Function at 0x14009bdcc
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r15, rcx
xor r13d, r13d
xor ecx, ecx
xor edx, edx
mov ebp, r13d
mov r12d, r8d
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
nop dword [rax + rax]
mov esi, eax
test eax, eax
jne 0x14009be6d
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x14009be25
movzx ebx, ax
or ebx, 0x80070000
mov rcx, qword [0x140173048]
lea rax, [0x140173048]
cmp rcx, rax
je 0x14009c034
test byte [rcx + 0x1c], 1
je 0x14009c034
cmp byte [rcx + 0x19], 2
jb 0x14009c034
mov rcx, qword [rcx + 0x10]
lea r8, [0x1401574e0]
mov edx, 0x3e
mov r9d, ebx
call fcn.14000c354
jmp 0x14009c034
or rbx, 0xffffffffffffffff
mov rdx, rbx
inc rdx
cmp word [r15 + rdx*2], r13w
jne 0x14009be74
lea r14d, [rax + 1]
xor ecx, ecx
inc r14
add r14, rdx
lea rdx, [r14 + r14]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
jne 0x14009beac
mov ebx, 0x8007000e
jmp 0x14009c050
mov edx, esi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
nop dword [rax + rax]
cmp eax, esi
ja 0x14009bfe4
test eax, eax
je 0x14009bfc7
inc rbx
cmp word [rdi + rbx*2], r13w
jne 0x14009becd
mov eax, 0x5c
cmp ax, word [rdi + rbx*2 - 2]
je 0x14009bf43
lea r8, [0x14014ff70]
mov rdx, r14
mov rcx, rdi
call fcn.14005655c
mov ebx, eax
test eax, eax
jns 0x14009bf43
mov rcx, qword [0x140173048]
lea rax, [0x140173048]
cmp rcx, rax
je 0x14009c020
test byte [rcx + 0x1c], 1
je 0x14009c020
cmp byte [rcx + 0x19], 2
jb 0x14009c020
mov edx, 0x40
mov rcx, qword [rcx + 0x10]
lea r8, [0x1401574e0]
mov r9d, ebx
call fcn.14000c47c
jmp 0x14009c020
mov r8, r15
mov rdx, r14
mov rcx, rdi
call fcn.14005655c
mov ebx, eax
test eax, eax
jns 0x14009bf89
mov rcx, qword [0x140173048]
lea rax, [0x140173048]
cmp rcx, rax
je 0x14009c020
test byte [rcx + 0x1c], 1
je 0x14009c020
cmp byte [rcx + 0x19], 2
jb 0x14009c020
mov edx, 0x41
jmp 0x14009bf2b
mov r8d, r12d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
nop dword [rax + rax]
mov rbp, rax
test rax, rax
jne 0x14009bfc2
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x14009c020
movzx ebx, ax
or ebx, 0x80070000
jmp 0x14009c020
mov ebx, r13d
jmp 0x14009c020
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x14009bfe9
movzx ebx, ax
or ebx, 0x80070000
jmp 0x14009bfe9
mov ebx, 0x8007006f
mov rcx, qword [0x140173048]
lea rax, [0x140173048]
cmp rcx, rax
je 0x14009c020
test byte [rcx + 0x1c], 1
je 0x14009c020
cmp byte [rcx + 0x19], 2
jb 0x14009c020
mov rcx, qword [rcx + 0x10]
lea r8, [0x1401574e0]
mov edx, 0x3f
mov r9d, ebx
call fcn.14000c354
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop dword [rax + rax]
test rbp, rbp
jne 0x14009c05e
test ebx, ebx
jne 0x14009c050
lea r8, str.S_OK___hr
mov edx, 0x64c
lea rcx, str.base_stor_blbutil_blbutility.cpp
call fcn.1400906e0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x50]
mov rax, rbp
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret