Function at 0x14000aa80
Capabilities:
Access peb ldr_data
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x470
mov rax, qword [0x140086240]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov rdi, rcx
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtAllocateVirtualMemory
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.ntdll.dll
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.RtlEnterCriticalSection
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.ntdll.dll
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.RtlLeaveCriticalSection
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.ntdll.dll
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.RtlInitUnicodeString
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbp, rax
test rbx, rbx
je 0x14000acd6
test rsi, rsi
je 0x14000acd6
test r14, r14
je 0x14000acd6
test rax, rax
je 0x14000acd6
mov qword [rsp + 0x30], 0x1000
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x28], 4
lea r9, [rsp + 0x30]
mov rcx, rax
mov dword [rsp + 0x20], 0x3000
xor r8d, r8d
lea rdx, [0x14008bdc8]
call rbx
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x208
mov ebx, eax
call fcn.140068a80
mov edx, 0x104
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea rcx, [rsp + 0x40]
sub rcx, 2
nop
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x14000abb0
mov eax, dword [0x140078c50]
mov dword [rcx], eax
test ebx, ebx
js 0x14000ac32
mov rdx, qword [0x14008bdc8]
lea rcx, [rsp + 0x40]
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rcx]
lea rcx, [rcx + 2]
mov word [rdx], ax
lea rdx, [rdx + 2]
test ax, ax
jne 0x14000abe0
cmp qword [rdi + 0x18], 7
mov r8, rdi
jbe 0x14000ac00
mov r8, qword [rdi]
mov rcx, qword [0x14008bdc8]
sub rcx, 2
nop dword [rax + rax]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x14000ac10
xor edx, edx
nop dword [rax]
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x14000ac20
mov rbx, qword gs:[0x60]
mov rcx, qword [rbx + 0x38]
call rsi
mov rcx, qword [rbx + 0x20]
mov rdx, qword [0x14008bdc8]
add rcx, 0x60
call rbp
cmp qword [rdi + 0x18], 7
mov rdx, rdi
jbe 0x14000ac5f
mov rdx, qword [rdi]
mov rcx, qword [rbx + 0x20]
add rcx, 0x70
call rbp
mov rcx, qword [rbx + 0x38]
call r14
mov rax, qword [rbx + 0x18]
lea rdx, [rsp + 0x250]
mov r8d, 0x104
xor ecx, ecx
mov rsi, qword [rax + 0x10]
mov rbx, rsi
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rdx, qword [rbx + 0x50]
lea rcx, [rsp + 0x250]
call fcn.1400462f4
test eax, eax
je 0x14000acb2
mov rbx, qword [rbx]
cmp rbx, rsi
jne 0x14000ac91
mov al, 1
jmp 0x14000acd8
mov rdx, qword [0x14008bdc8]
lea rcx, [rbx + 0x48]
call rbp
cmp qword [rdi + 0x18], 7
jbe 0x14000acc9
mov rdi, qword [rdi]
lea rcx, [rbx + 0x58]
mov rdx, rdi
call rbp
mov al, 1
jmp 0x14000acd8
xor al, al
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.14003f0d0
lea r11, [rsp + 0x470]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret