Function at 0x140009625
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rbp, rcx
mov ecx, edx
test edx, edx
jns 0x140009650
mov rax, qword [0x140010c20]
not ecx
movsxd rcx, ecx
mov rax, qword [rax]
mov ecx, dword [rax + rcx*4]
call fcn.140008c8c
mov r12, rax
test rax, rax
je 0x140009917
lea rbx, [0x140046440]
cmp rbp, rbx
jb 0x140009680
mov rax, rbp
sub rax, rbx
cmp rax, 0x3ffe
ja 0x140009680
mov rbx, rbp
xor ebp, ebp
mov rsi, r12
mov cx, word [rsi]
test cx, cx
je 0x1400098e3
mov rax, rbx
lea rdi, [0x140046440]
sub rax, rdi
cmp rax, 0x1ffe
jg 0x1400098e3
cmp cx, 3
ja 0x1400098bd
movsx edi, byte [rsi + 3]
mov al, byte [rsi + 2]
add rsi, 4
mov r15w, word [rsi - 2]
shl edi, 7
and eax, 0x7f
and edi, 0x3f80
mov r14d, r15d
or edi, eax
movzx eax, r15b
shr r14w, 8
mov edx, eax
movzx r13d, r14w
mov dword [rsp + 0x34], eax
or dh, 0x80
mov dword [rsp + 0x3c], r13d
mov dword [rsp + 0x30], edx
mov edx, r14d
or dx, 0x8000
movzx edx, dx
mov dword [rsp + 0x38], edx
cmp cx, 2
jne 0x140009854
mov rdx, qword [0x140010c90]
cmp dword [rdx + 4], 1
sbb edi, edi
and edi, 0xfffffffe
add edi, 4
test r15b, r15b
jns 0x14000976f
mov ecx, r15d
and ecx, 0x3f
call fcn.140008c8c
mov r9, rbx
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersion
mov rcx, 0xffffffff80000002
mov rdi, rax
mov eax, r15d
and eax, 0x40
mov r8, rdi
mov dword [rsp + 0x20], eax
call fcn.140008aaf
mov rcx, rdi
call fcn.140008d12
cmp word [rbx], 0
jne 0x14000979c
mov edx, r13d
mov rcx, rbx
call fcn.140009625
jmp 0x14000979c
cmp eax, 0x25
jne 0x140009784
mov edx, 0x1000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x14000979c
cmp eax, 0x24
je 0x14000978e
movsxd rdi, edi
jmp 0x1400097f6
mov edx, 0x1000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xor edi, edi
jmp 0x140009789
mov rax, qword [0x140010c40]
mov r13d, dword [rsp + rdi*4 + 0x2c]
mov rax, qword [rax]
mov edx, r13d
mov r15d, r13d
and edx, 0xffffffbf
and r15d, 0x8000
test rax, rax
jne 0x1400097fc
mov ecx, 4
call fcn.1400095a6
mov rcx, qword [0x140010cf0]
mov edx, r13d
mov r8d, r15d
and edx, 0xbf
mov rcx, qword [rcx]
call rax
mov r13, rax
test rax, rax
jne 0x140009835
mov word [rbx], 0
dec rdi
test edi, edi
jne 0x1400097a0
jmp 0x140009817
mov rcx, qword [0x140010cf0]
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rcx]
call rax
test eax, eax
jne 0x1400097c4
cmp word [rbx], 0
je 0x140009894
cmp r14w, 0x1a
jne 0x140009894
lea rdx, str.MicrosoftInternet_ExplorerQuick_Launch
mov rcx, rbx
call sub.KERNEL32.dll_lstrcatW
jmp 0x140009894
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov rcx, r13
mov r15d, eax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test r15d, r15d
je 0x1400097ee
jmp 0x140009817
cmp cx, 3
jne 0x14000989e
cmp edi, 0x1d
jne 0x140009873
mov rax, qword [0x140010cf0]
mov rcx, rbx
mov rdx, qword [rax]
call fcn.140008b43
jmp 0x1400098aa
movsxd rdx, edi
lea rax, [section..ndata]
mov rcx, rbx
sub edi, 0x15
shl rdx, 0xd
add rdx, rax
call fcn.140008c03
cmp edi, 6
ja 0x1400098aa
mov rcx, rbx
call fcn.140008d1d
jmp 0x1400098aa
not edi
mov rcx, rbx
mov edx, edi
call fcn.140009625
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cdqe
add rax, rax
add rax, rbx
jmp 0x1400098db
lea rax, [rbx + 2]
cmp cx, 4
jne 0x1400098d4
mov dx, word [rsi + 2]
add rsi, 4
mov word [rbx], dx
jmp 0x1400098db
mov word [rbx], cx
add rsi, 2
mov rbx, rax
jmp 0x140009683
mov word [rbx], 0
mov rcx, r12
lea r12, [0x140046440]
call fcn.140008d12
test rbp, rbp
je 0x140009917
mov rdx, r12
mov rcx, rbp
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.140008c03
mov rax, r12
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret