Function at 0x1000b2a6c
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r14
sub rsp, 0x470
mov rax, qword [0x100165138]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov rsi, rcx
mov rdi, r8
lea rcx, [rsp + 0x40]
xor ebx, ebx
xor edx, edx
mov r8d, 0x208
mov qword [rsp + 0x30], rbx
call sub.msvcrt.dll_memset
mov r12d, 0x104
test rdi, rdi
jne 0x1000b2b86
lea rcx, [rsp + 0x40]
mov edx, r12d
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x1000b2b21
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [0x1001653b8]
lea rcx, [0x1001653b8]
cmp rax, rcx
je 0x1000b2b0e
test byte [rax + 0x1c], 2
je 0x1000b2b0e
cmp byte [rax + 0x19], 2
jb 0x1000b2b0e
mov rcx, qword [rax + 0x10]
lea edx, [rdi + 0x59]
lea r8, [0x1000036e8]
mov r9d, ebx
call fcn.10001c7dc
movzx edi, bx
or edi, 0x80070000
test ebx, ebx
cmovle edi, ebx
jmp 0x1000b2d6f
mov ebp, 0x105
lea rcx, [rsp + 0x40]
mov rdx, rsi
mov r8d, ebp
call qword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
test eax, eax
jne 0x1000b2c4d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [0x1001653b8]
lea rcx, [0x1001653b8]
cmp rax, rcx
je 0x1000b2b0e
test byte [rax + 0x1c], 2
je 0x1000b2b0e
cmp byte [rax + 0x19], 2
jb 0x1000b2b0e
mov rcx, qword [rax + 0x10]
lea r9, [rsp + 0x40]
lea r8, [0x1000036e8]
mov edx, 0x5a
mov dword [rsp + 0x20], ebx
call fcn.10001daa4
jmp 0x1000b2b0e
lea r8, [rsp + 0x30]
xor r9d, r9d
xor edx, edx
mov rcx, rdi
call fcn.10009c5ec
mov edi, eax
test eax, eax
jns 0x1000b2bdf
mov rax, qword [0x1001653b8]
lea rcx, [0x1001653b8]
cmp rax, rcx
je 0x1000b2bd5
test byte [rax + 0x1c], 2
je 0x1000b2bd5
cmp byte [rax + 0x19], 2
jb 0x1000b2bd5
mov rcx, qword [rax + 0x10]
lea r8, [0x1000036e8]
mov edx, 0x5b
mov r9d, edi
call fcn.10001c7dc
mov rbx, qword [rsp + 0x30]
jmp 0x1000b2d61
mov rbx, qword [rsp + 0x30]
mov ebp, 0x105
mov rcx, rsi
mov r8, rbx
mov rdx, rbp
call fcn.100043e4c
mov edi, eax
test eax, eax
jns 0x1000b2c4d
mov rax, qword [0x1001653b8]
lea rcx, [0x1001653b8]
cmp rax, rcx
je 0x1000b2d61
test byte [rax + 0x1c], 2
je 0x1000b2d61
cmp byte [rax + 0x19], 2
jb 0x1000b2d61
mov rcx, qword [rax + 0x10]
lea r8, [0x1000036e8]
mov edx, 0x5c
mov r9, rbx
mov dword [rsp + 0x20], 0x103
call fcn.10001daa4
jmp 0x1000b2d61
or r14, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
mov rcx, r14
repne scasw ax, word [rdi]
not rcx
add rcx, 0x18
cmp rcx, r12
jb 0x1000b2c80
lea r8, [0x10000b8a0]
lea rcx, [0x10000b150]
mov edx, 0xb8d
call fcn.100099ad8
lea r8, [0x100002878]
mov rdx, rbp
mov rcx, rsi
call fcn.1000590dc
xor eax, eax
mov rcx, r14
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
add rcx, 0x12
cmp rcx, r12
jb 0x1000b2cc1
lea r8, [0x10000b8e0]
lea rcx, [0x10000b150]
mov edx, 0xb95
call fcn.100099ad8
lea r8, [0x100002954]
mov rdx, rbp
mov rcx, rsi
call fcn.1000590dc
lea r8, [0x1000028b0]
mov rdx, rbp
mov rcx, rsi
call fcn.1000590dc
xor edx, edx
mov rcx, rsi
call fcn.10009ff78
mov edi, eax
test eax, eax
js 0x1000b2d61
xor eax, eax
mov rcx, r14
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
add rcx, 0x10
cmp rcx, r12
jb 0x1000b2d24
lea r8, [0x10000b920]
lea rcx, [0x10000b150]
mov edx, 0xba5
call fcn.100099ad8
lea rax, [0x100002850]
lea r8, [0x10000a840]
lea rcx, [rsp + 0x250]
mov r9, rsi
mov rdx, r12
mov qword [rsp + 0x20], rax
call fcn.100043ec0
mov edi, eax
test eax, eax
js 0x1000b2d61
lea rcx, [rsp + 0x250]
xor edx, edx
call fcn.10009ff78
mov edi, eax
test rbx, rbx
je 0x1000b2d6f
mov rcx, rbx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, edi
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.10014e480
mov rbx, qword [rsp + 0x4a8]
add rsp, 0x470
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret