Function at 0x180090930
Capabilities:
Get common file path
Move file

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x888]
sub rsp, 0x960
mov qword [rbp - 0x60], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x180248950]
xor rax, rsp
mov qword [rbp + 0x850], rax
mov r14, rcx
xor edi, edi
mov dword [rcx + 0x20], edi
lea r15d, [rdi + 1]
mov word [rbp + 0x430], di
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0x432]
call fcn.1800be330
mov word [rbp - 0x18], di
xor eax, eax
mov qword [rbp - 0x16], rax
mov qword [rbp - 0xe], rax
mov qword [rbp - 6], rax
mov qword [rbp + 2], rax
mov dword [rbp + 0xa], eax
mov word [rbp + 0xe], ax
mov qword [rbp - 0x40], 0xf
mov qword [rbp - 0x48], rdi
mov byte [rbp - 0x58], al
lea r8d, [rdi + 0xb]
lea rdx, str.9.8.9.03091
lea rcx, [rbp - 0x58]
call fcn.18000c460
nop
lea rdx, [rbp - 0x58]
lea rcx, [rbp - 0x38]
call fcn.18000fb80
nop
cmp qword [rbp - 0x40], 0x10
jb 0x1800909f5
mov rcx, qword [rbp - 0x58]
call fcn.1800b5354
mov qword [rbp - 0x40], 0xf
mov qword [rbp - 0x48], rdi
mov byte [rbp - 0x58], 0
lea r8, [rbp - 0x38]
cmp qword [rbp - 0x20], 8
cmovae r8, qword [rbp - 0x38]
lea rdx, [0x1801ec2c4]
lea rcx, [rbp - 0x18]
call fcn.1800b5a54
mov rcx, rdi
lea r12, str.__wannengwb__
nop dword [rax]
movzx eax, word [rcx + r12]
mov word [rbp + rcx + 0x430], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x180090a30
lea rcx, [rbp + 0x430]
sub rcx, 2
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x180090a51
lea r8, [rbp - 0x18]
xor edx, edx
nop word [rax + rax]
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x180090a70
lea r8, [rbp + 0x430]
mov edx, 1
mov ecx, 0xf001f
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov qword [r14 + 0x10], rax
test rax, rax
jne 0x180090e4e
mov r15d, edi
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], rdi
mov dword [rsp + 0x68], 0x18
lea rax, [rsp + 0x40]
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x78], edi
mov edx, 1
lea rcx, [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
jne 0x180090af4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x1801eb230]
call fcn.1800b5390
nop
mov r8d, 0x10000000
lea rdx, str.Everyone
lea rcx, [rsp + 0x40]
call fcn.1800010d0
mov r8d, 0x10000000
lea rdx, str.ALL_APPLICATION_PACKAGES
lea rcx, [rsp + 0x40]
call fcn.1800010d0
lea rax, [rbp + 0x430]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x5d98
xor r9d, r9d
lea r8d, [r9 + 4]
lea rdx, [rsp + 0x68]
or rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [r14 + 0x10], rax
test rax, rax
jne 0x180090dff
mov word [rbp + 0x640], di
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0x642]
call fcn.1800be330
mov word [rbp + 0x220], di
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0x222]
call fcn.1800be330
mov word [rbp + 0x10], di
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0x12]
call fcn.1800be330
lea rdx, [rbp + 0x640]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rax, [rbp - 0x18]
mov qword [rsp + 0x28], rax
lea r13, [0x1801eb7e8]
mov qword [rsp + 0x20], r13
lea r9, str.WanNengWBInput
lea r8, [rbp + 0x640]
lea rdx, str._s_s_s_s
lea rcx, [rbp + 0x220]
call fcn.1800b5a54
mov rcx, rdi
nop
movzx eax, word [rcx + r12]
mov word [rbp + rcx + 0x10], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x180090bf0
lea rcx, [rbp + 0x10]
sub rcx, 2
nop dword [rax + rax]
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x180090c10
mov rax, qword [str.TEMP__]
mov qword [rcx], rax
mov eax, dword [0x1801f6fa0]
mov dword [rcx + 8], eax
movzx eax, word [0x1801f6fa4]
mov word [rcx + 0xc], ax
lea rcx, [rbp + 0x10]
sub rcx, 2
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x180090c40
lea r8, [rbp - 0x18]
xor edx, edx
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x180090c50
mov dword [r14 + 0x20], 1
lea r8, [rbp + 0x10]
mov edx, 1
mov ecx, 0xf001f
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov qword [r14 + 0x10], rax
test rax, rax
jne 0x180090dff
lea r8, [rbp + 0x10]
lea edx, [rax + 1]
lea ecx, [rax + 6]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov qword [r14 + 0x10], rax
test rax, rax
jne 0x180090dff
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov edx, 0x10000000
lea r8d, [rax + 3]
lea rcx, [rbp + 0x220]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180090df0
lea rax, [rbp + 0x10]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x5d98
xor r9d, r9d
lea r8d, [r9 + 4]
lea rdx, [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [r14 + 0x10], rax
test rax, rax
jne 0x180090de5
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, eax
mov dword [rsp + 0x30], eax
lea rax, [rbp - 0x18]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
lea r9, str.WanNengWBInput
lea r8, [rbp + 0x640]
lea rdx, str._s_s_s_s_d
lea rcx, [rbp + 0x220]
call fcn.1800b5a54
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov edx, 0x10000000
lea r8d, [r9 + 3]
lea rcx, [rbp + 0x220]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180090df0
mov dword [rsp + 0x20], esi
lea r9, [rbp - 0x18]
mov r8, r12
lea rdx, str._s_s_d
lea rcx, [rbp + 0x10]
call fcn.1800b5a54
lea rax, [rbp + 0x10]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x5d98
xor r9d, r9d
lea r8d, [r9 + 4]
lea rdx, [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [r14 + 0x10], rax
test rax, rax
je 0x180090df0
xor edx, edx
lea r8d, [rdx + 5]
lea rcx, [rbp + 0x220]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180090dff
lea rcx, [rsp + 0x40]
call fcn.180001050
jmp 0x180090eb3
mov rbx, qword [rbp - 0x80]
mov rax, qword [rbp - 0x78]
cmp rbx, rax
je 0x180090e3d
nop dword [rax]
mov rsi, qword [rbx]
test rsi, rsi
je 0x180090e30
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, qword [rbp - 0x78]
add rbx, 8
cmp rbx, rax
jne 0x180090e10
mov rbx, qword [rbp - 0x80]
mov qword [rbp - 0x78], rbx
test rbx, rbx
je 0x180090e4e
mov rcx, rbx
call fcn.1800b5354
mov rcx, qword [r14 + 0x10]
test rcx, rcx
je 0x180090e9c
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf001f
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [r14 + 0x18], rax
test rax, rax
je 0x180090e8e
mov qword [r14 + 0x48], rax
test r15d, r15d
jne 0x180090e87
mov rcx, rax
call fcn.18008dd60
mov edi, 1
jmp 0x180090eb3
mov rcx, qword [r14 + 0x10]
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov qword [r14 + 0x10], rdi
mov ecx, 0x5d98
call fcn.1800b543c
mov qword [r14 + 0x48], rax
mov rcx, rax
call fcn.18008dd60
nop
cmp qword [rbp - 0x20], 8
jb 0x180090ec3
mov rcx, qword [rbp - 0x38]
call fcn.1800b5354
mov eax, edi
mov rcx, qword [rbp + 0x850]
xor rcx, rsp
call fcn.1800b5370
lea r11, [rsp + 0x960]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret