Function at 0x1400987a0
Capabilities:
Get common file path

Disassembly:
xchg r11, r9
mov r9, rsp
xchg r11, r9
nop
jmp 0x140098860
add rsp, 0xfffffffffffffb10
mov dword [rsp - 0x3c], ebp
mov rax, qword [0x140248220]
jmp 0x1400988c8
mov r15, r15
test al, al
jne 0x1400987f3
jmp 0x1400988ee
add edx, 0x3199deff
sub edx, 0x379d8597
mov dword [rsp + 0x54], eax
mov rcx, rcx
mov dword [rsp + 0x50], r9d
jmp 0x140098821
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
jmp 0x1400987c6
mov qword [r11 - 0x20], r15
xchg rdi, r15
lea rcx, [rbp + 0x120]
mov qword [r11 - 0x28], r14
xchg rbp, rdi
mov rbp, rdx
jmp 0x1400988f3
test r8b, r8b
je 0x140098927
mov dword [rsp - 0x2c], 0x1f1f2788
jmp 0x140098875
sub edx, 0x3d8b6568
add edx, 0x5f7f4169
sub edx, 0x625da2b0
xor edx, 0x29f139f8
add edx, 0x22502b46
sub edx, 0x400fbca1
jmp 0x1400987d6
push 0x67fb24e6
mov qword [rsp], rbp
lea rbp, [r11 - 0x3f8]
jmp 0x1400987af
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov eax, dword [0x14011088c]
lea rcx, [rbp - 0x24]
mov dword [rbp - 0x24], eax
mov r8, r8
jmp 0x140098910
mov dword [rsp - 0x34], ecx
cmp byte [rcx + 1], r14b
lea rcx, [rcx + 1]
jne 0x140098894
lea r8, [rbp + 0x120]
jmp 0x1400988ae
mov r15, r15
xor edx, edx
nop dword [rax]
nop word [rax + rax]
mov rdi, rdi
jmp 0x1400987f3
xor rax, rsp
xchg r12, rax
mov qword [rbp + 0x3c0], r12
jmp 0x1400988d9
xchg r12, rax
mov qword [r11 - 0x18], rsi
mov dword [rsp - 0xc], edi
mov rsi, rcx
xchg r15, rdi
jmp 0x140098804
jmp 0x1400989b6
xchg rbp, rdi
xor r14d, r14d
mov dword [rsp - 0x24], esp
movzx eax, r8b
mov dword [rsp + 0x48], r14d
mov edx, 0x4a9bc83a
jmp 0x140098837
dec rcx
movzx eax, byte [0x140110890]
mov byte [rbp - 0x20], al
nop dword [rax + rax]
jmp 0x140098890
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryA]
mov eax, dword [0x14011088c]
lea rcx, [rbp - 0x24]
mov dword [rsp - 0x20], esp
jmp 0x1400989f8
mov dword [rsp - 0x24], 0x4556dde5
mov word [rcx], ax
mov eax, dword [rbp + 0x438]
jmp 0x1400989e1
lea rcx, [rcx + 1]
jne 0x1400989c9
movzx eax, word [0x140110894]
jmp 0x140098940
movzx eax, byte [r8 + rdx]
mov dword [rsp - 0x2c], 0x5df0427b
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x14009896c
xchg r12, r12
jmp 0x1400989b6
lea rcx, [rcx + 1]
jne 0x1400989d8
mov rdi, rdi
lea r8, [rbp + 0x120]
xor edx, edx
nop word [rax + rax]
jmp 0x14009896c
lea rcx, [rbp - 0x24]
dec rcx
nop word [rax + rax]
mov r12, r12
cmp byte [rcx + 1], r14b
jmp 0x140098956
xchg r14, r14
mov byte [rbp - 0x20], al
cmp byte [rcx + 1], r14b
jmp 0x140098990
cmp eax, 0xffffffff
xchg r15, r15
je 0x140098a0a
mov dword [rbp + 0xd0], eax
jmp 0x140098d2a
mov dword [rbp - 0x24], eax
dec rcx
movzx eax, byte [0x140110890]
jmp 0x1400989d2
mov qword [rsp + 0x4e8], rbx
mov dword [rsp - 0x40], ecx
nop
jmp 0x140098c4a
lea rcx, [rbp + 0x28]
xor byte [rsp + 0x41], 0x33
mov dword [rsp - 0x18], esi
xor byte [rsp + 0x42], 0x34
xor byte [rsp + 0x43], 0x35
mov word [rsp + 0x44], ax
jmp 0x140098d35
mov ecx, 0x796bdfe7
sub ecx, 0x56f428ad
add ecx, 0x593ac62e
xor ecx, 0x6db419c8
xor ecx, 0x30805798
xor ecx, 0x16470ace
sub ecx, 0xe4a2368
jmp 0x140098cc2
mov r12, rbx
xchg r12, r8
nop dword [rax]
mov rdx, rdx
inc r8
cmp byte [rdi + r8], r14b
jne 0x140098a7b
jmp 0x140098bdc
mov dword [rsp - 0x2c], ecx
lea rdx, [rsp + 0x48]
xchg r10, rdx
mov qword [rsp + 0x30], r10
xchg rdx, r10
mov edx, 0x3d8198de
jmp 0x140098b68
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
movsxd rax, dword [rbp + 0x428]
lea rdx, [rbp + 0x1a0]
jmp 0x140098a3d
xchg r8, r8
mov eax, dword [str.n_f_vi]
lea r8, [rbp + 0x2b3]
mov dword [rsp + 0x40], eax
mov dword [rsp - 0x28], 0x2d70f531
lea rdx, [rsp + 0x40]
movzx eax, word [0x140110888]
jmp 0x140098a1c
sub byte [rbp + 0xc8], 0x2d
sub byte [rbp + 0xc8], 0x44
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [rsp - 0x34], 0xb542866
jmp 0x140098bef
sub byte [rsp + 0x40], 3
sub byte [rsp + 0x40], 0x25
xor byte [rsp + 0x40], 0x50
jmp 0x140098eae
mov rsp, rsp
mov word [rax], r14w
mov rax, qword [rsi + 0x30]
lea r8, [rsp + 0x50]
xchg rdx, r14
mov qword [rsp + 0x38], rdx
xchg r14, rdx
jmp 0x140098c9e
mov qword [rsp + 0x20], rbp
xchg r14, rbp
call rax
mov r14, qword [rsp + 0x4d0]
xchg rbp, rbp
mov rsi, qword [rsp + 0x4e0]
jmp 0x140098d72
add edx, 0x22622e44
sub edx, 0x49fdb46
add edx, 0xc561e3a
sub edx, 0x2038d8db
xor edx, 0xa387343
jmp 0x140098c75
xchg r10, r10
mov dword [rbp - 0x28], ebx
xchg rbx, r8
mov r8, qword [rsp + 0x4e8]
xchg rbx, r8
mov dword [rbp + 0xd0], 0xf8151b9
xor dword [rbp + 0xd0], 0x3b6827a6
jmp 0x140098cee
mov rbp, rbp
call fcn.1400ddff8
xchg rdi, rsi
mov rsi, qword [rsp + 0x4d8]
xchg rsi, rdi
test rax, rax
je 0x140098b2d
jmp 0x140098b26
inc r8
xchg r10, r10
lea rcx, [rsp + 0x58]
xchg rdx, r8
jmp 0x140098dfd
movzx ecx, byte [rbp + 0x1a0]
lea rdx, [rbp + 0x2b0]
mov r8d, 0x9033bfa
add r8d, 0x4d5e86ee
sub r8d, 0x3409e8c
xor r8d, 0x451f6712
jmp 0x140098c1d
add r8d, 0x267f8278
xor r8d, 0x45c728de
sub r8d, 0x22b6d470
sub r8d, 0x565775fa
sub r8d, 0x6ca1aa
call fcn.1400a3260
jmp 0x140098ac4
movabs rbx, 0xffffffff05eedca2
xor rbx, 0x10fe79ee
xor rbx, 0x7f411337
sub rbx, 0x1c1ed028
add rbx, 0x22b51e81
jmp 0x140098e2a
add edx, 0x72a88188
mov dword [rsp + 0x28], r14d
xchg r14, rbp
jmp 0x140098b46
mov ecx, eax
lea rdx, [rbp + 0xcc]
mov dword [rsp - 0xc], 0x486e0ba0
jmp 0x140098aab
movabs rdx, 0x9024ae7f34c0d839
sub rdx, 0xe1692f4
add rdx, 0x22fb7620
xor rdx, 0xd28afd6
jmp 0x140098de3
add ecx, 0x5b28dd5f
sub ecx, 0x7d9ff2e9
mov qword [rbp + 0x20], rax
jmp 0x140098e4e
add edx, 0x4b3373e0
sub edx, 0x1ade9b58
sub edx, 0x2d97f663
jmp 0x140098ee3
sub dword [rbp + 0xd0], 0x2cdf5f01
xor dword [rbp + 0xd0], 0x2fe70f79
add dword [rbp + 0xd0], 0x815f865
xor dword [rbp + 0xd0], 0x3fb4cf25
add dword [rbp + 0xd0], 0x23aa6ebe
add dword [rbp + 0xd0], 0xcc9db158
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
jmp 0x140098c88
movzx eax, byte [0x14011088a]
mov dword [rsp - 0x44], ebp
xor byte [rsp + 0x44], 0x36
xor al, 0x38
jmp 0x140098e77
mov rdx, rdx
lea r8, [0x14024a640]
lea rdx, [0x14011087c]
lea rcx, [rbp + 0xd4]
call fcn.140096500
mov dword [rsp - 0x3c], edi
jmp 0x140098ecc
test eax, eax
jne 0x140098f00
mov dword [rsp - 0x38], 0x7c3b0636
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140098f02
add rdx, 0x7fffffff
xor rdx, 0x18563769
mov r9d, 0x71f227eb
sub r9d, 0x187daf1f
sub r9d, 0x2886bde1
add r9d, 0x2f2de6d5
jmp 0x140098dbb
sub r9d, 0x44d52030
sub r9d, 0x1b2434e8
add r9d, 0x556882e6
sub r9d, 0x37a6a703
sub r9d, 0x1de426c3
jmp 0x140098e92
xor rdx, 0x7d0e2d69
add rdx, 0x2dae0b4a
sub rdx, 0x319f3686
jmp 0x140098d8d
mov r8, rdi
xchg rdx, r8
call fcn.1400ea550
jmp 0x140098e0d
nop dword [rax]
mov dword [rsp - 0x44], esp
inc rbx
cmp byte [rdi + rbx], r14b
jne 0x140098e18
jmp 0x140098b8b
sub rbx, 0x3ea20b63
sub rbx, 0xd0d84df
add rbx, 0x7fffffff
add rbx, 0x5ac78b6e
xchg r12, r8
jmp 0x140098a6b
mov dword [rsp - 0x10], 0x2ac66dda
mov byte [rbp + 0xc8], 0x75
sub byte [rbp + 0xc8], 0x41
add byte [rbp + 0xc8], 4
add byte [rbp + 0xc8], 0x3a
jmp 0x140098af1
xor byte [rsp + 0x45], 0x37
mov byte [rsp + 0x46], al
mov dword [rsp - 0x2c], 0x2abf959d
mov byte [rsp + 0x40], 0x39
jmp 0x140098b12
xchg rcx, rbx
mov rbx, qword [rax + 0x98]
xchg rbx, rcx
mov rax, qword [0x14024afd0]
xor rax, rdx
jmp 0x140098a8d
sub byte [rsp + 0x40], 0x29
add byte [rsp + 0x40], 0x5f
sub byte [rsp + 0x40], 0x6b
xor byte [rsp + 0x40], 0x50
call fcn.14000e3f0
jmp 0x140098d4c
mov eax, dword [0x14024a660]
lea rcx, [rbp + 0xd4]
mov edx, 0xc040dd2
jmp 0x140098cd7
add edx, 0x3d75f93e
xor edx, 0x53ccfafd
sub edx, 0x1ffa139a
mov dword [rbp + 0x114], eax
jmp 0x140098bb8
xor eax, eax
mov rcx, qword [rbp + 0x3c0]
xor rcx, rsp
mov r8, r8
call fcn.1400dce30
jmp 0x140098f19
add rsp, 0x55ad9650
sub rsp, 0x55ad9160
pop rbp
ret