Function at 0x140001000
Capabilities:
Get common file path
Terminate process

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
mov eax, 0x10510
call fcn.140022930
sub rsp, rax
mov ecx, dword [0x14005b948]
call fcn.1400143b0
test eax, eax
jne 0x140001039
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
xor eax, eax
mov word [rsp + 0x40], ax
lea rax, [rsp + 0x42]
mov rdi, rax
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
mov r8d, 0x104
lea rdx, [rsp + 0x40]
xor ecx, ecx
call qword [0x140061f80]
test eax, eax
jne 0x140001070
xor ecx, ecx
call qword [0x140061f88]
call qword [0x140061f20]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x400], 0x18
mov qword [rsp + 0x408], 0
mov dword [rsp + 0x410], 1
lea r8, str.D8B5ED56_F07B_417B_9B34_108767A2DB83
xor edx, edx
lea rcx, [rsp + 0x400]
call qword [0x140061f28]
mov qword [0x140061bd0], rax
cmp qword [0x140061bd0], 0
jne 0x1400010cd
xor ecx, ecx
call qword [0x140061f88]
cmp dword [0x14005cf24], 1
jne 0x1400010db
call fcn.14000ab90
call fcn.1400040b0
cmp eax, 1
jne 0x14000117a
lea r8, str.27CC362A_DCCC_4251_9D0F_E199BDC0FE00
xor edx, edx
mov ecx, 0x100002
call qword [sym.imp.KERNEL32.dll_OpenEventW]
mov qword [0x140061bc8], rax
cmp qword [0x140061bc8], 0
jne 0x140001116
xor ecx, ecx
call qword [0x140061fe8]
mov qword [rsp + 0x4a0], 0
lea r8, str.2EA98070_A41F_4614_A8C4_71D98AE345A5
xor edx, edx
mov ecx, 0x100002
call qword [0x140061fd8]
mov qword [rsp + 0x4a0], rax
cmp qword [rsp + 0x4a0], 0
jne 0x140001151
xor ecx, ecx
call qword [0x140061fe8]
mov rcx, qword [rsp + 0x4a0]
call qword [0x140061fe0]
mov rcx, qword [rsp + 0x4a0]
call qword [0x140061f40]
call fcn.140017bd0
xor ecx, ecx
call qword [0x140061fe8]
call fcn.140009e70
test eax, eax
jne 0x14000118b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov qword [rsp + 0x468], 0
lea r8, str.F1B7F7DF_7158_482D_B6E9_CE5584516649
xor edx, edx
mov ecx, 0x100000
call qword [0x140061f10]
mov qword [rsp + 0x468], rax
cmp qword [rsp + 0x468], 0
je 0x1400011d4
mov rcx, qword [rsp + 0x468]
call qword [0x140061f40]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea r8, str.F1B7F7DF_7158_482D_B6E9_CE5584516649
mov edx, 1
xor ecx, ecx
call qword [0x140061f28]
test rax, rax
jne 0x1400011f5
xor ecx, ecx
call qword [0x140061f88]
cmp dword [0x14005cf2c], 1
jne 0x140001231
cmp dword [0x140061cd8], 0
jne 0x140001231
call fcn.140018310
test eax, eax
jne 0x140001231
call fcn.140018b70
cmp eax, 0xa
jb 0x140001231
lea rcx, [rsp + 0x40]
call fcn.140004440
cmp eax, 1
jne 0x140001231
xor ecx, ecx
call qword [0x140061f88]
cmp dword [0x14005b960], 1
jne 0x140001297
cmp dword [0x140061cdc], 0
jne 0x140001297
call fcn.140018b70
cmp eax, 0xa
jb 0x140001297
call fcn.140018310
cmp eax, 1
jne 0x140001297
lea rdx, reloc.OLEAUT32.dll_SysReAllocString
mov ecx, dword [0x14005b964]
call fcn.14000fb20
mov qword [rsp + 0x4a8], rax
cmp qword [rsp + 0x4a8], 0
je 0x140001297
mov rcx, qword [rsp + 0x4a8]
call fcn.140010040
mov rcx, qword [rsp + 0x4a8]
call qword [0x140061f68]
lea r8, str.02EFD93A_60FD_4F4E_840B_D8BD5CE3161D
mov edx, 1
xor ecx, ecx
call qword [0x140061f28]
mov qword [rsp + 0x428], rax
cmp qword [rsp + 0x428], 0
jne 0x1400012c9
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call qword [0x140062010]
cmp eax, 0xb7
jne 0x1400012e1
mov ecx, 0xffffffff
call qword [0x140061f88]
lea r8, str.626B5B93_8380_4563_9A78_71DC22405C74
mov edx, 1
xor ecx, ecx
call qword [0x140061f28]
mov qword [rsp + 0x418], rax
cmp qword [rsp + 0x418], 0
jne 0x140001310
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rcx, str.626B5B93_8380_4563_9A78_71DC22405C74
call fcn.1400187d0
lea r9, str.27CC362A_DCCC_4251_9D0F_E199BDC0FE00
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call qword [0x140061f70]
mov qword [0x140061bc8], rax
cmp qword [0x140061bc8], 0
jne 0x14000134f
mov ecx, 0xffffffff
call qword [0x140061f88]
call qword [0x140062010]
cmp eax, 0xb7
jne 0x140001364
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rcx, str.27CC362A_DCCC_4251_9D0F_E199BDC0FE00
call fcn.1400187d0
cmp dword [0x14005b538], 1
jne 0x14000156c
mov r8d, 0x7fff
lea rdx, [rsp + 0x4b0]
xor ecx, ecx
call qword [0x140061f80]
test eax, eax
je 0x140001564
mov dx, 0x5c
lea rcx, [rsp + 0x4b0]
call fcn.140001ca0
xor ecx, ecx
mov word [rax], cx
lea rdx, [rsp + 0x104b0]
lea rcx, [0x14005b270]
call fcn.14000ad30
mov qword [rsp + 0x104b8], rax
cmp qword [rsp + 0x104b8], 0
je 0x14000155a
mov dx, 0x5c
mov rcx, qword [rsp + 0x104b8]
call fcn.140001ca0
xor ecx, ecx
mov word [rax], cx
mov edx, 0xfffe
mov ecx, 0x40
call qword [0x140061f50]
mov qword [rsp + 0x104c0], rax
cmp qword [rsp + 0x104c0], 0
je 0x14000154a
mov rdx, qword [rsp + 0x104c0]
mov ecx, 0x7fff
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x140001534
mov dx, 0x5c
mov rcx, qword [rsp + 0x104c0]
call fcn.140001ca0
xor ecx, ecx
mov word [rax], cx
mov rdx, qword [rsp + 0x104b8]
lea rcx, [rsp + 0x4b0]
call qword [0x140062218]
test eax, eax
je 0x140001532
mov rdx, qword [rsp + 0x104c0]
lea rcx, [rsp + 0x4b0]
call qword [0x140062218]
test eax, eax
je 0x140001532
call qword [0x140061f18]
mov qword [rsp + 0x104d8], rax
lea rdx, [rsp + 0x104c8]
mov rcx, qword [rsp + 0x104d8]
call qword [0x1400626b8]
mov qword [rsp + 0x104d0], rax
lea rdx, str.05B9AB31_2753_4C90_8491_8E317133C2F4
mov rax, qword [rsp + 0x104d0]
mov rcx, qword [rax + 8]
call qword [0x140062218]
test eax, eax
je 0x140001532
lea rdx, str.CAEA0135_E7B5_46DE_9CC0_B3577FA4C2DA
mov rax, qword [rsp + 0x104d0]
mov rcx, qword [rax + 8]
call qword [0x140062218]
test eax, eax
je 0x140001532
lea rdx, str.EE886A29_5EFF_4881_A59C_20BC74837648
mov rax, qword [rsp + 0x104d0]
mov rcx, qword [rax + 8]
call qword [0x140062218]
test eax, eax
je 0x140001532
mov r9d, 1
lea r8, [0x14005b53c]
lea rdx, [0x14005b606]
xor ecx, ecx
call qword [0x140062270]
cmp eax, 2
jne 0x140001532
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x14000153c
xor ecx, ecx
call qword [0x140061f88]
mov rcx, qword [rsp + 0x104c0]
call qword [0x140061f68]
mov rcx, qword [rsp + 0x104b8]
call qword [0x140061f68]
jmp 0x140001562
xor ecx, ecx
call qword [0x140061f88]
jmp 0x14000156c
xor ecx, ecx
call qword [0x140061f88]
lea rdx, [rsp + 0x260]
mov cx, 2
call qword [0x140062818]
test eax, eax
je 0x14000158a
xor ecx, ecx
call qword [0x140061f88]
call fcn.140009e50
test eax, eax
jne 0x14000159e
mov ecx, 0xffffffff
call qword [0x140061f88]
call fcn.14001d870
test eax, eax
jne 0x1400015af
xor ecx, ecx
call qword [0x140061f88]
call fcn.140003c00
test eax, eax
jne 0x1400015c0
xor ecx, ecx
call qword [0x140061f88]
call fcn.140003e30
test eax, eax
jne 0x1400015d1
xor ecx, ecx
call qword [0x140061f88]
call fcn.140002590
cmp dword [0x14005b870], 0
jne 0x1400015f7
lea rcx, [0x14005b270]
call fcn.14000a410
test eax, eax
jne 0x1400015f7
xor ecx, ecx
call qword [0x140061f88]
lea rcx, [0x14005b270]
call fcn.14000ae80
test eax, eax
jne 0x14000160f
xor ecx, ecx
call qword [0x140061f88]
cmp dword [0x14005b870], 0
jne 0x140001633
cmp dword [0x14005cf18], 1
jne 0x140001633
call fcn.14000ccd0
cmp eax, 1
jne 0x140001633
xor ecx, ecx
call qword [0x140061f88]
cmp dword [0x14005afb8], 1
jne 0x14000164b
call fcn.140017bd0
jmp 0x140001c6c
mov edx, 0xfffe
mov ecx, 0x40
call qword [0x140061f50]
mov qword [rsp + 0x258], rax
cmp qword [rsp + 0x258], 0
jne 0x140001676
xor ecx, ecx
call qword [0x140061f88]
mov edx, 0x7fff
mov rcx, qword [rsp + 0x258]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x140001695
xor ecx, ecx
call qword [0x140061f88]
mov edx, 0xfffe
mov ecx, 0x40
call qword [0x140061f50]
mov qword [rsp + 0x250], rax
cmp qword [rsp + 0x250], 0
jne 0x1400016c0
xor ecx, ecx
call qword [0x140061f88]
mov edx, 0x7fff
mov rcx, qword [rsp + 0x250]
call qword [0x140062048]
test eax, eax
jne 0x1400016df
xor ecx, ecx
call qword [0x140061f88]
mov edx, 0xfffe
mov ecx, 0x40
call qword [0x140061f50]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x140001704
xor ecx, ecx
call qword [0x140061f88]
mov r9, qword [rsp + 0x258]
lea r8, [0x1400324c0]
mov edx, 0x7fff
mov rcx, qword [rsp + 0x28]
call fcn.14002283c
mov edx, 0xfffe
mov ecx, 0x40
call qword [0x140061f50]
mov qword [rsp + 0x460], rax
cmp qword [rsp + 0x460], 0
jne 0x14000174d
xor ecx, ecx
call qword [0x140061f88]
mov r9, qword [rsp + 0x250]
lea r8, [0x1400324e0]
mov edx, 0x7fff
mov rcx, qword [rsp + 0x460]
call fcn.14002283c
mov edx, 0xfffe
mov ecx, 0x40
call qword [0x140061f50]
mov qword [rsp + 0x430], rax
cmp qword [rsp + 0x430], 0
jne 0x140001799
xor ecx, ecx
call qword [0x140061f88]
mov r9, qword [rsp + 0x250]
lea r8, [0x140032500]
mov edx, 0x7fff
mov rcx, qword [rsp + 0x430]
call fcn.14002283c
mov dword [rsp + 0x420], 0
mov qword [rsp + 0x488], 0
lea rax, [rsp + 0x490]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov dword [rsp + 0x450], 0
lea rax, [rsp + 0x454]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
mov dword [rsp + 0x478], 0
lea rax, [rsp + 0x47c]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
cmp dword [0x14005afc0], 1
jne 0x140001877
movsxd rax, dword [rsp + 0x420]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + rax*8 + 0x488], rcx
movsxd rax, dword [rsp + 0x420]
mov dword [rsp + rax*4 + 0x450], 0
movsxd rax, dword [rsp + 0x420]
mov dword [rsp + rax*4 + 0x478], 1
mov eax, dword [rsp + 0x420]
inc eax
mov dword [rsp + 0x420], eax
cmp dword [0x14005afbc], 1
jne 0x1400018ce
movsxd rax, dword [rsp + 0x420]
mov rcx, qword [rsp + 0x460]
mov qword [rsp + rax*8 + 0x488], rcx
movsxd rax, dword [rsp + 0x420]
mov dword [rsp + rax*4 + 0x450], 1
movsxd rax, dword [rsp + 0x420]
mov dword [rsp + rax*4 + 0x478], 1
mov eax, dword [rsp + 0x420]
inc eax
mov dword [rsp + 0x420], eax
cmp dword [0x14005afc4], 1
jne 0x140001925
movsxd rax, dword [rsp + 0x420]
mov rcx, qword [rsp + 0x430]
mov qword [rsp + rax*8 + 0x488], rcx
movsxd rax, dword [rsp + 0x420]
mov dword [rsp + rax*4 + 0x450], 2
movsxd rax, dword [rsp + 0x420]
mov dword [rsp + rax*4 + 0x478], 1
mov eax, dword [rsp + 0x420]
inc eax
mov dword [rsp + 0x420], eax
mov eax, dword [rsp + 0x420]
mov dword [rsp + 0x470], eax
mov dword [rsp + 0x20], 1
cmp dword [rsp + 0x20], 0
je 0x140001c6c
mov dword [rsp + 0x104e0], 0
jmp 0x140001963
mov eax, dword [rsp + 0x104e0]
inc eax
mov dword [rsp + 0x104e0], eax
mov eax, dword [rsp + 0x470]
cmp dword [rsp + 0x104e0], eax
jge 0x140001c67
movsxd rax, dword [rsp + 0x104e0]
movsxd rcx, dword [rsp + 0x104e0]
lea r8, [rsp + 0x438]
mov edx, dword [rsp + rax*4 + 0x478]
mov rcx, qword [rsp + rcx*8 + 0x488]
call fcn.14000b070
cmp eax, 1
jne 0x140001c57
cmp dword [0x14005b870], 1
jne 0x140001b6d
movsxd rax, dword [rsp + 0x104e0]
cmp dword [rsp + rax*4 + 0x450], 1
jne 0x140001a47
xor edx, edx
mov rcx, qword [rsp + 0x438]
call qword [0x140061f90]
cmp eax, 0x102
jne 0x140001a47
lea r8, str.0E6BB1D8_7FDC_40AA_8933_C697666C75C0
xor edx, edx
mov ecx, 0x100000
call qword [0x140061f10]
mov qword [rsp + 0x104f8], rax
cmp qword [rsp + 0x104f8], 0
jne 0x140001a2e
mov edx, 0xa
mov rcx, qword [0x140061bc8]
call qword [0x140061f90]
cmp eax, 0x102
je 0x140001a2c
jmp 0x140001c6c
jmp 0x1400019cb
cmp qword [rsp + 0x104f8], 0
je 0x140001a47
mov rcx, qword [rsp + 0x104f8]
call qword [0x140061f40]
movsxd rax, dword [rsp + 0x104e0]
cmp dword [rsp + rax*4 + 0x450], 0
jne 0x140001ad5
xor edx, edx
mov rcx, qword [rsp + 0x438]
call qword [0x140061f90]
cmp eax, 0x102
jne 0x140001ad5
lea r8, str.2C7972A9_4B53_4F08_9B5E_E00DC26C3EA5
xor edx, edx
mov ecx, 0x100000
call qword [0x140061f10]
mov qword [rsp + 0x10500], rax
cmp qword [rsp + 0x10500], 0
jne 0x140001abc
mov edx, 0xa
mov rcx, qword [0x140061bc8]
call qword [0x140061f90]
cmp eax, 0x102
je 0x140001aba
jmp 0x140001c6c
jmp 0x140001a59
cmp qword [rsp + 0x10500], 0
je 0x140001ad5
mov rcx, qword [rsp + 0x10500]
call qword [0x140061f40]
movsxd rax, dword [rsp + 0x104e0]
cmp dword [rsp + rax*4 + 0x450], 2
jne 0x140001b63
xor edx, edx
mov rcx, qword [rsp + 0x438]
call qword [0x140061f90]
cmp eax, 0x102
jne 0x140001b63
lea r8, str.DE295051_134E_4365_BE09_671AE33DBFE4
xor edx, edx
mov ecx, 0x100000
call qword [0x140061f10]
mov qword [rsp + 0x10508], rax
cmp qword [rsp + 0x10508], 0
jne 0x140001b4a
mov edx, 0xa
mov rcx, qword [0x140061bc8]
call qword [0x140061f90]
cmp eax, 0x102
je 0x140001b48
jmp 0x140001c6c
jmp 0x140001ae7
cmp qword [rsp + 0x10508], 0
je 0x140001b63
mov rcx, qword [rsp + 0x10508]
call qword [0x140061f40]
jmp 0x140001c6c
mov qword [rsp + 0x104e8], 0
lea rax, [rsp + 0x104f0]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
mov rax, qword [0x140061bc8]
mov qword [rsp + 0x104e8], rax
mov rax, qword [rsp + 0x438]
mov qword [rsp + 0x104f0], rax
mov r9d, 0xffffffff
xor r8d, r8d
lea rdx, [rsp + 0x104e8]
mov ecx, 2
call qword [0x140062020]
xor edx, edx
mov rcx, qword [0x140061bc8]
call qword [0x140061f90]
cmp eax, 0x102
je 0x140001be8
mov dword [rsp + 0x20], 0
jmp 0x140001c67
cmp qword [rsp + 0x438], 0
je 0x140001c03
xor edx, edx
mov rcx, qword [rsp + 0x438]
call qword [0x140061fa8]
cmp qword [rsp + 0x438], 0
je 0x140001c1c
mov rcx, qword [rsp + 0x438]
call qword [0x140061f40]
cmp qword [rsp + 0x440], 0
je 0x140001c35
mov rcx, qword [rsp + 0x440]
call qword [0x140061f40]
mov r8d, 0x18
xor edx, edx
lea rcx, [rsp + 0x438]
call fcn.140022750
mov ecx, 0x3e8
call qword [0x140062050]
jmp 0x140001c62
mov ecx, 0x3e8
call qword [0x140062050]
jmp 0x140001953
jmp 0x14000193b
call fcn.140009e60
cmp dword [0x14005afb8], 1
jne 0x140001c8c
mov edx, 0xffffffff
mov rcx, qword [0x140062cc8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor ecx, ecx
call qword [0x140061f88]
add rsp, 0x10510
pop rdi
ret