Function at 0x140070840
Capabilities:
Get common file path
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x44b8
call fcn.140091330
sub rsp, rax
mov rsi, rcx
mov rax, qword [rcx + 0x40]
mov rcx, qword [rax + 0x44a0]
mov qword [rsp + 0x48], rcx
movsxd rbx, dword [rax + 0x44ac]
mov qword [rsp + 0x50], rbx
mov rdi, qword [rsi + 0x38]
call fcn.140007460
cmp dword [rdi + 0x44e0], 0
je 0x1400708aa
mov rax, qword [rdi + 0x4500]
test rax, rax
je 0x1400708aa
movzx eax, byte [rax + 0x122]
mov rbx, qword [rsp + 0x50]
test al, 0x10
jne 0x1400709c7
test rbx, rbx
je 0x140070f22
movsxd rax, dword [rdi + 0x4464]
test rax, rax
je 0x140070903
dec rax
mov rdx, qword [rdi + 0x4458]
movsxd r8, dword [rdi + 0x4460]
imul r8, rax
lea rcx, [rdx + r8]
add rcx, 0x10
mov qword [rdx + r8], rcx
mov rax, qword [rdx + r8 + 8]
test rax, rax
je 0x140070903
cmp rax, rbx
jne 0x140070903
mov r15, qword [rsp + 0x48]
mov rdx, r15
mov r8, rbx
call fcn.140092690
test eax, eax
je 0x140070963
mov eax, dword [rdi + 0x4464]
cmp eax, dword [rdi + 0x4468]
jne 0x140070923
lea rcx, [rdi + 0x4458]
call fcn.140001620
mov eax, dword [rdi + 0x4464]
mov r12, qword [rdi + 0x4458]
movsxd r13, dword [rdi + 0x4460]
cdqe
imul r13, rax
inc eax
mov dword [rdi + 0x4464], eax
lea r14, [r12 + r13]
add r14, 0x10
mov r15, qword [rsp + 0x48]
mov rcx, r14
mov rdx, r15
mov r8, rbx
call fcn.140091e40
mov qword [r12 + r13], r14
mov qword [r12 + r13 + 8], rbx
lea rax, [r15 + rbx]
test rbx, rbx
jg 0x140070978
jmp 0x140070986
inc r15
cmp r15, rax
jae 0x140070986
movzx ecx, byte [r15]
cmp ecx, 0x20
je 0x140070970
cmp ecx, 9
je 0x140070970
cmp r15, rax
je 0x140070f22
jae 0x140070a2f
mov rcx, rax
sub rcx, r15
xor r12d, r12d
nop
movzx edx, byte [r15 + r12]
cmp edx, 9
je 0x140070a32
cmp edx, 0x20
je 0x140070a32
lea rdx, [r15 + r12]
inc rdx
inc r12
cmp rdx, rax
jb 0x1400709a0
mov r12, rcx
jmp 0x140070a32
mov r14, qword [rdi + 0x4500]
movsxd rax, dword [rdi + 0x449c]
test rax, rax
je 0x140070cf8
dec rax
mov rdx, qword [rdi + 0x4490]
movsxd r8, dword [rdi + 0x4498]
imul r8, rax
lea rcx, [rdx + r8]
add rcx, 0x10
mov qword [rdx + r8], rcx
mov rdx, qword [rdx + r8 + 8]
xor eax, eax
test rdx, rdx
je 0x140070cfa
cmp rdx, rbx
jne 0x140070cfa
mov rdx, qword [rsp + 0x48]
mov r8, rbx
call fcn.140092690
test eax, eax
sete al
jmp 0x140070cfa
xor r12d, r12d
lea rbx, [rdi + 0x50]
lea r14, [rsp + 0xa0]
mov rcx, r14
mov rdx, rbx
call fcn.14006cc50
mov qword [rsp + 0xb0], r15
mov qword [rsp + 0xb8], r12
lea rdx, [0x1400aefc2]
lea rcx, [rsp + 0x80]
lea r8, [rsp + 0xb0]
mov r9, r14
call fcn.140002760
lea r14, [rsi + 0x48]
mov rdx, qword [rsp + 0x80]
mov r13, qword [rsp + 0x88]
mov rcx, r14
mov r8, r13
call fcn.140091e40
mov qword [rsi], r14
mov qword [rsi + 8], r13
cmp r12, 2
je 0x140070ad7
cmp r12, 5
je 0x140070c0e
cmp r12, 3
jne 0x140070c28
movzx eax, word [r15]
xor eax, 0x6c63
movzx ecx, byte [r15 + 2]
xor ecx, 0x73
or cx, ax
jne 0x140070c28
jmp 0x140070e40
lea rdx, [0x1400aefce]
mov rcx, r15
mov r8, r12
call fcn.140092690
test eax, eax
jne 0x140070c28
mov eax, dword [rdi + 0x4464]
mov dword [rdi + 0x4510], eax
vmovups xmm0, xmmword [rsp + 0x48]
vmovaps xmmword [rsp + 0xb0], xmm0
lea rdx, [rsp + 0xb0]
mov rcx, rdi
call fcn.1400706e0
mov r14, rax
or byte [rax + 0x122], 4
add r15, r12
mov rbp, qword [rsp + 0x48]
add rbp, qword [rsp + 0x50]
jmp 0x140070b43
inc r15
cmp r15, rbp
jae 0x140070b56
movzx eax, byte [r15]
cmp eax, 0x20
je 0x140070b40
cmp eax, 9
je 0x140070b40
sub rbp, r15
je 0x140070e54
movzx eax, byte [r15]
cmp eax, 0x2f
je 0x140070f56
cmp eax, 0x5c
je 0x140070f56
cmp eax, 0x7e
jne 0x140070f87
lea rcx, [0x1400b4740]
xor r15d, r15d
lea r9, [rsp + 0x58]
xor edx, edx
xor r8d, r8d
call sub.SHELL32.dll_SHGetKnownFolderPath
mov rax, qword [rsp + 0x58]
vxorps xmm0, xmm0, xmm0
vmovaps xmmword [rsp + 0xb0], xmm0
test rax, rax
je 0x140070bde
xor r15d, r15d
cmp word [rax], 0
je 0x140070bce
mov ecx, 1
add r15d, 2
mov edx, ecx
inc ecx
cmp word [rax + rdx*2], 0
jne 0x140070bbc
mov r15d, r15d
mov qword [rsp + 0xb8], r15
mov qword [rsp + 0xb0], rax
shl r15, 2
mov rcx, r15
call fcn.1400011b0
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0xb0]
mov r8, rax
call fcn.140003320
mov r15, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
jmp 0x140070f87
lea rdx, str.clear
mov rcx, r15
mov r8, r12
call fcn.140092690
test eax, eax
je 0x140070e40
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x38], r12
lea rcx, [rsp + 0xb0]
lea rdx, [rsp + 0x30]
call fcn.140003690
vmovups xmm0, xmmword [rsp + 0xb0]
vmovups xmmword [rsp + 0xb0], xmm0
vmovups xmm0, xmmword [rsp + 0x48]
vmovaps xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0xb0]
lea r8, [rsp + 0x30]
mov rcx, rdi
call fcn.14006fe50
test al, al
jne 0x140070cdf
vmovups xmm0, xmmword [rsp + 0x48]
vmovaps xmmword [rsp + 0xb0], xmm0
lea rdx, str.cmd.exe__c__
lea rbx, [rsp + 0x90]
lea r8, [rsp + 0xb0]
mov rcx, rbx
call fcn.140002760
lea rax, str.C:WindowsSystem32cmd.exe
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xb8], 0x1b
lea rdx, [rsp + 0xb0]
mov rcx, rdi
mov r8, rbx
call fcn.14006fe50
test al, al
je 0x140070f37
mov eax, dword [rdi + 0x4464]
mov dword [rdi + 0x4510], eax
mov rcx, rsi
call fcn.1400712a0
jmp 0x140070f22
xor eax, eax
test rbx, rbx
sete cl
or cl, al
jne 0x140070d6d
mov eax, dword [rdi + 0x449c]
cmp eax, dword [rdi + 0x44a0]
jne 0x140070d24
lea rcx, [rdi + 0x4490]
call fcn.140001620
mov eax, dword [rdi + 0x449c]
mov r12, qword [rdi + 0x4490]
movsxd r13, dword [rdi + 0x4498]
cdqe
imul r13, rax
inc eax
mov dword [rdi + 0x449c], eax
lea r15, [r12 + r13]
add r15, 0x10
mov rdx, qword [rsp + 0x48]
mov rcx, r15
mov r8, rbx
call fcn.140091e40
mov qword [r12 + r13], r15
mov qword [r12 + r13 + 8], rbx
mov eax, dword [rdi + 0x449c]
mov dword [rdi + 0x4514], eax
vmovups xmm0, xmmword [rsp + 0x48]
vmovaps xmmword [rsp + 0xb0], xmm0
lea rdx, [0x1400aefbe]
lea rcx, [rsp + 0x48]
lea r8, [rsp + 0xb0]
call fcn.140002760
movzx eax, byte [0x140178b9d]
cmp al, 1
je 0x140070dfe
mov cl, 1
nop word cs:[rax + rax]
movzx eax, byte [r14 + 0x120]
test al, al
jne 0x140070db0
xor eax, eax
lock cmpxchg byte [r14 + 0x120], cl
je 0x140070dcd
pause
jmp 0x140070db0
mov rdi, qword [rsp + 0x50]
lea rcx, [r14 + 0x40]
mov edx, edi
call fcn.1400018f0
mov rdx, qword [rsp + 0x48]
mov rcx, rax
mov r8, rdi
call fcn.140091e40
mov rcx, r14
call fcn.14006f390
xor eax, eax
xchg byte [r14 + 0x120], al
mov dword [rsp + 0x58], 0
mov r8d, dword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [r14 + 0x18]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test al, al
jne 0x140070e35
lock or byte [r14 + 0x122], 2
lock or byte [r14 + 0x122], 4
jmp 0x140070e54
mov eax, dword [rdi + 0x4464]
mov dword [rdi + 0x4510], eax
mov rcx, rdi
call fcn.14006b660
mov rax, qword [rsi + 0x40]
mov dword [rax + 0x44ac], 0
mov rdi, qword [rsi + 0x40]
mov rax, qword [rdi + 0x4570]
mov qword [rdi + 0x4590], rax
mov eax, dword [rdi + 0x44ac]
mov ecx, eax
sar ecx, 0x1f
and ecx, eax
movsxd rbx, ecx
lea rcx, [rsp + 0xb0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
imul rax, qword [rsp + 0xb0], 0xf4240
mov rcx, qword [rsp + 0x30]
mov rdx, rax
or rdx, rcx
shr rdx, 0x20
je 0x140070ec1
xor edx, edx
div rcx
jmp 0x140070ec5
xor edx, edx
div ecx
lea rcx, [rdi + 0x4570]
mov qword [0x1400f2008], rax
lock or word [rdi + 2], 4
mov qword [rdi + 0x4570], rbx
movzx edx, word [rdi + 2]
lea rax, [rdi + 0x4578]
test dl, 2
jne 0x140070ef8
mov rdx, qword [rcx]
mov qword [rax], rdx
jmp 0x140070f08
mov rdx, qword [rax]
cmp rdx, qword [rcx]
jge 0x140070f08
mov rdx, rax
mov rax, rcx
jmp 0x140070f0b
mov rdx, rcx
mov qword [rdi + 0x4580], rdx
mov qword [rdi + 0x4588], rax
mov rcx, qword [rsi + 0x40]
call fcn.140088be0
nop
add rsp, 0x44b8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [rsp + 0x48]
call fcn.140002ce0
lea r8, str.failed_to_execute_command_line__s.
xor ecx, ecx
xor edx, edx
mov r9, rax
call fcn.140007a90
jmp 0x140070f22
test rbp, rbp
jle 0x140070f7b
lea rcx, [r15 + rbp]
mov rax, r15
jmp 0x140070f6c
inc rax
cmp rax, rcx
jae 0x140070f7e
movzx edx, byte [rax]
cmp edx, 0x5c
je 0x140070f64
cmp edx, 0x2f
je 0x140070f64
jmp 0x140070f7e
mov rax, r15
sub r15, rax
add rbp, r15
mov r15, rax
cmp rbp, 2
jl 0x140070ff7
cmp byte [r15 + 1], 0x3a
jne 0x140070ff7
mov qword [rsp + 0xb0], r15
mov qword [rsp + 0xb8], rbp
lea rcx, [rsp + 0xb0]
call fcn.14002b430
test al, al
je 0x140071232
mov word [rdi + 0x4450], 0
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x38], rbp
lea rdi, [rsp + 0xb0]
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.14006acc0
mov r8d, 0x4408
mov rcx, rbx
mov rdx, rdi
call fcn.140091e40
jmp 0x140070e54
mov qword [rsp + 0x68], r14
lea rcx, [rsp + 0xb0]
mov rdx, rbx
call fcn.14006b7e0
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x38], 0
test rbp, rbp
jle 0x1400710fe
add rbp, r15
xor edi, edi
mov r14, r15
jmp 0x140071041
inc rdi
mov qword [rsp + 0x38], rdi
inc r14
cmp r14, rbp
jae 0x140071100
movzx eax, byte [r14]
cmp eax, 0x5c
je 0x14007104f
cmp eax, 0x2f
jne 0x14007102d
test rdi, rdi
je 0x1400710dd
cmp rdi, 1
je 0x140071088
cmp rdi, 2
jne 0x14007109e
movzx eax, word [r15]
cmp eax, 0x2e2e
jne 0x14007109e
movzx eax, word [rsp + 0x44b0]
test ax, ax
je 0x1400710dd
dec eax
mov word [rsp + 0x44b0], ax
jmp 0x1400710dd
mov rcx, r15
lea rdx, [0x1400aa258]
mov r8, rdi
call fcn.140092690
test eax, eax
je 0x1400710dd
movzx eax, word [rsp + 0x44b0]
imul r12, rax, 0x110
inc eax
mov word [rsp + 0x44b0], ax
lea r13, [rsp + r12 + 0xc0]
mov rcx, r13
mov rdx, r15
mov r8, rdi
call fcn.140091e40
mov qword [rsp + r12 + 0xb0], r13
mov qword [rsp + r12 + 0xb8], rdi
inc r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], 0
mov r15, r14
xor edi, edi
cmp r14, rbp
jb 0x140071041
jmp 0x140071100
xor edi, edi
lea rdx, [0x1400aa25a]
lea rcx, [rsp + 0x30]
call fcn.140002dc0
test al, al
je 0x14007112e
movzx eax, word [rsp + 0x44b0]
test ax, ax
je 0x140071187
dec eax
mov word [rsp + 0x44b0], ax
jmp 0x140071187
lea rdx, [0x1400aa258]
lea rcx, [rsp + 0x30]
call fcn.140002dc0
test al, al
jne 0x140071187
test rdi, rdi
je 0x140071187
movzx eax, word [rsp + 0x44b0]
imul r14, rax, 0x110
inc eax
mov word [rsp + 0x44b0], ax
lea r12, [rsp + r14 + 0xc0]
mov rcx, r12
mov rdx, r15
mov r8, rdi
call fcn.140091e40
mov qword [rsp + r14 + 0xb0], r12
mov qword [rsp + r14 + 0xb8], rdi
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0xb0]
call fcn.14006cc50
mov rdi, qword [rsp + 0x58]
mov r14, qword [rsp + 0x60]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], r14
lea rcx, [rsp + 0x58]
call fcn.14002b430
test al, al
je 0x1400711d6
lea rdx, [rsp + 0xb0]
mov r8d, 0x4408
mov rcx, rbx
call fcn.140091e40
jmp 0x140070e54
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], r14
lea rdx, str.Directory___does_not_seem_to_exist.
lea rcx, [rsp + 0x58]
lea r8, [rsp + 0x70]
call fcn.140002760
mov rdi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rcx, rbx
add rcx, 0x40
mov edx, edi
call fcn.1400018f0
mov rdx, qword [rsp + 0x58]
mov rcx, rax
mov r8, rdi
call fcn.140091e40
mov rcx, rbx
call fcn.14006f390
or byte [rbx + 0x122], 2
jmp 0x140070e54
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x38], rbp
lea rdx, str.Directory___does_not_seem_to_exist.
lea rcx, [rsp + 0xb0]
lea r8, [rsp + 0x30]
call fcn.140002760
mov rdi, qword [rsp + 0xb8]
mov rcx, r14
add rcx, 0x40
mov edx, edi
call fcn.1400018f0
mov rdx, qword [rsp + 0xb0]
mov rcx, rax
mov r8, rdi
call fcn.140091e40
mov rcx, r14
call fcn.14006f390
or byte [r14 + 0x122], 2
jmp 0x140070e54