Function at 0x180006390
Capabilities:
Get common file path
Terminate process

Disassembly:
mov r11, rsp
push rbp
lea rbp, [r11 - 0x898]
sub rsp, 0x990
mov rax, qword [0x18004c178]
xor rax, rsp
mov qword [rbp + 0x860], rax
mov qword [r11 - 0x10], rdi
xor edx, edx
mov qword [r11 - 0x18], r12
mov r8d, 0x208
mov qword [r11 - 0x20], r14
xor r12d, r12d
mov qword [r11 - 0x28], r15
mov r15, rcx
lea rcx, [rbp + 0x440]
mov qword [rsp + 0x50], r12
call fcn.180015430
xor edx, edx
lea rcx, [rbp + 0x650]
mov r8d, 0x208
call fcn.180015430
mov edi, 0x104
lea rcx, [rbp + 0x440]
mov edx, edi
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edx, edi
lea rcx, [rbp + 0x650]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edx, edi
lea rcx, [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ecx, edi
lea rax, [rbp + 0x30]
nop dword [rax + rax]
cmp word [rax], r12w
je 0x180006440
add rax, 2
sub rcx, 1
jne 0x180006430
mov r14d, 0x80070057
test rcx, rcx
mov edx, r14d
cmovne edx, r12d
je 0x18000645a
mov rax, rdi
sub rax, rcx
jmp 0x18000645d
mov rax, r12
test edx, edx
js 0x1800064b4
mov rdx, rdi
lea rcx, [rbp + 0x30]
lea rcx, [rcx + rax*2]
sub rdx, rax
je 0x1800064a5
add rax, 0x7ffffefa
lea r9, [0x1800435e4]
add rax, rdx
sub r9, rcx
test rax, rax
je 0x1800064a5
movzx r8d, word [r9 + rcx]
test r8w, r8w
je 0x1800064a5
mov word [rcx], r8w
dec rax
add rcx, 2
sub rdx, 1
jne 0x180006484
test rdx, rdx
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], r12w
mov rcx, rdi
lea rax, [rbp + 0x30]
nop dword [rax + rax]
cmp word [rax], r12w
je 0x1800064d0
add rax, 2
sub rcx, 1
jne 0x1800064c0
test rcx, rcx
mov edx, r14d
cmovne edx, r12d
je 0x1800064e4
mov rax, rdi
sub rax, rcx
jmp 0x1800064e7
mov rax, r12
test edx, edx
js 0x180006540
mov rdx, rdi
lea rcx, [rbp + 0x30]
lea rcx, [rcx + rax*2]
sub rdx, rax
je 0x180006531
add rax, 0x7ffffefa
lea r9, str.winver.exe
add rax, rdx
sub r9, rcx
nop
test rax, rax
je 0x180006531
movzx r8d, word [r9 + rcx]
test r8w, r8w
je 0x180006531
mov word [rcx], r8w
dec rax
add rcx, 2
sub rdx, 1
jne 0x180006510
test rdx, rdx
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], r12w
lea rax, [rsp + 0x60]
mov qword [rsp + 0x9b0], rsi
mov qword [rsp + 0x48], rax
lea rdx, [rbp + 0x30]
lea rax, [0x180043f60]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rcx, [rbp + 0x30]
lea rax, [rbp + 0x440]
mov qword [rsp + 0x20], rax
call fcn.180006110
test al, al
jne 0x180006588
mov esi, 0xc0000001
jmp 0x1800068ad
mov r9d, 8
mov qword [rsp + 0x9a8], rbx
mov rbx, qword [rsp + 0x60]
lea r8, [rsp + 0x50]
mov rcx, rbx
mov qword [rsp + 0x20], r12
lea edx, [r9 + 0x16]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov esi, eax
mov rcx, rbx
test eax, eax
jns 0x1800065d6
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
jmp 0x18000689f
mov rdx, qword [rsp + 0x50]
call qword [sym.imp.ntdll.dll_NtRemoveProcessDebug]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, [rbp + 0x650]
mov rdx, rdi
lea rax, [rbp + 0x30]
sub r8, rax
lea rcx, [rbp + 0x30]
nop word [rax + rax]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x180006643
movzx eax, word [r8 + rcx]
test ax, ax
je 0x180006643
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x180006620
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov rcx, rdi
mov word [rax], r12w
lea rax, [rbp + 0x30]
nop dword [rax]
cmp word [rax], r12w
je 0x180006670
add rax, 2
sub rcx, 1
jne 0x180006660
test rcx, rcx
mov edx, r14d
cmovne edx, r12d
je 0x180006684
mov rax, rdi
sub rax, rcx
jmp 0x180006687
mov rax, r12
test edx, edx
js 0x1800066e0
mov rdx, rdi
lea rcx, [rbp + 0x30]
lea rcx, [rcx + rax*2]
sub rdx, rax
je 0x1800066d1
add rax, 0x7ffffefa
lea r9, [0x18004369c]
add rax, rdx
sub r9, rcx
nop
test rax, rax
je 0x1800066d1
movzx r8d, word [rcx + r9]
test r8w, r8w
je 0x1800066d1
mov word [rcx], r8w
dec rax
add rcx, 2
sub rdx, 1
jne 0x1800066b0
test rdx, rdx
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], r12w
mov rcx, rdi
lea rax, [rbp + 0x30]
cmp word [rax], r12w
je 0x1800066f7
add rax, 2
sub rcx, 1
jne 0x1800066e7
test rcx, rcx
cmovne r14d, r12d
je 0x180006708
mov rax, rdi
sub rax, rcx
jmp 0x18000670b
mov rax, r12
test r14d, r14d
js 0x18000675e
lea rcx, [rbp + 0x30]
lea rcx, [rcx + rax*2]
sub rdi, rax
je 0x18000674f
add rax, 0x7ffffefa
lea r8, str.computerdefaults.exe
add rax, rdi
sub r8, rcx
test rax, rax
je 0x18000674f
movzx edx, word [rcx + r8]
test dx, dx
je 0x18000674f
mov word [rcx], dx
dec rax
add rcx, 2
sub rdi, 1
jne 0x180006730
test rdi, rdi
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], r12w
xor eax, eax
lea rdi, [rsp + 0x60]
mov ecx, 0x18
lea rdx, [rbp + 0x30]
rep stosb byte [rdi], al
lea rdi, [rbp - 0x80]
mov ecx, 0xb0
rep stosb byte [rdi], al
lea rax, [rsp + 0x60]
mov r8d, 1
mov qword [rsp + 0x48], rax
lea rcx, [rbp + 0x30]
lea rax, str.WinSta0Default
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x440]
mov qword [rsp + 0x20], rax
call fcn.180006110
test al, al
jne 0x1800067ba
mov esi, 0xc0000001
jmp 0x1800068a5
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntdll.dll_DbgUiSetThreadDebugObject]
or edx, 0xffffffff
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_WaitForDebugEvent]
test eax, eax
je 0x1800068a5
nop word [rax + rax]
cmp dword [rbp - 0x80], 3
jne 0x1800067ef
mov rdi, qword [rbp - 0x68]
test rdi, rdi
jne 0x180006817
mov edx, dword [rbp - 0x78]
mov r8d, 0x10002
mov ecx, dword [rbp - 0x7c]
call qword [sym.imp.KERNEL32.dll_ContinueDebugEvent]
or edx, 0xffffffff
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_WaitForDebugEvent]
test eax, eax
jne 0x1800067e0
jmp 0x1800068a5
or r8, 0xffffffffffffffff
mov dword [rsp + 0x30], r12d
or rdx, r8
mov dword [rsp + 0x28], r12d
lea r9, [rsp + 0x58]
mov qword [rsp + 0x58], r12
mov rcx, rdi
mov dword [rsp + 0x20], 0x1fffff
call qword [sym.imp.ntdll.dll_NtDuplicateObject]
mov esi, eax
test eax, eax
js 0x180006861
mov rcx, qword [rsp + 0x58]
mov rdx, r15
call fcn.180006900
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntdll.dll_NtClose]
xor ecx, ecx
call qword [sym.imp.ntdll.dll_DbgUiSetThreadDebugObject]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, rdi
mov qword [rsp + 0x50], r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x9a8]
mov rcx, qword [rsp + 0x50]
mov r15, qword [rsp + 0x970]
mov r14, qword [rsp + 0x978]
mov r12, qword [rsp + 0x980]
mov rdi, qword [rsp + 0x988]
test rcx, rcx
je 0x1800068dd
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, esi
mov rsi, qword [rsp + 0x9b0]
mov rcx, qword [rbp + 0x860]
xor rcx, rsp
call fcn.180011e00
add rsp, 0x990
pop rbp
ret