Function at 0x140004d10
Capabilities:
Get common file path

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0xb8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x30], 0xfffffffffffffffe
mov rsi, rcx
lea rdi, [rbp - 0x50]
mov edx, 0x10
mov rcx, rdi
call fcn.140008ee0
mov rcx, rdi
call fcn.140009050
cmp eax, 5
je 0x140004de7
cmp eax, 2
jne 0x140004dac
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
lea r9, [rbp - 0x40]
mov ecx, 0x40000003
xor edx, edx
xor r8d, r8d
call fcn.140008dd0
test byte [rbp - 0x40], 1
jne 0x14000503c
mov dword [rsi], 0
lea rcx, [rsi + 8]
mov qword [rsi + 8], 0
movaps xmm0, xmmword [0x14013f230]
movups xmmword [rsi + 0x18], xmm0
mov byte [rsi + 8], 0
lea r9, str.Running_in_a_guest_Hyper_V_VM__Hyper_V_is_not_supported
mov edx, 0x37
jmp 0x140005069
call fcn.140008f60
test al, al
je 0x140004de7
mov dword [rsi], 0
lea rcx, [rsi + 8]
mov qword [rsi + 8], 0
movaps xmm0, xmmword [0x14013f230]
movups xmmword [rsi + 0x18], xmm0
mov byte [rsi + 8], 0
lea r9, str.Running_in_a_guest_VM__Hyper_V_is_not_supported
mov edx, 0x2f
jmp 0x140005069
lea rbx, [rbp + 0x20]
mov edx, 0x104
mov rcx, rbx
call fcn.140018280
mov rdi, qword [rbp + 0x28]
mov rcx, rbx
call fcn.140018660
add edi, 1
mov rcx, rax
mov edx, edi
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov edx, eax
cmp qword [rbp + 0x28], rdx
jae 0x140004e3e
lea rcx, [rbp + 0x20]
call fcn.1400182d0
mov rdi, qword [rbp + 0x28]
lea rcx, [rbp + 0x20]
call fcn.140018660
add edi, 1
mov rcx, rax
mov edx, edi
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x140004e55
mov edx, eax
cmp qword [rbp + 0x28], rdx
je 0x140004e65
lea rcx, [rbp + 0x20]
call fcn.1400182d0
jmp 0x140004e65
lea rdx, str.C:Windows
lea rcx, [rbp + 0x20]
call fcn.140018580
lea rcx, [rbp + 0x20]
mov rdi, rbp
mov rdx, rdi
call fcn.140018680
mov rax, qword [rbp + 0x10]
cmp qword [rbp + 0x18], 0x10
jb 0x140004e83
mov rdi, qword [rbp]
lea rcx, str.System32
mov qword [rbp - 0x20], rcx
mov qword [rbp - 0x18], 8
mov qword [rbp - 0x10], rdi
mov qword [rbp - 8], rax
lea rdi, [rbp - 0x40]
lea rdx, [rbp - 0x10]
lea r8, [rbp - 0x20]
mov rcx, rdi
mov r9d, 1
call fcn.1400194e0
mov rax, qword [rbp + 0x18]
cmp rax, 0x10
jb 0x140004ef7
mov rcx, qword [rbp]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140004ef2
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x14000507d
add rax, 0x28
mov rdx, rax
mov rcx, rbx
call fcn.1400651e0
mov rax, qword [rbp - 0x30]
cmp qword [rbp - 0x28], 0x10
jb 0x140004f06
mov rdi, qword [rbp - 0x40]
lea rcx, str.vmms.exe
mov qword [rbp - 0x20], rcx
mov qword [rbp - 0x18], 8
mov qword [rbp - 0x10], rdi
mov qword [rbp - 8], rax
mov rdi, rbp
lea rdx, [rbp - 0x10]
lea r8, [rbp - 0x20]
mov rcx, rdi
mov r9d, 1
call fcn.1400194e0
cmp qword [rbp + 0x18], 0x10
jb 0x140004f45
mov rdi, qword [rbp]
mov rcx, rdi
call fcn.14001f1d0
test eax, eax
je 0x140004f85
mov dword [rsi], 1
lea rcx, [rsi + 8]
mov qword [rsi + 8], 0
movaps xmm0, xmmword [0x14013f230]
movups xmmword [rsi + 0x18], xmm0
mov byte [rsi + 8], 0
lea r9, str.Hyper_V_is_disabled
mov edx, 0x13
call fcn.140003190
jmp 0x140004fb7
mov dword [rsi], 0
lea rcx, [rsi + 8]
mov qword [rsi + 8], 0
movaps xmm0, xmmword [0x14013f230]
movups xmmword [rsi + 0x18], xmm0
mov byte [rsi + 8], 0
lea r9, str.Hyper_V_is_not_installed
mov edx, 0x18
call fcn.140003190
mov rax, qword [rbp + 0x18]
cmp rax, 0x10
jb 0x140004ff6
mov rcx, qword [rbp]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140004ff1
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x14000507d
add rax, 0x28
mov rdx, rax
mov rcx, rbx
call fcn.1400651e0
mov rax, qword [rbp - 0x28]
cmp rax, 0x10
jb 0x140005031
mov rcx, qword [rbp - 0x40]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14000502c
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x14000507d
add rax, 0x28
mov rdx, rax
mov rcx, rbx
call fcn.1400651e0
lea rcx, [rbp + 0x20]
call fcn.140018490
jmp 0x14000506e
mov dword [rsi], 2
lea rcx, [rsi + 8]
mov qword [rsi + 8], 0
movaps xmm0, xmmword [0x14013f230]
movups xmmword [rsi + 0x18], xmm0
mov byte [rsi + 8], 0
lea r9, str.Hyper_V_is_enabled
mov edx, 0x12
call fcn.140003190
mov rax, rsi
add rsp, 0xb8
pop rbx
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3