Function at 0x1400185d0
Capabilities:
Get common file path
Get startup folder

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2a0
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x1400f6bd8]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov rbp, rcx
mov qword [rsp + 0x70], rcx
lea rcx, [rsp + 0x50]
call fcn.140069d58
nop
call fcn.14006628c
mov rcx, rax
xor esi, esi
mov edx, esi
test rax, rax
setne dl
test edx, edx
jne 0x14001863e
mov ecx, 0x80004005
call fcn.140001950
int3
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x38], rbx
mov word [rsp + 0x80], 0
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x82]
call fcn.140096180
lea rdx, [rsp + 0x80]
mov qword [rsp + 0x20], rdx
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x23]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
xor eax, eax
or r12, 0xffffffffffffffff
mov rcx, r12
lea rdi, [rsp + 0x80]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
test ecx, ecx
jne 0x14001870c
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x140018799
cmp dword [rdx + 0x10], eax
jge 0x1400186dd
cmp dword [rbx - 0xc], eax
jge 0x1400186d2
mov ecx, 0x80070057
call fcn.140001950
int3
mov dword [rbx - 0x10], esi
mov word [rbx], ax
jmp 0x140018799
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400186f5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x38], rbx
jmp 0x140018799
mov r13d, dword [rbx - 0x10]
lea r14, [rsp + 0x80]
sub r14, rbx
sar r14, 1
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x140018740
mov edx, edi
lea rcx, [rsp + 0x38]
call fcn.140001970
mov rbx, qword [rsp + 0x38]
cmp r14, r13
ja 0x140018760
movsxd rax, edi
lea r13, [rax + rax]
lea r8, [rbx + r14*2]
mov r9, r13
mov rdx, r13
mov rcx, rbx
call fcn.140091600
jmp 0x14001877d
movsxd rax, edi
lea r13, [rax + rax]
mov r9, r13
lea r8, [rsp + 0x80]
mov rdx, r13
mov rcx, rbx
call fcn.140091de0
test edi, edi
js 0x140018928
cmp edi, dword [rbx - 0xc]
jg 0x140018928
mov dword [rbx - 0x10], edi
mov word [r13 + rbx], 0
xor eax, eax
mov rcx, r12
lea r14, str._rtkhdaud.dat
mov rdi, r14
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov qword [rsp + 0x48], rcx
mov r13, r14
sub r13, rbx
sar r13, 1
mov r15d, dword [rbx - 0x10]
lea edi, [r15 + rcx]
mov edx, 1
sub edx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, edx
jge 0x1400187ef
mov edx, edi
lea rcx, [rsp + 0x38]
call fcn.140001970
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
cmp r13, r15
ja 0x1400187f8
lea r14, [rbx + r13*2]
movsxd rdx, ecx
add rdx, rdx
lea rcx, [rbx + r15*2]
mov r9, rdx
mov r8, r14
call fcn.140091de0
test edi, edi
js 0x14001891d
cmp edi, dword [rbx - 0xc]
jg 0x14001891d
mov dword [rbx - 0x10], edi
movsxd rax, edi
mov word [rbx + rax*2], 0
xor r9d, r9d
mov r8d, 0x9001
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.14006a68c
test eax, eax
je 0x1400188ce
mov rax, qword [rbp]
cmp dword [rax - 0x10], 0
jle 0x1400188c3
mov r9d, 2
mov r8d, esi
lea rdx, [rsp + 0x40]
mov rcx, rbp
call fcn.140010ac0
nop
xor edx, edx
lea r8d, [rdx + 0x10]
mov rdi, qword [rsp + 0x40]
mov rcx, rdi
call fcn.1400935d0
mov byte [rsp + 0x30], al
mov r8d, 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.1400699d8
nop
lea rdx, [rdi - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400188b2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add esi, 2
mov rax, qword [rbp]
cmp esi, dword [rax - 0x10]
jl 0x140018852
mov rbx, qword [rsp + 0x38]
lea rcx, [rsp + 0x50]
call fcn.140069cd0
nop
lea rdx, [rbx - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400188eb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x50]
call fcn.140069fc4
nop
mov rdx, qword [rbp]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], r12d
add r12d, 0xffffffff
test r12d, r12d
jg 0x140018916
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, 1
jmp 0x140018933
mov ecx, 0x80070057
call fcn.140001950
int3
mov ecx, 0x80070057
call fcn.140001950
nop
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.140091dc0
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret