Function at 0x140027a70
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x140300040]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rcx
xor esi, esi
mov dword [rsp + 0x20], esi
xor edx, edx
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
test rax, rax
jne 0x140027d63
mov qword [rsp + 0x40], rsi
call fcn.140019590
mov rcx, rax
test rax, rax
je 0x140027da7
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140038ca6.0]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x40], rbx
mov r13d, 1
mov ecx, r13d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 0x104
or eax, ecx
jge 0x140027b18
mov edx, 0x104
lea rcx, [rsp + 0x40]
call fcn.140018ea0
mov rbx, qword [rsp + 0x40]
mov edx, 0x104
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1401fe5d0
test eax, eax
js 0x140027d9c
cmp eax, dword [rbx - 0xc]
jg 0x140027d9c
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], si
mov qword [rsp + 0x28], rsi
lea r14, [rbx - 0x18]
mov rcx, qword [r14]
test rcx, rcx
je 0x140027b72
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x140038ca6.0]
mov rcx, rax
test rax, rax
jne 0x140027b96
call fcn.140019590
mov rdx, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x20]
mov rcx, rdx
call qword [case.0x140038ca6.0]
mov rcx, rax
test rax, rax
je 0x140027db2
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x140038ca6.0]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], r13d
lea rcx, [0x140267514]
mov rbp, 0xffffffffffffffff
mov rsi, rbp
inc rsi
cmp word [rcx + rsi*2], 0
jne 0x140027bc2
movsxd r12, dword [rbx - 0x10]
lea r15d, [r12 + rsi]
test r15d, r15d
js 0x140027d91
mov ecx, r13d
sub ecx, dword [rax + 0x10]
mov eax, dword [rax + 0xc]
sub eax, r15d
or eax, ecx
jge 0x140027bff
mov edx, r15d
lea rcx, [rsp + 0x28]
call fcn.140018ea0
mov rdi, qword [rsp + 0x28]
add r12, r12
je 0x140027c29
test rdi, rdi
jne 0x140027c1b
call fcn.1401fed34
mov dword [rax], 0x16
call fcn.1401feb94
jmp 0x140027c29
mov r8, r12
mov rdx, rbx
mov rcx, rdi
call fcn.14022e460
movsxd r8, esi
add r8, r8
lea rcx, [r12 + rdi]
je 0x140027c58
test rcx, rcx
jne 0x140027c4c
call fcn.1401fed34
mov dword [rax], 0x16
call fcn.1401feb94
jmp 0x140027c58
lea rdx, [0x140267514]
call fcn.14022e460
cmp r15d, dword [rdi - 0xc]
jg 0x140027d91
mov dword [rdi - 0x10], r15d
movsxd rax, r15d
xor ecx, ecx
mov word [rdi + rax*2], cx
mov r8, qword [rsp + 0x30]
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x38]
call fcn.1400179b0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
cmp rcx, r14
je 0x140027ce1
cmp dword [r14 + 0x10], 0
jl 0x140027cd2
mov rax, qword [r14]
cmp qword [rcx], rax
jne 0x140027cd2
call fcn.140019180
mov rbx, rax
mov ecx, ebp
lock xadd dword [r14 + 0x10], ecx
sub ecx, 1
jg 0x140027cc7
mov rcx, qword [r14]
mov r8, qword [rcx]
mov rdx, r14
mov rax, qword [r8 + 8]
call qword [case.0x140038ca6.0]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x40], rax
jmp 0x140027ce1
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x40]
call fcn.140018f50
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140027d06
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
and r13d, 0xfffffffe
mov dword [rsp + 0x20], r13d
mov rdx, qword [rsp + 0x28]
add rdx, 0xffffffffffffffe8
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140027d34
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
mov rbx, qword [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, rax
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], ebp
sub ebp, 1
jg 0x140027d63
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
mov rax, rdi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1401f74b0
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov ecx, 0x80070057
call fcn.140019300
nop
mov ecx, 0x80070057
call fcn.140019300
nop
mov ecx, 0x80004005
call fcn.140019300
nop
mov ecx, 0x80004005
call fcn.140019300
int3