Function at 0x18004f620
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x120]
sub rsp, 0x220
mov rax, qword [0x180080a28]
xor rax, rsp
mov qword [rbp + 0x110], rax
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x38], r8
mov r15d, edx
mov qword [rsp + 0x60], rcx
movdqa xmm0, xmmword [0x18007b7e0]
movdqa xmmword [rbp - 0x80], xmm0
mov byte [rsp + 0x70], 0
movdqa xmm1, xmm0
movdqa xmmword [rbp - 0x60], xmm0
mov byte [rbp - 0x70], 0
movdqa xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
mov esi, edx
imul r12d, edx, 0x860
xor ebx, ebx
cmp edx, r12d
ja 0x18004f904
lea ecx, [rbx + 0x49]
lea edx, [rbx + 0x6d]
lea r10, [0x180075ec8]
lea r9, reloc.SHELL32.dll_SHChangeNotifyDeregister
mov r14, qword [rsp + 0x58]
mov r13, qword [rsp + 0x58]
nop dword [rax]
cmp esi, 0x4056
ja 0x18004f7dc
je 0x18004f7d0
cmp esi, 0xaf
ja 0x18004f783
je 0x18004f740
mov eax, esi
sub eax, 0x41
je 0x18004f738
sub eax, 0xe
je 0x18004f715
sub eax, 0x2b
je 0x18004f708
cmp eax, 0x12
jne 0x18004f8ed
mov rcx, qword [r8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x18004f8d2
mov word [rbp - 0x20], cx
mov word [rbp - 0x1f], dx
jmp 0x18004f8ed
mov ecx, ebx
mov edx, dword [r8]
mov rax, r10
nop dword [rax]
cmp edx, dword [rax]
je 0x18004f960
inc ecx
add rax, 8
cmp rax, r9
jl 0x18004f720
jmp 0x18004f8e5
mov r13, r8
jmp 0x18004f8ed
mov edx, 0x18
lea ecx, [rdx - 0x17]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov r14, rax
test rax, rax
jne 0x18004f8d2
mov edx, 0x3b
nop
mov ecx, edx
sub ecx, 0x3b
je 0x18004f772
cmp ecx, 1
je 0x18004fb1b
jmp 0x18004f777
mov qword [rsp + 0x40], rbx
inc edx
cmp edx, 0x3d
jb 0x18004f760
jmp 0x18004f8d2
cmp esi, 0xd1
je 0x18004f7c1
cmp esi, 0x2247
je 0x18004f7ac
cmp esi, 0x29a9
jne 0x18004f8ed
mov dword [rsp + 0x40], 1
jmp 0x18004fb1b
cmp qword [r13 + 0x1a], 0
jne 0x18004f8ed
mov byte [rsp + 0x40], 0
jmp 0x18004fb1b
mov rcx, qword [r8 + 8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x18004f8d2
mov dword [rbp - 0x1e], 0x726570
jmp 0x18004f8ed
cmp esi, 0x6653
ja 0x18004f877
je 0x18004f971
cmp esi, 0x444d
je 0x18004f85f
cmp esi, 0x49d4
je 0x18004f857
cmp esi, 0x5c49
jne 0x18004f8ed
lea r8, [r14 + 0x10]
lea rdx, [r14 + 8]
xor r9d, r9d
mov rcx, r14
call fcn.18003d770
test eax, eax
je 0x18004f84d
mov edi, 0xd7
mov eax, edi
sub eax, 0xd7
je 0x18004f83a
cmp eax, 1
je 0x18004fb20
jmp 0x18004f843
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
inc edi
cmp edi, 0xd9
jb 0x18004f826
mov qword [rsp + 0x40], r14
jmp 0x18004f8d2
mov qword [r8], rbx
jmp 0x18004f8ed
lea rdx, [r13 + 0xa]
lea r9, [rsp + 0x70]
xor r8d, r8d
mov ecx, 0x118
call fcn.180060ed0
jmp 0x18004f8d2
cmp esi, 0x6e37
je 0x18004f89f
cmp esi, 0x931c
je 0x18004f895
cmp esi, 0xb7e3
je 0x18004fb1b
jmp 0x18004f8ed
mov qword [r8 + 8], 0
jmp 0x18004f8ed
mov qword [r8 + 8], rbx
mov edi, ebx
mov rbx, qword [rsp + 0x38]
nop word [rax + rax]
mov dword [rsp + 0x48], edi
mov r9, rbx
lea r8, [rsp + 0x48]
xor edx, edx
lea ecx, [rdx + 0x12]
call fcn.180067590
inc edi
cmp edi, 0xffff
jl 0x18004f8b0
xor ebx, ebx
mov r8, qword [rsp + 0x38]
lea r9, reloc.SHELL32.dll_SHChangeNotifyDeregister
lea r10, [0x180075ec8]
mov edx, 0x6d
lea ecx, [rdx - 0x24]
imul eax, r15d, 0x86
add esi, eax
cmp esi, r12d
jbe 0x18004f6c0
mov r9, qword [rsp + 0x68]
lea eax, [r15 + 0x44]
cmp r15d, eax
jae 0x18004fb1b
lea edi, [r15 - 0x7a]
mov esi, ILClone
lea rdx, [0x180000000]
lea r11, [0x18001a900]
lea r10d, [rsi + 0x5d]
movzx r14d, byte [rsp + 0x30]
mov r15d, dword [rsp + 0x50]
mov r12d, dword [rsp + 0x50]
mov r13, qword [rsp + 0x58]
cmp edi, 0x57
ja case.0x18004f95c.16
movzx eax, byte [rdx + rdi + 0x4fc64]
mov ecx, dword [rdx + rax*4 + 0x4fc20]
add rcx, rdx
jmp rcx
movsxd rax, ecx
mov eax, dword [r10 + rax*8 + 4]
mov dword [rsp + 0x40], eax
jmp 0x18004fb1b
movzx eax, word [r13 + 8]
mov word [rsp + 0x30], ax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x70]
mov r8d, 0x21
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call fcn.1800148c0
mov byte [rsp + 0x40], al
jmp 0x18004fb1b
mov byte [rsp + 0x30], 0x69
mov qword [r8], r11
jmp case.0x18004f95c.16
mov ecx, ebx
movzx eax, r14b
cmp dword [rsp + 0x50], 0
cmove ecx, eax
movzx r14d, cl
jmp case.0x18004f95c.16
mov qword [rsp + 0x58], rbx
mov r15d, 0x36
jmp case.0x18004f95c.16
mov eax, 0x73
mov word [rbp - 0x1b], ax
jmp case.0x18004f95c.16
mov dword [rbp - 0x11], 0x65696c
mov word [rbp - 0xe], r10w
jmp case.0x18004f95c.16
test r14b, r14b
je case.0x18004f95c.16
lea r9, [rbp]
mov r8d, r12d
mov rdx, r13
mov ecx, r15d
call qword [sym.imp.SHELL32.dll_SHSetFolderPathA]
jmp 0x18004faf0
mov r12d, ebx
jmp case.0x18004f95c.16
lea rax, [rbp]
mov qword [rsp + 0x20], rax
mov r9d, r12d
mov r8, r13
mov edx, r15d
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
mov dword [rsp + 0x50], eax
jmp 0x18004faf0
mov rcx, r8
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x18004faf0
mov eax, 0x6f
mov word [rbp - 0x1a], ax
jmp case.0x18004f95c.16
mov eax, 0x796e
mov word [rbp - 0x14], ax
jmp case.0x18004f95c.16
mov word [rbp - 0x19], r10w
mov dword [rbp - 0x18], 0x41657461
jmp case.0x18004f95c.16
mov eax, 0x74
mov word [rbp - 0xd], ax
mov r14b, 1
jmp case.0x18004f95c.16
movzx eax, word [r9]
mov word [rsp + 0x48], ax
lea rdx, [rsp + 0x48]
mov ecx, 0xcc
call fcn.180004720
mov r13, rbx
jmp 0x18004faf0
mov eax, 0x43
mov word [rbp - 0x12], ax
jmp case.0x18004f95c.16
movsx edx, byte [rsp + 0x30]
lea rcx, [rbp - 0x20]
call qword [sym.imp.SHLWAPI.dll_StrChrA]
mov r8, qword [rsp + 0x38]
lea rcx, [r8 + 0xa]
mov r10, qword [rsp + 0x60]
cmp rcx, r10
je 0x18004faf5
mov rdx, r10
cmp qword [r10 + 0x18], 0x10
jb 0x18004fae7
mov rdx, qword [r10]
mov r8, qword [r10 + 0x10]
call fcn.18002a970
mov r8, qword [rsp + 0x38]
lea r11, [0x18001a900]
mov r10d, 0x6e
lea rdx, [0x180000000]
add edi, 4
sub rsi, 1
mov r9, qword [rsp + 0x68]
jne 0x18004f941
mov rbx, qword [rsp + 0x40]
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x18004fb5b
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18004fb56
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18004fbe7
call fcn.180071f98
movdqa xmm0, xmmword [0x18007b7e0]
movdqa xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x18004fba3
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18004fb9e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18004fbe7
call fcn.180071f98
movdqa xmm0, xmmword [0x18007b7e0]
movdqa xmmword [rbp - 0x60], xmm0
mov byte [rbp - 0x70], 0
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x18004fbf3
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18004fbee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18004fbee
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180071f98
mov rax, rbx
mov rcx, qword [rbp + 0x110]
xor rcx, rsp
call fcn.180072740
mov rbx, qword [rsp + 0x268]
add rsp, 0x220
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret