Function at 0x140018310
Capabilities:
Get common file path
Get startup folder

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2a0
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x1400f2bd8]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov rbp, rcx
mov qword [rsp + 0x70], rcx
lea rcx, [rsp + 0x50]
call fcn.1400671d8
nop
call fcn.140063708
mov rcx, rax
xor esi, esi
mov edx, esi
test rax, rax
setne dl
test edx, edx
jne 0x14001837e
mov ecx, 0x80004005
call fcn.140001950
int3
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x38], rbx
mov word [rsp + 0x80], 0
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x82]
call fcn.1400935f0
lea rdx, [rsp + 0x80]
mov qword [rsp + 0x20], rdx
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x23]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
xor eax, eax
or r12, 0xffffffffffffffff
mov rcx, r12
lea rdi, [rsp + 0x80]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
test ecx, ecx
jne 0x14001844c
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x1400184d9
cmp dword [rdx + 0x10], eax
jge 0x14001841d
cmp dword [rbx - 0xc], eax
jge 0x140018412
mov ecx, 0x80070057
call fcn.140001950
int3
mov dword [rbx - 0x10], esi
mov word [rbx], ax
jmp 0x1400184d9
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140018435
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x38], rbx
jmp 0x1400184d9
mov r13d, dword [rbx - 0x10]
lea r14, [rsp + 0x80]
sub r14, rbx
sar r14, 1
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x140018480
mov edx, edi
lea rcx, [rsp + 0x38]
call fcn.140001970
mov rbx, qword [rsp + 0x38]
cmp r14, r13
ja 0x1400184a0
movsxd rax, edi
lea r13, [rax + rax]
lea r8, [rbx + r14*2]
mov r9, r13
mov rdx, r13
mov rcx, rbx
call fcn.14008ea80
jmp 0x1400184bd
movsxd rax, edi
lea r13, [rax + rax]
mov r9, r13
lea r8, [rsp + 0x80]
mov rdx, r13
mov rcx, rbx
call fcn.14008f260
test edi, edi
js 0x140018668
cmp edi, dword [rbx - 0xc]
jg 0x140018668
mov dword [rbx - 0x10], edi
mov word [r13 + rbx], 0
xor eax, eax
mov rcx, r12
lea r14, str._rtkhdaud.dat
mov rdi, r14
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov qword [rsp + 0x48], rcx
mov r13, r14
sub r13, rbx
sar r13, 1
mov r15d, dword [rbx - 0x10]
lea edi, [r15 + rcx]
mov edx, 1
sub edx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, edx
jge 0x14001852f
mov edx, edi
lea rcx, [rsp + 0x38]
call fcn.140001970
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
cmp r13, r15
ja 0x140018538
lea r14, [rbx + r13*2]
movsxd rdx, ecx
add rdx, rdx
lea rcx, [rbx + r15*2]
mov r9, rdx
mov r8, r14
call fcn.14008f260
test edi, edi
js 0x14001865d
cmp edi, dword [rbx - 0xc]
jg 0x14001865d
mov dword [rbx - 0x10], edi
movsxd rax, edi
mov word [rbx + rax*2], 0
xor r9d, r9d
mov r8d, 0x9001
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.140067b0c
test eax, eax
je 0x14001860e
mov rax, qword [rbp]
cmp dword [rax - 0x10], 0
jle 0x140018603
mov r9d, 2
mov r8d, esi
lea rdx, [rsp + 0x40]
mov rcx, rbp
call fcn.1400109e0
nop
xor edx, edx
lea r8d, [rdx + 0x10]
mov rdi, qword [rsp + 0x40]
mov rcx, rdi
call fcn.140090a50
mov byte [rsp + 0x30], al
mov r8d, 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.140066e58
nop
lea rdx, [rdi - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400185f2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add esi, 2
mov rax, qword [rbp]
cmp esi, dword [rax - 0x10]
jl 0x140018592
mov rbx, qword [rsp + 0x38]
lea rcx, [rsp + 0x50]
call fcn.140067150
nop
lea rdx, [rbx - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14001862b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x50]
call fcn.140067444
nop
mov rdx, qword [rbp]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], r12d
add r12d, 0xffffffff
test r12d, r12d
jg 0x140018656
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, 1
jmp 0x140018673
mov ecx, 0x80070057
call fcn.140001950
int3
mov ecx, 0x80070057
call fcn.140001950
nop
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.14008f240
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret