Function at 0x1800072f0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x460
mov rax, qword [0x180080920]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov r14, r8
mov rbp, rdx
mov rdi, rcx
xor edx, edx
mov r8d, 0x400
lea rcx, [rsp + 0x50]
call fcn.18004c900
test rdi, rdi
je 0x1800076a1
xor edx, edx
mov r8d, 0x400
mov rcx, r14
call fcn.18004c900
xor r15d, r15d
xor r9d, r9d
mov qword [rsp + 0x30], r15
mov edx, 0x80000000
mov dword [rsp + 0x28], pe_nt_image_headers64
mov rcx, rdi
mov dword [rsp + 0x20], 3
lea r8d, [r15 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1800073ee
mov rbx, 0xffffffffffffffff
mov rcx, rbx
nop dword [rax]
inc rcx
cmp word [rdi + rcx*2], r15w
jne 0x180007390
cmp ecx, 0x200
jg 0x1800073bd
cmp word [rdi + rbx*2 + 2], r15w
lea rbx, [rbx + 1]
jne 0x1800073a2
lea r8, [rbx + rbx]
mov rdx, rdi
mov rcx, r14
call fcn.18004c130
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x1800074bd
test byte [rsp + 0x40], 2
jne 0x1800074bd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x1800076a3
mov edx, 0x200
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1800074c4
lea rcx, [rsp + 0x50]
sub rcx, 2
nop
cmp word [rcx + 2], r15w
lea rcx, [rcx + 2]
jne 0x180007410
mov eax, dword [0x18006cd8c]
mov dword [rcx], eax
lea rcx, [rsp + 0x50]
sub rcx, 2
nop dword [rax]
cmp word [rcx + 2], r15w
lea rcx, [rcx + 2]
jne 0x180007430
xor edx, edx
nop dword [rax]
movzx eax, word [rdi + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x180007440
xor r9d, r9d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], pe_nt_image_headers64
lea rcx, [rsp + 0x50]
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1800074c4
lea rax, [rsp + 0x50]
mov rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], r15w
jne 0x180007492
cmp ebx, 0x200
jg 0x1800074b5
lea r8, [rbx + rbx]
mov rcx, r14
lea rdx, [rsp + 0x50]
call fcn.18004c130
mov rcx, rsi
call fcn.18000d5c0
mov al, 1
jmp 0x1800076a3
mov edx, 0x200
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x180007571
lea rcx, [rsp + 0x50]
sub rcx, 2
cmp word [rcx + 2], r15w
lea rcx, [rcx + 2]
jne 0x1800074e5
mov eax, dword [0x18006cd90]
mov dword [rcx], eax
lea rcx, [rsp + 0x50]
sub rcx, 2
cmp word [rcx + 2], r15w
lea rcx, [rcx + 2]
jne 0x180007501
xor edx, edx
nop
movzx eax, word [rdi + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x180007510
xor r9d, r9d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], pe_nt_image_headers64
lea rcx, [rsp + 0x50]
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x180007571
lea rax, [rsp + 0x50]
mov rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], r15w
jne 0x180007562
jmp 0x18000749c
test rbp, rbp
je 0x1800076a1
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x400
call fcn.18004c900
mov rbx, 0xffffffffffffffff
mov rax, rbx
nop word [rax + rax]
inc rax
cmp word [rbp + rax*2], r15w
jne 0x1800075a0
movsxd rcx, eax
test eax, eax
jle 0x1800075c4
cmp word [rbp + rcx*2], 0x5c
je 0x1800075c4
dec eax
dec rcx
test rcx, rcx
jg 0x1800075b2
movsxd r8, eax
test eax, eax
js 0x1800075de
inc r8
lea rcx, [rsp + 0x50]
add r8, r8
mov rdx, rbp
call fcn.18004c130
lea rcx, [rsp + 0x50]
sub rcx, 2
nop word [rax + rax]
cmp word [rcx + 2], r15w
lea rcx, [rcx + 2]
jne 0x1800075f0
xor r9d, r9d
nop
movzx eax, word [rdi + r9*2]
mov word [rcx + r9*2], ax
lea r9, [r9 + 1]
test ax, ax
jne 0x180007600
xor r9d, r9d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], pe_nt_image_headers64
lea rcx, [rsp + 0x50]
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, rbx
je 0x1800076a1
lea rax, [rsp + 0x50]
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], r15w
jne 0x180007650
cmp ebx, 0x200
jg 0x180007673
lea r8, [rbx + rbx]
mov rcx, r14
lea rdx, [rsp + 0x50]
call fcn.18004c130
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x1800074bd
test byte [rsp + 0x40], 2
jne 0x1800074bd
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x1800076a3
xor al, al
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.180049ad0
mov rbx, qword [rsp + 0x498]
add rsp, 0x460
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret