Function at 0x180008f80
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x2d0]
sub rsp, 0x3d0
mov rax, qword [0x180112440]
xor rax, rsp
mov qword [rbp + 0x2c0], rax
mov rax, qword [rbp - 0x40]
mov qword [rbp - 0x40], rax
lea r14, [0x18011af90]
mov qword [rbp - 0x40], r14
xor esi, esi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], sil
lea r8d, [rsi + 0xc]
lea rdx, str.EppWscClient
lea rcx, [rsp + 0x50]
call fcn.180007670
nop
lea rdx, [rsp + 0x50]
mov rcx, r14
call fcn.180035070
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x18000903e
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180009039
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009a23
call fcn.180085560
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], 0
mov qword [0x18011afb0], rsi
mov qword [0x18011afb8], 7
mov word [0x18011afa0], si
mov r8d, 0xb
lea rdx, str.EppElam.sys
lea rdi, [0x18011afa0]
mov rcx, rdi
call fcn.180016910
nop
mov qword [0x18011afd0], rsi
mov qword [0x18011afd8], 7
mov word [0x18011afc0], si
mov r8d, 7
lea rdx, str.EppElam
lea rcx, [0x18011afc0]
call fcn.180016910
nop
mov qword [0x18011aff0], rsi
mov qword [0x18011aff8], 7
mov word [0x18011afe0], si
mov r8d, 0x29
lea rdx, str.Emsisoft_Early_Launch_Anti_Malware_Driver
lea rcx, [0x18011afe0]
call fcn.180016910
nop
mov rdx, rdi
cmp qword [0x18011afb8], 8
cmovae rdx, qword [0x18011afa0]
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], si
mov r8, qword [0x18011afb0]
lea rcx, [rsp + 0x30]
call fcn.180016910
nop
lea rcx, [rbp - 0x68]
call fcn.180041140
nop
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x40], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
lea rbx, [0x18011b000]
lea rdx, [rbp + 0x30]
lea rcx, [rsp + 0x78]
call fcn.180006ec0
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x78]
call fcn.180007ed0
mov rdx, rax
mov rcx, rbx
call fcn.180006ec0
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 8
jb 0x1800091c0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800091ba
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009a29
call fcn.180085560
nop
mov rdx, qword [rbp + 0x48]
cmp rdx, 8
jb 0x180009201
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800091fb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009a2f
call fcn.180085560
nop
mov rdx, qword [rbp - 0x50]
cmp rdx, 8
jb 0x180009241
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000923c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009a35
call fcn.180085560
mov qword [rbp - 0x58], rsi
mov qword [rbp - 0x50], 7
mov word [rbp - 0x68], si
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x180009293
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000928e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009a3b
call fcn.180085560
movdqa xmm0, xmmword [0x1800f6c30]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x30], si
mov rdx, rdi
lea rcx, [rsp + 0x78]
call fcn.180006ec0
nop
movdqa xmm0, xmmword [0x1800f6c30]
movdqu xmmword [rbp], xmm0
mov word [rbp - 0x10], si
mov r8d, 7
lea rdx, str.drivers
lea rcx, [rbp - 0x10]
call fcn.180016910
nop
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0xb0]
call fcn.1800a40a0
mov edx, 0x104
lea rcx, [rbp + 0xb0]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
movdqa xmm0, xmmword [0x1800f6c30]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x30], si
lea rax, [rbp + 0xb0]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp word [rax + r8*2], 0
jne 0x180009324
lea rdx, [rbp + 0xb0]
lea rcx, [rbp - 0x30]
call fcn.180016910
nop
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x30]
call fcn.180047c40
movups xmm0, xmmword [rbp - 0x30]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rbp - 0x20]
movups xmmword [rsp + 0x60], xmm1
movdqa xmm0, xmmword [0x1800f6c30]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x30], si
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x50]
call fcn.180047c40
movups xmm1, xmmword [rsp + 0x50]
movups xmmword [rbp + 0x10], xmm1
movups xmm2, xmmword [rsp + 0x60]
movdqu xmmword [rbp + 0x20], xmm2
movdqa xmm0, xmmword [0x1800f6c30]
movdqu xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x50], si
lea rcx, [0x18011b020]
lea rdx, [rbp + 0x10]
movq r8, xmm1
movdqa xmm0, xmm2
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 8
cmovae rdx, r8
mov qword [0x18011b030], rsi
mov qword [0x18011b038], 7
mov word [0x18011b020], si
movq r8, xmm2
call fcn.180016910
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 8
jb 0x18000942f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000942a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009a41
call fcn.180085560
movdqa xmm0, xmmword [0x1800f6c30]
movdqu xmmword [rbp + 0x20], xmm0
mov word [rbp + 0x10], si
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x180009482
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000947d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009a47
call fcn.180085560
movdqa xmm0, xmmword [0x1800f6c30]
movdqu xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x50], si
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x1800094d5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800094d0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009a4d
call fcn.180085560
movdqa xmm0, xmmword [0x1800f6c30]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x30], si
mov rdx, qword [rbp + 8]
cmp rdx, 8
jb 0x180009526
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180009521
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009a53
call fcn.180085560
movdqa xmm0, xmmword [0x1800f6c30]
movdqu xmmword [rbp], xmm0
mov word [rbp - 0x10], si
mov rdx, qword [rbp - 0x70]
cmp rdx, 8
jb 0x180009578
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180009573
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009a59
call fcn.180085560
movdqa xmm0, xmmword [0x1800f6c30]
movdqu xmmword [rbp - 0x78], xmm0
mov word [rsp + 0x78], si
cmp qword [0x18011afb8], 8
cmovae rdi, qword [0x18011afa0]
mov qword [rbp - 0x58], rsi
mov qword [rbp - 0x50], 7
mov word [rbp - 0x68], si
mov r8, qword [0x18011afb0]
mov rdx, rdi
lea rcx, [rbp - 0x68]
call fcn.180016910
nop
movdqa xmm0, xmmword [0x1800f6c30]
movdqu xmmword [rbp + 0xa0], xmm0
mov word [rbp + 0x90], si
mov r8d, 8
lea rdx, str.ELAMBKUP
lea rcx, [rbp + 0x90]
call fcn.180016910
nop
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0xb0]
call fcn.1800a40a0
mov edx, 0x104
lea rcx, [rbp + 0xb0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
movdqa xmm0, xmmword [0x1800f6c30]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x30], si
lea rax, [rbp + 0xb0]
nop
inc rbx
cmp word [rax + rbx*2], 0
jne 0x180009630
mov r8, rbx
lea rdx, [rbp + 0xb0]
lea rcx, [rsp + 0x30]
call fcn.180016910
nop
lea rdx, [rbp + 0x90]
lea rcx, [rsp + 0x30]
call fcn.180047c40
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rbp + 0x10], xmm0
movups xmm1, xmmword [rsp + 0x40]
movups xmmword [rbp + 0x20], xmm1
movdqa xmm0, xmmword [0x1800f6c30]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x30], si
mov qword [rbp + 0x80], rsi
mov qword [rbp + 0x88], 7
mov word [rbp + 0x70], si
mov r8d, 0xa
lea rdx, str.BackupPath
lea rcx, [rbp + 0x70]
call fcn.180016910
nop
mov qword [rbp + 0x60], rsi
mov qword [rbp + 0x68], 7
mov word [rbp + 0x50], si
mov r8d, 0x2c
lea rdx, str.SYSTEMCurrentControlSetControlEarlyLaunch
lea rcx, [rbp + 0x50]
call fcn.180016910
nop
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x70]
lea r8, [rbp + 0x50]
lea rcx, [rbp + 0x30]
call fcn.180040e70
nop
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x78], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
lea rbx, [0x18011b040]
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x10]
call fcn.180006ec0
nop
lea rdx, [rbp - 0x68]
lea rcx, [rbp - 0x10]
call fcn.180007ed0
mov rdx, rax
mov rcx, rbx
call fcn.180006ec0
nop
mov rdx, qword [rbp + 8]
cmp rdx, 8
jb 0x180009783
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000977d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009a5f
call fcn.180085560
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 8
jb 0x1800097c5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800097bf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009a65
call fcn.180085560
nop
mov rdx, qword [rbp + 0x48]
cmp rdx, 8
jb 0x180009805
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180009800
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009a6b
call fcn.180085560
mov qword [rbp + 0x40], rsi
mov qword [rbp + 0x48], 7
mov word [rbp + 0x30], si
mov rdx, qword [rbp + 0x68]
cmp rdx, 8
jb 0x180009855
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180009850
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009a71
call fcn.180085560
mov qword [rbp + 0x60], rsi
mov qword [rbp + 0x68], 7
mov word [rbp + 0x50], si
mov rdx, qword [rbp + 0x88]
cmp rdx, 8
jb 0x1800098a8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800098a3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009a77
call fcn.180085560
mov qword [rbp + 0x80], rsi
mov qword [rbp + 0x88], 7
mov word [rbp + 0x70], si
mov rdx, qword [rbp + 0x28]
cmp rdx, 8
jb 0x1800098ff
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800098f9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009a7d
call fcn.180085560
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x180009941
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000993c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009a83
call fcn.180085560
movdqa xmm0, xmmword [0x1800f6c30]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x30], si
mov rdx, qword [rbp + 0xa8]
cmp rdx, 8
jb 0x18000999a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180009995
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009a89
call fcn.180085560
movdqa xmm0, xmmword [0x1800f6c30]
movdqu xmmword [rbp + 0xa0], xmm0
mov word [rbp + 0x90], si
mov rdx, qword [rbp - 0x50]
cmp rdx, 8
jb 0x1800099ee
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800099e8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009a1d
call fcn.180085560
nop
mov rax, r14
mov rcx, qword [rbp + 0x2c0]
xor rcx, rsp
call fcn.180085510
lea r11, [rsp + 0x3d0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.1800a889c
nop
call fcn.1800a889c
nop
call fcn.1800a889c
nop
call fcn.1800a889c
nop
call fcn.1800a889c
nop
call fcn.1800a889c
nop
call fcn.1800a889c
nop
call fcn.1800a889c
nop
call fcn.1800a889c
nop
call fcn.1800a889c
nop
call fcn.1800a889c
nop
call fcn.1800a889c
nop
call fcn.1800a889c
nop
call fcn.1800a889c
nop
call fcn.1800a889c
nop
call fcn.1800a889c
nop
call fcn.1800a889c
nop
call fcn.1800a889c
nop
call fcn.1800a889c
int3