Function at 0x140115590
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x2c8
mov rax, qword [0x140211040]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
lea rcx, str.____Try_fixing..._n
call fcn.140031800
nop
mov rcx, qword [rsp + 0x2d0]
call fcn.1401144b0
movzx eax, al
test eax, eax
jne 0x140115603
lea rdx, str.____No_administrator_permissions
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140060410
mov qword [rsp + 0x40], rax
lea rdx, [fcn.140060800]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov eax, 1
jmp 0x1401158ab
mov rcx, qword [rsp + 0x2d0]
call fcn.1401145c0
movzx eax, al
test eax, eax
jne 0x14011564b
lea rdx, str.____Restart_pc_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140060410
mov qword [rsp + 0x48], rax
lea rdx, [fcn.140060800]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov eax, 1
jmp 0x1401158ab
mov edx, 0x104
lea rcx, [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov rax, qword [rsp + 0x2d0]
add rax, 0x18
lea rdx, [rsp + 0xa0]
mov rcx, rax
call fcn.140115bd0
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x88]
call fcn.140014d20
lea rdx, [rsp + 0x88]
mov rcx, qword [rsp + 0x2d0]
call fcn.140114e60
nop
mov byte [rsp + 0x20], 0
lea rax, [rsp + 0x88]
mov qword [rsp + 0x38], rax
mov edx, 8
lea rcx, [rsp + 0x80]
call fcn.140014d20
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
call fcn.14003b9a0
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0x38]
call fcn.14003b970
nop
jmp 0x1401156f8
lea rcx, [rsp + 0x80]
call fcn.14003b3a0
nop
movzx edx, byte [rsp + 0x78]
lea rcx, [rsp + 0x80]
call fcn.14003b3e0
movzx eax, al
test eax, eax
je 0x140115831
lea rcx, [rsp + 0x80]
call fcn.14003b3c0
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
add rax, 0x20
mov rdx, rax
mov rcx, qword [rsp + 0x2d0]
call fcn.140114620
movzx eax, al
test eax, eax
je 0x14011582c
mov byte [rsp + 0x20], 1
mov rax, qword [rsp + 0x30]
mov rdx, rax
mov rcx, qword [rsp + 0x2d0]
call fcn.1401152b0
nop
mov dword [rsp + 0x24], reloc.WLDAP32.dll_Ordinal_200
lea rdx, [rsp + 0x24]
lea rcx, [rsp + 0x70]
call fcn.14001de80
mov rcx, rax
call fcn.140116a90
nop
mov rcx, qword [rsp + 0x2d0]
call fcn.1401145c0
movzx eax, al
test eax, eax
je 0x140115801
mov rax, qword [rsp + 0x30]
mov rdx, rax
mov rcx, qword [rsp + 0x2d0]
call fcn.1401153f0
movzx eax, al
test eax, eax
jne 0x1401157ff
lea rdx, str.____Couldnt_delete_service_forcefully.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140060410
mov qword [rsp + 0x50], rax
lea rdx, [fcn.140060800]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
mov dword [rsp + 0x28], 1
lea rcx, [rsp + 0x88]
call fcn.140115290
mov eax, dword [rsp + 0x28]
jmp 0x1401158ab
jmp 0x14011582c
lea rdx, str.____driver_is_not_in_use_anymore_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140060410
mov qword [rsp + 0x58], rax
lea rdx, [fcn.140060800]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
jmp 0x1401156ea
movzx eax, byte [rsp + 0x20]
test eax, eax
je 0x140115867
lea rdx, str.___Done.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140060410
mov qword [rsp + 0x60], rax
lea rdx, [fcn.140060800]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
jmp 0x140115892
lea rdx, str.____Driver_wasnt_found.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140060410
mov qword [rsp + 0x68], rax
lea rdx, [fcn.140060800]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
mov dword [rsp + 0x2c], 0
lea rcx, [rsp + 0x88]
call fcn.140115290
mov eax, dword [rsp + 0x2c]
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.140165580
add rsp, 0x2c8
ret