Function at 0x14000df80
Capabilities:
Contain obfuscated stackstrings
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x200]
sub rsp, 0x300
mov rax, qword [0x140064010]
xor rax, rsp
mov qword [rbp + 0x1f0], rax
mov rsi, rcx
mov qword [rbp - 0x18], rcx
xor r15d, r15d
mov edx, 0x100
lea rcx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea edx, [r15 + 4]
mov dword [rsp + 0x30], 0x580004
mov dword [rsp + 0x34], 0x6b0057
mov dword [rsp + 0x38], 0x700062
mov dword [rsp + 0x3c], 0x650073
mov dword [rsp + 0x40], 0x610076
mov dword [rsp + 0x44], 0x6d0040
mov dword [rsp + 0x48], 0x700077
mov dword [rsp + 0x4c], 0x6d0076
mov dword [rsp + 0x50], 0x710066
mov dword [rsp + 0x54], 0x6d0070
mov dword [rsp + 0x58], 0x6a006b
mov dword [rsp + 0x5c], 0x400058
mov dword [rsp + 0x60], 0x73006b
mov dword [rsp + 0x64], 0x68006a
mov dword [rsp + 0x68], 0x65006b
mov dword [rsp + 0x6c], 0x580060
mov word [rsp + 0x70], dx
movzx eax, word [str.runas]
xor ax, dx
mov word [rsp + 0x72], ax
movzx eax, word [0x1400542a2]
xor ax, dx
mov word [rsp + 0x74], ax
movzx eax, word [0x1400542a4]
xor ax, dx
mov word [rsp + 0x76], ax
movzx eax, word [0x1400542a6]
xor ax, dx
mov word [rsp + 0x78], ax
movzx eax, word [0x1400542a8]
xor ax, dx
mov word [rsp + 0x7a], ax
movzx eax, word [0x1400542aa]
xor ax, dx
mov word [rsp + 0x7c], ax
movzx eax, word [0x1400542ac]
xor ax, dx
mov word [rsp + 0x7e], ax
movzx eax, word [0x1400542ae]
xor ax, dx
mov word [rbp - 0x80], ax
movzx eax, word [0x1400542b0]
xor ax, dx
mov word [rbp - 0x7e], ax
movzx eax, word [0x1400542b2]
xor ax, dx
mov word [rbp - 0x7c], ax
movzx eax, word [0x1400542b4]
xor ax, dx
mov word [rbp - 0x7a], ax
movzx eax, word [0x1400542b6]
xor ax, dx
mov word [rbp - 0x78], ax
movzx eax, word [0x1400542b8]
xor ax, dx
mov word [rbp - 0x76], ax
movzx eax, word [0x1400542ba]
xor ax, dx
mov word [rbp - 0x74], ax
movzx eax, word [0x1400542bc]
xor ax, dx
mov word [rbp - 0x72], ax
movzx eax, word [0x1400542be]
xor ax, dx
mov word [rbp - 0x70], ax
movzx eax, word [str..exe]
xor ax, dx
mov word [rbp - 0x6e], ax
movzx eax, word [0x1400542c2]
xor ax, dx
mov word [rbp - 0x6c], ax
movzx eax, word [0x1400542c4]
xor ax, dx
mov word [rbp - 0x6a], ax
movzx eax, word [0x1400542c6]
xor ax, dx
mov word [rbp - 0x68], ax
movzx eax, word [0x1400542c8]
xor ax, dx
mov word [rbp - 0x66], ax
movzx eax, word [0x1400542ca]
xor ax, dx
mov word [rbp - 0x64], ax
movzx eax, word [0x1400542cc]
xor ax, dx
mov word [rbp - 0x62], ax
movzx eax, word [0x1400542ce]
xor ax, dx
mov word [rbp - 0x60], ax
movzx eax, word [str.___mdl]
xor ax, dx
mov word [rbp - 0x5e], ax
movzx eax, word [0x1400542d2]
xor ax, dx
mov word [rbp - 0x5c], ax
movzx eax, word [0x1400542d4]
xor ax, dx
mov word [rbp - 0x5a], ax
movzx eax, word [0x1400542d6]
xor ax, dx
mov word [rbp - 0x58], ax
movzx eax, word [0x1400542d8]
xor ax, dx
mov word [rbp - 0x56], ax
movzx eax, word [0x1400542da]
xor ax, dx
mov word [rbp - 0x54], ax
movzx eax, word [0x1400542dc]
xor ax, dx
mov word [rbp - 0x52], ax
xor eax, eax
mov word [rbp - 0x50], ax
mov ecx, r15d
nop dword [rax + rax]
xor word [rsp + rcx*2 + 0x32], dx
movzx eax, word [rsp + 0x30]
xor word [rsp + rcx*2 + 0x34], ax
movzx eax, word [rsp + 0x30]
xor word [rsp + rcx*2 + 0x36], ax
movzx eax, word [rsp + 0x30]
xor word [rsp + rcx*2 + 0x38], ax
movzx eax, word [rsp + 0x30]
xor word [rsp + rcx*2 + 0x3a], ax
movzx eax, word [rsp + 0x30]
xor word [rsp + rcx*2 + 0x3c], ax
movzx eax, word [rsp + 0x30]
xor word [rsp + rcx*2 + 0x3e], ax
movzx eax, word [rsp + 0x30]
xor word [rsp + rcx*2 + 0x40], ax
movzx eax, word [rsp + 0x30]
xor word [rsp + rcx*2 + 0x42], ax
movzx eax, word [rsp + 0x30]
xor word [rsp + rcx*2 + 0x44], ax
movzx eax, word [rsp + 0x30]
xor word [rsp + rcx*2 + 0x46], ax
movzx eax, word [rsp + 0x30]
xor word [rsp + rcx*2 + 0x48], ax
movzx eax, word [rsp + 0x30]
xor word [rsp + rcx*2 + 0x4a], ax
movzx eax, word [rsp + 0x30]
xor word [rsp + rcx*2 + 0x4c], ax
movzx eax, word [rsp + 0x30]
xor word [rsp + rcx*2 + 0x4e], ax
movzx eax, word [rsp + 0x30]
xor word [rsp + rcx*2 + 0x50], ax
movzx eax, word [rsp + 0x30]
xor word [rsp + rcx*2 + 0x52], ax
movzx eax, word [rsp + 0x30]
xor word [rsp + rcx*2 + 0x54], ax
movzx eax, word [rsp + 0x30]
xor word [rsp + rcx*2 + 0x56], ax
movzx eax, word [rsp + 0x30]
xor word [rsp + rcx*2 + 0x58], ax
movzx eax, word [rsp + 0x30]
xor word [rsp + rcx*2 + 0x5a], ax
add rcx, 0x15
cmp rcx, 0x3f
jae 0x14000e301
movzx edx, word [rsp + 0x30]
jmp 0x14000e220
mov word [rbp - 0x50], r15w
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x30], xmm1
lea rax, [rbp - 0x10]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp word [rax + r8*2], r15w
jne 0x14000e323
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x40]
call fcn.140012770
nop
lea rax, [rsp + 0x32]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x14000e340
mov r14, qword [rbp - 0x30]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
sub rax, r14
cmp rbx, rax
ja 0x14000e393
lea rax, [r14 + rbx]
mov qword [rbp - 0x30], rax
lea rdi, [rbp - 0x40]
cmp rcx, 8
cmovae rdi, qword [rbp - 0x40]
lea rcx, [rdi + r14*2]
lea r8, [rbx + rbx]
lea rdx, [rsp + 0x32]
call sub.VCRUNTIME140.dll_memcpy
lea rax, [r14 + rbx]
mov word [rdi + rax*2], r15w
lea rax, [rbp - 0x40]
jmp 0x14000e3a9
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x32]
mov rdx, rbx
lea rcx, [rbp - 0x40]
call fcn.140012fe0
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], r15
movups xmm0, xmmword [rax]
movups xmmword [rsi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsi + 0x10], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x14000e418
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e413
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000e413
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140050d90
mov rax, rsi
mov rcx, qword [rbp + 0x1f0]
xor rcx, rsp
call fcn.1400505b0
lea r11, [rsp + 0x300]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret