Function at 0x14000f770
Capabilities:
Get common file path

Disassembly:
push rbp
push rsi
push r12
push r14
push r15
lea rbp, [rsp - 0x9c0]
sub rsp, 0xac0
mov rax, qword [0x140079010]
xor rax, rsp
mov qword [rbp + 0x9b0], rax
mov r15d, ecx
mov esi, r9d
mov rcx, qword [0x14007d0e8]
mov r12d, r8d
mov r14d, edx
test rcx, rcx
je 0x14000f7cb
xor edx, edx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
test eax, eax
je 0x14000f7c4
xor eax, eax
jmp 0x14000fbd0
mov rcx, qword [0x14007d0e8]
mov qword [rsp + 0xaf8], rbx
mov qword [rsp + 0xb00], rdi
test rcx, rcx
je 0x14000f7f9
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ResetEvent]
mov eax, esi
mov ecx, 0x20000
neg eax
sbb edx, edx
add edx, 2
call fcn.140010ce0
xor ebx, ebx
lea edi, [rbx + 1]
test r14d, r14d
je 0x14000faed
mov r14d, ebx
call fcn.14002b420
test eax, eax
jne 0x14000f901
mov ecx, dword [0x7ffe02d8]
cmp ecx, 0xffffffff
je 0x14000f901
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x60], rbx
call fcn.14003e070
test eax, eax
je 0x14000f901
xor edx, edx
lea rcx, [rbp + 0x190]
mov r8d, 0x208
call fcn.1400423d0
mov edx, 0x104
lea rcx, [rbp + 0x190]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x14000f880
lea r8, str.C:Windows
mov edx, 0x104
lea rcx, [rbp + 0x190]
call fcn.140044288
xor edx, edx
lea rcx, [rbp + 0x3a0]
mov r8d, 0x208
call fcn.1400423d0
movzx r9d, word [rbp + 0x190]
lea r8, str.powershell__Command__Suspend_BitLocker___C:___RebootCount_1_
mov edx, 0x104
lea rcx, [rbp + 0x3a0]
call fcn.14000a160
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x74]
mov dword [rsp + 0x38], 0x1388
lea r9, [rbp + 0x3a0]
mov qword [rsp + 0x30], rax
xor edx, edx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], edi
mov dword [rsp + 0x74], ebx
call fcn.14003cdb0
mov edx, eax
lea rcx, str.Suspend_BitLocker
mov r14d, eax
call fcn.14003f5e0
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test r14d, r14d
je 0x14000faed
mov dword [rsp + 0x70], ebx
mov ecx, dword [0x7ffe02d8]
cmp ecx, 0xffffffff
je 0x14000fac4
mov rax, qword [0x14007cba0]
mov r14d, ebx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x68], rbx
test rax, rax
je 0x14000fac4
lea rdx, [rsp + 0x68]
call rax
test eax, eax
je 0x14000f96d
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov r9d, edi
xor r8d, r8d
mov dword [rsp + 0x20], edi
mov edx, 0x2000000
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_DuplicateTokenEx]
mov r14d, eax
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14000f97d
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test r14d, r14d
je 0x14000fac4
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x50], rbx
call qword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
mov rcx, qword [rsp + 0x50]
test eax, eax
cmove rcx, rbx
mov qword [rsp + 0x50], rcx
call fcn.14003e200
xor edx, edx
lea rcx, [rbp - 0x80]
mov r8d, 0x208
call fcn.1400423d0
lea rax, str.AsusHotkey.exe
mov edx, 0x104
lea r9, [0x14007cbe0]
mov qword [rsp + 0x20], rax
lea r8, str.__s_s___BitLocker
lea rcx, [rbp - 0x80]
call fcn.14000a160
xor edx, edx
lea rcx, [rbp + 0x5b0]
mov r8d, 0x400
call fcn.1400423d0
mov edx, 0x104
lea rcx, [rbp - 0x80]
call fcn.14004d7f4
mov qword [rsp + 0x38], rbx
lea rcx, [rbp + 0x5b0]
mov qword [rsp + 0x30], rbx
lea r8, [rbp - 0x80]
mov dword [rsp + 0x28], 0x400
mov r9d, eax
mov qword [rsp + 0x20], rcx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_string_l1_1_0.dll_WideCharToMultiByte]
mov rcx, qword [0x140079b70]
lea rax, [0x140079b70]
cmp rcx, rax
je 0x14000fa7c
test byte [rcx + 0x1c], 4
je 0x14000fa7c
mov rcx, qword [rcx + 0x10]
lea rax, [rbp + 0x5b0]
mov qword [rsp + 0x28], rax
mov edx, 0x11
lea rax, str.LaunchBitLocker
mov qword [rsp + 0x20], rax
call fcn.14003f310
mov rdx, qword [rsp + 0x50]
lea rax, [rsp + 0x70]
mov rcx, qword [rsp + 0x58]
lea r9, [rbp - 0x80]
mov dword [rsp + 0x38], 0xffffffff
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], edi
call fcn.14003cdb0
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14000fab9
call qword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov edx, dword [rsp + 0x70]
lea rcx, str.LaunchBitLocker_result
call fcn.14003f5e0
test r12d, r12d
je 0x14000faed
cmp dword [rsp + 0x70], 0x140
jne 0x14000faed
mov edi, 2
jmp 0x14000fb72
test r15d, r15d
jne 0x14000fb0b
cmp dword [0x14007b3a4], ebx
je 0x14000fb0b
mov eax, dword [0x14007b3a0]
dec eax
cmp eax, edi
ja 0x14000fb0b
call fcn.140011190
mov rax, qword [0x14007d110]
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x14000fb5b
mov eax, ebx
mov dword [rsp + 0x48], 0x90026
cmp r15d, edi
mov dword [rsp + 0x40], 4
lea r9, [rsp + 0x78]
mov r8d, 8
sete al
lea rdx, [rsp + 0x48]
mov dword [rsp + 0x4c], eax
mov ecx, 0x53564544
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call fcn.140006780
mov edx, ebx
cmp r15d, edi
mov r8d, esi
sete dl
xor ecx, ecx
call fcn.14000fbf0
call fcn.1400316a0
mov rcx, qword [0x14007d0e8]
test rcx, rcx
je 0x14000fbbe
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
mov rcx, qword [0x14007d0e8]
test rcx, rcx
je 0x14000fba1
xor edx, edx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
test eax, eax
je 0x14000fba1
mov ebx, 0x10000
mov ecx, dword [0x14007b36c]
neg esi
sbb edx, edx
shl ecx, 8
or ecx, ebx
add edx, 2
or ecx, dword [0x14007b3a0]
call fcn.140010ce0
mov rbx, qword [rsp + 0xaf8]
mov eax, edi
mov rdi, qword [rsp + 0xb00]
mov rcx, qword [rbp + 0x9b0]
xor rcx, rsp
call fcn.1400406e0
add rsp, 0xac0
pop r15
pop r14
pop r12
pop rsi
pop rbp
ret