Function at 0x1400ddebc
Capabilities:
Get common file path

Disassembly:
jmp 0x1401792b0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x3e8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x92
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x408]
mov rax, qword [0x140329a40]
xor rax, rbp
mov qword [rbp + 0x3b8], rax
lea rcx, [0x1403515ac]
call fcn.1400e103a
mov dword [rbp + 4], 0
xor r8d, r8d
lea rdx, str.DeviceLanmanRedirector_
mov rcx, qword [rbp + 0x3e0]
call fcn.1400daaaf
test eax, eax
jne 0x14017938c
lea rdx, [0x1402c38b8]
mov rcx, qword [rbp + 0x3e8]
call fcn.1400dfd2f
mov r8d, 0x19
lea rdx, [rbp + 0x218]
mov rcx, qword [rbp + 0x3e0]
call fcn.1400de119
mov qword [rbp + 0x3a8], rax
mov rax, qword [rbp + 0x3a8]
mov qword [rbp + 0x3b0], rax
mov rdx, qword [rbp + 0x3b0]
mov rcx, qword [rbp + 0x3e8]
call fcn.1400ddb83
nop
lea rcx, [rbp + 0x218]
call fcn.1400dbf6d
mov dword [rbp + 4], 1
jmp 0x1401797e6
xor r8d, r8d
lea rdx, str.DeviceMup_
mov rcx, qword [rbp + 0x3e0]
call fcn.1400daaaf
test eax, eax
jne 0x140179413
lea rdx, [0x1402c38b8]
mov rcx, qword [rbp + 0x3e8]
call fcn.1400dfd2f
mov r8d, 0xc
lea rdx, [rbp + 0x238]
mov rcx, qword [rbp + 0x3e0]
call fcn.1400de119
mov qword [rbp + 0x3a8], rax
mov rax, qword [rbp + 0x3a8]
mov qword [rbp + 0x3b0], rax
mov rdx, qword [rbp + 0x3b0]
mov rcx, qword [rbp + 0x3e8]
call fcn.1400ddb83
nop
lea rcx, [rbp + 0x238]
call fcn.1400dbf6d
mov dword [rbp + 4], 1
jmp 0x1401797e6
mov r8d, 0xc
lea rdx, [rbp + 0x278]
mov rcx, qword [rbp + 0x3e0]
call fcn.1400e1490
mov qword [rbp + 0x3a8], rax
lea rdx, str.SystemRoot_
mov rcx, qword [rbp + 0x3a8]
call fcn.1400dbadb
mov byte [rbp + 0x254], al
lea rcx, [rbp + 0x278]
call fcn.1400dbf6d
movzx eax, byte [rbp + 0x254]
test eax, eax
je 0x140179532
mov eax, 2
imul rax, rax, 0
lea rcx, [0x14032f3e0]
movzx eax, word [rcx + rax]
test eax, eax
jne 0x140179491
mov edx, 0x104
lea rcx, [0x14032f3e0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea rdx, [0x14032f3e0]
mov rcx, qword [rbp + 0x3e8]
call fcn.1400dfd2f
mov rcx, qword [rbp + 0x3e8]
call fcn.1400db833
dec eax
mov edx, eax
mov rcx, qword [rbp + 0x3e8]
call fcn.1400df159
movzx eax, ax
cmp eax, 0x5c
je 0x1401794d8
mov dx, 0x5c
mov rcx, qword [rbp + 0x3e8]
call fcn.1400dba86
mov r8d, 0xc
lea rdx, [rbp + 0x298]
mov rcx, qword [rbp + 0x3e0]
call fcn.1400de119
mov qword [rbp + 0x3a8], rax
mov rax, qword [rbp + 0x3a8]
mov qword [rbp + 0x3b0], rax
mov rdx, qword [rbp + 0x3b0]
mov rcx, qword [rbp + 0x3e8]
call fcn.1400ddb83
nop
lea rcx, [rbp + 0x298]
call fcn.1400dbf6d
mov dword [rbp + 4], 1
jmp 0x1401797e6
mov r8d, 4
lea rdx, [rbp + 0x2d8]
mov rcx, qword [rbp + 0x3e0]
call fcn.1400e1490
mov qword [rbp + 0x3a8], rax
lea rdx, [0x1402c3900]
mov rcx, qword [rbp + 0x3a8]
call fcn.1400dbadb
mov byte [rbp + 0x2b4], al
lea rcx, [rbp + 0x2d8]
call fcn.1400dbf6d
movzx eax, byte [rbp + 0x2b4]
test eax, eax
je 0x1401795dc
mov r8d, 4
lea rdx, [rbp + 0x2f8]
mov rcx, qword [rbp + 0x3e0]
call fcn.1400de119
mov qword [rbp + 0x3a8], rax
mov rax, qword [rbp + 0x3a8]
mov qword [rbp + 0x3b0], rax
mov rdx, qword [rbp + 0x3b0]
mov rcx, qword [rbp + 0x3e8]
call fcn.1400df4c9
nop
lea rcx, [rbp + 0x2f8]
call fcn.1400dbf6d
mov dword [rbp + 4], 1
jmp 0x1401797e6
xor edx, edx
mov rcx, qword [rbp + 0x3e0]
call fcn.1400df159
movzx eax, ax
cmp eax, 0x5c
je 0x140179611
mov rdx, qword [rbp + 0x3e0]
mov rcx, qword [rbp + 0x3e8]
call fcn.1400df4c9
mov dword [rbp + 4], 1
jmp 0x1401797e6
cmp dword [0x14032f3d8], 0
jne 0x140179629
call fcn.1400de3cb
mov dword [0x14032f3d8], 1
mov dword [rbp + 0x24], 0
jmp 0x14017963a
mov eax, dword [rbp + 0x24]
inc eax
mov dword [rbp + 0x24], eax
cmp dword [rbp + 0x24], 2
jge 0x1401797dc
mov edx, 0x18
lea rcx, [rbp + 0x48]
call fcn.1400deb05
lea rdx, [rbp + 0x48]
lea rcx, [0x14032f3c0]
call fcn.1400da0be
nop
jmp 0x140179684
xor r8d, r8d
lea rdx, [rbp + 0x318]
lea rcx, [rbp + 0x48]
call fcn.1400e1210
lea rcx, [rbp + 0x318]
call fcn.1400dfe7e
lea rdx, [rbp + 0x368]
lea rcx, [0x14032f3c0]
call fcn.1400e00e5
mov qword [rbp + 0x3a8], rax
mov rdx, qword [rbp + 0x3a8]
lea rcx, [rbp + 0x48]
call fcn.1400dc51c
mov byte [rbp + 0x344], al
lea rcx, [rbp + 0x368]
call fcn.1400dfe7e
movzx eax, byte [rbp + 0x344]
test eax, eax
je 0x1401797bf
mov edx, 8
lea rcx, [rbp + 0x78]
call fcn.1400daef1
lea rcx, [rbp + 0x48]
call fcn.1400e0978
mov rcx, rax
call fcn.1400db833
mov r8d, eax
lea rdx, [rbp + 0x78]
mov rcx, qword [rbp + 0x3e0]
call fcn.1400e1490
nop
lea rcx, [rbp + 0x48]
call fcn.1400e0978
mov rcx, rax
call fcn.1400db0f9
mov rdx, rax
lea rcx, [rbp + 0x78]
call fcn.1400e10d5
test eax, eax
jne 0x1401797b1
lea rcx, [rbp + 0x48]
call fcn.1400e0978
add rax, 8
mov rdx, rax
mov rcx, qword [rbp + 0x3e8]
call fcn.1400ddb83
lea rcx, [rbp + 0x48]
call fcn.1400e0978
mov rcx, rax
call fcn.1400db833
mov r8d, eax
lea rdx, [rbp + 0x398]
mov rcx, qword [rbp + 0x3e0]
call fcn.1400de119
mov qword [rbp + 0x3a8], rax
mov rax, qword [rbp + 0x3a8]
mov qword [rbp + 0x3b0], rax
mov rdx, qword [rbp + 0x3b0]
mov rcx, qword [rbp + 0x3e8]
call fcn.1400ddb83
nop
lea rcx, [rbp + 0x398]
call fcn.1400dbf6d
mov dword [rbp + 4], 1
lea rcx, [rbp + 0x78]
call fcn.1400dbf6d
jmp 0x1401797bf
lea rcx, [rbp + 0x78]
call fcn.1400dbf6d
jmp 0x140179665
lea rcx, [rbp + 0x48]
call fcn.1400dfe7e
cmp dword [rbp + 4], 0
je 0x1401797d2
jmp 0x1401797dc
call fcn.1400de3cb
jmp 0x140179632
xor eax, eax
test eax, eax
jne 0x140179305
cmp dword [rbp + 4], 0
jne 0x1401797f8
mov rcx, qword [rbp + 0x3e8]
call fcn.1400df802
mov eax, dword [rbp + 4]
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, [0x1402c20b0]
call fcn.1400dfc67
mov eax, edi
mov rcx, qword [rbp + 0x3b8]
xor rcx, rbp
call fcn.1400dd6a1
lea rsp, [rbp + 0x3c8]
pop rdi
pop rbp
ret