Function at 0x1400010a1
Capabilities:
Get common file path
Link many functions at runtime
Patch process command line

Disassembly:
push r15
lea rcx, str.ntdll.dll
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x6b8
and qword [rsp + 0x40], 0
and qword [rsp + 0x48], 0
and qword [rsp + 0x50], 0
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
jne 0x1400010df
xor eax, eax
jmp 0x140001361
xchg rbx, rax
mov rdi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtQueryInformationProcess
mov rcx, rbx
call rdi
xchg rsi, rax
test rsi, rsi
je 0x1400010d8
lea rdx, str.RtlEnterCriticalSection
mov rcx, rbx
call rdi
xchg r13, rax
test r13, r13
je 0x1400010d8
lea rdx, str.RtlLeaveCriticalSection
mov rcx, rbx
call rdi
xchg rbp, rax
test rbp, rbp
je 0x1400010d8
lea rdx, str.RtlInitUnicodeString
mov rcx, rbx
call rdi
xchg rdi, rax
test rdi, rdi
je 0x1400010d8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov ecx, 0x438
xchg r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xchg rbx, rax
cmp rbx, 0xffffffffffffffff
je 0x1400010d8
and qword [rsp + 0x20], 0
xor edx, edx
mov rcx, rbx
push 0x30
pop r9
lea r8, [rsp + 0x60]
call rsi
and qword [rsp + 0x20], 0
lea rdx, [rsp + 0x68]
mov rcx, rbx
push 8
pop r9
mov r12, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea r8, [rsp + 0x40]
call r12
test eax, eax
je 0x1400010d8
mov rax, qword [rsp + 0x40]
and qword [rsp + 0x20], 0
mov rcx, rbx
push 8
pop r9
lea rdx, [rax + 0x18]
lea r8, [rsp + 0x48]
call r12
test eax, eax
je 0x1400010d8
lea rax, [rsp + 0x29c]
mov edx, 0x104
mov qword [rsp + 0x30], rax
xchg rcx, rax
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x1400010d8
lea r8, str.explorer.exe
mov edx, 0x105
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov rcx, qword [rsp + 0x30]
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
lea r14, [rax + 1]
lea rcx, [r14 + r14]
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
xchg rsi, rax
test rsi, rsi
je 0x1400010d8
mov r8, qword [rsp + 0x30]
mov rdx, r14
mov rcx, rsi
lea r15, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x38]
call r13
mov rax, qword [rsp + 0x40]
mov rdx, rsi
lea r13, [rsp + 0x94]
mov rcx, qword [rax + 0x20]
add rcx, 0x60
call rdi
mov rax, qword [rsp + 0x40]
mov rdx, rsi
mov rcx, qword [rax + 0x20]
add rcx, 0x70
call rdi
mov r8d, 0x104
mov rdx, r13
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x18]
mov r14, qword [rax + 0x10]
mov rax, qword [rsp + 0x48]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x58], rax
and qword [rsp + 0x20], 0
lea rdx, [rsp + 0x58]
mov r8, r15
mov rcx, rbx
push 8
pop r9
call r12
test eax, eax
je 0x1400010d8
mov rax, qword [rsp + 0x50]
lea rdx, [rsp + 0x4a6]
mov rcx, rbx
mov qword [rsp + 0x38], rdx
mov r8, qword [rsp + 0x38]
movzx r9d, word [rax + 0x4a]
mov rdx, qword [rax + 0x50]
and qword [rsp + 0x20], 0
call r12
test eax, eax
je 0x1400010d8
mov rax, qword [rsp + 0x50]
mov rcx, r13
mov rdx, qword [rsp + 0x38]
movzx eax, word [rax + 0x48]
shr rax, 1
and word [rsp + rax*2 + 0x4a6], 0
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
mov rcx, qword [rsp + 0x50]
test eax, eax
jne 0x140001324
add rcx, 0x48
mov rdx, rsi
call rdi
mov rax, qword [rsp + 0x50]
mov rdx, rsi
lea rcx, [rax + 0x58]
call rdi
jmp 0x140001335
mov rax, qword [rcx]
mov qword [rsp + 0x58], rax
cmp rax, r14
jne 0x14000128b
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x38]
call rbp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
setne al
movzx eax, al
add rsp, 0x6b8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret