Function at 0x180014080
Capabilities:
Check if file exists
Get common file path
Print debug messages

Disassembly:
mov r11, rsp
push rsi
push rdi
push r12
sub rsp, 0x7b0
mov qword [rsp + 0xc8], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov rax, qword [0x180071060]
xor rax, rsp
mov qword [rsp + 0x7a0], rax
mov rbx, rdx
lea r12, str.regedit.png
lea r8, str.wfchost.exe
xor edx, edx
lea rcx, [r11 - 0x6d0]
call fcn.1800367b4
nop
lea rcx, [rsp + 0x100]
cmp qword [rsp + 0x118], 8
cmovae rcx, qword [rsp + 0x100]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor ebp, ebp
test eax, eax
jne 0x180014200
mov word [rsp + 0x380], bp
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x382]
call fcn.18003e200
mov r8d, 0x104
lea rdx, [rsp + 0x590]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x1800141a2
lea rcx, [rsp + 0x590]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
lea rcx, str.wfchost.exe
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add edi, eax
cmp edi, 0x104
jge 0x1800141a2
lea rdx, [0x18005e940]
lea rcx, [rsp + 0x590]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, str.wfchost.exe
lea rcx, [rsp + 0x590]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
mov r8d, 0x104
lea rdx, [rsp + 0x590]
lea rcx, [rsp + 0x380]
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
lea rcx, [rsp + 0x380]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1800141d3
cmp qword [rsp + 0x118], 8
jb 0x1800141cc
mov rcx, qword [rsp + 0x100]
call fcn.18003cec4
xor eax, eax
jmp 0x180014b27
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x380]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x380]
lea rcx, [rsp + 0xf8]
call fcn.180006f50
test rbx, rbx
je 0x180014b0d
lea rsi, str.rtmessage.png
test r12, r12
cmovne rsi, r12
and dword [rsp + 0xa8], 0xfffffe00
mov qword [rsp + 0xb0], rbp
mov qword [rsp + 0xb8], rbp
mov qword [rsp + 0xc0], rbp
lea rax, [rsp + 0x20]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x98], 7
mov qword [rsp + 0x90], rbp
mov word [rsp + 0x80], bp
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [0x18005d4f0]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [0x18005d4f0]
lea rcx, [rsp + 0x78]
call fcn.180006f50
nop
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x50]
call fcn.180013ba0
nop
mov byte [rsp + 0x28], 4
bts dword [rsp + 0x28], 8
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], rbp
mov rdx, qword [rax + 0x18]
cmp qword [rax + 0x20], 0x10
jb 0x1800142c4
mov rcx, qword [rax + 8]
jmp 0x1800142c8
lea rcx, [rax + 8]
call fcn.18001fa9c
mov qword [rsp + 0x20], rax
lea r8, [0x18005ce81]
lea rdx, str.title
lea rcx, [rsp + 0xa0]
call fcn.1800213f0
mov rcx, rax
lea rdx, [rsp + 0x20]
call fcn.1800204dc
nop
cmp qword [rsp + 0x70], 0x10
jb 0x18001430d
mov rcx, qword [rsp + 0x58]
call fcn.18003cec4
mov qword [rsp + 0x70], 0xf
mov qword [rsp + 0x68], rbp
mov byte [rsp + 0x58], 0
cmp qword [rsp + 0x98], 8
jb 0x180014338
mov rcx, qword [rsp + 0x80]
call fcn.18003cec4
lea rax, [rsp + 0x20]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x98], 7
mov qword [rsp + 0x90], rbp
mov word [rsp + 0x80], bp
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rbx
lea rcx, [rsp + 0x78]
call fcn.180006f50
nop
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x50]
call fcn.180013ba0
nop
mov byte [rsp + 0x28], 4
bts dword [rsp + 0x28], 8
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], rbp
mov rdx, qword [rax + 0x18]
cmp qword [rax + 0x20], 0x10
jb 0x1800143ba
mov rcx, qword [rax + 8]
jmp 0x1800143be
lea rcx, [rax + 8]
call fcn.18001fa9c
mov qword [rsp + 0x20], rax
lea r8, [0x18005ce3f]
lea rdx, str.content
lea rcx, [rsp + 0xa0]
call fcn.1800213f0
mov rcx, rax
lea rdx, [rsp + 0x20]
call fcn.1800204dc
nop
cmp qword [rsp + 0x70], 0x10
jb 0x180014403
mov rcx, qword [rsp + 0x58]
call fcn.18003cec4
mov qword [rsp + 0x70], 0xf
mov qword [rsp + 0x68], rbp
mov byte [rsp + 0x58], 0
cmp qword [rsp + 0x98], 8
jb 0x18001442e
mov rcx, qword [rsp + 0x80]
call fcn.18003cec4
lea rax, [rsp + 0x20]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x98], 7
mov qword [rsp + 0x90], rbp
mov word [rsp + 0x80], bp
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [0x18005ce58]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [0x18005ce58]
lea rcx, [rsp + 0x78]
call fcn.180006f50
nop
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x50]
call fcn.180013ba0
nop
mov byte [rsp + 0x28], 4
bts dword [rsp + 0x28], 8
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], rbp
mov rdx, qword [rax + 0x18]
cmp qword [rax + 0x20], 0x10
jb 0x1800144b8
mov rcx, qword [rax + 8]
jmp 0x1800144bc
lea rcx, [rax + 8]
call fcn.18001fa9c
mov qword [rsp + 0x20], rax
lea r8, [0x18005ce8f]
lea rdx, str.btnText
lea rcx, [rsp + 0xa0]
call fcn.1800213f0
mov rcx, rax
lea rdx, [rsp + 0x20]
call fcn.1800204dc
nop
cmp qword [rsp + 0x70], 0x10
jb 0x180014501
mov rcx, qword [rsp + 0x58]
call fcn.18003cec4
mov qword [rsp + 0x70], 0xf
mov qword [rsp + 0x68], rbp
mov byte [rsp + 0x58], 0
cmp qword [rsp + 0x98], 8
jb 0x18001452c
mov rcx, qword [rsp + 0x80]
call fcn.18003cec4
lea rax, [rsp + 0x20]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x98], 7
mov qword [rsp + 0x90], rbp
mov word [rsp + 0x80], bp
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rsi
lea rcx, [rsp + 0x78]
call fcn.180006f50
nop
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x50]
call fcn.180013ba0
nop
mov byte [rsp + 0x28], 4
bts dword [rsp + 0x28], 8
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], rbp
mov rdx, qword [rax + 0x18]
cmp qword [rax + 0x20], 0x10
jb 0x1800145ae
mov rcx, qword [rax + 8]
jmp 0x1800145b2
lea rcx, [rax + 8]
call fcn.18001fa9c
mov qword [rsp + 0x20], rax
lea r8, [0x18005ce97]
lea rdx, str.icoName
lea rcx, [rsp + 0xa0]
call fcn.1800213f0
mov rcx, rax
lea rdx, [rsp + 0x20]
call fcn.1800204dc
nop
cmp qword [rsp + 0x70], 0x10
jb 0x1800145f7
mov rcx, qword [rsp + 0x58]
call fcn.18003cec4
mov qword [rsp + 0x70], 0xf
mov qword [rsp + 0x68], rbp
mov byte [rsp + 0x58], 0
cmp qword [rsp + 0x98], 8
jb 0x180014622
mov rcx, qword [rsp + 0x80]
call fcn.18003cec4
lea rax, [rsp + 0x20]
mov qword [rsp + 0x48], rax
mov byte [rsp + 0x28], 1
btr dword [rsp + 0x28], 8
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x20], 1
lea r8, [0x18005cea4]
lea rdx, str.showNotAlert
lea rcx, [rsp + 0xa0]
call fcn.1800213f0
mov rcx, rax
lea rdx, [rsp + 0x20]
call fcn.1800204dc
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x48], rdx
mov byte [rsp + 0x28], 1
btr dword [rsp + 0x28], 8
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x20], rbp
lea r8, [0x18005cead]
lea rdx, str.runas
lea rcx, [rsp + 0xa0]
call fcn.1800213f0
mov rcx, rax
lea rdx, [rsp + 0x20]
call fcn.1800204dc
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x48], rdx
mov byte [rsp + 0x28], 1
btr dword [rsp + 0x28], 8
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x20], rbp
lea r8, [0x18005ceba]
lea rdx, str.fullscreen
lea rcx, [rsp + 0xa0]
call fcn.1800213f0
mov rcx, rax
lea rdx, [rsp + 0x20]
call fcn.1800204dc
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x48], rdx
mov byte [rsp + 0x28], 1
btr dword [rsp + 0x28], 8
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x20], rbp
lea r8, [0x18005cecc]
lea rdx, str.closeExpired
lea rcx, [rsp + 0xa0]
call fcn.1800213f0
mov rcx, rax
lea rdx, [rsp + 0x20]
call fcn.1800204dc
lea rcx, [rsp + 0x148]
call fcn.180018940
nop
mov word [rsp + 0x170], bp
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x172]
call fcn.18003e200
lea rdx, [rsp + 0x170]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rcx, [rsp + 0x50]
call fcn.1800189f0
cmp qword [rax + 0x20], 8
jb 0x1800147bf
mov rdx, qword [rax + 8]
jmp 0x1800147c3
lea rdx, [rax + 8]
lea rcx, [rsp + 0x170]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
cmp qword [rsp + 0x70], 8
jb 0x1800147e3
mov rcx, qword [rsp + 0x58]
call fcn.18003cec4
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0xa0]
call fcn.180021da4
nop
mov rdx, rax
lea rcx, [rsp + 0x120]
call fcn.1800384a8
nop
cmp qword [rsp + 0x70], 0x10
jb 0x180014819
mov rcx, qword [rsp + 0x58]
call fcn.18003cec4
mov qword [rsp + 0x70], 0xf
mov qword [rsp + 0x68], rbp
mov byte [rsp + 0x58], 0
lea rdx, [rsp + 0x128]
cmp qword [rsp + 0x140], 0x10
cmovae rdx, qword [rsp + 0x128]
mov r8d, dword [rsp + 0x138]
lea rcx, [rsp + 0x170]
call fcn.180031dac
call fcn.180032f1c
mov rdi, rax
test rax, rax
je 0x1800148a4
mov r8, rax
mov edx, 4
lea rcx, [rsp + 0x170]
call qword [sym.imp.ADVAPI32.dll_SetFileSecurityW]
mov rcx, qword [rdi + 0x30]
test rcx, rcx
je 0x18001488d
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rdi + 0x28]
test rcx, rcx
je 0x18001489c
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov rcx, rdi
call fcn.18003cec4
lea r8, [rsp + 0x100]
cmp qword [rsp + 0x118], 8
cmovae r8, qword [rsp + 0x100]
lea r9, [rsp + 0x170]
lea rdx, str.__ls___common__ls
lea rcx, [rsp + 0xd0]
call fcn.1800335ec
nop
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rsp + 0xd8]
cmp qword [rsp + 0xf0], 8
cmovae rcx, qword [rsp + 0xd8]
mov edx, 1
call fcn.180032a98
test rax, rax
jne 0x180014a3a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x180014928
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x522
jne 0x180014956
lea rcx, [rsp + 0xd8]
cmp qword [rsp + 0xf0], 8
cmovae rcx, qword [rsp + 0xd8]
xor edx, edx
lea r8d, [rdx + 1]
call fcn.1800328a8
test rax, rax
jne 0x180014a3a
lea rcx, str.ShowClientNotify_failed:
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, [0x18005d4f0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
nop
cmp qword [rsp + 0xf0], 8
jb 0x180014989
mov rcx, qword [rsp + 0xd8]
call fcn.18003cec4
mov qword [rsp + 0xf0], 7
mov qword [rsp + 0xe8], rbp
mov word [rsp + 0xd8], bp
cmp qword [rsp + 0x140], 0x10
jb 0x1800149bd
mov rcx, qword [rsp + 0x128]
call fcn.18003cec4
mov qword [rsp + 0x140], 0xf
mov qword [rsp + 0x138], rbp
mov byte [rsp + 0x128], 0
cmp qword [rsp + 0x168], 0x10
jb 0x1800149f1
mov rcx, qword [rsp + 0x150]
call fcn.18003cec4
mov qword [rsp + 0x168], 0xf
mov qword [rsp + 0x160], rbp
mov byte [rsp + 0x150], 0
lea rcx, [rsp + 0xa0]
call fcn.180020444
nop
cmp qword [rsp + 0x118], 8
jb 0x180014a33
mov rcx, qword [rsp + 0x100]
call fcn.18003cec4
xor eax, eax
jmp 0x180014b27
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp qword [rsp + 0xf0], 8
jb 0x180014a5c
mov rcx, qword [rsp + 0xd8]
call fcn.18003cec4
mov qword [rsp + 0xf0], 7
mov qword [rsp + 0xe8], rbp
mov word [rsp + 0xd8], bp
cmp qword [rsp + 0x140], 0x10
jb 0x180014a90
mov rcx, qword [rsp + 0x128]
call fcn.18003cec4
mov qword [rsp + 0x140], 0xf
mov qword [rsp + 0x138], rbp
mov byte [rsp + 0x128], 0
cmp qword [rsp + 0x168], 0x10
jb 0x180014ac4
mov rcx, qword [rsp + 0x150]
call fcn.18003cec4
mov qword [rsp + 0x168], 0xf
mov qword [rsp + 0x160], rbp
mov byte [rsp + 0x150], 0
lea rcx, [rsp + 0xa0]
call fcn.180020444
nop
cmp qword [rsp + 0x118], 8
jb 0x180014b06
mov rcx, qword [rsp + 0x100]
call fcn.18003cec4
mov eax, 1
jmp 0x180014b27
cmp qword [rsp + 0x118], 8
jb 0x180014b25
mov rcx, qword [rsp + 0x100]
call fcn.18003cec4
xor eax, eax
mov rcx, qword [rsp + 0x7a0]
xor rcx, rsp
call fcn.18003c6c0
lea r11, [rsp + 0x7b0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret