Function at 0x140148e10
Capabilities:
Get common file path

Disassembly:
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x390]
sub rsp, 0x490
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x4b0], rbx
mov rax, qword [0x14041da10]
xor rax, rsp
mov qword [rbp + 0x380], rax
mov rsi, r8
mov rdi, rdx
xor bl, bl
mov edx, 0x104
lea rcx, [rbp + 0x170]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea r8, [0x14035a8a0]
mov edx, 0x104
lea rcx, [rbp + 0x170]
call fcn.1402bf098
cmp dword [rdi + 0xc], 0
je 0x140149050
mov edx, 0x5c
mov rcx, qword [rdi]
call fcn.1402c00ac
test rax, rax
je 0x140149050
sub rax, qword [rdi]
sar rax, 1
test eax, eax
js 0x140149050
xor r8d, r8d
lea rdx, str.system32_
mov rcx, rdi
call fcn.140205020
test al, al
je 0x140148f32
mov edx, 0x104
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1401490d4
mov r8d, 8
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140204810
nop
mov r8, rax
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x30]
call fcn.140201410
nop
mov rdx, rax
mov rcx, rsi
call fcn.140200cb0
nop
cmp dword [rsp + 0x38], 0
jle 0x140148f18
mov rcx, qword [rsp + 0x30]
call fcn.1402bd0e0
nop
cmp dword [rsp + 0x48], 0
jle 0x1401490d2
mov rcx, qword [rsp + 0x40]
call fcn.1402bd0e0
jmp 0x1401490d2
xor r8d, r8d
lea rdx, str.SystemRoot_
mov rcx, rdi
call fcn.140205020
test al, al
je 0x140148fbf
mov edx, 0x104
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x1401490d4
mov r8d, 0xb
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.140204810
nop
mov r8, rax
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.140201410
nop
mov rdx, rax
mov rcx, rsi
call fcn.140200cb0
nop
cmp dword [rsp + 0x48], 0
jle 0x140148fa5
mov rcx, qword [rsp + 0x40]
call fcn.1402bd0e0
nop
cmp dword [rsp + 0x38], 0
jle 0x1401490d2
mov rcx, qword [rsp + 0x30]
call fcn.1402bd0e0
jmp 0x1401490d2
xor r8d, r8d
lea rdx, str.WINDOWS_
mov rcx, rdi
call fcn.140205020
test al, al
je 0x1401490d4
mov edx, 0x104
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x1401490d4
mov r8d, 8
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.140204810
nop
mov r8, rax
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.140201410
nop
mov rdx, rax
mov rcx, rsi
call fcn.140200cb0
nop
cmp dword [rsp + 0x48], 0
jle 0x140149036
mov rcx, qword [rsp + 0x40]
call fcn.1402bd0e0
nop
cmp dword [rsp + 0x38], 0
jle 0x1401490d2
mov rcx, qword [rsp + 0x30]
call fcn.1402bd0e0
jmp 0x1401490d2
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x104
xor r8d, r8d
mov rdx, qword [rdi]
lea rcx, [rbp + 0x170]
call qword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
je 0x1401490d4
lea rax, [rsp + 0x60]
or rbx, 0xffffffffffffffff
nop word [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140149090
test ebx, ebx
jle 0x1401490c2
mov edx, ebx
mov rcx, rsi
call fcn.1402028a0
movsxd r9, ebx
mov eax, dword [rsi + 8]
inc eax
movsxd rdx, eax
lea r8, [rsp + 0x60]
mov rcx, qword [rsi]
call fcn.1402c06dc
jmp 0x1401490c8
cmp dword [rsi + 0xc], 0
jle 0x1401490d2
mov edx, ebx
mov rcx, rsi
call fcn.140203bb0
mov bl, 1
movzx eax, bl
mov rcx, qword [rbp + 0x380]
xor rcx, rsp
call fcn.1402bcad0
mov rbx, qword [rsp + 0x4b0]
add rsp, 0x490
pop rdi
pop rsi
pop rbp
ret