Function at 0x140005734
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x230]
sub rsp, 0x330
mov rax, qword [0x140011008]
xor rax, rsp
mov qword [rbp + 0x220], rax
mov rax, qword [rbp + 0x298]
mov r15, qword [rbp + 0x290]
mov rsi, qword [rbp + 0x2b8]
and qword [rsp + 0x70], 0
and qword [rbp - 0x78], 0
mov qword [rbp - 0x70], rax
mov rax, qword [rbp + 0x2c0]
mov r14, rcx
mov qword [rbp - 0x80], r8
mov qword [rbp - 0x20], rax
mov rax, qword [rbp + 0x2c8]
mov rbx, rdx
lea rcx, [rbp + 1]
xor r12d, r12d
xor edx, edx
mov r8d, 0x103
mov qword [rbp - 0x10], rax
mov rdi, r9
mov qword [rsp + 0x78], r9
mov dword [rsp + 0x60], 0xd41e4f1d
mov dword [rsp + 0x64], 0x11d1a407
mov dword [rsp + 0x68], 0xc000c98b
mov dword [rsp + 0x6c], 0x410aa34f
mov dword [rsp + 0x50], 0xaac56b
mov dword [rsp + 0x54], 0x11d0cd44
mov dword [rsp + 0x58], 0xc000c28c
mov dword [rsp + 0x5c], 0xee95c24f
mov byte [rbp], r12b
call sub.msvcrt.dll_memset
lea r13d, [r12 + 0x40]
lea rcx, [rbp - 0x60]
mov r8d, r13d
xor edx, edx
call sub.msvcrt.dll_memset
cmp dword [r14], r12d
je 0x140005dd3
lea rcx, [r14 + 8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [r14 + 0x30], 1
jge 0x14000583f
mov edi, 0x8007139f
jmp 0x140005dd8
test rbx, rbx
je 0x140005dcc
test r15, r15
je 0x140005dcc
test rsi, rsi
je 0x140005dcc
mov rdx, qword [r14 + 0x40]
sub rdx, rbx
movzx eax, word [rbx]
movzx ecx, word [rbx + rdx]
sub eax, ecx
jne 0x140005874
add rbx, 2
test ecx, ecx
jne 0x140005861
test eax, eax
je 0x140005882
mov edi, 0x80070005
jmp 0x140005dd8
mov rax, qword [rbp - 0x78]
and dword [rbp - 0x2c], r12d
and dword [rbp - 0x48], r12d
mov qword [rbp - 0x58], rax
mov dword [rbp - 0x60], r13d
mov qword [rbp - 0x50], rdi
cmp dword [r14 + 0x8c], r12d
je 0x1400059e5
cmp dword [0x1400115e4], r12d
je 0x140005941
mov r8, rsi
mov rdx, rdi
mov rcx, r14
call fcn.140004e5c
mov edi, eax
test eax, eax
js 0x140005dd8
mov rcx, qword [rsi]
test rcx, rcx
je 0x1400058dd
call fcn.14000ad9c
mov edi, eax
jmp 0x1400058df
xor edi, edi
test edi, edi
js 0x140005dd8
mov rcx, qword [rsi]
call fcn.14000ae48
mov edi, eax
test eax, eax
js 0x140005dd8
mov eax, 0x58
xor bl, bl
xor r13b, r13b
mov ecx, eax
mov dword [rbp - 0x38], eax
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov qword [rbp - 0x40], rax
test rax, rax
je 0x14000593b
mov r8d, dword [rbp - 0x38]
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
mov rax, qword [rbp - 0x40]
mov ecx, dword [rbp - 0x38]
mov dword [rax], ecx
mov rax, qword [rbp - 0x40]
mov dword [rax + 8], 1
jmp 0x1400059a0
and qword [rbp - 0x40], r12
jmp 0x1400059a0
mov bl, 1
cmp dword [r14 + 0x90], r12d
je 0x14000599d
mov r8, rsi
mov rdx, rdi
mov rcx, r14
call fcn.140004e5c
mov edi, eax
test eax, eax
js 0x140005dd8
mov rcx, qword [rsi]
test rcx, rcx
je 0x140005975
call fcn.14000ad9c
mov edi, eax
jmp 0x140005977
xor edi, edi
test edi, edi
js 0x140005dd8
mov rcx, qword [rsi]
call fcn.14000ae48
mov edi, eax
test eax, eax
js 0x140005dd8
mov dword [rbp - 0x28], 1
xor r13b, r13b
jmp 0x1400059a0
mov r13b, 1
mov ecx, 0x58
mov dword [rbp - 0x38], ecx
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov qword [rbp - 0x40], rax
test rax, rax
je 0x1400059db
mov r8d, dword [rbp - 0x38]
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
mov rax, qword [rbp - 0x40]
mov ecx, dword [rbp - 0x38]
mov dword [rax], ecx
mov rax, qword [rbp - 0x40]
mov dword [rax + 8], 1
jmp 0x1400059ea
and qword [rbp - 0x40], r12
and dword [rbp - 0x38], r12d
jmp 0x1400059ea
mov bl, 1
mov r13b, bl
test r13b, r13b
je 0x140005ae2
lea rdx, [rbp + 0x110]
mov ecx, 0x104
mov byte [rbp], r12b
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x140005a21
lea rdx, [rbp]
lea rcx, [rbp + 0x110]
call fcn.14000a48c
mov edi, eax
jmp 0x140005a35
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
js 0x140005dd8
call qword [sym.imp.ole32.dll_CoImpersonateClient]
test eax, eax
js 0x140005a5a
lea rcx, [rbp]
mov r8, rsi
mov rdx, r15
call fcn.14000a5e0
mov edi, eax
jmp 0x140005a5f
mov edi, 0x80004005
test edi, edi
js 0x140005dd8
mov rcx, qword [rsi]
test rcx, rcx
je 0x140005a78
call fcn.14000ad9c
mov edi, eax
jmp 0x140005a7a
xor edi, edi
test edi, edi
js 0x140005dd8
mov rcx, qword [rsi]
call fcn.14000ae48
mov edi, eax
test eax, eax
js 0x140005dd8
and qword [rsp + 0x30], r12
mov rcx, qword [rsi]
xor r9d, r9d
lea r8d, [r9 + 1]
mov edx, 0x80000000
mov dword [rsp + 0x28], Ordinal_134
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x70], rax
cmp rax, 0xffffffffffffffff
jne 0x140005ae2
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
jmp 0x140005dd8
test bl, bl
je 0x140005cf2
mov ecx, 0x20
call fcn.140004210
mov r12, rax
test rax, rax
je 0x140005b1e
and qword [r12 + 0x18], 0
and qword [r12 + 0x10], 0
lea rax, [0x140001400]
mov qword [r12], rax
mov dword [r12 + 8], 1
jmp 0x140005b21
xor r12d, r12d
test r12, r12
je 0x140005dd3
mov rax, qword [rsp + 0x78]
and qword [rbp - 0x18], 0
mov r15d, 0x80070057
test rax, rax
je 0x140005b87
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
test rax, rax
je 0x140005b80
lea rdx, [rbp - 0x18]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_CoInternetCreateSecurityManager]
mov edi, eax
test eax, eax
js 0x140005b75
mov rcx, qword [rbp - 0x18]
mov qword [r12 + 0x10], rbx
mov qword [r12 + 0x18], rcx
jmp 0x140005b8a
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x140005b8a
mov edi, 0x8007000e
jmp 0x140005b8a
mov edi, r15d
test edi, edi
js 0x140005dd8
mov rax, qword [r12]
mov rbx, qword [rax]
mov rcx, rbx
call qword [0x1400136a0]
lea r8, [rbp - 0x78]
lea rdx, [0x1400011e8]
mov rcx, r12
call rbx
mov edi, eax
test eax, eax
js 0x140005dd8
mov rax, qword [rbp - 0x70]
test rax, rax
je 0x140005c8d
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_VariantInit]
test eax, eax
je 0x140005c8d
mov rax, qword [rsi]
movaps xmm0, xmmword [rsp + 0x50]
mov ebx, dword [rbp + 0x2a8]
mov edi, dword [rbp + 0x2a0]
movdqa xmmword [rsp + 0x50], xmm0
test rax, rax
je 0x140005c38
mov r9, qword [rsp + 0x70]
mov r8, qword [rsp + 0x78]
lea rcx, [rbp - 0x60]
mov qword [rsp + 0x40], rcx
mov rcx, qword [rbp - 0x70]
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp - 0x80]
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call fcn.14000bd58
test eax, eax
jns 0x140005cf2
mov rax, qword [rsi]
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x50], xmm0
test rax, rax
je 0x140005ca0
mov r9, qword [rsp + 0x70]
mov r8, qword [rsp + 0x78]
lea rcx, [rbp - 0x60]
mov qword [rsp + 0x40], rcx
mov rcx, qword [rbp - 0x70]
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp - 0x80]
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call fcn.14000bd58
mov edi, eax
test eax, eax
jns 0x140005cf2
jmp 0x140005dd8
mov rcx, qword [rsi]
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x50], xmm0
test rcx, rcx
jne 0x140005ca8
mov edi, r15d
jmp 0x140005dd8
mov r9, qword [rsp + 0x70]
mov r8, qword [rsp + 0x78]
lea rax, [rbp - 0x60]
mov qword [rsp + 0x40], rax
mov eax, dword [rbp + 0x2a8]
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x38], eax
mov eax, dword [rbp + 0x2a0]
mov dword [rsp + 0x30], eax
and qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbp - 0x80]
call fcn.14000bd58
mov edi, eax
test eax, eax
js 0x140005dd8
cmp dword [r14 + 0x8c], 0
jne 0x140005d0c
mov rcx, qword [rsi]
call fcn.14000b684
test eax, eax
je 0x140005878
test r13b, r13b
je 0x140005d2a
lea rcx, [r14 + 0xa0]
mov rdx, rsi
call fcn.14000a7b8
mov edi, eax
test eax, eax
js 0x140005dd8
mov rcx, qword [rsi]
lea rdx, [r14 + 0x80]
call fcn.1400092f8
mov edi, eax
test eax, eax
js 0x140005dd8
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x140005da3
cmp dword [rbp - 0x38], 0
je 0x140005da3
mov rdx, qword [rcx + 0x18]
mov rax, rcx
test rdx, rdx
je 0x140005d69
sub rdx, rcx
mov qword [rcx + 0x18], rdx
mov rcx, qword [rbp - 0x40]
mov rdx, qword [rax + 0x28]
test rdx, rdx
je 0x140005d7d
sub rdx, rax
mov qword [rax + 0x28], rdx
mov rcx, qword [rbp - 0x40]
mov rdx, qword [rax + 0x38]
test rdx, rdx
je 0x140005d91
sub rdx, rax
mov qword [rax + 0x38], rdx
mov rcx, qword [rbp - 0x40]
mov eax, dword [rbp - 0x38]
mov rdx, qword [rbp - 0x20]
mov dword [rdx], eax
mov rax, qword [rbp - 0x10]
mov qword [rax], rcx
jmp 0x140005db2
mov rdx, qword [rbp - 0x20]
mov rax, qword [rbp - 0x10]
and dword [rdx], 0
and qword [rax], 0
mov rax, qword [rbp + 0x2b0]
movups xmm0, xmmword [rax]
mov dword [r14 + 0x30], 2
movdqu xmmword [r14 + 0x58], xmm0
jmp 0x140005dea
mov edi, 0x80070057
jmp 0x140005dd8
mov edi, 0x8007000e
test rsi, rsi
je 0x140005dea
mov rcx, qword [rsi]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
and qword [rsi], 0
mov rsi, qword [rbp - 0x78]
test rsi, rsi
je 0x140005e08
mov rax, qword [rsi]
mov rbx, qword [rax + 0x10]
mov rcx, rbx
call qword [0x1400136a0]
mov rcx, rsi
call rbx
test r12, r12
je 0x140005e23
mov rax, qword [r12]
mov rbx, qword [rax + 0x10]
mov rcx, rbx
call qword [0x1400136a0]
mov rcx, r12
call rbx
mov rcx, qword [rsp + 0x70]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140005e38
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
js 0x140005e44
and dword [r14 + 0x90], 0
lea rcx, [rbp]
call fcn.140009904
cmp dword [r14], 0
je 0x140005e5d
lea rcx, [r14 + 8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
mov rcx, qword [rbp + 0x220]
xor rcx, rsp
call fcn.14000faa0
mov rbx, qword [rsp + 0x378]
add rsp, 0x330
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret