Function at 0x140030f28
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x2a0
movaps xmmword [rsp + 0x290], xmm6
mov rdi, r9
mov r13, r8
mov r14, rdx
mov rdx, rcx
mov rax, qword [0x1400d7618]
xor rax, rsp
mov qword [rsp + 0x288], rax
movabs r12, 0xaaaaaaaaaaaaaaaa
lea rcx, [rsp + 0x30]
mov qword [rcx + 0x10], r12
movaps xmm6, xmmword [section..rdata]
movaps xmmword [rcx], xmm6
call fcn.14001fd78
lea rbx, [rsp + 0x80]
mov qword [rbx + 0x10], r12
movaps xmmword [rbx], xmm6
lea rdx, str.SOFTWAREPolicies_
mov rcx, rbx
call fcn.14000278c
mov rcx, r14
xor edx, edx
mov r8, rbx
call fcn.14002f7ab
xorps xmm0, xmm0
movaps xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
test byte [rbx], 1
lea rbx, [rsp + 0x82]
mov r8, rbx
je 0x140030fd6
mov r8, qword [rsp + 0x90]
lea rsi, [rsp + 0x60]
mov qword [rsp + 0x20], rsi
lea r9, str.UserDataDir
mov ecx, 1
xor edx, edx
call fcn.14004cddd
test al, al
jne 0x140031028
test byte [rsp + 0x80], 1
je 0x140031009
mov rbx, qword [rsp + 0x90]
mov qword [rsp + 0x20], rsi
lea r9, str.UserDataDir
mov ecx, 2
xor edx, edx
mov r8, rbx
call fcn.14004cddd
test al, al
je 0x14003108d
lea rcx, [rsp + 0x48]
lea rdx, [rsp + 0x60]
call fcn.14004d040
test byte [rsp + 0x30], 1
jne 0x14003104c
mov word [rsp + 0x32], 0
mov byte [rsp + 0x30], 0
jmp 0x140031079
mov rax, qword [rsp + 0x40]
mov word [rax], 0
mov qword [rsp + 0x38], 0
test byte [rsp + 0x30], 1
je 0x140031079
mov rcx, qword [rsp + 0x40]
call fcn.140083808
mov qword [rsp + 0x30], 0
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x40], rax
movups xmm0, xmmword [rsp + 0x48]
movaps xmmword [rsp + 0x30], xmm0
test byte [rsp + 0x60], 1
je 0x14003109e
mov rcx, qword [rsp + 0x70]
call fcn.140083808
test byte [rsp + 0x80], 1
je 0x1400310b5
mov rcx, qword [rsp + 0x90]
call fcn.140083808
lea r15, [rsp + 0x32]
movzx eax, byte [rsp + 0x30]
test al, 1
jne 0x1400310df
cmp al, 2
jb 0x140031145
mov ecx, eax
and ecx, 0xfffffffe
movzx ecx, word [rsp + rcx + 0x30]
cmp cx, 0x2f
je 0x140031101
cmp cx, 0x5c
je 0x140031105
jmp 0x140031141
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x140031168
mov rcx, qword [rsp + 0x40]
movzx edx, word [rcx + rax*2 - 2]
cmp dx, 0x2f
je 0x14003111c
cmp dx, 0x5c
je 0x140031126
jmp 0x14003114c
test al, 1
jne 0x14003111c
shr rax, 1
lea rcx, [rax - 1]
add cl, cl
mov byte [rsp + 0x30], cl
lea rax, [rsp + rax*2]
add rax, 0x30
jmp 0x140031137
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
lea rdx, [rax - 1]
mov qword [rsp + 0x38], rdx
lea rax, [rcx + rax*2]
add rax, 0xfffffffffffffffe
mov word [rax], 0
jmp 0x1400310ba
test al, 1
jne 0x14003114c
shr al, 1
movzx eax, al
jmp 0x140031151
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x140031168
lea rcx, [rsp + 0x30]
call fcn.140030497
test al, al
jne 0x14003129b
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.14001ff2a
lea rdi, [rsp + 0x80]
mov qword [rdi + 0x10], r12
movaps xmmword [rdi], xmm6
lea rdx, str.LOCALAPPDATA
mov rcx, rdi
call fcn.14002ff7e
movzx eax, byte [rdi]
test al, 1
je 0x1400311a4
mov rax, qword [rsp + 0x88]
jmp 0x1400311a7
shr rax, 1
test rax, rax
je 0x1400311f1
movaps xmm0, xmmword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
movaps xmm1, xmmword [rsp + 0x80]
movaps xmmword [rsp + 0x30], xmm1
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x40], rax
movaps xmmword [rsp + 0x80], xmm0
mov qword [rsp + 0x90], rcx
movzx ecx, byte [rsp + 0x30]
test cl, 1
je 0x140031233
mov rcx, qword [rsp + 0x38]
jmp 0x140031239
xor esi, esi
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x14003127f
mov edi, eax
inc edi
xor esi, esi
lea rbx, [rsp + 0x80]
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
call fcn.14001fff8
test byte [rbx], 1
je 0x140031390
mov rdx, qword [rsp + 0x90]
jmp 0x140031398
shr rcx, 1
mov rax, r15
cmp word [rax + rcx*2 - 2], 0x5c
je 0x14003124f
lea rcx, [rsp + 0x30]
mov dx, 0x5c
call fcn.1400205f8
mov sil, 1
lea rdi, [rsp + 0x30]
mov rcx, r14
mov dl, 1
mov r8, rdi
call fcn.14002f7ab
mov rcx, rdi
mov dx, 0x5c
call fcn.1400205f8
lea rdx, str.User_Data
mov rcx, rdi
call fcn.1400204b6
test byte [rsp + 0x80], 1
je 0x140031296
mov rcx, qword [rsp + 0x90]
call fcn.140083808
test sil, sil
je 0x1400312e9
lea rdi, [rsp + 0x80]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.140086a50
test byte [rsp + 0x30], 1
je 0x1400312bf
mov r15, qword [rsp + 0x40]
mov r8d, 0x104
mov rcx, rdi
mov rdx, r15
call fcn.140097784
test rax, rax
je 0x1400312ed
lea rcx, [rsp + 0x60]
lea rdx, [rsp + 0x80]
call fcn.14000278c
jmp 0x1400312fe
xor esi, esi
jmp 0x140031352
xorps xmm0, xmm0
movaps xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
test byte [r13], 1
jne 0x140031313
mov word [r13 + 2], 0
mov byte [r13], 0
jmp 0x14003133c
mov rax, qword [r13 + 0x10]
mov word [rax], 0
mov qword [r13 + 8], 0
test byte [r13], 1
je 0x14003133c
mov rcx, qword [r13 + 0x10]
call fcn.140083808
mov qword [r13], 0
mov rax, qword [rsp + 0x70]
mov qword [r13 + 0x10], rax
movaps xmm0, xmmword [rsp + 0x60]
movups xmmword [r13], xmm0
mov sil, 1
test byte [rsp + 0x30], 1
je 0x140031363
mov rcx, qword [rsp + 0x40]
call fcn.140083808
mov rcx, qword [rsp + 0x288]
xor rcx, rsp
call fcn.140083c20
mov eax, esi
movaps xmm6, xmmword [rsp + 0x290]
add rsp, 0x2a0
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rdx, [rsp + 0x82]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x14003127f
mov edx, eax
movzx eax, byte [rsp + 0x80]
test al, 1
je 0x1400313c0
mov rax, qword [rsp + 0x88]
jmp 0x1400313c3
shr rax, 1
cmp rax, rdx
jbe 0x1400313dd
lea rcx, [rsp + 0x80]
xor r8d, r8d
call fcn.14001fff8
jmp 0x1400311ac
xor esi, esi
jmp 0x14003127f