Function at 0x1000b2b5c
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r14
sub rsp, 0x470
mov rax, qword [0x100165138]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov rsi, rcx
mov rdi, r8
lea rcx, [rsp + 0x40]
xor ebx, ebx
xor edx, edx
mov r8d, 0x208
mov qword [rsp + 0x30], rbx
call sub.msvcrt.dll_memset
mov r12d, 0x104
test rdi, rdi
jne 0x1000b2c76
lea rcx, [rsp + 0x40]
mov edx, r12d
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x1000b2c11
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [0x1001653b8]
lea rcx, [0x1001653b8]
cmp rax, rcx
je 0x1000b2bfe
test byte [rax + 0x1c], 2
je 0x1000b2bfe
cmp byte [rax + 0x19], 2
jb 0x1000b2bfe
mov rcx, qword [rax + 0x10]
lea edx, [rdi + 0x59]
lea r8, [0x1000036a8]
mov r9d, ebx
call fcn.10001c878
movzx edi, bx
or edi, 0x80070000
test ebx, ebx
cmovle edi, ebx
jmp 0x1000b2e5f
mov ebp, 0x105
lea rcx, [rsp + 0x40]
mov rdx, rsi
mov r8d, ebp
call qword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
test eax, eax
jne 0x1000b2d3d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [0x1001653b8]
lea rcx, [0x1001653b8]
cmp rax, rcx
je 0x1000b2bfe
test byte [rax + 0x1c], 2
je 0x1000b2bfe
cmp byte [rax + 0x19], 2
jb 0x1000b2bfe
mov rcx, qword [rax + 0x10]
lea r9, [rsp + 0x40]
lea r8, [0x1000036a8]
mov edx, 0x5a
mov dword [rsp + 0x20], ebx
call fcn.10001ddb0
jmp 0x1000b2bfe
lea r8, [rsp + 0x30]
xor r9d, r9d
xor edx, edx
mov rcx, rdi
call fcn.10009cbc4
mov edi, eax
test eax, eax
jns 0x1000b2ccf
mov rax, qword [0x1001653b8]
lea rcx, [0x1001653b8]
cmp rax, rcx
je 0x1000b2cc5
test byte [rax + 0x1c], 2
je 0x1000b2cc5
cmp byte [rax + 0x19], 2
jb 0x1000b2cc5
mov rcx, qword [rax + 0x10]
lea r8, [0x1000036a8]
mov edx, 0x5b
mov r9d, edi
call fcn.10001c878
mov rbx, qword [rsp + 0x30]
jmp 0x1000b2e51
mov rbx, qword [rsp + 0x30]
mov ebp, 0x105
mov rcx, rsi
mov r8, rbx
mov rdx, rbp
call fcn.1000c23ac
mov edi, eax
test eax, eax
jns 0x1000b2d3d
mov rax, qword [0x1001653b8]
lea rcx, [0x1001653b8]
cmp rax, rcx
je 0x1000b2e51
test byte [rax + 0x1c], 2
je 0x1000b2e51
cmp byte [rax + 0x19], 2
jb 0x1000b2e51
mov rcx, qword [rax + 0x10]
lea r8, [0x1000036a8]
mov edx, 0x5c
mov r9, rbx
mov dword [rsp + 0x20], 0x103
call fcn.10001ddb0
jmp 0x1000b2e51
or r14, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
mov rcx, r14
repne scasw ax, word [rdi]
not rcx
add rcx, 0x18
cmp rcx, r12
jb 0x1000b2d70
lea r8, [0x10000b810]
lea rcx, [0x10000b0c0]
mov edx, 0xb8d
call fcn.10009a050
lea r8, [0x100002858]
mov rdx, rbp
mov rcx, rsi
call fcn.100059424
xor eax, eax
mov rcx, r14
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
add rcx, 0x12
cmp rcx, r12
jb 0x1000b2db1
lea r8, [0x10000b850]
lea rcx, [0x10000b0c0]
mov edx, 0xb95
call fcn.10009a050
lea r8, [0x100002934]
mov rdx, rbp
mov rcx, rsi
call fcn.100059424
lea r8, [0x100002890]
mov rdx, rbp
mov rcx, rsi
call fcn.100059424
xor edx, edx
mov rcx, rsi
call fcn.1000a0554
mov edi, eax
test eax, eax
js 0x1000b2e51
xor eax, eax
mov rcx, r14
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
add rcx, 0x10
cmp rcx, r12
jb 0x1000b2e14
lea r8, [0x10000b890]
lea rcx, [0x10000b0c0]
mov edx, 0xba5
call fcn.10009a050
lea rax, [0x100002830]
lea r8, [0x10000a7b0]
lea rcx, [rsp + 0x250]
mov r9, rsi
mov rdx, r12
mov qword [rsp + 0x20], rax
call fcn.100043f10
mov edi, eax
test eax, eax
js 0x1000b2e51
lea rcx, [rsp + 0x250]
xor edx, edx
call fcn.1000a0554
mov edi, eax
test rbx, rbx
je 0x1000b2e5f
mov rcx, rbx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, edi
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.10014e600
mov rbx, qword [rsp + 0x4a8]
add rsp, 0x470
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret