Function at 0x100013ad8
Capabilities:
Acquire debug privileges
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x460
mov rax, qword [0x10007d1c0]
xor rax, rsp
mov qword [rsp + 0x450], rax
xor r14d, r14d
mov r13, rcx
mov rcx, qword [rcx + 0xd8]
xor r12d, r12d
mov dword [rsp + 0x20], r14d
lea edi, [r14 + 0x19]
cmp rcx, 0xffffffffffffffff
jne 0x100013b32
mov eax, 0x80070490
jmp 0x100013dc9
mov r15d, 1
test rcx, rcx
jne 0x100013d4c
lea r8, [rsp + 0x20]
lea rcx, [0x1000033b8]
mov edx, r15d
call fcn.1000332ec
test eax, eax
jne 0x100013b75
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x1000033b8]
lea rcx, [0x1000033e0]
mov r8d, eax
call fcn.1000250f8
mov r14d, dword [rsp + 0x20]
mov ebx, 0x104
lea rcx, [rsp + 0x30]
test r14d, r14d
mov edx, ebx
cmove r14d, r15d
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x100013d5b
lea r8, [0x100003430]
lea rcx, [rsp + 0x30]
mov rdx, rbx
call fcn.100015828
mov ebx, eax
mov dword [rsp + 0x20], eax
test eax, eax
js 0x100013d86
lea r8, [rsp + 0x20]
mov rdx, rdi
mov ecx, 4
call fcn.10003228c
mov ebx, dword [rsp + 0x20]
mov r12, rax
test ebx, ebx
js 0x100013d86
mov r15d, 0xffffffff
mov esi, edi
mov ebp, edi
shl rsi, 2
cmp rsi, r15
ja 0x100013bf5
xor ebx, ebx
jmp 0x100013bfd
mov esi, r15d
mov ebx, 0x80070216
test ebx, ebx
js 0x100013d86
lea r8, [rsp + 0x24]
mov edx, esi
mov rcx, r12
call sub.KERNEL32.dll_K32EnumProcesses
test eax, eax
je 0x100013d5b
mov edi, dword [rsp + 0x24]
cmp edi, esi
jb 0x100013c87
test r12, r12
je 0x100013c3d
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r12
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rdi, [rbp + rbp]
xor r12d, r12d
cmp rdi, r15
ja 0x100013c4e
xor ebx, ebx
jmp 0x100013c56
mov edi, r15d
mov ebx, 0x80070216
mov dword [rsp + 0x20], ebx
test ebx, ebx
js 0x100013d86
lea r8, [rsp + 0x20]
mov edx, edi
mov ecx, 4
call fcn.10003228c
mov ebx, dword [rsp + 0x20]
mov r12, rax
test ebx, ebx
jns 0x100013be4
jmp 0x100013d82
xor esi, esi
shr edi, 2
lea r15d, [rsi + 1]
test edi, edi
je 0x100013d2d
mov rbp, r12
mov r8d, dword [rbp]
mov edx, r15d
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [rsp + 0x20], 0x104
mov rbx, rax
test rax, rax
je 0x100013d05
cmp rax, 0xffffffffffffffff
je 0x100013cf6
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x240]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
test eax, eax
je 0x100013cf6
lea rdx, [rsp + 0x240]
lea rcx, [rsp + 0x30]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
je 0x100013d12
cmp rbx, 0xffffffffffffffff
je 0x100013d05
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add esi, r15d
add rbp, 4
cmp esi, edi
jae 0x100013d2d
jmp 0x100013c9b
lea rdx, [rsp + 0x240]
lea rcx, [0x100003470]
call fcn.1000250f8
mov qword [r13 + 0xd8], rbx
mov rcx, qword [r13 + 0xd8]
test rcx, rcx
jne 0x100013d4c
lea rcx, [0x1000034b0]
call fcn.1000250f8
mov ebx, 0x80070490
jmp 0x100013d86
lea rdx, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x100013d71
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x100013d82
cmp dword [rsp + 0x24], 0x103
jne 0x100013d7f
xor ebx, ebx
jmp 0x100013d98
mov ebx, r15d
test ebx, ebx
jns 0x100013d98
cmp qword [r13 + 0xd8], 0
jne 0x100013d98
or qword [r13 + 0xd8], 0xffffffffffffffff
test r12, r12
je 0x100013db1
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r12
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test r14d, r14d
je 0x100013dc7
lea rcx, [0x1000033b8]
xor r8d, r8d
xor edx, edx
call fcn.1000332ec
mov eax, ebx
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.100068440
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret