Function at 0x18000aebc
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x30
xor edi, edi
mov r15d, 0x80070057
mov qword [rdx], rdi
mov r14, rdx
movzx r8d, word [rcx]
mov rsi, rcx
mov ebx, r15d
cmp r8d, 0x15
ja 0x18000af73
cmp r8d, 0x14
jae 0x18000af60
sub r8d, 2
je 0x18000af5a
sub r8d, 1
je 0x18000af23
sub r8d, 5
je 0x18000b1c0
sub r8d, 1
je 0x18000af4c
sub r8d, 4
je 0x18000af4c
cmp r8d, 6
jne 0x18000b1df
mov edx, dword [rcx + 8]
cmp edx, 0xffff
jge 0x18000b1df
bts edx, 0xf
mov r8, r14
xor ecx, ecx
call qword [sym.imp.ext_ms_win_shell_shell32_l1_2_1.dll_SHGetSpecialFolderLocation]
nop dword [rax + rax]
jmp 0x18000b1dd
mov rcx, qword [rcx + 8]
call fcn.18000ade8
jmp 0x18000b1dd
movsx edx, word [rcx + 8]
jmp 0x18000af32
cmp qword [rcx + 8], 0xffff
jae 0x18000b1df
mov edx, dword [rcx + 8]
jmp 0x18000af32
cmp r8d, 0x1f
je 0x18000b1c0
cmp r8d, 0x42
je 0x18000b0c8
cmp r8d, 0x1011
je 0x18000b049
cmp r8d, 0x2011
je 0x18000afbc
cmp r8d, 0x4009
jne 0x18000b1df
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x18000b1df
mov rcx, qword [rcx]
jmp 0x18000af50
mov rcx, qword [rcx + 8]
call qword [sym.imp.OLEAUT32.dll_SafeArrayGetElemsize]
nop dword [rax + rax]
cmp eax, 1
jne 0x18000b1df
mov rax, qword [rsi + 8]
mov edx, 2
mov r8d, edx
mov r10d, dword [rax + 0x18]
mov rcx, qword [rax + 0x10]
mov r9, rcx
cmp r10d, edx
jb 0x18000b1df
cmp word [r9], dx
jb 0x18000b019
movzx r11d, word [r9]
mov eax, r10d
sub eax, r8d
cmp r11d, eax
ja 0x18000b019
movzx eax, word [r9]
add r8d, r11d
add r9, rax
cmp r8d, r10d
jbe 0x18000aff5
cmp r8d, r10d
ja 0x18000b1df
cmp di, word [r9]
jne 0x18000b1df
test rcx, rcx
je 0x18000b0c0
call qword [sym.imp.api_ms_win_shell_namespace_l1_1_0.dll_ILClone]
nop dword [rax + rax]
mov rdi, rax
neg rax
jmp 0x18000b0b6
mov r9d, dword [rcx + 8]
mov edx, 2
mov rcx, qword [rcx + 0x10]
mov r8d, edx
mov r10, rcx
cmp r9d, edx
jb 0x18000b1df
cmp word [r10], dx
jb 0x18000b089
movzx r11d, word [r10]
mov eax, r9d
sub eax, r8d
cmp r11d, eax
ja 0x18000b089
movzx eax, word [r10]
add r8d, r11d
add r10, rax
cmp r8d, r9d
jbe 0x18000b065
cmp r8d, r9d
ja 0x18000b1df
cmp di, word [r10]
jne 0x18000b1df
test rcx, rcx
je 0x18000b0c0
call qword [sym.imp.api_ms_win_shell_namespace_l1_1_0.dll_ILClone]
nop dword [rax + rax]
mov rcx, rax
mov rdi, rax
neg rcx
sbb ebx, ebx
not ebx
and ebx, 0x8007000e
mov qword [r14], rdi
jmp 0x18000b1df
mov rcx, qword [rcx + 8]
lea r8, [rbp + 0x38]
lea rdx, [0x18006ecf0]
mov rax, qword [rcx]
mov rax, qword [rax]
call qword [case.0x18004bf34.0]
test eax, eax
js 0x18000b1df
mov rcx, qword [rbp + 0x38]
lea rdx, [rbp + 0x30]
mov qword [rbp + 0x30], rdi
call qword [sym.imp.SHCORE.dll_IStream_Size]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x18000b1ad
mov ebx, r15d
cmp dword [rbp + 0x34], edi
jne 0x18000b1ad
mov r8d, dword [rbp + 0x30]
lea r9, [rbp + 0x40]
mov edx, 1
call fcn.18000d44c
mov ebx, eax
test eax, eax
js 0x18000b1ad
mov rsi, qword [rbp + 0x40]
mov r8d, dword [rbp + 0x30]
mov rdx, rsi
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.SHCORE.dll_IStream_Read]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x18000b19e
mov rax, qword [rbp + 0x30]
mov edx, 2
mov ebx, r15d
mov r9, rsi
mov r8d, edx
cmp eax, edx
jb 0x18000b19e
cmp word [r9], dx
jb 0x18000b18b
movzx r10d, word [r9]
mov ecx, eax
sub ecx, r8d
cmp r10d, ecx
ja 0x18000b18b
movzx ecx, word [r9]
add r8d, r10d
add r9, rcx
cmp r8d, eax
jbe 0x18000b168
cmp r8d, eax
ja 0x18000b19e
cmp di, word [r9]
jne 0x18000b19e
mov qword [r14], rsi
mov ebx, edi
mov rsi, rdi
mov rcx, rsi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x38]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x18004bf34.0]
jmp 0x18000b1df
mov rcx, qword [rcx + 8]
xor r9d, r9d
mov r8, r14
mov qword [rsp + 0x20], rdi
xor edx, edx
call qword [sym.imp.api_ms_win_shell_namespace_l1_1_0.dll_SHParseDisplayName]
nop dword [rax + rax]
mov ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret