Function at 0x140027210
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x14033c140]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov r13, rcx
mov qword [rsp + 0x48], rcx
xor r12d, r12d
mov dword [rsp + 0x40], r12d
mov qword [rsp + 0x50], r12
lea r9, [rsp + 0x50]
xor r8d, r8d
xor edx, edx
lea rcx, [0x140301a80]
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
mov ebx, eax
xorps xmm0, xmm0
movups xmmword [r13], xmm0
mov qword [r13 + 0x10], r12
mov qword [r13 + 0x18], r12
mov rdx, qword [rsp + 0x50]
mov r15, 0xffffffffffffffff
mov r8, r15
inc r8
cmp word [rdx + r8*2], r12w
jne 0x140027295
mov rcx, r13
call fcn.14008b1e0
mov dword [rsp + 0x40], 1
call fcn.140256c20
test ebx, ebx
js 0x1400272c8
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x14002760b
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x140027368
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x140027368
mov r14d, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r11d
lea rcx, [r14 + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
mov r10d, 0xd1b186ea
movzx ecx, byte [r9]
inc r9
test cl, cl
je 0x140027363
nop
movsx edx, cl
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
movzx ecx, byte [r9]
lea r9, [r9 + 1]
test cl, cl
jne 0x140027330
cmp r10d, 0xc8d8fe67
je 0x140027370
test r11d, r11d
jne 0x140027310
mov rax, qword [rax]
jmp 0x1400272e0
mov ecx, dword [rsi + 0x24]
add rcx, rbx
movzx edx, word [rcx + r11*2]
mov ecx, dword [rsi + 0x1c]
add rcx, rbx
mov eax, dword [rcx + rdx*4]
add rax, rbx
mov edx, 0x104
lea rcx, [rsp + 0x60]
call rax
test eax, eax
jne 0x14002751d
mov ecx, reloc.WLDAP32.dll_Ordinal_35
mov dword [rsp + 0x20], 0x20023
mov r9d, 2
mov dword [rsp + 0x24], 0x720000
mov ebx, WSACleanup
mov dword [rsp + 0x28], 0x800000
mov r8d, 0x80
mov dword [rsp + 0x30], 0x59310000
mov r14b, 0x59
mov r11b, Ordinal_50
mov dword [rsp + 0x34], 0x3050031
xor sil, sil
mov dil, 5
mov r10b, 3
mov word [rsp + 0x38], 0x59
movzx edx, r11b
xor dx, cx
xor cl, cl
nop dword [rax + rax]
movzx eax, r9w
shr ax, cl
test al, 1
jne 0x140027414
inc cl
cmp cl, 4
jne 0x140027400
jmp 0x14002741e
movzx edx, dx
movzx eax, r10b
btc edx, eax
movzx ecx, dil
movzx eax, r12w
shr ax, cl
test al, 1
jne 0x140027436
inc cl
cmp cl, 8
jne 0x140027422
jmp 0x140027440
movzx edx, dx
movzx eax, dil
btc edx, eax
xor cl, cl
movzx eax, r12w
shr ax, cl
test al, 1
jne 0x140027456
inc cl
cmp cl, dil
jne 0x140027442
jmp 0x140027460
movzx edx, dx
movzx eax, sil
btc edx, eax
movzx eax, r14b
xor ax, dx
mov word [rsp + 0x2c], ax
movzx edx, r11b
add dx, 3
xor dx, bx
xor cl, cl
nop dword [rax]
movzx eax, r12w
shr ax, cl
test al, 1
jne 0x140027494
inc cl
cmp cl, 4
jne 0x140027480
jmp 0x14002749e
movzx edx, dx
movzx eax, r10b
btc edx, eax
movzx ecx, dil
movzx eax, r8w
shr ax, cl
test al, 1
jne 0x1400274b6
inc cl
cmp cl, 8
jne 0x1400274a2
jmp 0x1400274c0
movzx edx, dx
movzx eax, dil
btc edx, eax
xor cl, cl
movzx eax, r8w
shr ax, cl
test al, 1
jne 0x1400274d6
inc cl
cmp cl, dil
jne 0x1400274c2
jmp 0x1400274e0
movzx edx, dx
movzx eax, sil
btc edx, eax
movzx eax, r14b
add ax, 3
xor ax, dx
mov word [rsp + 0x2e], ax
lea rax, [rsp + 0x2c]
mov r8, r15
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140027500
lea rdx, [rsp + 0x2c]
mov rcx, r13
call fcn.14008b650
jmp 0x14002760b
xor r8d, r8d
lea rdx, [0x14031ce4c]
mov rcx, r13
call fcn.14008b650
movzx edx, word [rsp + 0x60]
mov rcx, r13
call fcn.1400894f0
mov r8d, 0x65
mov dword [rsp + 0x20], r8d
mov r9d, 0x90
mov word [rsp + 0x24], r9w
mov dword [rsp + 0x28], 0x4fd10000
mov dil, reloc.WLDAP32.dll_Ordinal_79
mov cl, Ordinal_50
mov dword [rsp + 0x2c], 0x3050031
xor bl, bl
mov r11b, 5
mov r10b, 3
mov word [rsp + 0x30], 0x59
movzx edx, cl
xor dx, r8w
xor cl, cl
movzx eax, r12w
shr ax, cl
test al, 1
jne 0x140027594
inc cl
cmp cl, 4
jne 0x140027580
jmp 0x14002759e
movzx edx, dx
movzx eax, r10b
btc edx, eax
movzx ecx, r11b
movzx eax, r9w
shr ax, cl
test al, 1
jne 0x1400275b6
inc cl
cmp cl, 8
jne 0x1400275a2
jmp 0x1400275c0
movzx edx, dx
movzx eax, r11b
btc edx, eax
xor cl, cl
movzx eax, r9w
shr ax, cl
test al, 1
jne 0x1400275d6
inc cl
cmp cl, r11b
jne 0x1400275c2
jmp 0x1400275df
movzx edx, dx
movzx eax, bl
btc edx, eax
movzx eax, dil
xor ax, dx
mov word [rsp + 0x26], ax
lea rax, [rsp + 0x26]
mov r8, r15
inc r8
cmp word [rax + r8*2], 0
jne 0x1400275f3
lea rdx, [rsp + 0x26]
mov rcx, r13
call fcn.14008bbe0
mov r8d, Ordinal_217
mov dword [rsp + 0x20], r8d
mov r9d, reloc.WS2_32.dll_recv
mov word [rsp + 0x24], r9w
mov dword [rsp + 0x28], 0x59310000
mov dil, 0x59
mov cl, 0xd1
mov dword [rsp + 0x2c], 0x30500d1
xor bl, bl
mov r11b, 5
mov r10b, 3
mov word [rsp + 0x30], reloc.WLDAP32.dll_Ordinal_79
movzx edx, cl
xor dx, r8w
xor cl, cl
nop
movzx eax, r12w
shr ax, cl
test al, 1
jne 0x140027664
inc cl
cmp cl, 4
jne 0x140027650
jmp 0x14002766e
movzx edx, dx
movzx eax, r10b
btc edx, eax
movzx ecx, r11b
movzx eax, r9w
shr ax, cl
test al, 1
jne 0x140027686
inc cl
cmp cl, 8
jne 0x140027672
jmp 0x140027690
movzx edx, dx
movzx eax, r11b
btc edx, eax
xor cl, cl
movzx eax, r9w
shr ax, cl
test al, 1
jne 0x1400276a6
inc cl
cmp cl, r11b
jne 0x140027692
jmp 0x1400276af
movzx edx, dx
movzx eax, bl
btc edx, eax
movzx eax, dil
xor ax, dx
mov word [rsp + 0x26], ax
lea rax, [rsp + 0x26]
inc r15
cmp word [rax + r15*2], 0
jne 0x1400276c0
mov r8, r15
lea rdx, [rsp + 0x26]
mov rcx, r13
call fcn.14008bbe0
mov rax, r13
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.1402bd6f0
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret