Function at 0x14009e3c0
Capabilities:
Get common file path
Persist via run registry key

Disassembly:
mov r11, rsp
mov byte [r11 + 0x18], r8b
mov dword [rsp + 0x10], edx
mov qword [r11 + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0x800
mov rax, qword [0x140241cc0]
xor rax, rsp
mov qword [rsp + 0x7f0], rax
mov edi, dword [r11 + 0x10]
mov rbx, rcx
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x5d0], edi
xor esi, esi
lea rax, [r11 - 0x238]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, edi
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edx, eax
test eax, eax
jns 0x14009e6ce
mov eax, edi
and eax, 0xffff00ff
and edi, 0xffff00ff
cmp edi, 0x24
jne 0x14009e463
mov edx, 0x104
lea rcx, [rsp + 0x5e0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x14009e8e3
cmp eax, 0x104
ja 0x14009e929
jmp 0x14009e6ce
cmp eax, 0x25
jne 0x14009e493
mov edx, 0x104
lea rcx, [rsp + 0x5e0]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x14009e972
cmp eax, 0x104
ja 0x14009e9be
jmp 0x14009e6ce
cmp eax, 0x26
jne 0x14009e4a5
mov rcx, rbx
call fcn.14009eaa0
jmp 0x14009e70b
cmp eax, 0x2b
jne 0x14009e4b7
mov rcx, rbx
call fcn.14009eb10
jmp 0x14009e70b
cmp eax, 0x23
jne 0x14009e5a0
lea rax, str.Common_AppData
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohl
lea rax, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 0x40
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea r8, [rsp + 0x30]
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x390]
call fcn.140058350
nop
mov rax, qword [rsp + 0x390]
mov qword [rsp + 0x148], rax
lea rdx, [rsp + 0x398]
lea rcx, [rsp + 0x150]
call fcn.1400585e0
mov eax, dword [rsp + 0x5c8]
mov dword [rsp + 0x380], eax
mov eax, dword [rsp + 0x5cc]
mov dword [rsp + 0x384], eax
mov byte [rsp + 0x388], 1
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x30], xmm0
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x148]
mov rcx, rbx
call fcn.1400a13d0
nop
lea rcx, [rsp + 0x148]
call fcn.1400582c0
nop
lea rcx, [rsp + 0x5a0]
call fcn.140058700
jmp 0x14009e70b
cmp eax, 0x1a
jne 0x14009e74e
lea rax, str.AppData
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 7
lea rax, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0x40
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea r8, [rsp + 0x50]
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x390]
call fcn.140058350
nop
mov rax, qword [rsp + 0x390]
mov qword [rsp + 0x148], rax
lea rdx, [rsp + 0x398]
lea rcx, [rsp + 0x150]
call fcn.1400585e0
mov eax, dword [rsp + 0x5c8]
mov dword [rsp + 0x380], eax
mov eax, dword [rsp + 0x5cc]
mov dword [rsp + 0x384], eax
mov byte [rsp + 0x388], 1
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x148]
mov rcx, rbx
call fcn.1400a13d0
nop
lea rcx, [rsp + 0x148]
call fcn.1400582c0
nop
lea rcx, [rsp + 0x5a0]
call fcn.140058700
mov rax, rbx
jmp 0x14009e70e
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], rsi
lea rax, [rsp + 0x5e0]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14009e6f0
lea rdx, [rsp + 0x5e0]
mov rcx, rbx
call fcn.140025740
mov rax, rbx
mov rcx, qword [rsp + 0x7f0]
xor rcx, rsp
call fcn.140144310
add rsp, 0x800
pop rdi
pop rsi
pop rbx
ret
cmp eax, 0x1c
jne 0x14009e89f
lea rax, str.Local_AppData
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], recvfrom
lea rax, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 0x40
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea r8, [rsp + 0x30]
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x390]
call fcn.140058350
nop
mov rax, qword [rsp + 0x390]
mov qword [rsp + 0x148], rax
lea rdx, [rsp + 0x398]
lea rcx, [rsp + 0x150]
call fcn.1400585e0
mov eax, dword [rsp + 0x5c8]
mov dword [rsp + 0x380], eax
mov eax, dword [rsp + 0x5cc]
mov dword [rsp + 0x384], eax
mov byte [rsp + 0x388], 1
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x30], xmm0
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x148]
mov rcx, rbx
call fcn.1400a13d0
nop
lea rcx, [rsp + 0x148]
call fcn.1400582c0
nop
lea rcx, [rsp + 0x5a0]
call fcn.140058700
mov rax, rbx
jmp 0x14009e70e
lea rcx, str.Unable_to_retrieve_a_path_of_the_known_folder____
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], gethostname
lea r9, [rsp + 0x5d0]
lea r8, [rsp + 0x30]
lea rcx, [rsp + 0x128]
call fcn.14009eb80
lea rdx, [0x14023da00]
lea rcx, [rsp + 0x128]
call fcn.14015a550
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Unable_to_retrieve_a_path_of_the_known_folder____
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], gethostname
lea r9, [rsp + 0x5d0]
lea r8, [rsp + 0x40]
mov edx, eax
lea rcx, [rsp + 0x68]
call fcn.14009eb80
lea rdx, [0x14023da00]
lea rcx, [rsp + 0x68]
call fcn.14015a550
int3
lea rcx, str.Unable_to_retrieve_a_path_of_the_known_folder____
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], gethostname
lea r9, [rsp + 0x5d0]
lea r8, [rsp + 0x40]
mov edx, 0xea
lea rcx, [rsp + 0x88]
call fcn.14009eb80
lea rdx, [0x14023da00]
lea rcx, [rsp + 0x88]
call fcn.14015a550
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Unable_to_retrieve_a_path_of_the_known_folder____
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], gethostname
lea r9, [rsp + 0x5d0]
lea r8, [rsp + 0x40]
mov edx, eax
lea rcx, [rsp + 0xa8]
call fcn.14009eb80
lea rdx, [0x14023da00]
lea rcx, [rsp + 0xa8]
call fcn.14015a550
int3
lea rcx, str.Unable_to_retrieve_a_path_of_the_known_folder____
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], gethostname
lea r9, [rsp + 0x5d0]
lea r8, [rsp + 0x40]
mov edx, 0xea
lea rcx, [rsp + 0xc8]
call fcn.14009eb80
lea rdx, [0x14023da00]
lea rcx, [rsp + 0xc8]
call fcn.14015a550
int3