Function at 0x14004beac
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rsi
push rdi
push r14
sub rsp, 0x480
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov rax, qword [0x1400c9158]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov ebp, edx
mov ebx, ecx
mov rsi, qword [rsp + 0x4c0]
mov r14, qword [rsp + 0x4c8]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov edx, ecx
xor ecx, ecx
call qword [sym.imp.ext_ms_win_shell32_shellfolders_l1_1_0.dll_SHGetFolderPathW]
mov edi, eax
test eax, eax
js 0x14004c080
mov ecx, 0x104
mov eax, ecx
lea rdx, [rsp + 0x50]
cmp word [rdx], 0
je 0x14004bf34
add rdx, 2
sub rax, 1
jne 0x14004bf24
mov ebx, 0x80070057
xor esi, esi
test rax, rax
cmovne ebx, esi
je 0x14004bf4b
mov r8, rcx
sub r8, rax
jmp 0x14004bf4e
mov r8, rsi
test rax, rax
je 0x14004bfac
sub rcx, r8
lea rdx, [rsp + 0x50]
lea rdx, [rdx + r8*2]
je 0x14004bf96
lea rax, [r8 + 0x7ffffefa]
add rax, rcx
lea r8, [0x140094c84]
sub r8, rdx
test rax, rax
je 0x14004bf96
movzx r9d, word [r8 + rdx]
test r9w, r9w
je 0x14004bf96
mov word [rdx], r9w
add rdx, 2
dec rax
sub rcx, 1
jne 0x14004bf75
lea rax, [rdx - 2]
test rcx, rcx
cmovne rax, rdx
mov word [rax], si
mov ebx, 0x8007007a
cmovne ebx, esi
mov rcx, qword [rsp + 0x498]
test ebx, ebx
jns 0x14004bfd3
mov r9d, ebx
lea r8, str.onecoreuap_base_appmodel_search_search_search_service_setup.cxx
mov edx, 0x384
call fcn.14002c058
mov eax, ebx
jmp 0x14004c14a
lea rdx, str.file:___
lea rcx, [rsp + 0x30]
call fcn.14000c5fc
nop
mov edi, 0x8007000e
mov rbx, qword [rsp + 0x30]
test rbx, rbx
cmovne edi, esi
mov rcx, qword [rsp + 0x498]
test edi, edi
jns 0x14004c00b
mov r9d, edi
mov edx, 0x38e
jmp 0x14004c065
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.14004a0e4
mov edi, 0x8007000e
mov rbx, qword [rsp + 0x30]
test rbx, rbx
cmovne edi, esi
mov rcx, qword [rsp + 0x498]
test edi, edi
jns 0x14004c040
mov r9d, edi
mov edx, 0x395
jmp 0x14004c065
mov qword [rsp + 0x28], r14
mov edx, ebp
mov rcx, rbx
call fcn.14004bc18
mov edi, eax
mov rcx, qword [rsp + 0x498]
test eax, eax
jns 0x14004c072
mov r9d, eax
mov edx, 0x39a
lea r8, str.onecoreuap_base_appmodel_search_search_search_service_setup.cxx
call fcn.14002c058
nop
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x14004c148
mov rcx, qword [rsp + 0x498]
mov dword [rsp + 0x28], ebx
lea rax, str.CSIDL:__d
mov qword [rsp + 0x20], rax
mov r9d, edi
lea r8, str.onecoreuap_base_appmodel_search_search_search_service_setup.cxx
mov edx, 0x3a1
call fcn.140050428
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x260]
call sub.msvcrt.dll_memset
mov r8d, 0x104
lea rdx, [rsp + 0x260]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
lea rdx, [rsp + 0x260]
lea rcx, [rsp + 0x30]
call fcn.140050374
nop
mov r9d, dword [rsi + 0x10]
mov r8, qword [rsi + 8]
mov edx, 0x7df
lea rcx, [rsp + 0x30]
call fcn.1400503b4
mov dword [rsi + 0x14], eax
mov edx, dword [rsi + 0x10]
mov rcx, rsi
call fcn.14001459c
mov edx, dword [rsi + 0x10]
mov r8d, dword [rsi + 0x14]
sub edx, r8d
lea rcx, [rax + r8*2]
mov r9d, ebx
lea r8, [0x1400a0f48]
call fcn.140006ce0
mov rcx, rsi
call fcn.140014568
nop
lea rcx, [rsp + 0x30]
call fcn.14002c0f0
mov eax, edi
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.14002cdb0
lea r11, [rsp + 0x480]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret