Function at 0x1400017e0
Capabilities:
Get common file path

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x2c0
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov rax, qword [0x140064270]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
mov rdi, rdx
mov ebp, 0x104
mov edx, ebp
lea rcx, [r11 - 0x228]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor esi, esi
cmp eax, esi
jne 0x140001855
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.GetSystemDirectory___returns_0__GetLastError___d
lea rcx, [0x1400585c8]
call fcn.140003328
mov eax, 0xffffff32
jmp 0x140001acb
lea ebx, [rax + 1]
cmp ebx, ebp
jb 0x140001879
lea rdx, str.GetSystemDirectory_buffer_overflow
lea rcx, [0x1400585c8]
call fcn.140003328
mov eax, 0xffffff2c
jmp 0x140001acb
lea r8, [0x140058628]
mov rdx, rbp
lea rcx, [rsp + 0xa0]
call fcn.140010b08
lea rcx, str.SogouPY.ime
call fcn.1400108d4
movsxd rcx, ebx
add rax, rcx
cmp rax, rbp
jb 0x1400018db
mov word [rsp + rcx*2 + 0xa0], si
lea r9, str.SogouPY.ime
lea r8, [rsp + 0xa0]
lea rdx, str.buffer_overflow:__s_s
lea rcx, [0x140058660]
call fcn.140003328
mov eax, 0xffffff22
jmp 0x140001acb
lea r8, str.SogouPY.ime
mov rdx, rbp
lea rcx, [rsp + 0xa0]
call fcn.140010b08
lea rcx, [rsp + 0x48]
call fcn.14003b5c0
nop
mov dword [rsp + 0x20], 0xe0000804
mov r9d, 0xf000ffff
lea r8, str.SogouPY.ime
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x48]
call fcn.140005284
cmp al, sil
je 0x140001933
mov ebx, dword [rsp + 0x6c]
cmp rbx, rsi
jne 0x140001a08
mov rdx, rdi
lea rcx, [rsp + 0xa0]
call sub.IMM32.dll_ImmInstallIMEW
mov rbx, rax
mov qword [rsp + 0x30], rax
cmp rax, rsi
jne 0x140001a08
mov edx, 0x5c
lea rcx, [rsp + 0xa0]
call fcn.1400108f0
mov rbx, rax
lea rcx, [rsp + 0x38]
call fcn.14003b5c0
nop
mov dword [rsp + 0x20], 0x804
mov r9d, 0xffff
lea r8, [rbx + 2]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x38]
call fcn.140005284
cmp al, sil
jne 0x1400019fa
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, esi
je 0x1400019c4
lea r9, [rsp + 0xa0]
mov r8d, eax
lea rdx, str.ImmInstallIME___returns_NULL__GetLastError_____d__Filename___s
lea rcx, [0x140058708]
call fcn.140003328
mov r9, rdi
lea r8, [rsp + 0xa0]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x38]
call fcn.140005864
cmp al, sil
jne 0x1400019f3
lea rcx, [rsp + 0x38]
call fcn.14003b520
nop
jmp 0x140001abf
mov rbx, qword [rsp + 0x30]
jmp 0x1400019fe
mov ebx, dword [rsp + 0x6c]
lea rcx, [rsp + 0x38]
call fcn.14003b520
call fcn.14000160c
mov rdi, rax
cmp rax, rsi
je 0x140001a35
mov r9b, 1
lea r8, str.HKEY_CURRENT_USER
mov rdx, rax
mov rcx, rbx
call fcn.1400023dc
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140001a4e
mov r9b, 1
lea r8, str.HKEY_CURRENT_USER
mov rdx, 0xffffffff80000001
mov rcx, rbx
call fcn.1400023dc
mov rcx, rbx
call fcn.140002ba4
mov rdi, rsi
cmp qword [str..DEFAULT], rsi
je 0x140001abd
lea rbp, str..DEFAULT
mov rax, rbp
mov qword [rsp + 0x30], rsi
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, qword [rax]
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x140001ab0
mov rdx, qword [rsp + 0x30]
mov rcx, rbx
call fcn.140002fa4
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc rdi
lea rax, [rbp + rdi*8]
cmp qword [rax], rsi
jne 0x140001a6c
mov ebx, esi
lea rcx, [rsp + 0x48]
call fcn.14003b520
mov eax, ebx
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.14000fd20
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret