Function at 0x180036f40
Capabilities:
Get common file path

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x120
mov rax, qword [0x1801483c0]
xor rax, rsp
mov qword [rsp + 0x100], rax
mov r10, qword [rsp + 0x168]
lea eax, [rdx - 1]
mov rdi, qword [rsp + 0x170]
cmp eax, 5
ja case.default.0x180036f8d
lea r11, [0x180000000]
cdqe
mov ecx, dword [r11 + rax*4 + 0x37344]
add rcx, r11
jmp rcx
test r9d, r9d
jle case.default.0x180036f8d
lfence
sub edx, 1
je 0x180036fc8
sub edx, 1
je 0x180036fc1
sub edx, 1
je 0x180036fba
cmp edx, 1
je 0x180036fb3
xor esi, esi
jmp 0x180036fcd
mov esi, 1
jmp 0x180036fcd
mov esi, 2
jmp 0x180036fcd
mov esi, 4
jmp 0x180036fcd
mov esi, 3
mov r8, qword [rsp + 0x160]
lea rcx, [0x18014e828]
mov rdx, qword [0x18014e790]
mov dword [rsp + 0x28], r9d
movzx r9d, byte [0x18014e788]
mov dword [rsp + 0x20], esi
call fcn.1800428b0
test al, al
je case.default.0x180036f8d
mov eax, 1
jmp 0x18003707d
mov rdx, qword [rsp + 0x160]
lea r8, [rsp + 0x50]
mov rcx, qword [0x18014e790]
mov r9, r10
call fcn.1800434b0
test al, al
je case.default.0x180036f8d
movzx eax, byte [rsp + 0x50]
neg al
sbb eax, eax
add eax, 3
jmp 0x18003707d
test r8d, r8d
jle case.default.0x180036f8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov ebx, eax
test eax, eax
jne 0x180037098
mov rcx, qword [0x1801491d8]
lea rax, [0x1801491d8]
cmp rcx, rax
je case.default.0x180036f8d
test byte [rcx + 0x1c], 0x10
je case.default.0x180036f8d
cmp byte [rcx + 0x19], 2
jb case.default.0x180036f8d
mov rcx, qword [rcx + 0x10]
lea r8, [0x180123218]
mov edx, 0xf0
call fcn.18001f9f0
xor eax, eax
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.1800d5000
add rsp, 0x120
pop rdi
pop rsi
pop rbx
ret
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call fcn.18001bca0
cmp qword [rdi + 0x18], 7
mov rdx, rdi
jbe 0x1800370b3
mov rdx, qword [rdi]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ecx, [rbx - 1]
mov r9d, eax
cmp eax, ecx
je 0x180037106
mov rcx, qword [0x1801491d8]
lea rax, [0x1801491d8]
cmp rcx, rax
je case.default.0x180036f8d
test byte [rcx + 0x1c], 0x10
je case.default.0x180036f8d
cmp byte [rcx + 0x19], 2
jb case.default.0x180036f8d
mov rcx, qword [rcx + 0x10]
lea r8, [0x180123218]
mov dword [rsp + 0x20], r9d
mov edx, 0xf1
mov r9d, ebx
call fcn.180021290
jmp case.default.0x180036f8d
mov qword [rsp + 0x140], rbp
xor r8d, r8d
mov qword [rsp + 0x148], r12
mov rdx, r9
mov qword [rsp + 0x150], r13
mov rcx, rdi
mov qword [rsp + 0x118], r14
mov qword [rsp + 0x110], r15
call fcn.18001bca0
xor ecx, ecx
call fcn.1800e7c08
xor esi, esi
mov qword [rsp + 0x58], rax
movabs rcx, 0x700000000
xor bpl, bpl
xor bl, bl
xor r15b, r15b
xor r12b, r12b
xor r13b, r13b
movzx r14d, si
cmp rax, rcx
jg 0x1800371a3
lea rdx, [rsp + 0x58]
mov r14d, esi
lea rcx, [rsp + 0x60]
call fcn.1800e7914
test eax, eax
jne 0x1800371a3
movzx r14d, word [rsp + 0x74]
movzx ebp, byte [rsp + 0x70]
movzx ebx, byte [rsp + 0x6c]
movzx r15d, byte [rsp + 0x68]
movzx r12d, byte [rsp + 0x64]
movzx r13d, byte [rsp + 0x60]
mov eax, 0x76c
movzx r8d, r13b
mov dword [rsp + 0x40], r8d
add r14w, ax
movzx r9d, r14w
lea r8, str.ESET__02d_02d_02d__02d_02d_02d_
mov eax, 0x51eb851f
movzx r10d, r12b
mul r9d
mov dword [rsp + 0x38], r10d
inc bpl
shr edx, 5
imul eax, edx, 0x64
mov edx, 0x32
movzx r11d, r15b
mov dword [rsp + 0x30], r11d
movzx ecx, bpl
movzx ebx, bl
mov dword [rsp + 0x28], ebx
sub r9d, eax
mov dword [rsp + 0x20], ecx
lea rcx, [rsp + 0x90]
call fcn.180059490
mov r15, qword [rsp + 0x110]
lea rax, [rsp + 0x90]
mov r14, qword [rsp + 0x118]
mov rdx, 0xffffffffffffffff
mov r13, qword [rsp + 0x150]
mov r12, qword [rsp + 0x148]
inc rdx
cmp word [rax + rdx*2], si
jne 0x180037236
mov r8, qword [rdi + 0x18]
mov rcx, qword [rdi + 0x10]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x180037281
lea rbp, [rcx + rdx]
mov rbx, rdi
mov qword [rdi + 0x10], rbp
cmp r8, 7
jbe 0x180037266
mov rbx, qword [rdi]
lea r8, [rdx + rdx]
lea rdx, [rsp + 0x90]
lea rcx, [rbx + rcx*2]
call fcn.180100680
mov word [rbx + rbp*2], si
jmp 0x18003729f
lfence
movzx r8d, byte [rsp + 0x50]
lea r9, [rsp + 0x90]
mov rcx, rdi
mov qword [rsp + 0x20], rdx
call fcn.180020e80
cmp qword [rdi + 0x18], 7
mov r8, rdi
mov rbp, qword [rsp + 0x140]
jbe 0x1800372b4
mov r8, qword [rdi]
mov rdx, qword [rsp + 0x160]
mov rcx, qword [0x18014e790]
call fcn.180043a10
test al, al
je case.default.0x180036f8d
cmp qword [rdi + 0x18], 7
mov rcx, rdi
jbe 0x1800372dd
mov rcx, qword [rdi]
call fcn.180054190
test eax, eax
je 0x180037338
mov rcx, qword [0x1801491d8]
lea rax, [0x1801491d8]
cmp rcx, rax
je case.default.0x180036f8d
test byte [rcx + 0x1c], 0x10
je case.default.0x180036f8d
cmp byte [rcx + 0x19], 2
jb case.default.0x180036f8d
cmp qword [rdi + 0x18], 7
jbe 0x18003731b
mov rdi, qword [rdi]
mov rcx, qword [rcx + 0x10]
lea r8, [0x180123218]
mov edx, 0xf2
mov r9, rdi
call fcn.18001fa10
jmp case.default.0x180036f8d
mov eax, 4
jmp 0x18003707d