Function at 0x14001a51c
Capabilities:
Check if file exists
Get common file path

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rax, qword [0x1400c2138]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
mov r14, r8
mov r15d, edx
mov r13, rcx
lea rsi, [rcx + 0xa0]
mov rdx, rsi
call fcn.14001b20c
xor ebx, ebx
test al, al
jne 0x14001a574
mov eax, 0x80004005
jmp 0x14001aba1
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x60]
call fcn.140061fe0
lea rdx, [rbp - 0x60]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rax, [rbp - 0x60]
or r12, 0xffffffffffffffff
mov r8, r12
inc r8
cmp word [rax + r8*2], bx
jne 0x14001a59f
lea rdi, [r13 + 0x80]
lea rdx, [rbp - 0x60]
mov rcx, rdi
call fcn.140006170
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], bx
mov r8d, 0xe
lea rdx, str.UserPinnedTemp
lea rcx, [rsp + 0x50]
call fcn.140006170
nop
lea r9, [rbp - 0x66]
mov r8d, r15d
test r15d, r15d
jns 0x14001a638
neg r8d
sub r9, 2
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dx
shl ax, 2
lea ecx, [rax + rdx]
add cx, cx
sub r8w, cx
add r8w, 0x30
mov word [r9], r8w
mov r8d, edx
test edx, edx
jne 0x14001a5fb
add r9, 0xfffffffffffffffe
lea eax, [rdx + 0x2d]
mov word [r9], ax
jmp 0x14001a668
sub r9, 2
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dx
shl ax, 2
lea ecx, [rax + rdx]
add cx, cx
sub r8w, cx
add r8w, 0x30
mov word [r9], r8w
mov r8d, edx
test edx, edx
jne 0x14001a638
mov qword [rsp + 0x30], rbx
mov r8, rbx
mov qword [rsp + 0x40], rbx
mov eax, 7
mov qword [rsp + 0x48], rax
mov word [rsp + 0x30], bx
lea rcx, [rbp - 0x66]
cmp r9, rcx
je 0x14001a6ae
lea r8, [rbp - 0x66]
sub r8, r9
sar r8, 1
mov rdx, r9
lea rcx, [rsp + 0x30]
call fcn.140006170
mov rax, qword [rsp + 0x48]
mov r8, qword [rsp + 0x40]
lea rdx, [rsp + 0x30]
cmp rax, 8
cmovae rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.14000993c
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x14001a70a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a705
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001abd7
call fcn.14005cb40
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.14001622c
mov rcx, rdi
cmp qword [rdi + 0x18], 8
jb 0x14001a724
mov rcx, qword [rdi]
lea rbx, [r13 + 0x80]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor ecx, ecx
mov rdx, rbx
test eax, eax
jne 0x14001a7c7
cmp qword [rbx + 0x18], 8
jb 0x14001a748
mov rdx, qword [rbx]
mov qword [rsp + 0x70], rcx
mov qword [rbp - 0x80], rcx
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], cx
mov r8, r12
inc r8
cmp word [rdx + r8*2], cx
jne 0x14001a761
lea rcx, [rsp + 0x70]
call fcn.140006170
nop
lea rcx, [rsp + 0x70]
call fcn.140016320
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x14001a84b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a846
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001abd1
jmp 0x14001a846
cmp qword [rbx + 0x18], 8
jb 0x14001a7d1
mov rdx, qword [rbx]
mov qword [rsp + 0x70], rcx
mov qword [rbp - 0x80], rcx
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], cx
mov r8, r12
inc r8
cmp word [rdx + r8*2], cx
jne 0x14001a7ea
lea rcx, [rsp + 0x70]
call fcn.140006170
nop
lea rcx, [rsp + 0x70]
call fcn.1400164fc
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x14001a84b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a846
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001abdd
call fcn.14005cb40
mov r8, r14
mov rdx, rbx
mov rcx, r13
call fcn.14001acec
mov ebx, eax
test eax, eax
js 0x14001ab61
cmp rsi, rdi
je 0x14001a881
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x14001a875
mov rdx, qword [rdi]
mov r8, qword [rdi + 0x10]
mov rcx, rsi
call fcn.140006170
mov rdx, r14
mov rcx, rsi
call fcn.14001622c
mov rdx, r14
cmp qword [r14 + 0x18], 8
jb 0x14001a899
mov rdx, qword [r14]
mov r8d, 9
cmp qword [r14 + 0x10], r8
jne 0x14001a8d4
lea rcx, [0x1400afec0]
sub rdx, rcx
movzx eax, word [rcx]
cmp word [rcx + rdx], ax
jne 0x14001a8d4
add rcx, 2
sub r8, 1
jne 0x14001a8af
mov rdx, rsi
cmp qword [rsi + 0x18], 8
jb 0x14001a8cf
mov rdx, qword [rsi]
call fcn.14001b384
xor ebx, ebx
call fcn.1400174e8
cmp eax, 0xd
je 0x14001aa8b
call fcn.1400174e8
cmp eax, 0xb
je 0x14001aa8b
call fcn.1400174e8
cmp eax, 0xc
je 0x14001aa8b
call fcn.1400174e8
cmp eax, 5
jg 0x14001aa56
test r15d, r15d
jne 0x14001aa56
xor r15d, r15d
mov qword [rsp + 0x70], r15
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], r15w
lea rcx, [rsp + 0x70]
call fcn.140020904
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], r15
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x30]
call fcn.140007abc
nop
mov rdx, r14
lea rcx, [rsp + 0x30]
call fcn.14001622c
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rcx, qword [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x14001a992
mov r8, r14
lea rdx, [rsp + 0x70]
mov rcx, r13
call fcn.14001acec
lea r8, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae r8, qword [rsp + 0x30]
lea rdx, [0x1400b0140]
call fcn.14001b5e0
mov ecx, 0x80004005
test eax, eax
cmove ebx, ecx
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x14001a9fb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a9f6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001abe3
call fcn.14005cb40
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], r15w
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x14001aab4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001aa4f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001abe9
call fcn.14005cb40
jmp 0x14001aab4
mov r8, rsi
cmp qword [rsi + 0x18], 8
jb 0x14001aa63
mov r8, qword [rsi]
lea rax, str.StartPin
lea rdx, str.TaskbarPin
test r15d, r15d
cmove rdx, rax
call fcn.14001b5e0
xor r15d, r15d
test eax, eax
jne 0x14001aab4
mov ebx, 0x80004005
jmp 0x14001aab4
call fcn.140017740
cmp eax, 0x40
jne 0x14001aa9c
xor eax, eax
jmp 0x14001ab61
mov r8, rsi
mov edx, r15d
call fcn.14001c078
mov ecx, 0x80004005
xor r15d, r15d
test eax, eax
cmove ebx, ecx
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x14001aac1
mov rdx, qword [rdi]
mov qword [rsp + 0x70], r15
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], r15w
inc r12
cmp word [rdx + r12*2], r15w
jne 0x14001aad8
mov r8, r12
lea rcx, [rsp + 0x70]
call fcn.140006170
nop
lea rcx, [rsp + 0x70]
call fcn.1400164c4
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x14001ab3c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001ab37
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001abef
call fcn.14005cb40
xor r8d, r8d
lea rdx, [0x1400ad950]
mov rcx, rdi
call fcn.140006170
xor r8d, r8d
lea rdx, [0x1400ad950]
mov rcx, rsi
call fcn.140006170
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x14001ab9f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001ab9a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001abcb
call fcn.14005cb40
mov eax, ebx
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.14005ccc0
mov rbx, qword [rsp + 0x318]
add rsp, 0x2c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140067514
nop
call fcn.140067514
nop
call fcn.140067514
int3
call fcn.140067514
nop
call fcn.140067514
nop
call fcn.140067514
int3
call fcn.140067514
int3