Function at 0x140008c00
Capabilities:
Get common file path

Disassembly:
push r15
mov eax, 0x1108
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.140016dd0
sub rsp, rax
xor r9d, r9d
mov word [rcx], r9w
movzx eax, word [rdx]
mov rbx, rcx
mov rsi, r8
test ax, ax
je 0x140008c99
lea rcx, [rsp + 0x2f0]
lea rdi, [rdx + 2]
xor edx, edx
mov qword [rsp + 0x40], rcx
lea r12, str.TEMP
jmp 0x140008c63
mov word [rdx], ax
add rdx, 2
movzx eax, word [rdi]
add rdi, 2
test ax, ax
je 0x140008c99
cmp ax, 0x7b
je 0x140008cb0
cmp ax, 0x7d
je 0x140008cd0
test rdx, rdx
jne 0x140008c50
test rsi, rsi
je 0x140008ecd
xor ebp, ebp
mov word [rbx], ax
sub rsi, 1
add rbx, 2
mov word [rbx], bp
movzx eax, word [rdi]
add rdi, 2
test ax, ax
jne 0x140008c63
xor r11d, r11d
mov eax, 1
mov word [rbx], r11w
jmp 0x140008ecf
xor r8d, r8d
lea rdx, [rsp + 0x900]
mov word [rsp + 0x900], r8w
jmp 0x140008c57
xor ecx, ecx
lea r14, [rsp + 0x900]
mov word [rdx], cx
mov rdx, r12
mov rcx, r14
call sub.msvcrt.dll__wcsicmp
test eax, eax
je 0x140008ee8
lea rdx, [0x14001f32c]
mov rcx, r14
call sub.msvcrt.dll__wcsicmp
test eax, eax
je 0x140008f40
lea rdx, str.PROGRAM_BASE
mov rcx, r14
call sub.msvcrt.dll__wcsicmp
test eax, eax
je 0x140008ea8
lea rdx, [0x14001f374]
mov rcx, r14
call sub.msvcrt.dll__wcsicmp
test eax, eax
je 0x1400091e0
lea rdx, [0x14001f380]
mov rcx, r14
call sub.msvcrt.dll__wcsicmp
test eax, eax
je 0x140009140
lea rdx, str.CACHE_DIR
mov rcx, r14
call sub.msvcrt.dll__wcsicmp
test eax, eax
je 0x140008fc8
lea rdx, str.COMPANY
mov rcx, r14
call sub.msvcrt.dll__wcsicmp
test eax, eax
je 0x1400092cc
lea rdx, str.PRODUCT
mov rcx, r14
call sub.msvcrt.dll__wcsicmp
test eax, eax
je 0x140009348
lea rdx, str.VERSION
mov rcx, r14
call sub.msvcrt.dll__wcsicmp
test eax, eax
je 0x1400090ac
lea rdx, str.TIME
mov rcx, r14
call sub.msvcrt.dll__wcsicmp
test eax, eax
jne 0x140008ecd
lea rcx, [rsp + 0x58]
lea rbp, [rsp + 0x500]
mov qword [rsp + 0x58], 0
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov r9, qword [rsp + 0x58]
mov edx, 0x400
mov rcx, rbp
lea r8, str._lld
call fcn.140001a50
cmp word [rbx], 0
je 0x1400093d4
mov r14, rsi
mov r15, rbx
nop dword [rax]
add r15, 2
sub r14, 1
cmp word [r15], 0
jne 0x140008e08
movzx edx, byte [rsp + 0x500]
test dl, dl
je 0x140008fba
mov r13, rbp
add r14, rbp
nop dword [rax]
mov rax, r14
mov rbp, r15
sub rax, r13
cmp word [r15], 0
je 0x140008e4f
add rbp, 2
sub rax, 1
cmp word [rbp], 0
jne 0x140008e40
mov byte [rsp + 0x38], dl
test rax, rax
je 0x14001d370
mov rcx, rbp
add r13, 1
add r15, 2
call sub.msvcrt.dll_wcslen
movzx edx, byte [rsp + 0x38]
mov r8d, 2
mov byte [rsp + 0x2f1], 0
lea rcx, [rbp + rax*2]
mov byte [rsp + 0x2f0], dl
mov rdx, qword [rsp + 0x40]
call sub.msvcrt.dll_mbstowcs
movzx edx, byte [r13]
test dl, dl
jne 0x140008e30
jmp 0x140008fb0
mov rcx, rbx
call sub.msvcrt.dll_wcslen
mov r8, rsi
lea rdx, str.PROGRAM
mov rcx, rbx
sub r8, rax
call fcn.140008c00
test al, al
jne 0x140009067
xor eax, eax
add rsp, 0x1108
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rdx, rbx
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp word [rbx], 0
je 0x140008f2f
mov eax, 1
nop
add rbx, 2
sub rsi, 1
cmp word [rbx], 0
jne 0x140008f00
test al, al
jne 0x140008f2f
xor edx, edx
jmp 0x140008c57
sub rbx, 2
xor r13d, r13d
add rsi, 1
mov word [rbx], r13w
cmp word [rbx - 2], 0x5c
je 0x140008f20
xor edx, edx
jmp 0x140008c57
mov rax, qword [sym.imp.msvcrt.dll___wargv]
cmp word [rbx], 0
mov rdx, rsi
mov rax, qword [rax]
mov rax, qword [rax]
mov rcx, qword [rax]
mov rax, rbx
je 0x140008f6e
nop dword [rax]
add rax, 2
sub rdx, 1
cmp word [rax], 0
jne 0x140008f60
movzx r8d, word [rcx]
test r8w, r8w
je 0x140008fab
test rdx, rdx
jne 0x140008f91
jmp 0x1400093f6
test rdx, rdx
je 0x14001d370
add rcx, 2
mov word [rax], r8w
add rax, 2
sub rdx, 1
movzx r8d, word [rcx]
test r8w, r8w
jne 0x140008f88
xor edx, edx
mov word [rax], dx
cmp word [rbx], 0
je 0x140008f12
xor eax, eax
jmp 0x140008f00
mov rax, qword [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov edx, 0x1c
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x140008ecd
cmp word [rbx], 0
mov rdx, rsi
mov rax, rbx
je 0x14000900e
nop dword [rax]
add rax, 2
sub rdx, 1
cmp word [rax], 0
jne 0x140009000
movzx ecx, word [rsp + 0x2f0]
test cx, cx
je 0x140009051
test rdx, rdx
je 0x14001d370
mov r8, qword [rsp + 0x40]
jmp 0x140009039
test rdx, rdx
je 0x14001d370
add r8, 2
mov word [rax], cx
add rax, 2
sub rdx, 1
movzx ecx, word [r8]
test cx, cx
jne 0x140009030
xor r15d, r15d
mov word [rax], r15w
cmp word [rbx], 0
jne 0x140008ef9
jmp 0x140008f2f
mov rcx, rbx
call sub.msvcrt.dll_wcslen
cmp rax, 3
jbe 0x140008fb0
lea rbp, [rbx + rax*2 - 8]
lea rdx, str..exe
mov rcx, rbp
call sub.msvcrt.dll__wcsicmp
test eax, eax
jne 0x140008fb0
xor eax, eax
mov word [rbp], ax
cmp word [rbx], 0
je 0x140008f12
xor eax, eax
jmp 0x140008f00
cmp word [rbx], 0
mov rax, rsi
mov rdx, rbx
je 0x1400090ce
nop dword [rax + rax]
add rdx, 2
sub rax, 1
cmp word [rdx], 0
jne 0x1400090c0
test rax, rax
je 0x1400093fb
mov r8d, 0x31
lea rcx, [rdx + 2]
sub rax, 1
mov word [rdx], r8w
mov r8d, 0x2e
lea rdx, [0x14001f314]
nop word cs:[rax + rax]
test rax, rax
je 0x14001d370
add rdx, 2
mov word [rcx], r8w
add rcx, 2
sub rax, 1
movzx r8d, word [rdx]
test r8w, r8w
jne 0x140009100
xor r14d, r14d
mov word [rcx], r14w
cmp word [rbx], 0
je 0x140008f12
xor eax, eax
jmp 0x140008f00
lea rbp, [rsp + 0xe0]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rbp
mov edx, 0x28
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x140008ecd
cmp word [rbx], 0
mov rdx, rsi
mov rax, rbx
je 0x140009186
nop dword [rax]
add rax, 2
sub rdx, 1
cmp word [rax], 0
jne 0x140009178
movzx r8d, word [rsp + 0xe0]
test r8w, r8w
je 0x140009051
test rdx, rdx
je 0x14001d370
mov rcx, rbp
jmp 0x1400091b9
test rdx, rdx
je 0x14001d370
add rcx, 2
mov word [rax], r8w
add rax, 2
sub rdx, 1
movzx r8d, word [rcx]
test r8w, r8w
jne 0x1400091b0
jmp 0x140009051
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rbp, [rsp + 0x60]
mov edx, pe_nt_image_headers64
lea r8, [0x14001f37c]
mov r9d, eax
mov rcx, rbp
call fcn.140001a50
cmp word [rbx], 0
je 0x1400093b8
mov r14, rsi
mov r13, rbx
nop word [rax + rax]
add r13, 2
sub r14, 1
cmp word [r13], 0
jne 0x140009218
movzx r15d, byte [rsp + 0x60]
test r15b, r15b
je 0x140008fba
lea rax, [rbp + r14]
mov r10, rbp
lea r14, [rsp + 0x500]
mov qword [rsp + 0x48], rax
nop dword [rax]
mov rax, qword [rsp + 0x48]
mov rbp, r13
sub rax, r10
cmp word [r13], 0
je 0x140009277
nop dword [rax + rax]
add rbp, 2
sub rax, 1
cmp word [rbp], 0
jne 0x140009268
mov qword [rsp + 0x38], r10
test rax, rax
je 0x14001d370
mov rcx, rbp
add r13, 2
call sub.msvcrt.dll_wcslen
mov r8d, 2
mov rdx, r14
mov byte [rsp + 0x500], r15b
lea rcx, [rbp + rax*2]
mov byte [rsp + 0x501], 0
call sub.msvcrt.dll_mbstowcs
mov r10, qword [rsp + 0x38]
movzx r15d, byte [r10 + 1]
add r10, 1
test r15b, r15b
jne 0x140009250
jmp 0x140008fb0
cmp word [rbx], 0
mov rax, rsi
mov rdx, rbx
je 0x1400092ee
nop dword [rax + rax]
add rdx, 2
sub rax, 1
cmp word [rdx], 0
jne 0x1400092e0
test rax, rax
je 0x1400093f1
mov r10d, 0x4c
lea rcx, [rdx + 2]
sub rax, 1
mov r8d, 0x6f
mov word [rdx], r10w
lea rdx, [0x14001f2c2]
nop word cs:[rax + rax]
test rax, rax
je 0x14001d370
add rdx, 2
mov word [rcx], r8w
add rcx, 2
sub rax, 1
movzx r8d, word [rdx]
test r8w, r8w
jne 0x140009320
jmp 0x140009123
cmp word [rbx], 0
mov rax, rsi
mov rdx, rbx
je 0x140009366
nop dword [rax]
add rdx, 2
sub rax, 1
cmp word [rdx], 0
jne 0x140009358
test rax, rax
je 0x140009400
mov r9d, 0x77
lea rcx, [rdx + 2]
sub rax, 1
mov r8d, 0x61
mov word [rdx], r9w
lea rdx, [0x14001f2f2]
nop
test rax, rax
je 0x14001d370
add rdx, 2
mov word [rcx], r8w
add rcx, 2
sub rax, 1
movzx r8d, word [rdx]
test r8w, r8w
jne 0x140009390
jmp 0x140009123
movzx r15d, byte [rsp + 0x60]
mov r14, rsi
mov r13, rbx
test r15b, r15b
jne 0x140009237
xor edx, edx
jmp 0x140008c57
movzx edx, byte [rsp + 0x500]
mov r14, rsi
mov r15, rbx
test dl, dl
jne 0x140008e27
xor edx, edx
jmp 0x140008c57
jmp 0x14001d370
jmp 0x14001d370
jmp 0x14001d370
jmp 0x14001d370
mov rax, r13
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
call sub.msvcrt.dll_abort
nop
or r13, 0xffffffffffffffff
jmp 0x14000e4ab