Function at 0x18004c610
Capabilities:
Get common file path

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x2a8
mov dword [rsp + 0x60], 0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x74], eax
mov eax, 2
imul rax, rax, 0
mov ecx, 0x3f
mov rdx, qword [rsp + 0x2b8]
mov word [rdx + rax], cx
mov eax, 2
imul rax, rax, 1
xor ecx, ecx
mov rdx, qword [rsp + 0x2b8]
mov word [rdx + rax], cx
cmp qword [rsp + 0x2b0], 0
je 0x18004ca6e
mov rcx, qword [rsp + 0x2b0]
call fcn.18003eff0
mov qword [rsp + 0x78], rax
cmp qword [rsp + 0x78], 0
je 0x18004ca6e
mov byte [rsp + 0x34], 0
xor eax, eax
mov word [rsp + 0x30], ax
mov rax, qword [rsp + 0x78]
add rax, 0x20
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x20], rcx
mov r9d, 8
lea r8, [rsp + 0x68]
mov rdx, rax
mov rcx, qword [rsp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x18004c859
cmp qword [rsp + 0x48], 8
jne 0x18004c859
cmp qword [rsp + 0x68], 0
je 0x18004c859
mov rax, qword [rsp + 0x68]
add rax, 8
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x20], rcx
mov r9d, 4
lea r8, [rsp + 0x70]
mov rdx, rax
mov rcx, qword [rsp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x18004c859
cmp qword [rsp + 0x48], 4
jne 0x18004c859
mov rax, qword [rsp + 0x68]
add rax, 0x70
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x20], rcx
mov r9d, 0x10
lea r8, [rsp + 0x50]
mov rdx, rax
mov rcx, qword [rsp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x18004c859
cmp qword [rsp + 0x48], 0x10
jne 0x18004c859
movzx eax, word [rsp + 0x50]
test eax, eax
je 0x18004c859
cmp qword [rsp + 0x58], 0
je 0x18004c859
movzx eax, word [rsp + 0x50]
mov ecx, dword [rsp + 0x2c0]
add ecx, ecx
cmp eax, ecx
jb 0x18004c7d7
movzx eax, word [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
add rcx, rax
mov rax, rcx
mov ecx, dword [rsp + 0x2c0]
lea ecx, [rcx + rcx - 2]
mov ecx, ecx
sub rax, rcx
mov qword [rsp + 0x58], rax
mov eax, dword [rsp + 0x2c0]
lea eax, [rax + rax - 2]
mov word [rsp + 0x50], ax
mov eax, dword [rsp + 0x70]
and eax, 1
test eax, eax
jne 0x18004c7f7
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
movzx eax, word [rsp + 0x50]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x20], rcx
mov r9d, eax
mov r8, qword [rsp + 0x2b8]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x18004c83e
movzx eax, word [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jne 0x18004c83e
mov dword [rsp + 0x64], 1
jmp 0x18004c846
mov dword [rsp + 0x64], 0
movzx eax, byte [rsp + 0x64]
mov byte [rsp + 0x34], al
movzx eax, word [rsp + 0x50]
mov word [rsp + 0x30], ax
movzx eax, byte [rsp + 0x34]
test eax, eax
je 0x18004ca6e
movzx eax, word [rsp + 0x30]
cdq
sub eax, edx
sar eax, 1
cdqe
xor ecx, ecx
mov rdx, qword [rsp + 0x2b8]
mov word [rdx + rax*2], cx
mov eax, 2
imul rax, rax, 4
mov rcx, qword [rsp + 0x2b8]
movzx eax, word [rcx + rax]
mov word [rsp + 0x38], ax
mov eax, 2
imul rax, rax, 4
xor ecx, ecx
mov rdx, qword [rsp + 0x2b8]
mov word [rdx + rax], cx
mov rdx, qword [rsp + 0x2b8]
lea rcx, [0x18007cec0]
call fcn.180052ca8
mov dword [rsp + 0x40], eax
mov eax, 2
imul rax, rax, 4
mov rcx, qword [rsp + 0x2b8]
movzx edx, word [rsp + 0x38]
mov word [rcx + rax], dx
cmp dword [rsp + 0x40], 0
jne 0x18004c923
movzx eax, word [rsp + 0x30]
sub eax, 6
cdqe
mov ecx, 2
imul rcx, rcx, 4
mov rdx, qword [rsp + 0x2b8]
add rdx, rcx
mov rcx, rdx
mov r8, rax
mov rdx, rcx
mov rcx, qword [rsp + 0x2b8]
call fcn.180052e30
jmp 0x18004ca66
mov eax, 2
imul rax, rax, 0xc
mov rcx, qword [rsp + 0x2b8]
movzx eax, word [rcx + rax]
mov word [rsp + 0x38], ax
mov eax, 2
imul rax, rax, 0xc
xor ecx, ecx
mov rdx, qword [rsp + 0x2b8]
mov word [rdx + rax], cx
mov rdx, qword [rsp + 0x2b8]
lea rcx, str.SystemRoot_
call fcn.180052ca8
mov dword [rsp + 0x40], eax
mov eax, 2
imul rax, rax, 0xc
mov rcx, qword [rsp + 0x2b8]
movzx edx, word [rsp + 0x38]
mov word [rcx + rax], dx
cmp dword [rsp + 0x40], 0
jne 0x18004ca66
mov edx, 0x104
lea rcx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov dword [rsp + 0x3c], eax
movzx eax, word [rsp + 0x30]
xor edx, edx
mov ecx, 2
div ecx
mov ecx, dword [rsp + 0x3c]
lea eax, [rax + rcx - 0xa]
cmp eax, dword [rsp + 0x2c0]
jb 0x18004c9f6
mov eax, dword [rsp + 0x2c0]
add eax, 0xa
sub eax, dword [rsp + 0x3c]
shl eax, 1
mov word [rsp + 0x30], ax
movzx eax, word [rsp + 0x30]
cdq
sub eax, edx
sar eax, 1
cdqe
xor ecx, ecx
mov rdx, qword [rsp + 0x2b8]
mov word [rdx + rax*2], cx
movzx eax, word [rsp + 0x30]
sub eax, 0x14
cdqe
mov ecx, 2
imul rcx, rcx, 0xb
mov rdx, qword [rsp + 0x2b8]
add rdx, rcx
mov rcx, rdx
movsxd rdx, dword [rsp + 0x3c]
mov r8, qword [rsp + 0x2b8]
lea rdx, [r8 + rdx*2]
mov qword [rsp + 0x80], rdx
mov r8, rax
mov rdx, rcx
mov rax, qword [rsp + 0x80]
mov rcx, rax
call fcn.180052e30
mov eax, dword [rsp + 0x3c]
shl eax, 1
cdqe
mov r8, rax
lea rdx, [rsp + 0x90]
mov rcx, qword [rsp + 0x2b8]
call fcn.180052e30
mov dword [rsp + 0x60], 1
mov ecx, dword [rsp + 0x74]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rsp + 0x60]
add rsp, 0x2a8
ret