Function at 0x140002ebc
Capabilities:
Get common file path
Set current directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x14000c008]
xor rax, rsp
mov qword [rsp + 0x250], rax
xor esi, esi
cmp word [0x14000cbf8], si
jne 0x140002f15
cmp dword [0x14000cbe4], esi
jne 0x140002f0c
call fcn.140005d2c
test eax, eax
jne 0x140002f03
xor eax, eax
jmp 0x14000312d
cmp word [0x14000cbf8], si
jne 0x140002f15
call fcn.140003d4c
test eax, eax
je 0x140002efc
call fcn.140005c6c
test eax, eax
je 0x140002efc
call fcn.140006174
test eax, eax
je 0x140002efc
mov ebx, 0x105
lea rcx, [rsp + 0x30]
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea r8, str.advapi32.dll
mov edx, ebx
lea rcx, [rsp + 0x30]
call fcn.140007628
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x140002f8b
lea rdx, str.DecryptFileA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x140002f8b
mov rcx, rax
call qword [0x140009520]
xor edx, edx
lea rcx, [0x14000d610]
call rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [0x14000cbe4], esi
jne 0x140003015
cmp dword [0x14000de60], esi
jne 0x140003015
mov edx, 0x104
lea rcx, [rsp + 0x140]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x140002ff8
mov edx, 0x4f0
xor r9d, r9d
mov dword [rsp + 0x28], esi
xor r8d, r8d
mov dword [rsp + 0x20], FDIDestroy
xor ecx, ecx
call fcn.140004b0c
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov dword [0x14000de7c], ecx
jmp 0x140002efc
mov edx, 2
lea rcx, [rsp + 0x140]
mov r8d, edx
call fcn.140006738
test eax, eax
je 0x140002efc
lea rcx, [0x14000d610]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x14000302d
mov edx, 0x4bc
jmp 0x140002fc0
cmp dword [0x14000cbec], esi
jne 0x1400030c9
lea rax, [0x14000cf20]
mov ecx, 0x28
mov dword [rax], 1
lea rax, [rax + 0x20]
sub rcx, 1
jne 0x140003045
test byte [0x14000cbf8], 1
jne 0x1400030a6
test byte [0x14000de64], 1
jne 0x1400030a6
mov eax, dword [0x14000c204]
lea r9, [0x1400037a0]
neg eax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
sbb rdx, rdx
xor r8d, r8d
add rdx, 0x7d5
call fcn.1400074f0
test rax, rax
jne 0x1400030af
mov dword [0x14000de7c], 0x8007042b
jmp 0x140002efc
call fcn.140005a60
test eax, eax
jmp 0x140003095
lea rcx, [0x140007300]
call fcn.140007188
test eax, eax
je 0x140002efc
mov dword [0x14000de7c], esi
mov eax, dword [0x14000cf08]
test al, 0x40
jne 0x1400030eb
test al, al
js 0x1400030eb
movzx ecx, word [0x14000de74]
call fcn.140002140
mov dword [0x14000de70], eax
jmp 0x1400030f1
mov dword [0x14000de70], esi
mov eax, dword [0x14000cbe4]
test eax, eax
jne 0x140003116
cmp dword [0x14000de60], esi
jne 0x140003116
call fcn.140003e8c
test eax, eax
je 0x140002efc
mov eax, dword [0x14000cbe4]
cmp word [0x14000cbf8], si
jne 0x140003128
test eax, eax
jne 0x140003128
call fcn.1400046c4
mov eax, 1
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140007e20
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret