Function at 0x140001900
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
push r15
lea rcx, str.ntdll.dll
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x6b8
and qword [rsp + 0x40], 0
and qword [rsp + 0x48], 0
and qword [rsp + 0x50], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x14000193e
xor eax, eax
jmp 0x140001c90
xchg rbx, rax
lea rsi, [rsp + 0x4a7]
movabs rax, 0x9b9385aa8fa99200
mov word [rsp + 0x4be], 0x8780
mov qword [rsp + 0x4a6], rax
mov rcx, rsi
movabs rax, 0x9e88859589838aaa
mov qword [rsp + 0x4ae], rax
movabs rax, 0x97929f9dbe838382
mov qword [rsp + 0x4b6], rax
mov byte [rsp + 0x4c0], 0xf5
call fcn.140002d30
mov rdx, rsi
mov byte [rsp + 0x4a6], 1
mov rcx, rbx
mov rdi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rdi
xchg rsi, rax
test rsi, rsi
je 0x140001937
lea rdx, str.RtlEnterCriticalSection
mov rcx, rbx
call rdi
xchg r13, rax
test r13, r13
je 0x140001937
lea rdx, str.RtlLeaveCriticalSection
mov rcx, rbx
call rdi
xchg rbp, rax
test rbp, rbp
je 0x140001937
lea rdx, str.RtlInitUnicodeString
mov rcx, rbx
call rdi
xchg rdi, rax
test rdi, rdi
je 0x140001937
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov ecx, 0x438
xchg r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xchg rbx, rax
cmp rbx, 0xffffffffffffffff
je 0x140001937
and qword [rsp + 0x20], 0
xor edx, edx
mov rcx, rbx
push 0x30
pop r9
lea r8, [rsp + 0x60]
call rsi
and qword [rsp + 0x20], 0
lea rdx, [rsp + 0x68]
mov rcx, rbx
push 8
pop r9
mov r12, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea r8, [rsp + 0x40]
call r12
test eax, eax
je 0x140001937
mov rax, qword [rsp + 0x40]
and qword [rsp + 0x20], 0
mov rcx, rbx
push 8
pop r9
lea rdx, [rax + 0x18]
lea r8, [rsp + 0x48]
call r12
test eax, eax
je 0x140001937
lea rax, [rsp + 0x29c]
mov edx, 0x104
mov qword [rsp + 0x30], rax
xchg rcx, rax
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x140001937
lea r8, [rsp + 0x4a8]
movabs rax, 0x6e006500790047
mov byte [rsp + 0x4a6], 0
mov qword [rsp + 0x4a8], rax
mov rcx, r8
movabs rax, 0x470053004f0073
mov qword [rsp + 0x4b0], rax
movabs rax, 0x5e0040000a0051
mov qword [rsp + 0x4b8], rax
mov qword [rsp + 0x38], r8
mov dword [rsp + 0x4c0], 0x280042
call fcn.140003340
mov r8, qword [rsp + 0x38]
mov edx, 0x105
mov rcx, qword [rsp + 0x30]
mov byte [rsp + 0x4a6], 1
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov rcx, qword [rsp + 0x30]
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
lea r14, [rax + 1]
lea rcx, [r14 + r14]
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
xchg rsi, rax
test rsi, rsi
je 0x140001937
mov r8, qword [rsp + 0x30]
mov rdx, r14
mov rcx, rsi
lea r15, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x38]
call r13
mov rax, qword [rsp + 0x40]
mov rdx, rsi
lea r13, [rsp + 0x94]
mov rcx, qword [rax + 0x20]
add rcx, 0x60
call rdi
mov rax, qword [rsp + 0x40]
mov rdx, rsi
mov rcx, qword [rax + 0x20]
add rcx, 0x70
call rdi
mov r8d, 0x104
mov rdx, r13
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x18]
mov r14, qword [rax + 0x10]
mov rax, qword [rsp + 0x48]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x58], rax
and qword [rsp + 0x20], 0
lea rdx, [rsp + 0x58]
mov r8, r15
mov rcx, rbx
push 8
pop r9
call r12
test eax, eax
je 0x140001937
mov rax, qword [rsp + 0x50]
lea rdx, [rsp + 0x4a6]
mov rcx, rbx
mov qword [rsp + 0x38], rdx
mov r8, qword [rsp + 0x38]
movzx r9d, word [rax + 0x4a]
mov rdx, qword [rax + 0x50]
and qword [rsp + 0x20], 0
call r12
test eax, eax
je 0x140001937
mov rax, qword [rsp + 0x50]
mov rcx, r13
mov rdx, qword [rsp + 0x38]
movzx eax, word [rax + 0x48]
shr rax, 1
and word [rsp + rax*2 + 0x4a6], 0
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
mov rcx, qword [rsp + 0x50]
test eax, eax
jne 0x140001c53
add rcx, 0x48
mov rdx, rsi
call rdi
mov rax, qword [rsp + 0x50]
mov rdx, rsi
lea rcx, [rax + 0x58]
call rdi
jmp 0x140001c64
mov rax, qword [rcx]
mov qword [rsp + 0x58], rax
cmp rax, r14
jne 0x140001bba
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x38]
call rbp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
setne al
movzx eax, al
add rsp, 0x6b8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret