Function at 0x1400084e4
Capabilities:
Get common file path
Set current directory

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r9
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xba8]
sub rsp, 0xc80
mov r12, rcx
mov r15d, edx
lea rcx, str.consent.exe
xor ebx, ebx
mov r14d, 0xc0000022
call fcn.140001f50
cmp rax, 0x104
jbe 0x14000853a
mov eax, 0xc00000f1
jmp 0x1400087be
xor r9d, r9d
lea r8, str.MpThreatOpen
mov edx, r15d
mov rcx, r12
call fcn.14000defc
test eax, eax
je 0x1400087bb
mov edx, 0x410
lea rcx, [rbp + 0x770]
call fcn.140001ae8
lea rcx, [rsp + 0x50]
call fcn.140001ae8
lea rcx, [rbp + 0xbc8]
mov qword [rbp + 0xbc8], 0xfffe
xor r9d, r9d
mov edx, 0x3000
call fcn.14000c7e4
mov rsi, rax
test rax, rax
je 0x1400087bb
lea rax, str.microsoft.windows.common_controls
mov qword [rsp + 0x40], rsi
lea r13, str.comctl32.dll
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], r13
call fcn.14000d434
test eax, eax
je 0x1400087a6
mov rcx, rsi
call fcn.140001c94
mov rdi, rax
test rax, rax
je 0x1400087a6
mov rcx, rax
call fcn.140001f50
xor r9d, r9d
lea rcx, [rbp + 0xbc8]
mov edx, 0x3000
lea rax, [rax*2 + 0x1000]
mov qword [rbp + 0xbc8], rax
call fcn.14000c7e4
mov rbx, rax
test rax, rax
je 0x1400087a6
mov rdx, qword [0x14002ea50]
mov rcx, rax
add rdx, 0x272
call fcn.140001ee0
lea rdx, str.consent.exe
lea rcx, [rsp + 0x50]
call fcn.140001ee0
lea rdx, [0x140027024]
lea rcx, [rsp + 0x50]
call fcn.140001d68
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.140009b8c
test eax, eax
je 0x1400087a6
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.140001d68
mov rdx, rdi
mov rcx, rbx
call fcn.140009b8c
test eax, eax
je 0x1400087a6
lea rdx, [0x1400265c0]
mov rcx, rbx
call fcn.140001d68
mov rdx, rdi
mov rcx, rbx
call fcn.140001d68
mov rcx, rbx
lea r9, str.D:_A__GA___WD_
call fcn.140009fe0
test eax, eax
je 0x1400087a6
lea rdx, [rbp + 0x360]
mov ecx, 0x208
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov r8d, r15d
mov rdx, r12
mov rcx, r13
call fcn.14000c9c8
test eax, eax
je 0x1400087a6
lea rcx, [rbp + 0x360]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov rdx, qword [0x14002ea50]
mov rcx, rbx
add rdx, 0x272
call fcn.140001ee0
lea rdx, str.consent.exe
call fcn.140001d68
lea rdx, [0x140027024]
mov rcx, rbx
call fcn.140001d68
lea rdx, str.consent.exe
lea rcx, [rsp + 0x50]
call fcn.140001ee0
lea rdx, str..local
lea rcx, [rsp + 0x50]
call fcn.140001d68
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.140009a7c
test eax, eax
je 0x1400087a6
mov rdx, qword [0x14002ea50]
lea rcx, [rsp + 0x50]
add rdx, 0x272
call fcn.140001ee0
lea rdx, str.msconfig.exe
lea rcx, [rsp + 0x50]
call fcn.140001d68
xor r8d, r8d
mov dword [rsp + 0x20], 0x3e8
xor edx, edx
lea rcx, [rsp + 0x50]
mov r9d, 1
call fcn.14000cefc
neg eax
sbb ecx, ecx
not ecx
and r14d, ecx
mov rcx, rsi
call fcn.14000c85c
test rbx, rbx
je 0x1400087bb
mov rcx, rbx
call fcn.14000c85c
mov eax, r14d
lea r11, [rsp + 0xc80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret