Function at 0x180083d60
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x460]
sub rsp, 0x560
mov rax, qword [0x1800c37a8]
xor rax, rsp
mov qword [rbp + 0x450], rax
movzx ebx, byte [rsp + 0x30]
lea r15d, [rcx + 0xa]
mov qword [rbp - 0x40], r8
mov r13, r8
mov qword [rsp + 0x40], rdx
mov r14d, ecx
mov dword [rsp + 0x3c], ecx
mov dword [rsp + 0x34], 0
mov dword [rsp + 0x5c], r15d
cmp ecx, r15d
jae 0x1800846bc
mov edi, dword [rsp + 0x60]
movzx r12d, byte [rsp + 0x30]
mov rsi, qword [rsp + 0x48]
mov qword [rbp - 0x60], rdi
lea eax, [r14 - 0x73]
mov r9d, 0x16
lea r10, [0x180000000]
movabs r8, 0x7fffffffffffffff
cmp eax, 0xa
ja case.0x180083e04.124
mov ecx, dword [r10 + rax*4 + 0x846fc]
add rcx, r10
jmp rcx
cmp qword [rdx + 0x10], 0x35
mov qword [rsp + 0x48], 0xffffffffffffffff
jb 0x1800842ea
xor r13d, r13d
nop dword [rax]
cmp r13d, 0x2a
ja case.0x180083e3e.7
movzx eax, byte [r10 + r13 + 0x84748]
mov ecx, dword [r10 + rax*4 + 0x84728]
add rcx, r10
jmp rcx
mov rax, qword [rdx + 0x10]
mov qword [rbp], ILFindLastID
mov byte [rbp - 0x18], 0
cmp rax, 0x11
jb 0x1800846ef
add rax, 0xffffffffffffffef
mov r14d, 0x24
cmp rax, r14
cmovb r14, rax
cmp qword [rdx + 0x18], 0x10
mov rax, rdx
jb 0x180083e78
mov rax, qword [rdx]
lea r15, [rax + 0x11]
cmp r14, 0xf
ja 0x180083ea0
mov r8, r14
mov qword [rbp - 8], r14
mov rdx, r15
lea rcx, [rbp - 0x18]
call sub.VCRUNTIME140.dll_memmove
mov byte [rbp + r14 - 0x18], 0
jmp 0x180083f2b
cmp r14, r8
ja 0x1800846e9
mov rsi, r14
or rsi, 0xf
cmp rsi, r8
jbe 0x180083eba
mov rsi, r8
jmp 0x180083ec2
cmp rsi, 0x16
cmovb rsi, r9
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x180083efb
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1800846f5
mov rcx, rax
call fcn.1800a103c
test rax, rax
je 0x1800846b1
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x180083f0c
test rcx, rcx
je 0x180083f0a
call fcn.1800a103c
mov rdi, rax
jmp 0x180083f0c
xor edi, edi
mov r8, r14
mov qword [rbp - 8], r14
mov rdx, r15
mov qword [rbp], rsi
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r14], 0
mov qword [rbp - 0x18], rdi
or dword [rsp + 0x34], 1
lea rdx, [rbp - 0x18]
lea rcx, [0x1800c2ef8]
call fcn.180003f90
mov rdx, qword [rbp]
cmp rdx, 0x10
jb 0x180083f7b
mov rcx, qword [rbp - 0x18]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180083f76
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800846b1
call fcn.1800a1078
mov edx, dword [rsp + 0x70]
lea r8, [rbp - 0x48]
lea rcx, [rbp + 0x40]
call qword [sym.imp.ADVAPI32.dll_QueryAllTracesW]
movzx eax, byte [rsp + 0x31]
xor ecx, ecx
cmp dword [rsp + 0x50], ecx
cmove ecx, eax
mov byte [rsp + 0x31], cl
jmp 0x1800842a6
lea r9, [rbp - 0x78]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call sub.RPCRT4.dll_MesEncodeIncrementalHandleCreate
mov dword [rsp + 0x50], eax
jmp 0x1800842a6
mov byte [rsp + 0x31], 1
jmp case.0x180083e3e.7
mov rax, qword [rdx + 0x10]
mov qword [rbp], ILFindLastID
mov byte [rbp - 0x18], 0
cmp rax, 0xb
jb 0x1800846ef
add rax, 0xfffffffffffffff5
mov r14d, 6
cmp rax, r14
cmovb r14, rax
cmp qword [rdx + 0x18], 0x10
mov rax, rdx
jb 0x180083fff
mov rax, qword [rdx]
lea r15, [rax + 0xb]
cmp r14, 0xf
ja 0x180084027
mov r8, r14
mov qword [rbp - 8], r14
mov rdx, r15
lea rcx, [rbp - 0x18]
call sub.VCRUNTIME140.dll_memmove
mov byte [rbp + r14 - 0x18], 0
jmp 0x1800840b2
cmp r14, r8
ja 0x1800846e9
mov rsi, r14
or rsi, 0xf
cmp rsi, r8
jbe 0x180084041
mov rsi, r8
jmp 0x180084049
cmp rsi, 0x16
cmovb rsi, r9
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x180084082
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1800846f5
mov rcx, rax
call fcn.1800a103c
test rax, rax
je 0x1800846b1
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x180084093
test rcx, rcx
je 0x180084091
call fcn.1800a103c
mov rdi, rax
jmp 0x180084093
xor edi, edi
mov r8, r14
mov qword [rbp - 8], r14
mov rdx, r15
mov qword [rbp], rsi
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r14], 0
mov qword [rbp - 0x18], rdi
or dword [rsp + 0x34], 2
lea rdx, [rbp - 0x18]
lea rcx, [0x1800c2f38]
call fcn.180003f90
mov rdx, qword [rbp]
cmp rdx, 0x10
jb 0x180084102
mov rcx, qword [rbp - 0x18]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800840fd
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800846b1
call fcn.1800a1078
mov dword [rsp + 0x70], 0x40
jmp 0x1800842a6
mov r14d, ILFindLastID
mov qword [rbp], ILFindLastID
cmp qword [rdx + 0x10], r14
mov r15, rdx
mov byte [rbp - 0x18], 0
cmovb r14, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x180084137
mov r15, qword [rdx]
cmp r14, 0xf
ja 0x18008415b
mov r8, r14
mov qword [rbp - 8], r14
mov rdx, r15
lea rcx, [rbp - 0x18]
call sub.VCRUNTIME140.dll_memmove
mov byte [rbp + r14 - 0x18], 0
jmp 0x1800841e6
cmp r14, r8
ja 0x1800846e9
mov rsi, r14
or rsi, 0xf
cmp rsi, r8
jbe 0x180084175
mov rsi, r8
jmp 0x18008417d
cmp rsi, 0x16
cmovb rsi, r9
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x1800841b6
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1800846f5
mov rcx, rax
call fcn.1800a103c
test rax, rax
je 0x1800846b1
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1800841c7
test rcx, rcx
je 0x1800841c5
call fcn.1800a103c
mov rdi, rax
jmp 0x1800841c7
xor edi, edi
mov r8, r14
mov qword [rbp - 8], r14
mov rdx, r15
mov qword [rbp], rsi
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r14], 0
mov qword [rbp - 0x18], rdi
or dword [rsp + 0x34], 4
lea rdx, [rbp - 0x18]
lea rcx, [0x1800c2f18]
call fcn.180003f90
mov rdx, qword [rbp]
cmp rdx, 0x10
jb 0x180084236
mov rcx, qword [rbp - 0x18]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180084231
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800846b1
call fcn.1800a1078
xor edx, edx
lea rcx, [rbp + 0x40]
mov r8d, 0x200
call sub.VCRUNTIME140.dll_memset
mov qword [rbp - 0x78], 0
jmp 0x1800842a6
cmp byte [rsp + 0x31], 0
je case.0x180083e3e.7
mov edi, 0xbd
nop dword [rax]
mov eax, edi
sub eax, 0xbd
je 0x180084274
cmp eax, 0x7e
jne 0x18008429b
mov rcx, qword [rbp - 0x80]
jmp 0x180084291
lea r8, [rbp - 0x80]
mov qword [rbp - 0x80], 0
xor edx, edx
xor ecx, ecx
call sub.RPCRT4.dll_MesDecodeIncrementalHandleCreate
mov rcx, qword [rbp - 0x78]
mov dword [rsp + 0x50], eax
test rcx, rcx
je 0x18008429b
call sub.RPCRT4.dll_MesHandleFree
add edi, 0x7e
cmp edi, 0x1b9
jb 0x180084260
mov rdx, qword [rsp + 0x40]
lea r10, [0x180000000]
movabs r8, 0x7fffffffffffffff
mov r9d, 0x16
add r13d, 7
lea eax, [r13 + 0xa3]
cmp eax, 0xd4
jb 0x180083e20
mov rdi, qword [rbp - 0x60]
mov r14d, dword [rsp + 0x3c]
mov r15d, dword [rsp + 0x5c]
mov r13, qword [rbp - 0x40]
mov rsi, qword [rsp + 0x48]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 8], xmm0
mov qword [rbp + 0x28], rax
movups xmmword [rbp + 0x18], xmm0
mov dword [rbp + 0x30], eax
jmp case.0x180083e04.124
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.dbghelp.dll_SymInitialize]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x60], 0
jmp case.0x180083e04.124
mov r12b, 1
jmp case.0x180083e04.124
mov byte [rsp + 0x32], 1
mov qword [rbp - 0x30], 0
jmp case.0x180083e04.124
cmp byte [rsp + 0x32], 0
je case.0x180083e04.124
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.GDI32.dll_DeleteObject]
jmp case.0x180083e04.124
movzx eax, byte [rsp + 0x32]
xor ecx, ecx
cmp qword [rbp - 0x50], rcx
cmovne ecx, eax
mov byte [rsp + 0x32], cl
jmp case.0x180083e04.124
mov r15d, 0x48
mov dword [rsp + 0x68], r15d
nop dword [rax]
mov eax, r15d
sub eax, 0x47
je 0x1800846bc
cmp eax, 1
jne 0x180084610
test r12b, r12b
je 0x18008460e
movzx r15d, byte [rsp + 0x30]
mov r14d, 0xde
nop word [rax + rax]
cmp r14d, 0xde
je 0x1800845e0
cmp r14d, 0x8ac0
je 0x1800845c6
cmp r14d, 0x114a2
je 0x180084439
cmp r14d, 0x19e84
jne 0x1800845f5
movzx eax, byte [rsp + 0x33]
xor ecx, ecx
cmp dword [rsp + 0x74], ecx
cmove ecx, eax
mov byte [rsp + 0x33], cl
cmp cl, 0
je 0x180084411
mov r8d, dword [rsp + 0x54]
lea r9, [rbp + 0x240]
mov rdx, qword [rbp - 0x58]
mov ecx, dword [rsp + 0x58]
call qword [sym.imp.SHELL32.dll_SHSetFolderPathW]
test r12b, r12b
je 0x1800845f5
mov rcx, qword [rsp + 0x48]
lea rdx, [rbp + 0x40]
call qword [sym.imp.dbghelp.dll_SymSetSearchPath]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.dbghelp.dll_SymCleanup]
jmp 0x1800845f5
mov rbx, qword [rsp + 0x48]
lea rdx, [rbp + 0x40]
mov r8d, dword [rsp + 0x7c]
mov rcx, rbx
call qword [sym.imp.dbghelp.dll_SymGetSearchPath]
mov r9d, dword [rsp + 0x54]
mov r8, qword [rbp - 0x58]
mov edx, dword [rsp + 0x58]
mov rcx, qword [rbp - 0x38]
mov dword [rsp + 0x38], eax
lea rax, [rbp + 0x240]
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp dword [rsp + 0x38], 0
mov dword [rsp + 0x74], eax
jne 0x1800845f5
mov esi, 0x95
nop dword [rax + rax]
cmp esi, 0x95
je 0x180084581
cmp esi, 0x6e01
je 0x180084567
cmp esi, 0xdb6d
je 0x180084554
cmp esi, 0x148d9
je 0x18008452f
cmp esi, 0x1b645
jne 0x1800845ad
test r15b, r15b
je 0x18008452a
mov ebx, 0x115
cmp ebx, 0x115
je 0x18008450f
cmp ebx, 0x65b6
jne 0x180084517
lea r8, [rbp - 0x70]
mov edx, edi
lea rcx, [rbp - 0x18]
call sub.RPCRT4.dll_MesDecodeBufferHandleCreate
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x1800844ff
call sub.RPCRT4.dll_MesHandleFree
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x180084517
call sub.RPCRT4.dll_MesHandleFree
jmp 0x180084517
mov qword [rbp - 0x70], 0
add ebx, 0x64a1
cmp ebx, 0xc942
jbe 0x1800844d2
mov rbx, qword [rsp + 0x48]
xor r12b, r12b
jmp 0x1800845ad
lea r9, [rbp - 0x68]
mov qword [rbp - 0x68], 0
lea r8, [rsp + 0x78]
mov edx, edi
lea rcx, [rbp - 0x18]
call sub.RPCRT4.dll_MesEncodeFixedBufferHandleCreate
test eax, eax
je 0x1800845ad
xor r15b, r15b
jmp 0x1800845ad
mov rcx, rbx
mov dword [rsp + 0x78], 0
call qword [sym.imp.dbghelp.dll_SymCleanup]
jmp 0x1800845ad
lea rax, [rbp - 0x18]
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [rax + rdi], 0
jne 0x180084572
mov qword [rbp - 0x60], rdi
jmp 0x1800845ad
mov eax, dword [0x1800b8258]
mov r15b, 1
movups xmm0, xmmword [str.T4TF5g4NT66aI2kdQ4faqA]
mov dword [rbp - 8], eax
movzx eax, word [0x1800b825c]
mov word [rbp - 4], ax
movzx eax, byte [0x1800b825e]
mov byte [rbp - 2], al
movups xmmword [rbp - 0x18], xmm0
add esi, 0x6d6c
cmp esi, 0x2231c
jbe 0x180084490
mov byte [rsp + 0x30], r15b
jmp 0x1800845f5
mov dword [rsp + 0x7c], 0x104
mov qword [rbp - 0x58], 0
mov dword [rsp + 0x54], 0
jmp 0x1800845f5
mov byte [rsp + 0x33], 1
mov qword [rbp - 0x38], 0
mov dword [rsp + 0x58], 0x36
add r14d, 0x89e2
cmp r14d, 0x22788
jbe 0x1800843b0
mov r15d, dword [rsp + 0x68]
xor bl, bl
dec r15d
mov dword [rsp + 0x68], r15d
cmp r15d, 0x46
ja 0x180084380
mov rsi, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov r14d, dword [rsp + 0x3c]
mov r15d, dword [rsp + 0x5c]
mov rax, qword [r13]
mov r8, rdx
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x68], rax
mov ecx, 0x7b
call fcn.180046e00
jmp case.0x180083e04.124
mov rax, qword [rbp - 0x30]
lea r9, [rbp - 0x20]
mov r8d, dword [rsp + 0x60]
lea rdx, [rbp + 8]
mov rcx, qword [rbp - 0x28]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.GDI32.dll_CreateDIBSection]
xor edx, edx
movzx ecx, r12b
cmp dword [rsp + 0x38], edx
mov qword [rbp - 0x50], rax
cmovne edx, ecx
movzx r12d, dl
jmp case.0x180083e04.124
mov qword [rbp - 0x28], 0
inc r14d
mov dword [rsp + 0x3c], r14d
cmp r14d, r15d
jae 0x1800846bc
mov rdx, qword [rsp + 0x40]
jmp 0x180083dd5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov al, 1
jmp 0x1800846bf
movzx eax, bl
mov rcx, qword [rbp + 0x450]
xor rcx, rsp
call fcn.1800a1820
mov rbx, qword [rsp + 0x5a0]
add rsp, 0x560
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.18001ca30
int3
call fcn.18001ca70
int3
call fcn.18001c8f0
int3