Function at 0x1400010d0
Capabilities:
Get common file path
Patch process command line

Disassembly:
push rbp
pxor xmm0, xmm0
lea rcx, str.ntdll.dll
mov rbp, rsp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
and rsp, 0xfffffffffffffff0
sub rsp, 0x6d0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x140001230
mov rdi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
lea rdx, str.NtQueryInformationProcess
mov rcx, rax
call rdi
mov r12, rax
test rax, rax
je 0x140001230
lea rdx, str.RtlEnterCriticalSection
mov rcx, rsi
call rdi
mov r13, rax
test rax, rax
je 0x140001230
lea rdx, str.RtlLeaveCriticalSection
mov rcx, rsi
call rdi
mov rbx, rax
test rax, rax
je 0x140001230
lea rdx, str.RtlInitUnicodeString
mov rcx, rsi
call rdi
mov rdi, rax
test rax, rax
je 0x140001230
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov ecx, 0x438
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140001230
xor edx, edx
mov r9d, 0x30
lea r8, [rsp + 0x70]
mov rcx, rax
mov qword [rsp + 0x20], 0
call r12
lea rdx, [rsp + 0x78]
lea r8, [rsp + 0x50]
mov rcx, rsi
mov qword [rsp + 0x20], 0
mov r12, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r9d, 8
call r12
test eax, eax
je 0x140001230
mov rax, qword [rsp + 0x50]
mov r9d, 8
lea r8, [rsp + 0x58]
mov rcx, rsi
mov qword [rsp + 0x20], 0
lea rdx, [rax + 0x18]
call r12
test eax, eax
jne 0x140001248
nop word [rax + rax]
xor eax, eax
lea rsp, [rbp - 0x38]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea r15, [rsp + 0x2b0]
mov edx, 0x104
mov qword [rsp + 0x48], r15
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x140001230
lea r8, str.explorer.exe
mov edx, 0x105
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov rcx, r15
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
lea r14, [rax + 1]
lea rcx, [r14 + r14]
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov qword [rsp + 0x38], rax
test rax, rax
je 0x140001230
mov r8, r15
mov rdx, r14
mov rcx, rax
mov r14, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
mov rax, qword [rsp + 0x50]
lea r15, [rsp + 0x68]
mov rcx, qword [rax + 0x38]
call r13
mov rax, qword [rsp + 0x50]
mov rdx, r14
lea r13, [rsp + 0x4c0]
mov rcx, qword [rax + 0x20]
add rcx, 0x60
call rdi
mov rax, qword [rsp + 0x50]
mov rdx, r14
lea r14, [rsp + 0xa0]
mov rcx, qword [rax + 0x20]
add rcx, 0x70
call rdi
xor ecx, ecx
mov r8d, 0x104
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x30], rdi
mov rax, qword [rax + 0x18]
mov rcx, qword [rax + 0x10]
mov rax, qword [rsp + 0x58]
mov rax, qword [rax + 0x10]
mov rdi, rcx
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x60]
mov rbx, rax
jmp 0x14000139f
mov rax, qword [rsp + 0x60]
mov r8, r13
mov rcx, rsi
movzx r9d, word [rax + 0x4a]
mov rdx, qword [rax + 0x50]
mov qword [rsp + 0x20], 0
call r12
test eax, eax
je 0x140001230
mov rax, qword [rsp + 0x60]
xor edx, edx
mov rcx, r14
movzx eax, word [rax + 0x48]
shr ax, 1
movzx eax, ax
mov word [rsp + rax*2 + 0x4c0], dx
mov rdx, r13
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x1400013c7
mov rax, qword [rsp + 0x60]
mov rax, qword [rax]
mov qword [rsp + 0x68], rax
cmp rax, rdi
je 0x140001421
mov r9d, 8
mov r8, rbx
mov rdx, r15
mov rcx, rsi
mov qword [rsp + 0x20], 0
call r12
test eax, eax
jne 0x140001338
jmp 0x140001230
mov rax, qword [rsp + 0x60]
mov r14, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x30]
lea rcx, [rax + 0x48]
mov rdx, r14
call rdi
mov rax, qword [rsp + 0x60]
mov rdx, r14
lea rcx, [rax + 0x58]
call rdi
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x38]
call rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x48]
mov rdx, r13
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
setne al
movzx eax, al
jmp 0x140001232
mov rbx, qword [rsp + 0x40]
jmp 0x1400013f2