Function at 0x140022040
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x390
mov rax, qword [0x1401c0030]
xor rax, rsp
mov qword [rsp + 0x380], rax
lea rax, [rsp + 0x88]
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x3a0]
mov rcx, qword [rsp + 0x30]
call fcn.14000b5f0
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x38]
call fcn.1400160e0
test eax, eax
jne 0x1400220a3
mov rcx, qword [rsp + 0x3a0]
call fcn.14000b4e0
jmp 0x140022388
mov qword [rsp + 0x20], 0
lea rax, [rsp + 0x170]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov rdx, qword [rsp + 0x3a0]
lea rcx, [rsp + 0x148]
call fcn.14000b5f0
nop
mov rdx, qword [rsp + 0x3a0]
lea rcx, [rsp + 0x128]
call fcn.14000b5f0
nop
lea rdx, [rsp + 0x170]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x3a0]
mov rcx, qword [rsp + 0x40]
call fcn.14000b5f0
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x48]
call fcn.140039570
lea rcx, [rsp + 0x148]
call fcn.140039480
lea rdx, [rsp + 0x148]
lea rcx, [rsp + 0x128]
call fcn.14000b480
lea rdx, str.atpdppta.dll
lea rcx, [rsp + 0x128]
call fcn.140019680
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0xe8]
mov qword [rsp + 0x60], rax
lea rdx, [rsp + 0x128]
mov rcx, qword [rsp + 0x50]
call fcn.14000b5f0
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x68], rax
lea rdx, str.Uninstall_PowerPoint_Plugin
mov rcx, qword [rsp + 0x60]
call fcn.140019710
mov qword [rsp + 0x70], rax
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x70]
call fcn.14003a2e0
lea rcx, [rsp + 0x128]
call fcn.14000b420
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x14002222a
lea rdx, [rsp + 0x148]
lea rcx, [rsp + 0x128]
call fcn.14000b480
lea rdx, str.atpdppta64.dll
lea rcx, [rsp + 0x128]
call fcn.140019680
lea rcx, [rsp + 0x128]
call fcn.14000b420
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x14002232a
lea rdx, str.PDUninstallPPTPlugIn
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x14002231f
lea rdx, [rsp + 0x148]
lea rcx, [rsp + 0x128]
call fcn.14000b480
lea rdx, str.webexpd.ppa
lea rcx, [rsp + 0x128]
call fcn.140019680
lea rcx, [rsp + 0x128]
call fcn.14000b420
mov edx, 1
mov rcx, rax
call qword [rsp + 0x20]
lea rdx, [rsp + 0x148]
lea rcx, [rsp + 0x128]
call fcn.14000b480
lea rdx, str.webex.ppa
lea rcx, [rsp + 0x128]
call fcn.140019680
lea rcx, [rsp + 0x128]
call fcn.14000b420
mov edx, 1
mov rcx, rax
call qword [rsp + 0x20]
lea rdx, [rsp + 0x148]
lea rcx, [rsp + 0x128]
call fcn.14000b480
lea rdx, str.webexpd64.ppa
lea rcx, [rsp + 0x128]
call fcn.140019680
lea rcx, [rsp + 0x128]
call fcn.14000b420
mov edx, 1
mov rcx, rax
call qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rax, [rsp + 0x108]
mov qword [rsp + 0x78], rax
lea rdx, [rsp + 0x170]
mov rcx, qword [rsp + 0x78]
call fcn.140019710
mov qword [rsp + 0x80], rax
mov rcx, qword [rsp + 0x80]
call fcn.140039570
nop
lea rcx, [rsp + 0x128]
call fcn.14000b4e0
nop
lea rcx, [rsp + 0x148]
call fcn.14000b4e0
nop
mov rcx, qword [rsp + 0x3a0]
call fcn.14000b4e0
mov rcx, qword [rsp + 0x380]
xor rcx, rsp
call fcn.14005e8d0
add rsp, 0x390
pop rdi
ret