Function at 0x140006d0c
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor r12d, r12d
mov rbp, rcx
test edx, edx
jns 0x140006d3e
mov rax, qword [0x140035730]
not edx
movsxd rdx, edx
mov edx, dword [rax + rdx*4]
mov r8, qword [0x1400367c4]
lea r13, [0x1400346c0]
movsxd rax, edx
mov rdi, r13
lea r14, [r8 + rax*2]
cmp rcx, r13
jb 0x140006d7a
mov rax, rcx
sub rax, r13
sar rax, 1
cmp rax, 0x800
jae 0x140006d7a
mov rdi, rcx
mov qword [rsp + 0x80], r12
mov rbp, r12
movzx ecx, word [r14]
mov r10d, 0x400
test cx, cx
je 0x140006fda
mov ebp, 4
lea esi, [rbp - 3]
lea r11d, [rbp - 2]
mov rax, rdi
mov r9, r14
sub rax, r13
and rax, 0xfffffffffffffffe
cmp rax, 0x800
jge 0x140006fd2
add r14, r11
cmp cx, bp
jae 0x140006fa5
movzx edx, byte [r14]
movzx r15d, byte [r14 + 1]
lea r14, [r9 + 4]
movsx ebx, byte [r9 + 3]
and ebx, 0x7f
movsx eax, dl
and eax, 0x7f
shl ebx, 7
or ebx, eax
mov dword [rsp + 0x34], edx
mov eax, edx
mov dword [rsp + 0x3c], r15d
bts eax, 0xf
mov dword [rsp + 0x30], eax
mov eax, r15d
bts eax, 0xf
mov dword [rsp + 0x38], eax
cmp cx, r11w
jne 0x140006f28
cmp dword [0x140036864], r12d
mov rsi, r11
mov eax, edx
cmovne rsi, rbp
test dl, dl
jns 0x140006e58
and edx, 0x40
and eax, 0x3f
mov dword [rsp + 0x20], edx
mov r9, rdi
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersion
mov rcx, 0xffffffff80000002
lea r8, [r8 + rax*2]
call fcn.14000790c
cmp word [rdi], r12w
jne 0x140006f03
mov edx, r15d
mov rcx, rdi
call fcn.140006d0c
jmp 0x140006efd
cmp edx, 0x25
jne 0x140006e6e
mov edx, r10d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x140006efd
cmp edx, 0x24
jne 0x140006ef8
mov edx, r10d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov rsi, r12
jmp 0x140006ef8
mov rax, qword [0x140035750]
dec rsi
test rax, rax
je 0x140006eb3
mov edx, dword [rsp + rsi*4 + 0x30]
xor r9d, r9d
mov rcx, qword [0x140035760]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call rax
test eax, eax
je 0x140006efd
mov edx, dword [rsp + rsi*4 + 0x30]
lea r8, [rsp + 0x90]
mov rcx, qword [0x140035760]
call sub.SHELL32.dll_SHGetSpecialFolderLocation
test eax, eax
jne 0x140006ef4
mov rcx, qword [rsp + 0x90]
mov rdx, rdi
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov rcx, qword [rsp + 0x90]
mov ebx, eax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test ebx, ebx
jne 0x140006efd
mov word [rdi], r12w
test rsi, rsi
jne 0x140006e88
cmp word [rdi], r12w
je 0x140006f19
cmp r15d, 0x1a
jne 0x140006f19
lea rdx, str.MicrosoftInternet_ExplorerQuick_Launch
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rcx, rdi
call fcn.140007d2c
mov esi, 1
jmp 0x140006f88
cmp cx, 3
jne 0x140006f77
mov rcx, rdi
cmp ebx, 0x1d
jne 0x140006f4c
mov r8, qword [0x140035760]
lea rdx, [0x14000a9c8]
call qword [sym.imp.USER32.dll_wsprintfW]
jmp 0x140006f65
lea rax, [section..ndata]
mov edx, ebx
shl rdx, 0xb
mov r8d, r10d
add rdx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
lea eax, [rbx - 0x15]
cmp eax, 7
jae 0x140006f88
mov rcx, rdi
call fcn.140007d2c
jmp 0x140006f88
cmp cx, si
jne 0x140006f88
not ebx
mov rcx, rdi
mov edx, ebx
call fcn.140006d0c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rdx, eax
mov r10d, 0x400
add rdx, rdx
mov r11d, 2
jmp 0x140006fba
mov rdx, r11
jne 0x140006fb7
movzx eax, word [r14]
lea r14, [r9 + 4]
mov word [rdi], ax
jmp 0x140006fba
mov word [rdi], cx
movzx ecx, word [r14]
add rdi, rdx
test cx, cx
je 0x140006fd2
mov r8, qword [0x1400367c4]
jmp 0x140006d99
mov rbp, qword [rsp + 0x80]
mov word [rdi], r12w
test rbp, rbp
je 0x140006ff4
mov r8d, r10d
mov rdx, r13
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
jmp 0x140006ff7
mov rax, r13
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret