Function at 0x140018160
Capabilities:
Get common file path
Get startup folder

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2a0
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x1400f0bc8]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov rbp, rcx
mov qword [rsp + 0x70], rcx
lea rcx, [rsp + 0x50]
call fcn.140065118
nop
call fcn.140062978
mov rcx, rax
xor esi, esi
mov edx, esi
test rax, rax
setne dl
test edx, edx
jne 0x1400181ce
mov ecx, 0x80004005
call fcn.140001950
int3
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x38], rbx
mov word [rsp + 0x80], 0
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x82]
call fcn.1400926c0
lea rdx, [rsp + 0x80]
mov qword [rsp + 0x20], rdx
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x23]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
xor eax, eax
or r12, 0xffffffffffffffff
mov rcx, r12
lea rdi, [rsp + 0x80]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
test ecx, ecx
jne 0x14001829c
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x140018329
cmp dword [rdx + 0x10], eax
jge 0x14001826d
cmp dword [rbx - 0xc], eax
jge 0x140018262
mov ecx, 0x80070057
call fcn.140001950
int3
mov dword [rbx - 0x10], esi
mov word [rbx], ax
jmp 0x140018329
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140018285
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x38], rbx
jmp 0x140018329
mov r13d, dword [rbx - 0x10]
lea r14, [rsp + 0x80]
sub r14, rbx
sar r14, 1
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x1400182d0
mov edx, edi
lea rcx, [rsp + 0x38]
call fcn.140001970
mov rbx, qword [rsp + 0x38]
cmp r14, r13
ja 0x1400182f0
movsxd rax, edi
lea r13, [rax + rax]
lea r8, [rbx + r14*2]
mov r9, r13
mov rdx, r13
mov rcx, rbx
call fcn.14008dcf0
jmp 0x14001830d
movsxd rax, edi
lea r13, [rax + rax]
mov r9, r13
lea r8, [rsp + 0x80]
mov rdx, r13
mov rcx, rbx
call fcn.14008e4d0
test edi, edi
js 0x1400184b8
cmp edi, dword [rbx - 0xc]
jg 0x1400184b8
mov dword [rbx - 0x10], edi
mov word [r13 + rbx], 0
xor eax, eax
mov rcx, r12
lea r14, str._rtkhdaud.dat
mov rdi, r14
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov qword [rsp + 0x48], rcx
mov r13, r14
sub r13, rbx
sar r13, 1
mov r15d, dword [rbx - 0x10]
lea edi, [r15 + rcx]
mov edx, 1
sub edx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, edx
jge 0x14001837f
mov edx, edi
lea rcx, [rsp + 0x38]
call fcn.140001970
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
cmp r13, r15
ja 0x140018388
lea r14, [rbx + r13*2]
movsxd rdx, ecx
add rdx, rdx
lea rcx, [rbx + r15*2]
mov r9, rdx
mov r8, r14
call fcn.14008e4d0
test edi, edi
js 0x1400184ad
cmp edi, dword [rbx - 0xc]
jg 0x1400184ad
mov dword [rbx - 0x10], edi
movsxd rax, edi
mov word [rbx + rax*2], 0
xor r9d, r9d
mov r8d, 0x9001
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.140065a4c
test eax, eax
je 0x14001845e
mov rax, qword [rbp]
cmp dword [rax - 0x10], 0
jle 0x140018453
mov r9d, 2
mov r8d, esi
lea rdx, [rsp + 0x40]
mov rcx, rbp
call fcn.1400109e0
nop
xor edx, edx
lea r8d, [rdx + 0x10]
mov rdi, qword [rsp + 0x40]
mov rcx, rdi
call fcn.14008fcc0
mov byte [rsp + 0x30], al
mov r8d, 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.140064d98
nop
lea rdx, [rdi - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140018442
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add esi, 2
mov rax, qword [rbp]
cmp esi, dword [rax - 0x10]
jl 0x1400183e2
mov rbx, qword [rsp + 0x38]
lea rcx, [rsp + 0x50]
call fcn.140065090
nop
lea rdx, [rbx - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14001847b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x50]
call fcn.140065384
nop
mov rdx, qword [rbp]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], r12d
add r12d, 0xffffffff
test r12d, r12d
jg 0x1400184a6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, 1
jmp 0x1400184c3
mov ecx, 0x80070057
call fcn.140001950
int3
mov ecx, 0x80070057
call fcn.140001950
nop
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.14008e4b0
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret