Function at 0x140139440
Capabilities:
Get common file path

Disassembly:
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x390]
sub rsp, 0x490
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x4b0], rbx
mov rax, qword [0x1403eaa10]
xor rax, rsp
mov qword [rbp + 0x380], rax
mov rsi, r8
mov rdi, rdx
xor bl, bl
mov edx, 0x104
lea rcx, [rbp + 0x170]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea r8, [0x1403304c8]
mov edx, 0x104
lea rcx, [rbp + 0x170]
call fcn.14029a500
cmp dword [rdi + 0xc], 0
je 0x140139680
mov edx, 0x5c
mov rcx, qword [rdi]
call fcn.14029aea8
test rax, rax
je 0x140139680
sub rax, qword [rdi]
sar rax, 1
test eax, eax
js 0x140139680
xor r8d, r8d
lea rdx, str.system32_
mov rcx, rdi
call fcn.1401eb700
test al, al
je 0x140139562
mov edx, 0x104
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x140139704
mov r8d, 8
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.1401eaef0
nop
mov r8, rax
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x30]
call fcn.1401e7ba0
nop
mov rdx, rax
mov rcx, rsi
call fcn.1401e7440
nop
cmp dword [rsp + 0x38], 0
jle 0x140139548
mov rcx, qword [rsp + 0x30]
call fcn.140298600
nop
cmp dword [rsp + 0x48], 0
jle 0x140139702
mov rcx, qword [rsp + 0x40]
call fcn.140298600
jmp 0x140139702
xor r8d, r8d
lea rdx, str.SystemRoot_
mov rcx, rdi
call fcn.1401eb700
test al, al
je 0x1401395ef
mov edx, 0x104
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x140139704
mov r8d, 0xb
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.1401eaef0
nop
mov r8, rax
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.1401e7ba0
nop
mov rdx, rax
mov rcx, rsi
call fcn.1401e7440
nop
cmp dword [rsp + 0x48], 0
jle 0x1401395d5
mov rcx, qword [rsp + 0x40]
call fcn.140298600
nop
cmp dword [rsp + 0x38], 0
jle 0x140139702
mov rcx, qword [rsp + 0x30]
call fcn.140298600
jmp 0x140139702
xor r8d, r8d
lea rdx, str.WINDOWS_
mov rcx, rdi
call fcn.1401eb700
test al, al
je 0x140139704
mov edx, 0x104
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x140139704
mov r8d, 8
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.1401eaef0
nop
mov r8, rax
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.1401e7ba0
nop
mov rdx, rax
mov rcx, rsi
call fcn.1401e7440
nop
cmp dword [rsp + 0x48], 0
jle 0x140139666
mov rcx, qword [rsp + 0x40]
call fcn.140298600
nop
cmp dword [rsp + 0x38], 0
jle 0x140139702
mov rcx, qword [rsp + 0x30]
call fcn.140298600
jmp 0x140139702
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x104
xor r8d, r8d
mov rdx, qword [rdi]
lea rcx, [rbp + 0x170]
call qword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
je 0x140139704
lea rax, [rsp + 0x60]
or rbx, 0xffffffffffffffff
nop word [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401396c0
test ebx, ebx
jle 0x1401396f2
mov edx, ebx
mov rcx, rsi
call fcn.1401e9030
movsxd r9, ebx
mov eax, dword [rsi + 8]
inc eax
movsxd rdx, eax
lea r8, [rsp + 0x60]
mov rcx, qword [rsi]
call fcn.14029b4d8
jmp 0x1401396f8
cmp dword [rsi + 0xc], 0
jle 0x140139702
mov edx, ebx
mov rcx, rsi
call fcn.1401ea290
mov bl, 1
movzx eax, bl
mov rcx, qword [rbp + 0x380]
xor rcx, rsp
call fcn.140297ff0
mov rbx, qword [rsp + 0x4b0]
add rsp, 0x490
pop rdi
pop rsi
pop rbp
ret