Function at 0x180008d50
Capabilities:
Get common file path
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x200]
sub rsp, 0x300
mov rax, qword [0x180357660]
xor rax, rsp
mov qword [rbp + 0x1f0], rax
imul r12d, edx, 0x625
mov rsi, r9
mov r15, r8
mov r14d, edx
mov rdi, rcx
mov ebx, edx
cmp edx, r12d
ja 0x180008ef6
mov r13, qword [rsp + 0x68]
xor edx, edx
mov eax, 0x6f66
cmp ebx, 0x19bc
ja 0x180008f56
je 0x180008f4d
cmp ebx, 0x75
ja 0x180008ee2
je 0x180008eab
cmp ebx, 0x24
je 0x180008e4c
cmp ebx, 0x36
je 0x180008e25
cmp ebx, 0x61
jne 0x180009033
cmp byte [0x180357741], 0
je 0x180009033
mov eax, dword [r15]
lea r9, [rsp + 0x50]
mov dword [rsp + 0x60], eax
lea r8, [rsp + 0x58]
mov rax, qword [rsi]
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x50], rax
xor ecx, ecx
mov rax, qword [rdi]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x20], SHTestTokenMembership
call fcn.180056b00
jmp 0x180008efb
mov r8d, 3
lea rdx, str.Get_Figures
lea rcx, [rbp - 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov eax, 0x7953
xor edx, edx
mov word [rbp - 0x4d], ax
jmp 0x180009033
xor r9d, r9d
mov qword [rsp + 0x50], 0x40
lea rax, [rsp + 0x50]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
lea edx, [r9 + 0x4c]
call fcn.18003ad60
movups xmm0, xmmword [rdi]
mov rcx, rax
xor edx, edx
movups xmmword [rax], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rax + 0x10], xmm1
movsd xmm0, qword [rdi + 0x20]
movsd qword [rax + 0x20], xmm0
movups xmm0, xmmword [rdi + 0x28]
movups xmmword [rax + 0x28], xmm0
mov eax, dword [rdi + 0x38]
mov dword [rcx + 0x38], eax
mov eax, dword [rdi + 0x3c]
mov dword [rcx + 0x3c], eax
mov qword [rsp + 0x50], rcx
jmp 0x180009033
mov qword [rsp + 0x48], rdi
xor r9d, r9d
mov qword [rsp + 0x40], rdx
xor r8d, r8d
mov qword [rsp + 0x38], rdx
mov ecx, 0xf8
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rdx
xor edx, edx
call fcn.180097920
xor edx, edx
jmp 0x180009033
cmp ebx, 0xe5
je 0x180008f25
cmp ebx, 0x1128
jne 0x180009033
mov rax, qword [rsp + 0x50]
mov rcx, qword [rbp + 0x1f0]
xor rcx, rsp
call fcn.1800bfa40
mov rbx, qword [rsp + 0x348]
add rsp, 0x300
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea r8, str.current_time__ld
lea rdx, [0x18034489c]
call fcn.1800bee00
xor edx, edx
jmp 0x180009033
mov byte [rbp - 0x4b], 0x73
jmp 0x180009033
cmp ebx, 0x664e
ja 0x18000901b
je 0x180008fe9
cmp ebx, 0x2e3a
je 0x180009047
cmp ebx, 0x3342
je 0x180008fbf
cmp ebx, 0x4cc8
jne 0x180009033
movups xmm0, xmmword [str.kernel32.]
mov word [rbp - 0x45], ax
lea rdx, [0x1803442c8]
mov eax, dword [0x18034cde8]
lea rcx, [rbp - 0x2e]
mov r8d, 4
mov byte [rbp - 0x43], 0
movups xmmword [rbp - 0x40], xmm0
mov dword [rbp - 0x30], eax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
xor edx, edx
jmp 0x180009033
mov r8d, 1
mov dword [rbp - 0x4a], 0x496d6574
lea rdx, [0x18034cdc2]
mov byte [rbp - 0x46], 0
lea rcx, [rbp - 0x46]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
xor edx, edx
mov byte [rbp - 0x45], 0
jmp 0x180009033
mov qword [rsp + 0x68], rdx
lea r8, [rbp - 0x50]
mov qword [rsp + 0x78], rdx
lea rcx, [rbp - 0x40]
xor edx, edx
mov dword [rsp + 0x58], 0x36
mov r9d, 0xe0
call fcn.180012510
xor edx, edx
mov r13, rax
mov dword [rsp + 0x60], edx
jmp 0x180009033
cmp ebx, 0x6d22
je 0x1800091f8
cmp ebx, 0x7fd4
je 0x1800091ba
imul eax, r14d, 0x79
add ebx, eax
cmp ebx, r12d
ja 0x180008ef6
jmp 0x180008da5
mov ecx, dword [r15]
test ecx, ecx
je 0x180009190
sub ecx, 1
je 0x180009166
sub ecx, 1
je 0x180009123
cmp ecx, 1
je 0x180009070
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
mov r14, qword [rsi]
lea r15, [0x1803555c0]
mov rbx, qword [rdi]
mov edi, 0x11c
mov rsi, qword [rsp + 0x78]
mov eax, edi
sub eax, 0x118
je 0x1800090d9
sub eax, 4
je 0x1800090d4
sub eax, 1
je 0x1800090a1
cmp eax, 1
je 0x18000911b
jmp 0x180009108
mov qword [rbx + 8], rdx
lea rax, [rsp + 0x50]
mov qword [rbx + 0x10], rdx
lea rcx, [rsp + 0x58]
xor edx, edx
mov qword [rsp + 0x50], r14
xor r9d, r9d
mov qword [rsp + 0x58], rbx
mov r8d, 0x8d
mov qword [rsp + 0x20], rax
call fcn.18006c150
jmp 0x180009106
mov qword [rbx], r15
jmp 0x180009108
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1800090e9
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test rsi, rsi
je 0x1800090f7
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xorps xmm0, xmm0
xor esi, esi
movups xmmword [rsp + 0x68], xmm0
mov rbx, qword [rsp + 0x68]
xor edx, edx
inc edi
cmp edi, 0x120
jb 0x180009087
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x180008efb
mov rax, qword [rsi]
xor r9d, r9d
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov rax, qword [rdi]
xor ecx, ecx
mov dword [rsp + 0x38], 0xc0
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x58]
call fcn.1800479f0
jmp 0x180008efb
mov rax, qword [rsi]
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x58]
mov rax, qword [rdi]
mov r8d, 0x6b
mov qword [rsp + 0x58], rax
call fcn.18006dbe0
jmp 0x180008efb
mov rax, qword [rsi]
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x58]
mov rax, qword [rdi]
mov r8d, 0x7e
mov qword [rsp + 0x58], rax
call fcn.180076620
jmp 0x180008efb
lea rcx, [rbp - 0x80]
call r13
mov r9d, dword [rsp + 0x60]
lea rax, [rbp - 0x20]
mov r8, qword [rsp + 0x78]
mov edx, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
call qword [sym.imp.SHELL32.dll_SHGetFolderPathAndSubDirW]
mov eax, dword [rbp - 0x60]
mov dword [rsp + 0x50], eax
jmp 0x180008ef6
mov ecx, dword [0x180355020]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3