Function at 0x1400965c0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r15, rcx
xor r13d, r13d
xor ecx, ecx
xor edx, edx
mov ebp, r13d
mov r12d, r8d
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
nop dword [rax + rax]
mov esi, eax
test eax, eax
jne 0x140096661
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x140096619
movzx ebx, ax
or ebx, 0x80070000
mov rcx, qword [0x14017a048]
lea rax, [0x14017a048]
cmp rcx, rax
je 0x140096828
test byte [rcx + 0x1c], 1
je 0x140096828
cmp byte [rcx + 0x19], 2
jb 0x140096828
mov rcx, qword [rcx + 0x10]
lea r8, [0x14015ec00]
mov edx, 0x3e
mov r9d, ebx
call fcn.140006bc4
jmp 0x140096828
or rbx, 0xffffffffffffffff
mov rdx, rbx
inc rdx
cmp word [r15 + rdx*2], r13w
jne 0x140096668
lea r14d, [rax + 1]
xor ecx, ecx
inc r14
add r14, rdx
lea rdx, [r14 + r14]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
jne 0x1400966a0
mov ebx, 0x8007000e
jmp 0x140096844
mov edx, esi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
nop dword [rax + rax]
cmp eax, esi
ja 0x1400967d8
test eax, eax
je 0x1400967bb
inc rbx
cmp word [rdi + rbx*2], r13w
jne 0x1400966c1
mov eax, 0x5c
cmp ax, word [rdi + rbx*2 - 2]
je 0x140096737
lea r8, [0x140157a78]
mov rdx, r14
mov rcx, rdi
call fcn.14005485c
mov ebx, eax
test eax, eax
jns 0x140096737
mov rcx, qword [0x14017a048]
lea rax, [0x14017a048]
cmp rcx, rax
je 0x140096814
test byte [rcx + 0x1c], 1
je 0x140096814
cmp byte [rcx + 0x19], 2
jb 0x140096814
mov edx, 0x40
mov rcx, qword [rcx + 0x10]
lea r8, [0x14015ec00]
mov r9d, ebx
call fcn.140006cec
jmp 0x140096814
mov r8, r15
mov rdx, r14
mov rcx, rdi
call fcn.14005485c
mov ebx, eax
test eax, eax
jns 0x14009677d
mov rcx, qword [0x14017a048]
lea rax, [0x14017a048]
cmp rcx, rax
je 0x140096814
test byte [rcx + 0x1c], 1
je 0x140096814
cmp byte [rcx + 0x19], 2
jb 0x140096814
mov edx, 0x41
jmp 0x14009671f
mov r8d, r12d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
nop dword [rax + rax]
mov rbp, rax
test rax, rax
jne 0x1400967b6
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x140096814
movzx ebx, ax
or ebx, 0x80070000
jmp 0x140096814
mov ebx, r13d
jmp 0x140096814
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x1400967dd
movzx ebx, ax
or ebx, 0x80070000
jmp 0x1400967dd
mov ebx, 0x8007006f
mov rcx, qword [0x14017a048]
lea rax, [0x14017a048]
cmp rcx, rax
je 0x140096814
test byte [rcx + 0x1c], 1
je 0x140096814
cmp byte [rcx + 0x19], 2
jb 0x140096814
mov rcx, qword [rcx + 0x10]
lea r8, [0x14015ec00]
mov edx, 0x3f
mov r9d, ebx
call fcn.140006bc4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop dword [rax + rax]
test rbp, rbp
jne 0x140096852
test ebx, ebx
jne 0x140096844
lea r8, str.S_OK___hr
mov edx, 0x64c
lea rcx, str.base_stor_blbutil_blbutility.cpp
call fcn.14008ac24
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x50]
mov rax, rbp
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret