Function at 0x140005300
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x220]
sub rsp, 0x320
mov rax, qword [0x140011108]
xor rax, rsp
mov qword [rbp + 0x210], rax
mov rsi, rcx
xor r12d, r12d
mov edi, r12d
mov dword [rsp + 0x50], r12d
mov edx, 0x104
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x140005cfb
cmp eax, 0x104
jg 0x140005cc9
lea r8, [rbp]
lea rdx, str._ls_inf
lea rcx, [rbp - 0x78]
call fcn.1400014f0
nop
lea ecx, [r12 + 0x28]
call fcn.1400072d0
mov r14, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x1400053d3
lea rcx, [rbp - 0x78]
call qword [sym.imp.VBoxRT.dll_public:_char_const____ptr64___cdecl_RTCString::c_str_void_const___ptr64]
lea rdx, str.setupapi.app.log
mov rcx, rax
call qword [sym.imp.VBoxRT.dll_RTPathJoinA]
mov rbx, rax
mov qword [rsp + 0x58], rax
mov edi, 1
mov dword [rsp + 0x50], edi
lea r8, str.setupapi.app.log
mov rdx, rax
mov rcx, r14
call fcn.140001380
jmp 0x1400053db
mov rax, r12
mov rbx, qword [rsp + 0x58]
xor r8d, r8d
mov rdx, rax
mov rcx, rsi
call fcn.140001fa0
nop
test dil, 1
je 0x140005400
and edi, 0xfffffffe
mov dword [rsp + 0x50], edi
mov rcx, rbx
call qword [sym.imp.VBoxRT.dll_RTStrFree]
mov ecx, 0x28
call fcn.1400072d0
mov r14, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x140005454
lea rcx, [rbp - 0x78]
call qword [sym.imp.VBoxRT.dll_public:_char_const____ptr64___cdecl_RTCString::c_str_void_const___ptr64]
lea rdx, str.setupapi.dev.log
mov rcx, rax
call qword [sym.imp.VBoxRT.dll_RTPathJoinA]
mov rbx, rax
mov qword [rsp + 0x58], rax
or edi, 2
mov dword [rsp + 0x50], edi
lea r8, str.setupapi.dev.log
mov rdx, rax
mov rcx, r14
call fcn.140001380
jmp 0x14000545c
mov rax, r12
mov rbx, qword [rsp + 0x58]
xor r8d, r8d
mov rdx, rax
mov rcx, rsi
call fcn.140001fa0
nop
test dil, 2
je 0x140005481
and edi, 0xfffffffd
mov dword [rsp + 0x50], edi
mov rcx, rbx
call qword [sym.imp.VBoxRT.dll_RTStrFree]
mov ecx, 0x1028
call fcn.1400072d0
mov rbx, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x1400054b3
lea rdx, str.NetworkAdapters
mov rcx, rax
call fcn.140001410
lea rax, vtable.BugReportNetworkAdaptersWin.0
mov qword [rbx], rax
jmp 0x1400054b6
mov rbx, r12
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
call fcn.140001fa0
lea r8, [rbp]
lea rdx, str._ls_System32
lea rcx, [rsp + 0x68]
call fcn.1400014f0
nop
mov ecx, 0x1128
call fcn.1400072d0
mov r14, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x14000553b
lea rcx, [rsp + 0x68]
call qword [sym.imp.VBoxRT.dll_public:_char_const____ptr64___cdecl_RTCString::c_str_void_const___ptr64]
lea rdx, str.ipconfig.exe
mov rcx, rax
call qword [sym.imp.VBoxRT.dll_RTPathJoinA]
mov rbx, rax
mov qword [rsp + 0x58], rax
or edi, 4
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x20], r12
lea r9, str._all
mov r8, rax
lea rdx, str.IpConfig
mov rcx, r14
call fcn.1400010f0
jmp 0x140005543
mov rax, r12
mov rbx, qword [rsp + 0x58]
xor r8d, r8d
mov rdx, rax
mov rcx, rsi
call fcn.140001fa0
nop
test dil, 4
je 0x140005568
and edi, 0xfffffffb
mov dword [rsp + 0x50], edi
mov rcx, rbx
call qword [sym.imp.VBoxRT.dll_RTStrFree]
mov ecx, 0x1128
call fcn.1400072d0
mov r14, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x1400055c9
lea rcx, [rsp + 0x68]
call qword [sym.imp.VBoxRT.dll_public:_char_const____ptr64___cdecl_RTCString::c_str_void_const___ptr64]
lea rdx, str.netstat.exe
mov rcx, rax
call qword [sym.imp.VBoxRT.dll_RTPathJoinA]
mov rbx, rax
mov qword [rsp + 0x58], rax
or edi, 8
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x20], r12
lea r9, [0x14000c14c]
mov r8, rax
lea rdx, str.RouteTable
mov rcx, r14
call fcn.1400010f0
jmp 0x1400055d1
mov rax, r12
mov rbx, qword [rsp + 0x58]
xor r8d, r8d
mov rdx, rax
mov rcx, rsi
call fcn.140001fa0
nop
test dil, 8
je 0x1400055f6
and edi, 0xfffffff7
mov dword [rsp + 0x50], edi
mov rcx, rbx
call qword [sym.imp.VBoxRT.dll_RTStrFree]
mov ecx, 0x1128
call fcn.1400072d0
mov r14, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x14000566f
lea rcx, [rsp + 0x68]
call qword [sym.imp.VBoxRT.dll_public:_char_const____ptr64___cdecl_RTCString::c_str_void_const___ptr64]
lea rdx, str.wevtutil.exe
mov rcx, rax
call qword [sym.imp.VBoxRT.dll_RTPathJoinA]
mov rbx, rax
mov qword [rsp + 0x58], rax
or edi, 0x10
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x30], r12
lea rax, str._q:_System_Provider__NameVBoxUSBMon_or__NameVBoxNetLwf___
mov qword [rsp + 0x28], rax
lea rax, str.System
mov qword [rsp + 0x20], rax
lea r9, [0x14000c1bc]
mov r8, rbx
lea rdx, str.SystemEvents
mov rcx, r14
call fcn.1400010f0
jmp 0x140005677
mov rax, r12
mov rbx, qword [rsp + 0x58]
xor r8d, r8d
mov rdx, rax
mov rcx, rsi
call fcn.140001fa0
nop
test dil, 0x10
je 0x14000569c
and edi, 0xffffffef
mov dword [rsp + 0x50], edi
mov rcx, rbx
call qword [sym.imp.VBoxRT.dll_RTStrFree]
mov ecx, 0x1128
call fcn.1400072d0
mov r14, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x140005715
lea rcx, [rsp + 0x68]
call qword [sym.imp.VBoxRT.dll_public:_char_const____ptr64___cdecl_RTCString::c_str_void_const___ptr64]
lea rdx, str.wbem_wmic.exe
mov rcx, rax
call qword [sym.imp.VBoxRT.dll_RTPathJoinA]
mov rbx, rax
mov qword [rsp + 0x58], rax
or edi, 0x20
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x30], r12
lea rax, str.brief
mov qword [rsp + 0x28], rax
lea rax, str.list
mov qword [rsp + 0x20], rax
lea r9, [0x14000c1e8]
mov r8, rbx
lea rdx, str.UpdateHistory
mov rcx, r14
call fcn.1400010f0
jmp 0x14000571d
mov rax, r12
mov rbx, qword [rsp + 0x58]
xor r8d, r8d
mov rdx, rax
mov rcx, rsi
call fcn.140001fa0
nop
test dil, 0x20
je 0x140005742
and edi, 0xffffffdf
mov dword [rsp + 0x50], edi
mov rcx, rbx
call qword [sym.imp.VBoxRT.dll_RTStrFree]
mov ecx, 0x1128
call fcn.1400072d0
mov r14, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x1400057d3
lea rcx, [rsp + 0x68]
call qword [sym.imp.VBoxRT.dll_public:_char_const____ptr64___cdecl_RTCString::c_str_void_const___ptr64]
lea rdx, str.sc.exe
mov rcx, rax
call qword [sym.imp.VBoxRT.dll_RTPathJoinA]
mov rbx, rax
mov qword [rsp + 0x58], rax
or edi, 0x40
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x40], r12
lea rax, [0x14000c210]
mov qword [rsp + 0x38], rax
lea rax, str.state
mov qword [rsp + 0x30], rax
lea rax, str.driver
mov qword [rsp + 0x28], rax
lea rax, str.type
mov qword [rsp + 0x20], rax
lea r9, str.query
mov r8, rbx
lea rdx, str.DriverServices
mov rcx, r14
call fcn.1400010f0
jmp 0x1400057db
mov rax, r12
mov rbx, qword [rsp + 0x58]
xor r8d, r8d
mov rdx, rax
mov rcx, rsi
call fcn.140001fa0
nop
test dil, 0x40
je 0x140005800
and edi, 0xffffffbf
mov dword [rsp + 0x50], edi
mov rcx, rbx
call qword [sym.imp.VBoxRT.dll_RTStrFree]
mov ecx, 0x1128
call fcn.1400072d0
mov r14, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x140005862
lea rcx, [rsp + 0x68]
call qword [sym.imp.VBoxRT.dll_public:_char_const____ptr64___cdecl_RTCString::c_str_void_const___ptr64]
lea rdx, str.pnputil.exe
mov rcx, rax
call qword [sym.imp.VBoxRT.dll_RTPathJoinA]
mov rbx, rax
mov qword [rsp + 0x58], rax
bts edi, 7
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x20], r12
lea r9, [0x14000c250]
mov r8, rax
lea rdx, str.DriverStore
mov rcx, r14
call fcn.1400010f0
jmp 0x14000586a
mov rax, r12
mov rbx, qword [rsp + 0x58]
xor r8d, r8d
mov rdx, rax
mov rcx, rsi
call fcn.140001fa0
nop
test dil, dil
jns 0x14000588f
btr edi, 7
mov dword [rsp + 0x50], edi
mov rcx, rbx
call qword [sym.imp.VBoxRT.dll_RTStrFree]
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400072d0
mov r14, rax
mov qword [rsp + 0x60], rax
lea r13, vtable.BugReportFilterRegistryWin.0
test rax, rax
je 0x1400058ba
mov rcx, rax
call fcn.1400013f0
mov qword [r14], r13
jmp 0x1400058bd
mov r14, r12
mov ecx, 0x2128
call fcn.1400072d0
mov r15, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x14000592b
lea rcx, [rsp + 0x68]
call qword [sym.imp.VBoxRT.dll_public:_char_const____ptr64___cdecl_RTCString::c_str_void_const___ptr64]
lea rdx, str.reg.exe
mov rcx, rax
call qword [sym.imp.VBoxRT.dll_RTPathJoinA]
mov rbx, rax
mov qword [rsp + 0x58], rax
bts edi, 8
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x28], r12
lea rax, str.HKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumRootNET
mov qword [rsp + 0x20], rax
lea r9, str.export
mov r8, rbx
lea rdx, str.RegDevKeys
mov rcx, r15
call fcn.140001200
jmp 0x140005933
mov rax, r12
mov rbx, qword [rsp + 0x58]
mov r8, r14
mov rdx, rax
mov rcx, rsi
call fcn.140001fa0
nop
bt edi, 8
jae 0x140005959
btr edi, 8
mov dword [rsp + 0x50], edi
mov rcx, rbx
call qword [sym.imp.VBoxRT.dll_RTStrFree]
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400072d0
mov r14, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x14000597d
mov rcx, rax
call fcn.1400013f0
mov qword [r14], r13
jmp 0x140005980
mov r14, r12
mov ecx, 0x2128
call fcn.1400072d0
mov r15, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x1400059ee
lea rcx, [rsp + 0x68]
call qword [sym.imp.VBoxRT.dll_public:_char_const____ptr64___cdecl_RTCString::c_str_void_const___ptr64]
lea rdx, str.reg.exe
mov rcx, rax
call qword [sym.imp.VBoxRT.dll_RTPathJoinA]
mov rbx, rax
mov qword [rsp + 0x58], rax
bts edi, 9
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x28], r12
lea rax, str.HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002BE10318
mov qword [rsp + 0x20], rax
lea r9, str.export
mov r8, rbx
lea rdx, str.RegDrvKeys
mov rcx, r15
call fcn.140001200
jmp 0x1400059f6
mov rax, r12
mov rbx, qword [rsp + 0x58]
mov r8, r14
mov rdx, rax
mov rcx, rsi
call fcn.140001fa0
nop
bt edi, 9
jae 0x140005a1c
btr edi, 9
mov dword [rsp + 0x50], edi
mov rcx, rbx
call qword [sym.imp.VBoxRT.dll_RTStrFree]
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400072d0
mov r14, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x140005a40
mov rcx, rax
call fcn.1400013f0
mov qword [r14], r13
jmp 0x140005a43
mov r14, r12
mov ecx, 0x2128
call fcn.1400072d0
mov r15, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x140005ab1
lea rcx, [rsp + 0x68]
call qword [sym.imp.VBoxRT.dll_public:_char_const____ptr64___cdecl_RTCString::c_str_void_const___ptr64]
lea rdx, str.reg.exe
mov rcx, rax
call qword [sym.imp.VBoxRT.dll_RTPathJoinA]
mov rbx, rax
mov qword [rsp + 0x58], rax
bts edi, 0xa
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x28], r12
lea rax, str.HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlNetwork
mov qword [rsp + 0x20], rax
lea r9, str.export
mov r8, rbx
lea rdx, str.RegNetwork
mov rcx, r15
call fcn.140001200
jmp 0x140005ab9
mov rax, r12
mov rbx, qword [rsp + 0x58]
mov r8, r14
mov rdx, rax
mov rcx, rsi
call fcn.140001fa0
nop
bt edi, 0xa
jae 0x140005adf
btr edi, 0xa
mov dword [rsp + 0x50], edi
mov rcx, rbx
call qword [sym.imp.VBoxRT.dll_RTStrFree]
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400072d0
mov r14, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x140005b03
mov rcx, rax
call fcn.1400013f0
mov qword [r14], r13
jmp 0x140005b06
mov r14, r12
mov ecx, 0x2128
call fcn.1400072d0
mov r15, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x140005b74
lea rcx, [rsp + 0x68]
call qword [sym.imp.VBoxRT.dll_public:_char_const____ptr64___cdecl_RTCString::c_str_void_const___ptr64]
lea rdx, str.reg.exe
mov rcx, rax
call qword [sym.imp.VBoxRT.dll_RTPathJoinA]
mov rbx, rax
mov qword [rsp + 0x58], rax
bts edi, 0xb
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x28], r12
lea rax, str.HKEY_LOCAL_MACHINESOFTWAREClassesCLSIDf374d1a0_bf08_4bdc_9cb2_c15ddaeef955
mov qword [rsp + 0x20], rax
lea r9, str.export
mov r8, rbx
lea rdx, str.RegNetFltNobj
mov rcx, r15
call fcn.140001200
jmp 0x140005b7c
mov rax, r12
mov rbx, qword [rsp + 0x58]
mov r8, r14
mov rdx, rax
mov rcx, rsi
call fcn.140001fa0
nop
bt edi, 0xb
jae 0x140005b9a
mov rcx, rbx
call qword [sym.imp.VBoxRT.dll_RTStrFree]
mov ecx, 0x1040
call fcn.1400072d0
mov rbx, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x140005be9
lea rdx, str.HostUsbTree
mov rcx, rax
call fcn.140001410
lea rax, vtable.BugReportUsbTreeWin.0
mov qword [rbx], rax
mov qword [rbx + 0x1028], 0xffffffffffffffff
mov qword [rbx + 0x1030], r12
mov qword [rbx + 0x1038], 0xffffffffffffffff
jmp 0x140005bec
mov rbx, r12
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
call fcn.140001fa0
mov ecx, 0x1058
call fcn.1400072d0
mov rbx, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x140005c71
lea rdx, str.DriverVersions
mov rcx, rax
call fcn.140001410
nop
lea rax, vtable.BugReportDriversWin.0
mov qword [rbx], rax
mov dword [rbx + 0x1030], 0x104
mov ecx, 0x208
call fcn.1400076ac
mov qword [rbx + 0x1028], rax
mov dword [rbx + 0x1040], 0x400
mov ecx, 0x2000
call fcn.1400076ac
mov qword [rbx + 0x1038], rax
mov qword [rbx + 0x1048], r12
mov dword [rbx + 0x1050], r12d
jmp 0x140005c74
mov rbx, r12
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
call fcn.140001fa0
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.VBoxRT.dll_public_virtual:_void___cdecl_RTCString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x78]
call qword [sym.imp.VBoxRT.dll_public_virtual:_void___cdecl_RTCString::destructor_void____ptr64]
mov rcx, qword [rbp + 0x210]
xor rcx, rsp
call fcn.140007660
lea r11, [rsp + 0x320]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov r8d, eax
lea rdx, str.Failed_to_get_Windows_directory__needed__d_byte_buffer__n
lea rcx, [rbp - 0x20]
call fcn.1400014f0
nop
mov rdx, rax
lea rcx, [rbp - 0x58]
call qword [sym.imp.VBoxRT.dll_public:_void___cdecl_RTCError::constructor_class_RTCString_const____ptr64____ptr64]
lea rdx, [0x14000ed18]
lea rcx, [rbp - 0x58]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.Failed_to_get_Windows_directory__err_d__n
lea rcx, [rbp - 0x20]
call fcn.1400014f0
nop
mov rdx, rax
lea rcx, [rbp - 0x58]
call qword [sym.imp.VBoxRT.dll_public:_void___cdecl_RTCError::constructor_class_RTCString_const____ptr64____ptr64]
lea rdx, [0x14000ed18]
lea rcx, [rbp - 0x58]
call sub.VCRUNTIME140.dll__CxxThrowException
int3