Function at 0x14000fb24
Capabilities:
Get common file path
Patch process command line

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x598]
sub rsp, 0x698
lea rdi, [0x1403b7688]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtQueryInformationProcess
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ebx, ebx
mov r14, rax
test rax, rax
je 0x14000fdf2
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.RtlEnterCriticalSection
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
test rax, rax
je 0x14000fdf2
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.RtlLeaveCriticalSection
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
test rax, rax
je 0x14000fdf2
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.RtlInitUnicodeString
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test rax, rax
je 0x14000fdf2
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov ecx, 0x438
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14000fdf2
lea r9d, [rbx + 0x30]
mov qword [rsp + 0x20], rbx
lea r8, [rsp + 0x30]
xor edx, edx
mov rcx, rax
call r14
lea r14d, [rbx + 8]
mov qword [rsp + 0x20], rbx
mov r9d, r14d
lea r8, [rbp + 0x5e0]
lea rdx, [rsp + 0x38]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x14000fdf2
mov rdx, qword [rbp + 0x5e0]
lea r8, [rbp + 0x5f8]
add rdx, 0x18
mov qword [rsp + 0x20], rbx
mov r9d, r14d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x14000fdf2
mov r13d, 0x104
lea rcx, [rsp + 0x60]
mov edx, r13d
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea r8, str.explorer.exe
lea edx, [r13 + 1]
lea rcx, [rsp + 0x60]
call fcn.14025a9dc
mov ecx, r13d
call fcn.14001a500
lea r8, [rsp + 0x60]
mov edx, r13d
mov rcx, rax
mov r14, rax
call fcn.140257550
mov rcx, qword [rbp + 0x5e0]
mov rcx, qword [rcx + 0x38]
call r12
mov rcx, qword [rbp + 0x5e0]
mov rdx, r14
mov rcx, qword [rcx + 0x20]
add rcx, 0x60
call rsi
mov rcx, qword [rbp + 0x5e0]
mov rdx, r14
mov rcx, qword [rcx + 0x20]
add rcx, 0x70
call rsi
mov r8d, r13d
lea rdx, [rbp + 0x380]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rax, qword [rbp + 0x5e0]
mov rcx, qword [rax + 0x18]
mov rax, qword [rbp + 0x5f8]
mov r12, qword [rcx + 0x10]
mov rcx, qword [rax + 0x10]
mov qword [rbp + 0x5f0], rcx
mov r9d, 8
mov qword [rsp + 0x20], rbx
lea r8, [rbp + 0x5e8]
mov rcx, rdi
lea rdx, [rbp + 0x5f0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x14000fdf2
mov rdx, qword [rbp + 0x5e8]
lea r8, [rbp + 0x170]
mov rcx, rdi
mov qword [rsp + 0x20], rbx
movzx r9d, word [rdx + 0x4a]
mov rdx, qword [rdx + 0x50]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x14000fdf2
lea rdx, [rbp + 0x170]
lea rcx, [rbp + 0x380]
call fcn.14025aa94
test eax, eax
je 0x14000fda1
mov rax, qword [rbp + 0x5e8]
mov rcx, qword [rax]
mov qword [rbp + 0x5f0], rcx
cmp rcx, r12
jne 0x14000fd17
jmp 0x14000fdc1
mov rcx, qword [rbp + 0x5e8]
mov rdx, r14
add rcx, 0x48
call rsi
mov rcx, qword [rbp + 0x5e8]
mov rdx, r14
add rcx, 0x58
call rsi
mov rcx, qword [rbp + 0x5e0]
mov rcx, qword [rcx + 0x38]
call r15
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp + 0x170]
lea rcx, [rsp + 0x60]
call fcn.14025aa94
test eax, eax
setne bl
mov eax, ebx
jmp 0x14000fdf4
xor eax, eax
add rsp, 0x698
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret