Function at 0x14005fd50
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x4e8]
sub rsp, 0x5c0
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1400f4080]
xor rax, rsp
mov qword [rbp + 0x4b0], rax
mov r13, rdx
mov rbx, rcx
mov qword [rsp + 0x50], rdx
xor r14d, r14d
mov dword [rsp + 0x20], r14d
xor edx, edx
mov r8d, 0x180
lea rcx, [rbp - 0x60]
call fcn.140088180
lea rcx, [rbp - 0x60]
call fcn.14003b070
nop
xor edx, edx
mov r8d, 0x180
lea rcx, [rbp + 0x120]
call fcn.140088180
lea rcx, [rbp + 0x120]
call fcn.14003b070
nop
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x2a0]
call fcn.140088180
mov edx, 0x104
lea rcx, [rbp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], r14w
lea rdx, [rbp + 0x2a0]
lea rcx, [rsp + 0x60]
call fcn.140003dc0
nop
cmp byte [rbx], r14b
je 0x14005ff99
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x68], 7
mov word [rbp - 0x80], r14w
mov dword [rsp + 0x20], 2
mov r8, qword [rsp + 0x70]
lea rdi, [r8 + 0x13]
cmp rdi, 8
jb 0x14005ff0f
movabs rbx, 0x7ffffffffffffffe
cmp rdi, rbx
ja 0x140060347
mov rax, rdi
or rax, 7
cmp rax, rbx
ja 0x14005fe8f
mov rbx, rax
mov r15d, 0xa
cmp rax, r15
cmovb rbx, r15
lea rax, [rbx + 1]
lea rdx, [rax + rax]
mov rsi, 0xffffffffffffffff
movabs r12, 0x7fffffffffffffff
cmp rax, r12
jbe 0x14005feb2
mov rdx, rsi
jmp 0x14005febb
cmp rdx, 0x1000
jb 0x14005fee2
lea rcx, [rdx + 0x27]
cmp rcx, rdx
cmovbe rcx, rsi
call fcn.14006967c
test rax, rax
je 0x14006034d
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x14005fef7
test rdx, rdx
je 0x14005fef4
mov rcx, rdx
call fcn.14006967c
mov rcx, rax
jmp 0x14005fef7
mov rcx, r14
mov qword [rbp - 0x68], rbx
movzx eax, word [rbp - 0x80]
mov word [rcx], ax
mov qword [rbp - 0x80], rcx
mov qword [rbp - 0x70], r14
mov r8, qword [rsp + 0x70]
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
lea rcx, [rbp - 0x80]
call fcn.1400080f4
mov r8d, 0x13
lea rdx, str.System32_ntdll.dll
lea rcx, [rbp - 0x80]
call fcn.1400080f4
mov r8b, 1
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x60]
call fcn.14003b390
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x140060285
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005ff8f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140060353
call fcn.140069674
jmp 0x140060285
xor eax, eax
mov qword [rbp - 0x78], rax
movzx eax, byte [rbx + 1]
mov qword [rbp - 0x80], r14
mov byte [rbp - 0x78], al
test al, al
je 0x14005ffb9
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
nop
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], r14w
mov dword [rsp + 0x20], 4
mov r8, qword [rsp + 0x70]
lea r14, [r8 + 0x13]
movabs rbx, 0x7ffffffffffffffe
mov rsi, 0xffffffffffffffff
lea r15d, [rsi + 0xb]
movabs r12, 0x7fffffffffffffff
cmp r14, 8
jb 0x14006009f
cmp r14, rbx
ja 0x140060359
mov rdi, r14
or rdi, 7
cmp rdi, rbx
jbe 0x140060021
mov rdi, rbx
jmp 0x140060028
cmp rdi, r15
cmovb rdi, r15
lea rax, [rdi + 1]
lea rdx, [rax + rax]
cmp rax, r12
jbe 0x14006003a
mov rdx, rsi
jmp 0x140060043
cmp rdx, 0x1000
jb 0x14006006a
lea rcx, [rdx + 0x27]
cmp rcx, rdx
cmovbe rcx, rsi
call fcn.14006967c
test rax, rax
je 0x14006035f
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x14006007e
test rdx, rdx
je 0x14006007c
mov rcx, rdx
call fcn.14006967c
mov rcx, rax
jmp 0x14006007e
xor ecx, ecx
mov qword [rsp + 0x40], rdi
movzx eax, word [rsp + 0x28]
mov word [rcx], ax
mov qword [rsp + 0x28], rcx
xor r14d, r14d
mov qword [rsp + 0x38], r14
mov r8, qword [rsp + 0x70]
jmp 0x1400600a2
xor r14d, r14d
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x28]
call fcn.1400080f4
mov r8d, 0x13
lea rdx, str.System32_ntdll.dll
lea rcx, [rsp + 0x28]
call fcn.1400080f4
mov r8b, 1
lea rdx, [rsp + 0x28]
lea rcx, [rbp + 0x120]
call fcn.14003b390
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x14006012c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140060126
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140060365
call fcn.140069674
nop
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], r14w
mov dword [rsp + 0x20], 8
mov r8, qword [rsp + 0x70]
lea rdi, [r8 + 0x13]
cmp rdi, 8
jb 0x1400601ee
cmp rdi, rbx
ja 0x14006036b
mov rax, rdi
or rax, 7
cmp rax, rbx
ja 0x14006017b
mov rbx, rax
cmp rax, 0xa
cmovb rbx, r15
lea rax, [rbx + 1]
lea rdx, [rax + rax]
cmp rax, r12
jbe 0x14006018d
mov rdx, rsi
jmp 0x140060196
cmp rdx, 0x1000
jb 0x1400601bd
lea rcx, [rdx + 0x27]
cmp rcx, rdx
cmovbe rcx, rsi
call fcn.14006967c
test rax, rax
je 0x140060371
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x1400601d2
test rdx, rdx
je 0x1400601cf
mov rcx, rdx
call fcn.14006967c
mov rcx, rax
jmp 0x1400601d2
mov rcx, r14
mov qword [rsp + 0x40], rbx
movzx eax, word [rsp + 0x28]
mov word [rcx], ax
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x38], r14
mov r8, qword [rsp + 0x70]
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x28]
call fcn.1400080f4
mov r8d, 0x13
lea rdx, str.SysWOW64_ntdll.dll
lea rcx, [rsp + 0x28]
call fcn.1400080f4
mov r8b, 1
lea rdx, [rsp + 0x28]
lea rcx, [rbp - 0x60]
call fcn.14003b390
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x140060275
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006026f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140060377
call fcn.140069674
nop
cmp byte [rbp - 0x78], 0
je 0x140060285
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
lea rdx, [rbp - 0x60]
mov rcx, r13
call fcn.140060380
nop
lea rcx, [r13 + 0x180]
lea rdx, [rbp + 0x120]
call fcn.140060380
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x1400602e4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400602df
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140060341
call fcn.140069674
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], r14w
lea rcx, [rbp + 0x120]
call fcn.14003b1e0
nop
lea rcx, [rbp - 0x60]
call fcn.14003b1e0
mov rax, r13
mov rcx, qword [rbp + 0x4b0]
xor rcx, rsp
call fcn.140069650
lea r11, [rsp + 0x5c0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400927c0
nop
call fcn.1400080e0
int3
call fcn.1400927c0
nop
call fcn.1400927c0
nop
call fcn.1400080e0
int3
call fcn.1400927c0
nop
call fcn.1400927c0
nop
call fcn.1400080e0
int3
call fcn.1400927c0
nop
call fcn.1400927c0
int3