Function at 0x180002850
Capabilities:
Contain obfuscated stackstrings
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xe40]
sub rsp, 0xf40
xor r13d, r13d
mov r14, rdx
mov rbx, rcx
mov dword [rdx], r13d
lea edx, [r13 + 0x5c]
call qword [sym.imp.msvcrt.dll_strchr]
lea rcx, [rbp + 0x40]
test rax, rax
jne 0x1800028c3
mov edx, 0x200
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea r8, [0x180005208]
lea rcx, [rbp + 0x40]
mov edx, 0x200
call qword [sym.imp.msvcrt.dll_strcat_s]
lea rcx, [rbp + 0x40]
mov r8, rbx
mov edx, 0x200
call qword [sym.imp.msvcrt.dll_strcat_s]
jmp 0x1800028d1
mov r8, rbx
mov edx, 0x200
call qword [sym.imp.msvcrt.dll_strcpy_s]
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x60], 0x6c64746e
mov dword [rsp + 0x64], 0x6c642e6c
mov word [rsp + 0x68], 0x6c
mov dword [rbp - 0x80], 0x7243775a
mov dword [rbp - 0x7c], 0x65746165
mov dword [rbp - 0x78], 0x656c6946
mov byte [rbp - 0x74], r13b
mov dword [rbp - 0x58], 0x7551775a
mov dword [rbp - 0x54], 0x49797265
mov dword [rbp - 0x50], 0x726f666e
mov dword [rbp - 0x4c], 0x6974616d
mov dword [rbp - 0x48], 0x69466e6f
mov word [rbp - 0x44], 0x656c
mov byte [rbp - 0x42], r13b
mov dword [rsp + 0x70], 0x6552775a
mov dword [rsp + 0x74], 0x69466461
mov word [rsp + 0x78], 0x656c
mov byte [rsp + 0x7a], r13b
mov dword [rbp + 0xe88], 0x6c43775a
mov dword [rbp + 0xe8c], 0x65736f
mov dword [rbp - 0x70], 0x496c7452
mov dword [rbp - 0x6c], 0x5574696e
mov dword [rbp - 0x68], 0x6f63696e
mov dword [rbp - 0x64], 0x74536564
mov dword [rbp - 0x60], 0x676e6972
mov byte [rbp - 0x5c], r13b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x80]
mov rcx, rax
mov rbx, rax
call fcn.180002670
lea rdx, [rbp - 0x58]
mov rcx, rbx
mov r12, rax
call fcn.180002670
lea rdx, [rsp + 0x70]
mov rcx, rbx
mov rsi, rax
call fcn.180002670
lea rdx, [rbp + 0xe88]
mov rcx, rbx
mov r15, rax
call fcn.180002670
lea rdx, [rbp - 0x70]
mov rcx, rbx
mov rdi, rax
call fcn.180002670
lea rcx, [rbp + 0x240]
xor edx, edx
mov rbx, rax
xor eax, eax
mov r8d, 0x400
mov dword [rbp - 8], r13d
mov qword [rbp - 0x18], r13
mov qword [rbp + 0xe90], r13
mov qword [rbp], rax
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rax
mov qword [rbp + 0x20], rax
mov qword [rbp - 0x10], rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x30], r13
mov dword [rbp - 0x40], 0x3f005c
mov dword [rbp - 0x3c], 0x5c003f
mov word [rbp - 0x38], r13w
call sub.msvcrt.dll_memset
lea rax, [rbp + 0x40]
or r9, 0xffffffffffffffff
inc r9
cmp byte [rax + r9], r13b
jne 0x180002a46
lea rax, [rbp + 0x240]
lea r8, [rbp + 0x40]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 0x200
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea r8, [rbp - 0x40]
lea rcx, [rbp + 0x640]
mov edx, 0x400
call qword [sym.imp.msvcrt.dll_wcscpy_s]
lea r8, [rbp + 0x240]
lea rcx, [rbp + 0x640]
mov edx, 0x400
call qword [sym.imp.msvcrt.dll_wcscat_s]
lea rdx, [rbp + 0x640]
lea rcx, [rbp + 0x28]
call rbx
mov dword [rsp + 0x50], r13d
mov qword [rsp + 0x48], r13
mov dword [rsp + 0x40], 0x20
mov dword [rsp + 0x38], 1
lea rax, [rbp + 0x28]
mov dword [rsp + 0x30], 1
lea r9, [rbp - 0x18]
lea r8, [rbp - 8]
lea rcx, [rbp + 0xe90]
mov edx, 0x100001
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], r13
mov dword [rbp - 8], 0x30
mov qword [rbp], r13
mov dword [rbp + 0x10], 0x40
mov qword [rbp + 8], rax
mov qword [rbp + 0x18], r13
mov qword [rbp + 0x20], r13
call r12
test eax, eax
js 0x180002b93
mov rcx, qword [rbp + 0xe90]
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x18]
mov r9d, 0x18
mov dword [rsp + 0x20], 5
call rsi
test eax, eax
js 0x180002b8a
mov esi, dword [rbp - 0x28]
mov ecx, esi
call qword [sym.imp.msvcrt.dll_malloc]
mov rcx, qword [rbp + 0xe90]
mov rbx, rax
test rax, rax
je 0x180002b91
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r13
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x18]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call r15
test eax, eax
jns 0x180002b97
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
mov rcx, qword [rbp + 0xe90]
call rdi
xor eax, eax
jmp 0x180002ba9
mov eax, dword [rbp - 0x28]
mov rcx, qword [rbp + 0xe90]
mov dword [r14], eax
call rdi
mov rax, rbx
mov rbx, qword [rsp + 0xf80]
add rsp, 0xf40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret