Function at 0x14003bbd0
Capabilities:
Get common file path
Print debug messages

Disassembly:
push rbp
push rsi
push rdi
push r13
push r14
lea rbp, [rsp - 0x1800]
mov eax, 0x1900
call fcn.14026e690
sub rsp, rax
mov rax, qword [0x1403ddfb8]
xor rax, rsp
mov qword [rbp + 0x17f0], rax
mov rdi, rcx
xor r13d, r13d
mov qword [rcx + 0x10], r13
xor edx, edx
lea rcx, [rbp - 0x30]
mov r8d, 0x20c
call fcn.14028e7e0
mov r14, qword [rdi]
or rsi, 0xffffffffffffffff
inc rsi
cmp word [r14 + rsi*2], r13w
jne 0x14003bc20
cmp rsi, 0x104
jb 0x14003bc3d
mov eax, 0x57
jmp 0x14003c041
mov qword [rsp + 0x1938], rbx
mov qword [rsp + 0x1940], r12
xor r12b, r12b
mov qword [rsp + 0x1948], r15
cmp rsi, 2
jbe 0x14003bc8b
cmp word [r14], 0x5c
je 0x14003bc8b
cmp word [r14 + 2], 0x3a
je 0x14003bc8b
mov r9d, 0x106
lea r8, [rbp - 0x30]
mov rdx, r14
xor ecx, ecx
call fcn.14003b9e0
test al, al
je 0x14003bc8e
lea r14, [rbp - 0x30]
jmp 0x14003bc8e
mov r12b, 1
lea r15, [rsi + 0x106]
lea rbx, [r15 + r15]
mov rcx, rbx
call fcn.14029de2c
mov qword [rdi + 0x10], rax
test rax, rax
je 0x14003bd0f
mov r8, rbx
xor edx, edx
mov rcx, rax
call fcn.14028e7e0
sub r15, 2
cmp r14, qword [rdi]
jne 0x14003bd97
test r12b, r12b
jne 0x14003bd97
mov rdx, qword [rdi + 0x10]
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ebx, eax
test eax, eax
je 0x14003bd97
lea rax, [rbx + rsi]
cmp rax, r15
jbe 0x14003bd5e
mov rcx, qword [rdi + 0x10]
call fcn.140290594
lea r14, [rbx*2 + 0x20c]
mov rcx, r14
call fcn.14029de2c
mov qword [rdi + 0x10], rax
test rax, rax
jne 0x14003bd19
mov eax, 8
jmp 0x14003c029
mov r8, r14
xor edx, edx
mov rcx, rax
mov r15, rbx
call fcn.14028e7e0
mov rdx, qword [rdi + 0x10]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ebx, eax
test eax, eax
je 0x14003bd57
cmp rbx, r15
jbe 0x14003bd57
mov rcx, qword [rdi + 0x10]
call fcn.140290594
mov eax, 3
mov qword [rdi + 0x10], r13
jmp 0x14003c029
add r15, 0x104
mov rax, qword [rdi + 0x10]
mov ecx, 0x5c
mov word [rax + rbx*2], cx
mov rdx, qword [rdi + 0x10]
mov rcx, qword [rdi]
add rdx, 2
lea rdx, [rdx + rbx*2]
nop word [rax + rax]
movzx eax, word [rcx]
lea rcx, [rcx + 2]
mov word [rdx], ax
lea rdx, [rdx + 2]
test ax, ax
jne 0x14003bd80
mov r14, qword [rdi + 0x10]
xor edx, edx
mov byte [rsp + 0x30], r13b
lea rcx, [rsp + 0x38]
mov dword [rsp + 0x34], r13d
mov qword [rbp - 0x50], r14
lea r8d, [rdx + 0x78]
call fcn.14028e7e0
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140044850
mov ebx, eax
cmp byte [rsp + 0x30], r13b
je 0x14003bdfe
lea r8, [rsp + 0x58]
mov dword [rbp - 0x40], 0xaac56b
lea rdx, [rbp - 0x40]
mov dword [rbp - 0x3c], 0x11d0cd44
xor ecx, ecx
mov dword [rbp - 0x38], 0xc000c28c
mov dword [rbp - 0x34], 0xee95c24f
mov dword [rbp - 0x78], 2
call qword [sym.imp.WINTRUST.dll_WinVerifyTrust]
cmp ebx, 2
je 0x14003be0f
cmp ebx, 0x80092003
jne 0x14003bf5e
test r12b, r12b
jne 0x14003bf5e
lea rcx, str.NotComDllGetInterface:_DLL_not_found_in_install_location__looking_in_current_directory_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rdi + 0x10]
lea r8, [r15 + r15]
xor edx, edx
call fcn.14028e7e0
mov rdx, qword [rdi + 0x10]
mov r8d, r15d
mov rcx, qword [rdi + 8]
mov r14, r13
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov r12d, eax
test eax, eax
je 0x14003bf5e
lea rax, [r12 + rsi]
cmp rax, r15
jb 0x14003bec2
mov rcx, qword [rdi + 0x10]
lea rbx, [rax*2 + 0x20c]
call fcn.140290594
mov rcx, rbx
call fcn.14029de2c
mov qword [rdi + 0x10], rax
test rax, rax
jne 0x14003be86
lea ebx, [rax + 8]
jmp 0x14003bf8a
mov r8, rbx
xor edx, edx
mov rcx, rax
call fcn.14028e7e0
mov rdx, qword [rdi + 0x10]
lea rbx, [r12 + 0x104]
mov rcx, qword [rdi + 8]
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, eax
test rax, rax
je 0x14003bec2
cmp rax, rbx
jb 0x14003bec2
mov ebx, 8
jmp 0x14003bf8a
mov rcx, qword [rdi + 0x10]
mov edx, 0x5c
call fcn.14028e070
test rax, rax
je 0x14003bef3
mov rcx, qword [rdi]
lea rdx, [rax + 2]
nop dword [rax]
movzx eax, word [rcx]
lea rcx, [rcx + 2]
mov word [rdx], ax
lea rdx, [rdx + 2]
test ax, ax
jne 0x14003bee0
mov r14, qword [rdi + 0x10]
lea rcx, [rsp + 0x38]
xor edx, edx
mov byte [rsp + 0x30], r13b
mov dword [rsp + 0x34], r13d
mov qword [rbp - 0x50], r14
lea r8d, [rdx + 0x78]
call fcn.14028e7e0
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140044850
mov ebx, eax
cmp byte [rsp + 0x30], r13b
je 0x14003bf5e
lea r8, [rsp + 0x58]
mov dword [rbp - 0x40], 0xaac56b
lea rdx, [rbp - 0x40]
mov dword [rbp - 0x3c], 0x11d0cd44
xor ecx, ecx
mov dword [rbp - 0x38], 0xc000c28c
mov dword [rbp - 0x34], 0xee95c24f
mov dword [rbp - 0x78], 2
call qword [sym.imp.WINTRUST.dll_WinVerifyTrust]
cmp ebx, 0x80092026
je 0x14003c014
cmp ebx, 0x800b0101
je 0x14003c014
cmp ebx, 0x800b010e
je 0x14003c014
test ebx, ebx
je 0x14003c014
xor edx, edx
lea rcx, [rbp + 0x1e0]
mov r8d, 0x800
call fcn.14028e7e0
xor edx, edx
lea rcx, [rbp + 0x9e0]
mov r8d, 0xe08
call fcn.14028e7e0
mov r8d, 0x400
lea rdx, [rbp + 0x1e0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test r14, r14
jne 0x14003bfcf
mov r14, qword [rdi]
mov r9, r14
mov dword [rsp + 0x20], ebx
lea r8, [rbp + 0x1e0]
lea rdx, str.NotComDllGetInterface:__s_loading__s__WinVerifyTrust_failed_with__08x_n
lea rcx, [rbp + 0x9e0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x9e0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x14003c010
call fcn.140290594
mov qword [rdi + 0x10], r13
mov eax, ebx
jmp 0x14003c029
xor edx, edx
mov rcx, r14
lea r8d, [rdx + 8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [rdi + 0x18], rax
xor eax, eax
mov r12, qword [rsp + 0x1940]
mov rbx, qword [rsp + 0x1938]
mov r15, qword [rsp + 0x1948]
mov rcx, qword [rbp + 0x17f0]
xor rcx, rsp
call fcn.14026d870
add rsp, 0x1900
pop r14
pop r13
pop rdi
pop rsi
pop rbp
ret