Function at 0x14001a660
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x168]
sub rsp, 0x240
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x14016d4c0]
xor rax, rsp
mov qword [rbp + 0x120], rax
mov rsi, rcx
xor r12d, r12d
mov edi, r12d
mov dword [rsp + 0x30], r12d
xorps xmm0, xmm0
movups xmmword [rbp + 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x88], xmm1
mov r8d, 0x80
lea rdx, str.h8_34z8zBYqJAwAgUvFOlPqb_aJVxu1XNJrxR9dgqsv8jnVcM_71_69jGsC_ABXSDnma6G4D3_yniKEvEPPuhobvV79UCBeSi_8_mHevFul0HtXsbXgZs178u
lea rcx, [rbp + 0x78]
call fcn.140008c70
nop
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x60], xmm1
mov qword [rbp + 0x70], r12
mov r15d, r12d
mov rdx, qword [rsi]
mov rax, qword [rsi + 8]
sub rax, rdx
sar rax, 5
mov r14, 0xffffffffffffffff
test rax, rax
je 0x14001a97d
mov ebx, r12d
mov r8, rdx
lea r13, str.Found_bypass_key__n
nop dword [rax]
lea rax, [rdx + rbx]
mov rcx, qword [rax + 0x10]
cmp rcx, 4
jl 0x14001a959
cmp qword [rax + 0x18], 0xf
jbe 0x14001a72c
mov rax, qword [rax]
cmp dword [rax], 0x3d79656b
sete al
test al, al
je 0x14001a959
lea rdx, [r8 + rbx]
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], r12
cmp rcx, 4
jb 0x14001afcf
lea rax, [rcx - 4]
mov r8, r14
cmp rax, r14
cmovb r8, rax
cmp qword [rdx + 0x18], 0xf
jbe 0x14001a775
mov rdx, qword [rdx]
add rdx, 4
lea rcx, [rsp + 0x38]
call fcn.140008c70
bts edi, 9
mov qword [rbp], r13
mov qword [rbp + 8], reloc.WS2_32.dll_sendto
lea rdx, [rsp + 0x38]
lea rcx, [rbp]
call fcn.140021150
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xf
jbe 0x14001a7df
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a7da
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001afb7
call fcn.1400c4e5c
mov rdx, qword [rsi]
add rdx, rbx
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], r12
mov rax, qword [rdx + 0x10]
cmp rax, 4
jb 0x14001afc9
add rax, 0xfffffffffffffffc
mov r8, r14
cmp rax, r14
cmovb r8, rax
cmp qword [rdx + 0x18], 0xf
jbe 0x14001a81d
mov rdx, qword [rdx]
add rdx, 4
lea rcx, [rsp + 0x38]
call fcn.140008c70
bts edi, 0xa
lea rax, str.Found_bypass_key_
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], reloc.WS2_32.dll_send
movaps xmm0, xmmword [rbp - 0x20]
movdqa xmmword [rbp + 0x20], xmm0
lea r9, [rsp + 0x38]
lea r8, [rbp + 0x20]
mov edx, 1
call fcn.140021290
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xf
jbe 0x14001a89c
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a897
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001afbd
call fcn.1400c4e5c
mov rdx, qword [rsi]
add rdx, rbx
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], r12
mov rax, qword [rdx + 0x10]
cmp rax, 4
jb 0x14001afc3
add rax, 0xfffffffffffffffc
mov r8, r14
cmp rax, r14
cmovb r8, rax
cmp qword [rdx + 0x18], 0xf
jbe 0x14001a8d7
mov rdx, qword [rdx]
add rdx, 4
lea rcx, [rbp + 0x20]
call fcn.140008c70
bts edi, 8
mov rdx, qword [rbp + 0x68]
cmp rdx, qword [rbp + 0x70]
je 0x14001a911
movups xmm0, xmmword [rbp + 0x20]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp + 0x30]
movups xmmword [rdx + 0x10], xmm1
mov edx, reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x20], 0
add qword [rbp + 0x68], 0x20
jmp 0x14001a922
lea r8, [rbp + 0x20]
lea rcx, [rbp + 0x60]
call fcn.1400254c0
mov rdx, qword [rbp + 0x38]
cmp rdx, 0xf
jbe 0x14001a959
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a954
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001afff
call fcn.1400c4e5c
inc r15d
add rbx, 0x20
mov rdx, qword [rsi]
mov r8, rdx
mov rcx, qword [rsi + 8]
sub rcx, rdx
sar rcx, 5
movsxd rax, r15d
cmp rax, rcx
jb 0x14001a710
lea rax, str.License
mov qword [rbp], rax
mov qword [rbp + 8], 7
call fcn.1400c1570
movaps xmm0, xmmword [rbp]
movdqa xmmword [rbp + 0x20], xmm0
lea r8, [rbp + 0x20]
mov edx, eax
lea rcx, [rbp - 0x68]
call fcn.140014100
or edi, 3
lea rax, [0x14014bc44]
mov qword [rbp], rax
mov qword [rbp + 8], 3
call fcn.1400c1570
movaps xmm0, xmmword [rbp]
movdqa xmmword [rbp + 0x20], xmm0
lea r8, [rbp + 0x20]
mov edx, eax
lea rcx, [rsp + 0x78]
call fcn.140014100
or edi, 0xc
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
movdqa xmm6, xmmword [0x140150630]
movdqu xmmword [rsp + 0x48], xmm6
mov word [rsp + 0x38], r12w
or edi, 0x10
mov dword [rsp + 0x30], edi
mov qword [rbp - 0x20], r12
lea r9, [rbp - 0x20]
xor r8d, r8d
xor edx, edx
lea rcx, [0x140119a28]
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x14001aab2
mov qword [rbp], rcx
mov rax, r14
inc rax
cmp word [rcx + rax*2], 0
jne 0x14001aa35
mov qword [rbp + 8], rax
movaps xmm0, xmmword [rbp]
movdqa xmmword [rbp + 0x20], xmm0
lea rdx, [rbp + 0x20]
lea rcx, [rbp]
call fcn.140027f20
or edi, 0x20
mov dword [rsp + 0x30], edi
lea rdx, [rbp]
lea rcx, [rsp + 0x38]
call fcn.1400157d0
mov rdx, qword [rbp + 0x18]
cmp rdx, 7
jbe 0x14001aaae
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001aaa9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001afb1
call fcn.1400c4e5c
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x48]
call fcn.1400145b0
nop
lea r8, [rbp - 0x68]
mov rdx, rax
lea rcx, [rbp + 0x40]
call fcn.1400145b0
nop
mov rdx, qword [rbp - 0x30]
cmp rdx, 7
jbe 0x14001ab1d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001ab18
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001afd5
call fcn.1400c4e5c
movdqu xmmword [rbp - 0x38], xmm6
mov word [rbp - 0x48], r12w
mov rdx, qword [rsp + 0x50]
cmp rdx, 7
jbe 0x14001ab69
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001ab64
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001afdb
call fcn.1400c4e5c
movdqu xmmword [rsp + 0x48], xmm6
mov word [rsp + 0x38], r12w
mov rdx, qword [rbp - 0x70]
cmp rdx, 7
jbe 0x14001abb6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001abb1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001afe1
call fcn.1400c4e5c
movdqu xmmword [rbp - 0x78], xmm6
mov word [rsp + 0x78], r12w
mov rdx, qword [rbp - 0x50]
cmp rdx, 7
jbe 0x14001ac01
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001abfc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001afe7
call fcn.1400c4e5c
movdqu xmmword [rbp - 0x58], xmm6
mov word [rbp - 0x68], r12w
mov r8d, 3
lea rdx, [rbp + 0x40]
lea rcx, [rbp - 0x20]
call fcn.140015c00
movsd xmm0, qword [rax]
movsd qword [rbp], xmm0
mov ecx, dword [rax + 8]
mov dword [rbp - 0x20], ecx
lea rdx, [0x14016e160]
mov qword [rbp - 0x18], rdx
movaps xmm0, xmmword [rbp - 0x20]
movdqa xmmword [rbp + 0x20], xmm0
mov eax, dword [rbp]
test eax, eax
je 0x14001ad15
cmp eax, 1
jne 0x14001ad22
mov qword [rbp], r12
mov qword [rbp + 8], rdx
lea rdx, [rbp]
lea rcx, [rbp + 0x40]
call fcn.140015ce0
cmp dword [rbp], 0
je 0x14001ad22
lea rax, [rbp + 0x40]
cmp qword [rbp + 0x58], 7
cmova rax, qword [rbp + 0x40]
mov qword [rbp], rax
mov rax, qword [rbp + 0x50]
mov qword [rbp + 8], rax
call fcn.1400c1570
movaps xmm0, xmmword [rbp]
movdqa xmmword [rbp + 0x20], xmm0
lea r8, [rbp + 0x20]
mov edx, eax
lea rcx, [rsp + 0x58]
call fcn.140027dc0
nop
lea rax, str.Failed_to_create_directory__n
mov qword [rbp], rax
mov qword [rbp + 8], reloc.WLDAP32.dll_Ordinal_32
lea rdx, [rsp + 0x58]
lea rcx, [rbp]
call fcn.140021150
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x14001aed7
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001ad0b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001afed
call fcn.1400c4e5c
jmp 0x14001aed7
test ecx, ecx
jne 0x14001afa3
jmp 0x14001ac55
lea rax, str.LicenseGenerator.log
mov qword [rbp], rax
mov qword [rbp + 8], reloc.WS2_32.dll_sendto
call fcn.1400c1570
movaps xmm0, xmmword [rbp]
movdqa xmmword [rbp + 0x20], xmm0
lea r8, [rbp + 0x20]
mov edx, eax
lea rcx, [rsp + 0x58]
call fcn.140014100
nop
lea r8, [rsp + 0x58]
lea rdx, [rbp + 0x40]
lea rcx, [rbp - 0x20]
call fcn.1400145b0
nop
mov rdx, rax
lea rcx, [0x14016e290]
call fcn.140014740
nop
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x14001adb7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001adb2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001aff3
call fcn.1400c4e5c
movdqu xmmword [rbp - 0x10], xmm6
mov word [rbp - 0x20], r12w
mov rdx, qword [rsp + 0x70]
cmp rdx, 7
jbe 0x14001ae03
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001adfe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001aff9
call fcn.1400c4e5c
call fcn.14005fa00
lea rax, [0x14014c3fc]
mov qword [rbp], rax
mov qword [rbp + 8], 5
movaps xmm0, xmmword [rbp]
movdqa xmmword [rbp + 0x20], xmm0
lea r8, [rbp + 0x20]
call fcn.140021370
lea rcx, [rbp + 0x40]
call fcn.140019330
mov rcx, rax
shr rcx, 0x20
test al, al
je 0x14001ae49
mov r14d, ecx
jmp 0x14001aed7
lea r8, [rbp + 0x78]
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0xa0]
call fcn.140019790
nop
cmp byte [rbp + 0xa0], 0
je 0x14001ae72
mov ecx, dword [rbp + 0xa4]
mov r14d, ecx
jmp 0x14001aeca
lea r9, [rbp + 0x40]
lea r8, [rbp + 0x78]
lea rdx, [rbp + 0xf8]
lea rcx, [rbp + 0xa8]
call fcn.140019b20
mov rcx, rax
shr rcx, 0x20
test al, al
je 0x14001ae9d
mov r14d, ecx
jmp 0x14001aeca
lea rax, str.Exit:_Authentication_success
mov qword [rbp], rax
mov qword [rbp + 8], Ordinal_30
movaps xmm0, xmmword [rbp]
movdqa xmmword [rbp + 0x20], xmm0
lea r8, [rbp + 0x20]
mov edx, 1
call fcn.140008910
mov r14d, r12d
lea rcx, [rbp + 0xa8]
call fcn.140019a60
nop
mov rdx, qword [rbp + 0x58]
cmp rdx, 7
jbe 0x14001af17
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001af12
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001afff
call fcn.1400c4e5c
movdqu xmmword [rbp + 0x50], xmm6
mov word [rbp + 0x40], r12w
lea rcx, [rbp + 0x60]
call fcn.14001eba0
nop
mov rdx, qword [rbp + 0x90]
cmp rdx, 0xf
jbe 0x14001af65
inc rdx
mov rcx, qword [rbp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001af60
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001af9d
call fcn.1400c4e5c
mov eax, r14d
mov rcx, qword [rbp + 0x120]
xor rcx, rsp
call fcn.1400c4df0
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400d3b88
nop
lea r8, [rbp + 0x40]
lea rdx, [rbp + 0x20]
call fcn.140015190
nop
call fcn.1400d3b88
nop
call fcn.1400d3b88
int3
call fcn.1400d3b88
int3
call fcn.1400094a0
int3
call fcn.1400094a0
int3
call fcn.1400094a0
nop
call fcn.1400d3b88
nop
call fcn.1400d3b88
nop
call fcn.1400d3b88
nop
call fcn.1400d3b88
int3
call fcn.1400d3b88
nop
call fcn.1400d3b88
nop
call fcn.1400d3b88
nop
call fcn.1400d3b88
int3