Function at 0x1400b43c0
Capabilities:
Get common file path
Query environment variable

Disassembly:
mov qword [rsp + 0x18], r8
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1fd0]
mov eax, 0x20d0
call fcn.140247340
sub rsp, rax
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x2100], rbx
mov qword [rsp + 0x2108], rsi
mov qword [rsp + 0x2118], rdi
mov r12d, r9d
mov r15, r8
mov rbx, rdx
mov r13, rcx
mov r8d, r9d
xor edx, edx
mov rcx, r15
call fcn.140249b10
lea rdi, str.CSIDL_ALTSTARTUP
mov qword [rsp + 0x50], rdi
mov dword [rsp + 0x58], 0x1d
lea rax, str.CSIDL_APPDATA
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x1a
lea rax, str.CSIDL_BITBUCKET
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x78], 0xa
lea rax, str.CSIDL_COMMON_ALTSTARTUP
mov qword [rbp - 0x80], rax
mov dword [rbp - 0x78], 0x1e
lea rax, str.CSIDL_COMMON_APPDATA
mov qword [rbp - 0x70], rax
mov dword [rbp - 0x68], 0x23
lea rax, str.CSIDL_COMMON_DESKTOPDIRECTORY
mov qword [rbp - 0x60], rax
mov dword [rbp - 0x58], 0x19
lea rax, str.CSIDL_COMMON_DOCUMENTS
mov qword [rbp - 0x50], rax
mov dword [rbp - 0x48], PathResolve
lea rax, str.CSIDL_COMMON_FAVORITES
mov qword [rbp - 0x40], rax
mov dword [rbp - 0x38], 0x1f
lea rax, str.CSIDL_COMMON_PROGRAMS
mov qword [rbp - 0x30], rax
mov dword [rbp - 0x28], reloc.OLEAUT32.dll_SafeArrayUnaccessData
lea rax, str.CSIDL_COMMON_STARTMENU
mov qword [rbp - 0x20], rax
mov dword [rbp - 0x18], reloc.WSOCK32.dll_shutdown
lea rax, str.CSIDL_COMMON_STARTUP
mov qword [rbp - 0x10], rax
mov dword [rbp - 8], reloc.OLEAUT32.dll_SafeArrayGetElement
lea rax, str.CSIDL_COMMON_TEMPLATES
mov qword [rbp], rax
mov dword [rbp + 8], PathResolve
lea rax, str.CSIDL_CONTROLS
mov qword [rbp + 0x10], rax
mov dword [rbp + 0x18], 3
lea rax, str.CSIDL_COOKIES
mov qword [rbp + 0x20], rax
mov dword [rbp + 0x28], 0x21
lea rax, str.CSIDL_DESKTOP
mov qword [rbp + 0x30], rax
xor esi, esi
mov dword [rbp + 0x38], esi
lea rax, str.CSIDL_DESKTOPDIRECTORY
mov qword [rbp + 0x40], rax
mov dword [rbp + 0x48], reloc.OLEAUT32.dll_SafeArrayGetDim
lea rax, str.CSIDL_DRIVES
mov qword [rbp + 0x50], rax
mov dword [rbp + 0x58], reloc.COMCTL32.dll_InitCommonControls
lea rax, str.CSIDL_FAVORITES
mov qword [rbp + 0x60], rax
mov dword [rbp + 0x68], 6
lea rax, str.CSIDL_FONTS
mov qword [rbp + 0x70], rax
mov dword [rbp + 0x78], SafeArrayUnaccessData
lea rax, str.CSIDL_HISTORY
mov qword [rbp + 0x80], rax
mov dword [rbp + 0x88], 0x22
lea rax, str.CSIDL_INTERNET
mov qword [rbp + 0x90], rax
mov dword [rbp + 0x98], 1
lea rax, str.CSIDL_INTERNET_CACHE
mov qword [rbp + 0xa0], rax
mov dword [rbp + 0xa8], 0x20
lea rax, str.CSIDL_LOCAL_APPDATA
mov qword [rbp + 0xb0], rax
mov dword [rbp + 0xb8], 0x1c
lea rax, str.CSIDL_PERSONAL
mov qword [rbp + 0xc0], rax
mov dword [rbp + 0xc8], 5
lea rax, str.CSIDL_PROGRAM_FILES
mov qword [rbp + 0xd0], rax
mov dword [rbp + 0xd8], 0x26
lea rax, str.CSIDL_PROGRAM_FILESX86
mov qword [rbp + 0xe0], rax
mov dword [rbp + 0xe8], PathResolve
lea rax, str.CSIDL_PROGRAM_FILES_COMMON
mov qword [rbp + 0xf0], rax
mov dword [rbp + 0xf8], PathResolve
lea rax, str.CSIDL_PROGRAM_FILES_COMMONX86
mov qword [rbp + 0x100], rax
mov dword [rbp + 0x108], PathResolve
lea rax, str.CSIDL_PROGRAMS
mov qword [rbp + 0x110], rax
mov dword [rbp + 0x118], 2
lea rax, str.CSIDL_RECENT
mov qword [rbp + 0x120], rax
mov dword [rbp + 0x128], 8
lea rax, str.CSIDL_SENDTO
mov qword [rbp + 0x130], rax
mov dword [rbp + 0x138], 9
lea rax, str.CSIDL_STARTMENU
mov qword [rbp + 0x140], rax
mov dword [rbp + 0x148], SafeArrayGetDim
lea rax, str.CSIDL_STARTUP
mov qword [rbp + 0x150], rax
mov dword [rbp + 0x158], 7
lea rax, str.CSIDL_SYSTEM
mov qword [rbp + 0x160], rax
mov dword [rbp + 0x168], 0x25
lea rax, str.CSIDL_SYSTEMX86
mov qword [rbp + 0x170], rax
mov dword [rbp + 0x178], 0x29
lea rax, str.CSIDL_TEMPLATES
mov qword [rbp + 0x180], rax
mov dword [rbp + 0x188], SafeArrayUnaccessData
lea rax, str.CSIDL_WINDOWS
mov qword [rbp + 0x190], rax
mov dword [rbp + 0x198], 0x24
lea rax, str.CSIDL_PROFILE
mov qword [rbp + 0x1a0], rax
mov dword [rbp + 0x1a8], 0x28
mov qword [rbp + 0x1b0], rsi
mov dword [rbp + 0x1b8], esi
xor edx, edx
mov r8d, 0x820
lea rcx, [rbp + 0x770]
call fcn.140249b10
lea rdx, str._CSIDL_
mov rcx, rbx
call fcn.140249ef0
mov r14, rax
test rax, rax
je 0x1400b4906
xor edx, edx
mov r8d, 0x820
lea rcx, [rbp + 0xf90]
call fcn.140249b10
mov r8, r14
sub r8, rbx
sar r8, 1
mov rdx, rbx
lea rcx, [rbp + 0x770]
call fcn.1402496a0
lea rdx, [0x14029cd20]
lea rcx, [r14 + 2]
call fcn.140249ef0
mov r15, rax
mov r8, rax
sub r8, r14
sar r8, 1
dec r8
lea rdx, [r14 + 2]
lea rcx, [rbp + 0xf90]
call fcn.1402496a0
mov r8d, esi
nop dword [rax]
lea rax, [rbp + 0xf90]
sub rdi, rax
nop word [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + rdi]
sub edx, ecx
jne 0x1400b4803
add rax, 2
test ecx, ecx
jne 0x1400b47f0
test edx, edx
je 0x1400b481a
inc r8d
mov eax, r8d
add rax, rax
mov rdi, qword [rsp + rax*8 + 0x50]
test rdi, rdi
jne 0x1400b47e0
mov eax, r8d
add rax, rax
mov ebx, dword [rsp + rax*8 + 0x58]
test ebx, ebx
je 0x1400b48fc
xor edx, edx
mov r8d, 0x820
lea rcx, [rbp + 0xf90]
call fcn.140249b10
lea r8, [rsp + 0x20]
mov edx, ebx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x1400b48fc
lea rdx, [rbp + 0xf90]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea rcx, [rsp + 0x28]
call qword [sym.imp.SHELL32.dll_SHGetMalloc]
mov rcx, qword [rsp + 0x28]
mov rax, qword [rcx]
mov rdx, qword [rsp + 0x20]
call qword [rax + 0x28]
lea rcx, [rbp + 0x770]
sub rcx, 2
nop
lea rcx, [rcx + 2]
cmp word [rcx], si
jne 0x1400b4890
lea r8, [rbp + 0xf90]
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x1400b48b0
lea rcx, [rbp + 0x770]
sub rcx, 2
nop dword [rax]
lea rcx, [rcx + 2]
cmp word [rcx], si
jne 0x1400b48d0
xor edx, edx
nop dword [rax + rax]
movzx eax, word [r15 + rdx*2 + 2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x1400b48e0
mov r15, qword [rbp + 0x2010]
jmp 0x1400b4920
mov eax, 0xffffffff
jmp 0x1400b4cfc
lea rcx, [rbp + 0x770]
sub rcx, rbx
movzx eax, word [rbx]
mov word [rcx + rbx], ax
lea rbx, [rbx + 2]
test ax, ax
jne 0x1400b4910
xor edx, edx
mov r8d, 0x820
lea rcx, [rbp + 0x17b0]
call fcn.140249b10
lea rdx, str._SABIDL_
lea rcx, [rbp + 0x770]
call fcn.140249ef0
test rax, rax
je 0x1400b4cd0
lea rbx, [rbp + 0x770]
mov r14, rsi
lea rcx, [rbp + 0x770]
lea rdx, str._SABIDL_
call fcn.140249ef0
test rax, rax
mov rdi, rax
je 0x1400b4c8e
xor edx, edx
mov r8d, 0x820
lea rcx, [rsp + 0x50]
call fcn.140249b10
mov r8, rdi
sub r8, rbx
sar r8, 1
lea rcx, [rbp + 0x17b0]
mov rax, 0xffffffffffffffff
lea rax, [rax + 1]
cmp word [rcx + rax*2], 0
jne 0x1400b49a2
lea rcx, [rbp + 0x17b0]
lea rcx, [rcx + rax*2]
mov rdx, rbx
call fcn.1402496a0
lea rdx, [0x14029cd20]
lea rcx, [rdi + 2]
call fcn.140249ef0
mov r14, rax
mov r8, rax
sub r8, rdi
sar r8, 1
dec r8
lea rdx, [rdi + 2]
lea rcx, [rsp + 0x50]
call fcn.1402496a0
lea rdx, [rsp + 0x50]
mov rcx, rsi
lea r8, str.SABIDL_APPDATADIRECTORYNAME
nop dword [rax]
movzx eax, word [rdx + rcx*2]
cmp ax, word [r8 + rcx*2]
jne 0x1400b4b4e
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [r8 + rcx*2 + 2]
jne 0x1400b4b4e
add rcx, 2
cmp rcx, 0x1c
jne 0x1400b4a00
cmp dword [r13 + 0x18], 0
jne 0x1400b4b0a
xor edx, edx
mov r8d, 0x820
lea rcx, [rbp + 0xf90]
call fcn.140249b10
lea r8, [rsp + 0x20]
mov edx, 0x1a
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x1400b4a8c
lea rdx, [rbp + 0xf90]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_SHGetMalloc]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
mov rdx, qword [rsp + 0x20]
call qword [rax + 0x28]
lea rbx, [rbp + 0xf90]
mov edi, 3
test rbx, rbx
je 0x1400b4ab8
lea rdx, [0x140287d80]
mov rcx, rbx
call fcn.140249ef0
mov rbx, rax
test rax, rax
je 0x1400b4ab8
add rbx, 2
sub rdi, 1
jne 0x1400b4a98
test rbx, rbx
je 0x1400b4b0a
lea rdx, [0x140287d80]
mov rcx, rbx
call fcn.140249ef0
test rax, rax
je 0x1400b4ada
mov word [rax], si
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1400b4d28
mov rdx, rax
lea rcx, [r13 + 8]
call fcn.14002a980
nop
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
lea rcx, [rbp + 0x17b0]
sub rcx, 2
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x1400b4b15
mov r8, qword [r13 + 0x10]
xor edx, edx
nop word [rax + rax]
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x1400b4b30
lea rbx, [r14 + 2]
mov rcx, rbx
jmp 0x1400b4961
lea rdx, [rsp + 0x50]
mov rax, 0xffffffffffffffff
lea r8, str.SABIDL_PROFILEROOT
movzx ecx, word [rdx + rax*2 + 2]
cmp cx, word [r8 + rax*2 + 2]
jne 0x1400b48fc
add rax, 2
cmp rax, 0x13
je 0x1400b4b8d
movzx ecx, word [rdx + rax*2]
cmp cx, word [r8 + rax*2]
jne 0x1400b48fc
jmp 0x1400b4b61
cmp dword [r13 + 0x30], 0
jne 0x1400b4c4b
xor edx, edx
mov r8d, 0x820
lea rcx, [rsp + 0x50]
call fcn.140249b10
lea r8, [rsp + 0x28]
mov edx, 0x1a
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x1400b4beb
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea rcx, [rsp + 0x38]
call qword [sym.imp.SHELL32.dll_SHGetMalloc]
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
mov rdx, qword [rsp + 0x28]
call qword [rax + 0x28]
lea rdx, [0x140287d80]
lea rcx, [rsp + 0x50]
call fcn.140249ef0
test rax, rax
je 0x1400b4c4b
lea rcx, [rax + 2]
lea rdx, [0x140287d80]
call fcn.140249ef0
test rax, rax
je 0x1400b4c4b
mov word [rax], si
lea rcx, [rsp + 0x50]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1400b4d1d
mov rdx, rax
lea rcx, [r13 + 0x20]
call fcn.14002a980
nop
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
lea rcx, [rbp + 0x17b0]
sub rcx, 2
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x1400b4c56
mov r8, qword [r13 + 0x28]
xor edx, edx
nop word [rax + rax]
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x1400b4c70
lea rbx, [r14 + 2]
mov rcx, rbx
jmp 0x1400b4961
lea rcx, [rbp + 0x17b0]
sub rcx, 2
nop dword [rax]
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x1400b4ca0
xor edx, edx
nop dword [rax]
movzx eax, word [r14 + rdx*2 + 2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x1400b4cb0
jmp 0x1400b4ce9
movzx eax, word [rbp + rsi + 0x770]
mov word [rbp + rsi + 0x17b0], ax
lea rsi, [rsi + 2]
test ax, ax
jne 0x1400b4cd0
mov r8d, r12d
mov rdx, r15
lea rcx, [rbp + 0x17b0]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea r11, [rsp + 0x20d0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x8007000e
call fcn.140004cd0
int3
mov ecx, 0x8007000e
call fcn.140004cd0
int3