Function at 0x140001000
Capabilities:
Get common file path
Terminate process

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
mov eax, 0x10510
call fcn.140023660
sub rsp, rax
mov dword [0x14005d5f8], 0x19721972
mov dword [0x14005d600], 0x19721972
mov dword [0x14005d604], 0x19721972
mov ecx, dword [0x14005d5f8]
call fcn.1400150d0
test eax, eax
jne 0x140001057
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
xor eax, eax
mov word [rsp + 0x40], ax
lea rax, [rsp + 0x42]
mov rdi, rax
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
mov r8d, 0x104
lea rdx, [rsp + 0x40]
xor ecx, ecx
call qword [0x140063d20]
test eax, eax
jne 0x14000108e
xor ecx, ecx
call qword [0x140063d28]
call qword [0x140063cc0]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x400], 0x18
mov qword [rsp + 0x408], 0
mov dword [rsp + 0x410], 1
lea r8, str.85E0AEF2_29BF_4BD8_B1AD_266CEFC60402
xor edx, edx
lea rcx, [rsp + 0x400]
call qword [0x140063cc8]
mov qword [0x140063970], rax
cmp qword [0x140063970], 0
jne 0x1400010eb
xor ecx, ecx
call qword [0x140063d28]
cmp dword [0x14005ebd4], 1
jne 0x1400010f9
call fcn.14000eb80
call fcn.140007f60
cmp eax, 1
jne 0x140001198
lea r8, str.F35EE406_8DEC_432E_A833_4405F0BB485E
xor edx, edx
mov ecx, 0x100002
call qword [sym.imp.KERNEL32.dll_OpenEventW]
mov qword [0x140063968], rax
cmp qword [0x140063968], 0
jne 0x140001134
xor ecx, ecx
call qword [0x140063d88]
mov qword [rsp + 0x4a0], 0
lea r8, str.9B680514_63D2_4219_8F5D_C718FC4E126F
xor edx, edx
mov ecx, 0x100002
call qword [0x140063d78]
mov qword [rsp + 0x4a0], rax
cmp qword [rsp + 0x4a0], 0
jne 0x14000116f
xor ecx, ecx
call qword [0x140063d88]
mov rcx, qword [rsp + 0x4a0]
call qword [0x140063d80]
mov rcx, qword [rsp + 0x4a0]
call qword [0x140063ce0]
call fcn.1400188f0
xor ecx, ecx
call qword [0x140063d88]
call fcn.14000de60
test eax, eax
jne 0x1400011a9
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov qword [rsp + 0x468], 0
lea r8, str.5FC463E8_2CC2_4913_96CF_4E1DD15A9686
xor edx, edx
mov ecx, 0x100000
call qword [0x140063cb0]
mov qword [rsp + 0x468], rax
cmp qword [rsp + 0x468], 0
je 0x1400011f2
mov rcx, qword [rsp + 0x468]
call qword [0x140063ce0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea r8, str.5FC463E8_2CC2_4913_96CF_4E1DD15A9686
mov edx, 1
xor ecx, ecx
call qword [0x140063cc8]
test rax, rax
jne 0x140001213
xor ecx, ecx
call qword [0x140063d28]
cmp dword [0x14005ebdc], 1
jne 0x14000124f
cmp dword [0x140063af0], 0
jne 0x14000124f
call fcn.140019030
test eax, eax
jne 0x14000124f
call fcn.140019890
cmp eax, 0xa
jb 0x14000124f
lea rcx, [rsp + 0x40]
call fcn.1400082f0
cmp eax, 1
jne 0x14000124f
xor ecx, ecx
call qword [0x140063d28]
cmp dword [0x14005d610], 1
jne 0x1400012b5
cmp dword [0x140063af4], 0
jne 0x1400012b5
call fcn.140019890
cmp eax, 0xa
jb 0x1400012b5
call fcn.140019030
cmp eax, 1
jne 0x1400012b5
lea rdx, reloc.OLEAUT32.dll_SysReAllocString
mov ecx, dword [0x14005d614]
call fcn.140013b10
mov qword [rsp + 0x4a8], rax
cmp qword [rsp + 0x4a8], 0
je 0x1400012b5
mov rcx, qword [rsp + 0x4a8]
call fcn.140014030
mov rcx, qword [rsp + 0x4a8]
call qword [0x140063d08]
lea r8, str.EEF288A7_441A_4770_8C8B_41C1DAFC1EBB
mov edx, 1
xor ecx, ecx
call qword [0x140063cc8]
mov qword [rsp + 0x428], rax
cmp qword [rsp + 0x428], 0
jne 0x1400012e7
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call qword [0x140063db0]
cmp eax, 0xb7
jne 0x1400012ff
mov ecx, 0xffffffff
call qword [0x140063d28]
lea r8, str.1D48338C_C4E9_4356_A7A1_51B4316C1904
mov edx, 1
xor ecx, ecx
call qword [0x140063cc8]
mov qword [rsp + 0x418], rax
cmp qword [rsp + 0x418], 0
jne 0x14000132e
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rcx, str.1D48338C_C4E9_4356_A7A1_51B4316C1904
call fcn.1400194f0
lea r9, str.F35EE406_8DEC_432E_A833_4405F0BB485E
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call qword [0x140063d10]
mov qword [0x140063968], rax
cmp qword [0x140063968], 0
jne 0x14000136d
mov ecx, 0xffffffff
call qword [0x140063d28]
call qword [0x140063db0]
cmp eax, 0xb7
jne 0x140001382
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rcx, str.F35EE406_8DEC_432E_A833_4405F0BB485E
call fcn.1400194f0
cmp dword [0x14005d1e8], 1
jne 0x14000158a
mov r8d, 0x7fff
lea rdx, [rsp + 0x4b0]
xor ecx, ecx
call qword [0x140063d20]
test eax, eax
je 0x140001582
mov dx, 0x5c
lea rcx, [rsp + 0x4b0]
call fcn.140001cc0
xor ecx, ecx
mov word [rax], cx
lea rdx, [rsp + 0x104b0]
lea rcx, [0x14005cf20]
call fcn.14000ed20
mov qword [rsp + 0x104b8], rax
cmp qword [rsp + 0x104b8], 0
je 0x140001578
mov dx, 0x5c
mov rcx, qword [rsp + 0x104b8]
call fcn.140001cc0
xor ecx, ecx
mov word [rax], cx
mov edx, 0xfffe
mov ecx, 0x40
call qword [0x140063cf0]
mov qword [rsp + 0x104c0], rax
cmp qword [rsp + 0x104c0], 0
je 0x140001568
mov rdx, qword [rsp + 0x104c0]
mov ecx, 0x7fff
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x140001552
mov dx, 0x5c
mov rcx, qword [rsp + 0x104c0]
call fcn.140001cc0
xor ecx, ecx
mov word [rax], cx
mov rdx, qword [rsp + 0x104b8]
lea rcx, [rsp + 0x4b0]
call qword [0x140063fb8]
test eax, eax
je 0x140001550
mov rdx, qword [rsp + 0x104c0]
lea rcx, [rsp + 0x4b0]
call qword [0x140063fb8]
test eax, eax
je 0x140001550
call qword [0x140063cb8]
mov qword [rsp + 0x104d8], rax
lea rdx, [rsp + 0x104c8]
mov rcx, qword [rsp + 0x104d8]
call qword [0x140064468]
mov qword [rsp + 0x104d0], rax
lea rdx, str.E30FE92A_D009_4AC0_9926_B1FD573C6AC5
mov rax, qword [rsp + 0x104d0]
mov rcx, qword [rax + 8]
call qword [0x140063fb8]
test eax, eax
je 0x140001550
lea rdx, str.47E00392_B18E_4669_A96A_A535BDFA947B
mov rax, qword [rsp + 0x104d0]
mov rcx, qword [rax + 8]
call qword [0x140063fb8]
test eax, eax
je 0x140001550
lea rdx, str.D8BD0659_96B3_4480_BDE2_3BC9A4ABAB94
mov rax, qword [rsp + 0x104d0]
mov rcx, qword [rax + 8]
call qword [0x140063fb8]
test eax, eax
je 0x140001550
mov r9d, 1
lea r8, [0x14005d1ec]
lea rdx, [0x14005d2b6]
xor ecx, ecx
call qword [0x140064010]
cmp eax, 2
jne 0x140001550
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x14000155a
xor ecx, ecx
call qword [0x140063d28]
mov rcx, qword [rsp + 0x104c0]
call qword [0x140063d08]
mov rcx, qword [rsp + 0x104b8]
call qword [0x140063d08]
jmp 0x140001580
xor ecx, ecx
call qword [0x140063d28]
jmp 0x14000158a
xor ecx, ecx
call qword [0x140063d28]
lea rdx, [rsp + 0x260]
mov cx, 2
call qword [0x1400645c8]
test eax, eax
je 0x1400015a8
xor ecx, ecx
call qword [0x140063d28]
call fcn.14000de40
test eax, eax
jne 0x1400015bc
mov ecx, 0xffffffff
call qword [0x140063d28]
call fcn.14001e5a0
test eax, eax
jne 0x1400015cd
xor ecx, ecx
call qword [0x140063d28]
call fcn.140007ab0
test eax, eax
jne 0x1400015de
xor ecx, ecx
call qword [0x140063d28]
call fcn.140007ce0
test eax, eax
jne 0x1400015ef
xor ecx, ecx
call qword [0x140063d28]
call fcn.140006440
cmp dword [0x14005d520], 0
jne 0x140001615
lea rcx, [0x14005cf20]
call fcn.14000e400
test eax, eax
jne 0x140001615
xor ecx, ecx
call qword [0x140063d28]
lea rcx, [0x14005cf20]
call fcn.14000ee70
test eax, eax
jne 0x14000162d
xor ecx, ecx
call qword [0x140063d28]
cmp dword [0x14005d520], 0
jne 0x140001651
cmp dword [0x14005ebc8], 1
jne 0x140001651
call fcn.140010cc0
cmp eax, 1
jne 0x140001651
xor ecx, ecx
call qword [0x140063d28]
cmp dword [0x14005cc68], 1
jne 0x140001669
call fcn.1400188f0
jmp 0x140001c8a
mov edx, 0xfffe
mov ecx, 0x40
call qword [0x140063cf0]
mov qword [rsp + 0x258], rax
cmp qword [rsp + 0x258], 0
jne 0x140001694
xor ecx, ecx
call qword [0x140063d28]
mov edx, 0x7fff
mov rcx, qword [rsp + 0x258]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x1400016b3
xor ecx, ecx
call qword [0x140063d28]
mov edx, 0xfffe
mov ecx, 0x40
call qword [0x140063cf0]
mov qword [rsp + 0x250], rax
cmp qword [rsp + 0x250], 0
jne 0x1400016de
xor ecx, ecx
call qword [0x140063d28]
mov edx, 0x7fff
mov rcx, qword [rsp + 0x250]
call qword [0x140063de8]
test eax, eax
jne 0x1400016fd
xor ecx, ecx
call qword [0x140063d28]
mov edx, 0xfffe
mov ecx, 0x40
call qword [0x140063cf0]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x140001722
xor ecx, ecx
call qword [0x140063d28]
mov r9, qword [rsp + 0x258]
lea r8, [0x1400334c0]
mov edx, 0x7fff
mov rcx, qword [rsp + 0x28]
call fcn.14002356c
mov edx, 0xfffe
mov ecx, 0x40
call qword [0x140063cf0]
mov qword [rsp + 0x460], rax
cmp qword [rsp + 0x460], 0
jne 0x14000176b
xor ecx, ecx
call qword [0x140063d28]
mov r9, qword [rsp + 0x250]
lea r8, [0x1400334e0]
mov edx, 0x7fff
mov rcx, qword [rsp + 0x460]
call fcn.14002356c
mov edx, 0xfffe
mov ecx, 0x40
call qword [0x140063cf0]
mov qword [rsp + 0x430], rax
cmp qword [rsp + 0x430], 0
jne 0x1400017b7
xor ecx, ecx
call qword [0x140063d28]
mov r9, qword [rsp + 0x250]
lea r8, [0x140033500]
mov edx, 0x7fff
mov rcx, qword [rsp + 0x430]
call fcn.14002356c
mov dword [rsp + 0x420], 0
mov qword [rsp + 0x488], 0
lea rax, [rsp + 0x490]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov dword [rsp + 0x450], 0
lea rax, [rsp + 0x454]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
mov dword [rsp + 0x478], 0
lea rax, [rsp + 0x47c]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
cmp dword [0x14005cc70], 1
jne 0x140001895
movsxd rax, dword [rsp + 0x420]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + rax*8 + 0x488], rcx
movsxd rax, dword [rsp + 0x420]
mov dword [rsp + rax*4 + 0x450], 0
movsxd rax, dword [rsp + 0x420]
mov dword [rsp + rax*4 + 0x478], 1
mov eax, dword [rsp + 0x420]
inc eax
mov dword [rsp + 0x420], eax
cmp dword [0x14005cc6c], 1
jne 0x1400018ec
movsxd rax, dword [rsp + 0x420]
mov rcx, qword [rsp + 0x460]
mov qword [rsp + rax*8 + 0x488], rcx
movsxd rax, dword [rsp + 0x420]
mov dword [rsp + rax*4 + 0x450], 1
movsxd rax, dword [rsp + 0x420]
mov dword [rsp + rax*4 + 0x478], 1
mov eax, dword [rsp + 0x420]
inc eax
mov dword [rsp + 0x420], eax
cmp dword [0x14005cc74], 1
jne 0x140001943
movsxd rax, dword [rsp + 0x420]
mov rcx, qword [rsp + 0x430]
mov qword [rsp + rax*8 + 0x488], rcx
movsxd rax, dword [rsp + 0x420]
mov dword [rsp + rax*4 + 0x450], 2
movsxd rax, dword [rsp + 0x420]
mov dword [rsp + rax*4 + 0x478], 1
mov eax, dword [rsp + 0x420]
inc eax
mov dword [rsp + 0x420], eax
mov eax, dword [rsp + 0x420]
mov dword [rsp + 0x470], eax
mov dword [rsp + 0x20], 1
cmp dword [rsp + 0x20], 0
je 0x140001c8a
mov dword [rsp + 0x104e0], 0
jmp 0x140001981
mov eax, dword [rsp + 0x104e0]
inc eax
mov dword [rsp + 0x104e0], eax
mov eax, dword [rsp + 0x470]
cmp dword [rsp + 0x104e0], eax
jge 0x140001c85
movsxd rax, dword [rsp + 0x104e0]
movsxd rcx, dword [rsp + 0x104e0]
lea r8, [rsp + 0x438]
mov edx, dword [rsp + rax*4 + 0x478]
mov rcx, qword [rsp + rcx*8 + 0x488]
call fcn.14000f060
cmp eax, 1
jne 0x140001c75
cmp dword [0x14005d520], 1
jne 0x140001b8b
movsxd rax, dword [rsp + 0x104e0]
cmp dword [rsp + rax*4 + 0x450], 1
jne 0x140001a65
xor edx, edx
mov rcx, qword [rsp + 0x438]
call qword [0x140063d30]
cmp eax, 0x102
jne 0x140001a65
lea r8, str.1D11923E_2C75_4625_AAF9_4ACBD8E47ADF
xor edx, edx
mov ecx, 0x100000
call qword [0x140063cb0]
mov qword [rsp + 0x104f8], rax
cmp qword [rsp + 0x104f8], 0
jne 0x140001a4c
mov edx, 0xa
mov rcx, qword [0x140063968]
call qword [0x140063d30]
cmp eax, 0x102
je 0x140001a4a
jmp 0x140001c8a
jmp 0x1400019e9
cmp qword [rsp + 0x104f8], 0
je 0x140001a65
mov rcx, qword [rsp + 0x104f8]
call qword [0x140063ce0]
movsxd rax, dword [rsp + 0x104e0]
cmp dword [rsp + rax*4 + 0x450], 0
jne 0x140001af3
xor edx, edx
mov rcx, qword [rsp + 0x438]
call qword [0x140063d30]
cmp eax, 0x102
jne 0x140001af3
lea r8, str.BB763DF9_02BD_49BC_8EA7_E9E1CEB3F972
xor edx, edx
mov ecx, 0x100000
call qword [0x140063cb0]
mov qword [rsp + 0x10500], rax
cmp qword [rsp + 0x10500], 0
jne 0x140001ada
mov edx, 0xa
mov rcx, qword [0x140063968]
call qword [0x140063d30]
cmp eax, 0x102
je 0x140001ad8
jmp 0x140001c8a
jmp 0x140001a77
cmp qword [rsp + 0x10500], 0
je 0x140001af3
mov rcx, qword [rsp + 0x10500]
call qword [0x140063ce0]
movsxd rax, dword [rsp + 0x104e0]
cmp dword [rsp + rax*4 + 0x450], 2
jne 0x140001b81
xor edx, edx
mov rcx, qword [rsp + 0x438]
call qword [0x140063d30]
cmp eax, 0x102
jne 0x140001b81
lea r8, str.6DB0DB22_B7F5_4960_9A6B_03BEC961A71D
xor edx, edx
mov ecx, 0x100000
call qword [0x140063cb0]
mov qword [rsp + 0x10508], rax
cmp qword [rsp + 0x10508], 0
jne 0x140001b68
mov edx, 0xa
mov rcx, qword [0x140063968]
call qword [0x140063d30]
cmp eax, 0x102
je 0x140001b66
jmp 0x140001c8a
jmp 0x140001b05
cmp qword [rsp + 0x10508], 0
je 0x140001b81
mov rcx, qword [rsp + 0x10508]
call qword [0x140063ce0]
jmp 0x140001c8a
mov qword [rsp + 0x104e8], 0
lea rax, [rsp + 0x104f0]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
mov rax, qword [0x140063968]
mov qword [rsp + 0x104e8], rax
mov rax, qword [rsp + 0x438]
mov qword [rsp + 0x104f0], rax
mov r9d, 0xffffffff
xor r8d, r8d
lea rdx, [rsp + 0x104e8]
mov ecx, 2
call qword [0x140063dc0]
xor edx, edx
mov rcx, qword [0x140063968]
call qword [0x140063d30]
cmp eax, 0x102
je 0x140001c06
mov dword [rsp + 0x20], 0
jmp 0x140001c85
cmp qword [rsp + 0x438], 0
je 0x140001c21
xor edx, edx
mov rcx, qword [rsp + 0x438]
call qword [0x140063d48]
cmp qword [rsp + 0x438], 0
je 0x140001c3a
mov rcx, qword [rsp + 0x438]
call qword [0x140063ce0]
cmp qword [rsp + 0x440], 0
je 0x140001c53
mov rcx, qword [rsp + 0x440]
call qword [0x140063ce0]
mov r8d, 0x18
xor edx, edx
lea rcx, [rsp + 0x438]
call fcn.140023480
mov ecx, 0x3e8
call qword [0x140063df0]
jmp 0x140001c80
mov ecx, 0x3e8
call qword [0x140063df0]
jmp 0x140001971
jmp 0x140001959
call fcn.14000de50
cmp dword [0x14005cc68], 1
jne 0x140001caa
mov edx, 0xffffffff
mov rcx, qword [0x140064a78]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor ecx, ecx
call qword [0x140063d28]
add rsp, 0x10510
pop rdi
ret