Function at 0x140027610
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x1403c1140]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov r13, rcx
mov qword [rsp + 0x48], rcx
xor r12d, r12d
mov dword [rsp + 0x40], r12d
mov qword [rsp + 0x50], r12
lea r9, [rsp + 0x50]
xor r8d, r8d
xor edx, edx
lea rcx, [0x140382a90]
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
mov ebx, eax
xorps xmm0, xmm0
movups xmmword [r13], xmm0
mov qword [r13 + 0x10], r12
mov qword [r13 + 0x18], r12
mov rdx, qword [rsp + 0x50]
mov r15, 0xffffffffffffffff
mov r8, r15
inc r8
cmp word [rdx + r8*2], r12w
jne 0x140027695
mov rcx, r13
call fcn.14008dc70
mov esi, 1
mov dword [rsp + 0x40], esi
call fcn.1402d3500
test ebx, ebx
js 0x1400276c9
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x1400279f0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x140027768
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x140027768
mov r14d, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r11d
lea rcx, [r14 + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
mov r10d, 0x43afc3f8
movzx ecx, byte [r9]
inc r9
test cl, cl
je 0x140027763
nop
movsx edx, cl
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
movzx ecx, byte [r9]
lea r9, [r9 + 1]
test cl, cl
jne 0x140027730
cmp r10d, 0xb39e5541
je 0x140027770
test r11d, r11d
jne 0x140027710
mov rax, qword [rax]
jmp 0x1400276e0
mov ecx, dword [rsi + 0x24]
add rcx, rbx
movzx edx, word [rcx + r11*2]
mov ecx, dword [rsi + 0x1c]
add rcx, rbx
mov eax, dword [rcx + rdx*4]
add rax, rbx
mov edx, 0x104
lea rcx, [rsp + 0x60]
call rax
test eax, eax
jne 0x140027901
mov dword [rsp + 0x20], reloc.WS2_32.dll_socket
mov dword [rsp + 0x24], 0x4e0080
mov qword [rsp + 0x28], 8
mov dword [rsp + 0x30], 0xb3c70000
mov dword [rsp + 0x34], 0x30500c7
mov word [rsp + 0x38], 0xb3
mov r10d, r12d
lea r11, [rsp + 0x2c]
lea edx, [r10 + r10*2]
movzx ecx, word [rsp + rdx*2 + 0x20]
mov word [r11], cx
movzx eax, r10w
add ax, ax
lea ebx, [rax + r10]
movzx r9d, byte [rsp + 0x34]
add r9w, bx
xor r9w, cx
mov word [r11], r9w
xor r8b, r8b
lea eax, [rdx + 1]
movzx edx, word [rsp + rax*2 + 0x20]
nop dword [rax + rax]
movzx ecx, r8b
movzx eax, dx
shr ax, cl
test al, 1
jne 0x140027829
inc r8b
cmp r8b, 4
jne 0x140027810
jmp 0x14002783a
movzx r9d, r9w
movzx eax, byte [rsp + 0x37]
btc r9d, eax
mov word [r11], r9w
mov dl, 5
lea eax, [r10 + 1]
lea eax, [r10 + rax*2]
movzx r8d, word [rsp + rax*2 + 0x20]
nop word [rax + rax]
movzx ecx, dl
movzx eax, r8w
shr ax, cl
test al, 1
jne 0x140027867
inc dl
cmp dl, 8
jne 0x140027850
jmp 0x14002787b
movzx ecx, r9w
movzx eax, byte [rsp + 0x36]
btc ecx, eax
movzx r9d, cx
mov word [r11], cx
xor dl, dl
lea eax, [r10 + 1]
lea eax, [r10 + rax*2]
movzx r8d, word [rsp + rax*2 + 0x20]
nop dword [rax + rax]
movzx ecx, dl
movzx eax, r8w
shr ax, cl
test al, 1
jne 0x1400278a7
inc dl
cmp dl, 5
jne 0x140027890
jmp 0x1400278bb
movzx ecx, r9w
movzx eax, byte [rsp + 0x35]
btc ecx, eax
movzx r9d, cx
mov word [r11], cx
movzx eax, byte [rsp + 0x33]
add ax, bx
xor ax, r9w
mov word [r11], ax
inc r10d
add r11, 2
cmp r10d, 2
jne 0x1400277d3
lea rax, [rsp + 0x2c]
mov r8, r15
inc r8
cmp word [rax + r8*2], 0
jne 0x1400278e4
lea rdx, [rsp + 0x2c]
mov rcx, r13
call fcn.14008df50
jmp 0x1400279eb
xor r8d, r8d
lea rdx, [0x14039d518]
mov rcx, r13
call fcn.14008df50
movzx edx, word [rsp + 0x60]
mov rcx, r13
call fcn.14008da10
mov r8d, 0x45
mov dword [rsp + 0x20], r8d
mov word [rsp + 0x24], r12w
mov dword [rsp + 0x28], 0xb8770000
mov bl, 0xb8
mov cl, Ordinal_200
mov dword [rsp + 0x2c], 0x30500c7
xor r11b, r11b
mov r10b, 5
mov r9b, 3
mov word [rsp + 0x30], 0xb3
movzx edx, cl
xor dx, r8w
xor cl, cl
nop
movzx eax, r12w
shr ax, cl
test al, 1
jne 0x140027974
inc cl
cmp cl, 4
jne 0x140027960
jmp 0x14002797e
movzx edx, dx
movzx eax, r9b
btc edx, eax
movzx ecx, r10b
movzx eax, r12w
shr ax, cl
test al, 1
jne 0x140027996
inc cl
cmp cl, 8
jne 0x140027982
jmp 0x1400279a0
movzx edx, dx
movzx eax, r10b
btc edx, eax
xor cl, cl
movzx eax, r12w
shr ax, cl
test al, 1
jne 0x1400279b6
inc cl
cmp cl, r10b
jne 0x1400279a2
jmp 0x1400279c0
movzx edx, dx
movzx eax, r11b
btc edx, eax
movzx eax, bl
xor ax, dx
mov word [rsp + 0x26], ax
lea rax, [rsp + 0x26]
mov r8, r15
inc r8
cmp word [rax + r8*2], 0
jne 0x1400279d3
lea rdx, [rsp + 0x26]
mov rcx, r13
call fcn.14008e390
mov esi, 1
mov r8d, 0xb1
mov dword [rsp + 0x20], 0x100b1
mov r9d, 0x50
mov word [rsp + 0x24], r9w
mov dword [rsp + 0x28], 0xb3c70000
mov dil, 0xb3
mov cl, 0x77
mov dword [rsp + 0x2c], 0x3050077
xor bl, bl
mov r11b, 5
mov r10b, 3
mov word [rsp + 0x30], 0xb8
movzx edx, cl
xor dx, r8w
xor cl, cl
nop word [rax + rax]
movzx eax, si
shr ax, cl
test al, 1
jne 0x140027a53
inc cl
cmp cl, 4
jne 0x140027a40
jmp 0x140027a5d
movzx edx, dx
movzx eax, r10b
btc edx, eax
movzx ecx, r11b
movzx eax, r9w
shr ax, cl
test al, 1
jne 0x140027a75
inc cl
cmp cl, 8
jne 0x140027a61
jmp 0x140027a7f
movzx edx, dx
movzx eax, r11b
btc edx, eax
xor cl, cl
movzx eax, r9w
shr ax, cl
test al, 1
jne 0x140027a95
inc cl
cmp cl, r11b
jne 0x140027a81
jmp 0x140027a9e
movzx edx, dx
movzx eax, bl
btc edx, eax
movzx eax, dil
xor ax, dx
mov word [rsp + 0x26], ax
lea rax, [rsp + 0x26]
nop
inc r15
cmp word [rax + r15*2], 0
jne 0x140027ab0
mov r8, r15
lea rdx, [rsp + 0x26]
mov rcx, r13
call fcn.14008e390
mov rax, r13
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.14033b2f0
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret