Function at 0x1400083fa
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rsi, qword [0x14000b018]
mov r8, qword [rsi + 0x24]
test edx, edx
jns 0x140008428
mov rax, qword [0x14000b808]
mov rax, qword [rax]
not edx
mov edx, dword [rax + rdx*4]
movsxd rdx, edx
lea rbx, [0x140034d20]
mov rax, rcx
sub rax, rbx
setae r9b
cmp rax, 0x1000
setb al
xor r10d, r10d
test r9b, al
mov rdi, rbx
cmovne rdi, rcx
cmove r10, rcx
movzx eax, word [r8 + rdx*2]
test ax, ax
mov qword [rsp + 0x40], r10
je 0x1400086eb
mov rcx, rdi
sub rcx, rbx
cmp rcx, 0x7ff
jg 0x1400086eb
lea r14, [r8 + rdx*2]
mov r15d, 0x8000
mov r13, qword [0x14000b010]
cmp ax, 3
ja 0x14000851a
movzx edx, byte [r14 + 3]
and edx, 0x7f
shl rdx, 7
movzx ecx, byte [r14 + 2]
mov r12d, ecx
and r12d, 0x7f
or r12, rdx
mov dword [rsp + 0x34], ecx
mov edx, ecx
or edx, r15d
mov dword [rsp + 0x30], edx
movzx ebp, word [r14 + 2]
shr ebp, 8
mov dword [rsp + 0x3c], ebp
mov edx, ebp
or edx, r15d
mov dword [rsp + 0x38], edx
cmp ax, 1
je 0x14000853b
movzx eax, ax
cmp eax, 3
je 0x14000854e
cmp eax, 2
jne 0x1400086bc
movzx eax, cx
cmp eax, 0x80
jae 0x14000856d
cmp cl, 0x24
je 0x1400085e4
cmp eax, 0x25
jne 0x1400085f7
mov rcx, rdi
mov edx, 0x400
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x140008699
cmp ax, 4
jne 0x14000852b
movzx eax, word [r14 + 2]
add r14, 4
jmp 0x14000852f
add r14, 2
mov word [rdi], ax
add rdi, 2
jmp 0x1400086cf
not r12d
mov rcx, rdi
mov edx, r12d
call fcn.1400083fa
jmp 0x1400086bc
cmp r12d, 0x1d
jne 0x1400085b1
mov r8, qword [r13]
mov rcx, rdi
lea rdx, [0x14000b654]
call qword [sym.imp.USER32.dll_wsprintfW]
jmp 0x1400086bc
mov r8d, ecx
and r8d, 0x3f
add r8, r8
add r8, qword [rsi + 0x24]
and ecx, 0x40
mov dword [rsp + 0x20], ecx
mov rcx, 0xffffffff80000002
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersion
mov r9, rdi
call fcn.14000825a
cmp word [rdi], 0
jne 0x140008699
mov rcx, rdi
mov edx, ebp
call fcn.1400083fa
jmp 0x140008699
mov rdx, r12
shl rdx, 0xb
lea rax, [section..ndata]
add rdx, rax
mov rcx, rdi
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
lea eax, [r12 - 0x15]
cmp eax, 6
jbe 0x1400086b4
jmp 0x1400086bc
mov rcx, rdi
mov edx, 0x400
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x140008699
xor eax, eax
mov rcx, qword [0x14000b368]
cmp dword [rcx + 4], 0
setne al
lea rsi, [rax + rax]
add rsi, 2
mov ebp, dword [rsp + rsi*4 + 0x2c]
mov rax, qword [0x14000b810]
mov rax, qword [rax]
test rax, rax
je 0x14000863c
mov edx, ebp
and edx, 0xffffffbf
mov rcx, qword [r13]
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor r9d, r9d
call rax
test eax, eax
je 0x14000868e
mov r12d, ebp
and r12d, 0x8000
mov ecx, 4
call fcn.14000767a
mov rcx, qword [r13]
and ebp, 0xbf
mov edx, ebp
mov r8d, r12d
call rax
test rax, rax
je 0x140008684
mov r12, rax
mov rcx, rax
mov rdx, rdi
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov ebp, eax
mov rcx, r12
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test ebp, ebp
jne 0x14000868e
mov word [rdi], 0
dec rsi
jne 0x14000860f
mov ebp, dword [rsp + 0x3c]
mov rsi, qword [0x14000b018]
cmp word [rdi], 0
je 0x1400086b4
cmp ebp, 0x1a
jne 0x1400086b4
mov rcx, rdi
lea rdx, str.MicrosoftInternet_ExplorerQuick_Launch
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rcx, rdi
call fcn.140007d82
add r14, 4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cdqe
lea rdi, [rdi + rax*2]
movzx eax, word [r14]
test ax, ax
je 0x1400086eb
mov rcx, rdi
sub rcx, rbx
cmp rcx, 0x800
jl 0x14000848d
mov word [rdi], 0
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14000871e
lea rdx, [0x140034d20]
mov r8d, 0x400
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_lstrcpynW]
lea rax, [0x140034d20]
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret