Function at 0x140001000
Capabilities:
Get common file path
Terminate process

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
mov eax, 0x10510
call fcn.140029f00
sub rsp, rax
mov dword [0x140066348], 0x19721972
mov dword [0x140066350], 0x19721972
mov dword [0x140066354], 0x19721972
mov ecx, dword [0x140066348]
call fcn.14001a160
test eax, eax
jne 0x140001057
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
xor eax, eax
mov word [rsp + 0x40], ax
lea rax, [rsp + 0x42]
mov rdi, rax
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
mov r8d, 0x104
lea rdx, [rsp + 0x40]
xor ecx, ecx
call qword [0x140071dd8]
test eax, eax
jne 0x14000108e
xor ecx, ecx
call qword [0x140071de0]
call fcn.14000a490
call qword [0x140071d78]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x400], 0x18
mov qword [rsp + 0x408], 0
mov dword [rsp + 0x410], 1
lea r8, str.027D1938_A43A_436D_88ED_5DDB70705748
xor edx, edx
lea rcx, [rsp + 0x400]
call qword [0x140071d80]
mov qword [0x140070050], rax
cmp qword [0x140070050], 0
jne 0x1400010f0
xor ecx, ecx
call qword [0x140071de0]
cmp dword [0x140066360], 0
jne 0x140001107
cmp dword [0x140067928], 1
jne 0x140001107
call fcn.140012690
cmp dword [0x140066360], 0
jne 0x1400011b3
call fcn.14000c0e0
cmp eax, 1
jne 0x1400011b3
lea r8, str.3B955F18_E12C_4E5B_9652_A01B9F710DE3
xor edx, edx
mov ecx, 0x100002
call qword [sym.imp.KERNEL32.dll_OpenEventW]
mov qword [0x140070048], rax
cmp qword [0x140070048], 0
jne 0x14000114f
xor ecx, ecx
call qword [0x140071e40]
mov qword [rsp + 0x4a0], 0
lea r8, str.F2395B66_12D2_4B13_8959_EC6193D3149F
xor edx, edx
mov ecx, 0x100002
call qword [0x140071e30]
mov qword [rsp + 0x4a0], rax
cmp qword [rsp + 0x4a0], 0
jne 0x14000118a
xor ecx, ecx
call qword [0x140071e40]
mov rcx, qword [rsp + 0x4a0]
call qword [0x140071e38]
mov rcx, qword [rsp + 0x4a0]
call qword [0x140071d98]
call fcn.14001ef50
xor ecx, ecx
call qword [0x140071e40]
call fcn.140011970
test eax, eax
jne 0x1400011c4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov qword [rsp + 0x468], 0
lea r8, str.D7FB3612_3E61_4B58_972C_83FF8C77E8EE
xor edx, edx
mov ecx, 0x100000
call qword [0x140071d68]
mov qword [rsp + 0x468], rax
cmp qword [rsp + 0x468], 0
je 0x14000120d
mov rcx, qword [rsp + 0x468]
call qword [0x140071d98]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea r8, str.D7FB3612_3E61_4B58_972C_83FF8C77E8EE
mov edx, 1
xor ecx, ecx
call qword [0x140071d80]
test rax, rax
jne 0x14000122e
xor ecx, ecx
call qword [0x140071de0]
cmp dword [0x140066360], 0
jne 0x140001273
cmp dword [0x140067930], 1
jne 0x140001273
cmp dword [0x140071ba8], 0
jne 0x140001273
call fcn.14001f720
test eax, eax
jne 0x140001273
call fcn.14001ff80
cmp eax, 0xa
jb 0x140001273
lea rcx, [rsp + 0x40]
call fcn.140001d40
cmp eax, 1
jne 0x140001273
xor ecx, ecx
call qword [0x140071de0]
cmp dword [0x140066364], 1
jne 0x1400012d9
cmp dword [0x140071bac], 0
jne 0x1400012d9
call fcn.14001ff80
cmp eax, 0xa
jb 0x1400012d9
call fcn.14001f720
cmp eax, 1
jne 0x1400012d9
lea rdx, [0x14006636c]
mov ecx, dword [0x140066368]
call fcn.140018ba0
mov qword [rsp + 0x4a8], rax
cmp qword [rsp + 0x4a8], 0
je 0x1400012d9
mov rcx, qword [rsp + 0x4a8]
call fcn.1400190c0
mov rcx, qword [rsp + 0x4a8]
call qword [0x140071dc0]
lea r8, str.DFEFA7FF_6DF4_4E2B_9377_0D86841D25BE
mov edx, 1
xor ecx, ecx
call qword [0x140071d80]
mov qword [rsp + 0x428], rax
cmp qword [rsp + 0x428], 0
jne 0x14000130b
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call qword [0x140071e68]
cmp eax, 0xb7
jne 0x140001323
mov ecx, 0xffffffff
call qword [0x140071de0]
lea r8, str.654BFB77_6041_4A1F_8FA9_2EDC607ECF00
mov edx, 1
xor ecx, ecx
call qword [0x140071d80]
mov qword [rsp + 0x418], rax
cmp qword [rsp + 0x418], 0
jne 0x140001352
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rcx, str.654BFB77_6041_4A1F_8FA9_2EDC607ECF00
call fcn.14001fbe0
lea r9, str.3B955F18_E12C_4E5B_9652_A01B9F710DE3
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call qword [0x140071dc8]
mov qword [0x140070048], rax
cmp qword [0x140070048], 0
jne 0x140001391
mov ecx, 0xffffffff
call qword [0x140071de0]
call qword [0x140071e68]
cmp eax, 0xb7
jne 0x1400013a6
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rcx, str.3B955F18_E12C_4E5B_9652_A01B9F710DE3
call fcn.14001fbe0
cmp dword [0x140066360], 0
jne 0x1400015bb
cmp dword [0x140065f38], 1
jne 0x1400015bb
mov r8d, 0x7fff
lea rdx, [rsp + 0x4b0]
xor ecx, ecx
call qword [0x140071dd8]
test eax, eax
je 0x1400015b3
mov dx, 0x5c
lea rcx, [rsp + 0x4b0]
call fcn.140001d10
xor ecx, ecx
mov word [rax], cx
lea rdx, [rsp + 0x104b0]
lea rcx, [0x140065c70]
call fcn.140012830
mov qword [rsp + 0x104b8], rax
cmp qword [rsp + 0x104b8], 0
je 0x1400015a9
mov dx, 0x5c
mov rcx, qword [rsp + 0x104b8]
call fcn.140001d10
xor ecx, ecx
mov word [rax], cx
mov edx, 0xfffe
mov ecx, 0x40
call qword [0x140071da8]
mov qword [rsp + 0x104c0], rax
cmp qword [rsp + 0x104c0], 0
je 0x140001599
mov rdx, qword [rsp + 0x104c0]
mov ecx, 0x7fff
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x140001583
mov dx, 0x5c
mov rcx, qword [rsp + 0x104c0]
call fcn.140001d10
xor ecx, ecx
mov word [rax], cx
mov rdx, qword [rsp + 0x104b8]
lea rcx, [rsp + 0x4b0]
call qword [0x140072070]
test eax, eax
je 0x140001581
mov rdx, qword [rsp + 0x104c0]
lea rcx, [rsp + 0x4b0]
call qword [0x140072070]
test eax, eax
je 0x140001581
call qword [0x140071d70]
mov qword [rsp + 0x104d8], rax
lea rdx, [rsp + 0x104c8]
mov rcx, qword [rsp + 0x104d8]
call qword [0x140072538]
mov qword [rsp + 0x104d0], rax
lea rdx, str.8A0F9EC8_E65E_4ABF_8EAB_5F91A92375AF
mov rax, qword [rsp + 0x104d0]
mov rcx, qword [rax + 8]
call qword [0x140072070]
test eax, eax
je 0x140001581
lea rdx, str.947DD332_7076_4F02_86B5_747282A760B8
mov rax, qword [rsp + 0x104d0]
mov rcx, qword [rax + 8]
call qword [0x140072070]
test eax, eax
je 0x140001581
lea rdx, str.96DBB05D_6BF8_4C4F_BFB5_9FD280B4931C
mov rax, qword [rsp + 0x104d0]
mov rcx, qword [rax + 8]
call qword [0x140072070]
test eax, eax
je 0x140001581
mov r9d, 1
lea r8, [0x140065f3c]
lea rdx, [0x140066006]
xor ecx, ecx
call qword [0x1400720d8]
cmp eax, 2
jne 0x140001581
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x14000158b
xor ecx, ecx
call qword [0x140071de0]
mov rcx, qword [rsp + 0x104c0]
call qword [0x140071dc0]
mov rcx, qword [rsp + 0x104b8]
call qword [0x140071dc0]
jmp 0x1400015b1
xor ecx, ecx
call qword [0x140071de0]
jmp 0x1400015bb
xor ecx, ecx
call qword [0x140071de0]
lea rdx, [rsp + 0x260]
mov cx, 2
call qword [0x1400726b0]
test eax, eax
je 0x1400015d9
xor ecx, ecx
call qword [0x140071de0]
cmp dword [0x140066360], 0
jne 0x1400015f6
call fcn.140011950
test eax, eax
jne 0x1400015f6
mov ecx, 0xffffffff
call qword [0x140071de0]
call fcn.140024cc0
test eax, eax
jne 0x140001607
xor ecx, ecx
call qword [0x140071de0]
call fcn.14000bc30
test eax, eax
jne 0x140001618
xor ecx, ecx
call qword [0x140071de0]
cmp dword [0x140066360], 0
jne 0x140001632
call fcn.14000be60
test eax, eax
jne 0x140001632
xor ecx, ecx
call qword [0x140071de0]
call fcn.14000a5c0
cmp dword [0x140066360], 0
jne 0x140001661
cmp dword [0x140066270], 0
jne 0x140001661
lea rcx, [0x140065c70]
call fcn.140011f10
test eax, eax
jne 0x140001661
xor ecx, ecx
call qword [0x140071de0]
lea rcx, [0x140065c70]
call fcn.140012980
test eax, eax
jne 0x140001679
xor ecx, ecx
call qword [0x140071de0]
cmp dword [0x140066360], 0
jne 0x1400016a6
cmp dword [0x140066270], 0
jne 0x1400016a6
cmp dword [0x14006791c], 1
jne 0x1400016a6
call fcn.1400147d0
cmp eax, 1
jne 0x1400016a6
xor ecx, ecx
call qword [0x140071de0]
cmp dword [0x1400659b8], 1
jne 0x1400016be
call fcn.14001ef50
jmp 0x140001cdf
mov edx, 0xfffe
mov ecx, 0x40
call qword [0x140071da8]
mov qword [rsp + 0x258], rax
cmp qword [rsp + 0x258], 0
jne 0x1400016e9
xor ecx, ecx
call qword [0x140071de0]
mov edx, 0x7fff
mov rcx, qword [rsp + 0x258]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x140001708
xor ecx, ecx
call qword [0x140071de0]
mov edx, 0xfffe
mov ecx, 0x40
call qword [0x140071da8]
mov qword [rsp + 0x250], rax
cmp qword [rsp + 0x250], 0
jne 0x140001733
xor ecx, ecx
call qword [0x140071de0]
mov edx, 0x7fff
mov rcx, qword [rsp + 0x250]
call qword [0x140071ea0]
test eax, eax
jne 0x140001752
xor ecx, ecx
call qword [0x140071de0]
mov edx, 0xfffe
mov ecx, 0x40
call qword [0x140071da8]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x140001777
xor ecx, ecx
call qword [0x140071de0]
mov r9, qword [rsp + 0x258]
lea r8, [0x1400394d0]
mov edx, 0x7fff
mov rcx, qword [rsp + 0x28]
call fcn.140029e0c
mov edx, 0xfffe
mov ecx, 0x40
call qword [0x140071da8]
mov qword [rsp + 0x460], rax
cmp qword [rsp + 0x460], 0
jne 0x1400017c0
xor ecx, ecx
call qword [0x140071de0]
mov r9, qword [rsp + 0x250]
lea r8, [0x1400394f0]
mov edx, 0x7fff
mov rcx, qword [rsp + 0x460]
call fcn.140029e0c
mov edx, 0xfffe
mov ecx, 0x40
call qword [0x140071da8]
mov qword [rsp + 0x430], rax
cmp qword [rsp + 0x430], 0
jne 0x14000180c
xor ecx, ecx
call qword [0x140071de0]
mov r9, qword [rsp + 0x250]
lea r8, [0x140039510]
mov edx, 0x7fff
mov rcx, qword [rsp + 0x430]
call fcn.140029e0c
mov dword [rsp + 0x420], 0
mov qword [rsp + 0x488], 0
lea rax, [rsp + 0x490]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov dword [rsp + 0x450], 0
lea rax, [rsp + 0x454]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
mov dword [rsp + 0x478], 0
lea rax, [rsp + 0x47c]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
cmp dword [0x1400659c0], 1
jne 0x1400018ea
movsxd rax, dword [rsp + 0x420]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + rax*8 + 0x488], rcx
movsxd rax, dword [rsp + 0x420]
mov dword [rsp + rax*4 + 0x450], 0
movsxd rax, dword [rsp + 0x420]
mov dword [rsp + rax*4 + 0x478], 1
mov eax, dword [rsp + 0x420]
inc eax
mov dword [rsp + 0x420], eax
cmp dword [0x1400659bc], 1
jne 0x140001941
movsxd rax, dword [rsp + 0x420]
mov rcx, qword [rsp + 0x460]
mov qword [rsp + rax*8 + 0x488], rcx
movsxd rax, dword [rsp + 0x420]
mov dword [rsp + rax*4 + 0x450], 1
movsxd rax, dword [rsp + 0x420]
mov dword [rsp + rax*4 + 0x478], 1
mov eax, dword [rsp + 0x420]
inc eax
mov dword [rsp + 0x420], eax
cmp dword [0x1400659c4], 1
jne 0x140001998
movsxd rax, dword [rsp + 0x420]
mov rcx, qword [rsp + 0x430]
mov qword [rsp + rax*8 + 0x488], rcx
movsxd rax, dword [rsp + 0x420]
mov dword [rsp + rax*4 + 0x450], 2
movsxd rax, dword [rsp + 0x420]
mov dword [rsp + rax*4 + 0x478], 1
mov eax, dword [rsp + 0x420]
inc eax
mov dword [rsp + 0x420], eax
mov eax, dword [rsp + 0x420]
mov dword [rsp + 0x470], eax
mov dword [rsp + 0x20], 1
cmp dword [rsp + 0x20], 0
je 0x140001cdf
mov dword [rsp + 0x104e0], 0
jmp 0x1400019d6
mov eax, dword [rsp + 0x104e0]
inc eax
mov dword [rsp + 0x104e0], eax
mov eax, dword [rsp + 0x470]
cmp dword [rsp + 0x104e0], eax
jge 0x140001cda
movsxd rax, dword [rsp + 0x104e0]
movsxd rcx, dword [rsp + 0x104e0]
lea r8, [rsp + 0x438]
mov edx, dword [rsp + rax*4 + 0x478]
mov rcx, qword [rsp + rcx*8 + 0x488]
call fcn.140012b70
cmp eax, 1
jne 0x140001cca
cmp dword [0x140066270], 1
jne 0x140001be0
movsxd rax, dword [rsp + 0x104e0]
cmp dword [rsp + rax*4 + 0x450], 1
jne 0x140001aba
xor edx, edx
mov rcx, qword [rsp + 0x438]
call qword [0x140071de8]
cmp eax, 0x102
jne 0x140001aba
lea r8, str.E1594BED_5477_472E_8061_D98657553F44
xor edx, edx
mov ecx, 0x100000
call qword [0x140071d68]
mov qword [rsp + 0x104f8], rax
cmp qword [rsp + 0x104f8], 0
jne 0x140001aa1
mov edx, 0xa
mov rcx, qword [0x140070048]
call qword [0x140071de8]
cmp eax, 0x102
je 0x140001a9f
jmp 0x140001cdf
jmp 0x140001a3e
cmp qword [rsp + 0x104f8], 0
je 0x140001aba
mov rcx, qword [rsp + 0x104f8]
call qword [0x140071d98]
movsxd rax, dword [rsp + 0x104e0]
cmp dword [rsp + rax*4 + 0x450], 0
jne 0x140001b48
xor edx, edx
mov rcx, qword [rsp + 0x438]
call qword [0x140071de8]
cmp eax, 0x102
jne 0x140001b48
lea r8, str.2523EFAC_9FBD_4039_9CCC_06B89B988E80
xor edx, edx
mov ecx, 0x100000
call qword [0x140071d68]
mov qword [rsp + 0x10500], rax
cmp qword [rsp + 0x10500], 0
jne 0x140001b2f
mov edx, 0xa
mov rcx, qword [0x140070048]
call qword [0x140071de8]
cmp eax, 0x102
je 0x140001b2d
jmp 0x140001cdf
jmp 0x140001acc
cmp qword [rsp + 0x10500], 0
je 0x140001b48
mov rcx, qword [rsp + 0x10500]
call qword [0x140071d98]
movsxd rax, dword [rsp + 0x104e0]
cmp dword [rsp + rax*4 + 0x450], 2
jne 0x140001bd6
xor edx, edx
mov rcx, qword [rsp + 0x438]
call qword [0x140071de8]
cmp eax, 0x102
jne 0x140001bd6
lea r8, str.D01813F0_4B7D_4297_BFB3_CFFAD4466EF1
xor edx, edx
mov ecx, 0x100000
call qword [0x140071d68]
mov qword [rsp + 0x10508], rax
cmp qword [rsp + 0x10508], 0
jne 0x140001bbd
mov edx, 0xa
mov rcx, qword [0x140070048]
call qword [0x140071de8]
cmp eax, 0x102
je 0x140001bbb
jmp 0x140001cdf
jmp 0x140001b5a
cmp qword [rsp + 0x10508], 0
je 0x140001bd6
mov rcx, qword [rsp + 0x10508]
call qword [0x140071d98]
jmp 0x140001cdf
mov qword [rsp + 0x104e8], 0
lea rax, [rsp + 0x104f0]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
mov rax, qword [0x140070048]
mov qword [rsp + 0x104e8], rax
mov rax, qword [rsp + 0x438]
mov qword [rsp + 0x104f0], rax
mov r9d, 0xffffffff
xor r8d, r8d
lea rdx, [rsp + 0x104e8]
mov ecx, 2
call qword [0x140071e78]
xor edx, edx
mov rcx, qword [0x140070048]
call qword [0x140071de8]
cmp eax, 0x102
je 0x140001c5b
mov dword [rsp + 0x20], 0
jmp 0x140001cda
cmp qword [rsp + 0x438], 0
je 0x140001c76
xor edx, edx
mov rcx, qword [rsp + 0x438]
call qword [0x140071e00]
cmp qword [rsp + 0x438], 0
je 0x140001c8f
mov rcx, qword [rsp + 0x438]
call qword [0x140071d98]
cmp qword [rsp + 0x440], 0
je 0x140001ca8
mov rcx, qword [rsp + 0x440]
call qword [0x140071d98]
mov r8d, 0x18
xor edx, edx
lea rcx, [rsp + 0x438]
call fcn.140029d20
mov ecx, 0x3e8
call qword [0x140071ea8]
jmp 0x140001cd5
mov ecx, 0x3e8
call qword [0x140071ea8]
jmp 0x1400019c6
jmp 0x1400019ae
call fcn.140011960
cmp dword [0x1400659b8], 1
jne 0x140001cff
mov edx, 0xffffffff
mov rcx, qword [0x140072b68]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor ecx, ecx
call qword [0x140071de0]
add rsp, 0x10510
pop rdi
ret