Function at 0x14000827a
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rsi, qword [0x14000b018]
mov r8, qword [rsi + 0x24]
test edx, edx
jns 0x1400082a8
mov rax, qword [0x14000b748]
mov rax, qword [rax]
not edx
mov edx, dword [rax + rdx*4]
movsxd rdx, edx
lea rbx, [0x14003e850]
mov rax, rcx
sub rax, rbx
setae r9b
cmp rax, 0x1000
setb al
xor r10d, r10d
test r9b, al
mov rdi, rbx
cmovne rdi, rcx
cmove r10, rcx
movzx eax, word [r8 + rdx*2]
test ax, ax
mov qword [rsp + 0x40], r10
je 0x14000856b
mov rcx, rdi
sub rcx, rbx
cmp rcx, 0x7ff
jg 0x14000856b
lea r14, [r8 + rdx*2]
mov r15d, 0x8000
mov r13, qword [0x14000b010]
cmp ax, 3
ja 0x14000839a
movzx edx, byte [r14 + 3]
and edx, 0x7f
shl rdx, 7
movzx ecx, byte [r14 + 2]
mov r12d, ecx
and r12d, 0x7f
or r12, rdx
mov dword [rsp + 0x34], ecx
mov edx, ecx
or edx, r15d
mov dword [rsp + 0x30], edx
movzx ebp, word [r14 + 2]
shr ebp, 8
mov dword [rsp + 0x3c], ebp
mov edx, ebp
or edx, r15d
mov dword [rsp + 0x38], edx
cmp ax, 1
je 0x1400083bb
movzx eax, ax
cmp eax, 3
je 0x1400083ce
cmp eax, 2
jne 0x14000853c
movzx eax, cx
cmp eax, 0x80
jae 0x1400083ed
cmp cl, 0x24
je 0x140008464
cmp eax, 0x25
jne 0x140008477
mov rcx, rdi
mov edx, 0x400
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x140008519
cmp ax, 4
jne 0x1400083ab
movzx eax, word [r14 + 2]
add r14, 4
jmp 0x1400083af
add r14, 2
mov word [rdi], ax
add rdi, 2
jmp 0x14000854f
not r12d
mov rcx, rdi
mov edx, r12d
call fcn.14000827a
jmp 0x14000853c
cmp r12d, 0x1d
jne 0x140008431
mov r8, qword [r13]
mov rcx, rdi
lea rdx, [0x14000b594]
call qword [sym.imp.USER32.dll_wsprintfW]
jmp 0x14000853c
mov r8d, ecx
and r8d, 0x3f
add r8, r8
add r8, qword [rsi + 0x24]
and ecx, 0x40
mov dword [rsp + 0x20], ecx
mov rcx, 0xffffffff80000002
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersion
mov r9, rdi
call fcn.1400080da
cmp word [rdi], 0
jne 0x140008519
mov rcx, rdi
mov edx, ebp
call fcn.14000827a
jmp 0x140008519
mov rdx, r12
shl rdx, 0xb
lea rax, [section..ndata]
add rdx, rax
mov rcx, rdi
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
lea eax, [r12 - 0x15]
cmp eax, 6
jbe 0x140008534
jmp 0x14000853c
mov rcx, rdi
mov edx, 0x400
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x140008519
xor eax, eax
mov rcx, qword [0x14000b2b8]
cmp dword [rcx + 4], 0
setne al
lea rsi, [rax + rax]
add rsi, 2
mov ebp, dword [rsp + rsi*4 + 0x2c]
mov rax, qword [0x14000b750]
mov rax, qword [rax]
test rax, rax
je 0x1400084bc
mov edx, ebp
and edx, 0xffffffbf
mov rcx, qword [r13]
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor r9d, r9d
call rax
test eax, eax
je 0x14000850e
mov r12d, ebp
and r12d, 0x8000
mov ecx, 4
call fcn.1400074fa
mov rcx, qword [r13]
and ebp, 0xbf
mov edx, ebp
mov r8d, r12d
call rax
test rax, rax
je 0x140008504
mov r12, rax
mov rcx, rax
mov rdx, rdi
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov ebp, eax
mov rcx, r12
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test ebp, ebp
jne 0x14000850e
mov word [rdi], 0
dec rsi
jne 0x14000848f
mov ebp, dword [rsp + 0x3c]
mov rsi, qword [0x14000b018]
cmp word [rdi], 0
je 0x140008534
cmp ebp, 0x1a
jne 0x140008534
mov rcx, rdi
lea rdx, str.MicrosoftInternet_ExplorerQuick_Launch
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rcx, rdi
call fcn.140007c02
add r14, 4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cdqe
lea rdi, [rdi + rax*2]
movzx eax, word [r14]
test ax, ax
je 0x14000856b
mov rcx, rdi
sub rcx, rbx
cmp rcx, 0x800
jl 0x14000830d
mov word [rdi], 0
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14000859e
lea rdx, [0x14003e850]
mov r8d, 0x400
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_lstrcpynW]
lea rax, [0x14003e850]
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret