Function at 0x18002bac0
Capabilities:
Get common file path
Get user security identifier

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x20], r9
mov dword [rax + 0x10], edx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x448]
sub rsp, 0x510
movaps xmmword [rax - 0x48], xmm6
lea ebx, [rdx + 0x12]
movaps xmmword [rax - 0x58], xmm7
mov r14, r9
movaps xmmword [rax - 0x68], xmm8
mov eax, edx
mov dword [rsp + 0x60], ebx
cmp edx, ebx
jae case.0x18002c1de.7
movzx edi, byte [rbp + 0x458]
lea rdx, [0x180000000]
movzx esi, word [rbp + 0x458]
xor ebx, ebx
movss xmm8, dword [0x180070358]
movabs r8, 0x65007600690072
mov r12d, dword [rbp + 0x458]
movabs r11, 0x75005100740065
movss xmm6, dword [rbp + 0x458]
mov r15, qword [rbp - 0x50]
lea r9d, [rbx + 0x70]
movss xmm7, dword [rbp + 0x458]
lea r10d, [rbx + 0x47]
movzx r13d, byte [rbp + 0x458]
mov ecx, dword [rsp + 0x60]
mov dword [rsp + 0x68], edi
mov dword [rsp + 0x6c], esi
nop dword [rax]
nop word [rax + rax]
add eax, 0xffffff5f
cmp eax, 0x33
ja case.default.0x18002bba0
movzx eax, byte [rdx + rax + 0x2c574]
mov ecx, dword [rdx + rax*4 + 0x2c528]
add rcx, rdx
jmp rcx
mov rcx, qword [rbp - 8]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x70], ebx
call qword [sym.imp.dbghelp.dll_SymInitialize]
mov ecx, 0x202
lea rdx, [rbp + 0x240]
mov dword [rbp - 0x2c], eax
call qword [rbp + 0x78]
test eax, eax
je 0x18002bfce
mov esi, reloc.SHELL32.dll_SHSetFolderPathA
cmp esi, 0x63084
ja 0x18002bd76
je 0x18002bd54
cmp esi, 0x2c0bb
ja 0x18002bcaf
je 0x18002bc87
cmp esi, 0xe7
je 0x18002bc74
cmp esi, 0xb0dc
je 0x18002bc61
cmp esi, 0x160d1
je 0x18002bc42
cmp esi, 0x210c6
jne 0x18002bfbc
mov r8d, 3
mov word [rbp - 0x64], bx
lea rdx, [0x18006fed0]
lea rcx, [rbp - 0x78]
call fcn.18004bddc
mov dword [rbp - 0x5e], 0x5c0064
jmp 0x18002bfbc
mov r8d, 2
mov word [rbp - 0x68], bx
lea rdx, [0x18006ff32]
lea rcx, [rbp - 0x68]
call fcn.18004be24
jmp 0x18002bfbc
mov dword [rbp - 0x70], 0x25005f
mov dword [rbp - 0x6c], 0x320030
jmp 0x18002bfbc
mov dword [rbp - 0x78], 0x300025
mov dword [rbp - 0x74], 0x640034
jmp 0x18002bfbc
mov r8d, 1
mov word [rbp - 0x5a], bx
lea rdx, [0x18006fd42]
lea rcx, [rbp - 0x78]
call fcn.18004bddc
mov eax, 0x73
mov word [rbp - 0x58], ax
jmp 0x18002bfbc
cmp esi, 0x370b0
je 0x18002bd44
cmp esi, 0x420a5
je 0x18002bd21
cmp esi, 0x4d09a
je 0x18002bcee
cmp esi, 0x5808f
jne 0x18002bfbc
movabs rax, 0x5f003100380039
mov word [rbp + 0x32], bx
mov qword [rbp + 0x2a], rax
jmp 0x18002bfbc
mov r8d, 4
lea rdx, [0x18006fde6]
lea rcx, [rbp + 0x18]
call fcn.18004be24
movsd xmm0, qword [0x18006fe70]
movzx eax, word [0x18006fe78]
movsd qword [rbp + 0x20], xmm0
mov word [rbp + 0x28], ax
jmp 0x18002bfbc
mov r8d, 2
mov word [rbp + 0x14], bx
lea rdx, [0x18006fee2]
lea rcx, [rbp + 0x14]
call fcn.18004be24
mov word [rbp + 0x18], bx
jmp 0x18002bfbc
mov word [rbp - 0x56], bx
mov dword [rbp + 0x10], 0x340056
jmp 0x18002bfbc
mov r8d, 3
mov dword [rbp + 0x32], 0x56
lea rdx, [0x18006fd02]
lea rcx, [rbp + 0x34]
call fcn.18004be24
jmp 0x18002bfbc
cmp esi, 0x9a04d
ja 0x18002be32
je 0x18002be20
cmp esi, 0x6e079
je 0x18002be0f
cmp esi, 0x7906e
je 0x18002be03
cmp esi, 0x84063
je 0x18002bdf0
cmp esi, 0x8f058
jne 0x18002bfbc
xorps xmm1, xmm1
mov dword [rbp - 0x34], 0x2000000
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x100], xmm0
mov qword [rbp + 0x120], rax
mov r12d, 1
movups xmmword [rbp + 0x110], xmm0
movups xmmword [rbp + 0xd0], xmm1
movups xmmword [rbp + 0xe0], xmm1
movups xmmword [rbp + 0xf0], xmm1
jmp 0x18002bfbc
xorps xmm0, xmm0
mov qword [rbp - 0x10], rbx
movups xmmword [rbp + 0xb0], xmm0
jmp 0x18002bfbc
mov dil, 1
mov dword [rsp + 0x68], edi
jmp 0x18002bfbc
mov dword [rbp + 0x3a], 0x66
mov byte [rsp + 0x64], 1
jmp 0x18002bfbc
mov dword [rbp + 0xd0], 0x30
mov dword [rbp - 0x38], ebx
jmp 0x18002bfbc
cmp esi, 0xa5042
je 0x18002bfae
cmp esi, 0xb0037
je 0x18002bf23
cmp esi, 0xbb02c
je 0x18002be8c
cmp esi, 0xc6021
jne 0x18002bfbc
mov rax, qword [rbp - 0x40]
lea r11, [rsp + 0x510]
mov rbx, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
test dil, dil
je 0x18002bef4
mov edi, 0x37
mov eax, edi
sub eax, 0x36
je 0x18002bed2
cmp eax, 1
jne 0x18002bee9
mov rcx, qword [rbp - 0x48]
lea rax, [rbp + 0x70]
lea r9, [rbp + 0x68]
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0xb0]
mov edx, r12d
call sub.ADVAPI32.dll_LsaLookupNames
mov rcx, qword [rbp + 0x68]
test rcx, rcx
je 0x18002bee9
call sub.ADVAPI32.dll_LsaFreeMemory
jmp 0x18002bee9
mov rcx, qword [rbp + 0x70]
test rcx, rcx
je 0x18002bee0
call sub.ADVAPI32.dll_LsaFreeMemory
mov rcx, qword [rbp - 0x48]
call sub.ADVAPI32.dll_LsaClose
dec edi
cmp edi, 0x35
ja 0x18002be96
mov edi, dword [rsp + 0x68]
cmp dword [rbp - 0x30], 0
mov ecx, ebx
movzx eax, byte [rsp + 0x64]
cmovne ecx, eax
mov byte [rsp + 0x64], cl
cmp cl, 0
je 0x18002bf1a
xor r8d, r8d
lea rdx, [rbp - 0x10]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_ObjectCloseAuditAlarmW]
mov byte [rbp - 0x40], 0
jmp 0x18002bfbc
mov r8d, dword [rbp - 0x38]
lea r9, [rbp - 0x48]
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0xb0]
call sub.ADVAPI32.dll_LsaOpenPolicy
cmp qword [rbp - 0x48], 0
lea rax, [rbp + 0xa8]
mov qword [rsp + 0x50], rax
lea r9, [rbp + 0x10]
lea rax, [rbp + 0xa4]
movzx edi, dil
mov qword [rsp + 0x48], rax
lea r8, [rbp - 0x78]
cmove edi, ebx
lea rax, [rbp + 0xa0]
mov qword [rsp + 0x40], rax
lea rdx, [rbp - 0x10]
lea rax, [rbp + 0xc0]
mov dword [rsp + 0x38], ebx
mov qword [rsp + 0x30], rax
xor ecx, ecx
mov eax, dword [rbp - 0x34]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x100]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x68], edi
call qword [sym.imp.ADVAPI32.dll_AccessCheckAndAuditAlarmW]
mov dword [rbp - 0x30], eax
jmp 0x18002bfbc
xorps xmm0, xmm0
mov qword [rbp - 0x48], rbx
movups xmmword [rbp + 0xc0], xmm0
add esi, 0xaff5
cmp esi, 0xd0f2f
jbe 0x18002bbd4
mov r9d, 0x70
lea rdx, [0x180000000]
movabs r8, 0x65007600690072
movabs r11, 0x75005100740065
lea r10d, [r9 - 0x29]
jmp case.0x18002bba0.179
mov qword [rbp + 0x52], r8
jmp case.0x18002bba0.179
mov qword [rbp + 0x80], rbx
jmp case.0x18002bba0.179
mov word [rbp - 0x7f], r9w
mov dword [rbp + 0x40], 0x47
jmp case.0x18002bba0.179
movzx eax, byte [rsp + 0x65]
mov ecx, ebx
cmp qword [rbp + 8], 0
cmovne ecx, eax
mov byte [rsp + 0x65], cl
jmp case.0x18002bba0.179
mov r8d, 2
lea rdx, [0x18006ff48]
lea rcx, [rsp + 0x78]
call fcn.18004c270
mov eax, 0x53
lea rdx, [0x18006fc84]
mov word [rsp + 0x79], ax
lea rcx, [rsp + 0x78]
movzx eax, word [0x18006ff4c]
mov r8d, 2
mov word [rsp + 0x7a], ax
movzx eax, byte [0x18006ff4e]
mov byte [rsp + 0x7c], al
call fcn.18004c030
jmp 0x18002bfce
cmp dword [rbp - 0x28], 0
mov esi, ebx
movzx eax, byte [rsp + 0x67]
cmove esi, eax
cmp byte [rsp + 0x66], 0
mov byte [rsp + 0x67], sil
je 0x18002c102
mov rbx, qword [rbp - 8]
mov edi, 0xf2
nop dword [rax]
mov eax, edi
sub eax, 0xf2
je 0x18002c0dd
sub eax, 0xe
je 0x18002c0ce
cmp eax, 0xe
jne 0x18002c0f5
mov rcx, rbx
call qword [sym.imp.dbghelp.dll_SymCleanup]
jmp 0x18002c0f5
lea rdx, [rbp - 0x78]
mov rcx, rbx
call qword [sym.imp.dbghelp.dll_SymGetLinePrev64]
jmp 0x18002c0f5
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x78], xmm0
mov dword [rbp - 0x78], 0x28
movups xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], rax
add edi, 0xe
cmp edi, 0x11c
jb 0x18002c0b0
xor ebx, ebx
test sil, sil
je 0x18002bfce
mov r8d, dword [rsp + 0x70]
lea r9, [rbp + 0x130]
mov rdx, qword [rbp]
mov ecx, dword [rsp + 0x74]
call qword [sym.imp.SHELL32.dll_SHSetFolderPathA]
jmp 0x18002bfce
xor r9d, r9d
mov dword [rsp + 0x74], 0x36
lea r8, [rsp + 0x78]
mov qword [rbp - 8], 0xffffffffffffffff
lea rdx, str.ws2_32.dll
lea ecx, [r9 + 0x20]
call fcn.18002f840
mov qword [rbp + 0x78], rax
mov qword [rbp], rbx
jmp 0x18002bfce
movzx eax, byte [rsp + 0x66]
mov ecx, ebx
cmp dword [rbp - 0x2c], 0
mov r9d, dword [rsp + 0x70]
mov r8, qword [rbp]
cmovne ecx, eax
mov edx, dword [rsp + 0x74]
lea rax, [rbp + 0x130]
mov byte [rsp + 0x66], cl
mov rcx, qword [rbp + 0x80]
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
xor r9d, r9d
xor r8d, r8d
mov rcx, r14
mov dword [rbp - 0x28], eax
lea edx, [r9 + 0xd]
call fcn.180039280
test al, al
jne 0x18002c3c2
mov r14d, ebx
nop word [rax + rax]
cmp r14d, 7
ja case.default.0x18002c1de
lea rdx, [0x180000000]
mov eax, r14d
mov ecx, dword [rdx + rax*4 + 0x2c5a8]
add rcx, rdx
jmp rcx
xor r9d, r9d
movsx eax, si
xor edx, edx
lea rcx, [rbp - 0x78]
mov qword [rsp + 0x28], rcx
movaps xmm6, xmm8
mov dword [rsp + 0x20], eax
lea r8d, [r9 + 4]
lea rcx, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov r15, rax
movaps xmm7, xmm8
jmp case.default.0x18002c1de
mov eax, dword [0x18006ff50]
mov dword [rbp - 0x78], eax
movzx eax, word [0x18006ff54]
mov word [rbp - 0x74], ax
jmp case.default.0x18002c1de
mov qword [rbp + 0x88], rbx
mov r13b, 1
jmp case.default.0x18002c1de
mov eax, dword [0x18006ff58]
lea rdx, [0x18006ff60]
mov dword [rbp - 0x6a], eax
lea rcx, [rbp - 0x78]
movzx eax, word [0x18006ff5c]
mov r8d, 1
mov word [rbp - 0x66], ax
call fcn.18004bddc
jmp case.default.0x18002c1de
mov r8d, 3
lea rdx, [0x18006ff64]
lea rcx, [rbp - 0x74]
call fcn.18004be24
mov eax, dword [0x18006ff6c]
mov dword [rbp - 0x70], eax
mov eax, 0x52
mov word [rbp - 0x6c], ax
jmp case.default.0x18002c1de
mov esi, 0x100
mov dword [rbp - 0x1c], 0x3e8
mov dword [rsp + 0x6c], esi
mov dword [rbp - 0x20], 0x2f8
mov dword [rbp - 0x24], 0x1e
jmp case.default.0x18002c1de
mov r9d, dword [rbp - 0x24]
mov ecx, ebx
mov r8d, dword [rbp - 0x20]
test r15, r15
mov edx, dword [rbp - 0x1c]
movzx eax, r13b
cmovne ecx, eax
movss dword [rsp + 0x28], xmm7
movzx r13d, cl
movss dword [rsp + 0x20], xmm6
mov rcx, qword [rbp + 0x88]
call qword [sym.imp.GDI32.dll_AngleArc]
test r13b, r13b
je 0x18002c3a2
movsx rax, si
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0xf001f
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rsi, rax
test rax, rax
jne 0x18002c32a
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r13b, r13b
jmp 0x18002c39e
mov edi, 0x26
nop
cmp edi, 0x26
je 0x18002c389
cmp edi, 0xb9
je 0x18002c350
cmp edi, 0x14c
jne 0x18002c390
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18002c390
lea rax, [rbp - 0x18]
mov qword [rbp + 0x90], rbx
lea r9, [rbp + 0x90]
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x98]
mov dword [rbp - 0x18], ebx
mov edx, 4
mov rcx, rsi
call sub.dbghelp.dll_MiniDumpReadDumpStream
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
jmp 0x18002c390
mov qword [rbp + 0x98], rbx
add edi, 0x93
cmp edi, 0x1df
jb 0x18002c330
mov esi, dword [rsp + 0x6c]
mov byte [rbp - 0x40], 0
inc r14d
lea eax, [r14 + 0xdf]
cmp eax, 0xe7
jb 0x18002c1c0
mov r14, qword [rbp + 0x468]
cmp byte [rsp + 0x65], 0
je 0x18002bfce
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18002bfce
mov r8d, 4
mov qword [rbp + 0x42], r11
lea rdx, [0x18006ffba]
mov word [rbp + 0x4a], bx
lea rcx, [rbp + 0x40]
call fcn.18004bddc
jmp 0x18002bfce
xor edx, edx
lea r8, [rbp + 0x40]
lea ecx, [rdx + 0x7b]
call qword [sym.imp.KERNEL32.dll_OpenEventW]
mov qword [rbp + 8], rax
jmp 0x18002bfce
mov esi, 1
cmp rsi, qword [r14 + 8]
jae case.0x18002bba0.179
mov edi, 0x20
nop dword [rax + rax]
mov rax, qword [r14]
lea rdx, [rbp - 0x50]
mov r8, qword [r14 + 0x18]
mov r9d, 0xbb
mov rcx, qword [rdi + rax + 0x10]
mov qword [rbp - 0x50], rcx
xor ecx, ecx
call fcn.18000f460
mov rax, qword [r14]
lea rdx, [rbp - 0x50]
mov r8, qword [r14 + 0x20]
mov r9d, 0xbb
mov rcx, qword [rdi + rax + 0x18]
mov qword [rbp - 0x50], rcx
xor ecx, ecx
call fcn.18000f460
inc rsi
lea rdi, [rdi + 0x20]
cmp rsi, qword [r14 + 8]
jb 0x18002c430
jmp 0x18002bfce
mov byte [rsp + 0x67], 1
mov byte [rsp + 0x65], 1
jmp case.0x18002bba0.179
mov r8d, 5
mov word [rbp + 0x5a], bx
lea rdx, [0x18006ffee]
lea rcx, [rbp + 0x5a]
call fcn.18004be24
mov word [rbp + 0x64], bx
jmp 0x18002bfce
mov byte [rsp + 0x66], 1
jmp case.0x18002bba0.179
lea rcx, [rsp + 0x78]
dec rcx
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x18002c4c2
mov eax, dword [0x18006fffc]
mov dword [rcx], eax
mov ecx, dword [rsp + 0x60]
mov eax, dword [rbp + 0x458]
inc eax
mov dword [rbp + 0x458], eax
cmp eax, ecx
jae case.0x18002c1de.7
mov edi, dword [rsp + 0x68]
mov esi, dword [rsp + 0x6c]
jmp 0x18002bb80
xor r9d, r9d
mov qword [rsp + 0x28], rbx
xor r8d, r8d
mov qword [rsp + 0x20], rbx
xor ecx, ecx
lea edx, [r9 + 0x2b]
call fcn.180029570
mov byte [rbp - 0x40], al
jmp case.0x18002c1de.7
mov rax, rbx
jmp 0x18002be62