Function at 0x14001137f
Capabilities:
Contain obfuscated stackstrings
Get common file path

Disassembly:
jmp 0x1400134d0
push rbp
push rdi
sub rsp, 0x588
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xfa
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x558], rax
lea rcx, [0x1400280fb]
call fcn.140011497
nop
movzx eax, byte [0x1400221d8]
test eax, eax
je 0x140013520
mov al, 1
jmp 0x140013a95
mov qword [rbp + 0x268], 0
mov dword [rbp + 0x284], 0
lea r8, [rbp + 0x10]
lea rdx, [0x1400221dc]
lea rcx, [0x1400221c8]
call fcn.140011447
movzx eax, al
test eax, eax
jne 0x14001355a
xor al, al
jmp 0x140013a95
mov edx, 0x104
lea rcx, [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
nop
lea rdx, [0x14001eae0]
lea rcx, [rbp + 0x140]
call fcn.14001143d
nop
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x140]
call fcn.14001143d
nop
lea r8, [rbp + 0x284]
lea rdx, [rbp + 0x268]
lea rcx, [rbp + 0x140]
call fcn.14001105f
movzx eax, al
test eax, eax
je 0x1400135fe
lea r9, [0x1400221e0]
lea r8, [0x1400221d0]
mov edx, dword [rbp + 0x284]
mov rcx, qword [rbp + 0x268]
call fcn.14001124e
movzx eax, al
test eax, eax
je 0x1400135ee
mov rdx, qword [0x1400221c8]
mov rcx, qword [0x1400221d0]
call fcn.140011375
nop
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop
jmp 0x140013608
jmp 0x140013a56
cmp qword [0x1400221d0], 0
jne 0x14001361c
jmp 0x140013a56
mov rax, qword [0x1400221d0]
mov eax, dword [rax + 0x3c]
mov rcx, qword [0x1400221d0]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x2a8], rax
mov rax, qword [rbp + 0x2a8]
movzx eax, word [rax + 0x14]
mov rcx, qword [rbp + 0x2a8]
lea rax, [rcx + rax + 0x18]
mov qword [rbp + 0x2c8], rax
mov dword [rbp + 0x2e4], 0
jmp 0x140013672
mov eax, dword [rbp + 0x2e4]
inc eax
mov dword [rbp + 0x2e4], eax
mov rax, qword [rbp + 0x2a8]
movzx eax, word [rax + 6]
cmp dword [rbp + 0x2e4], eax
jae 0x14001398e
mov rax, qword [rbp + 0x2c8]
mov eax, dword [rax + 0x24]
and eax, 0x20000000
test eax, eax
je 0x140013977
mov rax, qword [rbp + 0x2c8]
mov eax, dword [rax + 0x24]
and eax, 0x2000000
test eax, eax
jne 0x140013977
mov dword [rbp + 0x304], 0
jmp 0x1400136d1
mov eax, dword [rbp + 0x304]
inc eax
mov dword [rbp + 0x304], eax
mov rax, qword [rbp + 0x2c8]
mov eax, dword [rax + 8]
sub eax, 0x100
cmp dword [rbp + 0x304], eax
jae 0x140013977
mov rax, qword [rbp + 0x2c8]
mov eax, dword [rax + 0xc]
add eax, dword [rbp + 0x304]
mov dword [rbp + 0x324], eax
mov byte [rbp + 0x348], 0x48
mov byte [rbp + 0x349], 0x8b
mov byte [rbp + 0x34a], 0x44
mov byte [rbp + 0x34b], 0x24
mov byte [rbp + 0x34c], 0x20
mov byte [rbp + 0x34d], 0x48
mov byte [rbp + 0x34e], 0x8b
mov byte [rbp + 0x34f], 0x4c
mov byte [rbp + 0x350], 0x24
mov byte [rbp + 0x351], 0x28
mov byte [rbp + 0x352], 0x48
mov byte [rbp + 0x353], 0x8b
mov byte [rbp + 0x354], 0x54
mov byte [rbp + 0x355], 0x24
mov byte [rbp + 0x356], 0x30
mov byte [rbp + 0x357], 0x4c
mov byte [rbp + 0x358], 0x8b
mov byte [rbp + 0x359], 0x44
mov byte [rbp + 0x35a], 0x24
mov byte [rbp + 0x35b], 0x38
mov byte [rbp + 0x35c], 0x4c
mov byte [rbp + 0x35d], 0x8b
mov byte [rbp + 0x35e], 0x4c
mov byte [rbp + 0x35f], 0x24
mov byte [rbp + 0x360], 0x40
mov byte [rbp + 0x361], 0x48
mov byte [rbp + 0x362], 0x83
mov byte [rbp + 0x363], 0xc4
mov byte [rbp + 0x364], 0x48
mov byte [rbp + 0x365], 0x48
mov byte [rbp + 0x366], 0xff
mov byte [rbp + 0x367], 0xe0
mov eax, dword [rbp + 0x324]
mov rcx, qword [0x1400221d0]
add rcx, rax
mov rax, rcx
mov r8d, 0x20
lea rdx, [rbp + 0x348]
mov rcx, rax
call fcn.140011136
movzx eax, al
test eax, eax
je 0x14001382b
mov eax, dword [rbp + 0x324]
mov rcx, qword [0x1400221c8]
add rcx, rax
mov rax, rcx
mov qword [0x1400221f0], rax
mov byte [rbp + 0x384], 0x48
mov byte [rbp + 0x385], 0x83
mov byte [rbp + 0x386], 0xc4
mov byte [rbp + 0x387], 0x68
mov byte [rbp + 0x388], 0xc3
mov eax, dword [rbp + 0x324]
mov rcx, qword [0x1400221d0]
add rcx, rax
mov rax, rcx
mov r8d, 5
lea rdx, [rbp + 0x384]
mov rcx, rax
call fcn.140011136
movzx eax, al
test eax, eax
je 0x140013897
mov eax, dword [rbp + 0x324]
mov rcx, qword [0x1400221c8]
add rcx, rax
mov rax, rcx
mov qword [0x1400221f8], rax
mov byte [rbp + 0x3a4], 0x59
mov byte [rbp + 0x3a5], 0xc3
mov eax, dword [rbp + 0x324]
mov rcx, qword [0x1400221d0]
add rcx, rax
mov rax, rcx
mov r8d, 2
lea rdx, [rbp + 0x3a4]
mov rcx, rax
call fcn.140011136
movzx eax, al
test eax, eax
je 0x1400138ee
mov eax, dword [rbp + 0x324]
mov rcx, qword [0x1400221c8]
add rcx, rax
mov rax, rcx
mov qword [0x140022200], rax
mov byte [rbp + 0x3c4], 0x48
mov byte [rbp + 0x3c5], 0x89
mov byte [rbp + 0x3c6], 1
mov byte [rbp + 0x3c7], 0xc3
mov eax, dword [rbp + 0x324]
mov rcx, qword [0x1400221d0]
add rcx, rax
mov rax, rcx
mov r8d, 4
lea rdx, [rbp + 0x3c4]
mov rcx, rax
call fcn.140011136
movzx eax, al
test eax, eax
je 0x140013972
mov eax, dword [rbp + 0x324]
mov rcx, qword [0x1400221c8]
add rcx, rax
mov rax, rcx
mov qword [0x140022208], rax
mov eax, dword [rbp + 0x324]
add eax, 3
mov eax, eax
mov rcx, qword [0x1400221c8]
add rcx, rax
mov rax, rcx
mov qword [0x140022210], rax
jmp 0x1400136c3
mov rax, qword [rbp + 0x2c8]
add rax, 0x28
mov qword [rbp + 0x2c8], rax
jmp 0x140013664
cmp qword [0x1400221f0], 0
je 0x1400139c0
cmp qword [0x1400221f8], 0
je 0x1400139c0
cmp qword [0x140022200], 0
je 0x1400139c0
cmp qword [0x140022208], 0
je 0x1400139c0
cmp qword [0x140022210], 0
jne 0x1400139ca
jmp 0x140013a56
mov rdx, qword [0x1400221f0]
lea rcx, str.___ROP1:__p_n
call fcn.1400111f9
nop
mov rdx, qword [0x1400221f8]
lea rcx, str.___ROP2:__p_n
call fcn.1400111f9
nop
mov rdx, qword [0x140022200]
lea rcx, str.___ROP3:__p_n
call fcn.1400111f9
nop
mov rdx, qword [0x140022208]
lea rcx, str.___ROP4:__p_n
call fcn.1400111f9
nop
mov rdx, qword [0x140022210]
lea rcx, str.___ROP5:__p_n
call fcn.1400111f9
nop
lea rcx, str.ZwTerminateThread
call fcn.140011244
mov qword [0x1400221e8], rax
cmp qword [0x1400221e8], 0
jne 0x140013a4f
jmp 0x140013a56
mov byte [0x1400221d8], 1
movzx eax, byte [0x1400221d8]
test eax, eax
jne 0x140013a8e
cmp qword [0x1400221d0], 0
je 0x140013a8e
mov rcx, qword [0x1400221d0]
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop
mov qword [0x1400221d0], 0
mov dword [0x1400221e0], 0
movzx eax, byte [0x1400221d8]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14001e550]
call fcn.14001140b
mov rax, rdi
mov rcx, qword [rbp + 0x558]
xor rcx, rbp
call fcn.140011212
lea rsp, [rbp + 0x568]
pop rdi
pop rbp
ret