Function at 0x140001ff0
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x370
xorps xmm0, xmm0
lea rcx, [rsp + 0x60]
xor ebx, ebx
xor edx, edx
mov r8d, 0x100
mov qword [rsp + 0x380], rbx
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x30], xmm0
call fcn.1400022a0
mov qword [rsp + 0x388], rbx
call fcn.140003c80
test eax, eax
jne 0x14000228d
mov qword [rsp + 0x390], rdi
mov edi, ebx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea edx, [rbx + 8]
mov r8d, 0xff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x14000206c
mov dword [rax], 0xae
mov rdi, rax
cmp dword [rdi], 0x15e
jle 0x1400020e1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCriticalSectionSpinCount]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetWindowContextHelpId]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_RegisterClassW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_IsWindowVisible]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
xor r9d, r9d
mov dword [rsp + 0x28], ebx
xor r8d, r8d
mov qword [rsp + 0x20], rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_IsDialogMessageW]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor edx, edx
lea rcx, [rsp + 0x160]
mov r8d, 0x208
call fcn.1400022a0
xor r9d, r9d
lea rax, [rsp + 0x160]
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r9 + 0xe]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
call fcn.1400015f0
test eax, eax
je 0x140002285
xor ecx, ecx
call fcn.140001000
mov rdx, rax
test rax, rax
je 0x140002285
movsxd rcx, dword [rax + 0x3c]
mov r9d, dword [rcx + rax + 0x98]
movzx r8d, word [r9 + rax + 0xe]
lea r10, [r9 + rax]
movzx ecx, word [r10 + 0xc]
add r8, rcx
je 0x140002285
nop dword [rax]
mov eax, dword [r10 + rbx*8 + 0x14]
test eax, eax
jns 0x140002285
btr eax, 0x1f
add rax, r9
mov ecx, dword [rax + rdx + 0x14]
test ecx, ecx
jns 0x140002194
cmp word [rax + rdx + 0x10], 0x69
je 0x1400021af
inc rbx
cmp rbx, r8
jb 0x140002170
mov rdi, qword [rsp + 0x390]
xor eax, eax
add rsp, 0x370
pop rbx
ret
btr ecx, 0x1f
add rcx, r9
mov eax, dword [rcx + rdx + 0x14]
btr eax, 0x1f
add rax, r9
mov ebx, dword [rax + rdx]
mov ecx, dword [rax + rdx + 4]
add rbx, rdx
je 0x140002285
test ecx, ecx
je 0x140002285
lea edi, [rcx - 0x30]
mov r8d, 0x20
lea rcx, [rsp + 0x40]
mov rdx, rbx
call fcn.140003f00
lea rdx, [rbx + 0x20]
mov r8d, 0x10
lea rcx, [rsp + 0x30]
call fcn.140003f00
call fcn.140003890
test eax, eax
je 0x140002285
call fcn.140001780
test eax, eax
je 0x140002285
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.140001cd0
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.140002400
mov r8d, edi
lea rdx, [rbx + 0x30]
lea r9, [rsp + 0x380]
lea rcx, [rsp + 0x60]
call fcn.1400022d0
test al, al
je 0x140002285
lea rdx, [rsp + 0x388]
lea rcx, str.sihost.exe
call fcn.1400037d0
test eax, eax
je 0x140002285
mov rdx, qword [rsp + 0x380]
mov r8d, edi
mov rcx, qword [rsp + 0x388]
call fcn.1400039d0
mov rdi, qword [rsp + 0x390]
xor eax, eax
add rsp, 0x370
pop rbx
ret