Function at 0x14004bbec
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rsi
push rdi
push r14
sub rsp, 0x480
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov rax, qword [0x1400c9158]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov ebp, edx
mov ebx, ecx
mov rsi, qword [rsp + 0x4c0]
mov r14, qword [rsp + 0x4c8]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov edx, ecx
xor ecx, ecx
call qword [sym.imp.ext_ms_win_shell32_shellfolders_l1_1_0.dll_SHGetFolderPathW]
mov edi, eax
test eax, eax
js 0x14004bdc0
mov ecx, 0x104
mov eax, ecx
lea rdx, [rsp + 0x50]
cmp word [rdx], 0
je 0x14004bc74
add rdx, 2
sub rax, 1
jne 0x14004bc64
mov ebx, 0x80070057
xor esi, esi
test rax, rax
cmovne ebx, esi
je 0x14004bc8b
mov r8, rcx
sub r8, rax
jmp 0x14004bc8e
mov r8, rsi
test rax, rax
je 0x14004bcec
sub rcx, r8
lea rdx, [rsp + 0x50]
lea rdx, [rdx + r8*2]
je 0x14004bcd6
lea rax, [r8 + 0x7ffffefa]
add rax, rcx
lea r8, [0x140095b54]
sub r8, rdx
test rax, rax
je 0x14004bcd6
movzx r9d, word [r8 + rdx]
test r9w, r9w
je 0x14004bcd6
mov word [rdx], r9w
add rdx, 2
dec rax
sub rcx, 1
jne 0x14004bcb5
lea rax, [rdx - 2]
test rcx, rcx
cmovne rax, rdx
mov word [rax], si
mov ebx, 0x8007007a
cmovne ebx, esi
mov rcx, qword [rsp + 0x498]
test ebx, ebx
jns 0x14004bd13
mov r9d, ebx
lea r8, str.onecoreuap_base_appmodel_search_search_search_service_setup.cxx
mov edx, 0x384
call fcn.14002cfec
mov eax, ebx
jmp 0x14004be8a
lea rdx, str.file:___
lea rcx, [rsp + 0x30]
call fcn.14001007c
nop
mov edi, 0x8007000e
mov rbx, qword [rsp + 0x30]
test rbx, rbx
cmovne edi, esi
mov rcx, qword [rsp + 0x498]
test edi, edi
jns 0x14004bd4b
mov r9d, edi
mov edx, 0x38e
jmp 0x14004bda5
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.140049eb4
mov edi, 0x8007000e
mov rbx, qword [rsp + 0x30]
test rbx, rbx
cmovne edi, esi
mov rcx, qword [rsp + 0x498]
test edi, edi
jns 0x14004bd80
mov r9d, edi
mov edx, 0x395
jmp 0x14004bda5
mov qword [rsp + 0x28], r14
mov edx, ebp
mov rcx, rbx
call fcn.14004b958
mov edi, eax
mov rcx, qword [rsp + 0x498]
test eax, eax
jns 0x14004bdb2
mov r9d, eax
mov edx, 0x39a
lea r8, str.onecoreuap_base_appmodel_search_search_search_service_setup.cxx
call fcn.14002cfec
nop
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x14004be88
mov rcx, qword [rsp + 0x498]
mov dword [rsp + 0x28], ebx
lea rax, str.CSIDL:__d
mov qword [rsp + 0x20], rax
mov r9d, edi
lea r8, str.onecoreuap_base_appmodel_search_search_search_service_setup.cxx
mov edx, 0x3a1
call fcn.140050168
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x260]
call sub.msvcrt.dll_memset
mov r8d, 0x104
lea rdx, [rsp + 0x260]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
lea rdx, [rsp + 0x260]
lea rcx, [rsp + 0x30]
call fcn.1400500b4
nop
mov r9d, dword [rsi + 0x10]
mov r8, qword [rsi + 8]
mov edx, 0x7df
lea rcx, [rsp + 0x30]
call fcn.1400500f4
mov dword [rsi + 0x14], eax
mov edx, dword [rsi + 0x10]
mov rcx, rsi
call fcn.140017eac
mov edx, dword [rsi + 0x10]
mov r8d, dword [rsi + 0x14]
sub edx, r8d
lea rcx, [rax + r8*2]
mov r9d, ebx
lea r8, [0x1400a11d8]
call fcn.140009728
mov rcx, rsi
call fcn.140017e78
nop
lea rcx, [rsp + 0x30]
call fcn.14002d080
mov eax, edi
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.14002dd40
lea r11, [rsp + 0x480]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret