Function at 0x18002e5c0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x470
mov rax, qword [0x180223280]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov r15, rcx
mov qword [rsp + 0x68], rcx
xor r14d, r14d
xorps xmm0, xmm0
movups xmmword [rsp + 0x130], xmm0
xorps xmm1, xmm1
movdqa xmmword [rsp + 0x140], xmm1
mov r8d, 9
lea rdx, str.All_Users
lea rcx, [rsp + 0x130]
call fcn.180008f10
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x150], xmm0
xorps xmm1, xmm1
movdqa xmmword [rsp + 0x160], xmm1
mov r8d, 7
lea rdx, str.Default
lea rcx, [rsp + 0x150]
call fcn.180008f10
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x170], xmm0
xorps xmm1, xmm1
movdqa xmmword [rsp + 0x180], xmm1
mov r8d, Ordinal_15
lea rdx, str.Default_User
lea rcx, [rsp + 0x170]
call fcn.180008f10
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x190], xmm0
xorps xmm1, xmm1
movdqa xmmword [rsp + 0x1a0], xmm1
mov r8d, 6
lea rdx, str.Public
lea rcx, [rsp + 0x190]
call fcn.180008f10
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x1b0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rsp + 0x1c0], xmm1
mov r8d, 7
lea rdx, str.AppData
lea rcx, [rsp + 0x1b0]
call fcn.180008f10
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x1d0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rsp + 0x1e0], xmm1
mov r8d, Ordinal_15
lea rdx, str.defaultuser0
lea rcx, [rsp + 0x1d0]
call fcn.180008f10
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x1f0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rsp + 0x200], xmm1
mov r8d, Ordinal_15
lea rdx, str.defaultuser1
lea rcx, [rsp + 0x1f0]
call fcn.180008f10
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x210], xmm0
xorps xmm1, xmm1
movdqa xmmword [rsp + 0x220], xmm1
mov r8d, Ordinal_21
lea rdx, str.defaultuser100000
lea rcx, [rsp + 0x210]
call fcn.180008f10
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x230], xmm0
xorps xmm1, xmm1
movdqa xmmword [rsp + 0x240], xmm1
mov r8d, reloc.LIBPQ.dll_Ordinal_14
lea rdx, str.DefaultAppPool
lea rcx, [rsp + 0x230]
call fcn.180008f10
nop
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x250]
call fcn.1800c0e90
mov edx, 0x104
lea rcx, [rsp + 0x250]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rsp + 0x28], xmm0
movdqu xmmword [rsp + 0x38], xmm1
cmp eax, 3
lea rdx, [rsp + 0x250]
jae 0x18002e808
lea rdx, [0x180205ab0]
mov r8d, 3
lea rcx, [rsp + 0x28]
call fcn.180008f10
nop
lea rax, [0x180203898]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], 7
lea rax, [rsp + 0x28]
cmp qword [rsp + 0x40], 7
cmova rax, qword [rsp + 0x28]
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0xa8], rax
movups xmm0, xmmword [rsp + 0xa0]
movups xmmword [rsp + 0x50], xmm0
movabs rax, 0xc000000000000000
mov qword [rsp + 0x48], rax
mov qword [rsp + 0xa0], 1
lea rax, [rsp + 0x48]
mov qword [rsp + 0xa8], rax
movaps xmm0, xmmword [rsp + 0xa0]
movdqa xmmword [rsp + 0xb0], xmm0
movaps xmm1, xmmword [rsp + 0x90]
movdqa xmmword [rsp + 0xa0], xmm1
lea r8, [rsp + 0xb0]
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0xd0]
call fcn.18000a610
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 7
jbe 0x18002e911
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18002e90c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002f074
call fcn.18008ef10
movdqa xmm0, xmmword [0x1802080c0]
movdqu xmmword [rsp + 0x38], xmm0
mov word [rsp + 0x28], r14w
lea rdx, [rsp + 0xd0]
cmp qword [rsp + 0xe8], 7
cmova rdx, qword [rsp + 0xd0]
xorps xmm0, xmm0
movups xmmword [rsp + 0xb0], xmm0
mov qword [rsp + 0xc0], r14
mov qword [rsp + 0xc8], r14
mov r8, qword [rsp + 0xe0]
lea rcx, [rsp + 0xb0]
call fcn.180008f10
nop
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x90], xmm0
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x90]
call fcn.180028e70
test eax, eax
jne 0x18002f07a
mov rdx, qword [rsp + 0xc8]
cmp rdx, 7
jbe 0x18002e9e1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18002e9dc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002f091
call fcn.18008ef10
xorps xmm0, xmm0
movups xmmword [rsp + 0xa0], xmm0
mov rdi, qword [rsp + 0x98]
test rdi, rdi
je 0x18002ea05
lock inc dword [rdi + 8]
mov rdi, qword [rsp + 0x98]
movaps xmm0, xmmword [rsp + 0x90]
movdqa xmmword [rsp + 0xa0], xmm0
test rdi, rdi
je 0x18002ea27
lock inc dword [rdi + 8]
mov rdi, qword [rsp + 0x98]
xorps xmm1, xmm1
movdqu xmmword [rsp + 0xb0], xmm1
mov esi, 0xffffffff
test rdi, rdi
je 0x18002ea80
mov eax, esi
lock xadd dword [rdi + 8], eax
cmp eax, 1
jne 0x18002ea78
mov rbx, qword [rsp + 0x98]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, esi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x18002ea78
mov rdi, qword [rsp + 0x98]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 8]
jmp 0x18002ea80
mov rdi, qword [rsp + 0x98]
mov r12, qword [rsp + 0xb0]
nop dword [rax + rax]
mov rbx, qword [rsp + 0xa0]
cmp rbx, r12
je 0x18002ef0a
mov r8d, 3
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.1800240a0
mov edx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x48]
test edx, edx
je 0x18002ead0
lea ecx, [rax - 1]
test ecx, 0xfffffff7
jne 0x18002f097
cmp eax, 3
jne 0x18002eef0
lea rdx, [rbx + 0x20]
lea rcx, [rsp + 0xf0]
call fcn.1800064c0
nop
lea rcx, [rsp + 0xf0]
cmp qword [rsp + 0x108], 7
cmova rcx, qword [rsp + 0xf0]
mov rax, qword [rsp + 0x100]
lea rdx, [rcx + rax*2]
mov rbx, rdx
call fcn.180023160
cmp rax, rdx
je 0x18002eb5c
nop
movzx ecx, word [rax]
cmp cx, 0x5c
je 0x18002eb2f
cmp cx, 0x2f
jne 0x18002eb38
add rax, 2
cmp rax, rdx
jne 0x18002eb20
cmp rax, rdx
je 0x18002eb5c
nop dword [rax]
lea r8, [rbx - 2]
movzx ecx, word [r8]
cmp cx, 0x5c
je 0x18002eb5c
cmp cx, 0x2f
je 0x18002eb5c
mov rbx, r8
cmp rax, r8
jne 0x18002eb40
mov r8d, 0x3a
mov rcx, rbx
call fcn.18008c060
mov r8, rax
cmp rbx, rax
je 0x18002eb97
add rax, 0xfffffffffffffffe
cmp rbx, rax
je 0x18002eb97
cmp word [rax], 0x2e
jne 0x18002ecc6
lea rcx, [rax - 2]
cmp rbx, rcx
jne 0x18002eb94
cmp word [rcx], 0x2e
je 0x18002eb97
mov r8, rax
sub r8, rbx
sar r8, 1
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x80], r14
mov qword [rsp + 0x88], r14
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.180008f10
nop
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x110]
call fcn.1800064c0
nop
mov rdx, qword [rsp + 0x88]
cmp rdx, 7
jbe 0x18002ec1b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18002ec16
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002f0a8
call fcn.18008ef10
lea r9, [rsp + 0x130]
mov rbx, qword [rsp + 0x128]
mov r10, qword [rsp + 0x120]
mov r11, qword [rsp + 0x110]
nop dword [rax + rax]
mov rax, r9
cmp qword [r9 + 0x18], 7
jbe 0x18002ec4d
mov rax, qword [r9]
lea r8, [rsp + 0x110]
cmp rbx, 7
cmova r8, r11
cmp r10, qword [r9 + 0x10]
jne 0x18002eceb
mov rdx, r10
test r10, r10
je 0x18002ec86
sub r8, rax
movzx ecx, word [r8 + rax]
cmp cx, word [rax]
jne 0x18002eceb
add rax, 2
sub rdx, 1
jne 0x18002ec72
cmp rbx, 7
jbe 0x18002ed6b
lea rdx, [rbx*2 + 2]
mov rax, r11
cmp rdx, 0x1000
jb 0x18002ed62
add rdx, 0x27
mov r11, qword [r11 - 8]
sub rax, r11
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002f0a8
jmp 0x18002ed62
sub rax, 2
cmp rbx, rax
je 0x18002eb97
cmp word [rax], 0x2e
je 0x18002eb94
sub rax, 2
cmp rbx, rax
jne 0x18002ecd3
jmp 0x18002eb97
add r9, 0x20
lea rax, [rsp + 0x250]
cmp r9, rax
jne 0x18002ec40
movups xmm0, xmmword [rsp + 0x110]
movups xmmword [r15], xmm0
movups xmm1, xmmword [rsp + 0x120]
movups xmmword [r15 + 0x10], xmm1
mov rdx, qword [rsp + 0x108]
cmp rdx, 7
jbe 0x18002edc1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18002edbc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002f0ae
jmp 0x18002edbc
mov rcx, r11
call fcn.18008ef10
nop
mov rdx, qword [rsp + 0x108]
cmp rdx, 7
jbe 0x18002eef0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18002edb2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002f0ae
call fcn.18008ef10
jmp 0x18002eef0
call fcn.18008ef10
mov qword [rsp + 0x100], r14
mov qword [rsp + 0x108], 7
mov word [rsp + 0xf0], r14w
mov rcx, qword [rsp + 0xa8]
test rcx, rcx
je 0x18002ee29
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x18002ee21
mov rbx, qword [rsp + 0xa8]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, esi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x18002ee21
mov rcx, qword [rsp + 0xa8]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdi, qword [rsp + 0x98]
test rdi, rdi
je 0x18002ee63
mov eax, esi
lock xadd dword [rdi + 8], eax
cmp eax, 1
jne 0x18002ee63
mov rbx, qword [rsp + 0x98]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], esi
cmp esi, 1
jne 0x18002ee63
mov rcx, qword [rsp + 0x98]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0xe8]
cmp rdx, 7
jbe 0x18002eeab
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18002eea6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002f0b4
call fcn.18008ef10
mov qword [rsp + 0xe0], r14
mov qword [rsp + 0xe8], 7
mov word [rsp + 0xd0], r14w
lea r9, [fcn.180006450]
mov edx, Ordinal_34
mov r8d, 9
lea rcx, [rsp + 0x130]
call fcn.18008f314
nop
mov rax, r15
jmp 0x18002f046
lea rcx, [rsp + 0xa0]
call fcn.180024200
test eax, eax
jne 0x18002f0ba
jmp 0x18002ea90
mov rcx, qword [rsp + 0xa8]
test rcx, rcx
je 0x18002ef55
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x18002ef4d
mov rbx, qword [rsp + 0xa8]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, esi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x18002ef4d
mov rcx, qword [rsp + 0xa8]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdi, qword [rsp + 0x98]
test rdi, rdi
je 0x18002ef8f
mov eax, esi
lock xadd dword [rdi + 8], eax
cmp eax, 1
jne 0x18002ef8f
mov rbx, qword [rsp + 0x98]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], esi
cmp esi, 1
jne 0x18002ef8f
mov rcx, qword [rsp + 0x98]
mov rax, qword [rcx]
call qword [rax + 8]
nop
jmp 0x18002ef99
xorps xmm0, xmm0
movups xmmword [r15], xmm0
mov qword [r15 + 0x10], r14
mov qword [r15 + 0x18], r14
mov r8d, 3
lea rdx, [0x180203300]
mov rcx, r15
call fcn.180008f10
nop
mov rdx, qword [rsp + 0xe8]
cmp rdx, 7
jbe 0x18002f006
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18002f001
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002f0c2
call fcn.18008ef10
mov qword [rsp + 0xe0], r14
mov qword [rsp + 0xe8], 7
mov word [rsp + 0xd0], r14w
lea r9, [fcn.180006450]
mov edx, Ordinal_34
mov r8d, 9
lea rcx, [rsp + 0x130]
call fcn.18008f314
nop
mov rax, r15
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.18008eef0
lea r11, [rsp + 0x470]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
call fcn.18009e1e4
nop
lea r8, [rsp + 0xb0]
mov edx, eax
lea rcx, str.directory_iterator::directory_iterator
call fcn.18002bac0
nop
call fcn.18009e1e4
nop
lea r8, [rbx + 0x20]
lea rcx, str.directory_entry::status
call fcn.18002bac0
nop
call fcn.18009e1e4
nop
call fcn.18009e1e4
nop
call fcn.18009e1e4
nop
mov edx, eax
call fcn.18002ba60
nop
call fcn.18009e1e4
int3