Function at 0x1400924c0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x1a0]
sub rsp, 0x2a0
mov rax, qword [0x1401198e8]
xor rax, rsp
mov qword [rbp + 0x190], rax
mov r15, rcx
xor r12d, r12d
mov dword [rsp + 0x70], r12d
mov r9, qword [rcx + 8]
mov rcx, qword [0x140133ec8]
mov r10d, dword [0x140119014]
mov edx, dword [0x14011901c]
sub edx, r10d
mov r8d, dword [0x140119010]
mov eax, dword [0x140119018]
sub eax, r8d
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r9
mov dword [rsp + 0x38], edx
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], r10d
mov dword [rsp + 0x20], r8d
mov r9d, 0x5600904d
xor r8d, r8d
lea rdx, str.SysListView32
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov qword [r15 + 0xb8], rax
mov qword [r15 + 0x58], rax
inc dword [0x140133e9c]
mov r9d, 0x10424
xor r8d, r8d
mov edx, 0x1036
mov rcx, qword [r15 + 0xb8]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp qword [0x140133cf8], r12
jne 0x140092919
mov dword [rsp + 0x20], 8
mov edx, 0x10
mov ecx, edx
mov r9d, edx
lea r8d, [r12 + 0x21]
call qword [sym.imp.COMCTL32.dll_ImageList_Create]
mov qword [0x140133cf8], rax
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadIconW]
mov r8, rax
mov rsi, 0xffffffffffffffff
mov edx, esi
mov rcx, qword [0x140133cf8]
call qword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
mov dword [rsp + 0x20], 8
mov edx, 0x20
mov ecx, edx
lea r9d, [r12 + 0x10]
lea r8d, [r12 + 0x21]
call qword [sym.imp.COMCTL32.dll_ImageList_Create]
mov qword [0x140133d00], rax
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadIconW]
mov r8, rax
mov edx, esi
mov rcx, qword [0x140133d00]
call qword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
mov word [rsp + 0x60], r12w
mov edx, 0x104
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call fcn.140008180
mov rcx, rax
test rax, rax
je 0x140092a87
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x68], rax
lea rax, [rbp - 0x80]
cmp rax, 0x10000
jae 0x140092682
lea rax, [rbp - 0x80]
movzx edx, ax
lea rcx, [rsp + 0x68]
call fcn.140006660
jmp 0x1400926ac
lea rcx, [rbp - 0x80]
mov rax, rsi
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140092690
mov r8d, eax
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x68]
call fcn.1400068f0
nop
lea rdx, [0x1400da0a0]
mov rax, rsi
inc rax
cmp word [rdx + rax*2], 0
jne 0x1400926b6
mov r8d, eax
lea rcx, [rsp + 0x68]
call fcn.140012e90
mov rbx, qword [rsp + 0x68]
cmp dword [rbx - 8], 1
jle 0x1400926ea
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0x68]
call fcn.140006a80
mov rbx, qword [rsp + 0x68]
lea r8, [rsp + 0x60]
mov rdx, rbx
mov rcx, qword [0x140133ec8]
call qword [sym.imp.SHELL32.dll_ExtractAssociatedIconW]
mov r8, rax
mov edx, esi
mov rcx, qword [0x140133cf8]
call qword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
mov word [rsp + 0x60], r12w
cmp dword [rbx - 8], 1
jle 0x14009272f
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0x68]
call fcn.140006a80
mov rbx, qword [rsp + 0x68]
lea r8, [rsp + 0x60]
mov rdx, rbx
mov rcx, qword [0x140133ec8]
call qword [sym.imp.SHELL32.dll_ExtractAssociatedIconW]
mov r8, rax
mov edx, esi
mov rcx, qword [0x140133d00]
call qword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
lea rcx, [rbp - 0x80]
mov rax, rsi
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140092760
mov r8d, eax
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x68]
call fcn.1400068f0
lea rdx, str.drivers_acpi.sys
mov rax, rsi
inc rax
cmp word [rdx + rax*2], 0
jne 0x140092785
mov r8d, eax
lea rcx, [rsp + 0x68]
call fcn.140012e90
mov word [rsp + 0x60], r12w
mov rbx, qword [rsp + 0x68]
cmp dword [rbx - 8], 1
jle 0x1400927bf
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0x68]
call fcn.140006a80
mov rbx, qword [rsp + 0x68]
lea r8, [rsp + 0x60]
mov rdx, rbx
mov rcx, qword [0x140133ec8]
call qword [sym.imp.SHELL32.dll_ExtractAssociatedIconW]
mov r8, rax
mov edx, esi
mov rcx, qword [0x140133cf8]
call qword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
mov word [rsp + 0x60], r12w
cmp dword [rbx - 8], 1
jle 0x140092804
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0x68]
call fcn.140006a80
mov rbx, qword [rsp + 0x68]
lea r8, [rsp + 0x60]
mov rdx, rbx
mov rcx, qword [0x140133ec8]
call qword [sym.imp.SHELL32.dll_ExtractAssociatedIconW]
mov r8, rax
mov edx, esi
mov rcx, qword [0x140133d00]
call qword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
xor edx, edx
lea ecx, [rdx + 4]
call fcn.14003eef0
mov r8, rax
mov edx, esi
mov rcx, qword [0x140133cf8]
call qword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
mov dl, 1
mov ecx, 4
call fcn.14003eef0
mov r8, rax
mov edx, esi
mov rcx, qword [0x140133d00]
call qword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
mov dword [rsp + 0x78], 0x96
mov dword [rsp + 0x7c], 0x92
lea r14, [rsp + 0x78]
nop word [rax + rax]
mov edx, 0x10
lea r8d, [rdx + 0x54]
mov ecx, dword [r14]
call fcn.14008d370
mov r8, rax
mov edx, esi
mov rcx, qword [0x140133cf8]
call qword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
mov edx, 0x20
lea r8d, [rdx + 0x44]
mov ecx, dword [r14]
call fcn.14008d370
mov r8, rax
mov edx, esi
mov rcx, qword [0x140133d00]
call qword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
add r14, 4
lea rax, [rbp - 0x80]
cmp r14, rax
jne 0x140092880
call fcn.140061f10
xor r8d, r8d
mov rdx, qword [0x140133cf8]
mov rcx, rax
call fcn.140062520
call fcn.140061f10
mov r8b, 1
mov rdx, qword [0x140133d00]
mov rcx, rax
call fcn.140062520
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x140092919
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov r9, qword [0x140133cf8]
mov edx, 0x1003
mov r8d, 1
mov rcx, qword [r15 + 0xb8]
call qword [sym.imp.USER32.dll_SendMessageW]
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x70], 1
mov eax, 1
and eax, 0xfffffffe
mov dword [rsp + 0x70], eax
lea rcx, [r15 + 0x70]
mov rdx, qword [r15 + 0xb8]
call fcn.140090fc0
mov rbx, rax
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], r12d
mov r9d, 0x190
xor r8d, r8d
lea rdx, str.Autoruns_Entry
mov rcx, rax
call fcn.14008da40
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], r12d
mov r9d, 0xf0
xor r8d, r8d
lea rdx, str.Description
mov rcx, rbx
call fcn.14008da40
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], r12d
mov r9d, 0xc8
xor r8d, r8d
lea rdx, str.Publisher
mov rcx, rbx
call fcn.14008da40
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], r12d
mov r9d, 0x190
xor r8d, r8d
lea rdx, str.Image_Path
mov rcx, rbx
call fcn.14008da40
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], r12d
mov r9d, 0x96
xor r8d, r8d
lea rdx, str.Timestamp
mov rcx, rbx
call fcn.14008da40
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], r12d
mov r9d, 0x78
xor r8d, r8d
lea rdx, str.Virus_Total
mov rcx, rbx
call fcn.14008da40
mov rcx, rbx
call fcn.14003ec00
mov rcx, r15
call fcn.140096630
mov rcx, r15
call fcn.140096890
xor eax, eax
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.14009c570
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov ecx, 0x80004005
call fcn.140007f00
int3