Function at 0x1404111cf
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
mov rax, 8
sub rsp, 8
mov qword [rsp], 0
dec rax
jne 0x1404111d9
sub rsp, 0x28
call fcn.140005ab0
mov rcx, qword [rsp + 0xa0]
call fcn.1404176e4
sub rsp, 0x18
mov rdx, 1
lea rax, [rsp + 0x40]
push rax
xor r9, r9
mov r8, reloc.WS2_32.dll_inet_addr
mov rcx, 2
sub rsp, 0x20
call fcn.140005404
add rsp, 0x40
mov qword [rsp + 0x28], rax
push 0
push 0
pop rcx
pop rdx
call sub.KERNEL32.dll_GetWindowsDirectoryW
mov rax, rax
push rax
pop rax
mov dword [rsp + 0x50], eax
movsxd r15, dword [rsp + 0x50]
and r15, r15
jne 0x14041128f
movabs rcx, 0x140082028
push rcx
sub rsp, 0x28
call fcn.140005d50
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140005b00
add rsp, 0x28
pop rax
push rax
call fcn.140005d10
pop rdx
add rax, rdx
jmp 0x140411491
movsxd r15, dword [rsp + 0x50]
shl r15, 2
mov rax, r15
push rax
pop rax
mov dword [rsp + 0x50], eax
movsxd rax, dword [rsp + 0x50]
inc rax
lea rdx, [rsp + 0x28]
mov rcx, rax
call fcn.140005668
movsxd r15, dword [rsp + 0x50]
add r15, r15
mov rax, r15
push rax
mov rbp, qword [rsp + 0x30]
lea rax, [rbp]
mov rax, rax
push rax
pop rcx
pop rdx
call fcn.140005810
movsxd rax, dword [rsp + 0x50]
mov rax, rax
push rax
lea rax, [rbp]
mov rax, rax
push rax
pop rcx
pop rdx
call sub.KERNEL32.dll_GetWindowsDirectoryW
mov rax, rax
push rax
pop rax
mov dword [rsp + 0x50], eax
push rcx
sub rsp, 0x28
call fcn.140005d50
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140005d50
add rsp, 0x28
pop rcx
push rax
push 0x19
push 0xffffffffffffffff
mov rbp, qword [rsp + 0x50]
lea rax, [rbp]
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.140005880
add rsp, 0x28
movabs rcx, 0x14008207a
sub rsp, 0x28
call fcn.140005b00
add rsp, 0x28
lea rcx, [rsp + 0x60]
pop rdx
call fcn.1400059e0
push rcx
sub rsp, 0x28
call fcn.140005d50
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140005d50
add rsp, 0x28
pop rcx
push rax
movabs rax, 0x140082076
push rax
push 1
push qword [rsp + 0x80]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400019c0
add rsp, 0x28
lea rcx, [rsp + 0x60]
pop rdx
call fcn.1400059e0
call fcn.1400035b0
mov r15, rax
cmp r15, 0x32
jne 0x140411414
mov rcx, qword [rsp + 0x58]
push rcx
sub rsp, 0x28
call fcn.140005d50
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140005b00
add rsp, 0x28
movabs rcx, str.:winnt_
sub rsp, 0x28
call fcn.140005b00
add rsp, 0x28
lea rcx, [rsp + 0x60]
pop rdx
call fcn.1400059e0
jmp 0x140411458
mov rcx, qword [rsp + 0x58]
push rcx
sub rsp, 0x28
call fcn.140005d50
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140005b00
add rsp, 0x28
movabs rcx, str.:windows_
sub rsp, 0x28
call fcn.140005b00
add rsp, 0x28
lea rcx, [rsp + 0x60]
pop rdx
call fcn.1400059e0
mov rcx, qword [rsp + 0x58]
push rcx
sub rsp, 0x28
call fcn.140005d50
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140005b00
add rsp, 0x28
pop rax
push rax
call fcn.140005d10
pop rdx
add rax, rdx
jmp 0x140411491
push rax
mov rcx, qword [rsp + 0x60]
sub rsp, 0x28
call fcn.140005c90
add rsp, 0x28
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.1400055f0
add rsp, 0x28
pop rax
add rsp, 0x68
pop r15
pop rbp
ret