Function at 0x1400a60c0
Capabilities:
Get common file path
Get startup folder

Disassembly:
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x2b0], rbx
mov rax, qword [0x1403a0088]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov rsi, rdx
mov rdi, rcx
xor eax, eax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rax
xor edx, edx
mov r8d, 0x104
lea rcx, str.X:UsersAdministratorAppDataRoamingMicrosoftWindowsStart_MenuProgramsStartup
call fcn.1402767a0
xor edx, edx
mov r8d, 0x104
lea rcx, str.X:ProgramDataMicrosoftWindowsStart_MenuProgramsStartUp
call fcn.1402767a0
xor edx, edx
mov r8d, 0x104
lea rcx, str.X:ProgramDataMicrosoftWindowsStart_MenuPrograms
call fcn.1402767a0
xor r9d, r9d
lea r8d, [r9 + 7]
lea rdx, str.X:UsersAdministratorAppDataRoamingMicrosoftWindowsStart_MenuProgramsStartup
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor r9d, r9d
lea r8d, [r9 + 0x18]
lea rdx, str.X:ProgramDataMicrosoftWindowsStart_MenuProgramsStartUp
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor r9d, r9d
lea r8d, [r9 + 0x17]
lea rdx, str.X:ProgramDataMicrosoftWindowsStart_MenuPrograms
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea rdx, [rsp + 0x48]
lea rcx, str.X:UsersAdministratorAppDataRoamingMicrosoftWindowsStart_MenuProgramsStartup
call fcn.1400a5900
lea rdx, [rsp + 0x48]
lea rcx, str.X:ProgramDataMicrosoftWindowsStart_MenuProgramsStartUp
call fcn.1400a5900
lea rdx, [rsp + 0x48]
lea rcx, str.X:ProgramDataMicrosoftWindowsStart_MenuPrograms
call fcn.1400a5b20
mov rcx, qword [0x140457ea0]
mov rax, rcx
mov rbx, qword [0x140457e98]
sub rax, rbx
sar rax, 5
test rax, rax
je 0x1400a627d
cmp rbx, rcx
je 0x1400a627d
cmp qword [rbx + 0x18], 8
jb 0x1400a61f2
mov r9, qword [rbx]
jmp 0x1400a61f5
mov r9, rbx
lea r8, str._sAppDataRoamingMicrosoftInternet_ExplorerQuick_Launch
mov edx, 0x104
lea rcx, [rsp + 0x60]
call fcn.14004e9f0
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryEmptyW]
test eax, eax
jne 0x1400a6229
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x60]
call fcn.1400a5900
cmp qword [rbx + 0x18], 8
jb 0x1400a6235
mov r9, qword [rbx]
jmp 0x1400a6238
mov r9, rbx
lea r8, str._sAppDataRoamingMicrosoftInternet_ExplorerQuick_LaunchUser_PinnedTaskBar
mov edx, 0x104
lea rcx, [rsp + 0x60]
call fcn.14004e9f0
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryEmptyW]
test eax, eax
jne 0x1400a626c
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x60]
call fcn.1400a5900
add rbx, 0x20
cmp rbx, qword [0x140457ea0]
jne 0x1400a61e6
mov rdx, qword [rsp + 0x50]
mov rax, rdx
mov rcx, qword [rsp + 0x48]
sub rax, rcx
sar rax, 5
test rax, rax
je 0x1400a62bd
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x30]
call fcn.140055ef0
mov r8, rsi
mov rdx, rdi
mov rcx, rax
call fcn.1400a5d90
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400a62dd
call fcn.140056290
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x48]
sub r8, rdx
sar r8, 5
call fcn.140056110
xor eax, eax
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.140125a70
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret