Function at 0x140005470
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x380]
sub rsp, 0x480
mov rax, qword [0x14007e018]
xor rax, rsp
mov qword [rbp + 0x370], rax
xor r12d, r12d
mov dword [rsp + 0x30], r12d
lea rax, [rbp + 0x160]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r12 + 0x10]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea r8, str.mx81jh1jkx9bah0b3vv4.txt
mov edx, 0x104
lea rcx, [rbp + 0x160]
call fcn.1400406f4
lea r8, [0x140074984]
lea rdx, [rbp + 0x160]
lea rcx, [rsp + 0x78]
call fcn.14003b524
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x1400059c6
lea rdx, str.This_is_a_message._The_file_will_be_encrypted__n
call fcn.140001ee0
mov rcx, qword [rsp + 0x78]
call fcn.14003b658
lea rcx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x30]
call fcn.1400035e0
nop
xor edx, edx
mov r8d, 0xe8
lea rcx, [rbp + 0x70]
call fcn.140037230
lea rcx, [rbp + 0x70]
call fcn.140007420
nop
lea rdx, str._fakefile_created
lea rcx, [rbp + 0x70]
call fcn.14000b480
mov rcx, rax
lea rdx, [rbp + 0x160]
call fcn.14000b480
mov rcx, rax
call fcn.14000b6f0
mov qword [rbp - 0x80], r12
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x68], 7
mov word [rbp - 0x80], r12w
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], 7
mov word [rsp + 0x38], r12w
mov dword [rsp + 0x30], 2
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], rax
mov rcx, qword [rbp + 0xe8]
mov eax, ecx
and al, 0x22
cmp al, 2
je 0x1400055fe
mov rax, qword [rbp + 0xb8]
mov rdx, qword [rax]
test rdx, rdx
je 0x1400055fe
mov rax, qword [rbp + 0x98]
mov r9, qword [rax]
cmp rdx, qword [rbp + 0xe0]
cmovb rdx, qword [rbp + 0xe0]
sub rdx, r9
jmp 0x14000562f
test cl, 4
jne 0x140005667
mov rax, qword [rbp + 0xb0]
mov rcx, qword [rax]
test rcx, rcx
je 0x140005667
mov rax, qword [rbp + 0x90]
mov r9, qword [rax]
mov rax, qword [rbp + 0xc8]
movsxd rdx, dword [rax]
add rdx, rdx
sub rdx, r9
add rdx, rcx
mov rax, r9
sar rdx, 1
test rax, rax
je 0x140005667
lea rcx, [rsp + 0x38]
cmp rdx, 7
ja 0x140005661
mov qword [rsp + 0x48], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
mov rdx, r9
call fcn.140036b80
mov word [rsp + rbx + 0x38], r12w
jmp 0x140005667
call fcn.14000bbe0
nop
lea r8, str.___createEncFile__
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x60]
call fcn.14000b780
nop
lea r9, [rsp + 0x38]
mov r8, rax
lea rcx, [rsp + 0x58]
call fcn.14000cc90
nop
lea r9, [rsp + 0x58]
mov rdi, qword [rsp + 0x58]
mov r14, qword [rsp + 0x70]
cmp r14, 8
cmovae r9, rdi
mov r15, qword [rbp - 0x70]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
sub rax, r15
mov rsi, qword [rsp + 0x68]
cmp rsi, rax
ja 0x1400056ee
lea rax, [r15 + rsi]
mov qword [rbp - 0x70], rax
lea rbx, [rbp - 0x80]
cmp rcx, 8
cmovae rbx, qword [rbp - 0x80]
lea rcx, [rbx + r15*2]
lea r8, [rsi + rsi]
mov rdx, r9
call fcn.140036b80
lea rax, [rsi + r15]
mov word [rbx + rax*2], r12w
jmp 0x140005709
mov qword [rsp + 0x20], rsi
mov rdx, rsi
lea rcx, [rbp - 0x80]
call fcn.14000c010
mov r14, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x58]
cmp r14, 8
jb 0x140005745
lea rdx, [r14*2 + 2]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14000573c
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400059fc
mov rcx, rdi
call fcn.140034c90
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x140005785
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005780
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005a02
call fcn.140034c90
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x48], 7
mov word [rbp - 0x60], r12w
mov rdx, qword [rsp + 0x50]
cmp rdx, 8
jb 0x1400057d8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400057d3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005a08
call fcn.140034c90
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
movups xmmword [rbp + 0x40], xmm0
movups xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x60], rax
lea rcx, [rbp - 0x10]
call fcn.140007ee0
nop
lea r8, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae r8, qword [rbp - 0x80]
mov rax, qword [rbp - 0x70]
lea r9, [r8 + rax*2]
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x10]
call fcn.140009570
nop
lea rcx, [rbp - 0x10]
call fcn.140007df0
lea r15, [rbp - 0x60]
mov r14, qword [rbp - 0x60]
mov r13, qword [rbp - 0x48]
cmp r13, 0x10
cmovae r15, r14
mov edi, r12d
mov rsi, qword [rbp - 0x50]
test esi, esi
jle 0x140005894
nop dword [rax]
nop word [rax + rax]
mov eax, esi
sub eax, edi
mov ebx, 0x5000
cmp eax, ebx
cmovl ebx, eax
movsxd r8, ebx
movsxd rdx, edi
add rdx, r15
lea rcx, [0x1400819f0]
call fcn.140036b80
mov dword [0x1400819e8], ebx
add edi, ebx
call fcn.140001260
cmp edi, esi
jl 0x140005860
cmp r13, 0x10
jb 0x1400058cc
lea rdx, [r13 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x1400058c3
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005a0e
mov rcx, r14
call fcn.140034c90
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x14000590c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005907
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005a14
call fcn.140034c90
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x68], 7
mov word [rbp - 0x80], r12w
mov rax, qword [rbp + 0x70]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rbp + rcx + 0x70], rax
mov rax, qword [rbp + 0x70]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x88]
mov dword [rbp + rcx + 0x6c], edx
lea rcx, [rbp + 0x78]
call fcn.1400070d0
mov rax, qword [rbp + 0x70]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rbp + rcx + 0x70], rax
mov rax, qword [rbp + 0x70]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x10]
mov dword [rbp + rcx + 0x6c], edx
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0xf8], rax
lea rcx, [rbp + 0xf8]
call fcn.140014958
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x1400059c6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400059c1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400059f6
call fcn.140034c90
mov rcx, qword [rbp + 0x370]
xor rcx, rsp
call fcn.140034c70
lea r11, [rsp + 0x480]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140041530
nop
call fcn.140041530
nop
call fcn.140041530
nop
call fcn.140041530
int3
call fcn.140041530
nop
call fcn.140041530
int3