Function at 0x7ff72e2e1e50
Capabilities:
Contain obfuscated stackstrings
Get common file path

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x340
mov rax, qword [0x7ff72e3c3a28]
xor rax, rsp
mov qword [rsp + 0x330], rax
mov r12, r8
mov qword [rsp + 0x90], r8
mov rsi, rdx
mov qword [rsp + 0x80], rdx
mov r15, rcx
mov qword [rsp + 0x98], rcx
mov qword [rsp + 0xa8], r8
call qword [sym.imp.KERNEL32.dll_GetErrorMode]
mov dword [rsp + 0x3c], eax
mov ecx, eax
or ecx, 1
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov r14b, 1
mov byte [rsp + 0x30], r14b
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x40], xmm0
xor eax, eax
mov qword [rsp + 0x50], rax
mov ebx, eax
mov dword [rsp + 0x34], eax
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
je 0x7ff72e2e1f33
lea rdx, [rsp + 0x120]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x7ff72e2e1f33
lea r8, [0x7ff72e39a2b0]
mov edx, 0x104
lea rcx, [rsp + 0x120]
call fcn.7ff72e367a84
mov r8, rsi
mov edx, 0x104
lea rcx, [rsp + 0x120]
call fcn.7ff72e367a84
lea rsi, [rsp + 0x120]
mov qword [rsp + 0x80], rsi
call fcn.7ff72e2d2760
mov rdi, rax
xor edx, edx
lea r8d, [rdx + 2]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov r13, rax
mov qword [rsp + 0xa0], rax
test rax, rax
je 0x7ff72e2e2288
cmp qword [r15 + 0x30], 0
je 0x7ff72e2e1f73
call fcn.7ff72e2d2760
sub eax, edi
mov rcx, qword [r15 + 0x30]
mov dword [rcx + 0x3c], eax
mov qword [rsp + 0x70], 0
xor r9d, r9d
lea r8, [rsp + 0x70]
mov edx, 0x29bb
mov rcx, r13
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x7ff72e2e2273
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x58], xmm0
xor ecx, ecx
mov qword [rsp + 0x68], rcx
mov rsi, qword [rsp + 0x70]
movsxd rdi, eax
add rdi, rdi
mov rax, rdi
sar rax, 1
mov edx, ecx
cmp rdi, 2
jb 0x7ff72e2e2012
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
ja 0x7ff72e2e233f
lfence
lea rbx, [rax + rax]
mov rcx, rbx
call fcn.7ff72e2c3420
lfence
mov qword [rsp + 0x58], rax
lea r12, [rbx + rax]
mov qword [rsp + 0x68], r12
mov r8, rdi
mov rdx, rsi
mov rcx, rax
call fcn.7ff72e32d080
mov qword [rsp + 0x60], r12
mov rdx, r12
mov ebx, dword [rsp + 0x34]
xor ecx, ecx
mov word [rsp + 0x38], cx
lea r8, [rsp + 0x38]
lea rcx, [rsp + 0x58]
call 0x7ff72e2e0490
mov r12, qword [rsp + 0x68]
mov r14, qword [rsp + 0x58]
xor ecx, ecx
movabs rax, 0x20003b002c
mov qword [rsp + 0x118], rax
mov qword [rsp + 0x78], rcx
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x118]
mov rcx, r14
call fcn.7ff72e367998
mov rdi, qword [rsp + 0x48]
mov rsi, rax
test rax, rax
je 0x7ff72e2e2198
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x7ff72e2e2103
movdqa xmm0, xmmword [str.NvcPluginLoadHeS]
movdqu xmmword [rsp + 0xb8], xmm0
mov dword [rsp + 0xc8], 0x7265706c
mov dword [rsp + 0xcc], 0x336e6957
mov dword [rsp + 0xd0], 0x70632e32
mov word [rsp + 0xd4], 0x70
mov qword [rsp + 0x28], rsi
lea rax, str.Dependency_module__ls_has_been_loaded_already
mov qword [rsp + 0x20], rax
mov r9d, 3
mov r8d, 0xd9
lea rdx, [rsp + 0xb8]
mov rcx, qword [r15]
call fcn.7ff72e2d6d80
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x118]
xor ecx, ecx
call fcn.7ff72e367998
jmp 0x7ff72e2e2063
mov rdx, rsi
mov rcx, r15
call fcn.7ff72e2e1900
mov qword [rsp + 0x88], rax
test rax, rax
jne 0x7ff72e2e21d2
mov byte [rsp + 0x30], al
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [rsp + 0x34], eax
movdqa xmm0, xmmword [str.NvcPluginLoadHeS]
movdqu xmmword [rsp + 0xd8], xmm0
mov dword [rsp + 0xe8], 0x7265706c
mov dword [rsp + 0xec], 0x336e6957
mov dword [rsp + 0xf0], 0x70632e32
mov word [rsp + 0xf4], 0x70
mov dword [rsp + 0x28], eax
lea rax, str.Dependency_module_load_failed
mov qword [rsp + 0x20], rax
mov r9d, 1
mov r8d, 0xe3
lea rdx, [rsp + 0xd8]
mov rcx, qword [r15]
call fcn.7ff72e2d6af0
nop
test r14, r14
je 0x7ff72e2e223a
sub r12, r14
sar r12, 1
lea rdx, [r12 + r12]
mov rax, r14
cmp rdx, 0x1000
jb 0x7ff72e2e2231
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff72e2e2345
jmp 0x7ff72e2e2231
cmp rdi, qword [rsp + 0x50]
je 0x7ff72e2e21fe
mov qword [rdi], rax
add rdi, 8
mov qword [rsp + 0x48], rdi
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x118]
xor ecx, ecx
call fcn.7ff72e367998
jmp 0x7ff72e2e2063
lea r8, [rsp + 0x88]
mov rdx, rdi
lea rcx, [rsp + 0x40]
call 0x7ff72e2e0330
mov rdi, qword [rsp + 0x48]
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x118]
xor ecx, ecx
call fcn.7ff72e367998
jmp 0x7ff72e2e2063
mov rcx, r14
call fcn.7ff72e329cb8
nop
mov rsi, qword [rsp + 0x80]
movzx r14d, byte [rsp + 0x30]
mov r12, qword [rsp + 0x90]
jmp 0x7ff72e2e2278
mov rdi, qword [rsp + 0x48]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test r14b, r14b
je 0x7ff72e2e229f
jmp 0x7ff72e2e228d
mov rdi, qword [rsp + 0x48]
mov r8b, 1
mov rdx, rsi
mov rcx, r15
call fcn.7ff72e2e1bb0
mov qword [r12], rax
mov ecx, dword [rsp + 0x3c]
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov r14, qword [rsp + 0x40]
mov rsi, r14
cmp r14, rdi
je 0x7ff72e2e22c8
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
add rsi, 8
cmp rsi, rdi
jne 0x7ff72e2e22b6
cmp qword [r12], 0
setne dil
test ebx, ebx
je 0x7ff72e2e22de
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop
test r14, r14
je 0x7ff72e2e2318
mov rdx, qword [rsp + 0x50]
sub rdx, r14
and rdx, 0xfffffffffffffff8
mov rax, r14
cmp rdx, 0x1000
jb 0x7ff72e2e2310
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff72e2e234b
mov rcx, r14
call fcn.7ff72e329cb8
movzx eax, dil
mov rcx, qword [rsp + 0x330]
xor rcx, rsp
call fcn.7ff72e329d50
add rsp, 0x340
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
call fcn.7ff72e2e2c20
nop
call fcn.7ff72e33b2e8
nop
call fcn.7ff72e33b2e8
int3