Function at 0x14007eee0
Capabilities:
Get common file path
Get program files directory
Get startup folder
Query environment variable

Disassembly:
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x18d0]
mov eax, 0x19d0
call fcn.140247340
sub rsp, rax
mov qword [rbp + 0x290], 0xfffffffffffffffe
mov qword [rsp + 0x1a08], rbx
mov qword [rsp + 0x1a10], rsi
mov qword [rsp + 0x1a18], rdi
mov r13, rcx
call fcn.140088970
mov r9d, 1
mov r8d, r9d
lea rdx, str.CKnownFolders_Add_global_CSIDLs
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x80]
call fcn.140249b10
mov r8d, PathResolve
lea rdx, [0x140286ae4]
lea rcx, [rbp - 0x80]
call fcn.140006bc0
mov r9d, 1
mov r8d, r9d
lea rdx, [rbp - 0x80]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbp + 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x2f]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
xor r12d, r12d
test eax, eax
jne 0x14007efd7
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x80]
lea r8, [0x140299d58]
lea rdx, str._CommonAdminTools_
mov rcx, r13
call fcn.14007e9e0
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x80]
call fcn.140249b10
mov r8d, 0x23
lea rdx, [0x140286ae4]
lea rcx, [rbp - 0x80]
call fcn.140006bc0
mov r9d, 1
mov r8d, r9d
lea rdx, [rbp - 0x80]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbp + 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x23]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x14007f065
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x80]
lea r8, str.CSIDL_COMMON_APPDATA
lea rdx, str._CommonAppData_
mov rcx, r13
call fcn.14007e9e0
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x80]
call fcn.140249b10
mov r8d, 0x19
lea rdx, [0x140286ae4]
lea rcx, [rbp - 0x80]
call fcn.140006bc0
mov r9d, 1
mov r8d, r9d
lea rdx, [rbp - 0x80]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbp + 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x19]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x14007f0f3
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x80]
lea r8, str.CSIDL_COMMON_DESKTOPDIRECTORY
lea rdx, str._CommonDesktop_
mov rcx, r13
call fcn.14007e9e0
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x80]
call fcn.140249b10
mov r8d, PathResolve
lea rdx, [0x140286ae4]
lea rcx, [rbp - 0x80]
call fcn.140006bc0
mov r9d, 1
mov r8d, r9d
lea rdx, [rbp - 0x80]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbp + 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x2e]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x14007f181
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x80]
lea r8, str.CSIDL_COMMON_DOCUMENTS
lea rdx, str._CommonDocuments_
mov rcx, r13
call fcn.14007e9e0
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x80]
call fcn.140249b10
mov r8d, reloc.OLEAUT32.dll_SafeArrayUnaccessData
lea rdx, [0x140286ae4]
lea rcx, [rbp - 0x80]
call fcn.140006bc0
mov r9d, 1
mov r8d, r9d
lea rdx, [rbp - 0x80]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbp + 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x17]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x14007f20f
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x80]
lea r8, str.CSIDL_COMMON_PROGRAMS
lea rdx, str._CommonPrograms_
mov rcx, r13
call fcn.14007e9e0
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x80]
call fcn.140249b10
mov r8d, 0x36
lea rdx, [0x140286ae4]
lea rcx, [rbp - 0x80]
call fcn.140006bc0
mov r9d, 1
mov r8d, r9d
lea rdx, [rbp - 0x80]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbp + 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x36]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x14007f29d
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x80]
lea r8, [0x140299f10]
lea rdx, str._CommonPictures_
mov rcx, r13
call fcn.14007e9e0
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x80]
call fcn.140249b10
mov r8d, 0x35
lea rdx, [0x140286ae4]
lea rcx, [rbp - 0x80]
call fcn.140006bc0
mov r9d, 1
mov r8d, r9d
lea rdx, [rbp - 0x80]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbp + 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x35]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x14007f32b
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x80]
lea r8, [0x140299f68]
lea rdx, str._CommonMusic_
mov rcx, r13
call fcn.14007e9e0
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x80]
call fcn.140249b10
mov r8d, 0x37
lea rdx, [0x140286ae4]
lea rcx, [rbp - 0x80]
call fcn.140006bc0
mov r9d, 1
mov r8d, r9d
lea rdx, [rbp - 0x80]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbp + 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x37]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x14007f3b9
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x80]
lea r8, [0x140299fb0]
lea rdx, str._CommonVideo_
mov rcx, r13
call fcn.14007e9e0
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x80]
call fcn.140249b10
mov r8d, reloc.WSOCK32.dll_shutdown
lea rdx, [0x140286ae4]
lea rcx, [rbp - 0x80]
call fcn.140006bc0
mov r9d, 1
mov r8d, r9d
lea rdx, [rbp - 0x80]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbp + 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x16]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x14007f447
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x80]
lea r8, str.CSIDL_COMMON_STARTMENU
lea rdx, str._CommonStartMenu_
mov rcx, r13
call fcn.14007e9e0
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x80]
call fcn.140249b10
mov r8d, reloc.OLEAUT32.dll_SafeArrayGetElement
lea rdx, [0x140286ae4]
lea rcx, [rbp - 0x80]
call fcn.140006bc0
mov r9d, 1
mov r8d, r9d
lea rdx, [rbp - 0x80]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbp + 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x18]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x14007f4d5
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x80]
lea r8, str.CSIDL_COMMON_STARTUP
lea rdx, str._CommonStartup_
mov rcx, r13
call fcn.14007e9e0
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x80]
call fcn.140249b10
mov r8d, 0x2d
lea rdx, [0x140286ae4]
lea rcx, [rbp - 0x80]
call fcn.140006bc0
mov r9d, 1
mov r8d, r9d
lea rdx, [rbp - 0x80]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbp + 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x2d]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x14007f563
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x80]
lea r8, str.CSIDL_COMMON_TEMPLATES
lea rdx, str._CommonTemplates_
mov rcx, r13
call fcn.14007e9e0
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x80]
call fcn.140249b10
mov r8d, SafeArrayUnaccessData
lea rdx, [0x140286ae4]
lea rcx, [rbp - 0x80]
call fcn.140006bc0
mov r9d, 1
mov r8d, r9d
lea rdx, [rbp - 0x80]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbp + 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x14]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x14007f5f1
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x80]
lea r8, str.CSIDL_FONTS
lea rdx, str._Fonts_
mov rcx, r13
call fcn.14007e9e0
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x80]
call fcn.140249b10
mov r8d, 0x26
lea rdx, [0x140286ae4]
lea rcx, [rbp - 0x80]
call fcn.140006bc0
mov r9d, 1
mov r8d, r9d
lea rdx, [rbp - 0x80]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbp + 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x26]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x14007f67f
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x80]
lea r8, str.CSIDL_PROGRAM_FILES
lea rdx, str._ProgramFiles_
mov rcx, r13
call fcn.14007e9e0
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x80]
call fcn.140249b10
mov r8d, 0x2a
lea rdx, [0x140286ae4]
lea rcx, [rbp - 0x80]
call fcn.140006bc0
mov r9d, 1
mov r8d, r9d
lea rdx, [rbp - 0x80]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbp + 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x2a]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x14007f710
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x80]
lea r8, str.CSIDL_PROGRAM_FILESX86
lea rdx, str._ProgramFiles_
mov rcx, r13
call fcn.14007e9e0
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x80]
call fcn.140249b10
mov r8d, 0x2b
lea rdx, [0x140286ae4]
lea rcx, [rbp - 0x80]
call fcn.140006bc0
mov r9d, 1
mov r8d, r9d
lea rdx, [rbp - 0x80]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbp + 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x2b]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x14007f79e
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x80]
lea r8, str.CSIDL_PROGRAM_FILES_COMMON
lea rdx, str._CommonProgramFiles_
mov rcx, r13
call fcn.14007e9e0
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x80]
call fcn.140249b10
mov r8d, 0x2c
lea rdx, [0x140286ae4]
lea rcx, [rbp - 0x80]
call fcn.140006bc0
mov r9d, 1
mov r8d, r9d
lea rdx, [rbp - 0x80]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbp + 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x2c]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x14007f82f
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x80]
lea r8, str.CSIDL_PROGRAM_FILES_COMMONX86
lea rdx, str._CommonProgramFiles_
mov rcx, r13
call fcn.14007e9e0
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x80]
call fcn.140249b10
mov r8d, 0x38
lea rdx, [0x140286ae4]
lea rcx, [rbp - 0x80]
call fcn.140006bc0
mov r9d, 1
mov r8d, r9d
lea rdx, [rbp - 0x80]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbp + 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x38]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x14007f8bd
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x80]
lea r8, [0x14029a240]
lea rdx, str._Resources_
mov rcx, r13
call fcn.14007e9e0
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x80]
call fcn.140249b10
mov r8d, 0x39
lea rdx, [0x140286ae4]
lea rcx, [rbp - 0x80]
call fcn.140006bc0
mov r9d, 1
mov r8d, r9d
lea rdx, [rbp - 0x80]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbp + 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x39]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x14007f94b
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x80]
lea r8, [0x14029a278]
lea rdx, str._ResourcesLocalized_
mov rcx, r13
call fcn.14007e9e0
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x80]
call fcn.140249b10
mov r8d, 0x25
lea rdx, [0x140286ae4]
lea rcx, [rbp - 0x80]
call fcn.140006bc0
mov r9d, 1
mov r8d, r9d
lea rdx, [rbp - 0x80]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbp + 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x25]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x14007f9d9
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x80]
lea r8, str.CSIDL_SYSTEM
lea rdx, str._System_
mov rcx, r13
call fcn.14007e9e0
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x80]
call fcn.140249b10
mov r8d, 0x29
lea rdx, [0x140286ae4]
lea rcx, [rbp - 0x80]
call fcn.140006bc0
mov r9d, 1
mov r8d, r9d
lea rdx, [rbp - 0x80]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbp + 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x29]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x14007fa6a
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x80]
lea r8, str.CSIDL_SYSTEMX86
lea rdx, str._System_
mov rcx, r13
call fcn.14007e9e0
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x80]
call fcn.140249b10
mov r8d, 0x24
lea rdx, [0x140286ae4]
lea rcx, [rbp - 0x80]
call fcn.140006bc0
mov r9d, 1
mov r8d, r9d
lea rdx, [rbp - 0x80]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbp + 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x24]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x14007faf8
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x80]
lea r8, str.CSIDL_WINDOWS
lea rdx, str._Windows_
mov rcx, r13
call fcn.14007e9e0
mov r9d, 1
mov r8d, r9d
lea rdx, str.CKnownFolders_Add_user_CSIDLs
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
lea rax, [rbp + 0x2a0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x28]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov rax, qword [r13 + 8]
mov rbx, qword [rax]
cmp rbx, rax
je 0x1400816ce
lea rcx, vtable.CSABByteString.0
lea rdi, vtable.CSABStringW.0
mov rax, qword [rbx + 0x10]
mov r14, qword [rax + 0x20]
mov r15, qword [rax + 8]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x70], r12
mov ecx, 1
call fcn.140247068
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 1
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x58]
call fcn.14000af20
nop
mov rax, qword [rsp + 0x68]
cmp rax, 7
jae 0x14007fbe8
mov ecx, 7
call fcn.140247068
mov rsi, rax
mov rdi, qword [rsp + 0x60]
test rdi, rdi
je 0x14007fbd0
mov r8, qword [rsp + 0x70]
inc r8
mov rdx, rdi
mov rcx, rax
call fcn.1402496a0
mov edx, 1
mov rcx, rdi
call fcn.140247060
mov qword [rsp + 0x60], rsi
mov eax, 7
mov qword [rsp + 0x68], rax
lea rdi, vtable.CSABStringW.0
jmp 0x14007fbed
mov rsi, qword [rsp + 0x60]
mov dword [rbp + 0x1900], r12d
lea rcx, [rbp + 0x1900]
mov qword [rsp + 0x38], rcx
lea rcx, [0x140287240]
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
mov r9d, 6
lea r8, [0x14029a390]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov byte [rsi + 6], 0
mov qword [rsp + 0x70], 6
mov r9d, 1
mov r8d, r9d
mov rdx, rsi
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
mov r8d, 0x104
lea rdx, [rbp + 0x80]
lea rcx, [0x14029a390]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x14007fd2e
mov r8d, 0x1040
lea rdx, [rbp + 0x10b0]
lea rcx, [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
lea rdx, [rbp + 0x10b0]
lea rcx, [rbp + 0x80]
test eax, eax
cmove rdx, rcx
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], r12
mov dword [rsp + 0x50], r12d
lea rcx, [rsp + 0x40]
call fcn.14002a980
mov dword [rsp + 0x54], 1
mov r9, r14
lea r8, [rbp + 0x2a0]
lea rdx, [rsp + 0x40]
mov rcx, r13
call fcn.1400929d0
test eax, eax
je 0x14007fd17
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r15
mov rdi, qword [rsp + 0x48]
mov r9, rdi
lea r8, [0x14029a390]
lea rdx, str._Temp_
mov rcx, r13
call fcn.14007e9e0
nop
cmp dword [rsp + 0x54], 1
jne 0x14007fd2e
test rdi, rdi
je 0x14007fd2e
mov rcx, rdi
jmp 0x14007fd28
cmp dword [rsp + 0x54], 1
jne 0x14007fd2e
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14007fd2e
call fcn.140247060
nop
mov edx, 1
mov rcx, rsi
call fcn.140247060
mov rax, qword [rbx + 0x10]
mov r14, qword [rax + 0x20]
mov r15, qword [rax + 8]
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x80]
call fcn.140249b10
mov r8d, PathResolve
lea rdx, [0x140286ae4]
lea rcx, [rbp - 0x80]
call fcn.140006bc0
mov r9d, 1
mov r8d, r9d
lea rdx, [rbp - 0x80]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbp + 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x30]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x14007fe87
lea rax, vtable.CSABStringW.0
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x80]
mov rdi, 0xffffffffffffffff
nop dword [rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x14007fdd0
mov dword [rsp + 0x50], edi
lea ecx, [rdi*2 + 2]
call fcn.140247068
mov rsi, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x14007fe14
mov ecx, edi
lea rdi, [rcx + rcx]
mov r8, rdi
lea rdx, [rbp + 0x80]
mov rcx, rax
call fcn.1402496a0
mov word [rdi + rsi], r12w
mov dword [rsp + 0x54], 1
mov r9, r14
lea r8, [rbp + 0x2a0]
lea rdx, [rsp + 0x40]
mov rcx, r13
call fcn.1400929d0
test eax, eax
je 0x14007fe71
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r15
mov rdi, qword [rsp + 0x48]
mov r9, rdi
lea r8, [0x14029a3b0]
lea rdx, str._AdminTools_
mov rcx, r13
call fcn.14007e9e0
nop
cmp dword [rsp + 0x54], 1
jne 0x14007fe87
test rdi, rdi
je 0x14007fe87
mov rcx, rdi
jmp 0x14007fe82
cmp dword [rsp + 0x54], 1
jne 0x14007fe87
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14007fe87
call fcn.140247060
mov rax, qword [rbx + 0x10]
mov r14, qword [rax + 0x20]
mov r15, qword [rax + 8]
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x4b0]
call fcn.140249b10
mov r8d, 0x1d
lea rdx, [0x140286ae4]
lea rcx, [rbp + 0x4b0]
call fcn.140006bc0
mov r9d, 1
mov r8d, r9d
lea rdx, [rbp + 0x4b0]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbp + 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x1d]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x14007ffd8
lea rax, vtable.CSABStringW.0
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x80]
mov rdi, 0xffffffffffffffff
inc rdi
cmp word [rax + rdi*2], 0
jne 0x14007ff21
mov dword [rsp + 0x50], edi
lea ecx, [rdi*2 + 2]
call fcn.140247068
mov rsi, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x14007ff65
mov ecx, edi
lea rdi, [rcx + rcx]
mov r8, rdi
lea rdx, [rbp + 0x80]
mov rcx, rax
call fcn.1402496a0
mov word [rdi + rsi], r12w
mov dword [rsp + 0x54], 1
mov r9, r14
lea r8, [rbp + 0x2a0]
lea rdx, [rsp + 0x40]
mov rcx, r13
call fcn.1400929d0
test eax, eax
je 0x14007ffc2
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r15
mov rdi, qword [rsp + 0x48]
mov r9, rdi
lea r8, str.CSIDL_ALTSTARTUP
lea rdx, str._Startup_
mov rcx, r13
call fcn.14007e9e0
nop
cmp dword [rsp + 0x54], 1
jne 0x14007ffd8
test rdi, rdi
je 0x14007ffd8
mov rcx, rdi
jmp 0x14007ffd3
cmp dword [rsp + 0x54], 1
jne 0x14007ffd8
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14007ffd8
call fcn.140247060
mov rax, qword [rbx + 0x10]
mov r14, qword [rax + 0x20]
mov r15, qword [rax + 8]
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x5b0]
call fcn.140249b10
mov r8d, 0x1a
lea rdx, [0x140286ae4]
lea rcx, [rbp + 0x5b0]
call fcn.140006bc0
mov r9d, 1
mov r8d, r9d
lea rdx, [rbp + 0x5b0]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbp + 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x1a]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x140080129
lea rax, vtable.CSABStringW.0
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x80]
mov rdi, 0xffffffffffffffff
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140080072
mov dword [rsp + 0x50], edi
lea ecx, [rdi*2 + 2]
call fcn.140247068
mov rsi, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x1400800b6
mov ecx, edi
lea rdi, [rcx + rcx]
mov r8, rdi
lea rdx, [rbp + 0x80]
mov rcx, rax
call fcn.1402496a0
mov word [rdi + rsi], r12w
mov dword [rsp + 0x54], 1
mov r9, r14
lea r8, [rbp + 0x2a0]
lea rdx, [rsp + 0x40]
mov rcx, r13
call fcn.1400929d0
test eax, eax
je 0x140080113
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r15
mov rdi, qword [rsp + 0x48]
mov r9, rdi
lea r8, str.CSIDL_APPDATA
lea rdx, str._AppData_
mov rcx, r13
call fcn.14007e9e0
nop
cmp dword [rsp + 0x54], 1
jne 0x140080129
test rdi, rdi
je 0x140080129
mov rcx, rdi
jmp 0x140080124
cmp dword [rsp + 0x54], 1
jne 0x140080129
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140080129
call fcn.140247060
mov rax, qword [rbx + 0x10]
mov r14, qword [rax + 0x20]
mov r15, qword [rax + 8]
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x6b0]
call fcn.140249b10
mov r8d, 0x21
lea rdx, [0x140286ae4]
lea rcx, [rbp + 0x6b0]
call fcn.140006bc0
mov r9d, 1
mov r8d, r9d
lea rdx, [rbp + 0x6b0]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbp + 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x21]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x14008027a
lea rax, vtable.CSABStringW.0
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x80]
mov rdi, 0xffffffffffffffff
inc rdi
cmp word [rax + rdi*2], 0
jne 0x1400801c3
mov dword [rsp + 0x50], edi
lea ecx, [rdi*2 + 2]
call fcn.140247068
mov rsi, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140080207
mov ecx, edi
lea rdi, [rcx + rcx]
mov r8, rdi
lea rdx, [rbp + 0x80]
mov rcx, rax
call fcn.1402496a0
mov word [rdi + rsi], r12w
mov dword [rsp + 0x54], 1
mov r9, r14
lea r8, [rbp + 0x2a0]
lea rdx, [rsp + 0x40]
mov rcx, r13
call fcn.1400929d0
test eax, eax
je 0x140080264
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r15
mov rdi, qword [rsp + 0x48]
mov r9, rdi
lea r8, str.CSIDL_COOKIES
lea rdx, str._Cookies_
mov rcx, r13
call fcn.14007e9e0
nop
cmp dword [rsp + 0x54], 1
jne 0x14008027a
test rdi, rdi
je 0x14008027a
mov rcx, rdi
jmp 0x140080275
cmp dword [rsp + 0x54], 1
jne 0x14008027a
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14008027a
call fcn.140247060
mov rax, qword [rbx + 0x10]
mov r14, qword [rax + 0x20]
mov r15, qword [rax + 8]
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x7b0]
call fcn.140249b10
mov r8d, reloc.OLEAUT32.dll_SafeArrayGetDim
lea rdx, [0x140286ae4]
lea rcx, [rbp + 0x7b0]
call fcn.140006bc0
mov r9d, 1
mov r8d, r9d
lea rdx, [rbp + 0x7b0]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbp + 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x1400803cb
lea rax, vtable.CSABStringW.0
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x80]
mov rdi, 0xffffffffffffffff
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140080314
mov dword [rsp + 0x50], edi
lea ecx, [rdi*2 + 2]
call fcn.140247068
mov rsi, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140080358
mov ecx, edi
lea rdi, [rcx + rcx]
mov r8, rdi
lea rdx, [rbp + 0x80]
mov rcx, rax
call fcn.1402496a0
mov word [rdi + rsi], r12w
mov dword [rsp + 0x54], 1
mov r9, r14
lea r8, [rbp + 0x2a0]
lea rdx, [rsp + 0x40]
mov rcx, r13
call fcn.1400929d0
test eax, eax
je 0x1400803b5
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r15
mov rdi, qword [rsp + 0x48]
mov r9, rdi
lea r8, str.CSIDL_DESKTOPDIRECTORY
lea rdx, str._Desktop_
mov rcx, r13
call fcn.14007e9e0
nop
cmp dword [rsp + 0x54], 1
jne 0x1400803cb
test rdi, rdi
je 0x1400803cb
mov rcx, rdi
jmp 0x1400803c6
cmp dword [rsp + 0x54], 1
jne 0x1400803cb
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400803cb
call fcn.140247060
mov rax, qword [rbx + 0x10]
mov r14, qword [rax + 0x20]
mov r15, qword [rax + 8]
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x8b0]
call fcn.140249b10
mov r8d, 6
lea rdx, [0x140286ae4]
lea rcx, [rbp + 0x8b0]
call fcn.140006bc0
mov r9d, 1
mov r8d, r9d
lea rdx, [rbp + 0x8b0]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbp + 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 6]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x14008051c
lea rax, vtable.CSABStringW.0
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x80]
mov rdi, 0xffffffffffffffff
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140080465
mov dword [rsp + 0x50], edi
lea ecx, [rdi*2 + 2]
call fcn.140247068
mov rsi, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x1400804a9
mov ecx, edi
lea rdi, [rcx + rcx]
mov r8, rdi
lea rdx, [rbp + 0x80]
mov rcx, rax
call fcn.1402496a0
mov word [rdi + rsi], r12w
mov dword [rsp + 0x54], 1
mov r9, r14
lea r8, [rbp + 0x2a0]
lea rdx, [rsp + 0x40]
mov rcx, r13
call fcn.1400929d0
test eax, eax
je 0x140080506
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r15
mov rdi, qword [rsp + 0x48]
mov r9, rdi
lea r8, str.CSIDL_FAVORITES
lea rdx, str._Favorites_
mov rcx, r13
call fcn.14007e9e0
nop
cmp dword [rsp + 0x54], 1
jne 0x14008051c
test rdi, rdi
je 0x14008051c
mov rcx, rdi
jmp 0x140080517
cmp dword [rsp + 0x54], 1
jne 0x14008051c
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14008051c
call fcn.140247060
mov rax, qword [rbx + 0x10]
mov r14, qword [rax + 0x20]
mov r15, qword [rax + 8]
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x9b0]
call fcn.140249b10
mov r8d, 0x22
lea rdx, [0x140286ae4]
lea rcx, [rbp + 0x9b0]
call fcn.140006bc0
mov r9d, 1
mov r8d, r9d
lea rdx, [rbp + 0x9b0]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbp + 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x22]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x14008066d
lea rax, vtable.CSABStringW.0
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x80]
mov rdi, 0xffffffffffffffff
inc rdi
cmp word [rax + rdi*2], 0
jne 0x1400805b6
mov dword [rsp + 0x50], edi
lea ecx, [rdi*2 + 2]
call fcn.140247068
mov rsi, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x1400805fa
mov ecx, edi
lea rdi, [rcx + rcx]
mov r8, rdi
lea rdx, [rbp + 0x80]
mov rcx, rax
call fcn.1402496a0
mov word [rdi + rsi], r12w
mov dword [rsp + 0x54], 1
mov r9, r14
lea r8, [rbp + 0x2a0]
lea rdx, [rsp + 0x40]
mov rcx, r13
call fcn.1400929d0
test eax, eax
je 0x140080657
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r15
mov rdi, qword [rsp + 0x48]
mov r9, rdi
lea r8, str.CSIDL_HISTORY
lea rdx, str._History_
mov rcx, r13
call fcn.14007e9e0
nop
cmp dword [rsp + 0x54], 1
jne 0x14008066d
test rdi, rdi
je 0x14008066d
mov rcx, rdi
jmp 0x140080668
cmp dword [rsp + 0x54], 1
jne 0x14008066d
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14008066d
call fcn.140247060
mov rax, qword [rbx + 0x10]
mov r14, qword [rax + 0x20]
mov r15, qword [rax + 8]
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0xab0]
call fcn.140249b10
mov r8d, 0x20
lea rdx, [0x140286ae4]
lea rcx, [rbp + 0xab0]
call fcn.140006bc0
mov r9d, 1
mov r8d, r9d
lea rdx, [rbp + 0xab0]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbp + 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x20]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x1400807c7
lea rax, vtable.CSABStringW.0
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x80]
mov rdi, 0xffffffffffffffff
nop word [rax + rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140080710
mov dword [rsp + 0x50], edi
lea ecx, [rdi*2 + 2]
call fcn.140247068
mov rsi, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140080754
mov ecx, edi
lea rdi, [rcx + rcx]
mov r8, rdi
lea rdx, [rbp + 0x80]
mov rcx, rax
call fcn.1402496a0
mov word [rsi + rdi], r12w
mov dword [rsp + 0x54], 1
mov r9, r14
lea r8, [rbp + 0x2a0]
lea rdx, [rsp + 0x40]
mov rcx, r13
call fcn.1400929d0
test eax, eax
je 0x1400807b1
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r15
mov rdi, qword [rsp + 0x48]
mov r9, rdi
lea r8, str.CSIDL_INTERNET_CACHE
lea rdx, str._Cache_
mov rcx, r13
call fcn.14007e9e0
nop
cmp dword [rsp + 0x54], 1
jne 0x1400807c7
test rdi, rdi
je 0x1400807c7
mov rcx, rdi
jmp 0x1400807c2
cmp dword [rsp + 0x54], 1
jne 0x1400807c7
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400807c7
call fcn.140247060
mov rax, qword [rbx + 0x10]
mov r14, qword [rax + 0x20]
mov r15, qword [rax + 8]
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0xbb0]
call fcn.140249b10
mov r8d, 0x1c
lea rdx, [0x140286ae4]
lea rcx, [rbp + 0xbb0]
call fcn.140006bc0
mov r9d, 1
mov r8d, r9d
lea rdx, [rbp + 0xbb0]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbp + 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x1c]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x140080918
lea rax, vtable.CSABStringW.0
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x80]
mov rdi, 0xffffffffffffffff
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140080861
mov dword [rsp + 0x50], edi
lea ecx, [rdi*2 + 2]
call fcn.140247068
mov rsi, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x1400808a5
mov ecx, edi
lea rdi, [rcx + rcx]
mov r8, rdi
lea rdx, [rbp + 0x80]
mov rcx, rax
call fcn.1402496a0
mov word [rsi + rdi], r12w
mov dword [rsp + 0x54], 1
mov r9, r14
lea r8, [rbp + 0x2a0]
lea rdx, [rsp + 0x40]
mov rcx, r13
call fcn.1400929d0
test eax, eax
je 0x140080902
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r15
mov rdi, qword [rsp + 0x48]
mov r9, rdi
lea r8, str.CSIDL_LOCAL_APPDATA
lea rdx, str._LocalAppData_
mov rcx, r13
call fcn.14007e9e0
nop
cmp dword [rsp + 0x54], 1
jne 0x140080918
test rdi, rdi
je 0x140080918
mov rcx, rdi
jmp 0x140080913
cmp dword [rsp + 0x54], 1
jne 0x140080918
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140080918
call fcn.140247060
mov rax, qword [rbx + 0x10]
mov r14, qword [rax + 0x20]
mov r15, qword [rax + 8]
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0xcb0]
call fcn.140249b10
mov r8d, 5
lea rdx, [0x140286ae4]
lea rcx, [rbp + 0xcb0]
call fcn.140006bc0
mov r9d, 1
mov r8d, r9d
lea rdx, [rbp + 0xcb0]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbp + 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 5]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x140080a69
lea rax, vtable.CSABStringW.0
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x80]
mov rdi, 0xffffffffffffffff
inc rdi
cmp word [rax + rdi*2], 0
jne 0x1400809b2
mov dword [rsp + 0x50], edi
lea ecx, [rdi*2 + 2]
call fcn.140247068
mov rsi, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x1400809f6
mov ecx, edi
lea rdi, [rcx + rcx]
mov r8, rdi
lea rdx, [rbp + 0x80]
mov rcx, rax
call fcn.1402496a0
mov word [rsi + rdi], r12w
mov dword [rsp + 0x54], 1
mov r9, r14
lea r8, [rbp + 0x2a0]
lea rdx, [rsp + 0x40]
mov rcx, r13
call fcn.1400929d0
test eax, eax
je 0x140080a53
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r15
mov rdi, qword [rsp + 0x48]
mov r9, rdi
lea r8, [0x14029a5e8]
lea rdx, str._Documents_
mov rcx, r13
call fcn.14007e9e0
nop
cmp dword [rsp + 0x54], 1
jne 0x140080a69
test rdi, rdi
je 0x140080a69
mov rcx, rdi
jmp 0x140080a64
cmp dword [rsp + 0x54], 1
jne 0x140080a69
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140080a69
call fcn.140247060
mov rax, qword [rbx + 0x10]
mov r14, qword [rax + 0x20]
mov r15, qword [rax + 8]
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0xdb0]
call fcn.140249b10
mov r8d, SafeArrayGetDim
lea rdx, [0x140286ae4]
lea rcx, [rbp + 0xdb0]
call fcn.140006bc0
mov r9d, 1
mov r8d, r9d
lea rdx, [rbp + 0xdb0]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbp + 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xd]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x140080bba
lea rax, vtable.CSABStringW.0
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x80]
mov rdi, 0xffffffffffffffff
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140080b03
mov dword [rsp + 0x50], edi
lea ecx, [rdi*2 + 2]
call fcn.140247068
mov rsi, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140080b47
mov ecx, edi
lea rdi, [rcx + rcx]
mov r8, rdi
lea rdx, [rbp + 0x80]
mov rcx, rax
call fcn.1402496a0
mov word [rsi + rdi], r12w
mov dword [rsp + 0x54], 1
mov r9, r14
lea r8, [rbp + 0x2a0]
lea rdx, [rsp + 0x40]
mov rcx, r13
call fcn.1400929d0
test eax, eax
je 0x140080ba4
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r15
mov rdi, qword [rsp + 0x48]
mov r9, rdi
lea r8, [0x14029a628]
lea rdx, str._Music_
mov rcx, r13
call fcn.14007e9e0
nop
cmp dword [rsp + 0x54], 1
jne 0x140080bba
test rdi, rdi
je 0x140080bba
mov rcx, rdi
jmp 0x140080bb5
cmp dword [rsp + 0x54], 1
jne 0x140080bba
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140080bba
call fcn.140247060
mov rax, qword [rbx + 0x10]
mov r14, qword [rax + 0x20]
mov r15, qword [rax + 8]
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0xeb0]
call fcn.140249b10
mov r8d, 0x27
lea rdx, [0x140286ae4]
lea rcx, [rbp + 0xeb0]
call fcn.140006bc0
mov r9d, 1
mov r8d, r9d
lea rdx, [rbp + 0xeb0]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbp + 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x27]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x140080d0b
lea rax, vtable.CSABStringW.0
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x80]
mov rdi, 0xffffffffffffffff
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140080c54
mov dword [rsp + 0x50], edi
lea ecx, [rdi*2 + 2]
call fcn.140247068
mov rsi, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140080c98
mov ecx, edi
lea rdi, [rcx + rcx]
mov r8, rdi
lea rdx, [rbp + 0x80]
mov rcx, rax
call fcn.1402496a0
mov word [rsi + rdi], r12w
mov dword [rsp + 0x54], 1
mov r9, r14
lea r8, [rbp + 0x2a0]
lea rdx, [rsp + 0x40]
mov rcx, r13
call fcn.1400929d0
test eax, eax
je 0x140080cf5
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r15
mov rdi, qword [rsp + 0x48]
mov r9, rdi
lea r8, [0x14029a658]
lea rdx, str._Pictures_
mov rcx, r13
call fcn.14007e9e0
nop
cmp dword [rsp + 0x54], 1
jne 0x140080d0b
test rdi, rdi
je 0x140080d0b
mov rcx, rdi
jmp 0x140080d06
cmp dword [rsp + 0x54], 1
jne 0x140080d0b
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140080d0b
call fcn.140247060
mov rax, qword [rbx + 0x10]
mov r14, qword [rax + 0x20]
mov r15, qword [rax + 8]
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0xfb0]
call fcn.140249b10
mov r8d, SafeArrayGetDim
lea rdx, [0x140286ae4]
lea rcx, [rbp + 0xfb0]
call fcn.140006bc0
mov r9d, 1
mov r8d, r9d
lea rdx, [rbp + 0xfb0]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbp + 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xe]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x140080e5c
lea rax, vtable.CSABStringW.0
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x80]
mov rdi, 0xffffffffffffffff
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140080da5
mov dword [rsp + 0x50], edi
lea ecx, [rdi*2 + 2]
call fcn.140247068
mov rsi, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140080de9
mov ecx, edi
lea rdi, [rcx + rcx]
mov r8, rdi
lea rdx, [rbp + 0x80]
mov rcx, rax
call fcn.1402496a0
mov word [rsi + rdi], r12w
mov dword [rsp + 0x54], 1
mov r9, r14
lea r8, [rbp + 0x2a0]
lea rdx, [rsp + 0x40]
mov rcx, r13
call fcn.1400929d0
test eax, eax
je 0x140080e46
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r15
mov rdi, qword [rsp + 0x48]
mov r9, rdi
lea r8, [0x14029a698]
lea rdx, str._Videos_
mov rcx, r13
call fcn.14007e9e0
nop
cmp dword [rsp + 0x54], 1
jne 0x140080e5c
test rdi, rdi
je 0x140080e5c
mov rcx, rdi
jmp 0x140080e57
cmp dword [rsp + 0x54], 1
jne 0x140080e5c
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140080e5c
call fcn.140247060
mov rax, qword [rbx + 0x10]
mov r14, qword [rax + 0x20]
mov r15, qword [rax + 8]
mov edx, reloc.WSOCK32.dll_send
mov r9d, 1
mov r8d, r9d
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
lea rax, [rbp + 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x13]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x140080f79
lea rax, vtable.CSABStringW.0
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x80]
mov rdi, 0xffffffffffffffff
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140080ec2
mov dword [rsp + 0x50], edi
lea ecx, [rdi*2 + 2]
call fcn.140247068
mov rsi, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140080f06
mov ecx, edi
lea rdi, [rcx + rcx]
mov r8, rdi
lea rdx, [rbp + 0x80]
mov rcx, rax
call fcn.1402496a0
mov word [rsi + rdi], r12w
mov dword [rsp + 0x54], 1
mov r9, r14
lea r8, [rbp + 0x2a0]
lea rdx, [rsp + 0x40]
mov rcx, r13
call fcn.1400929d0
test eax, eax
je 0x140080f63
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r15
mov rdi, qword [rsp + 0x48]
mov r9, rdi
lea r8, [0x14029a6d0]
lea rdx, str._NetworkShortcuts_
mov rcx, r13
call fcn.14007e9e0
nop
cmp dword [rsp + 0x54], 1
jne 0x140080f79
test rdi, rdi
je 0x140080f79
mov rcx, rdi
jmp 0x140080f74
cmp dword [rsp + 0x54], 1
jne 0x140080f79
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140080f79
call fcn.140247060
mov rax, qword [rbx + 0x10]
mov r14, qword [rax + 0x20]
mov r15, qword [rax + 8]
mov edx, 0x1b
mov r9d, 1
mov r8d, r9d
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
lea rax, [rbp + 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x1b]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x140081097
lea rax, vtable.CSABStringW.0
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x80]
mov rdi, 0xffffffffffffffff
nop
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140080fe0
mov dword [rsp + 0x50], edi
lea ecx, [rdi*2 + 2]
call fcn.140247068
mov rsi, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140081024
mov ecx, edi
lea rdi, [rcx + rcx]
mov r8, rdi
lea rdx, [rbp + 0x80]
mov rcx, rax
call fcn.1402496a0
mov word [rsi + rdi], r12w
mov dword [rsp + 0x54], 1
mov r9, r14
lea r8, [rbp + 0x2a0]
lea rdx, [rsp + 0x40]
mov rcx, r13
call fcn.1400929d0
test eax, eax
je 0x140081081
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r15
mov rdi, qword [rsp + 0x48]
mov r9, rdi
lea r8, [0x14029a718]
lea rdx, str._PrinterShortcuts_
mov rcx, r13
call fcn.14007e9e0
nop
cmp dword [rsp + 0x54], 1
jne 0x140081097
test rdi, rdi
je 0x140081097
mov rcx, rdi
jmp 0x140081092
cmp dword [rsp + 0x54], 1
jne 0x140081097
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140081097
call fcn.140247060
mov rax, qword [rbx + 0x10]
mov r14, qword [rax + 0x20]
mov r15, qword [rax + 8]
mov edx, 0x28
mov r9d, 1
mov r8d, r9d
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
lea rax, [rbp + 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x28]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x1400811b7
lea rax, vtable.CSABStringW.0
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x80]
mov rdi, 0xffffffffffffffff
nop dword [rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140081100
mov dword [rsp + 0x50], edi
lea ecx, [rdi*2 + 2]
call fcn.140247068
mov rsi, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140081144
mov ecx, edi
lea rdi, [rcx + rcx]
mov r8, rdi
lea rdx, [rbp + 0x80]
mov rcx, rax
call fcn.1402496a0
mov word [rsi + rdi], r12w
mov dword [rsp + 0x54], 1
mov r9, r14
lea r8, [rbp + 0x2a0]
lea rdx, [rsp + 0x40]
mov rcx, r13
call fcn.1400929d0
test eax, eax
je 0x1400811a1
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r15
mov rdi, qword [rsp + 0x48]
mov r9, rdi
lea r8, str.CSIDL_PROFILE
lea rdx, str._Profile_
mov rcx, r13
call fcn.14007e9e0
nop
cmp dword [rsp + 0x54], 1
jne 0x1400811b7
test rdi, rdi
je 0x1400811b7
mov rcx, rdi
jmp 0x1400811b2
cmp dword [rsp + 0x54], 1
jne 0x1400811b7
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400811b7
call fcn.140247060
mov rax, qword [rbx + 0x10]
mov r14, qword [rax + 0x20]
mov r15, qword [rax + 8]
mov edx, 2
mov r9d, 1
mov r8d, r9d
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
lea rax, [rbp + 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 2]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x1400812d7
lea rax, vtable.CSABStringW.0
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x80]
mov rdi, 0xffffffffffffffff
nop dword [rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140081220
mov dword [rsp + 0x50], edi
lea ecx, [rdi*2 + 2]
call fcn.140247068
mov rsi, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140081264
mov ecx, edi
lea rdi, [rcx + rcx]
mov r8, rdi
lea rdx, [rbp + 0x80]
mov rcx, rax
call fcn.1402496a0
mov word [rsi + rdi], r12w
mov dword [rsp + 0x54], 1
mov r9, r14
lea r8, [rbp + 0x2a0]
lea rdx, [rsp + 0x40]
mov rcx, r13
call fcn.1400929d0
test eax, eax
je 0x1400812c1
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r15
mov rdi, qword [rsp + 0x48]
mov r9, rdi
lea r8, str.CSIDL_PROGRAMS
lea rdx, str._Programs_
mov rcx, r13
call fcn.14007e9e0
nop
cmp dword [rsp + 0x54], 1
jne 0x1400812d7
test rdi, rdi
je 0x1400812d7
mov rcx, rdi
jmp 0x1400812d2
cmp dword [rsp + 0x54], 1
jne 0x1400812d7
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400812d7
call fcn.140247060
mov rax, qword [rbx + 0x10]
mov r14, qword [rax + 0x20]
mov r15, qword [rax + 8]
mov edx, 8
mov r9d, 1
mov r8d, r9d
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
lea rax, [rbp + 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 8]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x1400813f7
lea rax, vtable.CSABStringW.0
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x80]
mov rdi, 0xffffffffffffffff
nop dword [rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140081340
mov dword [rsp + 0x50], edi
lea ecx, [rdi*2 + 2]
call fcn.140247068
mov rsi, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140081384
mov ecx, edi
lea rdi, [rcx + rcx]
mov r8, rdi
lea rdx, [rbp + 0x80]
mov rcx, rax
call fcn.1402496a0
mov word [rsi + rdi], r12w
mov dword [rsp + 0x54], 1
mov r9, r14
lea r8, [rbp + 0x2a0]
lea rdx, [rsp + 0x40]
mov rcx, r13
call fcn.1400929d0
test eax, eax
je 0x1400813e1
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r15
mov rdi, qword [rsp + 0x48]
mov r9, rdi
lea r8, str.CSIDL_RECENT
lea rdx, str._Recent_
mov rcx, r13
call fcn.14007e9e0
nop
cmp dword [rsp + 0x54], 1
jne 0x1400813f7
test rdi, rdi
je 0x1400813f7
mov rcx, rdi
jmp 0x1400813f2
cmp dword [rsp + 0x54], 1
jne 0x1400813f7
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400813f7
call fcn.140247060
mov rax, qword [rbx + 0x10]
mov r14, qword [rax + 0x20]
mov r15, qword [rax + 8]
mov edx, 9
mov r9d, 1
mov r8d, r9d
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
lea rax, [rbp + 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 9]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x140081517
lea rax, vtable.CSABStringW.0
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x80]
mov rdi, 0xffffffffffffffff
nop dword [rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140081460
mov dword [rsp + 0x50], edi
lea ecx, [rdi*2 + 2]
call fcn.140247068
mov rsi, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x1400814a4
mov ecx, edi
lea rdi, [rcx + rcx]
mov r8, rdi
lea rdx, [rbp + 0x80]
mov rcx, rax
call fcn.1402496a0
mov word [rsi + rdi], r12w
mov dword [rsp + 0x54], 1
mov r9, r14
lea r8, [rbp + 0x2a0]
lea rdx, [rsp + 0x40]
mov rcx, r13
call fcn.1400929d0
test eax, eax
je 0x140081501
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r15
mov rdi, qword [rsp + 0x48]
mov r9, rdi
lea r8, str.CSIDL_SENDTO
lea rdx, str._SendTo_
mov rcx, r13
call fcn.14007e9e0
nop
cmp dword [rsp + 0x54], 1
jne 0x140081517
test rdi, rdi
je 0x140081517
mov rcx, rdi
jmp 0x140081512
cmp dword [rsp + 0x54], 1
jne 0x140081517
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140081517
call fcn.140247060
mov rax, qword [rbx + 0x10]
mov r14, qword [rax + 0x20]
mov r15, qword [rax + 8]
mov edx, VariantTimeToDosDateTime
mov r9d, 1
mov r8d, r9d
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
lea rax, [rbp + 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xb]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x140081637
lea rax, vtable.CSABStringW.0
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x80]
mov rdi, 0xffffffffffffffff
nop dword [rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140081580
mov dword [rsp + 0x50], edi
lea ecx, [rdi*2 + 2]
call fcn.140247068
mov rsi, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x1400815c4
mov ecx, edi
lea rdi, [rcx + rcx]
mov r8, rdi
lea rdx, [rbp + 0x80]
mov rcx, rax
call fcn.1402496a0
mov word [rsi + rdi], r12w
mov dword [rsp + 0x54], 1
mov r9, r14
lea r8, [rbp + 0x2a0]
lea rdx, [rsp + 0x40]
mov rcx, r13
call fcn.1400929d0
test eax, eax
je 0x140081621
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r15
mov rdi, qword [rsp + 0x48]
mov r9, rdi
lea r8, str.CSIDL_STARTMENU
lea rdx, str._StartMenu_
mov rcx, r13
call fcn.14007e9e0
nop
cmp dword [rsp + 0x54], 1
jne 0x140081637
test rdi, rdi
je 0x140081637
mov rcx, rdi
jmp 0x140081632
cmp dword [rsp + 0x54], 1
jne 0x140081637
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140081637
call fcn.140247060
mov rcx, qword [rbx + 0x10]
mov rax, qword [rcx + 0x20]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x2a0]
mov qword [rsp + 0x28], rax
mov rax, qword [rcx + 8]
mov qword [rsp + 0x20], rax
mov r9d, 7
lea r8, str.CSIDL_STARTUP
lea rdx, str._Startup_
mov rcx, r13
call fcn.14007ecc0
mov rcx, qword [rbx + 0x10]
mov rax, qword [rcx + 0x20]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x2a0]
mov qword [rsp + 0x28], rax
mov rax, qword [rcx + 8]
mov qword [rsp + 0x20], rax
mov r9d, SafeArrayUnaccessData
lea r8, str.CSIDL_TEMPLATES
lea rdx, str._Templates_
mov rcx, r13
call fcn.14007ecc0
mov rbx, qword [rbx]
cmp rbx, qword [r13 + 8]
lea rdi, vtable.CSABStringW.0
lea rcx, vtable.CSABByteString.0
jne 0x14007fb50
lea r11, [rsp + 0x19d0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret