0x8c8]
mov qword [rsp + 0x7f0], rax
mov rax, qword [rsp + 0x950]
mov rcx, qword [rsp + 0x7f0]
mov qword [rax + 0x28], rcx
mov rax, qword [rsp + 0x950]
cmp qword [rax + 0x28], 0
jne 0x180101823
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6a4], eax
jmp 0x180101f82
mov rax, qword [rsp + 0x950]
cmp dword [rax + 0x4d0], 7
jl 0x18010184a
lea r8, str.Drivers
mov edx, 0x104
lea rcx, [rsp + 0x70]
call fcn.1800032a0
mov rax, qword [rsp + 0x950]
cmp dword [rax + 0x4d0], 0xd
jl 0x180101974
cmp dword [rsp + 0x990], 2
jl 0x180101974
mov eax, dword [rsp + 0x988]
and eax, 1
test eax, eax
jne 0x18010188d
mov eax, dword [rsp + 0x988]
and eax, 4
test eax, eax
je 0x18010196f
mov ecx, 0x98
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov qword [rsp + 0x808], rax
cmp qword [rsp + 0x808], 0
je 0x18010191e
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x50], 1
lea rax, [rsp + 0x290]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [0x180130628]
lea r8, str.AMonCDW8
mov edx, dword [rsp + 0x960]
mov rcx, qword [rsp + 0x808]
call fcn.180104be0
mov qword [rsp + 0x8d0], rax
jmp 0x18010192a
mov qword [rsp + 0x8d0], 0
mov rax, qword [rsp + 0x8d0]
mov qword [rsp + 0x800], rax
mov rax, qword [rsp + 0x950]
mov rcx, qword [rsp + 0x800]
mov qword [rax + 0x20], rcx
mov rax, qword [rsp + 0x950]
cmp qword [rax + 0x20], 0
jne 0x18010196f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6a4], eax
jmp 0x180101f82
jmp 0x180101d5e
mov eax, dword [rsp + 0x988]
and eax, 1
test eax, eax
je 0x180101af6
mov rax, qword [rsp + 0x950]
cmp dword [rax + 0x4d0], 0xb
jl 0x1801019a8
lea rax, [0x180130658]
mov qword [rsp + 0x7e0], rax
jmp 0x1801019d9
mov rax, qword [rsp + 0x950]
cmp dword [rax + 0x4d0], 7
jl 0x1801019ca
lea rax, str.AMonHKnt
mov qword [rsp + 0x7e0], rax
jmp 0x1801019d9
lea rax, str.AMonHK9x
mov qword [rsp + 0x7e0], rax
mov ecx, 0x98
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov qword [rsp + 0x818], rax
cmp qword [rsp + 0x818], 0
je 0x180101a6c
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x50], 1
lea rax, [rsp + 0x290]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x7e0]
mov r8, qword [rsp + 0x7e0]
mov edx, dword [rsp + 0x960]
mov rcx, qword [rsp + 0x818]
call fcn.180104be0
mov qword [rsp + 0x8d8], rax
jmp 0x180101a78
mov qword [rsp + 0x8d8], 0
mov rax, qword [rsp + 0x8d8]
mov qword [rsp + 0x810], rax
mov rax, qword [rsp + 0x950]
mov rcx, qword [rsp + 0x810]
mov qword [rax + 0x10], rcx
mov rax, qword [rsp + 0x950]
cmp qword [rax + 0x10], 0
je 0x180101ad5
mov rax, qword [rsp + 0x950]
cmp dword [rax + 0x4d0], 0xb
jl 0x180101ad5
mov rax, qword [rsp + 0x950]
mov rax, qword [rax + 0x10]
mov edx, 1
mov rcx, rax
call fcn.180105e30
mov rax, qword [rsp + 0x950]
cmp qword [rax + 0x10], 0
jne 0x180101af6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6a4], eax
jmp 0x180101f82
mov eax, dword [rsp + 0x988]
and eax, 4
test eax, eax
je 0x180101d5e
mov rax, qword [rsp + 0x950]
cmp dword [rax + 0x4d0], 0xc
jne 0x180101c27
lea rcx, [rsp + 0x6b0]
call fcn.180100720
test eax, eax
jne 0x180101c27
cmp dword [rsp + 0x990], 2
jl 0x180101c27
mov ecx, 0x98
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov qword [rsp + 0x828], rax
cmp qword [rsp + 0x828], 0
je 0x180101bd1
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x50], 1
lea rax, [rsp + 0x290]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [0x1801306a0]
lea r8, str.AMonCDW7
mov edx, dword [rsp + 0x960]
mov rcx, qword [rsp + 0x828]
call fcn.180104be0
mov qword [rsp + 0x8e0], rax
jmp 0x180101bdd
mov qword [rsp + 0x8e0], 0
mov rax, qword [rsp + 0x8e0]
mov qword [rsp + 0x820], rax
mov rax, qword [rsp + 0x950]
mov rcx, qword [rsp + 0x820]
mov qword [rax + 0x20], rcx
mov rax, qword [rsp + 0x950]
cmp qword [rax + 0x20], 0
jne 0x180101c22
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6a4], eax
jmp 0x180101f82
jmp 0x180101d5e
mov rax, qword [rsp + 0x950]
cmp dword [rax + 0x4d0], 0xb
jl 0x180101c49
lea rax, [0x1801306d0]
mov qword [rsp + 0x7e0], rax
jmp 0x180101c7a
mov rax, qword [rsp + 0x950]
cmp dword [rax + 0x4d0], 7
jl 0x180101c6b
lea rax, str.AMonTDnt
mov qword [rsp + 0x7e0], rax
jmp 0x180101c7a
lea rax, str.AMonTD9x
mov qword [rsp + 0x7e0], rax
mov ecx, 0x98
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov qword [rsp + 0x838], rax
cmp qword [rsp + 0x838], 0
je 0x180101d0d
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x50], 1
lea rax, [rsp + 0x290]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x7e0]
mov r8, qword [rsp + 0x7e0]
mov edx, dword [rsp + 0x960]
mov rcx, qword [rsp + 0x838]
call fcn.180104be0
mov qword [rsp + 0x8e8], rax
jmp 0x180101d19
mov qword [rsp + 0x8e8], 0
mov rax, qword [rsp + 0x8e8]
mov qword [rsp + 0x830], rax
mov rax, qword [rsp + 0x950]
mov rcx, qword [rsp + 0x830]
mov qword [rax + 8], rcx
mov rax, qword [rsp + 0x950]
cmp qword [rax + 8], 0
jne 0x180101d5e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6a4], eax
jmp 0x180101f82
mov eax, dword [rsp + 0x988]
and eax, 0x10
test eax, eax
je 0x180101e85
mov rax, qword [rsp + 0x950]
cmp dword [rax + 0x4d0], 7
jl 0x180101d92
lea rax, str.AnfdIOnt
mov qword [rsp + 0x7e0], rax
jmp 0x180101da1
lea rax, str.AnfdIO9x
mov qword [rsp + 0x7e0], rax
mov ecx, 0x98
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov qword [rsp + 0x848], rax
cmp qword [rsp + 0x848], 0
je 0x180101e34
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x50], 1
lea rax, [rsp + 0x290]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 2
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x7e0]
mov r8, qword [rsp + 0x7e0]
mov edx, dword [rsp + 0x960]
mov rcx, qword [rsp + 0x848]
call fcn.180104be0
mov qword [rsp + 0x8f0], rax
jmp 0x180101e40
mov qword [rsp + 0x8f0], 0
mov rax, qword [rsp + 0x8f0]
mov qword [rsp + 0x840], rax
mov rax, qword [rsp + 0x950]
mov rcx, qword [rsp + 0x840]
mov qword [rax + 0x18], rcx
mov rax, qword [rsp + 0x950]
cmp qword [rax + 0x18], 0
jne 0x180101e85
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6a4], eax
jmp 0x180101f82
mov eax, dword [rsp + 0x988]
and eax, 8
test eax, eax
je 0x180101f82
mov ecx, 0x98
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov qword [rsp + 0x858], rax
cmp qword [rsp + 0x858], 0
je 0x180101f38
mov rax, qword [rsp + 0x9a0]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x50], 0
lea rax, [rsp + 0x290]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 1
mov eax, dword [rsp + 0x980]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x290]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x970]
mov r8, qword [rsp + 0x968]
mov edx, dword [rsp + 0x960]
mov rcx, qword [rsp + 0x858]
call fcn.180104be0
mov qword [rsp + 0x8f8], rax
jmp 0x180101f44
mov qword [rsp + 0x8f8], 0
mov rax, qword [rsp + 0x8f8]
mov qword [rsp + 0x850], rax
mov rax, qword [rsp + 0x950]
mov rcx, qword [rsp + 0x850]
mov qword [rax], rcx
mov rax, qword [rsp + 0x950]
cmp qword [rax], 0
jne 0x180101f82
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6a4], eax
cmp dword [rsp + 0x6a4], 0
jne 0x180101fac
mov r8d, dword [rsp + 0x988]
mov edx, dword [rsp + 0x960]
lea rcx, str.CCdmPlugin::CCdmPlugin___CREATE_SUCCESS___MASK:0x_x__UseDrv:0x_x__n
call fcn.1801045e0
jmp 0x1801022a2
mov rax, qword [rsp + 0x950]
cmp qword [rax], 0
je 0x18010201f
mov rax, qword [rsp + 0x950]
mov rax, qword [rax]
mov qword [rsp + 0x868], rax
mov rax, qword [rsp + 0x868]
mov qword [rsp + 0x860], rax
cmp qword [rsp + 0x860], 0
je 0x180102004
mov edx, 1
mov rcx, qword [rsp + 0x860]
call fcn.180104600
mov qword [rsp + 0x900], rax
jmp 0x180102010
mov qword [rsp + 0x900], 0
mov rax, qword [rsp + 0x950]
mov qword [rax], 0
mov rax, qword [rsp + 0x950]
cmp qword [rax + 0x10], 0
je 0x180102095
mov rax, qword [rsp + 0x950]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x878], rax
mov rax, qword [rsp + 0x878]
mov qword [rsp + 0x870], rax
cmp qword [rsp + 0x870], 0
je 0x180102079
mov edx, 1
mov rcx, qword [rsp + 0x870]
call fcn.180104600
mov qword [rsp + 0x908], rax
jmp 0x180102085
mov qword [rsp + 0x908], 0
mov rax, qword [rsp + 0x950]
mov qword [rax + 0x10], 0
mov rax, qword [rsp + 0x950]
cmp qword [rax + 8], 0
je 0x18010210b
mov rax, qword [rsp + 0x950]
mov rax, qword [rax + 8]
mov qword [rsp + 0x888], rax
mov rax, qword [rsp + 0x888]
mov qword [rsp + 0x880], rax
cmp qword [rsp + 0x880], 0
je 0x1801020ef
mov edx, 1
mov rcx, qword [rsp + 0x880]
call fcn.180104600
mov qword [rsp + 0x910], rax
jmp 0x1801020fb
mov qword [rsp + 0x910], 0
mov rax, qword [rsp + 0x950]
mov qword [rax + 8], 0
mov rax, qword [rsp + 0x950]
cmp qword [rax + 0x20], 0
je 0x180102181
mov rax, qword [rsp + 0x950]
mov rax, qword [rax + 0x20]
mov qword [rsp + 0x898], rax
mov rax, qword [rsp + 0x898]
mov qword [rsp + 0x890], rax
cmp qword [rsp + 0x890], 0
je 0x180102165
mov edx, 1
mov rcx, qword [rsp + 0x890]
call fcn.180104600
mov qword [rsp + 0x918], rax
jmp 0x180102171
mov qword [rsp + 0x918], 0
mov rax, qword [rsp + 0x950]
mov qword [rax + 0x20], 0
mov rax, qword [rsp + 0x950]
cmp qword [rax + 0x18], 0
je 0x1801021f7
mov rax, qword [rsp + 0x950]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x8a8], rax
mov rax, qword [rsp + 0x8a8]
mov qword [rsp + 0x8a0], rax
cmp qword [rsp + 0x8a0], 0
je 0x1801021db
mov edx, 1
mov rcx, qword [rsp + 0x8a0]
call fcn.180104600
mov qword [rsp + 0x920], rax
jmp 0x1801021e7
mov qword [rsp + 0x920], 0
mov rax, qword [rsp + 0x950]
mov qword [rax + 0x18], 0
mov rax, qword [rsp + 0x950]
cmp dword [rax + 0x4e0], 0
jne 0x18010227e
mov rax, qword [rsp + 0x950]
cmp qword [rax + 0x28], 0
je 0x18010227e
mov rax, qword [rsp + 0x950]
mov rax, qword [rax + 0x28]
mov qword [rsp + 0x8b8], rax
mov rax, qword [rsp + 0x8b8]
mov qword [rsp + 0x8b0], rax
cmp qword [rsp + 0x8b0], 0
je 0x180102262
mov edx, 1
mov rcx, qword [rsp + 0x8b0]
call fcn.180104640
mov qword [rsp + 0x928], rax
jmp 0x18010226e
mov qword [rsp + 0x928], 0
mov rax, qword [rsp + 0x950]
mov qword [rax + 0x28], 0
mov r9d, dword [rsp + 0x6a4]
mov r8d, dword [rsp + 0x988]
mov edx, dword [rsp + 0x960]
lea rcx, str.CCdmPlugin::CCdmPlugin___CREATE_FAIL___MASK:0x_x__UseDrv:0x_x__ERROR:_d__n
call fcn.1801045e0
nop
lea rcx, [rsp + 0x6b0]
call fcn.1801001e0
mov rax, qword [rsp + 0x950]
mov rcx, qword [rsp + 0x930]
call fcn.180124250
add rsp, 0x940
pop rdi
ret