Function at 0x140016fb0
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x308
lea rbp, [rsp + 0x80]
mov rdi, r9
mov r13, r8
mov r12, rdx
mov rbx, rcx
mov r14, qword [rbp + 0x320]
mov r15, qword [rbp + 0x310]
call fcn.140046d10
mov rcx, qword [rax]
mov rdx, qword [rcx + 0x10]
mov rcx, rax
mov rax, rdx
call qword [case.0x14001b2ee.0]
cmp byte [rax + 4], 0
je 0x14001705b
mov rax, qword [rbp + 0x318]
mov rcx, qword [rbp + 0x308]
mov edx, dword [rbp + 0x300]
mov esi, dword [rbp + 0x2f8]
mov r9, qword [rbp + 0x2f0]
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], esi
mov rcx, r12
mov rdx, r13
mov r8, rdi
mov rax, rbx
call qword [case.0x14001b2ee.0]
mov edi, 1
test eax, eax
jne 0x140017089
lea rcx, str.CreateProcessA
mov rdx, r12
call fcn.140033200
call fcn.140046d10
mov rcx, qword [rax]
mov rdx, qword [rcx + 0x10]
mov rcx, rax
mov rax, rdx
call qword [case.0x14001b2ee.0]
xor edi, edi
cmp dword [rax], 0
jg 0x14001709f
mov eax, edi
add rsp, 0x308
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov edx, 0x18
mov rcx, r14
mov r8d, 1
call fcn.140046e40
call fcn.140046d50
test al, al
je 0x14001729c
mov rbx, qword [0x14005e8c8]
test rbx, rbx
je 0x14001729c
test r13, r13
je 0x1400170f1
mov rcx, r13
call fcn.140046f90
mov r13, rax
test rax, rax
jne 0x1400170f4
jmp 0x14001729c
xor r13d, r13d
test r12, r12
je 0x14001710b
mov rcx, r12
call fcn.140046f90
test rax, rax
jne 0x14001710d
mov rcx, r13
jmp 0x140017137
xor eax, eax
mov qword [rbp + 0x268], rax
test r15, r15
je 0x140017143
mov rcx, r15
call fcn.140046f90
test rax, rax
jne 0x140017145
mov rcx, r13
xor edx, edx
call fcn.1400320f0
mov rcx, qword [rbp + 0x268]
xor edx, edx
call fcn.1400320f0
jmp 0x14001729c
xor eax, eax
test r13, r13
je 0x140017150
mov rdx, qword [r13 + 8]
jmp 0x140017152
xor edx, edx
mov rcx, qword [rbp + 0x268]
mov qword [rbp + 0x278], r13
test rcx, rcx
je 0x14001716b
mov r13, qword [rcx + 8]
jmp 0x14001716e
xor r13d, r13d
test rax, rax
mov dword [rbp + 0x264], esi
mov qword [rbp + 0x280], rax
mov qword [rbp + 0x258], rdx
je 0x14001718d
mov rax, qword [rax + 8]
jmp 0x14001718f
xor eax, eax
mov qword [rbp + 0x270], rax
lea r15, [rbp - 0x30]
mov ecx, 0x104
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
dec eax
xor esi, esi
cmp eax, 0x103
cmovae r15, rsi
lea rcx, [rbp + 0x248]
mov qword [rcx], rbx
add rbx, qword [rbx + 0x10]
mov qword [rcx + 8], rbx
xorps xmm0, xmm0
movaps xmmword [rbp + 0x220], xmm0
movaps xmmword [rbp + 0x210], xmm0
movaps xmmword [rbp + 0x200], xmm0
movaps xmmword [rbp + 0x1f0], xmm0
movaps xmmword [rbp + 0x1e0], xmm0
mov qword [rbp + 0x230], 0
call fcn.1400321a0
test rax, rax
je 0x14001725a
mov rbx, rax
mov qword [rax], 0xd
mov dword [rax + 0x60], 5
mov dword [rax + 0x6c], 0xb0
test r13, r13
je 0x14001722c
mov rcx, r13
call fcn.140032200
mov rsi, rax
add esi, esi
test r13, r13
sete al
test esi, esi
setne cl
cmp esi, 0x400
ja 0x14001725a
and al, cl
jne 0x14001725a
mov r8d, esi
mov ecx, dword [rbx + 0x6c]
mov eax, 0x400
sub rax, r8
cmp rax, rcx
jae 0x1400172fb
mov r13, qword [rbp + 0x278]
mov rbx, qword [rbp + 0x280]
mov esi, 4
xor r14d, r14d
mov rcx, r13
xor edx, edx
call fcn.1400320f0
mov rcx, qword [rbp + 0x268]
xor edx, edx
call fcn.1400320f0
mov rcx, rbx
xor edx, edx
call fcn.1400320f0
test esi, esi
je 0x1400172a9
mov esi, dword [rbp + 0x264]
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140017089
mov ecx, dword [rbp + 0x1e8]
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [rbp + 0x1e8], 0
jne 0x1400172f3
mov rax, qword [0x14005cca8]
mov r14d, 1
test rax, rax
je 0x1400172f3
mov qword [rsp + 0x20], 0
lea rcx, str.Broker_ALLOWED
lea rdx, str.CreateProcessA
mov r8, r12
xor r9d, r9d
call qword [case.0x14001b2ee.0]
mov edi, r14d
jmp 0x140017089
add rcx, rbx
mov rdx, r13
call fcn.14001a860
mov eax, dword [rbx + 0x6c]
add eax, esi
add eax, 7
and eax, 0xfffffff8
mov dword [rbx + 0x78], eax
mov dword [rbx + 0x70], esi
mov dword [rbx + 0x68], 1
mov rdx, qword [rbp + 0x258]
test rdx, rdx
mov r13, qword [rbp + 0x278]
je 0x140017347
mov rcx, rdx
call fcn.140032200
mov rsi, rax
add esi, esi
mov rdx, qword [rbp + 0x258]
jmp 0x140017349
xor esi, esi
test rdx, rdx
sete al
test esi, esi
setne cl
cmp esi, 0x400
ja 0x140017261
and al, cl
jne 0x140017261
mov r8d, esi
mov ecx, dword [rbx + 0x78]
mov eax, 0x400
sub rax, r8
cmp rax, rcx
jb 0x140017261
add rcx, rbx
call fcn.14001a860
mov eax, dword [rbx + 0x78]
add eax, esi
add eax, 7
and eax, 0xfffffff8
mov dword [rbx + 0x84], eax
mov dword [rbx + 0x7c], esi
mov dword [rbx + 0x74], 1
test r15, r15
je 0x1400173b6
mov rcx, r15
call fcn.140032200
mov rsi, rax
add esi, esi
jmp 0x1400173b8
xor esi, esi
test r15, r15
sete al
test esi, esi
setne cl
cmp esi, 0x400
ja 0x140017261
and al, cl
jne 0x140017261
mov r8d, esi
mov ecx, dword [rbx + 0x84]
mov eax, 0x400
sub rax, r8
cmp rax, rcx
jb 0x140017261
mov r13, rbx
add rcx, rbx
mov rdx, r15
call fcn.14001a860
mov rcx, r13
mov eax, dword [r13 + 0x84]
add eax, esi
add eax, 7
and eax, 0xfffffff8
mov dword [r13 + 0x90], eax
mov dword [r13 + 0x88], esi
mov dword [r13 + 0x80], 1
cmp qword [rbp + 0x270], 0
je 0x140017447
mov rcx, qword [rbp + 0x270]
call fcn.140032200
mov rsi, rax
add esi, esi
jmp 0x140017449
xor esi, esi
cmp qword [rbp + 0x270], 0
sete al
test esi, esi
setne cl
cmp esi, 0x400
ja 0x14001725a
and al, cl
jne 0x14001725a
mov r8d, esi
mov ecx, dword [r13 + 0x90]
mov eax, 0x400
sub rax, r8
cmp rax, rcx
jb 0x14001725a
add rcx, r13
mov rdx, qword [rbp + 0x270]
call fcn.14001a860
mov rcx, r13
mov eax, dword [r13 + 0x90]
add eax, esi
add eax, 7
and eax, 0xfffffff8
mov dword [r13 + 0x9c], eax
mov dword [r13 + 0x94], esi
mov dword [r13 + 0x8c], 1
mov dword [rbp + 0x238], 0x18
mov qword [rbp + 0x240], r14
mov esi, 4
test r14, r14
je 0x140017596
cmp eax, 0x3e8
ja 0x140017596
mov ecx, eax
add rcx, r13
mov r8d, 0x18
mov rdx, r14
call fcn.14001a860
mov rdx, r13
mov dword [r13 + 4], 1
mov eax, dword [r13 + 0x9c]
add eax, 0x1f
and eax, 0xfffffff8
mov dword [r13 + 0xa8], eax
mov dword [r13 + 0xa0], 0x18
mov dword [r13 + 0x98], 6
lea rcx, [rbp + 0x248]
lea r8, [rbp + 0x1e0]
call fcn.140032300
mov esi, 0xa
cmp eax, 0xa
je 0x140017596
mov ebx, eax
mov r14d, dword [r13 + 0x9c]
lea rcx, [rbp + 0x238]
call fcn.1400334c0
mov esi, eax
lea rcx, [rbp + 0x238]
call fcn.1400334d0
mov rdx, r13
add rdx, r14
mov r8d, esi
mov rcx, rax
call fcn.14001a860
lea rcx, [rbp + 0x248]
mov rdx, r13
call fcn.1400324b0
mov esi, ebx
mov r13, qword [rbp + 0x278]
mov rbx, qword [rbp + 0x280]
jmp 0x14001726d