Function at 0x1400397c0
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x2b0
mov r15, r9
mov r12, r8
mov r14, rdx
mov rdx, rcx
mov rax, qword [0x1400e05d8]
xor rax, rsp
mov qword [rsp + 0x2a8], rax
lea r13, [rsp + 0x30]
mov rcx, r13
call fcn.140027de0
lea rdx, str.SOFTWAREPolicies_
lea rbx, [rsp + 0xa0]
mov rcx, rbx
call fcn.1400028f0
mov rcx, r14
xor edx, edx
mov r8, rbx
call fcn.140037830
xorps xmm0, xmm0
movaps xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
cmp byte [rbx + 0x17], 0
jns 0x140039840
mov rbx, qword [rsp + 0xa0]
lea rsi, [rsp + 0x60]
mov qword [rsp + 0x20], rsi
lea r9, str.UserDataDir
mov ecx, 1
xor edx, edx
mov r8, rbx
call fcn.140052fd0
test al, al
jne 0x14003989c
cmp byte [rsp + 0xb7], 0
jns 0x140039878
mov r8, qword [rsp + 0xa0]
jmp 0x140039880
lea r8, [rsp + 0xa0]
mov qword [rsp + 0x20], rsi
lea r9, str.UserDataDir
mov ecx, 2
xor edx, edx
call fcn.140052fd0
test al, al
je 0x140039901
lea rcx, [rsp + 0x48]
lea rdx, [rsp + 0x60]
call fcn.1400533c0
cmp byte [rsp + 0x47], 0
js 0x1400398c0
mov word [rsp + 0x30], 0
mov byte [rsp + 0x47], 0
jmp 0x1400398ed
mov rax, qword [rsp + 0x30]
mov word [rax], 0
mov qword [rsp + 0x38], 0
cmp byte [rsp + 0x47], 0
jns 0x1400398ed
mov rcx, qword [rsp + 0x30]
call fcn.140089d80
mov qword [rsp + 0x40], 0
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x40], rax
movups xmm0, xmmword [rsp + 0x48]
movaps xmmword [rsp + 0x30], xmm0
cmp byte [rsp + 0x77], 0
jns 0x140039912
mov rcx, qword [rsp + 0x60]
call fcn.140089d80
cmp byte [rsp + 0xb7], 0
jns 0x140039929
mov rcx, qword [rsp + 0xa0]
call fcn.140089d80
movzx ebx, byte [rsp + 0x47]
test bl, bl
mov rcx, qword [rsp + 0x38]
mov rax, rbx
cmovs rax, rcx
test rax, rax
je 0x1400399c6
mov edx, ebx
shr dl, 7
mov rsi, qword [rsp + 0x30]
test dl, 1
mov rdi, r13
cmovne rdi, rsi
movzx eax, word [rdi + rax*2 - 2]
cmp ax, 0x5c
je 0x14003996a
cmp ax, 0x2f
jne 0x1400399b6
test dl, 1
je 0x140039982
lea rax, [rcx - 1]
mov qword [rsp + 0x38], rax
lea rax, [rsi + rcx*2]
add rax, 0xfffffffffffffffe
jmp 0x140039992
lea rax, [rbx - 1]
mov byte [rsp + 0x47], al
lea rax, [rsp + rbx*2]
add rax, 0x2e
mov word [rax], 0
movzx ebx, byte [rsp + 0x47]
mov edx, ebx
shr dl, 7
test bl, bl
mov rcx, qword [rsp + 0x38]
mov rax, rbx
cmovs rax, rcx
test rax, rax
jne 0x14003994a
jmp 0x1400399c6
mov rcx, r13
call fcn.1400388a0
test al, al
jne 0x140039ab2
lea r13, [rsp + 0x30]
mov rcx, r15
mov rdx, r13
call fcn.140027fa0
lea rdx, str.LOCALAPPDATA
lea rbx, [rsp + 0xa0]
mov rcx, rbx
call fcn.140038000
movzx eax, byte [rbx + 0x17]
test al, al
jns 0x1400399fd
mov rax, qword [rsp + 0xa8]
test rax, rax
je 0x140039b13
mov rax, qword [rsp + 0x40]
movaps xmm0, xmmword [rsp + 0x30]
movaps xmm1, xmmword [rsp + 0xa0]
movaps xmmword [rsp + 0x30], xmm1
mov rcx, qword [rsp + 0xb0]
mov qword [rsp + 0x40], rcx
movaps xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0xb0], rax
movzx eax, byte [rsp + 0x47]
test al, al
cmovs rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
cmovns rcx, r13
cmp word [rcx + rax*2 - 2], 0x5c
je 0x140039a66
lea rcx, [rsp + 0x30]
mov dx, 0x5c
call fcn.140028930
mov r15b, 1
lea rsi, [rsp + 0x30]
mov rcx, r14
mov dl, 1
mov r8, rsi
call fcn.140037830
mov rcx, rsi
mov dx, 0x5c
call fcn.140028930
lea rdx, str.User_Data
mov rcx, rsi
call fcn.140028740
cmp byte [rsp + 0xb7], 0
jns 0x140039aad
mov rcx, qword [rsp + 0xa0]
call fcn.140089d80
test r15b, r15b
je 0x140039b0c
cmp byte [rsp + 0x47], 0
jns 0x140039abe
mov r13, qword [rsp + 0x30]
lea rcx, [rsp + 0xa0]
mov r8d, 0x104
mov rdx, r13
call fcn.14009e228
test rax, rax
jne 0x140039c17
xorps xmm0, xmm0
movaps xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
cmp byte [r12 + 0x17], 0
js 0x140039b96
mov word [r12], 0
mov byte [r12 + 0x17], 0
jmp 0x140039bc2
xor esi, esi
jmp 0x140039bd9
xor r15d, r15d
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x140039a96
mov esi, eax
inc esi
xor r15d, r15d
mov rcx, rbx
mov rdx, rsi
xor r8d, r8d
call fcn.140028110
cmp byte [rsp + 0xb7], 0
jns 0x140039b4f
mov rbx, qword [rsp + 0xa0]
mov ecx, esi
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x140039a96
mov edx, eax
movzx eax, byte [rsp + 0xb7]
test al, al
jns 0x140039b78
mov rax, qword [rsp + 0xa8]
cmp rax, rdx
jbe 0x140039c0f
lea rcx, [rsp + 0xa0]
xor r8d, r8d
call fcn.140028110
jmp 0x140039a06
mov rax, qword [r12]
mov word [rax], 0
mov qword [r12 + 8], 0
cmp byte [r12 + 0x17], 0
jns 0x140039bc2
mov rcx, qword [r12]
call fcn.140089d80
mov qword [r12 + 0x10], 0
mov rax, qword [rsp + 0x70]
mov qword [r12 + 0x10], rax
movaps xmm0, xmmword [rsp + 0x60]
movups xmmword [r12], xmm0
mov sil, 1
cmp byte [rsp + 0x47], 0
jns 0x140039bea
mov rcx, qword [rsp + 0x30]
call fcn.140089d80
mov rcx, qword [rsp + 0x2a8]
xor rcx, rsp
call fcn.14008a0f0
mov eax, esi
add rsp, 0x2b0
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor r15d, r15d
jmp 0x140039a96
lea rcx, [rsp + 0x60]
lea rdx, [rsp + 0xa0]
call fcn.1400028f0
jmp 0x140039aee