Function at 0x14000cd50
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3a8]
sub rsp, 0x4a8
mov r14, rcx
mov dword [rcx], 0x100
add rcx, 0x18
mov qword [rbp + 0x400], rcx
xor ebx, ebx
mov dword [rcx], ebx
mov qword [rcx + 8], rbx
mov qword [rcx + 0x10], rbx
xorps xmm0, xmm0
movups xmmword [rcx + 0x18], xmm0
movups xmmword [rcx + 0x28], xmm0
movups xmmword [rcx + 0x38], xmm0
mov qword [rcx + 0x48], rbx
lea edx, [rbx + 2]
call fcn.1400d8980
nop
lea r13, [r14 + 0x68]
mov qword [rbp + 0x408], r13
mov qword [r13], rbx
mov qword [r13 + 8], rbx
lea ecx, [rbx + 0x28]
call fcn.1400ff088
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [r13], rax
lea r12, [r14 + 0x78]
mov qword [rsp + 0x70], r12
mov qword [r12], rbx
mov qword [r12 + 8], rbx
lea ecx, [rbx + 0x30]
call fcn.1400ff088
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [r12], rax
mov eax, dword [r14]
mov dword [rsp + 0x20], eax
mov edx, InitCommonControls
mov ecx, edx
lea r9d, [rbx + 1]
lea r8d, [rbx + 0x20]
call qword [sym.imp.COMCTL32.dll_ImageList_Create]
mov qword [r14 + 8], rax
xor edx, edx
mov r8d, 0x410
lea rcx, [rbp - 0x70]
call fcn.14012ce40
mov edx, 0x208
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call fcn.140002e00
mov rcx, rax
test rax, rax
je 0x14000d1cb
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x400], rax
lea r8, [rbp - 0x70]
lea rdx, str._s_svchost.exe
lea rcx, [rbp + 0x400]
call fcn.140005d70
mov rbx, qword [rbp + 0x400]
mov rdx, rbx
call fcn.14000ccb0
mov rdi, rax
mov qword [rbp + 0x408], rax
lea rdx, [rbx - 0x18]
mov rsi, 0xffffffffffffffff
mov ecx, esi
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x14000cec2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r8, rdi
mov edx, esi
mov rcx, qword [r14 + 8]
call qword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
mov dword [r14 + 0x10], eax
call fcn.140002e00
mov rcx, rax
test rax, rax
je 0x14000d1d6
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x3f8], rax
lea rdx, [0x1401467a0]
cmp rdx, 0x10000
jae 0x14000cf18
movzx edx, dx
lea rcx, [rbp + 0x3f8]
call fcn.1400058a0
jmp 0x14000cf38
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x14000cf20
lea rcx, [rbp + 0x3f8]
call fcn.140005a90
nop
mov r15, qword [r12]
mov r8, qword [r15 + 8]
mov qword [rsp + 0x30], r8
xor r11d, r11d
mov dword [rsp + 0x38], r11d
mov r10, r15
mov rax, qword [rbp + 0x3f8]
cmp byte [r8 + 0x19], r11b
jne 0x14000cfc3
nop dword [rax]
mov qword [rsp + 0x30], r8
test rax, rax
je 0x14000d1e1
mov rcx, qword [r8 + 0x20]
mov r9, rax
sub r9, rcx
nop dword [rax + rax]
movzx edx, word [rcx]
cmp dx, word [rcx + r9]
jne 0x14000cf98
add rcx, 2
test dx, dx
jne 0x14000cf80
mov ecx, r11d
jmp 0x14000cf9d
sbb ecx, ecx
or ecx, 1
shr ecx, 0x1f
test cl, cl
je 0x14000cfaf
mov dword [rsp + 0x38], r11d
mov r8, qword [r8 + 0x10]
jmp 0x14000cfbd
mov dword [rsp + 0x38], 1
mov r10, r8
mov r8, qword [r8]
cmp byte [r8 + 0x19], r11b
je 0x14000cf60
cmp byte [r10 + 0x19], r11b
jne 0x14000d00b
mov rdx, qword [r10 + 0x20]
test rdx, rdx
je 0x14000d1e1
sub rdx, rax
nop dword [rax]
movzx ecx, word [rax]
cmp cx, word [rax + rdx]
jne 0x14000cff7
add rax, 2
test cx, cx
jne 0x14000cfe0
mov eax, r11d
jmp 0x14000cffc
sbb eax, eax
or eax, 1
shr eax, 0x1f
test al, al
jne 0x14000d00b
xor r15d, r15d
jmp 0x14000d0a7
movabs rax, 0x555555555555555
cmp qword [r12 + 8], rax
je 0x14000d1ec
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], r11
mov qword [rsp + 0x68], r11
mov ecx, 0x30
call fcn.1400ff088
mov rdi, rax
mov qword [rsp + 0x68], rax
lea rbx, [rax + 0x20]
mov qword [rsp + 0x70], rbx
mov qword [rbp - 0x80], rbx
mov rcx, qword [rbp + 0x3f8]
add rcx, 0xffffffffffffffe8
call fcn.140041570
add rax, 0x18
mov qword [rbx], rax
mov dword [rbx + 8], 0
mov qword [rdi], r15
mov qword [rdi + 8], r15
mov qword [rdi + 0x10], r15
mov word [rdi + 0x18], 0
xor r15d, r15d
mov qword [rsp + 0x68], r15
movups xmm0, xmmword [rsp + 0x30]
movaps xmmword [rbp - 0x80], xmm0
mov r8, rdi
lea rdx, [rbp - 0x80]
mov rcx, r12
call fcn.140044d70
mov r10, rax
mov rdi, qword [rbp + 0x408]
mov ecx, dword [r14 + 0x10]
mov dword [r10 + 0x28], ecx
mov rdx, qword [rbp + 0x3f8]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x14000d0cd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [r13]
mov rax, qword [rbx + 8]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], r15d
mov rcx, rbx
cmp byte [rax + 0x19], 0
jne 0x14000d119
mov edx, dword [r14 + 0x10]
nop dword [rax]
mov qword [rsp + 0x30], rax
cmp dword [rax + 0x1c], edx
jge 0x14000d105
mov dword [rsp + 0x38], r15d
mov rax, qword [rax + 0x10]
jmp 0x14000d113
mov dword [rsp + 0x38], 1
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x14000d0f0
cmp byte [rcx + 0x19], 0
jne 0x14000d128
mov eax, dword [rcx + 0x1c]
cmp dword [r14 + 0x10], eax
jge 0x14000d198
movabs rax, 0x666666666666666
cmp qword [r13 + 8], rax
je 0x14000d1c5
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x58], r15
mov ecx, 0x28
call fcn.1400ff088
mov qword [rsp + 0x58], rax
mov ecx, dword [r14 + 0x10]
mov dword [rax + 0x1c], ecx
mov dword [rax + 0x20], r15d
mov qword [rax], rbx
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbx
mov word [rax + 0x18], 0
mov qword [rsp + 0x58], r15
movups xmm0, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0x50], xmm0
mov r8, rax
lea rdx, [rsp + 0x50]
mov rcx, r13
call fcn.140044d70
mov rcx, rax
mov dword [rcx + 0x20], 1
test rdi, rdi
je 0x14000d1ae
mov rcx, rdi
call qword [sym.imp.USER32.dll_DestroyIcon]
nop
mov rax, r14
add rsp, 0x4a8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140006f40
nop
mov ecx, 0x80004005
call fcn.140002b00
int3
mov ecx, 0x80004005
call fcn.140002b00
nop
mov ecx, 0x80004005
call fcn.140002b00
int3
call fcn.140006f40
int3