Function at 0x7ff34476948
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x490
mov rax, qword [0x7ff34484108]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov rax, qword [rsp + 0x4f0]
mov r14, qword [rsp + 0x508]
mov rdi, qword [rsp + 0x500]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x4f8]
mov r13, r8
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x510]
mov qword [rsp + 0x30], r8
xor r8d, r8d
mov qword [rsp + 0x50], r9
mov r12, rdx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rdi
mov ebp, r8d
mov r15d, r8d
mov ebx, r8d
cmp r14, r8
je 0x7ff344769d6
mov dword [r14], r8d
cmp rdi, r8
je 0x7ff34476ddb
cmp rdx, r8
je 0x7ff34476ddb
mov rsi, qword [rdi]
jmp 0x7ff34476dd0
mov rdx, qword [rsi + 8]
cmp rdx, r8
je 0x7ff34476cec
mov rcx, r12
call sub.msvcrt.dll__wcsicmp
xor r8d, r8d
cmp eax, r8d
jne 0x7ff34476cec
mov eax, dword [rsi + 0x28]
and eax, 0xf
cmp al, r8b
jne 0x7ff34476a23
lea r15d, [r8 + 1]
mov ebx, r8d
cmp r8w, word [r13]
je 0x7ff34476bd6
mov rdx, qword [rsi]
mov rcx, r13
call sub.msvcrt.dll__wcsicmp
xor r8d, r8d
cmp eax, r8d
jne 0x7ff34476a4d
mov ebx, r8d
lea ebp, [r8 + 1]
jmp 0x7ff34476b90
lea rcx, [rsp + 0x60]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xor r8d, r8d
cmp eax, r8d
je 0x7ff34476b82
lea rdi, [rsp + 0x60]
lea rax, [rsp + 0x270]
mov r12d, 0x104
sub rdi, rax
mov rdx, r12
lea rcx, [rsp + 0x270]
lea rax, [rdx + 0x7ffffefa]
cmp rax, r8
je 0x7ff34476aad
movzx eax, word [rdi + rcx]
cmp ax, r8w
je 0x7ff34476aad
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x7ff34476a8a
cmp rdx, r8
jne 0x7ff34476ab6
sub rcx, 2
mov word [rcx], r8w
lea r8, [0x7ff34447bd8]
lea rcx, [rsp + 0x60]
mov rdx, r12
call fcn.7ff3444bbcc
lea r8, [0x7ff34447bf0]
lea rcx, [rsp + 0x270]
mov rdx, r12
call fcn.7ff3444bbcc
lea rdx, [rsp + 0x60]
mov r8, r12
mov rcx, r13
call sub.msvcrt.dll__wcsnicmp
xor edi, edi
lea rdx, [rsp + 0x270]
test eax, eax
mov r8, r12
mov rcx, r13
sete dil
call sub.msvcrt.dll__wcsnicmp
mov rcx, qword [rsi]
xor r12d, r12d
test eax, eax
lea rdx, [rsp + 0x60]
mov r8d, 0x104
sete r12b
call sub.msvcrt.dll__wcsnicmp
mov rcx, qword [rsi]
xor r13d, r13d
test eax, eax
lea rdx, [rsp + 0x270]
mov r8d, 0x104
sete r13b
call sub.msvcrt.dll__wcsnicmp
xor r8d, r8d
cmp eax, r8d
mov ecx, r8d
sete cl
cmp edi, r8d
jne 0x7ff34476b61
cmp r12d, r8d
je 0x7ff34476b73
cmp r13d, r8d
jne 0x7ff34476b6b
cmp ecx, r8d
je 0x7ff34476b73
mov ebx, r8d
mov ebp, 1
mov r13, qword [rsp + 0x30]
mov r12, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x20]
cmp ebp, r8d
jne 0x7ff34476b90
cmp r15d, r8d
je 0x7ff34476dcc
cmp dword [rdi + 0x50], r8d
je 0x7ff34476d1c
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [rsi + 0x38]
cmp eax, edx
jbe 0x7ff34476bb9
mov ecx, eax
sub ecx, edx
cmp ecx, 0x3e8
ja 0x7ff34476dc1
cmp eax, edx
jae 0x7ff34476d19
sub eax, edx
xor r8d, r8d
dec eax
cmp eax, 0x3e8
ja 0x7ff34476dc4
jmp 0x7ff34476d1c
mov rdi, qword [rsi]
lea rax, [rsp + 0x60]
mov edx, 0x104
lea rcx, [rsp + 0x60]
mov ebx, r8d
sub rdi, rax
lea rax, [rdx + 0x7ffffefa]
cmp rax, r8
je 0x7ff34476c11
movzx eax, word [rdi + rcx]
cmp ax, r8w
je 0x7ff34476c11
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x7ff34476bee
cmp rdx, r8
jne 0x7ff34476c1f
sub rcx, 2
mov ebx, 0x8007007a
cmp ebx, r8d
mov word [rcx], r8w
jl 0x7ff34476b7d
mov rdi, qword [rsi]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
mov eax, 0x5c
mov edi, 0x104
not rcx
cmp ax, word [rsp + rcx*2 + 0x5c]
je 0x7ff34476c65
lea r8, [0x7ff34441674]
lea rcx, [rsp + 0x60]
mov rdx, rdi
call fcn.7ff3444bbcc
xor r8d, r8d
mov ebx, eax
cmp ebx, r8d
jl 0x7ff34476b7d
lea rcx, [rsp + 0x60]
mov r8, r12
mov rdx, rdi
call fcn.7ff3444bbcc
xor r8d, r8d
cmp eax, r8d
mov ebx, eax
jl 0x7ff34476b7d
mov rax, qword [rsp + 0x40]
mov rdx, rdi
lea rdi, [rsp + 0x60]
mov rcx, rax
sub rdi, rax
mov ebx, r8d
lea rax, [rdx + 0x7ffffefa]
cmp rax, r8
je 0x7ff34476cc5
movzx eax, word [rdi + rcx]
cmp ax, r8w
je 0x7ff34476cc5
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x7ff34476ca2
cmp rdx, r8
jne 0x7ff34476cd3
sub rcx, 2
mov ebx, 0x8007007a
cmp ebx, r8d
mov word [rcx], r8w
jl 0x7ff34476b7d
mov ebx, 1
mov ebp, ebx
jmp 0x7ff34476b7d
mov rdx, qword [rsi + 0x10]
cmp rdx, r8
je 0x7ff34476b82
mov rcx, r12
call sub.msvcrt.dll__wcsicmp
xor r8d, r8d
cmp eax, r8d
jne 0x7ff34476b82
mov ebx, r8d
lea ebp, [r8 + 1]
jmp 0x7ff34476b82
xor r8d, r8d
mov eax, dword [rsi + 0x28]
mov rcx, qword [rsp + 0x50]
and eax, 0xf
mov dword [rcx], eax
mov rcx, qword [rsp + 0x48]
cmp rcx, r8
je 0x7ff34476d38
mov eax, dword [rsi + 0x2c]
mov dword [rcx], eax
mov rdi, qword [rsi + 0x18]
cmp rdi, r8
je 0x7ff34476d9a
or r8, 0xffffffffffffffff
xor eax, eax
mov rcx, r8
repne scasw ax, word [rdi]
lea eax, [r8 + 3]
not rcx
mov ebx, ecx
mul rbx
cmovo rax, r8
mov rcx, rax
call fcn.7ff3444f574
xor r8d, r8d
mov rdi, rax
cmp rax, r8
je 0x7ff34476d93
mov r8, qword [rsi + 0x18]
mov rdx, rbx
mov rcx, rax
call fcn.7ff3444bb58
xor r8d, r8d
cmp eax, r8d
mov ebx, eax
jl 0x7ff34476dba
mov rax, qword [rsp + 0x38]
mov qword [rax], rdi
jmp 0x7ff34476da2
mov ebx, 0x8007000e
jmp 0x7ff34476da2
mov rax, qword [rsp + 0x38]
mov qword [rax], r8
cmp ebx, r8d
jl 0x7ff34476dba
mov rdi, qword [rsp + 0x20]
cmp r14, r8
je 0x7ff34476dc4
mov dword [r14], 1
jmp 0x7ff34476dc4
mov rdi, qword [rsp + 0x20]
jmp 0x7ff34476dc4
xor r8d, r8d
mov r15d, r8d
cmp ebp, r8d
jne 0x7ff34476de0
mov rsi, qword [rsi + 0x40]
cmp rsi, r8
jne 0x7ff344769f0
jmp 0x7ff34476de0
mov ebx, 0x80070057
mov eax, ebx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.7ff344779c0
mov rbx, qword [rsp + 0x4d0]
add rsp, 0x490
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret