Function at 0x180071f10
Capabilities:
Get common file path
Query environment variable

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x250]
sub rsp, 0x350
mov rax, qword [0x18009da48]
xor rax, rsp
mov qword [rbp + 0x240], rax
mov rbx, qword [rsp + 0x70]
mov r13, rcx
imul eax, r9d, 0x2f0
mov r15, r8
mov qword [rsp + 0x68], rcx
mov rdi, rdx
mov rcx, qword [rbp + 0x2b0]
mov esi, r9d
mov dword [rbp - 0x5c], r9d
mov qword [rbp - 0x50], r8
mov qword [rbp - 0x38], rdx
mov qword [rsp + 0x58], rcx
mov dword [rbp - 0x58], eax
cmp r9d, eax
ja case.0x1800725b6.1
mov r14, qword [rsp + 0x70]
xor edx, edx
mov r12, qword [rsp + 0x70]
mov qword [rbp - 0x78], rbx
lea rax, [0x18001f1c0]
cmp esi, 0xbd0
ja 0x1800720d0
je 0x1800720aa
cmp esi, 0x12b
ja 0x18007203c
je 0x180072027
cmp esi, 0x10
je 0x180072015
cmp esi, 0x45
je 0x18007200d
cmp esi, 0x4d
je 0x180072584
cmp esi, 0x125
jne 0x1800722a0
test r13, r13
je 0x180072578
test r15, r15
je 0x180071fef
cmp qword [rdi], 0
jne 0x1800722a0
mov rcx, qword [r13]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 0xb8
xor edx, edx
call fcn.180052190
jmp 0x1800723f8
mov r12, rdx
jmp 0x1800722a0
mov byte [rsp + 0x50], 1
mov qword [rbp - 0x40], 0xffffffffffffffff
jmp 0x1800722a0
xor edx, edx
mov r8d, 0x12a
mov rcx, r13
call fcn.180058ec0
jmp 0x180072299
cmp esi, 0x300
je 0x180072078
cmp esi, 0x5f0
je 0x180072061
cmp esi, 0x8e0
jne 0x1800722a0
mov qword [r13], rax
jmp 0x1800722a0
xorps xmm0, xmm0
mov qword [rbp - 0x48], rdx
movups xmmword [rbp + 0x10], xmm0
mov dword [rbp - 0x80], edx
movups xmmword [rbp + 0x20], xmm0
jmp 0x1800722a0
movzx eax, word [rcx]
lea r8, [rsp + 0x60]
mov qword [rbp - 0x28], rdx
mov rcx, r13
mov qword [rsp + 0x20], rdx
mov r9d, SHTestTokenMembership
xor edx, edx
mov word [rsp + 0x60], ax
mov dword [rbp - 0x7c], 0x36
call fcn.18007b2f0
jmp 0x180072299
mov r9d, dword [rbp - 0x80]
lea rax, [rbp + 0x30]
mov r8, qword [rbp - 0x48]
mov edx, dword [rbp - 0x7c]
mov rcx, qword [rbp - 0x28]
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov dword [rbp - 0x68], eax
jmp 0x180072299
cmp esi, 0x14a0
ja 0x1800723d5
je 0x1800722b8
cmp esi, 0xcf0
je 0x180072134
cmp esi, 0xec0
je 0x180072115
cmp esi, 0x11b0
jne 0x1800722a0
movzx eax, byte [rsp + 0x50]
mov ecx, edx
cmp dword [rbp - 0x68], 0
cmove ecx, eax
mov byte [rsp + 0x50], cl
jmp 0x18007229b
mov rcx, qword [rbp - 0x40]
lea r9, [rbp + 0x10]
lea r8, [rbp - 0x30]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_GetTapeParameters]
mov dword [rbp - 0x64], eax
jmp 0x180072299
xor r9d, r9d
mov r8d, 0xfa
mov rdx, r13
xor ecx, ecx
call fcn.180071a70
xor r9d, r9d
mov qword [rsp + 0x78], rax
mov r8d, 0xfa
mov rdx, r15
xor ecx, ecx
mov rdi, rax
call fcn.180071a70
mov r13, rax
test rdi, rdi
je 0x180072294
test rax, rax
je 0x180072294
mov r15, qword [rsp + 0x68]
mov edi, 0xea
mov rbx, qword [rbp - 0x70]
mov eax, edi
sub eax, 0xe9
je 0x1800721b2
cmp eax, 1
jne 0x18007227a
mov r9d, SHTestTokenMembership
xor r8d, r8d
xor edx, edx
mov rcx, r15
call fcn.1800613e0
mov rbx, rax
jmp 0x18007227a
xor esi, esi
nop dword [rax]
nop dword [rax + rax]
lea r15, [r12 + r12*2]
mov edi, ILFindLastID
shl r15, 4
add r15, qword [rsp + 0x58]
cmp edi, 0xc
je 0x1800721ef
cmp edi, 0x9a
jne 0x18007224e
cmp r14, 0xffffffffffffffff
je 0x18007226b
lea rsi, [r14 + r13]
jmp 0x18007224e
mov r8, qword [rbp - 0x50]
lea rax, [rbp - 0x70]
mov rcx, qword [rsp + 0x68]
mov r9d, 0x90
xor edx, edx
mov qword [rsp + 0x20], rax
mov qword [rbp - 0x70], rsi
call fcn.18006f800
mov r14, rax
mov rax, qword [rbp - 0x38]
cmp r12, qword [rax]
jae 0x18007226b
mov rcx, qword [rsp + 0x78]
lea r8, [rbp - 0x70]
cmp r14, 0xffffffffffffffff
mov r9, r15
mov edx, 0xba
cmovne rcx, r14
sub rcx, rsi
mov qword [rbp - 0x70], rcx
lea rcx, [rsi + rbx]
call fcn.180070a60
inc r12
add r15, 0x30
add edi, 0x8e
cmp edi, 0x128
jb 0x1800721d2
cmp rsi, qword [rsp + 0x78]
jb 0x1800721c0
mov r15, qword [rsp + 0x68]
mov edi, 0xe9
mov esi, 0xcf0
dec edi
cmp edi, 0xe8
ja 0x180072185
mov r15, qword [rbp - 0x50]
mov qword [rbp - 0x70], rbx
mov rbx, qword [rbp - 0x78]
mov r13, qword [rsp + 0x68]
xor edx, edx
mov rcx, qword [rsp + 0x58]
imul eax, dword [rbp - 0x5c], 0x2f
add esi, eax
cmp esi, dword [rbp - 0x58]
ja case.0x1800725b6.1
mov rdi, qword [rbp - 0x38]
jmp 0x180071f91
cmp byte [rsp + 0x50], 0
je 0x1800722d6
mov r8d, dword [rbp - 0x80]
lea r9, [rbp + 0x30]
mov rdx, qword [rbp - 0x48]
mov ecx, dword [rbp - 0x7c]
call qword [sym.imp.SHELL32.dll_SHSetFolderPathW]
xor edx, edx
cmp dword [rbp - 0x64], 0
jne 0x1800723ad
mov rbx, qword [rbp - 8]
mov edi, 0x41
mov r15d, dword [rbp - 0x60]
mov r13, qword [rbp - 0x10]
mov eax, edi
sub eax, 0x3e
je 0x180072363
sub eax, 1
je 0x180072322
sub eax, 1
je 0x180072313
cmp eax, 1
jne 0x180072384
mov r13, rdx
mov r15d, edx
jmp 0x180072384
mov qword [rbp - 0x20], rdx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rbx, rax
jmp 0x180072384
lea rax, [rbp - 0x18]
xor r9d, r9d
mov qword [rsp + 0x40], rax
mov r8d, r15d
mov rax, qword [rbp - 0x20]
xor ecx, ecx
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], edx
mov qword [rsp + 0x28], rdx
mov rdx, r13
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_CDefFolderMenu_Create2]
test eax, eax
jne 0x180072384
mov rcx, qword [rbp - 0x18]
mov rax, qword [rcx]
call qword [rax + reloc.SHELL32.dll_ILFindLastID]
jmp 0x180072384
test rbx, rbx
je 0x180072371
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rcx, qword [rbp - 0x40]
lea r8, [rbp + 0x10]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_SetTapeParameters]
dec edi
mov edx, 0
cmp edi, 0x3d
ja 0x1800722f1
mov qword [rbp - 0x10], r13
mov r13, qword [rsp + 0x68]
mov dword [rbp - 0x60], r15d
mov r15, qword [rbp - 0x50]
mov qword [rbp - 8], rbx
mov rbx, qword [rbp - 0x78]
lea rcx, [r13 + 0xa]
cmp rcx, r15
je 0x180072299
cmp qword [r15 + 0x18], 0x10
mov rdx, r15
jb 0x1800723c7
mov rdx, qword [r15]
mov r8, qword [r15 + 0x10]
call fcn.180021a30
jmp 0x180072299
cmp esi, 0x199b
je 0x180072666
cmp esi, 0x36f0
je 0x180072422
cmp esi, 0x6cbb
jne 0x1800722a0
mov rax, rbx
mov rcx, qword [rbp + 0x240]
xor rcx, rsp
call fcn.180083f10
mov rbx, qword [rsp + 0x3a8]
add rsp, 0x350
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rdx, qword [r13]
cmp rdx, r15
jne 0x180072512
mov ebx, reloc.SHELL32.dll_ILFindLastID
mov eax, ebx
sub eax, 0x10
je 0x1800724e8
sub eax, 1
je 0x1800724ce
sub eax, 1
je 0x18007249a
sub eax, 1
je 0x18007247a
cmp eax, 1
jne 0x180072505
mov rdx, qword [r13]
lea r8d, [rax + 0x54]
xor r9d, r9d
mov byte [rsp + 0x60], 0
lea rcx, [rsp + 0x60]
call fcn.18005d190
jmp 0x180072500
mov rax, qword [rbp]
lea rcx, [rsp + 0x78]
mov r9, qword [r13]
xor r8d, r8d
mov qword [rsp + 0x78], rax
lea edx, [r8 + 0x4b]
call fcn.180064070
jmp 0x180072500
mov rcx, qword [rcx]
mov rax, qword [rbp + 8]
cmp rcx, rax
jae 0x180071fef
mov r8, rax
mov rax, qword [rsp + 0x70]
sub r8, rcx
cmp r8, qword [rdi]
cmovae r8, qword [rdi]
lea rdx, [rax + rcx]
mov rcx, rax
mov qword [rbp], r8
call sub.VCRUNTIME140.dll_memmove
jmp 0x180072500
mov rdx, qword [r13]
xor r9d, r9d
mov r8d, 0xfa
xor ecx, ecx
call fcn.180071a70
mov qword [rbp + 8], rax
jmp 0x180072500
mov r9, qword [r13]
xor edx, edx
xor ecx, ecx
mov r8d, 0xb5
call fcn.1800475b0
mov qword [rsp + 0x70], rax
mov rcx, qword [rsp + 0x58]
inc ebx
cmp ebx, 0x15
jb 0x180072434
jmp 0x180072552
xor r9d, r9d
xor ecx, ecx
mov r8d, 0xb9
call fcn.18005a1d0
mov rax, qword [rdi]
lea r9, [rsp + 0x78]
mov qword [rsp + 0x78], rax
lea rcx, [rbp - 0x78]
mov rax, qword [rsp + 0x58]
mov r8, r15
mov rdx, r13
mov dword [rsp + 0x20], 0x103
mov rax, qword [rax]
mov qword [rbp - 0x78], rax
call fcn.18006f220
xor r8d, r8d
mov qword [rsp + 0x20], 0
mov r9, r13
xor ecx, ecx
lea edx, [r8 + 0x3c]
call fcn.18005b5a0
mov rbx, rax
mov qword [rbp - 0x78], rax
jmp 0x180072299
mov rax, qword [0x18009c050]
jmp 0x1800723f8
mov r14, qword [r15]
lea r12, [0x180000000]
mov r15, qword [rsp + 0x70]
mov esi, 0x11c
mov rbx, qword [rsp + 0x70]
mov edi, edx
nop
cmp edi, 0xd
ja case.0x1800725b6.2
mov eax, edi
mov ecx, dword [r12 + rax*4 + 0x72670]
add rcx, r12
jmp rcx
test r15, r15
jne 0x1800725eb
mov eax, 0xb8
cmp eax, 0xb8
je 0x1800725d6
cmp eax, 0x1fa0
je case.0x1800725b6.1
jmp 0x1800725df
test r13, r13
je 0x1800725df
mov qword [r13], rdx
add eax, 0x1ee8
cmp eax, 0x3dd0
jbe 0x1800725c2
test r13, r13
je 0x1800725fc
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov qword [r13], rax
lea rcx, [r15 + 1]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov r14, rax
xor edx, edx
jmp case.0x1800725b6.2
test r13, r13
jne 0x180072617
mov rbx, rdx
jmp case.0x1800725b6.2
mov rax, qword [r13 + 8]
movzx ebx, byte [r13 + 1]
imul rax, r14
add rax, r13
add rbx, rax
jmp case.0x1800725b6.2
mov edx, reloc.SHELL32.dll_PathMakeUniqueName
xor ecx, ecx
call sub.VCRUNTIME140.dll_strrchr
mov r15, rax
xor edx, edx
jmp case.0x1800725b6.2
test r13, r13
jne 0x180072649
mov rbx, rdx
jmp case.0x1800725b6.2
movzx ebx, byte [r13 + 1]
add rbx, r13
inc esi
inc edi
cmp esi, 0x122
jb 0x1800725a0
jmp case.0x1800725b6.1
mov rax, r12
jmp 0x1800723f8