Function at 0x1400030d0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x208]
sub rsp, 0x308
mov edx, pe_nt_image_headers64
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
movzx r13d, word [0x140023642]
mov edi, 0x15
mov r10d, 0x61
mov word [rsp + 0x5c], di
mov word [rbp + 0x258], r10w
mov word [rsp + 0x20], r10w
lea eax, [rdi + 0x67]
mov word [rbp + 0x268], ax
lea r11d, [rdi + 0x65]
mov word [rsp + 0x22], ax
lea ebx, [rdi + 0x34]
lea eax, [rdi + 0x66]
mov word [rsp + 0x24], r11w
mov word [rsp + 0x2e], ax
lea edx, [rdi + 0x52]
movzx eax, word [str.runas]
lea ecx, [rdi + 0x3c]
xor ax, di
mov word [rbp + 0x260], dx
mov word [rsp + 0x36], ax
lea r9d, [rdi + 0x4d]
movzx eax, word [0x140023622]
lea r8d, [rdi + 0x5f]
xor ax, di
mov word [rsp + 0x26], bx
mov word [rsp + 0x38], ax
movzx eax, word [0x140023624]
xor ax, di
mov word [rsp + 0x28], cx
mov word [rsp + 0x3a], ax
movzx eax, word [0x140023626]
xor ax, di
mov word [rsp + 0x2a], r11w
mov word [rsp + 0x3c], ax
movzx eax, word [0x140023628]
xor ax, di
mov word [rsp + 0x2c], r9w
mov word [rsp + 0x3e], ax
movzx eax, word [0x14002362a]
xor ax, di
mov word [rsp + 0x30], r11w
mov word [rsp + 0x40], ax
movzx eax, word [0x14002362c]
xor ax, di
mov word [rsp + 0x32], r8w
mov word [rsp + 0x42], ax
movzx eax, word [0x14002362e]
xor ax, di
mov word [rsp + 0x34], bx
mov word [rsp + 0x44], ax
movzx eax, word [0x140023630]
xor ax, di
mov word [rsp + 0x46], ax
movzx eax, word [0x140023632]
xor ax, di
mov word [rsp + 0x48], ax
movzx eax, word [0x140023634]
xor ax, di
mov word [rsp + 0x4a], ax
movzx eax, word [0x140023636]
xor ax, di
mov word [rsp + 0x4c], ax
movzx eax, word [0x140023638]
xor ax, di
mov word [rsp + 0x4e], ax
movzx eax, word [0x14002363a]
xor ax, di
mov word [rsp + 0x50], ax
movzx eax, word [0x14002363c]
xor ax, di
mov word [rsp + 0x52], ax
movzx eax, word [0x14002363e]
xor ax, di
mov word [rsp + 0x54], ax
movzx eax, word [str.GameCenter.exe]
xor ax, di
mov word [rsp + 0x56], ax
xor r13w, di
mov word [rsp + 0x58], r13w
mov r13d, 0x49
movzx r12d, word [0x140023644]
movzx r15d, word [0x140023646]
xor r12w, di
movzx r14d, word [0x140023648]
xor r15w, di
movzx esi, word [0x14002364a]
xor r14w, di
movzx ebx, word [0x14002364e]
xor si, di
movzx edi, word [0x14002364c]
xor bx, 0x15
movzx r11d, word [0x140023650]
xor di, 0x15
movzx r10d, word [0x140023652]
xor r11w, 0x15
movzx r9d, word [0x140023654]
xor r10w, 0x15
movzx r8d, word [0x140023656]
xor r9w, 0x15
movzx edx, word [0x140023658]
xor r8w, 0x15
movzx ecx, word [0x14002365a]
xor dx, 0x15
movzx eax, word [0x14002365c]
xor cx, 0x15
mov word [rsp + 0x5a], r12w
xor ax, 0x15
mov r12d, 0x15
xor r13w, r12w
mov word [rsp + 0x5e], r13w
mov r13d, 0x46
xor r13w, r12w
mov word [rsp + 0x60], r13w
mov r13d, 0x7a
xor r13w, r12w
mov word [rsp + 0x62], r13w
mov r13d, 0x73
xor r13w, r12w
mov word [rsp + 0x64], r13w
mov r13d, 0x61
xor r13w, r12w
mov word [rsp + 0x66], r13w
mov r13d, 0x62
xor r13w, r12w
mov word [rsp + 0x68], r13w
mov r13d, 0x74
xor r13w, r12w
mov word [rsp + 0x6a], r13w
mov r13d, 0x67
xor r13w, r12w
mov word [rsp + 0x6c], r13w
mov r13d, 0x70
xor r13w, r12w
mov word [rsp + 0x6e], r13w
mov r13d, 0x51
xor r13w, r12w
mov word [rsp + 0x70], r13w
mov r13d, 0x7c
xor r13w, r12w
mov word [rsp + 0x72], r13w
mov r13d, 0x66
xor r13w, r12w
mov word [rsp + 0x74], r13w
movzx r13d, word [rbp + 0x258]
xor r13w, r12w
mov word [rsp + 0x76], r13w
movzx r13d, word [rbp + 0x260]
xor r13w, r12w
mov word [rsp + 0x78], r13w
movzx r13d, word [rbp + 0x268]
xor r13w, r12w
mov word [rsp + 0x7a], r13w
mov r13d, 0x77
xor r13w, r12w
mov word [rsp + 0x7c], r13w
mov r13d, 0x60
xor r13w, r12w
mov word [rsp + 0x7e], r13w
movzx r13d, word [rsp + 0x20]
xor r13w, r12w
mov word [rbp - 0x80], r13w
movzx r13d, word [rsp + 0x22]
xor r13w, r12w
mov word [rbp - 0x7e], r13w
movzx r13d, word [rsp + 0x24]
xor r13w, r12w
mov word [rbp - 0x7c], r13w
mov r13d, 0x7b
xor r13w, r12w
mov word [rbp - 0x7a], r13w
movzx r13d, word [rsp + 0x26]
xor r13w, r12w
mov word [rbp - 0x78], r13w
movzx r13d, word [rsp + 0x28]
xor r13w, r12w
mov word [rbp - 0x76], r13w
movzx r13d, word [rsp + 0x2a]
xor r13w, r12w
mov word [rbp - 0x74], r13w
movzx r13d, word [rsp + 0x2c]
xor r13w, r12w
mov word [rbp - 0x72], r13w
movzx r13d, word [rsp + 0x2e]
xor r13w, r12w
mov word [rbp - 0x70], r13w
mov r13d, 0x79
xor r13w, r12w
mov word [rbp - 0x6e], r13w
movzx r13d, word [rsp + 0x30]
xor r13w, r12w
mov word [rbp - 0x6c], r13w
movzx r13d, word [rsp + 0x32]
xor r13w, r12w
mov word [rbp - 0x6a], r13w
mov r13d, 0x71
xor r13w, r12w
mov word [rbp - 0x68], r13w
movzx r13d, word [rsp + 0x34]
xor r13w, r12w
mov word [rbp - 0x66], r13w
movzx r13d, r12w
xor r13w, r12w
mov word [rbp - 0x64], r13w
movzx r13d, word [rsp + 0x36]
xor r13w, r12w
mov word [rbp - 0x62], r13w
movzx r13d, word [rsp + 0x38]
xor r13w, r12w
mov word [rbp - 0x60], r13w
movzx r13d, word [rsp + 0x3a]
xor r13w, r12w
mov word [rbp - 0x5e], r13w
movzx r13d, word [rsp + 0x3c]
xor r13w, r12w
mov word [rbp - 0x5c], r13w
movzx r13d, word [rsp + 0x3e]
xor r13w, r12w
mov word [rbp - 0x5a], r13w
movzx r13d, word [rsp + 0x40]
xor r13w, r12w
mov word [rbp - 0x58], r13w
movzx r13d, word [rsp + 0x42]
xor r13w, r12w
mov word [rbp - 0x56], r13w
movzx r13d, word [rsp + 0x44]
xor r13w, r12w
mov word [rbp - 0x54], r13w
movzx r13d, word [rsp + 0x46]
xor r13w, r12w
mov word [rbp - 0x52], r13w
movzx r13d, word [rsp + 0x48]
xor r13w, r12w
mov word [rbp - 0x50], r13w
movzx r13d, word [rsp + 0x4a]
xor r13w, r12w
mov word [rbp - 0x4e], r13w
movzx r13d, word [rsp + 0x4c]
xor r13w, r12w
mov word [rbp - 0x4c], r13w
movzx r13d, word [rsp + 0x4e]
xor r13w, r12w
xorps xmm0, xmm0
mov word [rbp - 0x4a], r13w
xorps xmm1, xmm1
movzx r13d, word [rsp + 0x50]
xor r13w, r12w
mov word [rbp - 0x48], r13w
movzx r13d, word [rsp + 0x52]
xor r13w, r12w
mov word [rbp - 0x46], r13w
movzx r13d, word [rsp + 0x54]
xor r13w, r12w
mov word [rbp - 0x44], r13w
movzx r13d, word [rsp + 0x56]
xor r13w, r12w
mov word [rbp - 0x42], r13w
movzx r13d, word [rsp + 0x58]
xor r13w, r12w
movzx r12d, word [rsp + 0x5a]
mov word [rbp - 0x40], r13w
mov r13d, 0x15
xor ax, r13w
xor r8w, r13w
xor r12w, r13w
mov word [rbp - 0x26], ax
xor r15w, r13w
mov word [rbp - 0x2c], r8w
xor r14w, r13w
mov word [rbp - 0x3e], r12w
xor si, r13w
mov word [rbp - 0x3c], r15w
xor di, r13w
mov word [rbp - 0x3a], r14w
xor bx, r13w
mov word [rbp - 0x38], si
xor r11w, r13w
mov word [rbp - 0x36], di
xor r10w, r13w
mov word [rbp - 0x34], bx
xor r9w, r13w
mov word [rbp - 0x32], r11w
xor dx, r13w
mov word [rbp - 0x30], r10w
xor cx, r13w
mov word [rbp - 0x2e], r9w
xor eax, eax
mov word [rbp - 0x2a], dx
mov word [rbp - 0x24], ax
mov r8, 0xffffffffffffffff
lea rax, [rbp]
mov word [rbp - 0x28], cx
movups xmmword [rbp - 0x20], xmm0
movdqu xmmword [rbp - 0x10], xmm1
inc r8
cmp word [rax + r8*2], 0
jne 0x1400036d1
lea rdx, [rbp]
lea rcx, [rbp - 0x20]
call fcn.140001180
mov rbx, qword [rbp + 0x250]
lea r8, [rsp + 0x5e]
mov rcx, rbx
lea rdx, [rbp - 0x20]
call fcn.140002880
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x14000373d
mov rcx, qword [rbp - 0x20]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003738
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003754
call fcn.140005fc0
mov rax, rbx
add rsp, 0x308
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14000a93c
int3