Function at 0x1400247c0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x140398130]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov r13, rcx
mov qword [rsp + 0x48], rcx
xor r12d, r12d
mov dword [rsp + 0x40], r12d
mov qword [rsp + 0x50], r12
lea r9, [rsp + 0x50]
xor r8d, r8d
xor edx, edx
lea rcx, [0x140359a90]
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
mov ebx, eax
xorps xmm0, xmm0
movups xmmword [r13], xmm0
mov qword [r13 + 0x10], r12
mov qword [r13 + 0x18], r12
mov rdx, qword [rsp + 0x50]
mov r15, 0xffffffffffffffff
mov r8, r15
inc r8
cmp word [rdx + r8*2], r12w
jne 0x140024845
mov rcx, r13
call fcn.1400855f0
mov dword [rsp + 0x40], 1
call fcn.1402abdf0
test ebx, ebx
js 0x140024878
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x140024b98
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x140024918
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x140024918
mov r14d, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r11d
lea rcx, [r14 + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
mov r10d, 0xd021f5c4
movzx ecx, byte [r9]
inc r9
test cl, cl
je 0x140024913
nop
movsx edx, cl
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
movzx ecx, byte [r9]
lea r9, [r9 + 1]
test cl, cl
jne 0x1400248e0
cmp r10d, 0x90e4cff5
je 0x140024920
test r11d, r11d
jne 0x1400248c0
mov rax, qword [rax]
jmp 0x140024890
mov ecx, dword [rsi + 0x24]
add rcx, rbx
movzx edx, word [rcx + r11*2]
mov ecx, dword [rsi + 0x1c]
add rcx, rbx
mov eax, dword [rcx + rdx*4]
add rax, rbx
mov edx, 0x104
lea rcx, [rsp + 0x60]
call rax
test eax, eax
jne 0x140024a9d
mov dword [rsp + 0x20], Ordinal_211
mov dword [rsp + 0x24], 0x9b0020
mov qword [rsp + 0x28], 8
mov dword [rsp + 0x30], 0x63cc0000
mov dword [rsp + 0x34], 0x30500cc
mov word [rsp + 0x38], 0x63
mov r11d, r12d
lea r9, [rsp + 0x2c]
lea ebx, [r11 + r11*2]
movzx ecx, word [rsp + rbx*2 + 0x20]
mov word [r9], cx
movzx eax, r11w
add ax, ax
lea edi, [rax + r11]
movzx r8d, byte [rsp + 0x34]
add r8w, di
xor r8w, cx
mov word [r9], r8w
xor dl, dl
lea eax, [rbx + 1]
movzx r10d, word [rsp + rax*2 + 0x20]
nop dword [rax + rax]
movzx ecx, dl
movzx eax, r10w
shr ax, cl
test al, 1
jne 0x1400249d7
inc dl
cmp dl, 4
jne 0x1400249c0
jmp 0x1400249e8
movzx r8d, r8w
movzx eax, byte [rsp + 0x37]
btc r8d, eax
mov word [r9], r8w
mov dl, 5
lea eax, [rbx + 2]
lea rbx, [rsp + 0x20]
lea rbx, [rbx + rax*2]
movzx r10d, word [rbx]
nop word [rax + rax]
movzx ecx, dl
movzx eax, r10w
shr ax, cl
test al, 1
jne 0x140024a17
inc dl
cmp dl, 8
jne 0x140024a00
jmp 0x140024a2b
movzx ecx, r8w
movzx eax, byte [rsp + 0x36]
btc ecx, eax
movzx r8d, cx
mov word [r9], cx
xor cl, cl
movzx edx, word [rbx]
movzx eax, dx
shr ax, cl
test al, 1
jne 0x140024a43
inc cl
cmp cl, 5
jne 0x140024a30
jmp 0x140024a57
movzx ecx, r8w
movzx eax, byte [rsp + 0x35]
btc ecx, eax
movzx r8d, cx
mov word [r9], cx
movzx eax, byte [rsp + 0x33]
add ax, di
xor ax, r8w
mov word [r9], ax
inc r11d
add r9, 2
cmp r11d, 2
jne 0x140024983
lea rax, [rsp + 0x2c]
mov r8, r15
inc r8
cmp word [rax + r8*2], 0
jne 0x140024a80
lea rdx, [rsp + 0x2c]
mov rcx, r13
call fcn.1400858d0
jmp 0x140024b98
xor r8d, r8d
lea rdx, [0x140374568]
mov rcx, r13
call fcn.1400858d0
movzx edx, word [rsp + 0x60]
mov rcx, r13
call fcn.140085390
mov r9d, 0xdf
mov dword [rsp + 0x20], r9d
mov edx, reloc.WLDAP32.dll_Ordinal_32
mov word [rsp + 0x24], dx
mov dword [rsp + 0x28], 0xcc630000
mov dil, 0xcc
mov cl, 9
mov dword [rsp + 0x2c], 0x3050009
xor bl, bl
mov r11b, 5
mov r10b, 3
mov word [rsp + 0x30], WSAStartup
movzx r8d, cl
xor r8w, r9w
xor cl, cl
nop
movzx eax, r12w
shr ax, cl
test al, 1
jne 0x140024b14
inc cl
cmp cl, 4
jne 0x140024b00
jmp 0x140024b20
movzx r8d, r8w
movzx eax, r10b
btc r8d, eax
movzx ecx, r11b
movzx eax, dx
shr ax, cl
test al, 1
jne 0x140024b37
inc cl
cmp cl, 8
jne 0x140024b24
jmp 0x140024b43
movzx r8d, r8w
movzx eax, r11b
btc r8d, eax
xor cl, cl
movzx eax, dx
shr ax, cl
test al, 1
jne 0x140024b58
inc cl
cmp cl, r11b
jne 0x140024b45
jmp 0x140024b63
movzx r8d, r8w
movzx eax, bl
btc r8d, eax
movzx eax, dil
xor ax, r8w
mov word [rsp + 0x26], ax
lea rax, [rsp + 0x26]
mov r8, r15
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140024b80
lea rdx, [rsp + 0x26]
mov rcx, r13
call fcn.140085d20
mov r8d, 0x64
mov dword [rsp + 0x20], 0x20064
lea r10d, [r8 - 0x62]
mov r9d, Ordinal_50
mov word [rsp + 0x24], r9w
mov dword [rsp + 0x28], 0x63cc0000
mov sil, 0x63
mov cl, WSAStartup
mov dword [rsp + 0x2c], 0x3050072
xor dil, dil
mov bl, 5
mov r11b, 3
mov word [rsp + 0x30], 9
movzx edx, cl
xor dx, r8w
xor cl, cl
movzx eax, r10w
shr ax, cl
test al, 1
jne 0x140024bf7
inc cl
cmp cl, 4
jne 0x140024be3
jmp 0x140024c01
movzx edx, dx
movzx eax, r11b
btc edx, eax
movzx ecx, bl
movzx eax, r9w
shr ax, cl
test al, 1
jne 0x140024c18
inc cl
cmp cl, 8
jne 0x140024c04
jmp 0x140024c21
movzx edx, dx
movzx eax, bl
btc edx, eax
xor cl, cl
movzx eax, r9w
shr ax, cl
test al, 1
jne 0x140024c36
inc cl
cmp cl, bl
jne 0x140024c23
jmp 0x140024c40
movzx edx, dx
movzx eax, dil
btc edx, eax
movzx eax, sil
xor ax, dx
mov word [rsp + 0x26], ax
lea rax, [rsp + 0x26]
inc r15
cmp word [rax + r15*2], 0
jne 0x140024c51
mov r8, r15
lea rdx, [rsp + 0x26]
mov rcx, r13
call fcn.140085d20
mov rax, r13
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.1403139c0
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret