Function at 0x1400448bc
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x1400da318]
xor rax, rsp
mov qword [rbp + 0x170], rax
xor r14d, r14d
mov dword [rsp + 0x48], 4
lea rax, [rsp + 0x48]
mov byte [rcx], r14b
mov qword [rsp + 0x30], rax
lea r8, str.CatalogLogOnCorruption
lea rax, [rsp + 0x4c]
mov rsi, rcx
lea r9d, [r14 + 0x10]
mov qword [rsp + 0x28], rax
lea rdx, str.SOFTWAREMicrosoftWindows_Search
mov ebx, r14d
call fcn.14000a76c
test eax, eax
jne 0x140044b0f
cmp dword [rsp + 0x4c], r14d
je 0x140044b0f
lea rax, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea edx, [r14 + 0x23]
xor ecx, ecx
call qword [sym.imp.ext_ms_win_shell32_shellfolders_l1_1_0.dll_SHGetFolderPathW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x140044b0f
mov ecx, 0x104
lea rax, [rsp + 0x60]
mov edx, ecx
cmp word [rax], r14w
je 0x140044984
add rax, 2
sub rdx, 1
jne 0x140044974
mov rax, rdx
neg rax
sbb ebx, ebx
not ebx
and ebx, 0x80070057
test rdx, rdx
je 0x1400449a1
mov rax, rcx
sub rax, rdx
jmp 0x1400449a4
mov rax, r14
test rdx, rdx
je 0x140044a06
lea rdx, [rsp + 0x60]
lea rdx, [rdx + rax*2]
sub rcx, rax
je 0x1400449ea
lea r8, [rax + 0x7ffffefa]
add r8, rcx
lea r9, str.MicrosoftSearchCatalogCorruptionLoglogdata.txt
sub r9, rdx
test r8, r8
je 0x1400449ea
movzx eax, word [r9 + rdx]
test ax, ax
je 0x1400449ea
mov word [rdx], ax
dec r8
add rdx, 2
sub rcx, 1
jne 0x1400449cb
test rcx, rcx
lea rax, [rdx - 2]
cmovne rax, rdx
neg rcx
sbb ebx, ebx
not ebx
and ebx, 0x8007007a
mov word [rax], r14w
test ebx, ebx
js 0x140044b0f
mov qword [rsp + 0x30], r14
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x28], r14d
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateFileW]
nop dword [rax + rax]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140044ae3
xor r9d, r9d
lea rdx, [rsp + 0x40]
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileTime]
nop dword [rax + rax]
test eax, eax
jne 0x140044a82
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x140044a82
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
js 0x140044ad2
mov rax, qword [rsp + 0x40]
movabs rcx, 0xc92a69c000
add rax, rcx
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x40], eax
shr rax, 0x20
mov dword [rsp + 0x44], eax
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemTimeAsFileTime]
nop dword [rax + rax]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CompareFileTime]
nop dword [rax + rax]
test eax, eax
jns 0x140044ad2
mov byte [rsi], 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
jmp 0x140044b0f
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x140044afe
movzx ebx, ax
or ebx, 0x80070000
lea eax, [rbx + 0x7ff8fffe]
cmp eax, 1
ja 0x140044b0f
mov ebx, r14d
mov byte [rsi], 1
mov eax, ebx
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.140029fb0
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret