Function at 0x18000bc30
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x350
mov r9, qword [0x1800af870]
xor edi, edi
mov rbx, rcx
test r9, r9
je 0x18000bc71
lea r8, [0x18009b86c]
lea rdx, [rsp + 0x30]
mov ecx, 0xe6
call sym.sqlite3.dll_sqlite3_snprintf
jmp 0x18000bdd0
mov eax, dword [0x1800af81c]
test eax, eax
jne 0x18000bca9
lea rcx, [rsp + 0x140]
mov dword [rsp + 0x140], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x150], 2
mov eax, edi
sete al
inc eax
mov dword [0x1800af81c], eax
mov ecx, 0xe6
cmp eax, 2
jne 0x18000bcfb
lea rdx, [rsp + 0x140]
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rcx, [rsp + 0x140]
call fcn.18000b060
mov rsi, rax
test rax, rax
je 0x18000bd7d
lea r8, [0x18009b86c]
lea rdx, [rsp + 0x30]
mov r9, rax
mov ecx, 0xe6
call sym.sqlite3.dll_sqlite3_snprintf
mov rcx, rsi
jmp 0x18000bdcb
lea rdx, [rsp + 0x140]
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov r12d, edi
test eax, eax
lea r8, [rsp + 0x140]
mov dword [rsp + 0x28], edi
sete r12b
or r9d, 0xffffffff
xor edx, edx
mov ecx, r12d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor ecx, ecx
mov ebp, eax
add ebp, ebp
movsxd rdx, ebp
add rdx, rdx
call fcn.1800043e0
mov rsi, rax
test rax, rax
je 0x18000bd7d
lea r8, [rsp + 0x140]
or r9d, 0xffffffff
xor edx, edx
mov ecx, r12d
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rcx, rsi
test eax, eax
jne 0x18000bd9a
call fcn.1800046c0
mov eax, 7
lea r11, [rsp + 0x350]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
call fcn.18000b060
mov rcx, rsi
mov rbp, rax
call fcn.1800046c0
test rbp, rbp
je 0x18000bd7d
lea r8, [0x18009b86c]
lea rdx, [rsp + 0x30]
mov r9, rbp
mov ecx, 0xe6
call sym.sqlite3.dll_sqlite3_snprintf
mov rcx, rbp
call fcn.1800046c0
mov qword [rsp + 0x370], r13
lea rcx, [rsp + 0x30]
lea rax, [rsp + 0x30]
cmp byte [rsp + 0x30], dil
je 0x18000bdf8
nop dword [rax]
inc rax
cmp byte [rax], dil
jne 0x18000bdf0
sub eax, ecx
and eax, 0x3fffffff
movsxd rcx, eax
je 0x18000be1c
lea rax, [rsp + 0x30]
nop dword [rax]
cmp byte [rax + rcx - 1], 0x5c
jne 0x18000be1c
dec rcx
jne 0x18000be10
mov byte [rsp + rcx + 0x30], dil
lea r9, [rsp + 0x30]
lea r8, str._setilqs_
mov rdx, rbx
mov ecx, 0xe7
call sym.sqlite3.dll_sqlite3_snprintf
mov r11, rbx
test rbx, rbx
je 0x18000be5c
cmp byte [rbx], dil
je 0x18000be4f
inc r11
cmp byte [r11], dil
jne 0x18000be47
sub r11d, ebx
and r11d, 0x3fffffff
mov edi, r11d
movsxd rdi, edi
mov ecx, 0x14
lea rdx, [rdi + rbx]
call sym.sqlite3.dll_sqlite3_randomness
lea r11, [rbx + 1]
mov r8, rbx
sub r8, r11
mov r9, rbx
mov r10, rbx
sub r9, r11
sub r10, r11
mov rsi, rbx
lea rbp, [r11 + rdi]
sub rsi, r11
movabs r12, 0x842108421084211
mov r11d, 4
lea r13, str.abcd
nop word [rax + rax]
movzx ecx, byte [r8 + rbp]
mov rax, r12
add rbp, 5
mul rcx
mov eax, ecx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
imul rax, rax, 0x3e
sub rcx, rax
movzx eax, byte [rcx + r13]
movzx ecx, byte [rbp - 5]
mov byte [r8 + rbp - 5], al
mov rax, r12
mul rcx
mov eax, ecx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
imul rax, rax, 0x3e
sub rcx, rax
movzx eax, byte [rcx + r13]
movzx ecx, byte [r9 + rbp - 3]
mov byte [rbp - 5], al
mov rax, r12
mul rcx
mov eax, ecx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
imul rax, rax, 0x3e
sub rcx, rax
movzx eax, byte [rcx + r13]
movzx ecx, byte [r10 + rbp - 2]
mov byte [r9 + rbp - 3], al
mov rax, r12
mul rcx
mov eax, ecx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
imul rax, rax, 0x3e
sub rcx, rax
movzx eax, byte [rcx + r13]
movzx ecx, byte [rsi + rbp - 1]
mov byte [r10 + rbp - 2], al
mov rax, r12
mul rcx
mov eax, ecx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
imul rax, rax, 0x3e
sub rcx, rax
dec r11
movzx eax, byte [rcx + r13]
mov byte [rsi + rbp - 1], al
jne 0x18000beb0
mov r13, qword [rsp + 0x370]
mov byte [rdi + rbx + 0x14], r11b
xor eax, eax
jmp 0x18000bd82