Function at 0x140009635
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rbp, rcx
mov ecx, edx
test edx, edx
jns 0x140009660
mov rax, qword [0x140010c20]
not ecx
movsxd rcx, ecx
mov rax, qword [rax]
mov ecx, dword [rax + rcx*4]
call fcn.140008c9c
mov r12, rax
test rax, rax
je 0x140009927
lea rbx, [0x140046440]
cmp rbp, rbx
jb 0x140009690
mov rax, rbp
sub rax, rbx
cmp rax, 0x3ffe
ja 0x140009690
mov rbx, rbp
xor ebp, ebp
mov rsi, r12
mov cx, word [rsi]
test cx, cx
je 0x1400098f3
mov rax, rbx
lea rdi, [0x140046440]
sub rax, rdi
cmp rax, 0x1ffe
jg 0x1400098f3
cmp cx, 3
ja 0x1400098cd
movsx edi, byte [rsi + 3]
mov al, byte [rsi + 2]
add rsi, 4
mov r15w, word [rsi - 2]
shl edi, 7
and eax, 0x7f
and edi, 0x3f80
mov r14d, r15d
or edi, eax
movzx eax, r15b
shr r14w, 8
mov edx, eax
movzx r13d, r14w
mov dword [rsp + 0x34], eax
or dh, 0x80
mov dword [rsp + 0x3c], r13d
mov dword [rsp + 0x30], edx
mov edx, r14d
or dx, 0x8000
movzx edx, dx
mov dword [rsp + 0x38], edx
cmp cx, 2
jne 0x140009864
mov rdx, qword [0x140010c90]
cmp dword [rdx + 4], 1
sbb edi, edi
and edi, 0xfffffffe
add edi, 4
test r15b, r15b
jns 0x14000977f
mov ecx, r15d
and ecx, 0x3f
call fcn.140008c9c
mov r9, rbx
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersion
mov rcx, 0xffffffff80000002
mov rdi, rax
mov eax, r15d
and eax, 0x40
mov r8, rdi
mov dword [rsp + 0x20], eax
call fcn.140008abf
mov rcx, rdi
call fcn.140008d22
cmp word [rbx], 0
jne 0x1400097ac
mov edx, r13d
mov rcx, rbx
call fcn.140009635
jmp 0x1400097ac
cmp eax, 0x25
jne 0x140009794
mov edx, 0x1000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x1400097ac
cmp eax, 0x24
je 0x14000979e
movsxd rdi, edi
jmp 0x140009806
mov edx, 0x1000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xor edi, edi
jmp 0x140009799
mov rax, qword [0x140010c40]
mov r13d, dword [rsp + rdi*4 + 0x2c]
mov rax, qword [rax]
mov edx, r13d
mov r15d, r13d
and edx, 0xffffffbf
and r15d, 0x8000
test rax, rax
jne 0x14000980c
mov ecx, 4
call fcn.1400095b6
mov rcx, qword [0x140010cf0]
mov edx, r13d
mov r8d, r15d
and edx, 0xbf
mov rcx, qword [rcx]
call rax
mov r13, rax
test rax, rax
jne 0x140009845
mov word [rbx], 0
dec rdi
test edi, edi
jne 0x1400097b0
jmp 0x140009827
mov rcx, qword [0x140010cf0]
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rcx]
call rax
test eax, eax
jne 0x1400097d4
cmp word [rbx], 0
je 0x1400098a4
cmp r14w, 0x1a
jne 0x1400098a4
lea rdx, str.MicrosoftInternet_ExplorerQuick_Launch
mov rcx, rbx
call sub.KERNEL32.dll_lstrcatW
jmp 0x1400098a4
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov rcx, r13
mov r15d, eax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test r15d, r15d
je 0x1400097fe
jmp 0x140009827
cmp cx, 3
jne 0x1400098ae
cmp edi, 0x1d
jne 0x140009883
mov rax, qword [0x140010cf0]
mov rcx, rbx
mov rdx, qword [rax]
call fcn.140008b53
jmp 0x1400098ba
movsxd rdx, edi
lea rax, [section..ndata]
mov rcx, rbx
sub edi, 0x15
shl rdx, 0xd
add rdx, rax
call fcn.140008c13
cmp edi, 6
ja 0x1400098ba
mov rcx, rbx
call fcn.140008d2d
jmp 0x1400098ba
not edi
mov rcx, rbx
mov edx, edi
call fcn.140009635
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cdqe
add rax, rax
add rax, rbx
jmp 0x1400098eb
lea rax, [rbx + 2]
cmp cx, 4
jne 0x1400098e4
mov dx, word [rsi + 2]
add rsi, 4
mov word [rbx], dx
jmp 0x1400098eb
mov word [rbx], cx
add rsi, 2
mov rbx, rax
jmp 0x140009693
mov word [rbx], 0
mov rcx, r12
lea r12, [0x140046440]
call fcn.140008d22
test rbp, rbp
je 0x140009927
mov rdx, r12
mov rcx, rbp
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.140008c13
mov rax, r12
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret