Function at 0x14008dcc0
Capabilities:
Get common file path
Persist via run registry key

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], rbx
mov byte [r11 + 0x18], r8b
mov dword [rsp + 0x10], edx
mov qword [r11 + 8], rcx
push rdi
sub rsp, 0x840
mov rax, qword [0x140212c80]
xor rax, rsp
mov qword [rsp + 0x830], rax
mov edi, dword [r11 + 0x10]
mov rbx, rcx
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x610], edi
lea rax, [r11 - 0x228]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, edi
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edx, eax
test eax, eax
jns 0x14008dfbe
mov eax, edi
and eax, 0xffff00ff
and edi, 0xffff00ff
cmp edi, 0x24
jne 0x14008dd63
mov edx, 0x104
lea rcx, [rsp + 0x620]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x14008e1d5
cmp eax, 0x104
ja 0x14008e21b
jmp 0x14008dfbe
cmp eax, 0x25
jne 0x14008dd93
mov edx, 0x104
lea rcx, [rsp + 0x620]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x14008e264
cmp eax, 0x104
ja 0x14008e2b0
jmp 0x14008dfbe
cmp eax, 0x26
jne 0x14008dda5
mov rcx, rbx
call fcn.14008e390
jmp 0x14008dffe
cmp eax, 0x2b
jne 0x14008ddb7
mov rcx, rbx
call fcn.14008e400
jmp 0x14008dffe
cmp eax, 0x23
jne 0x14008de99
lea rax, str.Common_AppData
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohl
lea rax, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 0x40
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x30], xmm0
lea r8, [rsp + 0x30]
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x3d0]
call fcn.1400544e0
nop
mov rax, qword [rsp + 0x3d0]
mov qword [rsp + 0x180], rax
lea rdx, [rsp + 0x3d8]
lea rcx, [rsp + 0x188]
call fcn.140054750
mov eax, dword [rsp + 0x608]
mov dword [rsp + 0x3b8], eax
mov eax, dword [rsp + 0x60c]
mov dword [rsp + 0x3bc], eax
mov byte [rsp + 0x3c0], 1
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x30], xmm0
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x180]
mov rcx, rbx
call fcn.1400908b0
nop
lea rcx, [rsp + 0x180]
call fcn.140054450
nop
lea rcx, [rsp + 0x5e0]
call fcn.140054870
jmp 0x14008dffe
cmp eax, 0x1a
jne 0x14008e047
lea rax, str.AppData
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 7
lea rax, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0x40
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
lea r8, [rsp + 0x50]
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x3d0]
call fcn.1400544e0
nop
mov rax, qword [rsp + 0x3d0]
mov qword [rsp + 0x180], rax
lea rdx, [rsp + 0x3d8]
lea rcx, [rsp + 0x188]
call fcn.140054750
mov eax, dword [rsp + 0x608]
mov dword [rsp + 0x3b8], eax
mov eax, dword [rsp + 0x60c]
mov dword [rsp + 0x3bc], eax
mov byte [rsp + 0x3c0], 1
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x180]
mov rcx, rbx
call fcn.1400908b0
nop
lea rcx, [rsp + 0x180]
call fcn.140054450
nop
lea rcx, [rsp + 0x5e0]
call fcn.140054870
mov rax, rbx
jmp 0x14008e001
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0
lea rax, [rsp + 0x620]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x14008dfe3
lea rdx, [rsp + 0x620]
mov rcx, rbx
call fcn.1400258d0
mov rax, rbx
mov rcx, qword [rsp + 0x830]
xor rcx, rsp
call fcn.140133600
mov rbx, qword [rsp + 0x868]
add rsp, 0x840
pop rdi
ret
cmp eax, 0x1c
jne 0x14008e191
lea rax, str.Local_AppData
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], recvfrom
lea rax, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 0x40
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
lea r8, [rsp + 0x30]
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x3d0]
call fcn.1400544e0
nop
mov rax, qword [rsp + 0x3d0]
mov qword [rsp + 0x180], rax
lea rdx, [rsp + 0x3d8]
lea rcx, [rsp + 0x188]
call fcn.140054750
mov eax, dword [rsp + 0x608]
mov dword [rsp + 0x3b8], eax
mov eax, dword [rsp + 0x60c]
mov dword [rsp + 0x3bc], eax
mov byte [rsp + 0x3c0], 1
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x30], xmm0
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x180]
mov rcx, rbx
call fcn.1400908b0
nop
lea rcx, [rsp + 0x180]
call fcn.140054450
nop
lea rcx, [rsp + 0x5e0]
call fcn.140054870
mov rax, rbx
jmp 0x14008e001
lea rcx, str.Unable_to_retrieve_a_path_of_the_known_folder____
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], getservbyname
lea r9, [rsp + 0x610]
lea r8, [rsp + 0x30]
lea rcx, [rsp + 0x158]
call fcn.14008e470
lea rdx, [0x14020e468]
lea rcx, [rsp + 0x158]
call fcn.140135f84
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Unable_to_retrieve_a_path_of_the_known_folder____
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], getservbyname
lea r9, [rsp + 0x610]
lea r8, [rsp + 0x40]
mov edx, eax
lea rcx, [rsp + 0x68]
call fcn.14008e470
lea rdx, [0x14020e468]
lea rcx, [rsp + 0x68]
call fcn.140135f84
int3
lea rcx, str.Unable_to_retrieve_a_path_of_the_known_folder____
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], getservbyname
lea r9, [rsp + 0x610]
lea r8, [rsp + 0x40]
mov edx, 0xea
lea rcx, [rsp + 0x90]
call fcn.14008e470
lea rdx, [0x14020e468]
lea rcx, [rsp + 0x90]
call fcn.140135f84
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Unable_to_retrieve_a_path_of_the_known_folder____
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], getservbyname
lea r9, [rsp + 0x610]
lea r8, [rsp + 0x40]
mov edx, eax
lea rcx, [rsp + 0xb8]
call fcn.14008e470
lea rdx, [0x14020e468]
lea rcx, [rsp + 0xb8]
call fcn.140135f84
int3
lea rcx, str.Unable_to_retrieve_a_path_of_the_known_folder____
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], getservbyname
lea r9, [rsp + 0x610]
lea r8, [rsp + 0x40]
mov edx, 0xea
lea rcx, [rsp + 0xe0]
call fcn.14008e470
lea rdx, [0x14020e468]
lea rcx, [rsp + 0xe0]
call fcn.140135f84
int3