Function at 0x413ce0
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xe8
movaps xmmword [rsp + 0xd0], xmm6
mov rsi, rcx
mov qword [rsp + 0x38], 0
lea rcx, [0x00497ee8]
lea r9, [rsp + 0x38]
xor edx, edx
xor r8d, r8d
call sub.SHELL32.dll_SHGetKnownFolderPath
mov rcx, qword [rsp + 0x38]
test eax, eax
je 0x413d35
call sub.ole32.dll_CoTaskMemFree
mov byte [rsp + 0xc8], 2
jmp 0x413d59
call sub.KERNEL32.dll_lstrlenW
movsxd r8, eax
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0xb0]
call fcn.0044a330
mov rcx, qword [rsp + 0x38]
call sub.ole32.dll_CoTaskMemFree
mov qword [rsp + 0x38], 0
lea rcx, [0x00497ef8]
lea r9, [rsp + 0x38]
xor edx, edx
xor r8d, r8d
call sub.SHELL32.dll_SHGetKnownFolderPath
mov rcx, qword [rsp + 0x38]
test eax, eax
je 0x413d90
call sub.ole32.dll_CoTaskMemFree
mov byte [rsp + 0xa8], 2
jmp 0x413db4
call sub.KERNEL32.dll_lstrlenW
movsxd r8, eax
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x90]
call fcn.0044a330
mov rcx, qword [rsp + 0x38]
call sub.ole32.dll_CoTaskMemFree
mov qword [rsp + 0x30], 0
lea rcx, [0x00497f08]
lea r9, [rsp + 0x30]
xor edx, edx
xor r8d, r8d
call sub.SHELL32.dll_SHGetKnownFolderPath
mov rcx, qword [rsp + 0x30]
test eax, eax
je 0x413deb
call sub.ole32.dll_CoTaskMemFree
mov byte [rsp + 0x50], 2
mov bpl, 2
jmp 0x413e25
call sub.KERNEL32.dll_lstrlenW
movsxd r8, eax
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x38]
call fcn.0044a330
mov rcx, qword [rsp + 0x30]
call sub.ole32.dll_CoTaskMemFree
mov rdi, qword [rsp + 0x38]
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x60], rax
mov r13, qword [rsp + 0x48]
movzx ebp, byte [rsp + 0x50]
mov r8, qword [rsp + 0xb0]
movdqu xmm6, xmmword [rsp + 0xb8]
movzx eax, byte [rsp + 0xc8]
mov r14, qword [rsp + 0x90]
mov r15, qword [rsp + 0x98]
movzx ebx, byte [rsp + 0xa8]
cmp al, 2
je 0x4140d8
cmp bl, 2
je 0x4140d8
cmp bpl, 2
je 0x4140d8
mov byte [rsp + 0x2f], al
mov qword [rsp + 0x88], r8
mov r12, qword [rsp + 0xa0]
mov eax, 1
mov qword [rsp + 0x58], rax
test r13, r13
je 0x413ed8
js 0x41417d
movzx eax, byte [0x004ac1c8]
mov rcx, qword [0x004ac108]
test rcx, rcx
jne 0x413ec5
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x414184
mov rcx, rax
mov qword [0x004ac108], rax
xor edx, edx
mov r8, r13
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x414184
mov qword [rsp + 0x70], r15
mov r15, r14
mov byte [rsp + 0x2e], bpl
mov qword [rsp + 0x68], rax
mov rcx, rax
mov qword [rsp + 0x80], rdi
mov rdx, rdi
mov qword [rsp + 0x78], r13
mov r8, r13
call sub.msvcrt.dll_memcpy
mov edi, 1
test r12, r12
je 0x413fae
js 0x41417d
movzx eax, byte [0x004ac1c8]
mov rcx, qword [0x004ac108]
test rcx, rcx
mov rdi, r15
jne 0x413f47
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x41416e
mov rcx, rax
mov qword [0x004ac108], rax
xor edx, edx
mov r8, r12
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x41416e
mov qword [rsp + 0x58], rax
mov rcx, rax
mov rdx, rdi
mov r8, r12
call sub.msvcrt.dll_memcpy
movzx eax, byte [0x004ac1c8]
mov rcx, qword [0x004ac108]
test rcx, rcx
jne 0x413f98
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x41416e
mov rcx, rax
mov qword [0x004ac108], rax
xor edx, edx
mov r8, r12
call sub.KERNEL32.dll_HeapAlloc
mov rdi, rax
test rax, rax
je 0x41416e
lea r13, [rsp + 0xc9]
lea r14, [rsp + 0xa9]
lea rbp, [rsp + 0x51]
mov rcx, rdi
mov rdx, r15
mov r8, r12
call sub.msvcrt.dll_memcpy
mov eax, dword [r14 + 3]
mov dword [rsi + 0xdc], eax
mov eax, dword [r14]
mov dword [rsi + 0xd9], eax
mov eax, dword [rbp]
mov dword [rsi + 0xf9], eax
mov eax, dword [rbp + 3]
mov dword [rsi + 0xfc], eax
mov eax, dword [r13]
mov dword [rsi + 0x79], eax
mov eax, dword [r13 + 3]
mov dword [rsi + 0x7c], eax
mov byte [rsi + 0x18], 2
mov byte [rsi + 0x38], 2
mov byte [rsi + 0x58], 2
mov rax, qword [rsp + 0x88]
mov qword [rsi + 0x60], rax
movdqu xmmword [rsi + 0x68], xmm6
movzx eax, byte [rsp + 0x2f]
mov byte [rsi + 0x78], al
mov rax, qword [rsp + 0x68]
mov qword [rsi + 0x80], rax
mov rdx, qword [rsp + 0x78]
mov qword [rsi + 0x88], rdx
mov qword [rsi + 0x90], rdx
movzx ecx, byte [rsp + 0x2e]
mov byte [rsi + 0x98], cl
mov rax, qword [rsp + 0x58]
mov qword [rsi + 0xa0], rax
mov qword [rsi + 0xa8], r12
mov qword [rsi + 0xb0], r12
mov byte [rsi + 0xb8], bl
mov qword [rsi + 0xc0], r15
mov rax, qword [rsp + 0x70]
mov qword [rsi + 0xc8], rax
mov qword [rsi + 0xd0], r12
mov byte [rsi + 0xd8], bl
mov rax, qword [rsp + 0x80]
mov qword [rsi + 0xe0], rax
mov rax, qword [rsp + 0x60]
mov qword [rsi + 0xe8], rax
mov qword [rsi + 0xf0], rdx
mov byte [rsi + 0xf8], cl
mov qword [rsi + 0x100], rdi
mov qword [rsi + 0x108], r12
mov qword [rsi + 0x110], r12
mov byte [rsi + 0x118], bl
jmp 0x414152
mov byte [rsi + 0x118], 2
cmp al, 2
je 0x4140fb
movq rax, xmm6
test rax, rax
je 0x4140fb
mov rcx, qword [0x004ac108]
xor edx, edx
call fcn.0049062c
cmp bl, 2
je 0x414116
test r15, r15
je 0x414116
mov rcx, qword [0x004ac108]
xor edx, edx
mov r8, r14
call fcn.0049062c
cmp bpl, 2
mov rax, qword [rsp + 0x60]
je 0x414152
test rax, rax
je 0x414152
mov rcx, qword [0x004ac108]
xor edx, edx
mov r8, rdi
movaps xmm6, xmmword [rsp + 0xd0]
add rsp, 0xe8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.0049062c
movaps xmm6, xmmword [rsp + 0xd0]
add rsp, 0xe8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, 1
mov rdx, r12
call fcn.0040cdc0
ud2
call fcn.0040cd80
ud2
mov ecx, 1
mov rdx, r13
call fcn.0040cdc0
ud2