Function at 0x180042d70
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x180]
sub rsp, 0x290
mov rax, qword [0x1800791a8]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov rax, qword [rbp + 0x1e8]
lea r12d, [r9 - 0x12]
mov ebx, dword [rbp - 0x80]
mov r14d, r9d
mov qword [rbp - 0x38], r8
mov rsi, rcx
mov r8, qword [rbp + 0x1e0]
mov qword [rbp - 0x58], r8
mov qword [rbp - 0x30], rdx
mov qword [rbp - 0x48], rcx
mov qword [rbp - 0x40], rax
cmp r9d, r12d
jbe case.0x180042e19.3
mov r13, qword [rbp - 0x48]
lea r15d, [r9 - 0xac]
xor edx, edx
lea r9, [0x180000000]
mov r10d, 0x64
mov edi, 0x6d6f
lea r11d, [r10 + 0x13]
cmp r15d, 0x26
ja case.0x180042e19.18
movzx eax, byte [r9 + r15 + 0x4340c]
mov ecx, dword [r9 + rax*4 + 0x433c0]
add rcx, r9
jmp rcx
mov word [rbp + 0x48], r11w
mov word [rbp + 0x49], r11w
mov dword [rbp + 0x4a], 0x65722e77
mov word [rbp + 0x4e], r10w
jmp case.0x180042e19.18
mov r8d, 2
lea rdx, [0x18006e7fd]
lea rcx, [rbp + 0x30]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov byte [rbp + 0x37], 0x73
jmp 0x1800433a2
mov eax, 0x69
mov word [rbp + 0x4f], r10w
mov word [rbp + 0x50], ax
jmp case.0x180042e19.18
mov ecx, 0x60038
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdx, qword [rbp - 0x58]
lea r8, [rbp - 0x70]
mov rdi, rax
mov dword [rsp + 0x30], 0xd8
mov rax, qword [rbp - 0x40]
lea rcx, [rbp - 0x78]
mov r9, rdi
mov eax, dword [rax]
mov dword [rbp - 0x70], eax
mov rax, qword [rbp - 0x38]
mov eax, dword [rax]
mov dword [rbp - 0x78], eax
mov rax, qword [rbp - 0x30]
mov eax, dword [rax]
mov dword [rbp - 0x68], eax
lea rax, [rbp - 0x68]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
call fcn.180010d90
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x1800433a2
mov dword [rbp + 0x51], 0x632e74
mov word [rbp + 0x54], di
mov byte [rbp + 0x56], 0
mov byte [rbp + 0x30], 0
jmp case.0x180042e19.18
mov eax, dword [str.json]
mov r8, 0xffffffffffffffff
mov dword [rbp + 0x40], eax
movzx eax, byte [0x18006e81c]
mov byte [rbp + 0x44], al
lea rax, [rbp + 0x48]
mov byte [rbp + 0x38], 0
inc r8
cmp byte [rax + r8], 0
jne 0x180042f06
lea rdx, [rbp + 0x48]
mov rcx, rsi
call fcn.180025720
xor edx, edx
mov r13d, edx
jmp case.0x180042e19.18
mov rcx, qword [rsi + 0x30]
lea rdi, [rsi + 0x20]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x180042f53
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x180042f4b
mov rax, qword [rdi]
mov word [rax + rcx], 0x2e
jmp 0x180042f65
xor r8d, r8d
mov r9b, 0x2e
mov rcx, rdi
lea edx, [r8 + 1]
call fcn.180003820
xor esi, esi
lea rax, [rbp + 0x40]
mov dword [rbp - 0x60], esi
mov rsi, 0xffffffffffffffff
inc rsi
cmp byte [rax + rsi], 0
jne 0x180042f75
mov rdx, qword [rdi + 0x18]
mov rcx, qword [rdi + 0x10]
mov rax, rdx
sub rax, rcx
cmp rsi, rax
ja 0x180042fbd
lea rax, [rcx + rsi]
mov qword [rdi + 0x10], rax
cmp rdx, 0x10
jb 0x180042fa2
mov rdi, qword [rdi]
add rdi, rcx
lea rdx, [rbp + 0x40]
mov rcx, rdi
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rsi], 0
jmp 0x1800433a2
lea r9, [rbp + 0x40]
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
call fcn.180003980
jmp 0x1800433a2
lea rcx, [0x180032f00]
mov edi, 0x62
mov qword [rbp - 0x70], rcx
nop dword [rax]
mov eax, edi
sub eax, 0x44
je 0x180043019
sub eax, 0x1e
je 0x180043013
sub eax, 0x44
je 0x18004305f
sub eax, 0x1e
je 0x18004300d
cmp eax, 0x62
je 0x18004305f
jmp 0x180043054
mov qword [rbp + 8], rdx
jmp 0x180043054
mov qword [rbp], rcx
jmp 0x180043054
mov eax, dword [pe_dos_header]
lea r9, [rbp - 0x78]
dec eax
mov qword [rsp + 0x20], rdx
lea r8, [rbp - 0x10]
mov dword [rbp - 0x78], eax
lea rdx, [rbp - 0x6f]
mov ecx, 0x10f
call fcn.18005c1e0
test eax, eax
jne 0x18004305f
mov rcx, qword [rbp - 0x70]
xor edx, edx
mov eax, edx
test cl, cl
setne al
mov dword [rbp - 8], eax
add edi, 0x62
cmp edi, 0x24c
jb 0x180042ff0
mov edi, 0xa
xor esi, esi
nop word [rax + rax]
mov r9d, 0xae
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.180035c00
lea r9, [rbp - 0x50]
mov qword [rsp + 0x28], rsi
lea r8, [rbp - 0x10]
mov qword [rbp - 0x50], rax
xor edx, edx
mov qword [rsp + 0x20], rsi
mov ecx, 0xcd
call fcn.180029510
movsd xmm1, qword [rbp - 0x50]
lea rcx, str.NoArguments
movq rdx, xmm1
call fcn.180068710
sub rdi, 1
jne 0x180043070
jmp 0x1800433a2
mov r9d, dword [rbp - 0x60]
mov eax, 0x1bb
mov r8, qword [rbp - 0x20]
mov rcx, r13
mov edx, dword [rbp - 0x80]
mov word [rsi + 0x80], ax
lea rax, [rbp + 0x60]
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
jmp 0x1800433a2
mov qword [rsp + 0x28], rdx
lea rax, [rsi + 0x40]
xor edx, edx
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor ecx, ecx
mov r8d, 0x11c
call fcn.1800259e0
jmp 0x1800433a2
mov rcx, qword [rsi + 0x30]
lea rdi, [rsi + 0x20]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x180043145
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x18004313d
mov rax, qword [rdi]
mov word [rax + rcx], 0x2f
jmp 0x180043157
xor r8d, r8d
mov r9b, 0x2f
mov rcx, rdi
lea edx, [r8 + 1]
call fcn.180003820
lea rax, [rbp + 0x30]
mov rsi, 0xffffffffffffffff
inc rsi
cmp byte [rax + rsi], 0
jne 0x180043162
mov rdx, qword [rdi + 0x18]
mov rcx, qword [rdi + 0x10]
mov rax, rdx
sub rax, rcx
cmp rsi, rax
ja 0x1800431aa
lea rax, [rcx + rsi]
mov qword [rdi + 0x10], rax
cmp rdx, 0x10
jb 0x18004318f
mov rdi, qword [rdi]
add rdi, rcx
lea rdx, [rbp + 0x30]
mov rcx, rdi
mov r8, rsi
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + rsi], 0
jmp 0x1800433a2
lea r9, [rbp + 0x30]
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
call fcn.180003980
jmp 0x1800433a2
mov r8d, 1
lea rdx, [0x18006e834]
lea rcx, [rbp + 0x30]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp 0x1800433a2
movzx eax, word [0x18006e849]
mov word [rbp + 0x31], ax
movzx eax, byte [0x18006e84b]
mov byte [rbp + 0x33], al
jmp case.0x180042e19.18
mov esi, 0x62
cmp esi, 0x62
je 0x180043267
cmp esi, 0x454a
je 0x180043246
cmp esi, 0x8a32
jne 0x1800432ec
mov eax, ebx
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.180068d70
mov rbx, qword [rsp + 0x2e8]
add rsp, 0x290
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor r9d, r9d
mov qword [rsp + 0x20], rdx
xor r8d, r8d
lea rdx, [rbp - 0x10]
lea ecx, [r9 + 0x65]
call fcn.180016bc0
xor edx, edx
mov ebx, edx
jmp 0x1800432ec
mov edi, 0xa
nop dword [rax]
mov qword [rsp + 0x80], rdx
lea rax, [rbp - 0x28]
mov qword [rsp + 0x78], rdx
lea r8, [rbp - 0x10]
mov qword [rsp + 0x70], rdx
xor r9d, r9d
mov qword [rsp + 0x68], rdx
xor ecx, ecx
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x40], rdx
mov dword [rsp + 0x38], 0xbc
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rdx
xor edx, edx
call fcn.18002a990
movsd xmm1, qword [rbp - 0x28]
lea rcx, str.Compression:__s
movq rdx, xmm1
call fcn.180068710
mov edx, 0
sub rdi, 1
jne 0x180043270
add esi, 0x44e8
cmp esi, 0xceb8
jbe 0x180043201
mov word [rbp + 0x34], 0x65
jmp case.0x180042e19.18
mov rcx, qword [rsi + 0x30]
lea rdi, [rsi + 0x20]
mov rdx, qword [rdi + 0x18]
mov dword [rbp - 0x80], 0x36
cmp rcx, rdx
jae 0x18004333d
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x180043335
mov rax, qword [rdi]
mov word [rax + rcx], 0x2f
jmp 0x180043353
xor r8d, r8d
mov r9b, 0x2f
mov rcx, rdi
lea edx, [r8 + 1]
call fcn.180003820
mov r8, qword [rbp - 0x58]
xor esi, esi
mov rdx, r8
cmp qword [r8 + 0x18], 0x10
mov qword [rbp - 0x20], rsi
jb 0x180043366
mov rdx, qword [r8]
mov r8, qword [r8 + 0x10]
mov rcx, rdi
call fcn.180025390
jmp 0x1800433a2
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
xor r9d, r9d
mov qword [rbp - 0x78], 8
lea r8, [rbp - 0x78]
mov edx, 0xec
lea rcx, [rbp - 0x10]
call fcn.180064890
xor edx, edx
dec r14d
dec r15d
cmp r14d, r12d
jbe case.0x180042e19.3
mov rsi, qword [rbp - 0x48]
mov r8, qword [rbp - 0x58]
jmp 0x180042de5