Function at 0x1400168a0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x190]
sub rsp, 0x290
mov rax, qword [0x140300b88]
xor rax, rsp
mov qword [rbp + 0x188], rax
xor r14d, r14d
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], 7
mov word [rsp + 0x38], r14w
lea r8d, [r14 + 9]
lea rdx, str.Safestore
lea rcx, [rsp + 0x38]
call fcn.140001e70
nop
mov qword [rbp - 0x68], r14
mov qword [rbp - 0x58], r14
mov qword [rbp - 0x50], 7
mov word [rbp - 0x68], r14w
lea r8d, [r14 + 6]
lea rdx, str.Sophos
lea rcx, [rbp - 0x68]
call fcn.140001e70
nop
lea rbx, [0x1403089e0]
cmp word [0x1403089e0], r14w
jne 0x140016959
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea edx, [r14 + 0x23]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov qword [rsp + 0x78], r14
mov qword [rbp - 0x78], r14
mov qword [rbp - 0x70], 7
mov word [rsp + 0x78], r14w
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rbx + r8*2], 0
jne 0x140016980
mov rdx, rbx
lea rcx, [rsp + 0x78]
call fcn.140001e70
nop
lea r8, [rbp - 0x68]
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x28]
call fcn.14004c640
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 8
jb 0x1400169ee
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400169e8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140017036
call fcn.1402090c4
nop
movups xmm0, xmmword [rbp - 0x28]
movups xmmword [rbp - 0x48], xmm0
movups xmm1, xmmword [rbp - 0x18]
movups xmmword [rbp - 0x38], xmm1
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x10], 7
mov word [rbp - 0x28], r14w
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 8]
call fcn.14000d580
nop
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 8]
call fcn.1400166e0
mov rdx, rax
lea rcx, [rbp + 0x168]
call fcn.14000d580
nop
mov rdx, qword [rbp + 0x10]
cmp rdx, 8
jb 0x140016a7c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016a76
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001703c
call fcn.1402090c4
nop
mov rdx, qword [rbp - 0x30]
cmp rdx, 8
jb 0x140016abd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016ab7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140017042
call fcn.1402090c4
nop
mov rdx, qword [rbp - 0x50]
cmp rdx, 8
jb 0x140016afe
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016af8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140017048
call fcn.1402090c4
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 8
jb 0x140016b40
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016b3b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001704e
call fcn.1402090c4
movdqa xmm0, xmmword [0x1402d6970]
movdqu xmmword [rsp + 0x48], xmm0
mov word [rsp + 0x38], r14w
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x138], xmm0
mov qword [rbp + 0x148], rax
lea rdx, [rbp + 0x168]
lea rcx, [rbp + 0x78]
call fcn.14000d580
lea rbx, str.D:_A_OICI_FA___SY__A_OICI_FA___BA__A_OICI_FA___LA__A_OICI_FR___BU_
mov qword [rbp + 0x98], rbx
movups xmm0, xmmword [rbp + 0x78]
movaps xmmword [rbp + 0xc0], xmm0
movups xmm1, xmmword [rbp + 0x88]
movaps xmmword [rbp + 0xd0], xmm1
movdqa xmm0, xmmword [0x1402d6970]
movdqu xmmword [rbp + 0x88], xmm0
mov word [rbp + 0x78], r14w
mov qword [rbp + 0xe0], rbx
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], 7
mov word [rsp + 0x58], r14w
mov r8d, 4
lea rdx, str.Logs
lea rcx, [rsp + 0x58]
call fcn.140001e70
nop
lea rdx, [rbp + 0x168]
lea rcx, [rbp + 0x18]
call fcn.14000d580
nop
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x18]
call fcn.1400166e0
mov rdx, rax
lea rcx, [rbp + 0x58]
call fcn.14000d580
nop
mov rdx, qword [rbp + 0x30]
cmp rdx, 8
jb 0x140016c58
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016c52
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140017054
call fcn.1402090c4
nop
movups xmm2, xmmword [rbp + 0x58]
movups xmmword [rbp + 0x110], xmm2
movups xmm1, xmmword [rbp + 0x68]
movdqa xmm0, xmmword [0x1402d6970]
movdqu xmmword [rbp + 0x68], xmm0
mov word [rbp + 0x58], r14w
mov qword [rbp + 0x130], rbx
movups xmmword [rbp + 0xe8], xmm2
movups xmmword [rbp + 0xf8], xmm1
movdqu xmmword [rbp + 0x120], xmm0
mov word [rbp + 0x110], r14w
mov qword [rbp + 0x108], rbx
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x138], xmm0
mov qword [rbp + 0x148], r14
lfence
mov ecx, 0x50
call fcn.140208e30
mov rbx, rax
mov qword [rbp + 0x138], rax
mov qword [rbp + 0x140], rax
lea rcx, [rax + 0x50]
mov qword [rbp + 0x148], rcx
lea rax, [rbp + 0x138]
mov qword [rsp + 0x30], rax
lea rdi, [rbp + 0xc0]
xorps xmm0, xmm0
movups xmmword [rbp + 0x150], xmm0
mov qword [rbp + 0x150], rbx
mov qword [rbp + 0x158], rbx
lea rax, [rbp + 0x138]
mov qword [rbp + 0x160], rax
nop dword [rax]
mov rdx, rdi
mov rcx, rbx
call fcn.14000d580
mov rax, qword [rdi + 0x20]
mov qword [rbx + 0x20], rax
add rbx, 0x28
mov qword [rbp + 0x158], rbx
add rdi, 0x28
lea rax, [rbp + 0x110]
cmp rdi, rax
jne 0x140016d20
mov rdx, rbx
mov rcx, rbx
call fcn.140017e50
mov qword [rbp + 0x140], rbx
lea r9, [fcn.140001e00]
mov edx, 0x28
lea r8d, [rdx - 0x26]
lea rcx, [rbp + 0xc0]
call fcn.1402090fc
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x140016dbf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016dba
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001705a
call fcn.1402090c4
movdqa xmm0, xmmword [0x1402d6970]
movdqu xmmword [rsp + 0x68], xmm0
mov word [rsp + 0x58], r14w
mov rbx, qword [rbp + 0x138]
mov rsi, qword [rbp + 0x140]
cmp rbx, rsi
je 0x140016ef2
nop word [rax + rax]
mov rdi, qword [rbx + 0x20]
mov rdx, rbx
lea rcx, [rbp + 0xa0]
call fcn.14000d580
nop
mov rdx, rdi
lea rcx, [rbp + 0xa0]
call fcn.14004eeb0
test al, al
sete dil
mov rdx, qword [rbp + 0xb8]
cmp rdx, 8
jb 0x140016e5f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016e5a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140017066
call fcn.1402090c4
test dil, dil
je 0x140016ed7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rdx, rbx
lea rcx, [rbp + 0x38]
call fcn.14000d580
nop
lea rdx, [rbp + 0x38]
cmp qword [rbp + 0x50], 8
cmovae rdx, qword [rbp + 0x38]
mov r8d, edi
lea rcx, str.Failed_to_create_directory___s_:_error__d
call fcn.14004e280
nop
mov rdx, qword [rbp + 0x50]
cmp rdx, 8
jb 0x140016ed7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016ed2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001706c
call fcn.1402090c4
add rbx, 0x28
cmp rbx, rsi
jne 0x140016df0
mov rsi, qword [rbp + 0x140]
mov rbx, qword [rbp + 0x138]
test rbx, rbx
je 0x140016fc2
cmp rbx, rsi
je 0x140016f5f
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x140016f3f
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140016f3a
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140017060
mov rcx, r8
call fcn.1402090c4
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
add rbx, 0x28
cmp rbx, rsi
jne 0x140016f00
mov rbx, qword [rbp + 0x138]
mov rax, qword [rbp + 0x148]
sub rax, rbx
sar rax, 3
movabs rcx, 0xcccccccccccccccd
imul rax, rcx
lea rdx, [rax + rax*4]
shl rdx, 3
mov rax, rbx
cmp rdx, 0x1000
jb 0x140016fa8
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140017060
mov rcx, rbx
call fcn.1402090c4
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x138], xmm0
mov qword [rbp + 0x148], r14
mov rdx, qword [rbp + 0x180]
cmp rdx, 8
jb 0x140017004
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x168]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016fff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140017030
call fcn.1402090c4
mov rcx, qword [rbp + 0x188]
xor rcx, rsp
call fcn.140208e10
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.140212258
nop
call fcn.140212258
nop
call fcn.140212258
nop
call fcn.140212258
nop
call fcn.140212258
nop
call fcn.140212258
nop
call fcn.140212258
nop
call fcn.140212258
nop
call fcn.140212258
nop
call fcn.140212258
int3
call fcn.140212258
int3