Function at 0x14020b640
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0xba8]
sub rsp, 0xc90
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
xor edx, edx
mov r8d, 0x410
lea rcx, [rbp + 0x360]
call fcn.140249b10
lea rdx, [0x14034ec34]
lea rcx, [rbp + 0x360]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rdx, str.Quarantine
lea rcx, [rbp + 0x360]
call qword [sym.imp.SHLWAPI.dll_PathAppendA]
mov rcx, qword [0x14037caf8]
add rcx, 0x1330
call fcn.140025de0
lea r15, vtable.CSABString.0
mov qword [rsp + 0x20], r15
lea rcx, [rbp + 0x360]
mov rsi, 0xffffffffffffffff
mov rax, rsi
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x14020b6e0
mov dword [rsp + 0x30], eax
inc eax
mov ebx, eax
mov ecx, eax
call fcn.140247068
mov qword [rsp + 0x28], rax
test rax, rax
je 0x14020b714
mov r8d, ebx
lea rdx, [rbp + 0x360]
mov rcx, rax
call fcn.1402496a0
mov dword [rsp + 0x34], 1
mov rcx, qword [0x14037caf8]
add rcx, 0x1330
lea rdx, [rsp + 0x20]
call fcn.1400b2e80
nop
cmp dword [rsp + 0x34], 1
jne 0x14020b74b
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x14020b74b
call fcn.140247060
xor edx, edx
mov r8d, 0x410
lea rcx, [rsp + 0x50]
call fcn.140249b10
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.140043220
mov qword [rsp + 0x20], rax
lea rdx, [0x14034ec34]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rdx, str.EXCLUDE.STG
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathAppendA]
lea r14, vtable.CSASFolderListManager.0
mov qword [rbp + 0x770], r14
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x778]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
nop
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x770]
call fcn.1401ed5e0
mov rdi, qword [rsp + 0x20]
cmp qword [rsp + 0x28], 0
je 0x14020b812
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x14020b812
nop
mov rcx, qword [0x14037caf8]
add rcx, 0x1330
lea r8, [rbx + 0x18]
mov rdx, qword [rcx]
call fcn.14007aa40
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x14020b7f0
mov qword [rbp + 0x770], r14
mov r14, qword [rdi]
mov qword [rdi], rdi
mov qword [rdi + 8], rdi
cmp r14, rdi
je 0x14020b853
nop dword [rax + rax]
mov rbx, qword [r14]
lea rcx, [r14 + 0x10]
mov rax, qword [rcx]
xor edx, edx
call qword [rax]
mov edx, PathResolve
mov rcx, r14
call fcn.140247060
mov r14, rbx
cmp rbx, rdi
jne 0x14020b830
mov edx, PathResolve
mov rcx, rdi
call fcn.140247060
mov rax, qword [0x14037caf8]
cmp dword [0x140350890], 0
je 0x14020b87c
or dword [rax + 0x12b8], 0x1000
jmp 0x14020b886
and dword [rax + 0x12b8], 0xffffefff
mov rax, qword [0x14037caf8]
cmp dword [0x140350850], 0
je 0x14020b8a2
or dword [rax + 0x12b8], 0x400000
jmp 0x14020b8ac
and dword [rax + 0x12b8], 0xffbfffff
mov rax, qword [0x14037caf8]
cmp dword [0x1403507e8], 0
je 0x14020b8c8
or dword [rax + 0x12b8], 0x8000
jmp 0x14020b8d2
and dword [rax + 0x12b8], 0xffff7fff
mov rax, qword [0x14037caf8]
cmp dword [rax + 0x9d8], 2
jne 0x14020b91d
cmp dword [0x1403507e0], 0
je 0x14020b8f7
or dword [rax + 0x12b8], 0x200000
jmp 0x14020b901
and dword [rax + 0x12b8], 0xffdfffff
mov rax, qword [0x14037caf8]
cmp dword [0x1403507e4], 0
je 0x14020b92e
or dword [rax + 0x12b8], 0x100000
jmp 0x14020b938
and dword [rax + 0x12b8], 0xffdfffff
mov rax, qword [0x14037caf8]
and dword [rax + 0x12b8], 0xffefffff
mov rax, qword [0x14037caf8]
cmp dword [rax + 0x9d8], 2
jne 0x14020b95d
cmp dword [0x1403507ec], 0
je 0x14020b95d
or dword [rax + 0x12b8], 0x80000
jmp 0x14020b967
and dword [rax + 0x12b8], 0xfff7ffff
test dword [0x14037caf0], 0x10000000
je 0x14020bafc
mov rax, qword [0x14037caf8]
and dword [rax + 0x12b8], 0xbfffffff
mov rax, qword [0x14037caf8]
and dword [rax + 0x12b8], 0xdfffffff
mov rax, qword [0x14037caf8]
and dword [rax + 0x12b8], 0xf079ffff
mov rax, qword [0x14037caf8]
and dword [rax + 0x12b8], 0xffffdfff
mov rax, qword [0x14037caf8]
or dword [rax + 0x12b8], 0x2010000
mov rcx, qword [0x14037caf8]
add rcx, 0x1320
call fcn.1400b2c40
mov rax, qword [0x14037d1f8]
mov rbx, qword [rax]
cmp rbx, rax
je 0x14020baa6
lea r15, vtable.CSASScanner::CDiskScanLocation.0
movabs r12, 0x492492492492491
nop dword [rax]
nop word [rax + rax]
mov qword [rsp + 0x20], r15
mov rdx, qword [rbx + 0x18]
lea rcx, [rsp + 0x28]
call fcn.140006f70
mov dword [rsp + 0x40], 0xffffffff
mov rdi, qword [0x14037caf8]
mov rsi, qword [rdi + 0x1320]
mov r14, qword [rsi + 8]
lea r9, [rsp + 0x20]
mov r8, r14
mov rdx, rsi
lea rcx, [rdi + 0x1320]
call fcn.1401e5ab0
mov rdx, qword [rdi + 0x1328]
mov rcx, r12
sub rcx, rdx
cmp rcx, 1
jb 0x14020beaa
lea rcx, [rdx + 1]
mov qword [rdi + 0x1328], rcx
mov qword [rsi + 8], rax
mov qword [r14], rax
cmp dword [rsp + 0x3c], 1
jne 0x14020ba93
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14020ba93
call fcn.140247060
mov rbx, qword [rbx]
mov rax, qword [0x14037d1f8]
cmp rbx, rax
jne 0x14020ba10
mov rdi, qword [rax]
mov qword [rax], rax
mov rax, qword [0x14037d1f8]
mov qword [rax + 8], rax
mov qword [0x14037d200], 0
cmp rdi, qword [0x14037d1f8]
je 0x14020be7c
nop
mov rbx, qword [rdi]
lea rcx, [rdi + 0x10]
mov rax, qword [rcx]
xor edx, edx
call qword [rax]
mov edx, 0x28
mov rcx, rdi
call fcn.140247060
mov rdi, rbx
cmp rbx, qword [0x14037d1f8]
jne 0x14020bad0
jmp 0x14020be7c
mov eax, dword [0x140350860]
test eax, eax
je 0x14020be0e
sub eax, 1
je 0x14020bc8a
sub eax, 1
je 0x14020bb9e
cmp eax, 2
jne 0x14020be7c
lea rcx, str._CRITICALPOINTSCAN_
call fcn.140202b20
mov rcx, qword [0x14037caf8]
add rcx, 0x1330
call fcn.140025de0
mov rax, qword [0x14037caf8]
and dword [rax + 0x12b8], 0xbfffffff
mov rax, qword [0x14037caf8]
and dword [rax + 0x12b8], 0xdfffffff
mov rax, qword [0x14037caf8]
and dword [rax + 0x12b8], 0xff79ffff
mov rax, qword [0x14037caf8]
or dword [rax + 0x12b8], 0xd000000
mov rax, qword [0x14037caf8]
or dword [rax + 0x12b8], 0x2000
jmp 0x14020be7c
lea rcx, str._CUSTOMSCAN_
call fcn.140202b20
mov rax, qword [0x14037caf8]
and dword [rax + 0x12b8], 0xbfffffff
mov rax, qword [0x14037caf8]
and dword [rax + 0x12b8], 0xdfffffff
mov rax, qword [0x14037caf8]
and dword [rax + 0x12b8], 0xffffdfff
mov rax, qword [0x14037caf8]
and dword [rax + 0x12b8], 0xfff9ffff
mov rax, qword [0x14037caf8]
and dword [rax + 0x12b8], 0xf07fffff
cmp dword [0x1403507cc], 0
je 0x14020bc19
mov rax, qword [0x14037caf8]
or dword [rax + 0x12b8], 0x8000000
cmp dword [0x1403507d0], 0
je 0x14020bc33
mov rax, qword [0x14037caf8]
or dword [rax + 0x12b8], 0x4000000
cmp dword [0x1403507d4], 0
je 0x14020bc4d
mov rax, qword [0x14037caf8]
or dword [rax + 0x12b8], 0x1000000
cmp dword [0x1403507d8], 0
je 0x14020bc67
mov rax, qword [0x14037caf8]
or dword [rax + 0x12b8], 0x2000000
cmp dword [0x1403507dc], 0
je 0x14020be7c
mov rax, qword [0x14037caf8]
or dword [rax + 0x12b8], 0x800000
jmp 0x14020be7c
xor edx, edx
mov r8d, 0x410
lea rcx, [rsp + 0x50]
call fcn.140249b10
lea rcx, str._COMPLETESCAN_
call fcn.140202b20
mov rax, qword [0x14037caf8]
and dword [rax + 0x12b8], 0xbfffffff
mov rax, qword [0x14037caf8]
and dword [rax + 0x12b8], 0xdfffffff
mov rax, qword [0x14037caf8]
and dword [rax + 0x12b8], 0xffffdfff
mov rax, qword [0x14037caf8]
or dword [rax + 0x12b8], 0xf060000
mov rax, qword [0x14037caf8]
cmp dword [0x140350840], 0
je 0x14020bd08
or dword [rax + 0x12b8], 0x800000
jmp 0x14020bd12
and dword [rax + 0x12b8], 0xff7fffff
cmp dword [0x140350848], 0
je 0x14020be7c
mov edx, 0x410
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x14020be7c
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathStripToRootA]
lea rdx, str.System_Volume_Information
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathAppendA]
mov qword [rsp + 0x20], r15
lea rax, [rsp + 0x50]
nop
inc rsi
cmp byte [rax + rsi], 0
jne 0x14020bd60
mov dword [rsp + 0x30], esi
lea eax, [rsi + 1]
mov ebx, eax
mov ecx, eax
call fcn.140247068
mov qword [rsp + 0x28], rax
test rax, rax
je 0x14020bd93
mov r8d, ebx
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.1402496a0
mov dword [rsp + 0x34], 1
mov rbx, qword [0x14037caf8]
mov rdi, qword [rbx + 0x1330]
mov rsi, qword [rdi + 8]
lea r9, [rsp + 0x20]
mov r8, rsi
mov rdx, rdi
lea rcx, [rbx + 0x1330]
call fcn.140039da0
mov rdx, rax
mov rax, qword [rbx + 0x1338]
movabs rcx, 0x666666666666665
sub rcx, rax
cmp rcx, 1
jb 0x14020be9d
inc rax
mov qword [rbx + 0x1338], rax
mov qword [rdi + 8], rdx
mov qword [rsi], rdx
cmp dword [rsp + 0x34], 1
jne 0x14020be7c
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x14020be7c
call fcn.140247060
jmp 0x14020be7c
lea rcx, str._QUICKSCAN_
call fcn.140202b20
mov rax, qword [0x14037caf8]
or dword [rax + 0x12b8], 0x40000000
mov rax, qword [0x14037caf8]
or dword [rax + 0x12b8], 0x20000000
mov rax, qword [0x14037caf8]
or dword [rax + 0x12b8], 0x2000
mov rax, qword [0x14037caf8]
or dword [rax + 0x12b8], 0xf060000
mov rax, qword [0x14037caf8]
cmp dword [0x140350840], 0
jne 0x14020bc7b
and dword [rax + 0x12b8], 0xff7fffff
lea r11, [rsp + 0xc90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
lea rcx, str.list_T__too_long
call fcn.1402453d0
nop
lea rcx, str.list_T__too_long
call fcn.1402453d0
int3