Function at 0x1400983a0
Capabilities:
Get common file path

Disassembly:
xchg rsp, r11
mov rsp, r11
xchg rsp, r11
jmp 0x1400984fd
sub rsp, 0x4f0
mov rax, qword [0x140248220]
xor rax, rsp
mov r8, r8
xchg r11, rax
mov qword [rbp + 0x3c0], r11
xchg r11, rax
jmp 0x140098466
sub edx, 0x54127b47
add edx, 0x627b421d
add edx, 0x174a0c6
xor edx, 0x6db058ae
jmp 0x1400983ef
mov dword [rsp + 0x54], eax
mov dword [rsp + 0x50], r9d
mov dword [rsp - 0x2c], edx
test r8b, r8b
je 0x14009851e
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x1400984da
mov qword [r11 - 0x28], r9
xchg r9, r14
xchg rdi, rdx
mov rdx, rdi
xchg rdx, rdi
xor r14d, r14d
mov dword [rsp - 0x30], 0xb0f6f06
jmp 0x1400984ac
xor edx, edx
xchg r11, r11
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
jmp 0x1400984cb
xchg rsp, rdi
lea rcx, [rbp + 0x120]
mov dword [rsp - 0x30], 0x3dfeb117
xchg r14, r9
jmp 0x140098410
xchg rsp, rsi
mov qword [r11 - 0x18], rsp
xchg rsp, rsi
mov rsi, rcx
xchg rsi, rsi
xchg rsp, rdi
mov qword [r11 - 0x20], rsp
jmp 0x14009844c
mov byte [rbp - 0x20], al
nop dword [rax + rax]
cmp byte [rcx + 1], r14b
mov r11, r11
jmp 0x140098496
lea rcx, [rcx + 1]
jne 0x14009848a
lea r8, [rbp + 0x120]
jmp 0x140098430
movzx eax, r8b
mov dword [rsp + 0x48], r14d
mov edx, 0x75324047
sub edx, 0x4ca0c0ec
xor edx, 0x75438fc9
jmp 0x1400983d2
mov rcx, rcx
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
jmp 0x14009850d
mov eax, dword [0x14011088c]
mov rdx, rdx
lea rcx, [rbp - 0x24]
mov dword [rbp - 0x24], eax
dec rcx
movzx eax, byte [0x140110890]
mov dword [rsp - 0x28], esi
jmp 0x140098482
push rbp
mov r12, r12
lea rbp, [r11 - 0x3f8]
jmp 0x1400983ae
test al, al
jne 0x140098442
mov dword [rsp - 0x44], ecx
jmp 0x1400985d1
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryA]
mov eax, dword [0x14011088c]
mov dword [rsp - 0x38], 0x57c725e0
lea rcx, [rbp - 0x24]
mov dword [rbp - 0x24], eax
dec rcx
jmp 0x14009858d
je 0x140098610
mov dword [rbp + 0xd0], eax
xchg r15, r15
jmp 0x140098af4
jne 0x1400985ff
lea r8, [rbp + 0x120]
xor edx, edx
mov dword [rsp - 0x24], esi
nop word [rax + rax]
jmp 0x1400985b5
jne 0x1400985ee
movzx eax, word [0x140110894]
mov word [rcx], ax
jmp 0x14009859f
mov rcx, rcx
movzx eax, byte [0x140110890]
mov byte [rbp - 0x20], al
jmp 0x1400985ff
mov eax, dword [rbp + 0x438]
mov dword [rsp - 0xc], 0x133cb4d3
cmp eax, 0xffffffff
jmp 0x140098541
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
mov dword [rsp - 0x18], 0x5317f8f4
lea rdx, [rdx + 1]
test al, al
jne 0x1400985b5
lea rcx, [rbp - 0x24]
jmp 0x1400985da
mov dword [rsp - 0x20], 0x10fbf345
dec rcx
nop word [rax + rax]
cmp byte [rcx + 1], r14b
lea rcx, [rcx + 1]
mov dword [rsp - 0x24], esp
jmp 0x140098578
cmp byte [rcx + 1], r14b
lea rcx, [rcx + 1]
mov dword [rsp - 0xc], edx
jmp 0x140098555
xchg rbx, r12
mov qword [rsp + 0x4e8], r12
xchg rbx, r12
nop
movabs rbx, 0xffffffff34ccfff8
add rbx, 0x23d9c485
sub rbx, 0xa36e885
jmp 0x140098816
lea rdx, [0x14011087c]
lea rcx, [rbp + 0xd4]
call fcn.140096120
mov dword [rsp - 0x28], 0x5562ec5c
mov eax, dword [0x14024a660]
jmp 0x140098899
sub edx, 0x4495bf03
xor edx, 0x41f0a184
xor edx, 0x5326ddd9
add edx, 0x64c6cbc3
xor edx, 0x289aec5e
xor edx, 0xb75e6ca
jmp 0x140098ac3
sub r8d, 0x7b895f09
sub r8d, 0x17ac54f
call fcn.1400a2db0
mov dword [rsp - 0x1c], 0x53744c5a
mov eax, dword [str.n_f_vi]
jmp 0x1400988f3
mov qword [rbp + 0x20], r13
xchg r13, rax
mov byte [rbp + 0xc8], 0x43
xor byte [rbp + 0xc8], 0x30
xor byte [rbp + 0xc8], 0x60
add byte [rbp + 0xc8], 0
add byte [rbp + 0xc8], 0x12
jmp 0x140098848
mov dword [rsp - 0x30], edi
xchg r14, rbx
mov rbx, qword [rsp + 0x4d0]
jmp 0x140098731
mov rax, qword [rsi + 0x30]
lea r8, [rsp + 0x50]
mov qword [rsp + 0x38], r14
movabs rdx, 0x9024ae7f67674acd
xor rdx, 0x43f36aa1
xor rdx, 0x5a294830
jmp 0x140098938
xchg rsp, rsp
movzx eax, word [0x140110888]
lea rcx, [rbp + 0x28]
jmp 0x140098908
xchg r14, rbx
xchg rsi, r11
mov r11, qword [rsp + 0x4e0]
xchg r11, rsi
test eax, eax
jmp 0x14009876e
mov byte [rsp + 0x46], al
xchg rdi, rdi
mov byte [rsp + 0x40], 0x2e
xor byte [rsp + 0x40], 0x2d
xor byte [rsp + 0x40], 0x79
sub byte [rsp + 0x40], 0x34
add byte [rsp + 0x40], 0x32
jmp 0x1400988df
mov dword [rsp - 0x18], 0x5c96cde9
jne 0x140098b11
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140098b13
mov rdi, rdx
xchg rdx, rdi
call fcn.1400ea040
mov rbx, rbx
nop dword [rax]
jmp 0x140098972
xor rdx, 0x478f9df0
add rdx, 0x7fffffff
xor rdx, 0xbd3d779
jmp 0x140098872
add dword [rbp + 0xd0], 0x1e5d4f00
xor dword [rbp + 0xd0], 0x59bd7d6b
add dword [rbp + 0xd0], 0x636b8cdb
jmp 0x140098ae0
mov rax, qword [0x14024afd0]
xor rax, rdx
mov r15, r15
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x30], rdx
mov edx, 0x7380212e
jmp 0x1400987ff
xor edx, 0x4ca79235
xor edx, 0x3fee2f84
add edx, 0x55befa48
jmp 0x140098aa0
xor rbx, 0x670c0b30
xor rbx, 0x6f0d477f
xor rbx, 0x1a948ad5
sub rbx, 0x22ec9aa3
add rbx, 0x7fffffff
xor rbx, 0x45f27d41
xchg rbx, r15
jmp 0x140098a34
sub byte [rbp + 0xc8], 0x24
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
movzx ecx, byte [rbp + 0x1a0]
mov dword [rsp - 0x14], esp
lea rdx, [rbp + 0x2b0]
mov r8d, 0x3812b643
jmp 0x1400989cd
mov r9d, 0x2b2ae7f3
sub r9d, 0xd14304e
add r9d, 0x2975b754
add r9d, 0x1b7d72d9
sub r9d, 0x23e12170
jmp 0x140098988
lea rcx, [rbp + 0xd4]
mov edx, 0x2a59453
add edx, 0x5e5c3b15
jmp 0x140098662
jne 0x140098a41
inc r8
lea rcx, [rsp + 0x58]
mov dword [rsp - 0x18], 0x401920dd
xchg rdx, rdi
jmp 0x140098787
xor byte [rsp + 0x44], 0x36
xor al, 0x38
xor byte [rsp + 0x45], 0x37
jmp 0x140098749
xor byte [rsp + 0x40], 0x6f
xor byte [rsp + 0x40], 0x5a
add byte [rsp + 0x40], 0x29
jmp 0x1400989af
lea r8, [rbp + 0x2b3]
mov dword [rsp + 0x40], eax
lea rdx, [rsp + 0x40]
jmp 0x14009871e
xor byte [rsp + 0x41], 0x33
xor byte [rsp + 0x42], 0x34
mov dword [rsp - 0x40], 0x215adb26
xor byte [rsp + 0x43], 0x35
mov word [rsp + 0x44], ax
movzx eax, byte [0x14011088a]
mov dword [rsp - 0x38], 0x66f15f76
jmp 0x1400988ce
xor rdx, 0x468040eb
add rdx, 0x29a292ee
xor rdx, 0x47c8db
jmp 0x1400987a1
mov rcx, qword [rsp + 0x4d8]
xchg rcx, rdi
test rax, rax
je 0x1400986f3
mov word [rax], r14w
mov rcx, rcx
jmp 0x1400986f3
inc rbx
cmp byte [rdi + rbx], r14b
jne 0x140098972
mov dword [rsp - 0x1c], esp
jmp 0x1400989fc
sub r9d, 0x10ae5a90
sub r9d, 0xa7688ed
sub r9d, 0x2403db1d
xchg rcx, r14
mov r14, qword [rax + 0x98]
xchg rcx, r14
jmp 0x1400987de
sub byte [rsp + 0x40], 0x1a
call fcn.14000e200
mov dword [rsp - 0x18], 0x7300954c
lea r8, [0x14024a640]
jmp 0x14009863c
xor r8d, 0x4fcf36a0
xor r8d, 0x4e5f5dc3
sub r8d, 0x193cb7ff
add r8d, 0x278080cf
sub r8d, 0x19d0c892
xor r8d, 0x50f1f802
jmp 0x14009868b
mov dword [rbp - 0x28], ebx
mov rbx, qword [rsp + 0x4e8]
mov dword [rbp + 0xd0], 0x6434103a
sub dword [rbp + 0xd0], 0x23a61771
sub dword [rbp + 0xd0], 0x34f44031
add dword [rbp + 0xd0], 0x30b121f4
jmp 0x1400987bb
mov r8, r15
xchg rbx, r15
nop dword [rax]
inc r8
mov dword [rsp - 0xc], 0x99a4334
cmp byte [rdi + r8], r14b
jmp 0x1400988b0
sub ecx, 0x45d0d74
sub ecx, 0x2dbb72a5
sub ecx, 0x30ca7be8
xchg r13, rax
jmp 0x1400986b1
mov dword [rsp - 0x28], 0x5927c166
movsxd rax, dword [rbp + 0x428]
lea rdx, [rbp + 0x1a0]
mov ecx, 0x5167e8c8
add ecx, 0x236f3ca7
sub ecx, 0x1540ead0
add ecx, 0x34cc266
jmp 0x140098a55
sub edx, 0x48426fa2
xor edx, 0xce47e345
mov dword [rsp + 0x28], r14d
xchg r14, rbp
mov qword [rsp + 0x20], rbp
xchg r14, rbp
call rax
jmp 0x1400986df
xor edx, 0x506e3d41
mov dword [rbp + 0x114], eax
mov dword [rsp - 0x18], ebp
call fcn.1400ddae8
xchg rcx, rdi
jmp 0x140098952
sub dword [rbp + 0xd0], 0x91b9d6
add dword [rbp + 0xd0], 0x9a10d813
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r13, r13
mov ecx, eax
lea rdx, [rbp + 0xcc]
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
jmp 0x140098a6e
xor eax, eax
mov rcx, qword [rbp + 0x3c0]
mov dword [rsp - 0x24], edx
xor rcx, rsp
jmp 0x140098b26
call fcn.1400dc920
sub rsp, 0x5d9a3807
add rsp, 0x5d9a3cf7
pop rbp
ret