Function at 0x14009edf0
Capabilities:
Get common file path

Disassembly:
push rsi
push rbx
sub rsp, 0x38
xor r8d, r8d
lea rax, [rcx + 0x10]
mov esi, edx
mov edx, 0x1000
mov qword [rcx], rax
mov rbx, rcx
call fcn.14015c320
cmp esi, 0xe
ja case.0x14009ee26.0
lea rdx, [0x1401a2e80]
movsxd rax, dword [rdx + rsi*4]
add rax, rdx
jmp rax
mov rax, qword [rbx]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x802a
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
nop dword [rax + rax]
mov rcx, qword [rbx]
cmp byte [rcx], 0
jne 0x14009ee8e
xor r8d, r8d
mov edx, 0x1000
mov rcx, rbx
call fcn.14015df10
mov rax, qword [rbx]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8028
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x14009f150
mov rcx, qword [rbx]
call sub.msvcrt.dll_strlen
xor r8d, r8d
mov rcx, rbx
mov rdx, rax
call fcn.14015df10
mov rdx, qword [rbx + 8]
mov rax, qword [rbx]
cmp byte [rax + rdx - 1], 0x5c
je 0x14009eec8
mov dword [rsp + 0x20], 0x5c
mov r9d, 1
xor r8d, r8d
mov rcx, rbx
call fcn.14015cad0
mov rax, rbx
add rsp, 0x38
pop rbx
pop rsi
ret
mov rax, qword [rbx]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8010
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
jmp 0x14009ee50
mov rax, qword [rbx]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8005
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
jmp 0x14009ee50
mov rax, qword [rbx]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8027
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
jmp 0x14009ee50
mov rax, qword [rbx]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x800d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
jmp 0x14009ee50
mov rax, qword [rbx]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x800e
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
jmp 0x14009ee50
mov rax, qword [rbx]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8028
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
mov rcx, qword [rbx]
js 0x14009ee53
call sub.msvcrt.dll_strlen
xor r8d, r8d
mov rcx, rbx
mov rdx, rax
call fcn.14015df10
movabs rax, 0x3fffffffffffffff
sub rax, qword [rbx + 8]
cmp rax, 9
jbe 0x14009f19f
lea rdx, str.Downloads
mov r8d, 0xa
mov rcx, rbx
call fcn.14015ea30
mov rcx, qword [rbx]
call sub.msvcrt.dll__mkdir
jmp 0x14009f0e6
mov rax, qword [rbx]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x801a
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
jmp 0x14009ee50
mov rax, qword [rbx]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x801c
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
jmp 0x14009ee50
mov rax, qword [rbx]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8023
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
jmp 0x14009ee50
mov rax, qword [rbx]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8014
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
jmp 0x14009ee50
mov rax, qword [rbx]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x801c
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
mov rcx, qword [rbx]
js 0x14009ee53
call sub.msvcrt.dll_strlen
xor r8d, r8d
mov rcx, rbx
mov rdx, rax
call fcn.14015df10
movabs rax, 0x3fffffffffffffff
sub rax, qword [rbx + 8]
cmp rax, 0x17
jbe 0x14009f193
lea rdx, str.MicrosoftWindowsFonts
mov r8d, 0x18
mov rcx, rbx
call fcn.14015ea30
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14009f0fc
test al, 0x10
jne 0x14009ee50
mov rax, qword [rbx]
mov qword [rbx + 8], 0
mov byte [rax], 0
mov rcx, qword [rbx]
jmp 0x14009ee53
mov rdx, qword [rbx]
mov ecx, dword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
jmp 0x14009ee50
mov rax, qword [rbx]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8026
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
jmp 0x14009ee50
mov qword [rsp + 0x20], 2
mov r8, qword [rbx + 8]
lea r9, [0x1401a2e7b]
xor edx, edx
mov rcx, rbx
call fcn.14015c140
jmp 0x14009ee8b
mov rax, qword [rbx]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8028
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
jmp 0x14009ee50
lea rcx, [0x1401a2e42]
call fcn.140172f50
lea rcx, [0x1401a2e42]
call fcn.140172f50
mov rsi, rax
mov rcx, rbx
call fcn.14015c120
mov rcx, rsi
call fcn.1400c2350
nop
nop