Function at 0x1800015c0
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x1e0
mov qword [rsp + 0xc0], 0xfffffffffffffffe
mov qword [rsp + 0x210], rbx
mov rax, qword [0x18002e010]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov rdi, rdx
mov rsi, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea r9, [0x180030118]
xor r8d, r8d
xor edx, edx
lea rcx, [0x1800213c0]
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
js 0x180001be0
lea r9, [0x180030120]
xor r8d, r8d
xor edx, edx
lea rcx, [0x1800213c0]
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
js 0x180001be0
movdqa xmm0, xmmword [0x180029de0]
movdqu xmmword [rsp + 0x30], xmm0
xor r14d, r14d
mov word [rsp + 0x20], r14w
lea rdx, str.Public_Cache6CE6C512EA433A7FC5C8841628E7696CD0FF7F2BMainFolderFiles_
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], r14w
jne 0x180001670
lea rcx, [rsp + 0x20]
call fcn.180001d60
nop
movdqa xmm0, xmmword [0x180029de0]
movdqu xmmword [rsp + 0x70], xmm0
mov word [rsp + 0x60], r14w
mov r8d, 0x10
lea rdx, str.AppDataRoaming
lea rcx, [rsp + 0x60]
call fcn.180001d60
nop
movdqa xmm0, xmmword [0x180029de0]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], r14w
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp word [rdi + r8*2], 0
jne 0x1800016d0
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.180001d60
nop
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0xa0]
call fcn.180001ed0
nop
lea r8, [rsp + 0x20]
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.180001ed0
mov rdx, rax
lea rcx, [0x18002ec68]
call fcn.180001cc0
mov rdx, qword [rsp + 0x98]
cmp rdx, 8
jb 0x18000176d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180001768
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180001c0a
call fcn.180007264
movdqa xmm0, xmmword [0x180029de0]
movdqu xmmword [rsp + 0x90], xmm0
mov word [rsp + 0x80], r14w
mov rdx, qword [rsp + 0xb8]
cmp rdx, 8
jb 0x1800017cf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800017ca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180001c10
call fcn.180007264
movdqa xmm0, xmmword [0x180029de0]
movdqu xmmword [rsp + 0xb0], xmm0
mov word [rsp + 0xa0], r14w
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x18000182b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180001826
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180001c16
call fcn.180007264
movdqa xmm0, xmmword [0x180029de0]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], r14w
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x180001881
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000187c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180001c1c
call fcn.180007264
movdqa xmm0, xmmword [0x180029de0]
movdqu xmmword [rsp + 0x70], xmm0
mov word [rsp + 0x60], r14w
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x1800018d7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800018d2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180001c22
call fcn.180007264
movdqa xmm0, xmmword [0x180029de0]
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x20], r14w
lea rdx, str.Public_Cache6CE6C512EA433A7FC5C8841628E7696CD0FF7F2BMainFolderFsFilter.log
mov r8, rbx
inc r8
cmp word [rdx + r8*2], 0
jne 0x1800018f5
lea rcx, [rsp + 0x20]
call fcn.180001d60
nop
movdqa xmm0, xmmword [0x180029de0]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], r14w
mov r8d, 0x10
lea rdx, str.AppDataRoaming
lea rcx, [rsp + 0x40]
call fcn.180001d60
nop
movdqa xmm0, xmmword [0x180029de0]
movdqu xmmword [rsp + 0x70], xmm0
mov word [rsp + 0x60], r14w
mov r8, rbx
nop
inc r8
cmp word [rdi + r8*2], 0
jne 0x180001950
mov rdx, rdi
lea rcx, [rsp + 0x60]
call fcn.180001d60
nop
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x80]
call fcn.180001ed0
nop
lea r8, [rsp + 0x20]
mov rdx, rax
lea rcx, [rsp + 0xa0]
call fcn.180001ed0
mov rdx, rax
lea rcx, [0x18002ec48]
call fcn.180001cc0
mov rdx, qword [rsp + 0xb8]
cmp rdx, 8
jb 0x1800019ed
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800019e8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180001c28
call fcn.180007264
movdqa xmm0, xmmword [0x180029de0]
movdqu xmmword [rsp + 0xb0], xmm0
mov word [rsp + 0xa0], r14w
mov rdx, qword [rsp + 0x98]
cmp rdx, 8
jb 0x180001a4f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180001a4a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180001c2e
call fcn.180007264
movdqa xmm0, xmmword [0x180029de0]
movdqu xmmword [rsp + 0x90], xmm0
mov word [rsp + 0x80], r14w
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x180001aab
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180001aa6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180001c34
call fcn.180007264
movdqa xmm0, xmmword [0x180029de0]
movdqu xmmword [rsp + 0x70], xmm0
mov word [rsp + 0x60], r14w
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x180001b01
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180001afc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180001c3a
call fcn.180007264
movdqa xmm0, xmmword [0x180029de0]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], r14w
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x180001b57
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180001b52
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180001c40
call fcn.180007264
movdqa xmm0, xmmword [0x180029de0]
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x20], r14w
nop dword [rax + rax]
inc rbx
cmp word [rsi + rbx*2], 0
jne 0x180001b70
mov r8, rbx
mov rdx, rsi
lea rcx, [rsp + 0x20]
call fcn.180001d60
lea rdx, [rsp + 0x20]
lea rcx, [0x18002ec28]
call fcn.180001cc0
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x180001bd9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180001bd4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180001c46
call fcn.180007264
mov eax, 1
jmp 0x180001be6
xor eax, eax
jmp 0x180001be6
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.180006e20
mov rbx, qword [rsp + 0x210]
add rsp, 0x1e0
pop r14
pop rdi
pop rsi
ret
call fcn.18000f7d0
nop
call fcn.18000f7d0
nop
call fcn.18000f7d0
nop
call fcn.18000f7d0
nop
call fcn.18000f7d0
nop
call fcn.18000f7d0
nop
call fcn.18000f7d0
nop
call fcn.18000f7d0
nop
call fcn.18000f7d0
nop
call fcn.18000f7d0
int3
call fcn.18000f7d0
int3