Function at 0x508590
Capabilities:
Get common file path

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x268
mov rbp, rsp
mov qword [rbp + 0x28], rcx
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x250], 0
nop
cmp qword [0x00b34008], 0
jne 0x5085ea
lea rcx, [0x00508904]
call sub.kernel32.dll_GetModuleHandleW
mov rcx, rax
lea rdx, [0x00508918]
call fcn.0041f960
mov qword [0x00b34008], rax
cmp qword [0x00b34010], 0
jne 0x508616
lea rcx, [0x0050894a]
call sub.kernel32.dll_LoadLibraryW
mov rcx, rax
lea rdx, [0x0050895e]
call fcn.0041f960
mov qword [0x00b34010], rax
cmp qword [0x00b34018], 0
jne 0x508642
lea rcx, [0x00508988]
call sub.kernel32.dll_GetModuleHandleW
mov rcx, rax
lea rdx, [0x0050899e]
call fcn.0041f960
mov qword [0x00b34018], rax
mov dword [rbp + 0x25c], 0
mov ecx, 5
xor rdx, rdx
xor r8, r8
lea r9, [rbp + 0x25c]
call qword [0x00b34008]
xor rbx, rbx
cmp dword [rbp + 0x25c], 0
jne 0x5086d0
mov dword [rbp + 0x25c], 0x10000
mov eax, dword [rbp + 0x25c]
add eax, eax
mov dword [rbp + 0x25c], eax
mov rcx, rbx
call sub.kernel32.dll_LocalFree
mov ecx, 0x40
mov edx, dword [rbp + 0x25c]
call sub.kernel32.dll_LocalAlloc
mov rbx, rax
mov ecx, 5
mov rdx, rbx
mov r8d, dword [rbp + 0x25c]
xor r9, r9
call qword [0x00b34008]
test eax, eax
je 0x50870b
cmp dword [rbp + 0x25c], 0x400000
jne 0x50867b
jmp 0x50870b
mov eax, dword [rbp + 0x25c]
add eax, eax
mov dword [rbp + 0x25c], eax
mov ecx, 0x40
mov edx, dword [rbp + 0x25c]
call sub.kernel32.dll_LocalAlloc
mov rbx, rax
mov ecx, 5
mov rdx, rbx
mov r8d, dword [rbp + 0x25c]
xor r9, r9
call qword [0x00b34008]
test eax, eax
jne 0x508883
mov rsi, rbx
cmp word [rsi + 0x38], 0
jbe 0x50885b
lea rcx, [rbp + 0x250]
mov rdx, qword [rsi + 0x40]
call fcn.00411eb0
cmp qword [0x00b34010], 0
je 0x508841
mov ecx, 0x410
xor rdx, rdx
mov r8d, dword [rsi + 0x50]
call sub.kernel32.dll_OpenProcess
mov rdi, rax
test rdi, rdi
je 0x508841
mov rcx, rdi
xor rdx, rdx
lea r8, [rbp + 0x46]
mov r9d, 0x104
call qword [0x00b34010]
test eax, eax
jbe 0x508839
lea rcx, [rbp + 0x250]
lea rdx, [rbp + 0x46]
mov r8d, 0x105
call fcn.00411f10
lea rcx, [0x005089cc]
mov rdx, qword [rbp + 0x250]
mov rax, qword [0x00bb8d10]
call qword [rax]
test al, al
je 0x508805
lea rcx, [rbp + 0x46]
mov edx, 0x104
call sub.kernel32.dll_GetSystemDirectoryW
lea rcx, [rbp + 0x38]
lea rdx, [rbp + 0x46]
mov r8d, 0x105
call fcn.00411f10
lea rcx, [rbp + 0x30]
mov rdx, qword [rbp + 0x250]
mov r8d, 0x15
mov r9d, 0x7fffffff
call fcn.00412480
lea rcx, [rbp + 0x250]
mov rdx, qword [rbp + 0x38]
mov r8, qword [rbp + 0x30]
call fcn.00412270
jmp 0x508839
lea rcx, [0x00508a04]
mov rdx, qword [rbp + 0x250]
mov rax, qword [0x00bb6760]
call qword [rax]
test al, al
je 0x508839
lea rcx, [rbp + 0x250]
mov edx, 1
mov r8d, 4
call fcn.004124e0
mov rcx, rdi
call sub.kernel32.dll_CloseHandle
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x250]
mov r8d, dword [rsi + 0x50]
mov r9d, dword [rsi + 0x64]
call fcn.00508010
jmp 0x508873
mov rcx, qword [rbp + 0x28]
lea rdx, [0x00508a1c]
mov r8d, dword [rsi + 0x50]
mov r9d, dword [rsi + 0x64]
call fcn.00508010
cmp dword [rsi], 0
je 0x508882
mov eax, dword [rsi]
add rsi, rax
jmp 0x508716
nop
mov rcx, rbx
call sub.kernel32.dll_LocalFree
nop
lea rcx, [rbp + 0x30]
mov edx, 2
call fcn.00410160
lea rcx, [rbp + 0x250]
call fcn.00410080
lea rsp, [rbp + 0x268]
pop rbx
pop rsi
pop rdi
pop rbp
ret