Function at 0x140005ce0
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x258]
sub rsp, 0x330
mov qword [rbp - 0x58], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x140012528]
xor rax, rsp
mov qword [rbp + 0x220], rax
mov r12, rcx
xor esi, esi
mov edi, esi
mov dword [rsp + 0x50], esi
mov edx, 0x104
lea rcx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x140005d75
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.Failed_to_get_Windows_directory__err_d__n
lea rcx, [rbp - 0x18]
call fcn.140001060
nop
mov rdx, rax
lea rcx, [rbp - 0x50]
call qword [sym.imp.VBoxRT.dll_public:_void___cdecl_RTCError::constructor_class_RTCString_const____ptr64____ptr64]
lea rdx, [0x14000ff28]
lea rcx, [rbp - 0x50]
call sub.MSVCR100.dll__CxxThrowException
nop
cmp eax, 0x104
jle 0x140005dae
mov r8d, eax
lea rdx, str.Failed_to_get_Windows_directory__needed__d_byte_buffer__n
lea rcx, [rbp - 0x18]
call fcn.140001060
nop
mov rdx, rax
lea rcx, [rbp - 0x50]
call qword [sym.imp.VBoxRT.dll_public:_void___cdecl_RTCError::constructor_class_RTCString_const____ptr64____ptr64]
lea rdx, [0x14000ff28]
lea rcx, [rbp - 0x50]
call sub.MSVCR100.dll__CxxThrowException
nop
lea r8, [rbp + 0x10]
lea rdx, str._ls_inf
lea rcx, [rbp - 0x78]
call fcn.140001060
nop
mov ecx, 0x28
call sub.MSVCR100.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov r13, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x140005e19
lea rcx, [rbp - 0x78]
call qword [sym.imp.VBoxRT.dll_public:_char_const____ptr64___cdecl_RTCString::c_str_void_const___ptr64]
lea rdx, str.setupapi.app.log
mov rcx, rax
call qword [sym.imp.VBoxRT.dll_RTPathJoinA]
mov rbx, rax
mov qword [rsp + 0x58], rax
mov edi, 1
mov dword [rsp + 0x50], edi
lea r8, str.setupapi.app.log
mov rdx, rax
mov rcx, r13
call fcn.140001600
jmp 0x140005e21
mov rax, rsi
mov rbx, qword [rsp + 0x58]
xor r8d, r8d
mov rdx, rax
mov rcx, r12
call fcn.1400028c0
nop
test dil, 1
je 0x140005e46
and edi, 0xfffffffe
mov dword [rsp + 0x50], edi
mov rcx, rbx
call qword [sym.imp.VBoxRT.dll_RTStrFree]
mov ecx, 0x28
call sub.MSVCR100.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov r13, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x140005e9a
lea rcx, [rbp - 0x78]
call qword [sym.imp.VBoxRT.dll_public:_char_const____ptr64___cdecl_RTCString::c_str_void_const___ptr64]
lea rdx, str.setupapi.dev.log
mov rcx, rax
call qword [sym.imp.VBoxRT.dll_RTPathJoinA]
mov rbx, rax
mov qword [rsp + 0x58], rax
or edi, 2
mov dword [rsp + 0x50], edi
lea r8, str.setupapi.dev.log
mov rdx, rax
mov rcx, r13
call fcn.140001600
jmp 0x140005ea2
mov rax, rsi
mov rbx, qword [rsp + 0x58]
xor r8d, r8d
mov rdx, rax
mov rcx, r12
call fcn.1400028c0
nop
test dil, 2
je 0x140005ec7
and edi, 0xfffffffd
mov dword [rsp + 0x50], edi
mov rcx, rbx
call qword [sym.imp.VBoxRT.dll_RTStrFree]
mov ecx, 0x1028
call sub.MSVCR100.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov rbx, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x140005ef9
lea rdx, str.NetworkAdapters
mov rcx, rax
call fcn.140001420
lea r11, vtable.BugReportNetworkAdaptersWin.0
mov qword [rbx], r11
jmp 0x140005efc
mov rbx, rsi
xor r8d, r8d
mov rdx, rbx
mov rcx, r12
call fcn.1400028c0
lea r8, [rbp + 0x10]
lea rdx, str._ls_System32
lea rcx, [rsp + 0x68]
call fcn.140001060
nop
mov ecx, 0x1128
call sub.MSVCR100.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov r13, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x140005f81
lea rcx, [rsp + 0x68]
call qword [sym.imp.VBoxRT.dll_public:_char_const____ptr64___cdecl_RTCString::c_str_void_const___ptr64]
lea rdx, str.ipconfig.exe
mov rcx, rax
call qword [sym.imp.VBoxRT.dll_RTPathJoinA]
mov rbx, rax
mov qword [rsp + 0x58], rax
or edi, 4
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x20], rsi
lea r9, str._all
mov r8, rax
lea rdx, str.IpConfig
mov rcx, r13
call fcn.1400016c0
jmp 0x140005f89
mov rax, rsi
mov rbx, qword [rsp + 0x58]
xor r8d, r8d
mov rdx, rax
mov rcx, r12
call fcn.1400028c0
nop
test dil, 4
je 0x140005fae
and edi, 0xfffffffb
mov dword [rsp + 0x50], edi
mov rcx, rbx
call qword [sym.imp.VBoxRT.dll_RTStrFree]
mov ecx, 0x1128
call sub.MSVCR100.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov r13, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x14000600f
lea rcx, [rsp + 0x68]
call qword [sym.imp.VBoxRT.dll_public:_char_const____ptr64___cdecl_RTCString::c_str_void_const___ptr64]
lea rdx, str.netstat.exe
mov rcx, rax
call qword [sym.imp.VBoxRT.dll_RTPathJoinA]
mov rbx, rax
mov qword [rsp + 0x58], rax
or edi, 8
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x20], rsi
lea r9, [0x14000c324]
mov r8, rax
lea rdx, str.RouteTable
mov rcx, r13
call fcn.1400016c0
jmp 0x140006017
mov rax, rsi
mov rbx, qword [rsp + 0x58]
xor r8d, r8d
mov rdx, rax
mov rcx, r12
call fcn.1400028c0
nop
test dil, 8
je 0x14000603c
and edi, 0xfffffff7
mov dword [rsp + 0x50], edi
mov rcx, rbx
call qword [sym.imp.VBoxRT.dll_RTStrFree]
mov ecx, 0x1128
call sub.MSVCR100.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov r13, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x1400060b5
lea rcx, [rsp + 0x68]
call qword [sym.imp.VBoxRT.dll_public:_char_const____ptr64___cdecl_RTCString::c_str_void_const___ptr64]
lea rdx, str.wevtutil.exe
mov rcx, rax
call qword [sym.imp.VBoxRT.dll_RTPathJoinA]
mov rbx, rax
mov qword [rsp + 0x58], rax
or edi, 0x10
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x30], rsi
lea rax, str._q:_System_Provider__NameVBoxUSBMon_or__NameVBoxNetLwf___
mov qword [rsp + 0x28], rax
lea rax, str.System
mov qword [rsp + 0x20], rax
lea r9, [0x14000c2a8]
mov r8, rbx
lea rdx, str.SystemEvents
mov rcx, r13
call fcn.1400016c0
jmp 0x1400060bd
mov rax, rsi
mov rbx, qword [rsp + 0x58]
xor r8d, r8d
mov rdx, rax
mov rcx, r12
call fcn.1400028c0
nop
test dil, 0x10
je 0x1400060e2
and edi, 0xffffffef
mov dword [rsp + 0x50], edi
mov rcx, rbx
call qword [sym.imp.VBoxRT.dll_RTStrFree]
mov ecx, 0x1128
call sub.MSVCR100.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov r13, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x14000615b
lea rcx, [rsp + 0x68]
call qword [sym.imp.VBoxRT.dll_public:_char_const____ptr64___cdecl_RTCString::c_str_void_const___ptr64]
lea rdx, str.wbem_wmic.exe
mov rcx, rax
call qword [sym.imp.VBoxRT.dll_RTPathJoinA]
mov rbx, rax
mov qword [rsp + 0x58], rax
or edi, 0x20
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x30], rsi
lea rax, str.brief
mov qword [rsp + 0x28], rax
lea rax, str.list
mov qword [rsp + 0x20], rax
lea r9, [0x14000c278]
mov r8, rbx
lea rdx, str.UpdateHistory
mov rcx, r13
call fcn.1400016c0
jmp 0x140006163
mov rax, rsi
mov rbx, qword [rsp + 0x58]
xor r8d, r8d
mov rdx, rax
mov rcx, r12
call fcn.1400028c0
nop
test dil, 0x20
je 0x140006188
and edi, 0xffffffdf
mov dword [rsp + 0x50], edi
mov rcx, rbx
call qword [sym.imp.VBoxRT.dll_RTStrFree]
mov ecx, 0x1128
call sub.MSVCR100.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov r13, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x140006219
lea rcx, [rsp + 0x68]
call qword [sym.imp.VBoxRT.dll_public:_char_const____ptr64___cdecl_RTCString::c_str_void_const___ptr64]
lea rdx, str.sc.exe
mov rcx, rax
call qword [sym.imp.VBoxRT.dll_RTPathJoinA]
mov rbx, rax
mov qword [rsp + 0x58], rax
or edi, 0x40
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x40], rsi
lea rax, [0x14000c258]
mov qword [rsp + 0x38], rax
lea rax, str.state
mov qword [rsp + 0x30], rax
lea rax, str.driver
mov qword [rsp + 0x28], rax
lea rax, str.type
mov qword [rsp + 0x20], rax
lea r9, str.query
mov r8, rbx
lea rdx, str.DriverServices
mov rcx, r13
call fcn.1400016c0
jmp 0x140006221
mov rax, rsi
mov rbx, qword [rsp + 0x58]
xor r8d, r8d
mov rdx, rax
mov rcx, r12
call fcn.1400028c0
nop
test dil, 0x40
je 0x140006246
and edi, 0xffffffbf
mov dword [rsp + 0x50], edi
mov rcx, rbx
call qword [sym.imp.VBoxRT.dll_RTStrFree]
mov ecx, 0x1128
call sub.MSVCR100.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov r13, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x1400062a8
lea rcx, [rsp + 0x68]
call qword [sym.imp.VBoxRT.dll_public:_char_const____ptr64___cdecl_RTCString::c_str_void_const___ptr64]
lea rdx, str.pnputil.exe
mov rcx, rax
call qword [sym.imp.VBoxRT.dll_RTPathJoinA]
mov rbx, rax
mov qword [rsp + 0x58], rax
bts edi, 7
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x20], rsi
lea r9, [0x14000c214]
mov r8, rax
lea rdx, str.DriverStore
mov rcx, r13
call fcn.1400016c0
jmp 0x1400062b0
mov rax, rsi
mov rbx, qword [rsp + 0x58]
xor r8d, r8d
mov rdx, rax
mov rcx, r12
call fcn.1400028c0
nop
test dil, dil
jns 0x1400062d5
btr edi, 7
mov dword [rsp + 0x50], edi
mov rcx, rbx
call qword [sym.imp.VBoxRT.dll_RTStrFree]
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call sub.MSVCR100.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov r13, rax
mov qword [rsp + 0x60], rax
lea r15, vtable.BugReportFilterRegistryWin.0
test rax, rax
je 0x140006301
mov rcx, rax
call fcn.1400012e0
mov qword [r13], r15
jmp 0x140006304
mov r13, rsi
mov ecx, 0x2128
call sub.MSVCR100.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov r14, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x140006372
lea rcx, [rsp + 0x68]
call qword [sym.imp.VBoxRT.dll_public:_char_const____ptr64___cdecl_RTCString::c_str_void_const___ptr64]
lea rdx, str.reg.exe
mov rcx, rax
call qword [sym.imp.VBoxRT.dll_RTPathJoinA]
mov rbx, rax
mov qword [rsp + 0x58], rax
bts edi, 8
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x28], rsi
lea rax, str.HKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumRootNET
mov qword [rsp + 0x20], rax
lea r9, str.export
mov r8, rbx
lea rdx, str.RegDevKeys
mov rcx, r14
call fcn.140001a00
jmp 0x14000637a
mov rax, rsi
mov rbx, qword [rsp + 0x58]
mov r8, r13
mov rdx, rax
mov rcx, r12
call fcn.1400028c0
nop
bt edi, 8
jae 0x1400063a0
btr edi, 8
mov dword [rsp + 0x50], edi
mov rcx, rbx
call qword [sym.imp.VBoxRT.dll_RTStrFree]
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call sub.MSVCR100.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov r13, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x1400063c5
mov rcx, rax
call fcn.1400012e0
mov qword [r13], r15
jmp 0x1400063c8
mov r13, rsi
mov ecx, 0x2128
call sub.MSVCR100.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov r14, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x140006436
lea rcx, [rsp + 0x68]
call qword [sym.imp.VBoxRT.dll_public:_char_const____ptr64___cdecl_RTCString::c_str_void_const___ptr64]
lea rdx, str.reg.exe
mov rcx, rax
call qword [sym.imp.VBoxRT.dll_RTPathJoinA]
mov rbx, rax
mov qword [rsp + 0x58], rax
bts edi, 9
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x28], rsi
lea rax, str.HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002BE10318
mov qword [rsp + 0x20], rax
lea r9, str.export
mov r8, rbx
lea rdx, str.RegDrvKeys
mov rcx, r14
call fcn.140001a00
jmp 0x14000643e
mov rax, rsi
mov rbx, qword [rsp + 0x58]
mov r8, r13
mov rdx, rax
mov rcx, r12
call fcn.1400028c0
nop
bt edi, 9
jae 0x140006464
btr edi, 9
mov dword [rsp + 0x50], edi
mov rcx, rbx
call qword [sym.imp.VBoxRT.dll_RTStrFree]
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call sub.MSVCR100.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov r13, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x140006489
mov rcx, rax
call fcn.1400012e0
mov qword [r13], r15
jmp 0x14000648c
mov r13, rsi
mov ecx, 0x2128
call sub.MSVCR100.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov r14, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x1400064fa
lea rcx, [rsp + 0x68]
call qword [sym.imp.VBoxRT.dll_public:_char_const____ptr64___cdecl_RTCString::c_str_void_const___ptr64]
lea rdx, str.reg.exe
mov rcx, rax
call qword [sym.imp.VBoxRT.dll_RTPathJoinA]
mov rbx, rax
mov qword [rsp + 0x58], rax
bts edi, 0xa
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x28], rsi
lea rax, str.HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlNetwork
mov qword [rsp + 0x20], rax
lea r9, str.export
mov r8, rbx
lea rdx, str.RegNetwork
mov rcx, r14
call fcn.140001a00
jmp 0x140006502
mov rax, rsi
mov rbx, qword [rsp + 0x58]
mov r8, r13
mov rdx, rax
mov rcx, r12
call fcn.1400028c0
nop
bt edi, 0xa
jae 0x140006528
btr edi, 0xa
mov dword [rsp + 0x50], edi
mov rcx, rbx
call qword [sym.imp.VBoxRT.dll_RTStrFree]
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call sub.MSVCR100.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov r13, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x14000654d
mov rcx, rax
call fcn.1400012e0
mov qword [r13], r15
jmp 0x140006550
mov r13, rsi
mov ecx, 0x2128
call sub.MSVCR100.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov r14, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x1400065be
lea rcx, [rsp + 0x68]
call qword [sym.imp.VBoxRT.dll_public:_char_const____ptr64___cdecl_RTCString::c_str_void_const___ptr64]
lea rdx, str.reg.exe
mov rcx, rax
call qword [sym.imp.VBoxRT.dll_RTPathJoinA]
mov rbx, rax
mov qword [rsp + 0x58], rax
bts edi, 0xb
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x28], rsi
lea rax, str.HKEY_LOCAL_MACHINESOFTWAREClassesCLSIDf374d1a0_bf08_4bdc_9cb2_c15ddaeef955
mov qword [rsp + 0x20], rax
lea r9, str.export
mov r8, rbx
lea rdx, str.RegNetFltNobj
mov rcx, r14
call fcn.140001a00
jmp 0x1400065c6
mov rax, rsi
mov rbx, qword [rsp + 0x58]
mov r8, r13
mov rdx, rax
mov rcx, r12
call fcn.1400028c0
nop
bt edi, 0xb
jae 0x1400065e4
mov rcx, rbx
call qword [sym.imp.VBoxRT.dll_RTStrFree]
mov ecx, 0x1040
call sub.MSVCR100.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov qword [rsp + 0x60], rax
test rax, rax
je 0x140006602
mov rcx, rax
call fcn.1400050a0
jmp 0x140006605
mov rax, rsi
xor r8d, r8d
mov rdx, rax
mov rcx, r12
call fcn.1400028c0
mov ecx, 0x1058
call sub.MSVCR100.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov qword [rsp + 0x60], rax
test rax, rax
je 0x140006632
mov rcx, rax
call fcn.140005b60
mov rsi, rax
xor r8d, r8d
mov rdx, rsi
mov rcx, r12
call fcn.1400028c0
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.VBoxRT.dll_public_virtual:_void___cdecl_RTCString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x78]
call qword [sym.imp.VBoxRT.dll_public_virtual:_void___cdecl_RTCString::destructor_void____ptr64]
mov rcx, qword [rbp + 0x220]
xor rcx, rsp
call fcn.1400074d0
lea r11, [rsp + 0x330]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret