Function at 0x4070be
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
mov r12, rcx
movsxd rbx, edx
test edx, edx
jns 0x4070eb
mov rax, qword [0x0040bb00]
not edx
movsxd rdx, edx
mov rax, qword [rax]
movsxd rbx, dword [rax + rdx*4]
mov rax, qword [0x0040bb30]
lea rbp, [0x0043d020]
add rbx, rbx
mov rsi, rbp
add rbx, qword [rax + 0x24]
cmp r12, rbp
jb 0x4071da
mov rax, r12
sub rax, rbp
cmp rax, 0xfff
ja 0x4071da
mov rsi, r12
xor r12d, r12d
jmp 0x4071da
mov rax, rsi
sub rax, rbp
cmp rax, 0x7fe
jg 0x407387
cmp cx, 3
ja 0x407361
movsx edi, byte [rbx + 3]
mov dl, byte [rbx + 2]
add rbx, 4
mov ax, word [rbx - 2]
shl edi, 7
and edx, 0x7f
and edi, 0x3f80
mov r13d, eax
or edi, edx
movzx edx, al
shr r13w, 8
mov r9d, edx
movzx r15d, r13w
mov dword [rsp + 0x54], edx
or r9d, 0x8000
mov dword [rsp + 0x5c], r15d
mov dword [rsp + 0x50], r9d
mov r9d, r13d
or r9w, 0x8000
movzx r9d, r9w
mov dword [rsp + 0x58], r9d
cmp cx, 2
je 0x4071eb
cmp cx, 3
jne 0x407347
cmp edi, 0x1d
jne 0x407315
mov rax, qword [0x0040bbc0]
mov rcx, rsi
mov rdx, qword [rax]
call fcn.00406eb9
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cdqe
add rax, rax
add rax, rsi
mov rsi, rax
mov cx, word [rbx]
test cx, cx
jne 0x407129
jmp 0x407387
mov rcx, qword [0x0040bb60]
cmp dword [rcx + 4], 1
sbb edi, edi
and edi, 0xfffffffe
add edi, 4
test al, al
jns 0x407256
mov rdi, qword [0x0040bb30]
mov r8, rax
and eax, 0x40
mov r9, rsi
and r8d, 0x3f
movzx eax, al
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersion
mov rcx, 0xffffffff80000002
add r8, r8
add r8, qword [rdi + 0x24]
mov dword [rsp + 0x20], eax
xor edi, edi
call fcn.00406e25
cmp word [rsi], 0
jne 0x40724a
mov edx, r15d
mov rcx, rsi
call fcn.004070be
movsxd rdi, edi
mov r15, qword [0x0040bbc0]
jmp 0x4072b6
cmp dl, 0x25
jne 0x40726b
mov edx, 0x400
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x40727e
cmp edx, 0x24
jne 0x40724a
mov edx, 0x400
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xor edi, edi
jmp 0x40724a
mov rax, qword [0x0040bb10]
mov r14d, dword [rsp + rdi*4 + 0x4c]
mov rcx, qword [r15]
mov rax, qword [rax]
test rax, rax
jne 0x4072bc
lea r8, [rsp + 0x48]
mov edx, r14d
mov rcx, qword [r15]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
je 0x4072ee
mov word [rsi], 0
dec rdi
test edi, edi
jne 0x407282
jmp 0x4072d0
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rsi
mov edx, r14d
call rax
test eax, eax
jne 0x407299
cmp word [rsi], 0
je 0x40733a
cmp r13w, 0x1a
jne 0x40733a
lea rdx, str.MicrosoftInternet_ExplorerQuick_Launch
mov rcx, rsi
call sub.KERNEL32.dll_lstrcatW
jmp 0x40733a
mov rdx, rsi
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov rcx, qword [rsp + 0x48]
mov dword [rsp + 0x3c], eax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, dword [rsp + 0x3c]
test eax, eax
je 0x4072ae
jmp 0x4072d0
movsxd rdx, edi
lea rax, [section..ndata]
mov rcx, rsi
sub edi, 0x15
shl rdx, 0xb
add rdx, rax
call fcn.00406f90
cmp edi, 6
ja 0x4071c6
mov rcx, rsi
call fcn.00406fe9
jmp 0x4071c6
dec cx
jne 0x4071c6
not edi
mov rcx, rsi
mov edx, edi
call fcn.004070be
jmp 0x4071c6
lea rax, [rsi + 2]
cmp cx, 4
jne 0x40737b
mov dx, word [rbx + 2]
add rbx, 4
mov word [rsi], dx
jmp 0x4071d7
add rbx, 2
mov word [rsi], cx
jmp 0x4071d7
mov word [rsi], 0
mov rax, rbp
test r12, r12
je 0x40739f
mov rdx, rbp
mov rcx, r12
call fcn.00406f90
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret