Function at 0x14002db60
Capabilities:
Get common file path

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x110
mov rax, qword [0x1400a3020]
xor rax, rsp
mov qword [rsp + 0x100], rax
mov rsi, r9
mov r12, r8
mov qword [rsp + 0x50], r8
mov r13, rdx
mov r14, rcx
mov qword [rsp + 0xb8], rcx
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
xor ecx, ecx
call fcn.1400011d0
mov qword [rsp + 0x48], rax
lea rdx, str.CMemDumper::CreateImageDump___started
mov rcx, rax
call fcn.140022090
xorps xmm0, xmm0
movups xmmword [rsp + 0xc0], xmm0
mov edx, dword [r13 + 8]
lea rcx, [rsp + 0xc0]
call fcn.1400273d0
nop
mov rbx, qword [rsp + 0x170]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rsi
mov r9, r12
mov r8, qword [rsp + 0xc0]
mov rdx, r13
mov rcx, r14
call fcn.14002bcd0
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov rdi, rax
mov r8d, dword [r13 + 0x20]
mov edx, dword [r13 + 8]
mov rcx, qword [r14 + 0x60]
call fcn.140030950
mov qword [rsp + 0x20], rbx
mov r9, rsi
mov r8, r12
mov edx, dword [r13 + 8]
mov rcx, qword [r14 + 0x60]
call fcn.140032a10
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov rcx, rax
xorps xmm2, xmm2
test rax, rax
js 0x14002dc52
cvtsi2sd xmm2, rax
jmp 0x14002dc64
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2sd xmm2, rax
addsd xmm2, xmm2
xorps xmm0, xmm0
test rdi, rdi
js 0x14002dc73
cvtsi2sd xmm0, rdi
jmp 0x14002dc88
mov rax, rdi
shr rax, 1
and edi, 1
or rax, rdi
cvtsi2sd xmm0, rax
addsd xmm0, xmm0
subsd xmm2, xmm0
divsd xmm2, qword [0x140095710]
movq r8, xmm2
lea rdx, str.CMemDumper::CreateImageDump:_update_basic_info_time__f
mov rcx, qword [rsp + 0x48]
call fcn.140022090
mov r15, qword [r14 + 0x60]
mov esi, dword [r13 + 8]
lea rdi, [r15 + 0x78]
mov qword [rsp + 0x68], rdi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov rcx, qword [r15 + 0x68]
mov rax, qword [rcx + 8]
mov rbx, rcx
cmp byte [rax + 0x19], 0
jne 0x14002dced
cmp dword [rax + 0x20], esi
jae 0x14002dce1
mov rax, qword [rax + 0x10]
jmp 0x14002dce7
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x14002dcd6
cmp byte [rbx + 0x19], 0
jne 0x14002dd9b
cmp esi, dword [rbx + 0x20]
jb 0x14002dd9b
cmp rbx, rcx
je 0x14002dd9b
xor ecx, ecx
call fcn.1400011d0
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov rsi, rax
mov rdx, qword [rbx + 0x28]
mov rcx, r15
call fcn.14002fc40
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov rcx, rax
xorps xmm2, xmm2
test rax, rax
js 0x14002dd40
cvtsi2sd xmm2, rax
jmp 0x14002dd52
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2sd xmm2, rax
addsd xmm2, xmm2
xorps xmm0, xmm0
test rsi, rsi
js 0x14002dd61
cvtsi2sd xmm0, rsi
jmp 0x14002dd76
mov rax, rsi
shr rax, 1
and esi, 1
or rax, rsi
cvtsi2sd xmm0, rax
addsd xmm0, xmm0
subsd xmm2, xmm0
divsd xmm2, qword [0x140095710]
movq r8, xmm2
lea rdx, str.CProcessInfo::upload:_upload_pinfo_time__f
mov rcx, r12
call fcn.140022090
mov r12, qword [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
jmp 0x14002ddbe
mov rbx, qword [r14]
cmp dword [rbx + 0x19c], 0
je 0x14002de22
lea rdi, [rbx + 0x1a0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [rbx + 0x198]
mov ebx, dword [rbx + 0x19c]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp esi, ebx
jl 0x14002de22
lea rdx, str.CMemDumper::CreateImageDump__:_maximum_number_of_dumps_reached
mov rcx, qword [rsp + 0x48]
call fcn.140022090
nop
mov rdi, qword [rsp + 0xc8]
test rdi, rdi
je 0x14002e554
mov rsi, 0xffffffffffffffff
jmp 0x14002e52d
xor bl, bl
mov byte [rsp + 0x40], bl
mov rsi, qword [r14]
mov rcx, qword [rsp + 0xc0]
mov rax, qword [rcx]
mov edi, dword [rax + 0x20]
cmp dword [rsi + 0x128], 0
je 0x14002de75
xor ecx, ecx
call fcn.1400011d0
movsxd rcx, dword [rsi + 0x128]
shl rcx, 0xa
cmp rdi, rcx
jbe 0x14002de6d
mov r8d, edi
lea rdx, str.CheckRegionSize__:_region_size_too_large:__08X
mov rcx, rax
call fcn.140022090
jmp 0x14002dea1
mov rcx, qword [rsp + 0xc0]
mov rax, qword [rcx]
mov r9d, dword [rax + 0x20]
mov byte [rsp + 0x30], 0
mov qword [rsp + 0x28], r12
mov byte [rsp + 0x20], 1
mov r8, qword [rax + 0x18]
mov rdx, r13
mov rcx, r14
call fcn.14002a870
movzx ebx, al
mov byte [rsp + 0x40], al
jmp 0x14002debf
mov rax, qword [r13 + 0x238]
mov rdi, qword [rax]
mov rdi, qword [rdi]
mov qword [rsp + 0xb0], rdi
cmp byte [rdi + 0x19], 0
jne 0x14002dfc4
mov r15, qword [r14]
mov rsi, qword [rdi + 0x28]
cmp dword [r15 + 0x128], 0
je 0x14002df1a
xor ecx, ecx
call fcn.1400011d0
movsxd rcx, dword [r15 + 0x128]
shl rcx, 0xa
cmp rsi, rcx
jbe 0x14002df1a
mov r8, rsi
lea rdx, str.CheckRegionSize__:_region_size_too_large:__08X
mov rcx, rax
call fcn.140022090
jmp 0x14002df42
mov byte [rsp + 0x30], 0
mov qword [rsp + 0x28], r12
mov byte [rsp + 0x20], 0
mov r9, qword [rdi + 0x28]
mov r8, qword [rdi + 0x20]
mov rdx, r13
mov rcx, r14
call fcn.14002a870
or bl, al
mov byte [rsp + 0x40], bl
jmp 0x14002df68
mov rax, qword [rdi + 0x10]
cmp byte [rax + 0x19], 0
je 0x14002df9b
mov rax, qword [rdi + 8]
cmp byte [rax + 0x19], 0
jne 0x14002df93
nop dword [rax]
cmp rdi, qword [rax + 0x10]
jne 0x14002df93
mov rdi, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x14002df80
mov rdi, rax
jmp 0x14002decc
mov rdi, rax
mov rcx, qword [rax]
cmp byte [rcx + 0x19], 0
jne 0x14002decc
nop dword [rax + rax]
mov rdi, rcx
mov rax, qword [rcx]
mov rcx, rax
cmp byte [rax + 0x19], 0
je 0x14002dfb0
jmp 0x14002decc
xorps xmm0, xmm0
movups xmmword [rsp + 0xf0], xmm0
lea r9, [r14 + 0x48]
mov r8, qword [r14]
mov edx, dword [r13 + 8]
lea rcx, [rsp + 0xf0]
call fcn.140027c50
nop
mov rax, qword [rsp + 0xf0]
mov rdi, qword [rax]
mov rdi, qword [rdi]
mov qword [rsp + 0xb0], rdi
cmp byte [rdi + 0x19], 0
jne 0x14002e0e5
mov r15, qword [r14]
mov rsi, qword [rdi + 0x28]
cmp dword [r15 + 0x128], 0
je 0x14002e044
xor ecx, ecx
call fcn.1400011d0
movsxd rcx, dword [r15 + 0x128]
shl rcx, 0xa
cmp rsi, rcx
jbe 0x14002e044
mov r8, rsi
lea rdx, str.CheckRegionSize__:_region_size_too_large:__08X
mov rcx, rax
call fcn.140022090
jmp 0x14002e06c
mov byte [rsp + 0x30], 0
mov qword [rsp + 0x28], r12
mov byte [rsp + 0x20], 0
mov r9, qword [rdi + 0x28]
mov r8, qword [rdi + 0x20]
mov rdx, r13
mov rcx, r14
call fcn.14002a870
or bl, al
mov byte [rsp + 0x40], bl
jmp 0x14002e092
mov rax, qword [rdi + 0x10]
cmp byte [rax + 0x19], 0
je 0x14002e0c1
mov rax, qword [rdi + 8]
cmp byte [rax + 0x19], 0
jne 0x14002e0b9
cmp rdi, qword [rax + 0x10]
jne 0x14002e0b9
mov rdi, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x14002e0a6
mov rdi, rax
jmp 0x14002dff6
mov rdi, rax
mov rcx, qword [rax]
cmp byte [rcx + 0x19], 0
jne 0x14002dff6
mov rdi, rcx
mov rax, qword [rcx]
mov rcx, rax
cmp byte [rax + 0x19], 0
je 0x14002e0d1
jmp 0x14002dff6
mov rax, qword [r14]
cmp byte [rax + 0x122], 0
je 0x14002e485
xor r15d, r15d
mov qword [rsp + 0x90], r15
mov qword [rsp + 0xa8], 7
mov qword [rsp + 0xa0], 1
mov dword [rsp + 0x90], r15d
lea edx, [r15 + 1]
lea rcx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov ecx, eax
mov r8, qword [rsp + 0xa0]
cmp rcx, r8
ja 0x14002e16a
lea rax, [rsp + 0x90]
cmp qword [rsp + 0xa8], 8
cmovae rax, qword [rsp + 0x90]
mov qword [rsp + 0xa0], rcx
mov word [rax + rcx*2], r15w
jmp 0x14002e1d4
mov rdx, rcx
sub rdx, r8
mov rdi, qword [rsp + 0xa8]
mov rax, rdi
sub rax, r8
cmp rdx, rax
ja 0x14002e1be
mov qword [rsp + 0xa0], rcx
lea r9, [rsp + 0x90]
cmp rdi, 8
cmovae r9, qword [rsp + 0x90]
lea rdi, [r9 + r8*2]
test rdx, rdx
je 0x14002e1b3
movzx eax, r15w
mov rcx, rdx
rep stosw word [rdi], ax
lea rax, [rdx + r8]
mov word [r9 + rax*2], r15w
jmp 0x14002e1d4
mov word [rsp + 0x20], r15w
mov r9, rdx
lea rcx, [rsp + 0x90]
call fcn.1400221b0
mov dword [rsp + 0x58], r15d
lea rcx, [rsp + 0x90]
cmp qword [rsp + 0xa8], 8
cmovae rcx, qword [rsp + 0x90]
mov rax, qword [rsp + 0xa0]
lea rax, [rcx + rax*2]
lea rdi, [rsp + 0x90]
cmovae rdi, qword [rsp + 0x90]
mov dword [rsp + 0xb8], r15d
sub rax, rdi
sar rax, 1
lea r8, [rax + rax]
xor edx, edx
mov rcx, rdi
call fcn.14004a2e0
lea rcx, [rsp + 0x90]
cmp qword [rsp + 0xa8], 8
cmovae rcx, qword [rsp + 0x90]
mov edx, dword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov rax, qword [rsp + 0xc0]
mov rdi, qword [rax]
mov rsi, 0xffffffffffffffff
add rdi, 0x438
cmp rdi, qword [rax + 8]
je 0x14002e43b
mov rax, qword [r14 + 0x50]
cmp byte [rax + 0x38], 0
je 0x14002e37d
lea rdx, [rdi + 0x230]
mov qword [rsp + 0xd0], r15
mov qword [rsp + 0xe0], r15
mov qword [rsp + 0xe8], 7
mov word [rsp + 0xd0], r15w
mov r8, rsi
inc r8
cmp word [rdx + r8*2], 0
jne 0x14002e2b3
lea rcx, [rsp + 0xd0]
call fcn.140002760
nop
lea rdx, [rsp + 0xd0]
mov rcx, qword [r14 + 0x50]
call fcn.140042590
nop
mov rdx, qword [rsp + 0xe8]
test al, al
je 0x14002e33b
cmp rdx, 8
jb 0x14002e42e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002e329
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002e577
call fcn.1400477f0
mov rax, qword [rsp + 0xc0]
jmp 0x14002e265
cmp rdx, 8
jb 0x14002e3b6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002e376
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002e577
call fcn.1400477f0
jmp 0x14002e3b6
mov r8, qword [rsp + 0xa0]
dec r8
lea rdx, [rsp + 0x90]
cmp qword [rsp + 0xa8], 8
cmovae rdx, qword [rsp + 0x90]
lea rcx, [rdi + 0x230]
call fcn.14005b970
test eax, eax
je 0x14002e42e
mov r12, qword [r14]
mov r15d, dword [rdi + 0x20]
cmp dword [r12 + 0x128], 0
je 0x14002e402
xor ecx, ecx
call fcn.1400011d0
movsxd rcx, dword [r12 + 0x128]
shl rcx, 0xa
cmp r15, rcx
jbe 0x14002e402
mov r8d, r15d
lea rdx, str.CheckRegionSize__:_region_size_too_large:__08X
mov rcx, rax
call fcn.140022090
xor r15d, r15d
mov rax, qword [rsp + 0xc0]
jmp 0x14002e265
mov r9d, dword [rdi + 0x20]
mov byte [rsp + 0x30], 0
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x20], 1
mov r8, qword [rdi + 0x18]
mov rdx, r13
mov rcx, r14
call fcn.14002a870
or bl, al
xor r15d, r15d
mov rax, qword [rsp + 0xc0]
jmp 0x14002e265
mov rdx, qword [rsp + 0xa8]
cmp rdx, 8
jb 0x14002e48c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002e47e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002e57d
call fcn.1400477f0
jmp 0x14002e48c
mov rsi, 0xffffffffffffffff
test bl, bl
je 0x14002e4be
mov rbx, qword [r14]
cmp dword [rbx + 0x19c], 0
je 0x14002e4d7
lea rcx, [rbx + 0x1a0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc dword [rbx + 0x198]
lea rcx, [rbx + 0x1a0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x14002e4d7
lea r9, [r13 + 0x2c]
mov r8d, dword [r13 + 8]
lea rdx, str.CMemDumper::CreateImageDump__:_process__d__s__is_white
mov rcx, qword [rsp + 0x48]
call fcn.140022090
lea rdx, str.CMemDumper::CreateImageDump___finished
mov rcx, qword [rsp + 0x48]
call fcn.140022090
nop
mov rdi, qword [rsp + 0xf8]
test rdi, rdi
je 0x14002e520
mov eax, esi
lock xadd dword [rdi + 8], eax
cmp eax, 1
jne 0x14002e520
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
mov eax, esi
lock xadd dword [rdi + 0xc], eax
cmp eax, 1
jne 0x14002e520
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + VariantCopy]
nop
mov rdi, qword [rsp + 0xc8]
test rdi, rdi
je 0x14002e554
mov eax, esi
lock xadd dword [rdi + 8], eax
cmp eax, 1
jne 0x14002e554
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
lock xadd dword [rdi + 0xc], esi
cmp esi, 1
jne 0x14002e554
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + VariantCopy]
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.1400477d0
add rsp, 0x110
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
call fcn.14004e14c
nop
call fcn.14004e14c
int3