Function at 0x140001a10
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xcc8
xor r9d, r9d
lea rdi, [0x14000c0a2]
xor edx, edx
mov word [0x14001e0c0], r9w
mov r15d, 0x1000
mov eax, 0x25
lea rsi, [0x14001e0c0]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x28], rcx
jmp 0x140001a78
test rdx, rdx
je 0x140001b08
mov word [rdx], ax
add rdx, 2
movzx eax, word [rdi]
add rdi, 2
test ax, ax
je 0x140001b28
cmp ax, 0x25
jne 0x140001a58
test rdx, rdx
je 0x140001b38
xor ecx, ecx
lea r14, [rsp + 0x4c0]
mov word [rdx], cx
lea rdx, str.TEMP
mov rcx, r14
call sub.msvcrt.dll__wcsicmp
test eax, eax
je 0x140001c2b
lea rdx, str.PROGRAM
mov rcx, r14
call sub.msvcrt.dll__wcsicmp
test eax, eax
je 0x140001d2b
lea rdx, [0x14000c0f2]
mov rcx, r14
call sub.msvcrt.dll__wcsicmp
test eax, eax
je 0x140001c58
lea rdx, str.TIME
mov rcx, r14
call sub.msvcrt.dll__wcsicmp
test eax, eax
je 0x140001b51
xor eax, eax
add rsp, 0xcc8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
test r15, r15
je 0x140001aec
mov word [rsi], ax
movzx eax, word [rdi]
sub r15, 1
add rsi, 2
add rdi, 2
test ax, ax
jne 0x140001a78
xor eax, eax
mov word [rsi], ax
mov eax, 1
jmp 0x140001aee
xor r8d, r8d
lea rdx, [rsp + 0x4c0]
mov word [rsp + 0x4c0], r8w
jmp 0x140001a68
lea rcx, [rsp + 0x38]
lea rbx, [rsp + 0xc0]
mov rbp, r15
mov r14, rsi
mov qword [rsp + 0x38], 0
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov r9, qword [rsp + 0x38]
mov edx, 0x400
mov rcx, rbx
lea r8, str._lld
call fcn.140001820
movzx eax, word [rsi]
test ax, ax
je 0x140001ba7
nop dword [rax]
add r14, 2
sub rbp, 1
cmp word [r14], 0
jne 0x140001b98
movzx r13d, byte [rsp + 0xc0]
xor ecx, ecx
mov r9, rbx
add rbp, rbx
test r13b, r13b
je 0x140001c3a
nop dword [rax]
mov rax, rbp
mov rbx, r14
sub rax, r9
test cx, cx
je 0x140001bde
nop
add rbx, 2
sub rax, 1
cmp word [rbx], 0
jne 0x140001bd0
mov qword [rsp + 0x20], r9
test rax, rax
je 0x14000a130
mov rcx, rbx
call sub.msvcrt.dll_wcslen
mov rdx, qword [rsp + 0x28]
mov r8d, 2
mov byte [rsp + 0x40], r13b
lea rcx, [rbx + rax*2]
mov byte [rsp + 0x41], 0
call sub.msvcrt.dll_mbstowcs
mov r9, qword [rsp + 0x20]
movzx r13d, byte [r9 + 1]
add r9, 1
test r13b, r13b
je 0x140001c37
movzx ecx, word [r14]
jmp 0x140001bc0
mov rdx, rsi
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
movzx eax, word [rsi]
test ax, ax
je 0x140001c4e
nop
add rsi, 2
sub r15, 1
cmp word [rsi], 0
jne 0x140001c40
xor edx, edx
jmp 0x140001a68
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [rsp + 0x28]
mov rbp, r15
mov r14, rsi
mov r9d, eax
lea r8, [0x14000c0fa]
mov edx, pe_nt_image_headers64
call fcn.140001820
movzx eax, word [rsi]
test ax, ax
je 0x140001c97
nop dword [rax]
add r14, 2
sub rbp, 1
cmp word [r14], 0
jne 0x140001c88
mov rdx, qword [rsp + 0x28]
movzx r13d, byte [rsp + 0x40]
xor ecx, ecx
mov r12, rdx
add rbp, rdx
lea rdx, [rsp + 0xc0]
mov qword [rsp + 0x20], rdx
test r13b, r13b
je 0x140001c3a
mov rax, rbp
mov rbx, r14
sub rax, r12
test cx, cx
je 0x140001cde
nop
add rbx, 2
sub rax, 1
cmp word [rbx], 0
jne 0x140001cd0
test rax, rax
je 0x14000a130
mov rcx, rbx
add r12, 1
call sub.msvcrt.dll_wcslen
mov rdx, qword [rsp + 0x20]
mov r8d, 2
mov byte [rsp + 0xc0], r13b
lea rcx, [rbx + rax*2]
mov byte [rsp + 0xc1], 0
call sub.msvcrt.dll_mbstowcs
movzx r13d, byte [r12]
test r13b, r13b
je 0x140001c37
movzx ecx, word [r14]
jmp 0x140001cc0
mov rax, qword [sym.imp.msvcrt.dll___wargv]
cmp word [rsi], 0
mov rdx, r15
mov rax, qword [rax]
mov rax, qword [rax]
mov rcx, qword [rax]
mov rax, rsi
je 0x140001d5e
nop word [rax + rax]
add rax, 2
sub rdx, 1
cmp word [rax], 0
jne 0x140001d50
movzx r8d, word [rcx]
test r8w, r8w
je 0x140001d93
test rdx, rdx
jne 0x140001d79
jmp 0x140001da0
test rdx, rdx
je 0x14000a130
add rcx, 2
mov word [rax], r8w
add rax, 2
sub rdx, 1
movzx r8d, word [rcx]
test r8w, r8w
jne 0x140001d70
xor edx, edx
mov word [rax], dx
movzx eax, word [rsi]
jmp 0x140001c3a
jmp 0x14000a130
call sub.msvcrt.dll_abort
nop