Function at 0x140012f50
Capabilities:
Get common file path

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
lea rbp, [rsp - 0x27]
sub rsp, 0x100
mov rax, qword [0x140073040]
xor rax, rsp
mov qword [rbp + 0x17], rax
movzx r8d, byte [rsp + 0x40]
xor r12d, r12d
xorps xmm0, xmm0
mov qword [rbp - 0x71], rdx
mov r9d, 0x104
mov qword [rsp + 0x58], rcx
mov r14, rcx
mov qword [rbp - 0x51], r12
movups xmmword [rbp - 0x61], xmm0
mov edx, r9d
mov word [rbp - 0x61], r12w
lea rcx, [rbp - 0x61]
mov qword [rbp - 0x49], 7
mov word [rsp + 0x20], r12w
call fcn.140013d50
cmp qword [rbp - 0x49], 7
lea rcx, [rbp - 0x61]
mov edx, 0x104
cmova rcx, qword [rbp - 0x61]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
cmp eax, 1
jbe 0x14001305e
mov r8, qword [rbp - 0x51]
mov ecx, eax
cmp rcx, r8
ja 0x140013000
cmp qword [rbp - 0x49], 7
lea rax, [rbp - 0x61]
mov qword [rbp - 0x51], rcx
cmova rax, qword [rbp - 0x61]
mov word [rax + rcx*2], r12w
jmp 0x140013074
mov rdi, qword [rbp - 0x49]
mov rdx, rcx
mov rax, rdi
sub rdx, r8
sub rax, r8
cmp rdx, rax
ja 0x140013044
cmp rdi, 7
mov qword [rbp - 0x51], rcx
lea r9, [rbp - 0x61]
cmova r9, qword [rbp - 0x61]
lea rdi, [r9 + r8*2]
test rdx, rdx
je 0x140013039
movzx eax, r12w
mov rcx, rdx
rep stosw word [rdi], ax
lea rax, [rdx + r8]
mov word [r9 + rax*2], r12w
jmp 0x140013074
movzx r8d, byte [rsp + 0x40]
lea rcx, [rbp - 0x61]
mov r9, rdx
mov word [rsp + 0x20], r12w
call fcn.140013d50
jmp 0x140013074
mov r8d, 0xa
lea rdx, [0x140068de8]
lea rcx, [rbp - 0x61]
call fcn.14000f130
cmp qword [rbp - 0x49], 7
lea rcx, [rbp - 0x61]
mov r8, qword [rbp - 0x61]
lea rbx, [rbp - 0x61]
mov rax, qword [rbp - 0x51]
lea rsi, [rbp - 0x61]
cmova rcx, r8
cmova rbx, r8
cmova rsi, r8
lea rdi, [rcx + rax*2]
cmp rbx, rdi
je 0x1400130ba
sub rsi, rbx
movzx ecx, word [rbx]
call fcn.14003acec
mov word [rsi + rbx], ax
add rbx, 2
cmp rbx, rdi
jne 0x1400130a5
mov ebx, 0x10000
mov ecx, ebx
call fcn.14003405c
mov qword [rsp + 0x50], rax
mov r13, rax
test rax, rax
jne 0x140013131
mov rdx, qword [rbp - 0x49]
cmp rdx, 7
jbe 0x140013113
mov rcx, qword [rbp - 0x61]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001310e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001390b
call fcn.14002c5f0
mov rcx, r14
mov qword [rbp - 0x51], r12
mov qword [rbp - 0x49], 7
mov word [rbp - 0x61], r12w
call fcn.14000e290
jmp 0x1400133a8
mov rax, qword [0x140076360]
xor r9d, r9d
mov r8d, ebx
mov qword [rsp + 0x150], r15
mov rdx, r13
lea ecx, [r9 + 0x10]
call rax
cmp eax, 0xc0000004
jne 0x14001319d
nop word [rax + rax]
lea eax, [rbx + rbx]
mov rcx, r13
mov edx, eax
mov ebx, eax
call fcn.140034040
test rax, rax
je 0x14001333f
mov rdi, qword [0x140076360]
xor r9d, r9d
mov r8d, ebx
mov qword [rsp + 0x50], rax
mov rdx, rax
mov r13, rax
lea ecx, [r9 + 0x10]
call rdi
cmp eax, 0xc0000004
je 0x140013160
test eax, eax
js 0x14001333f
xorps xmm0, xmm0
mov qword [rbp + 0xf], r12
mov edx, 0x2000
lea rcx, [rbp - 1]
movdqu xmmword [rbp - 1], xmm0
call fcn.140014080
mov eax, r12d
mov dword [rsp + 0x44], eax
cmp dword [r13], r12d
jbe 0x1400132b4
movzx r15d, byte [rsp + 0x40]
movzx ebx, byte [rsp + 0x40]
movzx r14d, byte [rsp + 0x40]
movzx esi, byte [rsp + 0x40]
nop word [rax + rax]
lea rcx, [rax + rax*2]
lea r13, [r13 + rcx*8]
add r13, 8
mov qword [rsp + 0x48], r13
cmp dword [r13], 0xa
jb 0x140013296
mov r8, qword [rbp + 7]
xor edx, edx
mov rcx, qword [rbp - 1]
sub r8, rcx
call fcn.140050d90
mov r8d, dword [r13]
xor edx, edx
mov qword [rbp - 0x69], r12
lea ecx, [rdx + 0x40]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r12, rax
test rax, rax
je 0x140013293
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
movzx edx, word [r13 + 6]
lea r9, [rbp - 0x69]
xor ecx, ecx
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], ecx
mov r8, rax
mov dword [rsp + 0x20], ecx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rcx, r12
mov edi, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x140013293
mov rcx, qword [rbp - 0x69]
call qword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x1400133c6
mov rcx, qword [rbp - 0x69]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r12d, r12d
mov eax, dword [rsp + 0x44]
mov r13, qword [rsp + 0x50]
inc eax
mov dword [rsp + 0x44], eax
cmp eax, dword [r13]
jb 0x1400131f0
mov r14, qword [rsp + 0x58]
mov rcx, r13
call fcn.140034048
mov rcx, qword [rbp - 1]
test rcx, rcx
je 0x140013302
mov rdx, qword [rbp + 0xf]
mov rax, rcx
sub rdx, rcx
cmp rdx, 0x1000
jb 0x1400132f1
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400138ff
call fcn.14002c5f0
xorps xmm0, xmm0
mov qword [rbp + 0xf], r12
movdqu xmmword [rbp - 1], xmm0
mov rdx, qword [rbp - 0x49]
cmp rdx, 7
jbe 0x140013387
mov rcx, qword [rbp - 0x61]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140013382
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400138ff
jmp 0x140013382
mov rcx, r13
call fcn.140034048
mov rdx, qword [rbp - 0x49]
cmp rdx, 7
jbe 0x140013387
mov rcx, qword [rbp - 0x61]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140013382
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400138ff
call fcn.14002c5f0
mov rcx, r14
mov qword [rbp - 0x51], r12
mov qword [rbp - 0x49], 7
mov word [rbp - 0x61], r12w
call fcn.14000e290
mov r15, qword [rsp + 0x150]
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.14002c2f0
add rsp, 0x100
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
xor r12d, r12d
mov qword [rbp - 9], 7
xorps xmm0, xmm0
mov qword [rbp - 0x11], r12
mov r9d, 0x104
mov word [rsp + 0x20], r12w
movups xmmword [rbp - 0x21], xmm0
mov edx, r9d
mov word [rbp - 0x21], r12w
movzx r8d, r15b
lea rcx, [rbp - 0x21]
call fcn.140013d50
cmp qword [rbp - 9], 7
lea rdx, [rbp - 0x21]
mov rcx, qword [rbp - 0x69]
mov r8d, 0x104
cmova rdx, qword [rbp - 0x21]
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetFinalPathNameByHandleW]
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x1400138aa
mov r8, qword [rbp - 0x11]
mov ecx, eax
cmp rcx, r8
ja 0x140013451
cmp qword [rbp - 9], 7
lea rax, [rbp - 0x21]
mov qword [rbp - 0x11], rcx
cmova rax, qword [rbp - 0x21]
mov word [rax + rcx*2], r12w
jmp 0x1400134ab
mov rdi, qword [rbp - 9]
mov rdx, rcx
mov rax, rdi
sub rdx, r8
sub rax, r8
cmp rdx, rax
ja 0x140013495
cmp rdi, 7
mov qword [rbp - 0x11], rcx
lea r9, [rbp - 0x21]
cmova r9, qword [rbp - 0x21]
lea rdi, [r9 + r8*2]
test rdx, rdx
je 0x14001348a
movzx eax, r12w
mov rcx, rdx
rep stosw word [rdi], ax
lea rax, [rdx + r8]
mov word [r9 + rax*2], r12w
jmp 0x1400134ab
mov r9, rdx
mov word [rsp + 0x20], r12w
movzx r8d, bl
lea rcx, [rbp - 0x21]
call fcn.140013d50
mov r11, qword [rbp - 9]
lea rdi, [rbp - 0x21]
mov r10, qword [rbp - 0x21]
cmp r11, 7
mov r12, qword [rbp - 0x11]
cmova rdi, r10
test r12, r12
je 0x140013544
xor edx, edx
mov rax, r12
mov rcx, rdi
test r12, r12
je 0x1400134f6
cmp word [rdi], 0x3a
je 0x1400134f3
nop dword [rax + rax]
cmp rax, 1
je 0x1400134f6
add rcx, 2
dec rax
cmp word [rcx], 0x3a
jne 0x1400134e0
mov rdx, rcx
test rdx, rdx
je 0x140013544
sub rdx, rdi
sar rdx, 1
cmp rdx, 1
jbe 0x140013544
cmp rdx, 0xffffffffffffffff
je 0x140013544
lea rax, [rdx - 1]
cmp r12, rax
lea rcx, [rbp - 0x21]
cmovb rax, r12
cmp r11, 7
cmova rcx, r10
sub r12, rax
lea r8, [r12*2 + 2]
lea rdx, [rcx + rax*2]
call fcn.140051150
mov r11, qword [rbp - 9]
mov r10, qword [rbp - 0x21]
mov qword [rbp - 0x11], r12
mov rax, qword [rsp + 0x58]
mov r9, qword [rax + 8]
mov r8, qword [rax]
cmp r8, r9
je 0x1400138a7
nop dword [rax]
mov rdx, qword [r8 + 0x10]
lea rax, [rbp - 0x21]
cmp r11, 7
mov rdi, r8
cmova rax, r10
cmp qword [r8 + 0x18], 7
jbe 0x14001357d
mov rdi, qword [r8]
cmp rdx, r12
jne 0x1400135a5
test rdx, rdx
je 0x1400135ae
sub rdi, rax
nop word [rax + rax]
movzx ecx, word [rax + rdi]
cmp cx, word [rax]
jne 0x1400135a5
add rax, 2
sub rdx, 1
jne 0x140013590
jmp 0x1400135ae
add r8, 0x20
cmp r8, r9
jne 0x140013560
cmp r8, r9
je 0x1400138a7
mov r8d, dword [r13]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor r12d, r12d
mov qword [rbp - 0x29], 7
xorps xmm0, xmm0
mov qword [rbp - 0x31], r12
mov r9d, 0x104
mov word [rsp + 0x20], r12w
movups xmmword [rbp - 0x41], xmm0
mov edx, r9d
mov word [rbp - 0x41], r12w
movzx r8d, r14b
lea rcx, [rbp - 0x41]
mov rdi, rax
call fcn.140013d50
test rdi, rdi
jne 0x140013650
mov rdx, qword [rbp - 0x29]
cmp rdx, 7
jbe 0x1400138aa
mov rcx, qword [rbp - 0x41]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140013646
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400138f9
call fcn.14002c5f0
jmp 0x1400138aa
cmp qword [rbp - 0x29], 7
lea r8, [rbp - 0x41]
mov r9d, 0x104
mov rcx, rdi
cmova r8, qword [rbp - 0x41]
xor edx, edx
call qword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
test eax, eax
je 0x140013607
mov r8, qword [rbp - 0x31]
mov ecx, eax
cmp rcx, r8
ja 0x140013697
cmp qword [rbp - 0x29], 7
lea rax, [rbp - 0x41]
mov qword [rbp - 0x31], rcx
cmova rax, qword [rbp - 0x41]
mov word [rax + rcx*2], r12w
jmp 0x1400136f1
mov rdi, qword [rbp - 0x29]
mov rdx, rcx
mov rax, rdi
sub rdx, r8
sub rax, r8
cmp rdx, rax
ja 0x1400136db
cmp rdi, 7
mov qword [rbp - 0x31], rcx
lea r9, [rbp - 0x41]
cmova r9, qword [rbp - 0x41]
lea rdi, [r9 + r8*2]
test rdx, rdx
je 0x1400136d0
movzx eax, r12w
mov rcx, rdx
rep stosw word [rdi], ax
lea rax, [r8 + rdx]
mov word [r9 + rax*2], r12w
jmp 0x1400136f1
mov r9, rdx
mov word [rsp + 0x20], r12w
movzx r8d, sil
lea rcx, [rbp - 0x41]
call fcn.140013d50
mov r11, qword [rbp - 0x41]
lea rax, [rbp - 0x41]
mov r8, qword [rbp - 0x29]
lea r12, [rbp - 0x41]
mov rcx, qword [rbp - 0x31]
lea r13, [rbp - 0x41]
cmp r8, 7
cmova rax, r11
cmova r12, r11
cmova r13, r11
lea rdi, [rax + rcx*2]
cmp r12, rdi
je 0x140013749
sub r13, r12
movzx ecx, word [r12]
call fcn.14003acec
mov word [r12 + r13], ax
add r12, 2
cmp r12, rdi
jne 0x140013725
mov rcx, qword [rbp - 0x31]
mov r11, qword [rbp - 0x41]
mov r8, qword [rbp - 0x29]
cmp qword [rbp - 0x49], 7
lea r10, [rbp - 0x61]
mov r12, qword [rbp - 0x51]
lea r13, [rbp - 0x41]
cmova r10, qword [rbp - 0x61]
cmp r8, 7
cmova r13, r11
cmp r12, rcx
ja 0x140013841
sub rcx, r12
test r12, r12
je 0x1400137f8
movzx r9d, word [r10]
lea rax, [rcx*2 + 2]
add rax, r13
mov rcx, r13
mov qword [rbp - 0x79], rax
sub rax, rcx
mov edx, 0
sar rax, 1
je 0x1400137bb
cmp word [rcx], r9w
je 0x1400137b8
cmp rax, 1
je 0x1400137bb
add rcx, 2
dec rax
cmp word [rcx], r9w
jne 0x1400137a5
mov rdx, rcx
mov rcx, rdx
test rdx, rdx
je 0x140013841
mov rdi, r12
mov rdx, r10
test r12, r12
je 0x1400137e8
mov r8, rcx
sub r8, r10
movzx eax, word [rdx + r8]
cmp ax, word [rdx]
jne 0x140013834
add rdx, 2
sub rdi, 1
jne 0x1400137d4
sub rcx, r13
sar rcx, 1
cmp rcx, 0xffffffffffffffff
je 0x140013841
mov r8, qword [rbp - 0x29]
cmp r8, 7
jbe 0x1400138a7
lea rdx, [r8*2 + 2]
mov rax, r11
cmp rdx, 0x1000
jb 0x14001382f
mov r11, qword [r11 - 8]
add rdx, 0x27
sub rax, r11
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400138f9
mov rcx, r11
jmp 0x1400138a2
mov rax, qword [rbp - 0x79]
add rcx, 2
jmp 0x140013792
mov r12, qword [rbp - 0x71]
mov r8, qword [rsp + 0x48]
mov rdx, qword [r12 + 8]
cmp rdx, qword [r12 + 0x10]
je 0x140013863
mov eax, dword [r8]
mov dword [rdx], eax
add qword [r12 + 8], 4
jmp 0x14001386b
mov rcx, r12
call fcn.140013eb0
mov rdx, qword [rbp - 0x29]
cmp rdx, 7
jbe 0x1400138a7
mov rcx, qword [rbp - 0x41]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400138a2
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400138f9
call fcn.14002c5f0
xor r12d, r12d
mov rcx, qword [rbp - 0x69]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbp - 9]
cmp rdx, 7
jbe 0x140013296
mov rcx, qword [rbp - 0x21]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400138ef
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140013905
call fcn.14002c5f0
jmp 0x140013296
call fcn.1400395bc
int3
call fcn.1400395bc
int3
call fcn.1400395bc
int3
call fcn.1400395bc
int3