Function at 0x1400e82b0
Capabilities:
Get common file path

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2a8]
sub rsp, 0x3a8
mov qword [rbp - 0x70], 0xfffffffffffffffe
mov rax, qword [0x14028c238]
xor rax, rsp
mov qword [rbp + 0x290], rax
mov r13d, r9d
mov r15, r8
mov rdi, rdx
mov rbx, rcx
mov r12, qword [rbp + 0x318]
xor r14d, r14d
mov esi, r14d
mov dword [rsp + 0x48], r14d
mov dword [rsp + 0x40], 0xfffffffb
xor r8d, r8d
lea rdx, [0x1402325f4]
mov rcx, r15
call fcn.1400c3720
mov dword [r12], r14d
mov qword [rbp + 0x78], 7
mov qword [rbp + 0x70], r14
mov word [rbp + 0x60], r14w
xor r8d, r8d
lea rdx, [0x1402325f4]
lea rcx, [rbp + 0x60]
call fcn.1400c3720
nop
mov qword [rsp + 0x48], 3
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1400e8d62
cmp byte [rbx + 0x18], r14b
je 0x1400e836f
cmp byte [rcx + 0xb8], r14b
jne 0x1400e8d62
lea rdx, [rsp + 0x48]
call fcn.1400eb190
test eax, eax
jne 0x1400e83de
mov qword [rbp - 0x50], 7
mov qword [rbp - 0x58], r14
mov word [rbp - 0x68], r14w
cmp word [rdi], ax
jne 0x1400e8398
mov r8, r14
jmp 0x1400e83ab
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rdi + r8*2], 0
jne 0x1400e83a0
mov rdx, rdi
lea rcx, [rbp - 0x68]
call fcn.1400c3720
nop
mov esi, 1
mov dword [rsp + 0x48], esi
lea r8, [rbp + 0x60]
lea rdx, [rbp - 0x68]
call fcn.1400e8da0
mov ebx, eax
mov dword [rsp + 0x40], eax
test eax, eax
js 0x1400e83e2
movzx r14d, sil
jmp 0x1400e83e5
mov ebx, dword [rsp + 0x40]
xor r14b, r14b
test sil, 1
je 0x1400e8409
mov r8, qword [rbp - 0x50]
cmp r8, 8
jb 0x1400e8409
inc r8
mov rdx, qword [rbp - 0x68]
lea rcx, [rbp - 0x68]
call fcn.1400c3a10
mov ebx, dword [rsp + 0x40]
test r14b, r14b
je 0x1400e867f
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x40], xmm0
xor esi, esi
mov qword [rbp + 0x50], rsi
lea r8, [rbp + 0x60]
lea rdx, str._n_WaCLRHostUtils__invoke_:_funcName:_Execute__params:
lea rcx, [rbp - 0x68]
call fcn.1400e2040
mov rbx, rax
call fcn.1400e04b0
mov rcx, rax
lea r8d, [rsi + 1]
mov rdx, rbx
call fcn.1400db9a0
nop
mov r8, qword [rbp - 0x50]
cmp r8, 8
jb 0x1400e8466
inc r8
mov rdx, qword [rbp - 0x68]
lea rcx, [rbp - 0x68]
call fcn.1400c3a10
lea rdx, [rbp + 0x60]
cmp qword [rbp + 0x78], 8
cmovae rdx, qword [rbp + 0x60]
lea rbx, vtable.WaJson.0
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x70], rsi
mov dword [rsp + 0x70], esi
mov byte [rsp + 0x70], 0
mov dword [rsp + 0x68], 5
lea rcx, [rsp + 0x60]
call fcn.1400c8870
nop
mov qword [rsp + 0x78], rbx
mov qword [rbp - 0x78], rsi
mov dword [rbp - 0x78], esi
mov byte [rbp - 0x78], 0
mov dword [rbp - 0x80], 5
mov rbx, qword [fcn.1400c54b0]
mov rcx, rbx
call qword [fcn.140005fb0]
lea rcx, [rsp + 0x78]
call rbx
mov dword [rbp - 0x78], r13d
mov dword [rbp - 0x80], 1
mov qword [rbp - 0x50], 7
mov qword [rbp - 0x58], rsi
mov word [rbp - 0x68], si
mov r8d, 7
lea rdx, [0x1402341d0]
lea rcx, [rbp - 0x68]
call fcn.1400c3720
nop
mov qword [rbp - 8], 7
mov qword [rbp - 0x10], rsi
mov word [rbp - 0x20], si
mov r8d, SafeArrayAccessData
lea rdx, str.libwapshost.WaPSHost
lea rcx, [rbp - 0x20]
call fcn.1400c3720
nop
mov dword [rsp + 0x48], 0x66
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], rsi
lea r8, [rbp - 0x70]
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x40]
call fcn.1400eb2e0
nop
call fcn.1400e9980
mov rcx, rax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x68]
lea r8, [rbp - 0x20]
lea rdx, [rsp + 0x48]
call fcn.1400e2fa0
mov dword [rsp + 0x40], eax
lea rcx, [rbp - 0x40]
call fcn.1400ca420
nop
mov r8, qword [rbp - 8]
cmp r8, 8
jb 0x1400e85a3
inc r8
mov rdx, qword [rbp - 0x20]
lea rcx, [rbp - 0x20]
call fcn.1400c3a10
mov qword [rbp - 8], 7
mov qword [rbp - 0x10], rsi
mov word [rbp - 0x20], si
mov r8, qword [rbp - 0x50]
cmp r8, 8
jb 0x1400e85cd
inc r8
mov rdx, qword [rbp - 0x68]
lea rcx, [rbp - 0x68]
call fcn.1400c3a10
mov qword [rbp - 0x50], 7
mov qword [rbp - 0x58], rsi
mov word [rbp - 0x68], si
lea r9, [fcn.1400c4610]
mov edx, SafeArrayCopy
lea r8d, [rdx - 0x16]
lea rcx, [rsp + 0x60]
call fcn.14016ea7c
cmp dword [rsp + 0x40], 0
jl 0x1400e8671
mov rcx, qword [rbp + 0x48]
sub rcx, qword [rbp + 0x40]
movabs rax, 0x2aaaaaaaaaaaaaab
imul rcx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rdx, 2
jb 0x1400e8671
lea r8, [rsp + 0x40]
lea rdx, [rbp + 0x40]
lea rcx, [rbp - 0x68]
call fcn.1400e73f0
mov qword [rbp - 0x40], r12
lea rcx, [rsp + 0x40]
mov qword [rbp - 0x38], rcx
mov qword [rbp - 0x30], r15
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.1400eaf50
mov r8, qword [rbp - 0x48]
cmp r8, 8
jb 0x1400e8671
inc r8
mov rdx, qword [rbp - 0x60]
lea rcx, [rbp - 0x60]
call fcn.1400c3a10
nop
lea rcx, [rbp + 0x40]
call fcn.1400ca420
nop
mov ebx, dword [rsp + 0x40]
test ebx, ebx
jns 0x1400e8d44
mov edx, ebx
lea rcx, [rbp + 0x40]
call fcn.1400c4090
mov rbx, rax
mov r8, r15
lea rdx, str._nPowershell_Host_Execution_failed._Error:
lea rcx, [rbp - 0x40]
call fcn.1400e2040
nop
lea r8, str.._Return_code:
mov rdx, rax
lea rcx, [rbp - 0x20]
call fcn.1400cb5f0
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp - 0x68]
call fcn.1400cb390
mov rbx, rax
call fcn.1400e04b0
mov rcx, rax
mov r8d, 1
mov rdx, rbx
call fcn.1400db9a0
nop
mov r8, qword [rbp - 0x50]
cmp r8, 8
jb 0x1400e8700
inc r8
mov rdx, qword [rbp - 0x68]
lea rcx, [rbp - 0x68]
call fcn.1400c3a10
mov qword [rbp - 0x50], 7
xor r12d, r12d
mov qword [rbp - 0x58], r12
mov word [rbp - 0x68], r12w
mov r8, qword [rbp - 8]
cmp r8, 8
jb 0x1400e872e
inc r8
mov rdx, qword [rbp - 0x20]
lea rcx, [rbp - 0x20]
call fcn.1400c3a10
mov qword [rbp - 8], 7
mov qword [rbp - 0x10], r12
mov word [rbp - 0x20], r12w
mov r8, qword [rbp - 0x28]
cmp r8, 8
jb 0x1400e8759
inc r8
mov rdx, qword [rbp - 0x40]
lea rcx, [rbp - 0x40]
call fcn.1400c3a10
mov qword [rbp - 0x28], 7
mov qword [rbp - 0x30], r12
mov word [rbp - 0x40], r12w
mov r8, qword [rbp + 0x58]
cmp r8, 8
jb 0x1400e8784
inc r8
mov rdx, qword [rbp + 0x40]
lea rcx, [rbp + 0x40]
call fcn.1400c3a10
mov ebx, dword [rsp + 0x40]
cmp ebx, 0xffffffcf
je 0x1400e8d44
cmp byte [rbp + 0x310], 0
je 0x1400e8d44
mov qword [rbp + 0x38], 7
mov qword [rbp + 0x30], r12
mov word [rbp + 0x20], r12w
mov r8d, 0x39
lea rdx, str.C:WindowsSystem32WindowsPowerShell_v1.0powershell.exe
lea rcx, [rbp + 0x20]
call fcn.1400c3720
nop
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x80]
call fcn.1401b1bc0
mov edx, 0x104
lea rcx, [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x1400e88d9
mov qword [rbp - 0x50], 7
mov qword [rbp - 0x58], r12
mov word [rbp - 0x68], r12w
cmp word [rbp + 0x80], 0
jne 0x1400e8814
mov r8, r12
jmp 0x1400e882b
lea rax, [rbp + 0x80]
or r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x1400e8820
lea rdx, [rbp + 0x80]
lea rcx, [rbp - 0x68]
call fcn.1400c3720
nop
lea r8, str.System32WindowsPowerShell_v1.0powershell.exe
lea rdx, [rbp - 0x68]
lea rcx, [rbp - 0x20]
call fcn.1400cb5f0
mov rbx, rax
lea rax, [rbp + 0x20]
cmp rax, rbx
je 0x1400e8894
mov r8, qword [rbp + 0x38]
cmp r8, 8
jb 0x1400e8876
inc r8
mov rdx, qword [rbp + 0x20]
lea rcx, [rbp + 0x20]
call fcn.1400c3a10
mov qword [rbp + 0x38], 7
mov qword [rbp + 0x30], r12
mov word [rbp + 0x20], r12w
mov rdx, rbx
lea rcx, [rbp + 0x20]
call fcn.1400c3980
nop
mov r8, qword [rbp - 8]
cmp r8, 8
jb 0x1400e88ae
inc r8
mov rdx, qword [rbp - 0x20]
lea rcx, [rbp - 0x20]
call fcn.1400c3a10
mov qword [rbp - 8], 7
mov qword [rbp - 0x10], r12
mov word [rbp - 0x20], r12w
mov r8, qword [rbp - 0x50]
cmp r8, 8
jb 0x1400e88d9
inc r8
mov rdx, qword [rbp - 0x68]
lea rcx, [rbp - 0x68]
call fcn.1400c3a10
mov qword [rbp + 0x18], 7
mov qword [rbp + 0x10], r12
mov word [rbp], r12w
cmp word [rdi], 0
jne 0x1400e88f5
mov r8, r12
jmp 0x1400e890b
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rdi + r8*2], 0
jne 0x1400e8900
mov rdx, rdi
lea rcx, [rbp]
call fcn.1400c3720
nop
mov qword [rbp - 0x50], 7
mov qword [rbp - 0x58], r12
mov word [rbp - 0x68], r12w
mov r8d, 1
lea rdx, [0x1402342b8]
lea rcx, [rbp - 0x68]
call fcn.1400c3720
nop
mov qword [rbp - 0x28], 7
mov qword [rbp - 0x30], r12
mov word [rbp - 0x40], r12w
mov r8d, 1
lea rdx, [0x140232684]
lea rcx, [rbp - 0x40]
call fcn.1400c3720
nop
mov rsi, qword [rbp - 0x30]
mov r14, qword [rbp - 0x40]
mov rdi, qword [rbp - 0x28]
test rsi, rsi
je 0x1400e89f5
lea rdx, [rbp - 0x40]
cmp rdi, 8
cmovae rdx, r14
mov r9, rsi
xor r8d, r8d
lea rcx, [rbp]
call fcn.1400c35d0
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400e89f5
nop dword [rax]
mov qword [rsp + 0x28], 0xffffffffffffffff
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x68]
mov r8, rsi
mov rdx, rbx
lea rcx, [rbp]
call fcn.1400cc2a0
lea rdx, [rbp - 0x40]
mov r14, qword [rbp - 0x40]
mov rdi, qword [rbp - 0x28]
cmp rdi, 8
cmovae rdx, r14
mov r8, qword [rbp - 0x58]
add r8, rbx
mov rsi, qword [rbp - 0x30]
mov r9, rsi
lea rcx, [rbp]
call fcn.1400c35d0
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1400e89a0
cmp rdi, 8
jb 0x1400e8a0b
lea r8, [rdi + 1]
mov rdx, r14
lea rcx, [rbp - 0x40]
call fcn.1400c3a10
mov qword [rbp - 0x28], 7
mov qword [rbp - 0x30], r12
mov word [rbp - 0x40], r12w
mov r8, qword [rbp - 0x50]
cmp r8, 8
jb 0x1400e8a36
inc r8
mov rdx, qword [rbp - 0x68]
lea rcx, [rbp - 0x68]
call fcn.1400c3a10
lea r8, [rbp]
lea rdx, str._noprofile__ExecutionPolicy_Bypass__
lea rcx, [rbp - 0x20]
call fcn.1400e2040
nop
lea r8, [0x140232684]
mov rdx, rax
lea rcx, [rbp - 0x68]
call fcn.1400cb5f0
mov rbx, rax
lea rax, [rbp]
cmp rax, rbx
je 0x1400e8aa2
mov r8, qword [rbp + 0x18]
cmp r8, 8
jb 0x1400e8a84
inc r8
mov rdx, qword [rbp]
lea rcx, [rbp]
call fcn.1400c3a10
mov qword [rbp + 0x18], 7
mov qword [rbp + 0x10], r12
mov word [rbp], r12w
mov rdx, rbx
lea rcx, [rbp]
call fcn.1400c3980
nop
mov r8, qword [rbp - 0x50]
cmp r8, 8
jb 0x1400e8abc
inc r8
mov rdx, qword [rbp - 0x68]
lea rcx, [rbp - 0x68]
call fcn.1400c3a10
mov qword [rbp - 0x50], 7
mov qword [rbp - 0x58], r12
mov word [rbp - 0x68], r12w
mov r8, qword [rbp - 8]
cmp r8, 8
jb 0x1400e8ae7
inc r8
mov rdx, qword [rbp - 0x20]
lea rcx, [rbp - 0x20]
call fcn.1400c3a10
mov dword [rsp + 0x58], r12d
lea rdx, [rsp + 0x44]
lea rcx, [rbp + 0x20]
call fcn.140142ee0
mov ebx, eax
test eax, eax
js 0x1400e8bac
movzx edi, byte [rsp + 0x44]
test dil, dil
je 0x1400e8b4c
xor dil, dil
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.Wow64DisableWow64FsRedirection
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x1400e8b4c
mov rcx, rax
call qword [fcn.140005fb0]
lea rcx, [rsp + 0x48]
call rbx
test eax, eax
setne dil
mov dword [rsp + 0x30], r13d
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 1
lea r9, [rsp + 0x58]
mov r8, r15
lea rdx, [rbp]
lea rcx, [rbp + 0x20]
call fcn.140145170
mov ebx, eax
test dil, dil
je 0x1400e8bac
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.Wow64RevertWow64FsRedirection
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x1400e8bac
mov rcx, rax
call qword [fcn.140005fb0]
mov rcx, qword [rsp + 0x48]
call rdi
mov dword [rsp + 0x40], ebx
test ebx, ebx
jns 0x1400e8cb4
mov edx, ebx
lea rcx, [rbp + 0x40]
call fcn.1400c4090
mov rbx, rax
mov r8, r15
lea rdx, str._nSystem_Powershell_Execution_failed._Error:
lea rcx, [rbp - 0x40]
call fcn.1400e2040
nop
lea r8, str.._Return_code:
mov rdx, rax
lea rcx, [rbp - 0x20]
call fcn.1400cb5f0
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp - 0x68]
call fcn.1400cb390
mov rbx, rax
call fcn.1400e04b0
mov rcx, rax
mov r8d, 1
mov rdx, rbx
call fcn.1400db9a0
nop
mov r8, qword [rbp - 0x50]
cmp r8, 8
jb 0x1400e8c31
inc r8
mov rdx, qword [rbp - 0x68]
lea rcx, [rbp - 0x68]
call fcn.1400c3a10
mov qword [rbp - 0x50], 7
mov qword [rbp - 0x58], r12
mov word [rbp - 0x68], r12w
mov r8, qword [rbp - 8]
cmp r8, 8
jb 0x1400e8c5c
inc r8
mov rdx, qword [rbp - 0x20]
lea rcx, [rbp - 0x20]
call fcn.1400c3a10
mov qword [rbp - 8], 7
mov qword [rbp - 0x10], r12
mov word [rbp - 0x20], r12w
mov r8, qword [rbp - 0x28]
cmp r8, 8
jb 0x1400e8c87
inc r8
mov rdx, qword [rbp - 0x40]
lea rcx, [rbp - 0x40]
call fcn.1400c3a10
mov qword [rbp - 0x28], 7
mov qword [rbp - 0x30], r12
mov word [rbp - 0x40], r12w
mov r8, qword [rbp + 0x58]
cmp r8, 8
jb 0x1400e8cea
inc r8
mov rdx, qword [rbp + 0x40]
lea rcx, [rbp + 0x40]
call fcn.1400c3a10
jmp 0x1400e8cea
cmp qword [r15 + 0x18], 8
jb 0x1400e8cc0
mov rcx, qword [r15]
jmp 0x1400e8cc3
mov rcx, r15
call fcn.1400cf970
test al, al
je 0x1400e8cea
cmp qword [r15 + 0x18], 8
jb 0x1400e8cd8
mov rcx, qword [r15]
jmp 0x1400e8cdb
mov rcx, r15
mov r8, r15
lea rdx, str._.__r_n
call fcn.1400cf7b0
mov ebx, dword [rsp + 0x40]
mov r8, qword [rbp + 0x18]
cmp r8, 8
jb 0x1400e8d08
inc r8
mov rdx, qword [rbp]
lea rcx, [rbp]
call fcn.1400c3a10
mov qword [rbp + 0x18], 7
mov qword [rbp + 0x10], r12
mov word [rbp], r12w
mov r8, qword [rbp + 0x38]
cmp r8, 8
jb 0x1400e8d33
inc r8
mov rdx, qword [rbp + 0x20]
lea rcx, [rbp + 0x20]
call fcn.1400c3a10
mov qword [rbp + 0x38], 7
mov qword [rbp + 0x30], r12
mov word [rbp + 0x20], r12w
mov r8, qword [rbp + 0x78]
cmp r8, 8
jb 0x1400e8d5e
inc r8
mov rdx, qword [rbp + 0x60]
lea rcx, [rbp + 0x60]
call fcn.1400c3a10
mov eax, ebx
jmp 0x1400e8d7a
mov edx, 4
lea rcx, [rsp + 0x48]
call fcn.1400e6a60
mov rcx, rax
call fcn.140177894
nop
mov rcx, qword [rbp + 0x290]
xor rcx, rsp
call fcn.14016e480
add rsp, 0x3a8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret