Function at 0x140093370
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x160]
sub rsp, 0x260
mov rax, qword [0x140136e20]
xor rax, rsp
mov qword [rbp + 0x150], rax
xor r9d, r9d
mov rbx, rdx
lea rax, [rsp + 0x30]
mov rdi, rcx
lea edx, [r9 + 3]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderLocation]
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov r8d, 1
call fcn.140092ff0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea rcx, [rsp + 0x40]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x14009340a
lea ecx, [rax + 3]
mov rdx, rbx
call fcn.140092e10
xor eax, eax
jmp 0x140093873
xor r9d, r9d
lea rax, [rsp + 0x30]
xor r8d, r8d
lea edx, [r9 + 0xa]
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderLocation]
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov r8d, 1
call fcn.140092ff0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea rcx, [rsp + 0x40]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x14009346a
lea ecx, [rax + 0xa]
mov rdx, rbx
call fcn.140092e10
xor eax, eax
jmp 0x140093873
xor r9d, r9d
lea rax, [rsp + 0x30]
xor r8d, r8d
lea edx, [r9 + 0x11]
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderLocation]
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov r8d, 1
call fcn.140092ff0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea rcx, [rsp + 0x40]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1400934ca
lea ecx, [rax + 0x11]
mov rdx, rbx
call fcn.140092e10
xor eax, eax
jmp 0x140093873
xor r9d, r9d
lea rax, [rsp + 0x30]
xor r8d, r8d
lea edx, [r9 + 0x12]
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderLocation]
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov r8d, 1
call fcn.140092ff0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea rcx, [rsp + 0x40]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x14009352a
lea ecx, [rax + 0x12]
mov rdx, rbx
call fcn.140092e10
xor eax, eax
jmp 0x140093873
xor r9d, r9d
lea rax, [rsp + 0x30]
xor r8d, r8d
lea edx, [r9 + 0x31]
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderLocation]
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov r8d, 1
call fcn.140092ff0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea rcx, [rsp + 0x40]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x14009358a
lea ecx, [rax + 0x31]
mov rdx, rbx
call fcn.140092e10
xor eax, eax
jmp 0x140093873
xor r9d, r9d
lea rax, [rsp + 0x30]
xor r8d, r8d
lea edx, [r9 + 4]
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderLocation]
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov r8d, 1
call fcn.140092ff0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea rcx, [rsp + 0x40]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1400935ea
lea ecx, [rax + 4]
mov rdx, rbx
call fcn.140092e10
xor eax, eax
jmp 0x140093873
xor r9d, r9d
lea rax, [rsp + 0x30]
xor r8d, r8d
lea edx, [r9 + 6]
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderLocation]
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov r8d, 1
call fcn.140092ff0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea rcx, [rsp + 0x40]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x14009364a
lea ecx, [rax + 6]
mov rdx, rbx
call fcn.140092e10
xor eax, eax
jmp 0x140093873
xor r9d, r9d
lea rax, [rsp + 0x30]
xor r8d, r8d
lea edx, [r9 + 0x27]
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderLocation]
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov r8d, 1
call fcn.140092ff0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea rcx, [rsp + 0x40]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1400936ac
mov rdx, rbx
mov ecx, 0x27
call fcn.140092e10
xor eax, eax
jmp 0x140093873
xor r9d, r9d
lea rax, [rsp + 0x30]
xor r8d, r8d
lea edx, [r9 + 0xd]
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderLocation]
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov r8d, 1
call fcn.140092ff0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea rcx, [rsp + 0x40]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x14009370e
mov rdx, rbx
mov ecx, ILFindLastID
call fcn.140092e10
xor eax, eax
jmp 0x140093873
xor r9d, r9d
lea rax, [rsp + 0x30]
xor r8d, r8d
lea edx, [r9 + 0xe]
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderLocation]
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov r8d, 1
call fcn.140092ff0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea rcx, [rsp + 0x40]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140093770
mov rdx, rbx
mov ecx, ILClone
call fcn.140092e10
xor eax, eax
jmp 0x140093873
or r9d, 0xffffffff
lea r8, str.Desktop
mov dword [rsp + 0x28], 0xffffffff
lea edx, [r9 + 2]
mov qword [rsp + 0x20], rdi
lea ecx, [rdx + 0x7e]
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x1400937ab
mov rdx, rbx
xor ecx, ecx
call fcn.140092e10
xor eax, eax
jmp 0x140093873
or r9d, 0xffffffff
lea r8, str.Pictures
mov dword [rsp + 0x28], 0xffffffff
lea edx, [r9 + 2]
mov qword [rsp + 0x20], rdi
lea ecx, [rdx + 0x7e]
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x140093698
or r9d, 0xffffffff
lea r8, str.Music
mov dword [rsp + 0x28], 0xffffffff
lea edx, [r9 + 2]
mov qword [rsp + 0x20], rdi
lea ecx, [rdx + 0x7e]
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x1400936fa
or r9d, 0xffffffff
lea r8, str.Videos
mov dword [rsp + 0x28], 0xffffffff
lea edx, [r9 + 2]
mov qword [rsp + 0x20], rdi
lea ecx, [rdx + 0x7e]
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x14009375c
or r9d, 0xffffffff
lea r8, str.Documents
mov dword [rsp + 0x28], 0xffffffff
lea edx, [r9 + 2]
mov qword [rsp + 0x20], rdi
lea ecx, [rdx + 0x7e]
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x14009386e
lea ecx, [rax + 3]
mov rdx, rbx
call fcn.140092e10
xor eax, eax
jmp 0x140093873
mov eax, 0x80004005
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.14004ae00
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret