Function at 0x409c80
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
sub rsp, 0x1c8
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov qword [rax - 8], rsi
mov qword [rax - 0x10], rdi
mov qword [rax - 0x18], r12
mov qword [rax - 0x20], r13
mov qword [rax - 0x28], r14
mov qword [rax - 0x30], r15
mov rax, qword [0x00454a00]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov dword [rsp + 0x20], edx
mov r15, rcx
call fcn.00413cb8
mov rcx, rax
xor eax, eax
test rcx, rcx
setne al
test eax, eax
jne 0x409ceb
mov ecx, 0x80004005
call fcn.00401000
int3
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x30], rax
call fcn.00413cb8
mov rdx, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x409d19
mov ecx, 0x80004005
call fcn.00401000
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x28], rdi
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x409d96
lea rcx, str.Error_:_Get_windows_path_error_n
call fcn.004042c0
nop
lea rdx, [rdi - 0x18]
mov rsi, 0xffffffffffffffff
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x409d6e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
add esi, 0xffffffff
test esi, esi
jg 0x409d8c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, 0x4e25
jmp 0x40a445
xor r12d, r12d
xor r13d, r13d
lea rsi, [r12 - 1]
cmp dword [rsp + 0x20], r12d
jbe 0x40a409
lea rbx, str._system32drivers
mov rax, r13
imul rax, rax, 0x1cc
cmp dword [rax + r15 + 0x1c8], 0
je 0x40a3f6
mov r10d, 0xf
mov qword [rsp + 0x60], r10
xor r8d, r8d
mov qword [rsp + 0x58], r8
mov byte [rsp + 0x48], r8b
xor eax, eax
mov rcx, rsi
lea rdi, [rsp + 0x70]
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
cmp rcx, 0xfffffffffffffffe
jbe 0x409e0f
call fcn.00436ca0
mov r10, qword [rsp + 0x60]
mov r8, qword [rsp + 0x58]
cmp r10, rdi
jae 0x409e2d
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.00402120
mov r10, qword [rsp + 0x60]
mov r8, qword [rsp + 0x58]
jmp 0x409e55
test rdi, rdi
jne 0x409e55
mov qword [rsp + 0x58], rdi
lea rax, [rsp + 0x48]
cmp r10, 0x10
cmovae rax, qword [rsp + 0x48]
mov byte [rax], dil
mov r10, qword [rsp + 0x60]
mov r8, qword [rsp + 0x58]
jmp 0x409e9d
test rdi, rdi
je 0x409e9d
lea rcx, [rsp + 0x48]
cmp r10, 0x10
cmovae rcx, qword [rsp + 0x48]
mov r9, rdi
lea r8, [rsp + 0x70]
mov rdx, r10
call fcn.00421090
mov qword [rsp + 0x58], rdi
lea rax, [rsp + 0x48]
cmp qword [rsp + 0x60], 0x10
cmovae rax, qword [rsp + 0x48]
mov byte [rax + rdi], 0
mov r10, qword [rsp + 0x60]
mov r8, qword [rsp + 0x58]
mov r14d, r12d
imul r14, r14, 0x1cc
add r14, r15
lea rdx, [r14 + 0x80]
xor eax, eax
mov rcx, rsi
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
cmp rcx, 1
je 0x409eec
mov rcx, rsi
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x40]
call fcn.00402e60
mov r10, qword [rsp + 0x60]
mov r8, qword [rsp + 0x58]
jmp 0x40a120
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x48]
cmp r10, 0x10
cmovae rax, rcx
cmp rbx, rax
jb 0x40a04e
lea rax, [rsp + 0x48]
cmp r10, 0x10
cmovae rax, rcx
add rax, r8
cmp rax, rbx
jbe 0x40a04e
lea rax, [rsp + 0x48]
cmp r10, 0x10
cmovae rax, rcx
mov rbp, rbx
sub rbp, rax
cmp r8, rbp
jae 0x409f47
call fcn.00436d70
mov r10, qword [rsp + 0x60]
mov r8, qword [rsp + 0x58]
mov rax, r8
sub rax, rbp
mov ebx, 0x11
cmp rax, rbx
cmovb rbx, rax
mov rax, rsi
sub rax, r8
cmp rax, rbx
jbe 0x409f6d
lea rax, [r8 + rbx]
cmp rax, r8
jae 0x409f7c
call fcn.00436ca0
mov r10, qword [rsp + 0x60]
mov r8, qword [rsp + 0x58]
test rbx, rbx
je 0x40a120
lea rdi, [r8 + rbx]
cmp rdi, 0xfffffffffffffffe
jbe 0x409f9e
call fcn.00436ca0
mov r10, qword [rsp + 0x60]
mov r8, qword [rsp + 0x58]
cmp r10, rdi
jae 0x409fbc
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.00402120
mov r10, qword [rsp + 0x60]
mov r8, qword [rsp + 0x58]
jmp 0x409fe7
test rdi, rdi
jne 0x409fe7
mov qword [rsp + 0x58], rdi
lea rax, [rsp + 0x48]
cmp r10, 0x10
cmovae rax, qword [rsp + 0x48]
mov byte [rax], dil
mov r10, qword [rsp + 0x60]
mov r8, qword [rsp + 0x58]
jmp 0x40a120
test rdi, rdi
je 0x40a120
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0x48]
cmp r10, 0x10
cmovae rdx, rcx
lea rax, [rsp + 0x48]
cmp r10, 0x10
cmovae rax, rcx
sub r10, r8
lea rcx, [rax + r8]
lea r8, [rdx + rbp]
mov r9, rbx
mov rdx, r10
call fcn.00421090
mov qword [rsp + 0x58], rdi
lea rax, [rsp + 0x48]
cmp qword [rsp + 0x60], 0x10
cmovae rax, qword [rsp + 0x48]
mov byte [rax + rdi], 0
mov r10, qword [rsp + 0x60]
mov r8, qword [rsp + 0x58]
jmp 0x40a120
mov rax, rsi
sub rax, r8
cmp rax, 0x11
jbe 0x40a063
lea rax, [r8 + 0x11]
cmp rax, r8
jae 0x40a072
call fcn.00436ca0
mov r10, qword [rsp + 0x60]
mov r8, qword [rsp + 0x58]
lea rdi, [r8 + 0x11]
cmp rdi, 0xfffffffffffffffe
jbe 0x40a08b
call fcn.00436ca0
mov r10, qword [rsp + 0x60]
mov r8, qword [rsp + 0x58]
cmp r10, rdi
jae 0x40a0a9
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.00402120
mov r10, qword [rsp + 0x60]
mov r8, qword [rsp + 0x58]
jmp 0x40a0d1
test rdi, rdi
jne 0x40a0d1
mov qword [rsp + 0x58], rdi
lea rax, [rsp + 0x48]
cmp r10, 0x10
cmovae rax, qword [rsp + 0x48]
mov byte [rax], dil
mov r10, qword [rsp + 0x60]
mov r8, qword [rsp + 0x58]
jmp 0x40a120
test rdi, rdi
je 0x40a120
lea rcx, [rsp + 0x48]
cmp r10, 0x10
cmovae rcx, qword [rsp + 0x48]
sub r10, r8
add rcx, r8
mov r9d, 0x11
mov r8, rbx
mov rdx, r10
call fcn.00421090
mov qword [rsp + 0x58], rdi
lea rax, [rsp + 0x48]
cmp qword [rsp + 0x60], 0x10
cmovae rax, qword [rsp + 0x48]
mov byte [rax + rdi], 0
mov r10, qword [rsp + 0x60]
mov r8, qword [rsp + 0x58]
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x48]
cmp r10, 0x10
cmovae rax, rcx
lea rdx, [0x00439c94]
cmp rdx, rax
jb 0x40a275
lea rax, [rsp + 0x48]
cmp r10, 0x10
cmovae rax, rcx
add rax, r8
cmp rax, rdx
jbe 0x40a275
lea rax, [rsp + 0x48]
cmp r10, 0x10
cmovae rax, rcx
mov rbp, rdx
sub rbp, rax
cmp r8, rbp
jae 0x40a182
call fcn.00436d70
mov r10, qword [rsp + 0x60]
mov r8, qword [rsp + 0x58]
mov rax, r8
sub rax, rbp
mov ebx, 1
cmp rax, rbx
cmovb rbx, rax
mov rax, rsi
sub rax, r8
cmp rax, rbx
jbe 0x40a1a8
lea rax, [r8 + rbx]
cmp rax, r8
jae 0x40a1b7
call fcn.00436ca0
mov r10, qword [rsp + 0x60]
mov r8, qword [rsp + 0x58]
test rbx, rbx
je 0x40a337
lea rdi, [r8 + rbx]
cmp rdi, 0xfffffffffffffffe
jbe 0x40a1d9
call fcn.00436ca0
mov r10, qword [rsp + 0x60]
mov r8, qword [rsp + 0x58]
cmp r10, rdi
jae 0x40a1f7
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.00402120
mov r10, qword [rsp + 0x60]
mov r8, qword [rsp + 0x58]
jmp 0x40a218
test rdi, rdi
jne 0x40a218
mov qword [rsp + 0x58], rdi
lea rax, [rsp + 0x48]
cmp r10, 0x10
cmovae rax, qword [rsp + 0x48]
mov byte [rax], dil
jmp 0x40a337
test rdi, rdi
je 0x40a337
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0x48]
cmp r10, 0x10
cmovae rdx, rcx
lea rax, [rsp + 0x48]
cmp r10, 0x10
cmovae rax, rcx
sub r10, r8
lea rcx, [rax + r8]
lea r8, [rdx + rbp]
mov r9, rbx
mov rdx, r10
call fcn.00421090
mov qword [rsp + 0x58], rdi
lea rax, [rsp + 0x48]
cmp qword [rsp + 0x60], 0x10
cmovae rax, qword [rsp + 0x48]
mov byte [rax + rdi], 0
jmp 0x40a337
mov rax, rsi
sub rax, r8
cmp rax, 1
jbe 0x40a28a
lea rax, [r8 + 1]
cmp rax, r8
jae 0x40a299
call fcn.00436ca0
mov r10, qword [rsp + 0x60]
mov r8, qword [rsp + 0x58]
lea rdi, [r8 + 1]
cmp rdi, 0xfffffffffffffffe
jbe 0x40a2b2
call fcn.00436ca0
mov r10, qword [rsp + 0x60]
mov r8, qword [rsp + 0x58]
cmp r10, rdi
jae 0x40a2d0
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.00402120
mov r10, qword [rsp + 0x60]
mov r8, qword [rsp + 0x58]
jmp 0x40a2ee
test rdi, rdi
jne 0x40a2ee
mov qword [rsp + 0x58], rdi
lea rax, [rsp + 0x48]
cmp r10, 0x10
cmovae rax, qword [rsp + 0x48]
mov byte [rax], dil
jmp 0x40a337
test rdi, rdi
je 0x40a337
lea rcx, [rsp + 0x48]
cmp r10, 0x10
cmovae rcx, qword [rsp + 0x48]
sub r10, r8
add rcx, r8
mov r9d, 1
lea r8, [0x00439c94]
mov rdx, r10
call fcn.00421090
mov qword [rsp + 0x58], rdi
lea rax, [rsp + 0x48]
cmp qword [rsp + 0x60], 0x10
cmovae rax, qword [rsp + 0x48]
mov byte [rdi + rax], 0
xor eax, eax
mov rcx, rsi
mov rdi, r14
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, r14
lea rcx, [rsp + 0x40]
call fcn.00402e60
lea r8, [rsp + 0x48]
cmp qword [rsp + 0x60], 0x10
cmovae r8, qword [rsp + 0x48]
lea rdx, str._nInfo__:_Remove_file___s__n
lea rcx, [rsp + 0x28]
call fcn.00403500
mov rdi, qword [rsp + 0x28]
mov rcx, rdi
call fcn.004042c0
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], 0x10
cmovae rcx, qword [rsp + 0x48]
call fcn.00401ba0
test al, al
jne 0x40a3c7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.Error_:_Remove_file_fail__err:__d_n
lea rcx, [rsp + 0x28]
call fcn.00403500
mov rdi, qword [rsp + 0x28]
mov rcx, rdi
call fcn.004042c0
jmp 0x40a3d4
lea rcx, str.Info__:_Remove_file_OK._n
call fcn.004042c0
nop
cmp qword [rsp + 0x60], 0x10
jb 0x40a3ef
mov rcx, qword [rsp + 0x48]
call fcn.004135ec
lea rbx, str._system32drivers
jmp 0x40a3f6
lea rbx, str._system32drivers
add r12d, 1
add r13, 1
cmp r12d, dword [rsp + 0x20]
jb 0x409db3
lea rdx, [rdi - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x40a425
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
add esi, 0xffffffff
test esi, esi
jg 0x40a443
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.00420600
mov rbx, qword [rsp + 0x1e0]
mov rbp, qword [rsp + 0x1e8]
mov rsi, qword [rsp + 0x1c0]
mov rdi, qword [rsp + 0x1b8]
mov r12, qword [rsp + 0x1b0]
mov r13, qword [rsp + 0x1a8]
mov r14, qword [rsp + 0x1a0]
mov r15, qword [rsp + 0x198]
add rsp, 0x1c8
ret