Function at 0x140071cd0
Capabilities:
Contain obfuscated stackstrings
Get common file path

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x278]
sub rsp, 0x350
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14011c018]
xor rax, rsp
mov qword [rbp + 0x240], rax
mov r14, rdx
mov dword [rbp - 0x20], 0x61004d
mov ebx, 0x63
mov dword [rbp - 0x1c], 0x720063
mov dword [rbp - 0x18], 0x6d006f
mov dword [rbp - 0x14], 0x640065
mov dword [rbp - 0x10], 0x46005c
mov dword [rbp - 0xc], 0x61006c
mov dword [rbp - 8], 0x680073
mov dword [rbp - 4], 0x46005c
mov dword [rbp], 0x61006c
mov dword [rbp + 4], 0x680073
mov dword [rbp + 8], 0x650048
mov dword [rbp + 0xc], 0x70006c
mov dword [rbp + 0x10], 0x720065
mov dword [rbp + 0x14], 0x650053
mov dword [rbp + 0x18], 0x760072
mov dword [rbp + 0x1c], 0x630069
mov dword [rbp + 0x20], 0x2e0065
mov dword [rbp + 0x24], 0x780065
mov dword [rbp + 0x28], 0x65
xor r13d, r13d
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x30]
call fcn.1400a2390
lea rax, [rbp + 0x30]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [rbx - 0x3a]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x78]
call fcn.140001c78
nop
lea rdx, [rbp + 0x30]
lea rcx, [rsp + 0x58]
call fcn.140001c78
nop
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x48]
call fcn.140003b40
nop
lea rcx, [rsp + 0x58]
call fcn.140001c70
nop
lea rcx, [rsp + 0x78]
call fcn.140001c70
lea rcx, [rbp - 0x48]
call fcn.14000db40
test al, al
jne 0x140071e26
xor bl, bl
jmp 0x140072039
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x68]
call fcn.140016c70
nop
lea rcx, [rbp - 0x68]
call fcn.140002da0
test al, al
je 0x140071e48
xor bl, bl
jmp 0x14007202f
lea rcx, [rbp - 0x68]
call fcn.140001ca0
cmp r14, rax
je 0x14007202d
lea rcx, [rbp - 0x68]
call fcn.140001ca0
mov r12, rax
cmp qword [rax + 0x18], 8
jb 0x140071e70
mov r12, qword [rax]
mov rsi, qword [rax + 0x10]
mov rcx, r14
call fcn.140001ca0
mov rdi, rax
mov r15, qword [rax + 0x18]
cmp rsi, r15
ja 0x140071ebf
mov rbx, rax
cmp r15, 8
jb 0x140071e94
mov rbx, qword [rax]
mov qword [rax + 0x10], rsi
mov r8, rsi
mov rdx, r12
mov rcx, rbx
call fcn.140001ddc
mov word [rsp + 0x30], r13w
lea rcx, [rbx + rsi*2]
lea rdx, [rsp + 0x30]
call fcn.140001dd4
jmp 0x14007202d
mov rcx, r14
call fcn.140001f74
cmp rsi, rax
ja 0x14007207b
mov rcx, r14
call fcn.140001f74
mov rbx, rax
mov rcx, r14
call fcn.140001ca0
mov rcx, rsi
or rcx, 7
mov qword [rsp + 0x48], rcx
cmp rcx, rbx
ja 0x140071f24
mov rdx, qword [rax + 0x18]
mov rcx, rdx
shr rcx, 1
mov rax, rbx
sub rax, rcx
cmp rdx, rax
ja 0x140071f24
lea rax, [rcx + rdx]
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x48]
call fcn.140001d84
mov rbx, qword [rax]
lea rax, [rbx + 1]
lea rdx, [rax + rax]
movabs rcx, 0x7fffffffffffffff
mov r8, 0xffffffffffffffff
cmp rax, rcx
jbe 0x140071f47
mov rdx, r8
jmp 0x140071f50
cmp rdx, 0x1000
jb 0x140071f7a
lea rcx, [rdx + 0x27]
cmp rcx, rdx
cmovbe rcx, r8
call fcn.1400a08c4
mov rcx, rax
test rax, rax
je 0x140072081
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140071f8c
test rdx, rdx
je 0x140071f89
mov rcx, rdx
call fcn.1400a08c4
jmp 0x140071f8c
mov rax, r13
mov qword [rsp + 0x38], rax
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rbx
mov rbx, qword [rsp + 0x38]
mov r8, rsi
mov rdx, r12
mov rcx, rbx
call fcn.140001ddc
mov word [rsp + 0x30], r13w
lea rcx, [rbx + rsi*2]
lea rdx, [rsp + 0x30]
call fcn.140001dd4
cmp r15, 8
jb 0x140072005
mov rcx, qword [rdi]
lea rdx, [r15*2 + 2]
cmp rdx, 0x1000
jb 0x140071ff6
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140072075
mov rcx, r8
call fcn.1400a0900
mov rax, qword [rsp + 0x38]
mov qword [rdi], rax
jmp 0x14007202d
mov rcx, rdi
call fcn.140001ca0
mov rdx, rax
mov ecx, 8
call fcn.140001bf0
mov rbx, rax
lea rcx, [rsp + 0x38]
call fcn.140001ca0
mov rcx, qword [rax]
mov qword [rbx], rcx
mov bl, 1
lea rcx, [rbp - 0x68]
call fcn.140001c70
nop
lea rcx, [rbp - 0x48]
call fcn.140001c70
movzx eax, bl
mov rcx, qword [rbp + 0x240]
xor rcx, rsp
call fcn.1400a08a0
lea r11, [rsp + 0x350]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400a4d80
nop
call fcn.140001f60
int3
call fcn.1400a4d80
int3