Function at 0x140039780
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x990
mov qword [rsp + 0x978], 0xfffffffffffffffe
mov rax, qword [0x140064270]
xor rax, rsp
mov qword [rsp + 0x980], rax
mov rcx, qword [rsp + 0x9a0]
call fcn.140038820
movzx eax, al
test eax, eax
jne 0x1400397e5
lea rdx, str.Win7
mov rcx, qword [rsp + 0x9a8]
call fcn.1400010b4
mov rcx, rax
call fcn.140004608
jmp 0x140039abb
xor eax, eax
mov word [rsp + 0x50], ax
lea rdi, [rsp + 0x52]
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
mov edx, 0x104
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
je 0x140039826
mov eax, dword [rsp + 0x44]
add eax, 1
cdqe
cmp rax, 0x104
jb 0x140039847
lea rdx, [0x140055320]
mov rcx, qword [rsp + 0x9a8]
call fcn.1400010b4
mov rcx, rax
call fcn.140004608
jmp 0x140039abb
call fcn.1400392c0
mov byte [rsp + 0x40], al
movzx eax, byte [rsp + 0x40]
test eax, eax
jne 0x1400398a3
lea rdx, str.SystemDirectory:
lea rcx, [rsp + 0x3a0]
call fcn.14003acc0
nop
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x3a0]
call fcn.14003a880
lea rcx, [rsp + 0x3a0]
call fcn.14003a0f0
mov rcx, rax
call fcn.140039450
nop
lea rcx, [rsp + 0x3a0]
call fcn.14003a260
mov rcx, qword [rsp + 0x9a0]
call fcn.140038770
mov rcx, rax
call fcn.14003cdd0
mov rdx, rax
lea rcx, [rsp + 0x260]
call fcn.14003acc0
nop
xor eax, eax
mov rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x50]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
lea rcx, [rsp + 0x260]
call fcn.14003a0f0
mov r8, rdi
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.140010450
test eax, eax
jne 0x14003992b
mov rax, qword [rsp + 0x9a0]
mov byte [rax + 0x1e1a], 1
movzx eax, byte [rsp + 0x40]
test eax, eax
jne 0x140039929
lea rcx, [0x140055360]
call fcn.140039450
jmp 0x140039940
movzx eax, byte [rsp + 0x40]
test eax, eax
jne 0x140039940
lea rcx, [0x140055388]
call fcn.140039450
mov rax, qword [rsp + 0x9a0]
movzx eax, byte [rax + 0x1e1a]
test eax, eax
jne 0x140039a93
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x4e0]
call fcn.14003d780
nop
lea rcx, [rsp + 0x830]
call fcn.14003d9e0
nop
lea rdx, [rsp + 0x830]
lea rcx, [rsp + 0x4e0]
call fcn.14003dca0
xor edx, edx
mov word [rsp + 0x620], dx
lea rdi, [rsp + 0x622]
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
lea rdx, [rsp + 0x620]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
movzx eax, byte [rsp + 0x40]
test eax, eax
jne 0x1400399f2
lea rcx, [rsp + 0x620]
call fcn.140039450
lea rcx, [rsp + 0x830]
call fcn.14003cdb0
mov rdi, rax
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
lea rcx, [rsp + 0x830]
call fcn.14003cdb0
mov r8, rdi
mov rdx, rax
lea rcx, [rsp + 0x620]
call fcn.140010450
test eax, eax
jne 0x140039a62
mov rax, qword [rsp + 0x9a0]
mov byte [rax + 0x1e1a], 1
movzx eax, byte [rsp + 0x40]
test eax, eax
jne 0x140039a60
lea rcx, str.Cur_Proc_Is_Special
call fcn.140039450
jmp 0x140039a78
movzx eax, byte [rsp + 0x40]
test eax, eax
jne 0x140039a78
lea rcx, str.Cur_Proc_Isnt_Special
call fcn.140039450
nop
lea rcx, [rsp + 0x830]
call fcn.14003cdf0
nop
lea rcx, [rsp + 0x4e0]
call fcn.14003cdf0
mov rcx, qword [rsp + 0x9a8]
call fcn.1400010b0
mov byte [rsp + 0x970], al
lea rcx, [rsp + 0x260]
call fcn.14003a260
mov al, byte [rsp + 0x970]
mov rcx, qword [rsp + 0x980]
xor rcx, rsp
call fcn.14000fd20
add rsp, 0x990
pop rdi
ret