Function at 0x140004280
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x208]
sub rsp, 0x308
mov edx, pe_nt_image_headers64
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
movzx r13d, word [0x14004ffa2]
mov edi, 0x26
mov r10d, 0x52
mov word [rsp + 0x5c], di
mov word [rbp + 0x258], r10w
mov word [rsp + 0x20], r10w
lea eax, [rdi + 0x29]
mov word [rbp + 0x268], ax
lea r11d, [rdi + 0x23]
mov word [rsp + 0x22], ax
lea ebx, [rdi + 0x54]
lea eax, [rdi + 0x22]
mov word [rsp + 0x24], r11w
mov word [rsp + 0x2e], ax
lea edx, [rdi + 0x2e]
movzx eax, word [str.runas]
lea ecx, [rdi + 0x3c]
xor ax, di
mov word [rbp + 0x260], dx
mov word [rsp + 0x36], ax
lea r9d, [rdi + 0x2b]
movzx eax, word [0x14004ff82]
lea r8d, [rdi + 0x21]
xor ax, di
mov word [rsp + 0x26], bx
mov word [rsp + 0x38], ax
movzx eax, word [0x14004ff84]
xor ax, di
mov word [rsp + 0x28], cx
mov word [rsp + 0x3a], ax
movzx eax, word [0x14004ff86]
xor ax, di
mov word [rsp + 0x2a], r11w
mov word [rsp + 0x3c], ax
movzx eax, word [0x14004ff88]
xor ax, di
mov word [rsp + 0x2c], r9w
mov word [rsp + 0x3e], ax
movzx eax, word [0x14004ff8a]
xor ax, di
mov word [rsp + 0x30], r11w
mov word [rsp + 0x40], ax
movzx eax, word [0x14004ff8c]
xor ax, di
mov word [rsp + 0x32], r8w
mov word [rsp + 0x42], ax
movzx eax, word [0x14004ff8e]
xor ax, di
mov word [rsp + 0x34], bx
mov word [rsp + 0x44], ax
movzx eax, word [0x14004ff90]
xor ax, di
mov word [rsp + 0x46], ax
movzx eax, word [0x14004ff92]
xor ax, di
mov word [rsp + 0x48], ax
movzx eax, word [0x14004ff94]
xor ax, di
mov word [rsp + 0x4a], ax
movzx eax, word [0x14004ff96]
xor ax, di
mov word [rsp + 0x4c], ax
movzx eax, word [0x14004ff98]
xor ax, di
mov word [rsp + 0x4e], ax
movzx eax, word [0x14004ff9a]
xor ax, di
mov word [rsp + 0x50], ax
movzx eax, word [0x14004ff9c]
xor ax, di
mov word [rsp + 0x52], ax
movzx eax, word [0x14004ff9e]
xor ax, di
mov word [rsp + 0x54], ax
movzx eax, word [0x14004ffa0]
xor ax, di
mov word [rsp + 0x56], ax
xor r13w, di
mov word [rsp + 0x58], r13w
mov r13d, 0x7a
movzx r12d, word [0x14004ffa4]
movzx r15d, word [0x14004ffa6]
xor r12w, di
movzx r14d, word [0x14004ffa8]
xor r15w, di
movzx esi, word [0x14004ffaa]
xor r14w, di
movzx ebx, word [0x14004ffae]
xor si, di
movzx edi, word [0x14004ffac]
xor bx, 0x26
movzx r11d, word [str.Franklin_Gothic]
xor di, 0x26
movzx r10d, word [0x14004ffb2]
xor r11w, 0x26
movzx r9d, word [0x14004ffb4]
xor r10w, 0x26
movzx r8d, word [0x14004ffb6]
xor r9w, 0x26
movzx edx, word [0x14004ffb8]
xor r8w, 0x26
movzx ecx, word [0x14004ffba]
xor dx, 0x26
movzx eax, word [0x14004ffbc]
xor cx, 0x26
mov word [rsp + 0x5a], r12w
xor ax, 0x26
mov r12d, 0x26
xor r13w, r12w
mov word [rsp + 0x5e], r13w
mov r13d, 0x75
xor r13w, r12w
mov word [rsp + 0x60], r13w
mov r13d, 0x49
xor r13w, r12w
mov word [rsp + 0x62], r13w
mov r13d, 0x40
xor r13w, r12w
mov word [rsp + 0x64], r13w
mov r13d, 0x52
xor r13w, r12w
mov word [rsp + 0x66], r13w
mov r13d, 0x51
xor r13w, r12w
mov word [rsp + 0x68], r13w
mov r13d, 0x47
xor r13w, r12w
mov word [rsp + 0x6a], r13w
mov r13d, 0x54
xor r13w, r12w
mov word [rsp + 0x6c], r13w
mov r13d, 0x43
xor r13w, r12w
mov word [rsp + 0x6e], r13w
mov r13d, 0x62
xor r13w, r12w
mov word [rsp + 0x70], r13w
mov r13d, 0x4f
xor r13w, r12w
mov word [rsp + 0x72], r13w
mov r13d, 0x55
xor r13w, r12w
mov word [rsp + 0x74], r13w
movzx r13d, word [rbp + 0x258]
xor r13w, r12w
mov word [rsp + 0x76], r13w
movzx r13d, word [rbp + 0x260]
xor r13w, r12w
mov word [rsp + 0x78], r13w
movzx r13d, word [rbp + 0x268]
xor r13w, r12w
mov word [rsp + 0x7a], r13w
mov r13d, 0x44
xor r13w, r12w
mov word [rsp + 0x7c], r13w
mov r13d, 0x53
xor r13w, r12w
mov word [rsp + 0x7e], r13w
movzx r13d, word [rsp + 0x20]
xor r13w, r12w
mov word [rbp - 0x80], r13w
movzx r13d, word [rsp + 0x22]
xor r13w, r12w
mov word [rbp - 0x7e], r13w
movzx r13d, word [rsp + 0x24]
xor r13w, r12w
mov word [rbp - 0x7c], r13w
mov r13d, 0x48
xor r13w, r12w
mov word [rbp - 0x7a], r13w
movzx r13d, word [rsp + 0x26]
xor r13w, r12w
mov word [rbp - 0x78], r13w
movzx r13d, word [rsp + 0x28]
xor r13w, r12w
mov word [rbp - 0x76], r13w
movzx r13d, word [rsp + 0x2a]
xor r13w, r12w
mov word [rbp - 0x74], r13w
movzx r13d, word [rsp + 0x2c]
xor r13w, r12w
mov word [rbp - 0x72], r13w
movzx r13d, word [rsp + 0x2e]
xor r13w, r12w
mov word [rbp - 0x70], r13w
mov r13d, 0x4a
xor r13w, r12w
mov word [rbp - 0x6e], r13w
movzx r13d, word [rsp + 0x30]
xor r13w, r12w
mov word [rbp - 0x6c], r13w
movzx r13d, word [rsp + 0x32]
xor r13w, r12w
mov word [rbp - 0x6a], r13w
mov r13d, 0x42
xor r13w, r12w
mov word [rbp - 0x68], r13w
movzx r13d, word [rsp + 0x34]
xor r13w, r12w
mov word [rbp - 0x66], r13w
movzx r13d, r12w
xor r13w, r12w
mov word [rbp - 0x64], r13w
movzx r13d, word [rsp + 0x36]
xor r13w, r12w
mov word [rbp - 0x62], r13w
movzx r13d, word [rsp + 0x38]
xor r13w, r12w
mov word [rbp - 0x60], r13w
movzx r13d, word [rsp + 0x3a]
xor r13w, r12w
mov word [rbp - 0x5e], r13w
movzx r13d, word [rsp + 0x3c]
xor r13w, r12w
mov word [rbp - 0x5c], r13w
movzx r13d, word [rsp + 0x3e]
xor r13w, r12w
mov word [rbp - 0x5a], r13w
movzx r13d, word [rsp + 0x40]
xor r13w, r12w
mov word [rbp - 0x58], r13w
movzx r13d, word [rsp + 0x42]
xor r13w, r12w
mov word [rbp - 0x56], r13w
movzx r13d, word [rsp + 0x44]
xor r13w, r12w
mov word [rbp - 0x54], r13w
movzx r13d, word [rsp + 0x46]
xor r13w, r12w
mov word [rbp - 0x52], r13w
movzx r13d, word [rsp + 0x48]
xor r13w, r12w
mov word [rbp - 0x50], r13w
movzx r13d, word [rsp + 0x4a]
xor r13w, r12w
mov word [rbp - 0x4e], r13w
movzx r13d, word [rsp + 0x4c]
xor r13w, r12w
mov word [rbp - 0x4c], r13w
movzx r13d, word [rsp + 0x4e]
xor r13w, r12w
mov qword [rbp - 8], 7
mov word [rbp - 0x4a], r13w
movzx r13d, word [rsp + 0x50]
xor r13w, r12w
mov word [rbp - 0x48], r13w
movzx r13d, word [rsp + 0x52]
xor r13w, r12w
mov word [rbp - 0x46], r13w
movzx r13d, word [rsp + 0x54]
xor r13w, r12w
mov word [rbp - 0x44], r13w
movzx r13d, word [rsp + 0x56]
xor r13w, r12w
mov word [rbp - 0x42], r13w
movzx r13d, word [rsp + 0x58]
xor r13w, r12w
movzx r12d, word [rsp + 0x5a]
mov word [rbp - 0x40], r13w
mov r13d, 0x26
xor ax, r13w
xor r8w, r13w
xor r12w, r13w
mov word [rbp - 0x26], ax
xor r15w, r13w
mov word [rbp - 0x2c], r8w
xor r14w, r13w
mov word [rbp - 0x3e], r12w
xor si, r13w
mov word [rbp - 0x3c], r15w
xor di, r13w
mov word [rbp - 0x3a], r14w
xor bx, r13w
mov word [rbp - 0x38], si
xor r11w, r13w
mov word [rbp - 0x36], di
xor r10w, r13w
mov word [rbp - 0x34], bx
xor r9w, r13w
mov word [rbp - 0x32], r11w
xor dx, r13w
mov word [rbp - 0x30], r10w
xor cx, r13w
mov word [rbp - 0x2e], r9w
xor eax, eax
mov word [rbp - 0x2a], dx
mov word [rbp - 0x24], ax
mov r8, 0xffffffffffffffff
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x10], rax
lea rax, [rbp]
mov word [rbp - 0x28], cx
inc r8
cmp word [rax + r8*2], 0
jne 0x140004882
lea rdx, [rbp]
lea rcx, [rbp - 0x20]
call fcn.140002600
mov rbx, qword [rbp + 0x250]
lea r8, [rsp + 0x5e]
mov rcx, rbx
lea rdx, [rbp - 0x20]
call fcn.1400175a0
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x1400048ee
mov rcx, qword [rbp - 0x20]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400048e9
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004905
call fcn.14001bfa4
mov rax, rbx
add rsp, 0x308
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140025ba8
int3