Function at 0x140026630
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x20
mov r8b, 1
or edx, 0xffffffff
mov rbx, rcx
call 0x140026630
xor r8d, r8d
mov rcx, rbx
mov edx, eax
add rsp, 0x20
pop rbx
jmp 0x140026630
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xc80]
sub rsp, 0xd90
mov qword [rbp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0xde8], rbx
mov rax, qword [0x1401222f0]
xor rax, rsp
mov qword [rbp + 0xc70], rax
movzx edi, r8b
mov byte [rbp - 0x80], r8b
mov ebx, edx
mov dword [rbp - 0x7c], edx
mov r13, rcx
mov ecx, 2
call fcn.1400a82f0
mov qword [rbp - 0x28], rax
xor r14d, r14d
mov word [rax], r14w
lea ecx, [r14 + 2]
call fcn.1400a82f0
mov qword [rbp - 0x18], rax
mov word [rax], r14w
lea ecx, [r14 + 2]
call fcn.1400a82f0
mov qword [rbp - 0x70], rax
mov word [rax], r14w
lea ecx, [r14 + 2]
call fcn.1400a82f0
mov qword [rbp - 0x20], rax
mov word [rax], r14w
mov esi, r14d
mov dword [rbp - 0x78], r14d
lea ecx, [r14 + 2]
call fcn.1400a82f0
mov qword [rbp - 0x10], rax
mov word [rax], r14w
mov edx, 0x208
lea rcx, [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea rcx, [rbp + 0x60]
sub rcx, 2
test dil, dil
jne 0x140026740
nop dword [rax + rax]
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x140026700
movups xmm0, xmmword [str.AutorunsDisabled.ini]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [0x1400d8d48]
movups xmmword [rcx + 0x10], xmm1
movsd xmm0, qword [0x1400d8d58]
movsd qword [rcx + 0x20], xmm0
mov eax, dword [0x1400d8d60]
mov dword [rcx + 0x28], eax
jmp 0x14002675f
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x140026740
movups xmm0, xmmword [str.win.ini]
movups xmmword [rcx], xmm0
movzx eax, word [0x1400d8d78]
mov word [rcx + 0x10], ax
cmp ebx, 0xffffffff
jne 0x1400268ab
lea rcx, [0x1400d1428]
call fcn.1400a8238
mov qword [rbp - 0x38], rax
lea rcx, [0x1400d1428]
call fcn.1400a8238
mov qword [rbp - 0x68], rax
lea rcx, [0x1400d1428]
call fcn.1400a8238
mov qword [rbp - 0x30], rax
lea rcx, [0x1400d1428]
call fcn.1400a8238
mov qword [rbp - 0x40], rax
lea rcx, [0x1400d1428]
call fcn.1400a8238
mov qword [rbp - 0x50], rax
lea rcx, [0x1400d1428]
call fcn.1400a8238
mov qword [rbp - 0x60], rax
lea rcx, [rbp + 0x60]
call fcn.1400a8238
mov qword [rbp - 0x58], rax
lea rcx, [rbp + 0x60]
call fcn.1400a8238
mov qword [rbp - 0x48], rax
mov dword [rsp + 0x80], ebx
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x70], r14
lea rax, [rbp - 0x38]
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x60], 1
mov qword [rsp + 0x58], r14
lea rax, [rbp - 0x68]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x48]
mov qword [rsp + 0x20], rax
xor r9d, r9d
or r8d, ebx
lea edx, [rbx + 3]
mov rcx, r13
call fcn.140004870
mov dword [rbp - 0x7c], eax
mov rcx, qword [rbp - 0x48]
call fcn.1400a82b0
nop
mov rcx, qword [rbp - 0x58]
call fcn.1400a82b0
nop
mov rcx, qword [rbp - 0x60]
call fcn.1400a82b0
nop
mov rcx, qword [rbp - 0x50]
call fcn.1400a82b0
nop
mov rcx, qword [rbp - 0x40]
call fcn.1400a82b0
nop
mov rcx, qword [rbp - 0x30]
call fcn.1400a82b0
nop
mov rcx, qword [rbp - 0x68]
call fcn.1400a82b0
nop
mov rcx, qword [rbp - 0x38]
call fcn.1400a82b0
lea rdx, [0x1400d8d7c]
lea rcx, [rbp + 0x60]
call fcn.1400ab568
mov r12, rax
mov qword [rbp + 0x50], rax
test rax, rax
je 0x140026dc0
mov r8, rax
mov edx, 0x400
lea rcx, [rbp + 0x470]
call fcn.1400ab4a0
test rax, rax
je 0x140026db7
nop dword [rax + rax]
cmp word [rbp + 0x470], 0x5b
jne 0x140026924
mov r8d, 9
lea rdx, str._windows_
lea rcx, [rbp + 0x470]
call fcn.1400a9d30
mov esi, r14d
test eax, eax
sete sil
mov dword [rbp - 0x78], esi
jmp 0x140026d9a
test esi, esi
je 0x140026d9a
mov r8d, 5
lea rdx, str.load
lea rcx, [rbp + 0x470]
call fcn.1400a9d30
test eax, eax
jne 0x140026952
lea rsi, [rbp + 0x47a]
jmp 0x140026978
mov r8d, 4
lea rdx, str.run
lea rcx, [rbp + 0x470]
call fcn.1400a9d30
lea rsi, [rbp + 0x478]
test eax, eax
cmovne rsi, r14
test rsi, rsi
je 0x140026d97
xor edx, edx
mov rcx, rsi
call fcn.1400a9720
mov rbx, rax
cmp rax, rsi
jbe 0x1400269ac
add rbx, 0xfffffffffffffffe
movzx ecx, word [rbx]
call fcn.1400a9388
test eax, eax
je 0x1400269ac
mov word [rbx], r14w
cmp rbx, rsi
ja 0x140026993
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x28], xmm0
mov qword [rbp + 0x38], r14
xor r9d, r9d
lea edx, [r9 + 0x2c]
lea r8, [rbp + 0x28]
mov rcx, rsi
call fcn.140007cc0
mov r15, r14
mov r14, qword [rbp + 0x30]
mov rax, r14
mov rcx, qword [rbp + 0x28]
sub rax, rcx
sar rax, 5
test rax, rax
je 0x140026d2b
xor r14d, r14d
mov r12d, r14d
jmp 0x1400269f4
xor r14d, r14d
lea rdi, [rcx + r12]
mov rbx, qword [rbp - 0x20]
mov rcx, qword [rdi]
call fcn.1400a8238
mov qword [rbp - 0x20], rax
mov rcx, rbx
call fcn.1400a82b0
xor r9d, r9d
mov r8, rdi
mov rdx, r13
lea rcx, [rbp + 0x40]
call fcn.1400058f0
mov rbx, qword [rbp - 0x70]
mov rcx, qword [rax]
call fcn.1400a8238
mov qword [rbp - 0x70], rax
mov rcx, rbx
call fcn.1400a82b0
mov rcx, qword [rbp + 0x40]
call fcn.1400a82b0
mov rdx, qword [rbp - 0x70]
cmp word [rdx], 0
je 0x140026d05
lea r9, [rbp - 0x18]
lea r8, [rbp - 0x28]
mov rcx, r13
call fcn.1400058e0
mov edi, eax
lea rcx, [rbp + 0x60]
call fcn.1400a8238
mov qword [rbp - 0x30], rax
lea rcx, [rbp + 0x60]
call fcn.1400a8238
mov qword [rbp - 0x68], rax
mov rcx, rsi
call fcn.1400a8238
mov qword [rbp - 0x38], rax
lea rax, [rbp + 0x48]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x28]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x30]
lea r8, [rbp - 0x68]
lea rdx, [rbp - 0x38]
mov rcx, r13
call fcn.140004500
movzx ebx, al
mov rcx, qword [rbp - 0x38]
call fcn.1400a82b0
nop
mov rcx, qword [rbp - 0x68]
call fcn.1400a82b0
nop
mov rcx, qword [rbp - 0x30]
call fcn.1400a82b0
test bl, bl
je 0x140026d05
cmp dword [rbp - 0x7c], 0xffffffff
jne 0x140026c3c
lea rcx, [0x1400d1428]
call fcn.1400a8238
mov qword [rbp + 0x10], rax
lea rcx, [0x1400d1428]
call fcn.1400a8238
mov qword [rbp + 0x20], rax
lea rcx, [0x1400d1428]
call fcn.1400a8238
mov qword [rbp - 8], rax
lea rcx, [0x1400d1428]
call fcn.1400a8238
mov qword [rbp - 0x48], rax
lea rcx, [0x1400d1428]
call fcn.1400a8238
mov qword [rbp - 0x58], rax
lea rcx, [0x1400d1428]
call fcn.1400a8238
mov qword [rbp - 0x60], rax
lea rcx, [rbp + 0x60]
call fcn.1400a8238
mov qword [rbp - 0x50], rax
lea rcx, [rbp + 0x60]
call fcn.1400a8238
mov qword [rbp - 0x40], rax
movzx eax, byte [rbp - 0x80]
mov dword [rsp + 0x80], 0xffffffff
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x70], r14
lea rcx, [rbp + 0x10]
mov qword [rsp + 0x68], rcx
mov dword [rsp + 0x60], eax
mov qword [rsp + 0x58], r14
lea rax, [rbp + 0x20]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 8]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x48]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x58]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
or r8d, 0xffffffff
lea edx, [r9 + 2]
mov rcx, r13
call fcn.140004870
mov dword [rbp - 0x7c], eax
mov rcx, qword [rbp - 0x40]
call fcn.1400a82b0
nop
mov rcx, qword [rbp - 0x50]
call fcn.1400a82b0
nop
mov rcx, qword [rbp - 0x60]
call fcn.1400a82b0
nop
mov rcx, qword [rbp - 0x58]
call fcn.1400a82b0
nop
mov rcx, qword [rbp - 0x48]
call fcn.1400a82b0
nop
mov rcx, qword [rbp - 8]
call fcn.1400a82b0
nop
mov rcx, qword [rbp + 0x20]
call fcn.1400a82b0
nop
mov rcx, qword [rbp + 0x10]
call fcn.1400a82b0
lea rcx, [0x1400d1428]
call fcn.1400a8238
mov qword [rbp + 0x18], rax
lea rcx, [rbp + 0x60]
call fcn.1400a8238
mov qword [rbp + 8], rax
mov rcx, rsi
call fcn.1400a8238
mov qword [rbp], rax
movzx eax, byte [rbp - 0x80]
mov dword [rsp + 0x80], 0xffffffff
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x70], r14
lea rcx, [rbp + 0x18]
mov qword [rsp + 0x68], rcx
mov dword [rsp + 0x60], eax
mov rax, qword [rbp + 0x48]
mov qword [rsp + 0x58], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x18]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x28]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 8]
mov qword [rsp + 0x28], rax
lea rax, [rbp]
mov qword [rsp + 0x20], rax
mov r9d, 4
mov r8d, dword [rbp - 0x7c]
mov edx, edi
mov rcx, r13
call fcn.140004870
nop
mov rcx, qword [rbp]
call fcn.1400a82b0
nop
mov rcx, qword [rbp + 8]
call fcn.1400a82b0
nop
mov rcx, qword [rbp + 0x18]
call fcn.1400a82b0
inc r15
add r12, 0x20
mov r14, qword [rbp + 0x30]
mov rax, r14
mov rcx, qword [rbp + 0x28]
sub rax, rcx
sar rax, 5
cmp r15, rax
jb 0x1400269f1
mov r12, qword [rbp + 0x50]
test rcx, rcx
je 0x140026d94
cmp rcx, r14
je 0x140026d8f
lea rdi, [rcx + 8]
xor r15d, r15d
nop dword [rax]
mov rbx, qword [rdi]
test rbx, rbx
je 0x140026d75
mov rsi, qword [rdi + 8]
cmp rbx, rsi
je 0x140026d62
mov rcx, qword [rbx]
call fcn.1400a82b0
add rbx, 8
cmp rbx, rsi
jne 0x140026d51
mov rcx, qword [rdi]
call fcn.1400a7cb8
mov qword [rdi], r15
mov qword [rdi + 8], r15
mov qword [rdi + 0x10], r15
mov rcx, qword [rdi - 8]
call fcn.1400a82b0
add rdi, 0x20
lea rax, [rdi - 8]
cmp rax, r14
jne 0x140026d40
mov rcx, qword [rbp + 0x28]
call fcn.1400a7cb8
xor r14d, r14d
mov esi, dword [rbp - 0x78]
mov r8, r12
mov edx, 0x400
lea rcx, [rbp + 0x470]
call fcn.1400ab4a0
test rax, rax
jne 0x1400268f0
mov rcx, r12
call fcn.1400ab724
nop
mov rcx, qword [rbp - 0x10]
call fcn.1400a82b0
nop
mov rcx, qword [rbp - 0x20]
call fcn.1400a82b0
nop
mov rcx, qword [rbp - 0x70]
call fcn.1400a82b0
nop
mov rcx, qword [rbp - 0x18]
call fcn.1400a82b0
nop
mov rcx, qword [rbp - 0x28]
call fcn.1400a82b0
mov eax, dword [rbp - 0x7c]
mov rcx, qword [rbp + 0xc70]
xor rcx, rsp
call fcn.1400ab140
mov rbx, qword [rsp + 0xde8]
add rsp, 0xd90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp