Function at 0x1401473c0
Capabilities:
Get common file path

Disassembly:
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x390]
sub rsp, 0x490
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x4b0], rbx
mov rax, qword [0x140418a10]
xor rax, rsp
mov qword [rbp + 0x380], rax
mov rsi, r8
mov rdi, rdx
xor bl, bl
mov edx, 0x104
lea rcx, [rbp + 0x170]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea r8, [0x140356258]
mov edx, 0x104
lea rcx, [rbp + 0x170]
call fcn.1402bbbd8
cmp dword [rdi + 0xc], 0
je 0x140147600
mov edx, 0x5c
mov rcx, qword [rdi]
call fcn.1402bcbec
test rax, rax
je 0x140147600
sub rax, qword [rdi]
sar rax, 1
test eax, eax
js 0x140147600
xor r8d, r8d
lea rdx, str.system32_
mov rcx, rdi
call fcn.1402019e0
test al, al
je 0x1401474e2
mov edx, 0x104
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x140147684
mov r8d, 8
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.1402011d0
nop
mov r8, rax
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x30]
call fcn.1401fddd0
nop
mov rdx, rax
mov rcx, rsi
call fcn.1401fd670
nop
cmp dword [rsp + 0x38], 0
jle 0x1401474c8
mov rcx, qword [rsp + 0x30]
call fcn.1402b9c20
nop
cmp dword [rsp + 0x48], 0
jle 0x140147682
mov rcx, qword [rsp + 0x40]
call fcn.1402b9c20
jmp 0x140147682
xor r8d, r8d
lea rdx, str.SystemRoot_
mov rcx, rdi
call fcn.1402019e0
test al, al
je 0x14014756f
mov edx, 0x104
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x140147684
mov r8d, 0xb
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.1402011d0
nop
mov r8, rax
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.1401fddd0
nop
mov rdx, rax
mov rcx, rsi
call fcn.1401fd670
nop
cmp dword [rsp + 0x48], 0
jle 0x140147555
mov rcx, qword [rsp + 0x40]
call fcn.1402b9c20
nop
cmp dword [rsp + 0x38], 0
jle 0x140147682
mov rcx, qword [rsp + 0x30]
call fcn.1402b9c20
jmp 0x140147682
xor r8d, r8d
lea rdx, str.WINDOWS_
mov rcx, rdi
call fcn.1402019e0
test al, al
je 0x140147684
mov edx, 0x104
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x140147684
mov r8d, 8
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.1402011d0
nop
mov r8, rax
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.1401fddd0
nop
mov rdx, rax
mov rcx, rsi
call fcn.1401fd670
nop
cmp dword [rsp + 0x48], 0
jle 0x1401475e6
mov rcx, qword [rsp + 0x40]
call fcn.1402b9c20
nop
cmp dword [rsp + 0x38], 0
jle 0x140147682
mov rcx, qword [rsp + 0x30]
call fcn.1402b9c20
jmp 0x140147682
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x104
xor r8d, r8d
mov rdx, qword [rdi]
lea rcx, [rbp + 0x170]
call qword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
je 0x140147684
lea rax, [rsp + 0x60]
or rbx, 0xffffffffffffffff
nop word [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140147640
test ebx, ebx
jle 0x140147672
mov edx, ebx
mov rcx, rsi
call fcn.1401ff260
movsxd r9, ebx
mov eax, dword [rsi + 8]
inc eax
movsxd rdx, eax
lea r8, [rsp + 0x60]
mov rcx, qword [rsi]
call fcn.1402bd21c
jmp 0x140147678
cmp dword [rsi + 0xc], 0
jle 0x140147682
mov edx, ebx
mov rcx, rsi
call fcn.140200570
mov bl, 1
movzx eax, bl
mov rcx, qword [rbp + 0x380]
xor rcx, rsp
call fcn.1402b9610
mov rbx, qword [rsp + 0x4b0]
add rsp, 0x490
pop rdi
pop rsi
pop rbp
ret