Function at 0x1400b9300
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x140398250]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
mov dword [rcx + 0x1c], 0x80000000
xor edx, edx
add rcx, 0x24
mov r8d, 0x11c
call fcn.14024b970
lea rcx, [rbx + 0x24]
mov dword [rbx + 0x24], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x1400b9360
lea rcx, [rbx + 0x24]
mov dword [rbx + 0x24], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x148]
mov rcx, rbx
mov dword [rbx + 0x1c], eax
mov rax, qword [rbx]
call qword [rax + 0x158]
mov dword [rbx + 0x18], eax
mov rcx, qword [0x1403b9750]
test rcx, rcx
je 0x1400b95d9
mov rax, qword [rcx]
call qword [rax + 0x48]
test rax, rax
je 0x1400b95d9
mov eax, dword [rbx + 8]
lea r9, [0x1402dc3ec]
lea rcx, [rsp + 0x30]
or r8, 0xffffffffffffffff
mov edx, 0x104
mov dword [rsp + 0x20], eax
call fcn.14024679c
mov rcx, qword [0x1403b9750]
mov rax, qword [rcx]
call qword [rax + 0x48]
lea r8, [rsp + 0x30]
lea rdx, str.VersionNT
mov r10, qword [rax]
mov rcx, rax
call qword [r10 + 0x20]
mov r11d, dword [rbx + 0xc]
lea r9, [0x1402dc3ec]
lea rcx, [rsp + 0x30]
or r8, 0xffffffffffffffff
mov edx, 0x104
mov dword [rsp + 0x20], r11d
call fcn.14024679c
mov rcx, qword [0x1403b9750]
mov rax, qword [rcx]
call qword [rax + 0x48]
lea r8, [rsp + 0x30]
lea rdx, str.VersionNT64
mov r9, qword [rax]
mov rcx, rax
call qword [r9 + 0x20]
mov r11, qword [rbx]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0xe0]
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov rcx, qword [0x1403b9750]
mov rax, qword [rcx]
call qword [rax + 0x48]
lea r8, [rsp + 0x30]
lea rdx, str.ProgramFilesFolder
mov r9, qword [rax]
mov rcx, rax
call qword [r9 + 0x20]
mov rcx, qword [0x1403b9750]
mov rax, qword [rcx]
call qword [rax + 0x48]
lea r8, [rsp + 0x30]
lea rdx, str.ProgramFilesFolder
mov r9, qword [rax]
mov rcx, rax
call qword [r9 + 0x20]
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov rcx, qword [0x1403b9750]
mov rax, qword [rcx]
call qword [rax + 0x48]
lea r8, [rsp + 0x30]
lea rdx, str.WindowsFolder
mov r9, qword [rax]
mov rcx, rax
call qword [r9 + 0x20]
mov rcx, qword [0x1403b9750]
mov rax, qword [rcx]
call qword [rax + 0x48]
lea r8, [0x1402dc4e0]
lea rdx, str.StartupFolder
mov r9, qword [rax]
mov rcx, rax
call qword [r9 + 0x20]
mov r11, qword [rbx]
lea rdx, [rsp + 0x30]
mov r8d, 0x104
mov rcx, rbx
call qword [r11 + 0xe8]
mov rcx, qword [0x1403b9750]
mov rax, qword [rcx]
call qword [rax + 0x48]
mov r9, qword [rax]
lea r8, [rsp + 0x30]
lea rdx, str.SOURCEDIR
mov rcx, rax
call qword [r9 + 0x20]
mov r11, qword [rbx]
lea rdx, [rsp + 0x30]
mov r8d, 0x104
mov rcx, rbx
call qword [r11 + 0xf0]
mov rcx, qword [0x1403b9750]
mov rax, qword [rcx]
call qword [rax + 0x48]
lea r8, [rsp + 0x30]
lea rdx, str.INSTTEMPPATH
mov r9, qword [rax]
mov rcx, rax
call qword [r9 + 0x20]
mov r11, qword [rbx]
lea rdx, [rsp + 0x30]
mov r8d, 0x104
mov rcx, rbx
call qword [r11 + 0xf8]
mov rcx, qword [0x1403b9750]
mov rax, qword [rcx]
call qword [rax + 0x48]
lea r8, [rsp + 0x30]
lea rdx, str.INSTALLDIR
mov r9, qword [rax]
mov rcx, rax
call qword [r9 + 0x20]
mov r11, qword [rbx]
lea rdx, [rsp + 0x30]
mov r8d, 0x104
mov rcx, rbx
call qword [r11 + pe_nt_image_headers64]
mov rcx, qword [0x1403b9750]
mov rax, qword [rcx]
call qword [rax + 0x48]
lea r8, [rsp + 0x30]
lea rdx, str.TEMPPATH
mov r9, qword [rax]
mov rcx, rax
call qword [r9 + 0x20]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140245660
mov rbx, qword [rsp + 0x268]
add rsp, 0x250
pop rdi
ret