Function at 0x140071ce0
Capabilities:
Get common file path

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x190
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rsp + 0x1e0], rbx
mov rax, qword [0x1402ba4e0]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov r14d, r8d
movsxd r15, edx
mov r12, rcx
xor edx, edx
lea rcx, [rsp + 0x38]
call fcn.1400a3e30
nop
test r15d, r15d
jle 0x140071f81
lea rax, str._AMZ2122
mov qword [rsp + 0x28], rax
lea rax, str.RatSymLdrD
mov qword [rsp + 0x20], rax
lea r9, str.RatSymLdr
xor r8d, r8d
lea rdx, [0x140213f68]
lea rcx, [rsp + 0x38]
call fcn.1400210c0
mov r13d, eax
test eax, eax
jle 0x140071f86
cmp byte [0x1402bf240], 0
je 0x140071e06
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [0x1402bf240]
repne scasb al, byte [rdi]
not rcx
lea rbp, [rcx - 1]
lea rcx, [rsp + 0x38]
call fcn.1400a41d0
test rax, rax
mov rdi, rax
je 0x140071e06
mov rcx, rax
call fcn.1400a39b0
mov rbx, rax
test rax, rax
je 0x140071dce
mov r8, rbp
lea rdx, [0x1402bf240]
mov rcx, rax
call fcn.14010f9e8
test eax, eax
je 0x140071ddd
mov rdx, rdi
lea rcx, [rsp + 0x38]
call fcn.1400a41e0
jmp 0x140071da0
mov rsi, r15
mov r8, r15
mov rcx, r12
test r14d, r14d
mov rdx, rbx
jne 0x140071df2
lea rdx, [rbx + rbp]
call fcn.14010d5f0
mov byte [rsi + r12 - 1], 0
test rdi, rdi
jne 0x140071f86
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x70]
repne scasb al, byte [rdi]
not rcx
lea rsi, [rcx - 1]
lea rcx, [rsp + 0x38]
call fcn.1400a41d0
test rax, rax
mov rbx, rax
je 0x140071efa
mov rcx, rax
call fcn.1400a39b0
mov rdi, rax
test rax, rax
je 0x140071e64
mov r8, rsi
lea rdx, [rsp + 0x70]
mov rcx, rax
call fcn.14010f9e8
test eax, eax
jne 0x140071e73
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.1400a41e0
jmp 0x140071e34
cmp byte [0x1402bf240], 0
jne 0x140071eb6
mov rcx, rdi
lea rdx, [0x1402bf240]
sub rdx, rdi
nop dword [rax]
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
inc rcx
test al, al
jne 0x140071e90
mov edx, 0x5c
lea rcx, [0x1402bf240]
call fcn.14010db4c
test rax, rax
je 0x140071eb6
mov byte [rax], 0
test r14d, r14d
je 0x140071ec0
mov rdx, rdi
jmp 0x140071edd
mov edx, 0x5c
mov rcx, rdi
call fcn.14010db4c
test rax, rax
je 0x140071ed7
inc rax
jmp 0x140071eda
mov rax, rdi
mov rdx, rax
mov rsi, r15
mov r8, r15
mov rcx, r12
call fcn.14010d5f0
mov byte [r15 + r12 - 1], 0
test rbx, rbx
jne 0x140071f86
test r14d, r14d
je 0x140071f7c
lea rcx, [rsp + 0x38]
call fcn.1400a41d0
test rax, rax
je 0x140071f86
mov rcx, rax
call fcn.1400a39b0
mov rbx, rax
test rax, rax
je 0x140071f86
cmp byte [0x1402bf240], 0
jne 0x140071f66
mov rcx, rax
lea rdx, [0x1402bf240]
sub rdx, rax
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
inc rcx
test al, al
jne 0x140071f40
mov edx, 0x5c
lea rcx, [0x1402bf240]
call fcn.14010db4c
test rax, rax
je 0x140071f66
mov byte [rax], 0
mov r8, r15
mov rdx, rbx
mov rcx, r12
call fcn.14010d5f0
mov byte [r15 + r12 - 1], 0
jmp 0x140071f86
xor r13d, r13d
jmp 0x140071f86
mov r13d, dword [rsp + 0x30]
mov edx, 1
lea rcx, [rsp + 0x38]
call fcn.1400a4230
nop
lea rcx, [rsp + 0x38]
call fcn.1400a4630
mov eax, r13d
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.14010d170
mov rbx, qword [rsp + 0x1e0]
add rsp, 0x190
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret