Function at 0x140061920
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x4e8]
sub rsp, 0x5c0
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1400f3080]
xor rax, rsp
mov qword [rbp + 0x4b0], rax
mov r13, rdx
mov rbx, rcx
mov qword [rsp + 0x50], rdx
xor r12d, r12d
mov dword [rsp + 0x20], r12d
xor edx, edx
mov r8d, 0x180
lea rcx, [rbp - 0x60]
call fcn.14008a450
lea rcx, [rbp - 0x60]
call fcn.14003ca90
nop
xor edx, edx
mov r8d, 0x180
lea rcx, [rbp + 0x120]
call fcn.14008a450
lea rcx, [rbp + 0x120]
call fcn.14003ca90
nop
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x2a0]
call fcn.14008a450
mov edx, 0x104
lea rcx, [rbp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], r12w
lea rdx, [rbp + 0x2a0]
lea rcx, [rsp + 0x60]
call fcn.140004c64
nop
cmp byte [rbx], r12b
je 0x140061b66
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x68], 7
mov word [rbp - 0x80], r12w
mov dword [rsp + 0x20], 2
mov r8, qword [rsp + 0x70]
lea rax, [r8 + 0x13]
cmp rax, 8
jb 0x140061adc
movabs rbx, 0x7ffffffffffffffe
cmp rax, rbx
ja 0x140061f08
or rax, 7
cmp rax, rbx
ja 0x140061a5c
mov rbx, rax
mov r14d, 0xa
cmp rax, r14
cmovb rbx, r14
lea rax, [rbx + 1]
lea rdx, [rax + rax]
mov rsi, 0xffffffffffffffff
movabs r15, 0x7fffffffffffffff
cmp rax, r15
jbe 0x140061a7f
mov rdx, rsi
jmp 0x140061a88
cmp rdx, 0x1000
jb 0x140061aaf
lea rcx, [rdx + 0x27]
cmp rcx, rdx
cmovbe rcx, rsi
call fcn.14006bb2c
test rax, rax
je 0x140061f0e
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x140061ac4
test rdx, rdx
je 0x140061ac1
mov rcx, rdx
call fcn.14006bb2c
mov rcx, rax
jmp 0x140061ac4
mov rcx, r12
mov qword [rbp - 0x68], rbx
movzx eax, word [rbp - 0x80]
mov word [rcx], ax
mov qword [rbp - 0x80], rcx
mov qword [rbp - 0x70], r12
mov r8, qword [rsp + 0x70]
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
lea rcx, [rbp - 0x80]
call fcn.140009530
mov r8d, 0x13
lea rdx, str.System32_ntdll.dll
lea rcx, [rbp - 0x80]
call fcn.140009530
mov r8b, 1
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x60]
call fcn.14003ccf0
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x140061e46
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061b5c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140061f14
call fcn.14006bb24
jmp 0x140061e46
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
movzx eax, byte [rbx + 1]
mov qword [rbp - 0x80], r12
mov byte [rbp - 0x78], al
test al, al
je 0x140061b87
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
nop
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], r12w
mov dword [rsp + 0x20], 4
mov r8, qword [rsp + 0x70]
lea rdi, [r8 + 0x13]
movabs rbx, 0x7ffffffffffffffe
mov rsi, 0xffffffffffffffff
lea r14d, [rsi + 0xb]
movabs r15, 0x7fffffffffffffff
cmp rdi, 8
jb 0x140061c66
cmp rdi, rbx
ja 0x140061f1a
or rdi, 7
cmp rdi, rbx
jbe 0x140061bec
mov rdi, rbx
jmp 0x140061bf3
cmp rdi, r14
cmovb rdi, r14
lea rax, [rdi + 1]
lea rdx, [rax + rax]
cmp rax, r15
jbe 0x140061c05
mov rdx, rsi
jmp 0x140061c0e
cmp rdx, 0x1000
jb 0x140061c35
lea rcx, [rdx + 0x27]
cmp rcx, rdx
cmovbe rcx, rsi
call fcn.14006bb2c
test rax, rax
je 0x140061f20
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x140061c4a
test rdx, rdx
je 0x140061c47
mov rcx, rdx
call fcn.14006bb2c
mov rcx, rax
jmp 0x140061c4a
mov rcx, r12
mov qword [rsp + 0x40], rdi
movzx eax, word [rsp + 0x28]
mov word [rcx], ax
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x38], r12
mov r8, qword [rsp + 0x70]
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x28]
call fcn.140009530
mov r8d, 0x13
lea rdx, str.System32_ntdll.dll
lea rcx, [rsp + 0x28]
call fcn.140009530
mov r8b, 1
lea rdx, [rsp + 0x28]
lea rcx, [rbp + 0x120]
call fcn.14003ccf0
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x140061cf0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061cea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140061f26
call fcn.14006bb24
nop
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], r12w
mov dword [rsp + 0x20], 8
mov r8, qword [rsp + 0x70]
lea rax, [r8 + 0x13]
cmp rax, 8
jb 0x140061daf
cmp rax, rbx
ja 0x140061f2c
or rax, 7
cmp rax, rbx
ja 0x140061d3c
mov rbx, rax
cmp rax, 0xa
cmovb rbx, r14
lea rax, [rbx + 1]
lea rdx, [rax + rax]
cmp rax, r15
jbe 0x140061d4e
mov rdx, rsi
jmp 0x140061d57
cmp rdx, 0x1000
jb 0x140061d7e
lea rcx, [rdx + 0x27]
cmp rcx, rdx
cmovbe rcx, rsi
call fcn.14006bb2c
test rax, rax
je 0x140061f32
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x140061d93
test rdx, rdx
je 0x140061d90
mov rcx, rdx
call fcn.14006bb2c
mov rcx, rax
jmp 0x140061d93
mov rcx, r12
mov qword [rsp + 0x40], rbx
movzx eax, word [rsp + 0x28]
mov word [rcx], ax
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x38], r12
mov r8, qword [rsp + 0x70]
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x28]
call fcn.140009530
mov r8d, 0x13
lea rdx, str.SysWOW64_ntdll.dll
lea rcx, [rsp + 0x28]
call fcn.140009530
mov r8b, 1
lea rdx, [rsp + 0x28]
lea rcx, [rbp - 0x60]
call fcn.14003ccf0
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x140061e36
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061e30
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140061f38
call fcn.14006bb24
nop
cmp byte [rbp - 0x78], 0
je 0x140061e46
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
lea rdx, [rbp - 0x60]
mov rcx, r13
call fcn.140061f40
nop
lea rcx, [r13 + 0x180]
lea rdx, [rbp + 0x120]
call fcn.140061f40
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x140061ea5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061ea0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140061f02
call fcn.14006bb24
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], r12w
lea rcx, [rbp + 0x120]
call fcn.14003cba0
nop
lea rcx, [rbp - 0x60]
call fcn.14003cba0
mov rax, r13
mov rcx, qword [rbp + 0x4b0]
xor rcx, rsp
call fcn.14006bb00
lea r11, [rsp + 0x5c0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140095014
nop
call fcn.14000951c
int3
call fcn.140095014
nop
call fcn.140095014
nop
call fcn.14000951c
int3
call fcn.140095014
nop
call fcn.140095014
nop
call fcn.14000951c
int3
call fcn.140095014
nop
call fcn.140095014
int3