Function at 0x180081fa0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2a0
mov rax, qword [0x180357660]
xor rax, rsp
mov qword [rsp + 0x290], rax
lea r13d, [r8 + 0x1d8]
mov ebx, r8d
mov rdi, rdx
mov rsi, rcx
cmp r8d, r13d
jae 0x18008221c
mov r12, qword [rsp + 0x48]
mov r15d, dword [rsp + 0x48]
mov r14, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x48]
nop word [rax + rax]
cmp ebx, 0xd7
ja 0x180082192
je 0x180082174
mov eax, ebx
sub eax, 0x13
je 0x180082252
sub eax, 0x3d
je 0x18008216c
sub eax, 0x3b
je 0x180082103
cmp eax, 0x3b
jne 0x180082210
mov edx, dword [rsp + 0x48]
lea rax, [rsp + 0x80]
xor r9d, r9d
mov qword [rsp + 0x20], rax
mov r8, r14
mov dword [rsp + 0x50], 0
mov rcx, r12
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp qword [rdi + 0x18], 0x10
mov r10, rdi
jb 0x18008206d
mov r10, qword [rdi]
cmp qword [rsi + 0x18], 0x10
mov rcx, rsi
jb 0x18008207a
mov rcx, qword [rsi]
mov eax, dword [rsi + 0x10]
lea r9, [rsp + 0x40]
mov dword [rsp + 0x58], eax
lea r8, [rsp + 0x58]
lea rax, [rsp + 0x50]
mov byte [rsp + 0x40], 0
mov qword [rsp + 0x38], rax
xor edx, edx
mov dword [rsp + 0x30], 0x85
mov qword [rsp + 0x28], rcx
mov rcx, r10
mov qword [rsp + 0x20], 0
call fcn.180030930
test al, al
je 0x1800820e6
mov eax, dword [rsp + 0x50]
cmp qword [rdi + 0x10], rax
jb 0x180082274
mov qword [rdi + 0x10], rax
mov rcx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x1800820dd
mov rcx, qword [rdi]
mov byte [rcx + rax], 0
jmp 0x180082210
mov qword [rdi + 0x10], 0
mov rax, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x1800820fb
mov rax, qword [rdi]
mov byte [rax], 0
jmp 0x180082210
mov rdx, qword [rsi + 0x10]
lea rcx, [rsp + 0x60]
xor r8d, r8d
mov dword [rsp + 0x48], 0x36
call fcn.180006480
mov rdx, rax
mov rcx, rdi
call fcn.180006f10
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x180082164
mov rcx, qword [rsp + 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18008215f
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18008224b
call fcn.1800bf294
xor r14d, r14d
jmp 0x180082210
xor r12d, r12d
jmp 0x180082210
mov rax, qword [rsi + 0x10]
mov edx, 1
mov rcx, qword [rsi + 0x70]
call qword [rax + 0x30]
mov rbp, rax
mov r15d, 0xffffffff
jmp 0x180082210
mov eax, ebx
sub eax, 0x112
je 0x1800821b9
sub eax, 0x3b
je 0x1800821aa
cmp eax, 0x3b
jne 0x180082210
mov eax, r15d
jmp 0x180082220
mov rdx, rbp
mov ecx, 0x22
call fcn.1800b73a0
jmp 0x180082210
movsxd rax, dword [rsi + 0x30]
xor r11d, r11d
xor r10d, r10d
test eax, eax
jle 0x18008220b
mov r9, qword [rsi + 0x28]
mov rbx, rax
nop
mov r8, qword [r9]
mov rax, rbp
sub r8, rbp
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1800821f3
inc rax
test ecx, ecx
jne 0x1800821e0
test edx, edx
je 0x180082208
inc r11d
inc r10
add r9, 8
cmp r10, rbx
jl 0x1800821d0
jmp 0x18008220b
mov r15d, r11d
mov ebx, 0x112
add ebx, 0x3b
cmp ebx, r13d
jb 0x180082000
mov eax, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.1800bfa40
mov rbx, qword [rsp + 0x2f0]
add rsp, 0x2a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov ecx, dword [0x180355020]
lea r9, str.doUninstallAgent
lea r8, [0x18034a188]
xor edx, edx
call fcn.1800bed60
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
call fcn.18001ec00
int3