Function at 0x1400390e0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x4d0]
sub rsp, 0x5d0
mov rax, qword [0x1402a2cf8]
xor rax, rsp
mov qword [rbp + 0x4c0], rax
mov qword [rsp + 0x58], rdx
mov rdi, rcx
mov qword [rsp + 0x60], rdx
xor edx, edx
mov r8d, 0x180
lea rcx, [rbp - 0x50]
call fcn.1400b6650
lea rcx, [rbp - 0x50]
call fcn.140013b50
nop
xor edx, edx
mov r8d, 0x180
lea rcx, [rbp + 0x130]
call fcn.1400b6650
lea rcx, [rbp + 0x130]
call fcn.140013b50
nop
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x2b0]
call fcn.1400b6650
mov edx, 0x104
lea rcx, [rbp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xor esi, esi
mov qword [rbp - 0x60], rsi
mov ebx, 7
mov qword [rbp - 0x58], rbx
mov word [rbp - 0x70], si
lea rax, [rbp + 0x2b0]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], si
jne 0x1400391b0
lea rdx, [rbp + 0x2b0]
lea rcx, [rbp - 0x70]
call fcn.1400098b0
nop
cmp byte [rdi], 0
je 0x140039309
movabs rdi, 0x7ffffffffffffffe
mov rax, rdi
mov r15, qword [rbp - 0x60]
sub rax, r15
cmp rax, 0x13
jb 0x140039635
lea rax, [rbp - 0x70]
mov r14, qword [rbp - 0x70]
mov r12, qword [rbp - 0x58]
cmp r12, 8
cmovae rax, r14
mov qword [rsp + 0x20], rax
mov qword [rbp - 0x80], rsi
mov qword [rbp - 0x78], rsi
lea r13, [r15 + 0x13]
lea rsi, [rsp + 0x70]
cmp r13, 7
jbe 0x14003925f
mov rbx, r13
or rbx, 7
cmp rbx, rdi
jbe 0x140039233
mov rbx, rdi
jmp 0x140039244
mov r13d, 0xa
cmp rbx, r13
cmovb rbx, r13
lea r13, [r15 + 0x13]
lea rdx, [rbx + 1]
lea rcx, [rsp + 0x70]
call fcn.1400099e0
mov rsi, rax
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x20]
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], rbx
lea rbx, [r15 + r15]
mov r8, rbx
mov rdx, rax
mov rcx, rsi
call fcn.1400b76e0
movups xmm0, xmmword [str.System32_ntdll.dll]
movups xmmword [rbx + rsi], xmm0
movups xmm1, xmmword [0x1401209b0]
movups xmmword [rbx + rsi + 0x10], xmm1
mov eax, dword [0x1401209c0]
mov dword [rbx + rsi + 0x20], eax
movzx eax, word [0x1401209c4]
mov word [rbx + rsi + 0x24], ax
xor eax, eax
mov word [rsi + r13*2], ax
mov r8b, 1
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x50]
call fcn.140013e50
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x140039588
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400392ff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003963b
call fcn.14009aa1c
jmp 0x140039588
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
movzx eax, byte [rdi + 1]
mov qword [rsp + 0x70], rsi
mov byte [rsp + 0x78], al
test al, al
je 0x14003932e
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
nop
movabs rdi, 0x7ffffffffffffffe
mov rax, rdi
mov rcx, qword [rbp - 0x60]
sub rax, rcx
cmp rax, 0x13
jb 0x140039641
lea rax, [rbp - 0x70]
mov r14, qword [rbp - 0x70]
mov r12, qword [rbp - 0x58]
cmp r12, 8
cmovae rax, r14
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rsi
lea r15, [rcx + 0x13]
mov rsi, rbx
lea rax, [rsp + 0x28]
mov qword [rsp + 0x50], rax
mov r13d, 0xa
cmp r15, rbx
jbe 0x1400393bf
mov rsi, r15
or rsi, 7
cmp rsi, rdi
jbe 0x14003939c
mov rsi, rdi
jmp 0x1400393a3
cmp rsi, r13
cmovb rsi, r13
lea rdx, [rsi + 1]
lea rcx, [rsp + 0x28]
call fcn.1400099e0
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x28], rax
mov rcx, qword [rbp - 0x60]
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x40], rsi
lea r8, [rcx + rcx]
mov qword [rsp + 0x20], r8
mov rdx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rcx, rsi
call fcn.1400b76e0
movups xmm0, xmmword [str.System32_ntdll.dll]
mov rcx, qword [rsp + 0x20]
movups xmmword [rcx + rsi], xmm0
movups xmm1, xmmword [0x1401209b0]
movups xmmword [rcx + rsi + 0x10], xmm1
mov eax, dword [0x1401209c0]
mov dword [rcx + rsi + 0x20], eax
movzx eax, word [0x1401209c4]
mov word [rcx + rsi + 0x24], ax
xor eax, eax
mov word [rsi + r15*2], ax
mov r8b, 1
lea rdx, [rsp + 0x28]
lea rcx, [rbp + 0x130]
call fcn.140013e50
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x140039474
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003946f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140039647
call fcn.14009aa1c
lea rax, [rbp - 0x70]
cmp r12, 8
cmovae rax, r14
mov qword [rsp + 0x48], rax
xor ecx, ecx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rcx
lea rsi, [rsp + 0x28]
cmp r15, 7
jbe 0x1400394d0
mov rbx, r15
or rbx, 7
cmp rbx, rdi
jbe 0x1400394ad
mov rbx, rdi
jmp 0x1400394b5
cmp rbx, 0xa
cmovb rbx, r13
lea rdx, [rbx + 1]
lea rcx, [rsp + 0x28]
call fcn.1400099e0
mov rsi, rax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x40], rbx
mov rbx, qword [rsp + 0x20]
mov r8, rbx
mov rdx, rax
mov rcx, rsi
call fcn.1400b76e0
movups xmm0, xmmword [str.SysWOW64_ntdll.dll]
movups xmmword [rsi + rbx], xmm0
movups xmm1, xmmword [0x140120988]
movups xmmword [rsi + rbx + 0x10], xmm1
mov eax, dword [0x140120998]
mov dword [rsi + rbx + 0x20], eax
movzx eax, word [0x14012099c]
mov word [rsi + rbx + 0x24], ax
xor eax, eax
mov word [rsi + r15*2], ax
mov r8b, 1
lea rdx, [rsp + 0x28]
lea rcx, [rbp - 0x50]
call fcn.140013e50
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x140039576
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140039570
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003964d
call fcn.14009aa1c
nop
cmp byte [rsp + 0x78], 0
je 0x140039588
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
lea rdx, [rbp - 0x50]
mov rbx, qword [rsp + 0x58]
mov rcx, rbx
call fcn.140039660
nop
lea rcx, [rbx + 0x180]
lea rdx, [rbp + 0x130]
call fcn.140039660
nop
cmp r12, 8
jb 0x1400395e6
lea rdx, [r12*2 + 2]
mov rax, r14
cmp rdx, 0x1000
jb 0x1400395dd
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003962f
mov rcx, r14
call fcn.14009aa1c
nop
lea rcx, [rbp + 0x130]
call fcn.140013c50
nop
lea rcx, [rbp - 0x50]
call fcn.140013c50
mov rax, rbx
mov rcx, qword [rbp + 0x4c0]
xor rcx, rsp
call fcn.14009a9c0
lea r11, [rsp + 0x5d0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400c88c8
nop
call fcn.140001830
int3
call fcn.1400c88c8
nop
call fcn.140001830
int3
call fcn.1400c88c8
int3
call fcn.1400c88c8
int3