Function at 0x18006e550
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xc0]
sub rsp, 0x1c0
mov rsi, rcx
xor r13d, r13d
mov dword [rsp + 0x20], r13d
mov qword [rcx], r13
mov qword [rcx + 0x10], r13
lea r15d, [r13 + 0xf]
mov qword [rcx + 0x18], r15
mov byte [rcx], r13b
lea r12d, [r13 + 1]
mov dword [rsp + 0x20], r12d
lea rax, [rbp - 0x48]
mov qword [rbp - 0x50], rax
lea r8d, [r13 + 3]
lea rcx, [rbp - 0x50]
call fcn.18004fc68
nop
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x68], r13
mov qword [rbp - 0x60], r15
mov byte [rbp - 0x78], r13b
mov rdx, qword [rbp - 0x50]
lea rcx, [rbp - 0x78]
call fcn.180003104
nop
lea rax, [rbp - 0x48]
mov rcx, qword [rbp - 0x50]
cmp rcx, rax
je 0x18006e5e0
call fcn.1800a89bc
lea rdi, [rbp - 0x78]
mov rdx, qword [rbp - 0x78]
mov r8, qword [rbp - 0x60]
cmp r8, 0x10
cmovae rdi, rdx
lea r14, [rbp - 0x78]
cmovae r14, rdx
mov rcx, qword [rbp - 0x68]
add r14, rcx
lea rbx, [rbp - 0x78]
cmp r8, 0x10
cmovae rbx, rdx
cmp rbx, r14
je 0x18006e636
sub rdi, rbx
movsx ecx, byte [rbx]
call fcn.1800a4800
mov byte [rdi + rbx], al
inc rbx
cmp rbx, r14
jne 0x18006e617
mov r8, qword [rbp - 0x60]
mov rcx, qword [rbp - 0x68]
mov rdx, qword [rbp - 0x78]
mov qword [rsp + 0x40], r15
mov r14d, reloc.WS2_32.dll_inet_ntoa
mov qword [rsp + 0x38], r14
movsd xmm0, qword [str.windowsapps]
movsd qword [rsp + 0x28], xmm0
mov eax, dword [0x1800d5c98]
mov dword [rsp + 0x30], eax
mov byte [rsp + 0x34], r13b
lea r15, [rsp + 0x28]
lea rdi, [rbp - 0x78]
cmp r8, 0x10
cmovae rdi, rdx
cmp r14, rcx
ja 0x18006e6c3
sub rcx, r14
lea r13, [rcx + rdi]
lea r8, [r13 + 1]
sub r8, rdi
mov rcx, rdi
jmp 0x18006e6af
mov r8, r14
mov rdx, r15
mov rcx, rbx
call fcn.18009fb20
test eax, eax
je 0x18006e734
inc rbx
lea r8, [r13 + 1]
sub r8, rbx
mov rcx, rbx
movsx edx, byte [r15]
call fcn.1800a06d0
test rax, rax
mov rbx, rax
jne 0x18006e68c
xor r13d, r13d
mov ebx, 0x104
mov r8d, ebx
xor edx, edx
lea rcx, [rbp - 0x50]
call fcn.1800a02d0
mov edx, ebx
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x18006e833
lea rax, [rbp - 0x50]
or rbx, 0xffffffffffffffff
mov rdi, rbx
inc rdi
cmp byte [rax + rdi], r13b
jne 0x18006e6f5
cmp rdi, qword [rsp + 0x40]
ja 0x18006e749
lea rbx, [rsp + 0x28]
cmp qword [rsp + 0x40], 0x10
cmovae rbx, qword [rsp + 0x28]
mov qword [rsp + 0x38], rdi
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.18009fc20
mov byte [rbx + rdi], r13b
or rbx, 0xffffffffffffffff
jmp 0x18006e75d
sub rbx, rdi
xor r13d, r13d
cmp rbx, 0xffffffffffffffff
jne 0x18006e973
jmp 0x18006e6c3
lea r9, [rbp - 0x50]
mov r8b, r13b
mov rdx, rdi
lea rcx, [rsp + 0x28]
call fcn.180003a38
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 0x10
cmovae rcx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x18006e84c
dec rax
mov r8, rbx
cmp rax, rbx
cmovb r8, rax
add r8, rcx
jmp 0x18006e79a
cmp r8, rcx
je 0x18006e84c
dec r8
cmp byte [r8], 0x3a
jne 0x18006e78e
sub r8, rcx
cmp r8, rbx
je 0x18006e84c
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x58], r13
mov eax, reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x60], rax
inc r8
mov r9, rbx
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x48]
call fcn.18000764c
mov r12d, 3
mov dword [rsp + 0x20], r12d
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x18006e81d
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18006e818
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18006ef84
call fcn.18009d1f4
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rsp + 0x28], xmm0
movups xmm1, xmmword [rsp + 0x58]
movups xmmword [rsp + 0x38], xmm1
jmp 0x18006e84c
lea rax, [rsp + 0x28]
cmp qword [rsp + 0x40], 0x10
cmovae rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], r13
mov byte [rax], r13b
mov r8d, inet_ntoa
lea rdx, str._systemapps
lea rcx, [rsp + 0x28]
call fcn.180002f70
lea r13, [rsp + 0x28]
mov rdi, qword [rsp + 0x28]
mov r15, qword [rsp + 0x40]
cmp r15, 0x10
cmovae r13, rdi
lea rax, [rsp + 0x28]
cmovae rax, rdi
mov r14, qword [rsp + 0x38]
add rax, r14
lea rbx, [rsp + 0x28]
cmp r15, 0x10
cmovae rbx, rdi
cmp rbx, rax
je 0x18006e8c6
sub r13, rbx
mov rdi, rax
movsx ecx, byte [rbx]
call fcn.1800a4800
mov byte [rbx + r13], al
inc rbx
cmp rbx, rdi
jne 0x18006e8a3
mov r15, qword [rsp + 0x40]
mov r14, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x28]
lea rcx, [rsp + 0x28]
cmp r15, 0x10
cmovae rcx, rdi
mov qword [rbp + 0x118], rcx
lea r13, [rbp - 0x78]
cmp qword [rbp - 0x60], 0x10
cmovae r13, qword [rbp - 0x78]
mov rdx, qword [rbp - 0x68]
cmp r14, rdx
ja 0x18006eed7
test r14, r14
jne 0x18006e902
xor r13d, r13d
mov ebx, r13d
jmp 0x18006e973
mov rax, r13
sub rax, r14
inc rax
add rax, rdx
mov qword [rbp - 0x58], rax
movsx ecx, byte [rcx]
mov dword [rbp + 0x110], ecx
mov r8, rax
sub r8, r13
mov edx, ecx
mov rcx, r13
jmp 0x18006e951
mov r8, r14
mov rdx, qword [rbp + 0x118]
mov rcx, rbx
call fcn.18009fb20
test eax, eax
je 0x18006e963
inc rbx
mov r8, qword [rbp - 0x58]
sub r8, rbx
mov edx, dword [rbp + 0x110]
mov rcx, rbx
call fcn.1800a06d0
test rax, rax
mov rbx, rax
jne 0x18006e928
jmp 0x18006eed7
sub rbx, r13
cmp rbx, 0xffffffffffffffff
je 0x18006eed7
xor r13d, r13d
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x78], r13
mov ecx, reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x80], rcx
mov byte [rsp + 0x68], r13b
lea r8, [r14 + rbx]
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x60], rcx
or r9, 0xffffffffffffffff
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x48]
call fcn.18000764c
or r12d, 4
mov dword [rsp + 0x20], r12d
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x18006e9f5
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18006e9f0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18006ef8a
call fcn.18009d1f4
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rsp + 0x68], xmm0
movups xmm1, xmmword [rsp + 0x58]
movups xmmword [rsp + 0x78], xmm1
lea rbx, [rsp + 0x68]
movq r15, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
movq r13, xmm0
cmp r13, 0x10
cmovae rbx, r15
movq rdi, xmm1
cmp rdi, 1
jb 0x18006ee8d
lea r14, [rbx + rdi]
mov r8, rdi
mov edx, 0x5c
mov rcx, rbx
jmp 0x18006ea6b
mov edx, 0x5c
cmp byte [rax], dl
jne 0x18006ea56
xor ecx, ecx
jmp 0x18006ea5b
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x18006ea7a
inc rax
mov r8, r14
sub r8, rax
mov rcx, rax
call fcn.1800a06d0
test rax, rax
jne 0x18006ea49
jmp 0x18006ee8d
sub rax, rbx
cmp rax, 0xffffffffffffffff
je 0x18006ee8d
lea rbx, [rax + 1]
lea r14, [rsp + 0x68]
cmp r13, 0x10
cmovae r14, r15
cmp rdi, 1
jb 0x18006eae7
lea rax, [rdi - 1]
cmp rbx, rax
ja 0x18006eae7
add rdi, r14
lea rcx, [r14 + rbx]
mov r8, rdi
sub r8, rcx
jmp 0x18006eadd
cmp byte [rax], 0x5c
jne 0x18006eabf
xor ecx, ecx
jmp 0x18006eac4
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x18006eb5d
inc rax
mov r8, rdi
sub r8, rax
mov edx, 0x5c
mov rcx, rax
call fcn.1800a06d0
test rax, rax
jne 0x18006eab6
and qword [rsp + 0x48], 0
and qword [rsp + 0x58], 0
mov eax, reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x60], rax
or r9, 0xffffffffffffffff
mov r8, rbx
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x48]
call fcn.18000764c
or r12d, 0x10
mov dword [rsp + 0x20], r12d
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x18006ebda
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18006ebd5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18006ef7e
jmp 0x18006ebd5
sub rax, r14
cmp rax, 0xffffffffffffffff
je 0x18006eae7
and qword [rsp + 0x48], 0
and qword [rsp + 0x58], 0
mov r9d, reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x60], r9
sub rax, rbx
mov r9, rax
mov r8, rbx
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x48]
call fcn.18000764c
or r12d, 8
mov dword [rsp + 0x20], r12d
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x18006ebda
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18006ebd5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18006ef90
call fcn.18009d1f4
movups xmm1, xmmword [rsp + 0x58]
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rsp + 0x78], xmm1
movups xmmword [rsp + 0x68], xmm0
lea r15, [rsp + 0x68]
mov rbx, qword [rsp + 0x68]
mov r14, qword [rbp - 0x80]
cmp r14, 0x10
cmovae r15, rbx
mov rdi, qword [rsp + 0x78]
test rdi, rdi
je 0x18006ee8d
mov r8, rdi
mov edx, 0x5f
mov rcx, r15
call fcn.1800a06d0
mov r13, rax
test rax, rax
je 0x18006ee8d
sub r13, r15
cmp r13, 0xffffffffffffffff
je 0x18006ee8d
lea r15, [rsp + 0x68]
cmp r14, 0x10
cmovae r15, rbx
cmp rdi, 2
jb 0x18006ec95
lea r14, [rdi + r15]
lea r8, [r14 - 1]
sub r8, r15
mov rcx, r15
jmp 0x18006ec83
cmp byte [rbx], 0x5f
jne 0x18006ec6d
cmp byte [rbx + 1], 0x5f
jne 0x18006ec6d
xor eax, eax
jmp 0x18006ec72
sbb eax, eax
or eax, 1
test eax, eax
je 0x18006ece5
inc rbx
lea r8, [r14 - 1]
sub r8, rbx
mov rcx, rbx
mov edx, 0x5f
call fcn.1800a06d0
test rax, rax
mov rbx, rax
jne 0x18006ec5e
lea rax, [rsp + 0x68]
cmp rsi, rax
je 0x18006ee8d
lea r9, [rsp + 0x68]
cmp qword [rbp - 0x80], 0x10
cmovae r9, qword [rsp + 0x68]
cmp rdi, qword [rsi + 0x18]
ja 0x18006ee7e
mov rbx, rsi
cmp qword [rsi + 0x18], 0x10
jb 0x18006ecca
mov rbx, qword [rsi]
mov qword [rsi + 0x10], rdi
mov r8, rdi
mov rdx, r9
mov rcx, rbx
call fcn.18009fc20
mov byte [rbx + rdi], 0
jmp 0x18006ee8d
sub rbx, r15
cmp rbx, 0xffffffffffffffff
je 0x18006ec95
and qword [rsp + 0x48], 0
and qword [rsp + 0x58], 0
mov edi, reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x60], rdi
lea r9, [r13 + 1]
xor r8d, r8d
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x48]
call fcn.18000764c
or r12d, 0x20
mov dword [rsp + 0x20], r12d
lea rax, [rsp + 0x48]
cmp rsi, rax
je 0x18006ed90
mov rdx, qword [rsi + 0x18]
cmp rdx, 0x10
jb 0x18006ed67
mov rcx, qword [rsi]
inc rdx
cmp rdx, 0x1000
jb 0x18006ed62
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18006ef96
mov rcx, r8
call fcn.18009d1f4
mov byte [rsi], 0
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rsi], xmm0
movups xmm1, xmmword [rsp + 0x58]
movups xmmword [rsi + 0x10], xmm1
and qword [rsp + 0x58], 0
mov rax, rdi
mov qword [rsp + 0x60], rax
mov byte [rsp + 0x48], 0
jmp 0x18006ed95
mov rax, qword [rsp + 0x60]
cmp rax, 0x10
jb 0x18006edce
lea rdx, [rax + 1]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18006edc9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18006ef96
call fcn.18009d1f4
and qword [rsp + 0x48], 0
and qword [rsp + 0x58], 0
mov qword [rsp + 0x60], rdi
lea r8, [rbx + 2]
or r9, 0xffffffffffffffff
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x48]
call fcn.18000764c
or r12d, 0x40
mov dword [rsp + 0x20], r12d
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x18006ee3b
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18006ee36
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18006ef9c
call fcn.18009d1f4
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rsp + 0x68], xmm0
movups xmm1, xmmword [rsp + 0x58]
movups xmmword [rsp + 0x78], xmm1
lea rdx, [rsp + 0x68]
movq rcx, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 0x10
cmovae rdx, rcx
movq r8, xmm1
mov rcx, rsi
call fcn.180002f70
jmp 0x18006ee8d
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call fcn.180003a38
nop
mov r14, qword [rbp - 0x80]
cmp r14, 0x10
jb 0x18006eecd
lea rdx, [r14 + 1]
mov rbx, qword [rsp + 0x68]
mov rax, rbx
cmp rdx, 0x1000
jb 0x18006eec5
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18006efa2
mov rcx, rbx
call fcn.18009d1f4
mov rdi, qword [rsp + 0x28]
mov r15, qword [rsp + 0x40]
cmp r15, 0x10
jb 0x18006ef0e
lea rdx, [r15 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x18006ef06
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18006efa8
mov rcx, rdi
call fcn.18009d1f4
and qword [rsp + 0x38], 0
mov eax, reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x40], rax
mov byte [rsp + 0x28], 0
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x18006ef5a
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18006ef55
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18006ef78
call fcn.18009d1f4
mov rax, rsi
mov rbx, qword [rsp + 0x208]
add rsp, 0x1c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1800a45b8
nop
call fcn.1800a45b8
nop
call fcn.1800a45b8
nop
call fcn.1800a45b8
int3
call fcn.1800a45b8
int3
call fcn.1800a45b8
int3
call fcn.1800a45b8
nop
call fcn.1800a45b8
nop
call fcn.1800a45b8
int3