Function at 0x180017890
Capabilities:
Get common file path

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x678]
sub rsp, 0x778
mov rax, qword [0x18006af78]
xor rax, rsp
mov qword [rbp + 0x660], rax
mov edi, dword [rbp + 0x6e8]
xor ebx, ebx
mov r14, rdx
mov qword [rbp - 0x58], rdx
mov rdx, qword [rbp + 0x6e0]
mov r12, r9
mov r9, r8
mov qword [rbp - 0x60], r8
lea eax, [rdi + 0xb]
mov qword [rsp + 0x78], rdx
mov dword [rsp + 0x38], ebx
mov r15, rcx
mov dword [rsp + 0x40], edi
mov esi, edi
cmp edi, eax
jae 0x18001816f
mov rax, qword [rbp - 0x58]
lea r8, str.rsquo_
movzx edi, byte [rsp + 0x50]
mov r10d, 0x18201
mov r13, qword [rbp - 0x40]
movabs r11, 0x57ffffffd7fffff9
mov qword [rbp - 0x50], rax
mov ecx, esi
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x48], edi
lea eax, [rsi - 0x5b]
cmp eax, 0x1a
ja case.default.0x180017954
lea rcx, [0x180000000]
mov ecx, dword [rcx + rax*4 + 0x18920]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
cmp qword [rdx], 2
jb 0x180017b9d
mov esi, 0xfc
nop word [rax + rax]
cmp esi, 0xfc
je 0x180017b60
cmp esi, 0x8acc
je 0x180017b03
cmp esi, 0x1149c
jne 0x180017b76
lea eax, [rdi - 0x64]
cmp al, 0x10
ja 0x180017a33
movzx eax, al
bt r10d, eax
jae 0x180017a33
cmp qword [rdx], 3
je 0x1800179d5
movzx eax, byte [r15 + 2]
lea rdx, [rsp + 0x30]
mov ecx, reloc.SHELL32.dll_SHSetFolderPathA
mov byte [rsp + 0x30], al
call fcn.1800240b0
test eax, eax
je 0x180017a2e
lea r8, str.rsquo_
mov edi, 0x56
nop word [rax + rax]
mov eax, edi
sub eax, 0x56
je 0x1800179f4
cmp eax, 1
jne 0x180017a1c
mov rax, rbx
jmp 0x1800188eb
mov qword [rsp + 0x28], r8
lea rcx, [rsp + 0x70]
mov r8d, ILFree
mov qword [rsp + 0x70], 7
mov r9, r14
mov qword [rsp + 0x20], rbx
xor edx, edx
call fcn.18003ebb0
inc edi
lea r8, str.rsquo_
cmp edi, 0x58
jb 0x1800179e0
mov edi, dword [rsp + 0x48]
mov rdx, qword [rsp + 0x78]
cmp qword [rdx], 3
jb 0x180017b76
movzx ecx, byte [r15 + 2]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
cmp dil, 0x72
jne 0x180017a57
cmp al, 0x65
je 0x180017a79
jmp 0x180017b71
cmp dil, 0x6c
jne 0x180017a67
cmp al, dil
je 0x180017a79
jmp 0x180017b71
cmp dil, 0x76
jne 0x180017b71
cmp al, 0x65
jne 0x180017b71
mov rax, qword [rsp + 0x78]
cmp qword [rax], 4
je 0x180017aa4
movzx eax, byte [r15 + 3]
lea rdx, [rsp + 0x30]
mov ecx, reloc.SHELL32.dll_SHSetFolderPathA
mov byte [rsp + 0x30], al
call fcn.1800240b0
test eax, eax
je 0x180017b71
mov edi, 0x121
nop dword [rax]
mov eax, edi
sub eax, 0x120
je case.0x1800181e8.85
cmp eax, 1
jne 0x180017af3
lea rax, str.rsquo_
mov qword [rbp - 0x80], 7
mov qword [rsp + 0x28], rax
lea rcx, [rbp - 0x80]
mov r9, r14
mov qword [rsp + 0x20], rbx
xor edx, edx
mov r8d, ILFree
call fcn.18003ebb0
mov qword [rbp - 0x80], rbx
dec edi
cmp edi, 0x11f
ja 0x180017ab0
mov edi, dword [rsp + 0x48]
jmp 0x180017b71
cmp dil, 0x27
jne 0x180017b76
cmp qword [rdx], 3
jb 0x180017b16
movzx eax, byte [r15 + 2]
jmp 0x180017b18
xor al, al
mov byte [rsp + 0x68], al
lea rdx, [rsp + 0x68]
movzx eax, byte [r9]
lea rcx, [rsp + 0x50]
mov byte [rsp + 0x30], al
lea r9, [r12 + 4]
lea rax, [rsp + 0x30]
mov dword [rsp + 0x28], 0xa6
mov r8, r14
mov qword [rsp + 0x20], rax
mov byte [rsp + 0x50], 0x64
call fcn.18004d3d0
test eax, eax
je 0x180017b71
mov eax, 1
jmp 0x1800188eb
movzx ecx, byte [r15 + 1]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
mov edi, eax
mov dword [rsp + 0x48], eax
mov rdx, qword [rsp + 0x78]
mov r9, qword [rbp - 0x60]
lea r8, str.rsquo_
add esi, 0x89d0
mov r10d, 0x18201
cmp esi, 0x19d70
jbe 0x180017970
mov esi, dword [rsp + 0x40]
cmp qword [rdx], rbx
jbe 0x180017ba9
movzx ecx, byte [r15 + 1]
jmp 0x180017bab
xor cl, cl
movzx eax, byte [r9]
lea rdx, [rsp + 0x68]
mov byte [rsp + 0x50], al
mov r9, r12
lea rax, [rsp + 0x50]
mov byte [rsp + 0x68], cl
mov dword [rsp + 0x28], 0xa6
lea rcx, [rsp + 0x30]
mov r8, r14
mov qword [rsp + 0x20], rax
mov byte [rsp + 0x30], 0x73
call fcn.18004d3d0
test eax, eax
je 0x180017c11
mov ecx, 0x4e
nop dword [rax]
mov eax, ecx
sub eax, 0x4e
je 0x180017c02
cmp eax, 0x43
je case.0x1800181e8.85
jmp 0x180017c06
mov qword [rbp - 0x80], rbx
add ecx, 0x43
cmp ecx, 0xd4
jb 0x180017bf0
mov rdx, qword [rsp + 0x78]
lea r8, str.rsquo_
mov r10d, 0x18201
movabs r11, 0x57ffffffd7fffff9
jmp case.0x180017954.92
mov ecx, dword [rbp + 0x6e8]
mov r9d, 1
mov dword [rsp + 0x58], r9d
mov qword [rbp - 0x50], rbx
jmp 0x18001811a
mov rax, qword [rbp - 0x78]
mov qword [rdx], rax
jmp case.0x180017954.92
movzx eax, byte [r15]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x28], rbx
mov r9d, 0x7d
mov r8, r14
mov dword [rsp + 0x40], eax
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.1800139c0
mov qword [rbp - 0x80], rbx
jmp 0x180017c11
cmp r13, 1
jbe case.0x180017954.92
mov edi, 0xca
cmp edi, 0xca
je 0x180017cb4
cmp edi, 0x4312
jne 0x180017cc9
mov rcx, qword [rbp - 0x68]
dec rcx
add rcx, r13
mov qword [rbp - 0x68], rcx
jmp 0x180017cc9
mov rcx, qword [rbp - 0x78]
lea r8, [r13 - 1]
lea rdx, [r9 + 1]
call sub.VCRUNTIME140.dll_memcpy
mov r9, qword [rbp - 0x60]
add edi, 0x4248
cmp edi, 0x8490
jbe 0x180017c94
jmp 0x180017c11
mov rax, qword [r14 + 0x98]
movzx ecx, byte [rax]
lea eax, [rcx - 0x21]
cmp al, 0x3e
ja 0x180017cfa
movzx eax, al
bt r11, rax
jb 0x180017d0a
lea eax, [rcx - 0x61]
cmp al, 0x19
jbe 0x180017d0a
cmp cl, 0x7e
jne 0x180017f23
mov esi, 0xdc
nop
mov eax, esi
sub eax, 0xdc
je 0x180017d5d
cmp eax, 0x58
jne 0x180017f05
cmp qword [r14 + 0xa8], 1
jae 0x180017f05
mov r9d, eax
mov qword [rsp + 0x70], 1
xor r8d, r8d
mov qword [rsp + 0x20], r14
lea rdx, [rsp + 0x70]
xor ecx, ecx
call fcn.180037f00
test eax, eax
je 0x18001813b
jmp 0x180017f05
mov rax, qword [r14 + 0x98]
cmp byte [rax], 0x25
jne 0x180017e12
mov edi, SHSetFolderPathA
cmp edi, 0xe6
je 0x180017dcf
cmp edi, 0x174
jne 0x180017dfb
mov eax, dword [r12]
lea r9, [rsp + 0x60]
movups xmm0, xmmword [r15]
lea rcx, [rbp - 0x78]
mov dword [rsp + 0x60], eax
movsd xmm1, qword [r15 + 0x10]
lea rax, [rbp + 0x200]
mov r8, r14
movaps xmmword [rbp + 0x200], xmm0
mov edx, 0xdd
mov qword [rsp + 0x20], rax
movsd qword [rbp + 0x210], xmm1
call fcn.18000fff0
test eax, eax
je 0x18001813b
jmp 0x180017dfb
mov rax, qword [rbp - 0x68]
add rax, 5
cmp rax, qword [rbp - 0x70]
jb 0x180017dfb
lea r9, [rbp - 0x70]
mov edx, 0xc4
lea r8, [rbp - 0x78]
lea rcx, [rbp - 0x68]
call fcn.18005c2c0
test eax, eax
je 0x180018134
add edi, 0x8e
cmp edi, 0x202
jb 0x180017d72
jmp 0x180017f02
mov rax, qword [rbp - 0x68]
add rax, 5
cmp rax, qword [rbp - 0x70]
jb 0x180017e3e
lea r9, [rbp - 0x70]
mov edx, 0xc4
lea r8, [rbp - 0x78]
lea rcx, [rbp - 0x68]
call fcn.18005c2c0
test eax, eax
je 0x180018134
mov rax, qword [r14 + 0x98]
movzx ecx, byte [rax]
test cl, cl
js 0x180017e57
mov rax, qword [rbp - 0x68]
mov byte [rax], cl
jmp 0x180017ee2
movzx eax, cl
and al, 0xe0
cmp al, 0xc0
jne 0x180017e68
mov rax, qword [rbp - 0x68]
mov byte [rax], cl
jmp 0x180017ec4
movzx eax, cl
and al, 0xf0
cmp al, 0xe0
jne 0x180017e79
mov rax, qword [rbp - 0x68]
mov byte [rax], cl
jmp 0x180017ea6
movzx eax, cl
and al, 0xf8
cmp al, 0xf0
jne 0x180017eed
mov rax, qword [rbp - 0x68]
mov byte [rax], cl
mov rdx, qword [rbp - 0x68]
inc rdx
inc qword [r14 + 0x98]
mov rax, qword [r14 + 0x98]
mov qword [rbp - 0x68], rdx
movzx ecx, byte [rax]
mov byte [rdx], cl
mov rdx, qword [rbp - 0x68]
inc rdx
inc qword [r14 + 0x98]
mov rax, qword [r14 + 0x98]
mov qword [rbp - 0x68], rdx
movzx ecx, byte [rax]
mov byte [rdx], cl
mov rdx, qword [rbp - 0x68]
inc rdx
inc qword [r14 + 0x98]
mov rax, qword [r14 + 0x98]
mov qword [rbp - 0x68], rdx
movzx ecx, byte [rax]
mov byte [rdx], cl
inc qword [rbp - 0x68]
inc qword [r14 + 0x98]
inc qword [r14 + 0xe0]
inc qword [r14 + 0xf0]
dec qword [r14 + 0xa8]
inc r13
add esi, 0x58
cmp esi, 0x18c
jb 0x180017d10
movabs r11, 0x57ffffffd7fffff9
jmp case.0x180017954.108
test r13, r13
jne 0x180017fde
mov edi, 0x10b
mov eax, edi
sub eax, 0x10b
je 0x180017f9b
sub eax, 1
je 0x180017f4a
cmp eax, 1
je 0x18001813b
jmp 0x180017fc7
cmp dword [r12], ebx
lea rax, str.IMS_ERROR_INVALID_DEVICE_TOKEN
movups xmm0, xmmword [r15]
lea rcx, str.orc_subtract_s16_u8
mov r9, r14
movsd xmm1, qword [r15 + 0x10]
lea r8, str.Unable_to_start_ringback_tone
cmovne rcx, rax
movaps xmmword [rbp + 0x220], xmm0
lea rax, [rbp + 0x220]
movsd qword [rbp + 0x230], xmm1
mov edx, 0x50
mov qword [rsp + 0x20], rax
call fcn.18005b170
jmp 0x180017fc7
mov rax, qword [rbp - 0x68]
add rax, 5
cmp rax, qword [rbp - 0x70]
jb 0x180017fc7
lea r9, [rbp - 0x70]
mov edx, 0xc4
lea r8, [rbp - 0x78]
lea rcx, [rbp - 0x68]
call fcn.18005c2c0
test eax, eax
je 0x180018134
inc edi
cmp edi, 0x10e
jb 0x180017f31
mov esi, dword [rsp + 0x40]
jmp 0x180017c11
mov rdx, qword [rsp + 0x78]
lea r8, str.rsquo_
mov esi, dword [rsp + 0x40]
mov r10d, 0x18201
jmp case.0x180017954.92
xorps xmm0, xmm0
mov qword [rbp - 0x68], rbx
mov r9d, 0xc8
mov qword [rsp + 0x70], reloc.SHELL32.dll_ILFindLastID
xor r8d, r8d
mov qword [rsp + 0x20], rbx
xor edx, edx
lea rcx, [rsp + 0x70]
movdqu xmmword [rbp - 0x78], xmm0
call fcn.1800112b0
mov qword [rbp - 0x78], rax
test rax, rax
je 0x180018134
lea rcx, [rax + 0x10]
mov qword [rbp - 0x68], rax
xorps xmm0, xmm0
mov qword [rbp - 0x70], rcx
movups xmmword [rax], xmm0
jmp 0x180017c11
cmp qword [r14 + 0xa8], 1
jae case.0x180017954.92
mov r9d, 0x58
mov qword [rsp + 0x70], 1
xor r8d, r8d
mov qword [rsp + 0x20], r14
lea rdx, [rsp + 0x70]
xor ecx, ecx
call fcn.180037f00
test eax, eax
je 0x18001813b
jmp 0x180017c11
mov rax, qword [rbp - 0x70]
sub rax, qword [rbp - 0x78]
cmp rax, r13
ja case.0x180017954.92
nop word [rax + rax]
lea r9, [rbp - 0x70]
mov edx, 0xc4
lea r8, [rbp - 0x78]
lea rcx, [rbp - 0x68]
call fcn.18005c2c0
test eax, eax
jne 0x1800180e3
mov eax, 0x104
nop
cmp eax, 0x104
je 0x1800180d0
cmp eax, 0x9344
je 0x18001813b
jmp 0x1800180d7
mov dword [r14], 1
add eax, 0x9240
cmp eax, 0x12480
jbe 0x1800180c0
mov rax, qword [rbp - 0x70]
sub rax, qword [rbp - 0x78]
cmp rax, r13
jbe 0x1800180a0
jmp 0x180017c11
test r9, r9
je 0x18001810c
mov r13, 0xffffffffffffffff
inc r13
cmp byte [r9 + r13], bl
jne 0x180018101
jmp case.0x180017954.92
mov r13, rbx
mov ecx, dword [rbp + 0x6e8]
mov r9d, dword [rsp + 0x58]
inc esi
lea eax, [rcx + 0xb]
mov dword [rsp + 0x40], esi
cmp esi, eax
jae 0x180018183
mov edi, dword [rsp + 0x48]
mov r9, qword [rbp - 0x60]
jmp 0x180017930
mov dword [r14], 1
mov eax, dword [rsp + 0x38]
mov rdi, qword [rbp - 0x80]
mov rcx, qword [rbp - 0x80]
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x40], eax
mov qword [rbp - 0x60], rdi
mov qword [rsp + 0x70], rcx
mov r13d, 0x66
jmp case.0x1800181e8.92
mov rsi, qword [rbp - 0x58]
mov r9d, dword [rsp + 0x38]
mov qword [rbp - 0x50], rsi
mov dword [rsp + 0x58], r9d
jmp 0x180018187
mov rsi, qword [rbp - 0x50]
mov rdi, qword [rbp - 0x80]
mov r10, qword [rbp - 0x80]
mov eax, dword [rbp + 0x6e8]
mov r13d, eax
mov edx, dword [rsp + 0x38]
mov r8d, dword [rsp + 0x38]
mov r11d, dword [rsp + 0x38]
mov qword [rbp - 0x60], rdi
mov qword [rsp + 0x70], r10
mov dword [rsp + 0x60], edx
mov dword [rsp + 0x48], r8d
mov dword [rsp + 0x40], r11d
add eax, 0xfffffff4
cmp r13d, eax
jbe case.0x1800181e8.85
lea eax, [r13 - 0x55]
cmp eax, 0x12
ja case.0x1800181e8.92
lea r15, [0x180000000]
mov ecx, dword [r15 + rax*4 + 0x1898c]
add rcx, r15
jmp rcx
mov qword [rbp - 0x40], rbx
jmp case.0x1800181e8.92
xor edx, edx
lea rcx, [rbp - 0xc]
mov r8d, 0x20c
call sub.VCRUNTIME140.dll_memset
mov dword [rbp - 0x10], 0x210
jmp case.0x1800181e8.92
mov dword [rbp - 0x48], 0x104
jmp case.0x1800181e8.92
mov r8, qword [rbp - 0x78]
xor edx, edx
lea ecx, [rdx + 0x5b]
call fcn.180048360
xorps xmm0, xmm0
mov qword [rbp - 0x78], rbx
movdqu xmmword [rbp - 0x70], xmm0
jmp case.0x1800181e8.92
mov eax, dword [rbp - 0x48]
lea r9, [rbp - 0x40]
mov dword [rsp + 0x28], eax
lea r8, [rbp - 0x38]
lea rax, [rbp + 0x240]
xor edx, edx
mov rcx, rsi
mov qword [rsp + 0x20], rax
call sub.SHELL32.dll_SHGetUnreadMailCountW
mov byte [rbp - 0x80], bl
jmp case.0x1800181e8.92
cmp qword [r14 + 0x10], 0x35
jb case.0x1800181e8.92
mov esi, 0x1a
nop dword [rax + rax]
cmp esi, 0x1a
ja case.0x180018296.9
mov eax, esi
mov ecx, dword [r15 + rax*4 + 0x189d8]
add rcx, r15
jmp rcx
mov dword [rbp + 0x21c], 0x62
jmp case.0x180018296.9
mov byte [rbp - 0x80], 1
jmp case.0x180018296.9
mov r9d, edx
lea r8, [rbp + 0x200]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHPathPrepareForWriteW]
mov edx, dword [rsp + 0x60]
jmp 0x180018724
mov edi, 0xb
mov qword [rbp - 0x60], rbx
cmp qword [r14 + 0x10], rdi
mov r12, r14
mov qword [rbp - 0x18], ILRemoveLastID
cmovb rdi, qword [r14 + 0x10]
cmp qword [r14 + 0x18], 0x10
mov byte [rbp - 0x30], bl
jb 0x1800182f7
mov r12, qword [r14]
cmp rdi, 0xf
ja 0x180018319
mov r8, rdi
mov qword [rbp - 0x20], rdi
mov rdx, r12
lea rcx, [rbp - 0x30]
call sub.VCRUNTIME140.dll_memmove
mov byte [rbp + rdi - 0x30], bl
jmp 0x1800183be
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
ja 0x18001891a
mov r14, rdi
or r14, 0xf
cmp r14, rax
jbe 0x18001833d
mov r14, rax
jmp 0x18001834a
cmp r14, 0x16
mov eax, 0x16
cmovb r14, rax
lea rcx, [r14 + 1]
cmp rcx, 0x1000
jb 0x180018383
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180018914
mov rcx, rax
call fcn.18005cb78
test rax, rax
je 0x1800188d8
lea r15, [rax + 0x27]
and r15, 0xffffffffffffffe0
mov qword [r15 - 8], rax
jmp 0x180018395
test rcx, rcx
je 0x180018392
call fcn.18005cb78
mov r15, rax
jmp 0x180018395
mov r15, rbx
mov r8, rdi
mov qword [rbp - 0x20], rdi
mov rdx, r12
mov qword [rbp - 0x18], r14
mov rcx, r15
call sub.VCRUNTIME140.dll_memcpy
mov r14, qword [rbp - 0x58]
mov byte [r15 + rdi], bl
mov qword [rbp - 0x30], r15
lea r15, [0x180000000]
or dword [rsp + 0x38], 1
lea rdx, [rbp - 0x30]
lea rcx, [0x1800696e8]
call fcn.180003700
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x18001840e
mov rcx, qword [rbp - 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180018409
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800188d8
call fcn.18005cbb4
mov edx, dword [rsp + 0x60]
mov rdi, rbx
jmp 0x180018724
mov dword [rbp + 0x218], 0x5c0073
jmp case.0x180018296.9
mov eax, dword [0x180061d5c]
mov dword [rbp + 0x22a], eax
movzx eax, word [0x180061d60]
mov word [rbp + 0x22e], ax
lea rax, [rbp + 0x220]
sub rax, 2
nop
cmp word [rax + 2], bx
lea rax, [rax + 2]
jne 0x180018450
mov ecx, dword [0x180061d64]
mov dword [rax], ecx
jmp case.0x180018296.9
mov dword [rsp + 0x78], ebx
jmp case.0x180018296.9
mov word [rbp + 0x220], bx
jmp case.0x180018296.9
mov r8d, 2
lea rdx, [0x180061d68]
lea rcx, [rbp + 0x220]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov edx, dword [rsp + 0x60]
jmp 0x180018724
mov r8d, 2
lea rdx, [0x180061d70]
lea rcx, [rbp + 0x220]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov edx, dword [rsp + 0x60]
jmp 0x180018724
mov dword [rbp + 0x234], 0x5f
jmp case.0x180018296.9
mov eax, 0x6f
mov word [rbp + 0x216], ax
jmp case.0x180018296.9
mov r8d, ebx
mov dword [rsp + 0x48], ebx
jmp case.0x180018296.9
mov dword [rbp + 0x236], 0x5f
jmp case.0x180018296.9
mov r10, rbx
mov qword [rsp + 0x70], rbx
jmp case.0x180018296.9
mov r11d, 0x36
mov dword [rsp + 0x40], r11d
jmp case.0x180018296.9
mov eax, 0x64
mov dword [rbp + 0x200], 0x62005c
mov word [rbp + 0x204], ax
jmp case.0x180018296.9
movabs rax, 0x64006d0069
mov qword [rbp + 0x224], rax
jmp case.0x180018296.9
mov dword [rbp + 0x20c], 0x61006b
jmp case.0x180018296.9
mov eax, 0x73
mov dword [rbp + 0x210], 0x69006e
mov word [rbp + 0x214], ax
jmp case.0x180018296.9
lea rax, [rbp + 0x450]
mov r9d, r8d
mov r8, r10
mov qword [rsp + 0x20], rax
mov edx, r11d
mov rcx, rdi
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rsp + 0x78]
lea rcx, [rbp + 0x220]
call qword [sym.imp.SHELL32.dll_SHIsFileAvailableOffline]
mov edx, dword [rsp + 0x60]
jmp 0x180018724
mov eax, 0x6f
mov dword [rbp + 0x208], 0x650064
mov word [rbp + 0x206], ax
jmp case.0x180018296.9
mov rax, qword [r14 + 0x10]
mov dword [rsp + 0x60], ebx
mov qword [rbp - 0x18], ILRemoveLastID
mov byte [rbp - 0x30], bl
cmp rax, 0x11
jb 0x18001890e
add rax, 0xffffffffffffffef
mov edi, 0x24
cmp rax, rdi
cmovb rdi, rax
cmp qword [r14 + 0x18], 0x10
mov rax, r14
jb 0x180018603
mov rax, qword [r14]
lea r12, [rax + 0x11]
cmp rdi, 0xf
ja 0x180018629
mov r8, rdi
mov qword [rbp - 0x20], rdi
mov rdx, r12
lea rcx, [rbp - 0x30]
call sub.VCRUNTIME140.dll_memmove
mov byte [rbp + rdi - 0x30], bl
jmp 0x1800186ce
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
ja 0x18001891a
mov r14, rdi
or r14, 0xf
cmp r14, rax
jbe 0x18001864d
mov r14, rax
jmp 0x18001865a
cmp r14, 0x16
mov eax, 0x16
cmovb r14, rax
lea rcx, [r14 + 1]
cmp rcx, 0x1000
jb 0x180018693
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180018914
mov rcx, rax
call fcn.18005cb78
test rax, rax
je 0x1800188d8
lea r15, [rax + 0x27]
and r15, 0xffffffffffffffe0
mov qword [r15 - 8], rax
jmp 0x1800186a5
test rcx, rcx
je 0x1800186a2
call fcn.18005cb78
mov r15, rax
jmp 0x1800186a5
mov r15, rbx
mov r8, rdi
mov qword [rbp - 0x20], rdi
mov rdx, r12
mov qword [rbp - 0x18], r14
mov rcx, r15
call sub.VCRUNTIME140.dll_memcpy
mov r14, qword [rbp - 0x58]
mov byte [r15 + rdi], bl
mov qword [rbp - 0x30], r15
lea r15, [0x180000000]
or dword [rsp + 0x38], 2
lea rdx, [rbp - 0x30]
lea rcx, [0x1800696c8]
call fcn.180003700
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x18001871e
mov rcx, qword [rbp - 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180018719
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800188d8
call fcn.18005cbb4
mov edx, ebx
mov rdi, qword [rbp - 0x60]
mov r11d, dword [rsp + 0x40]
mov r10, qword [rsp + 0x70]
mov r8d, dword [rsp + 0x48]
dec esi
lea eax, [rsi + 0x78]
cmp eax, 0x77
ja 0x180018280
jmp case.0x1800181e8.92
mov rax, qword [r14 + 0x10]
mov qword [rbp - 0x18], ILRemoveLastID
mov byte [rbp - 0x30], bl
cmp rax, 0xb
jb 0x18001890e
add rax, 0xfffffffffffffff5
mov edi, 6
cmp rax, rdi
cmovb rdi, rax
cmp qword [r14 + 0x18], 0x10
mov rax, r14
jb 0x18001877c
mov rax, qword [r14]
lea r12, [rax + 0xb]
cmp rdi, 0xf
ja 0x1800187a2
mov r8, rdi
mov qword [rbp - 0x20], rdi
mov rdx, r12
lea rcx, [rbp - 0x30]
call sub.VCRUNTIME140.dll_memmove
mov byte [rbp + rdi - 0x30], bl
jmp 0x180018847
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
ja 0x18001891a
mov r14, rdi
or r14, 0xf
cmp r14, rax
jbe 0x1800187c6
mov r14, rax
jmp 0x1800187d3
cmp r14, 0x16
mov eax, 0x16
cmovb r14, rax
lea rcx, [r14 + 1]
cmp rcx, 0x1000
jb 0x18001880c
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180018914
mov rcx, rax
call fcn.18005cb78
test rax, rax
je 0x1800188d8
lea r15, [rax + 0x27]
and r15, 0xffffffffffffffe0
mov qword [r15 - 8], rax
jmp 0x18001881e
test rcx, rcx
je 0x18001881b
call fcn.18005cb78
mov r15, rax
jmp 0x18001881e
mov r15, rbx
mov r8, rdi
mov qword [rbp - 0x20], rdi
mov rdx, r12
mov qword [rbp - 0x18], r14
mov rcx, r15
call sub.VCRUNTIME140.dll_memcpy
mov r14, qword [rbp - 0x58]
mov byte [r15 + rdi], bl
mov qword [rbp - 0x30], r15
lea r15, [0x180000000]
or dword [rsp + 0x38], 4
lea rdx, [rbp - 0x30]
lea rcx, [0x180069708]
call fcn.180003700
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x180018893
mov rcx, qword [rbp - 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001888e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800188d8
call fcn.18005cbb4
mov edx, dword [rsp + 0x60]
jmp 0x180018720
mov dword [rbp - 0x80], ebx
jmp case.0x1800181e8.92
lea rdx, [rbp - 0x10]
mov ecx, r9d
call qword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
mov edx, dword [rsp + 0x60]
dec r13d
mov r8d, dword [rsp + 0x48]
mov r10, qword [rsp + 0x70]
mov r11d, dword [rsp + 0x40]
mov eax, dword [rbp + 0x6e8]
mov r9d, dword [rsp + 0x58]
mov rsi, qword [rbp - 0x50]
jmp 0x1800181bd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov dword [rbp - 0x80], 1
mov rax, qword [rbp - 0x80]
mov rcx, qword [rbp + 0x660]
xor rcx, rsp
call fcn.18005d0c0
add rsp, 0x778
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1800253e0
int3
call fcn.180025260
int3
call fcn.1800253a0
int3