Function at 0x140008390
Capabilities:
Get common file path
Patch process command line

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x598]
sub rsp, 0x698
lea rdi, str.ntdll.dll
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.NtQueryInformationProcess
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ebx, ebx
mov r12, rax
test rax, rax
je 0x14000865d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.RtlEnterCriticalSection
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x14000865d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.RtlLeaveCriticalSection
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
test rax, rax
je 0x14000865d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.RtlInitUnicodeString
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test rax, rax
je 0x14000865d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov ecx, 0x438
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14000865d
lea r9d, [rbx + 0x30]
lea r8, [rsp + 0x30]
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x20], rbx
call r12
lea r12d, [rbx + 8]
lea r8, [rbp + 0x5e0]
lea rdx, [rsp + 0x38]
mov rcx, rdi
mov r9d, r12d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x14000865d
mov rdx, qword [rbp + 0x5e0]
lea r8, [rbp + 0x5f8]
mov r9d, r12d
mov rcx, rdi
add rdx, 0x18
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x14000865d
mov r15d, 0x104
lea rcx, [rsp + 0x60]
mov edx, r15d
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea r8, str.explorer.exe
lea edx, [r15 + 1]
lea rcx, [rsp + 0x60]
call fcn.140023aa8
mov ecx, r15d
call fcn.1400220e4
lea r8, [rsp + 0x60]
mov edx, r15d
mov rcx, rax
mov r12, rax
call fcn.1400215c0
mov rcx, qword [rbp + 0x5e0]
mov rcx, qword [rcx + 0x38]
call r14
mov r11, qword [rbp + 0x5e0]
mov rdx, r12
mov rcx, qword [r11 + 0x20]
add rcx, 0x60
call rsi
mov r11, qword [rbp + 0x5e0]
mov rdx, r12
mov rcx, qword [r11 + 0x20]
add rcx, 0x70
call rsi
lea rdx, [rbp + 0x380]
mov r8d, r15d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov r11, qword [rbp + 0x5e0]
mov rax, qword [r11 + 0x18]
mov r14, qword [rax + 0x10]
mov rax, qword [rbp + 0x5f8]
mov rcx, qword [rax + 0x10]
mov qword [rbp + 0x5f0], rcx
lea r8, [rbp + 0x5e8]
lea rdx, [rbp + 0x5f0]
mov r9d, 8
mov rcx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x14000865d
mov rdx, qword [rbp + 0x5e8]
lea r8, [rbp + 0x170]
mov rcx, rdi
movzx r9d, word [rdx + 0x4a]
mov rdx, qword [rdx + 0x50]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x14000865d
lea rdx, [rbp + 0x170]
lea rcx, [rbp + 0x380]
call fcn.140023c34
test eax, eax
je 0x14000860c
mov rax, qword [rbp + 0x5e8]
mov rcx, qword [rax]
mov qword [rbp + 0x5f0], rcx
cmp rcx, r14
je 0x14000862c
jmp 0x140008583
mov rcx, qword [rbp + 0x5e8]
mov rdx, r12
add rcx, 0x48
call rsi
mov rcx, qword [rbp + 0x5e8]
mov rdx, r12
add rcx, 0x58
call rsi
mov rcx, qword [rbp + 0x5e0]
mov rcx, qword [rcx + 0x38]
call r13
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp + 0x170]
lea rcx, [rsp + 0x60]
call fcn.140023c34
test eax, eax
setne bl
mov eax, ebx
jmp 0x14000865f
xor eax, eax
add rsp, 0x698
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret