Function at 0x140006ce0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor r12d, r12d
mov rbp, rcx
test edx, edx
jns 0x140006d12
mov rax, qword [0x140029a10]
not edx
movsxd rdx, edx
mov edx, dword [rax + rdx*4]
mov r8, qword [0x14002aaa4]
lea r13, [0x1400289a0]
movsxd rax, edx
mov rdi, r13
lea r14, [r8 + rax*2]
cmp rcx, r13
jb 0x140006d4e
mov rax, rcx
sub rax, r13
sar rax, 1
cmp rax, 0x800
jae 0x140006d4e
mov rdi, rcx
mov qword [rsp + 0x80], r12
mov rbp, r12
movzx ecx, word [r14]
mov r10d, 0x400
test cx, cx
je 0x140006fae
mov ebp, 4
lea esi, [rbp - 3]
lea r11d, [rbp - 2]
mov rax, rdi
mov r9, r14
sub rax, r13
and rax, 0xfffffffffffffffe
cmp rax, 0x800
jge 0x140006fa6
add r14, r11
cmp cx, bp
jae 0x140006f79
movzx edx, byte [r14]
movzx r15d, byte [r14 + 1]
lea r14, [r9 + 4]
movsx ebx, byte [r9 + 3]
and ebx, 0x7f
movsx eax, dl
and eax, 0x7f
shl ebx, 7
or ebx, eax
mov dword [rsp + 0x34], edx
mov eax, edx
mov dword [rsp + 0x3c], r15d
bts eax, 0xf
mov dword [rsp + 0x30], eax
mov eax, r15d
bts eax, 0xf
mov dword [rsp + 0x38], eax
cmp cx, r11w
jne 0x140006efc
cmp dword [0x14002ab44], r12d
mov rsi, r11
mov eax, edx
cmovne rsi, rbp
test dl, dl
jns 0x140006e2c
and edx, 0x40
and eax, 0x3f
mov dword [rsp + 0x20], edx
mov r9, rdi
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersion
mov rcx, 0xffffffff80000002
lea r8, [r8 + rax*2]
call fcn.1400078e0
cmp word [rdi], r12w
jne 0x140006ed7
mov edx, r15d
mov rcx, rdi
call fcn.140006ce0
jmp 0x140006ed1
cmp edx, 0x25
jne 0x140006e42
mov edx, r10d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x140006ed1
cmp edx, 0x24
jne 0x140006ecc
mov edx, r10d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov rsi, r12
jmp 0x140006ecc
mov rax, qword [0x140029a30]
dec rsi
test rax, rax
je 0x140006e87
mov edx, dword [rsp + rsi*4 + 0x30]
xor r9d, r9d
mov rcx, qword [0x140029a40]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call rax
test eax, eax
je 0x140006ed1
mov edx, dword [rsp + rsi*4 + 0x30]
lea r8, [rsp + 0x90]
mov rcx, qword [0x140029a40]
call sub.SHELL32.dll_SHGetSpecialFolderLocation
test eax, eax
jne 0x140006ec8
mov rcx, qword [rsp + 0x90]
mov rdx, rdi
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov rcx, qword [rsp + 0x90]
mov ebx, eax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test ebx, ebx
jne 0x140006ed1
mov word [rdi], r12w
test rsi, rsi
jne 0x140006e5c
cmp word [rdi], r12w
je 0x140006eed
cmp r15d, 0x1a
jne 0x140006eed
lea rdx, str.MicrosoftInternet_ExplorerQuick_Launch
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rcx, rdi
call fcn.140007d00
mov esi, 1
jmp 0x140006f5c
cmp cx, 3
jne 0x140006f4b
mov rcx, rdi
cmp ebx, 0x1d
jne 0x140006f20
mov r8, qword [0x140029a40]
lea rdx, [0x1400099c8]
call qword [sym.imp.USER32.dll_wsprintfW]
jmp 0x140006f39
lea rax, [section..ndata]
mov edx, ebx
shl rdx, 0xb
mov r8d, r10d
add rdx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
lea eax, [rbx - 0x15]
cmp eax, 7
jae 0x140006f5c
mov rcx, rdi
call fcn.140007d00
jmp 0x140006f5c
cmp cx, si
jne 0x140006f5c
not ebx
mov rcx, rdi
mov edx, ebx
call fcn.140006ce0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rdx, eax
mov r10d, 0x400
add rdx, rdx
mov r11d, 2
jmp 0x140006f8e
mov rdx, r11
jne 0x140006f8b
movzx eax, word [r14]
lea r14, [r9 + 4]
mov word [rdi], ax
jmp 0x140006f8e
mov word [rdi], cx
movzx ecx, word [r14]
add rdi, rdx
test cx, cx
je 0x140006fa6
mov r8, qword [0x14002aaa4]
jmp 0x140006d6d
mov rbp, qword [rsp + 0x80]
mov word [rdi], r12w
test rbp, rbp
je 0x140006fc8
mov r8d, r10d
mov rdx, r13
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
jmp 0x140006fcb
mov rax, r13
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret