Function at 0x140011360
Capabilities:
Get common file path

Disassembly:
push r15
sub rsp, 0x30
cmp qword [0x1400b3b08], 0
mov r15d, ecx
jne 0x140011620
cmp qword [0x1400b3a00], 0
jne 0x140011620
cmp qword [0x1400b3af8], 0
jne 0x140011620
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rdi
xor edi, edi
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r14
lea r12d, [rdi + 0x5c]
test ecx, ecx
je 0x14001143c
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ebx, eax
lea ecx, [rax + 1]
lea rdx, [rcx*2 + 0x14]
lea ecx, [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r14, rax
test rax, rax
jne 0x1400113ec
mov r14d, edi
jmp 0x140011443
mov edx, ebx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov r9d, eax
lea ecx, [r9 - 1]
cmp word [r14 + rcx*2], r12w
je 0x14001140d
mov word [r14 + r9*2], r12w
inc r9d
mov r8d, edi
lea r10, str.msasn1.dll
nop word [rax + rax]
mov edx, r8d
lea ecx, [r8 + r9]
inc r8d
movzx eax, word [r10 + rdx*2]
mov word [r14 + rcx*2], ax
cmp r8d, 0xa
jb 0x140011420
jmp 0x140011443
lea r14, str.msasn1.dll
test r15d, r15d
je 0x1400114cb
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ebx, eax
lea ecx, [rax + 1]
lea rdx, [rcx*2 + 0x18]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
jne 0x14001147b
mov rsi, rdi
jmp 0x1400114d2
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov r9d, eax
lea ecx, [r9 - 1]
cmp word [rsi + rcx*2], r12w
je 0x14001149c
mov word [rsi + r9*2], r12w
inc r9d
mov r8d, edi
lea r10, str.cryptnet.dll
nop word [rax + rax]
mov edx, r8d
lea ecx, [r8 + r9]
inc r8d
movzx eax, word [r10 + rdx*2]
mov word [rsi + rcx*2], ax
cmp r8d, 0xc
jb 0x1400114b0
jmp 0x1400114d2
lea rsi, str.cryptnet.dll
test r15d, r15d
je 0x14001154c
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ecx, 0x40
mov ebp, eax
lea edx, [rax + 1]
lea rdx, [rdx*2 + 0x1a]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
jne 0x140011506
mov rbx, rdi
jmp 0x140011553
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov r9d, eax
lea ecx, [r9 - 1]
cmp word [rbx + rcx*2], r12w
je 0x140011527
mov word [rbx + r9*2], r12w
inc r9d
mov r8d, edi
lea r10, str.cryptbase.dll
mov edx, r8d
lea ecx, [r8 + r9]
inc r8d
movzx eax, word [r10 + rdx*2]
mov word [rbx + rcx*2], ax
cmp r8d, 0xd
jb 0x140011531
jmp 0x140011553
lea rbx, str.cryptbase.dll
test r15d, r15d
mov ebp, 0x800
mov rcx, r14
cmovne ebp, edi
xor edx, edx
mov r8d, ebp
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov r12, qword [rsp + 0x28]
mov qword [0x1400b3b08], rax
test rax, rax
jne 0x14001158a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7e
mov eax, edi
je 0x14001158f
mov eax, 1
and dword [0x1400b02f8], eax
mov r8d, ebp
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [0x1400b3b00], rax
test rax, rax
jne 0x1400115ba
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7e
je 0x1400115bf
mov edi, 1
and dword [0x1400b02f8], edi
mov r8d, ebp
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov qword [0x1400b3af8], rax
test r15d, r15d
je 0x140011604
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [0x1400b02f8]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
mov r14, qword [rsp + 0x20]
add rsp, 0x30
pop r15
ret
mov eax, dword [0x1400b02f8]
add rsp, 0x30
pop r15
ret