Function at 0x1400049d0
Capabilities:
Get common file path

Disassembly:
push rdi
sub rsp, 0x2a0
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rsp + 0x2b8], rbx
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov rbx, rcx
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc120u.dll_Ordinal_296]
nop
lea rdx, str.NitroUpdateService
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc120u.dll_Ordinal_1498]
mov rax, qword [rsp + 0x30]
cmp dword [rax - 0x10], 0
je 0x140004cae
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc120u.dll_Ordinal_320]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.MSVCR120.dll__ftime64_s]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc120u.dll_Ordinal_296]
nop
movzx r11d, word [rsp + 0x78]
mov r8, qword [rsp + 0x70]
movabs rdi, 0x8888888888888889
mov rax, rdi
imul r8
lea r10, [r8 + rdx]
sar r10, 5
mov rcx, r10
shr rcx, 0x3f
add r10, rcx
imul ecx, r10d, 0x3c
mov r9d, r8d
sub r9d, ecx
mov rax, rdi
imul r10
add rdx, r10
sar rdx, 5
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0x3c
sub r10, rax
movabs rax, 0x48d159e26af37c05
imul r8
mov rcx, rdx
sar rcx, 0xa
mov rax, rcx
shr rax, 0x3f
add rcx, rax
movabs rax, 0x2aaaaaaaaaaaaaab
imul rcx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rax, [rdx + rdx*2]
shl rax, 3
sub rcx, rax
mov dword [rsp + 0x28], r11d
mov dword [rsp + 0x20], r9d
mov r9d, r10d
mov r8d, ecx
lea rdx, str._d:_d:_d:_d
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc120u.dll_Ordinal_4612]
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc120u.dll_Ordinal_296]
nop
lea rax, [rsp + 0x88]
mov qword [rsp + 0x80], rax
mov r8d, 3
mov rdx, rbx
lea rcx, [rsp + 0x80]
call fcn.140003df0
nop
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x30]
mov r8, qword [rsp + 0x40]
lea rdx, str._s_t_s_t_s_r_n
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc120u.dll_Ordinal_4612]
nop
lea rax, [rsp + 0x88]
mov rcx, qword [rsp + 0x80]
cmp rcx, rax
je 0x140004b82
call qword [sym.imp.MSVCR120.dll_free]
cmp qword [0x140017a70], 0
jne 0x140004c17
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x80]
call sub.MSVCR120.dll_memset
lea rdx, [rsp + 0x80]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x140004bd1
lea rdx, str.NitroUpdateService.slog
lea rcx, [rsp + 0x80]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
mov ecx, 0x28
call qword [sym.imp.mfc120u.dll_Ordinal_1484]
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140004c02
mov r8d, 0x3021
lea rdx, [rsp + 0x80]
mov rcx, rax
call qword [sym.imp.mfc120u.dll_Ordinal_486]
mov rcx, rax
jmp 0x140004c04
xor ecx, ecx
mov qword [0x140017a70], rcx
mov rax, qword [rcx]
xor edx, edx
lea r8d, [rdx + 2]
call qword [rax + 0x68]
lea rax, [rsp + 0x88]
mov qword [rsp + 0x80], rax
mov r8d, 3
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x80]
call fcn.140002e40
nop
mov rax, qword [rsp + 0x38]
mov rcx, qword [0x140017a70]
mov r9, qword [rcx]
mov r8d, dword [rax - 0x10]
mov rdx, qword [rsp + 0x80]
call qword [r9 + 0x88]
nop
lea rax, [rsp + 0x88]
mov rcx, qword [rsp + 0x80]
cmp rcx, rax
je 0x140004c7e
call qword [sym.imp.MSVCR120.dll_free]
mov rcx, qword [0x140017a70]
mov rax, qword [rcx]
call qword [rax + 0xa8]
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc120u.dll_Ordinal_1030]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc120u.dll_Ordinal_1030]
nop
call qword [sym.imp.mfc120u.dll_Ordinal_2315]
nop
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc120u.dll_Ordinal_1030]
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.14000cd50
mov rbx, qword [rsp + 0x2b8]
add rsp, 0x2a0
pop rdi
ret