Function at 0x14000e370
Capabilities:
Acquire debug privileges
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x40
mov rax, qword [0x1401507e0]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rax, vtable.CBackDllApp.0
mov rbx, rcx
xor edx, edx
mov qword [rcx], rax
xor eax, eax
mov dword [0x140151e48], eax
mov dword [rcx + 0xac], eax
lea rcx, [0x140152e60]
lea r8d, [rax + 0x50]
call fcn.140013580
lea rcx, [rbx + 0xc80]
xor edx, edx
mov r8d, 0x104
call fcn.140013580
xor edx, edx
lea rcx, [rbx + 0xc0]
lea r8d, [rdx + 0x60]
call fcn.140013580
xor edx, edx
lea rcx, [rbx + 0x120]
lea r8d, [rdx + 0x78]
call fcn.140013580
lea rcx, [rbx + 0x198]
xor edx, edx
mov r8d, 0x184
call fcn.140013580
lea rcx, [rbx + 0x33c]
xor edx, edx
mov r8d, 0x104
call fcn.140013580
lea rcx, [rbx + 0x440]
xor edx, edx
mov r8d, 0x104
call fcn.140013580
lea rcx, [rbx + 0x544]
xor edx, edx
mov r8d, 0x104
call fcn.140013580
lea rcx, [rbx + 0x648]
xor edx, edx
mov r8d, 0x104
call fcn.140013580
lea rcx, [rbx + 0xa78]
xor edx, edx
mov r8d, 0x104
call fcn.140013580
lea rcx, [rbx + 0xb7c]
xor edx, edx
mov r8d, 0x104
call fcn.140013580
movzx edx, word [0x1400c04b4]
movzx eax, word [0x1400c04b0]
movzx r9d, word [0x1400c04ac]
movzx r8d, word [reloc.WS2_32.dll_sendto]
mov dword [rsp + 0x28], edx
lea rdx, str._u._u._u._u
lea rcx, [rbx + 0x31c]
mov dword [rsp + 0x20], eax
call fcn.140014060
call fcn.14000f570
lea rcx, str.SeDebugPrivilege
call fcn.1400068a0
lea rdx, [rbx + 0x648]
mov ecx, 0x103
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x14000e510
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14000e510
mov dword [rbx + 0x648], 0x575c3a43
mov dword [rbx + 0x64c], 0x6f646e69
mov dword [rbx + 0x650], 0x5c7377
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rbx + 0x648]
repne scasb al, byte [rdi]
not rcx
dec rcx
test ecx, ecx
je 0x14000e550
lea eax, [rcx - 1]
cmp byte [rax + rbx + 0x648], 0x5c
je 0x14000e550
xor eax, eax
lea rdi, [rbx + 0x648]
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
movzx eax, word [0x14002267c]
mov word [rdi - 1], ax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call fcn.140013e2c
xor eax, eax
mov qword [rbx + 0x74c], rax
mov qword [rbx + 0x754], rax
mov qword [rbx + 0x75c], rax
mov qword [rbx + 0x764], rax
call fcn.140004300
xor ecx, ecx
mov dword [rbx + 0xa4], eax
call fcn.140004200
mov ecx, 1
mov dword [rbx + 0xa8], eax
call fcn.1400129a0
lea rcx, [rbx + 8]
mov dword [rbx + 0xac], eax
mov dword [rbx + 8], 0x9c
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x14000e5d3
lea rcx, [rbx + 8]
mov dword [rbx + 8], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x14000e5d3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, [rbx + 0x14]
lea rdx, [rbx + 0x10]
lea rcx, [rbx + 0xc]
call fcn.1400063c0
lea rcx, [rbx + 0x76c]
xor edx, edx
mov r8d, 0x104
call fcn.140013580
lea rdx, [rbx + 0x76c]
mov r8d, 0x103
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rcx, [rbx + 0x76c]
mov edx, 0x5c
call fcn.140015434
test rax, rax
je 0x14000e626
mov byte [rax], 0
lea rcx, [rbx + 0x440]
xor edx, edx
mov r8d, 0x104
call fcn.140013580
lea rcx, [rbx + 0x440]
mov edx, 0x103
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rbx + 0x440]
repne scasb al, byte [rdi]
not rcx
dec rcx
test ecx, ecx
je 0x14000e67a
lea eax, [rcx - 1]
cmp byte [rax + rbx + 0x440], 0x5c
jne 0x14000e67a
mov byte [rax + rbx + 0x440], 0
lea rcx, [rbx + 0x544]
xor edx, edx
mov r8d, 0x104
call fcn.140013580
lea rcx, [rbx + 0x544]
mov edx, 0x103
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea rdx, [rbx + 0x870]
xor r9d, r9d
mov r8d, 0x104
mov rcx, rbx
call fcn.14000d190
mov eax, dword [0x140024284]
lea rdi, [rbx + 0x974]
mov dword [rdi], eax
movzx eax, byte [0x140024288]
or rcx, 0xffffffffffffffff
mov byte [rdi + 4], al
xor eax, eax
repne scasb al, byte [rdi]
xor ecx, ecx
nop dword [rax + rax]
movzx eax, byte [rbx + rcx + 0x870]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x14000e6e0
mov byte [rbx + 0x378], al
mov dword [rbx + 0x33c], 0x54535953
mov dword [rbx + 0x340], 0x435c4d45
mov rax, rbx
mov dword [rbx + 0x344], 0x65727275
mov dword [rbx + 0x348], 0x6f43746e
mov dword [rbx + 0x34c], 0x6f72746e
mov dword [rbx + 0x350], 0x7465536c
mov dword [rbx + 0x354], 0x6e6f435c
mov dword [rbx + 0x358], 0x6c6f7274
mov dword [rbx + 0x35c], 0x7265545c
mov dword [rbx + 0x360], 0x616e696d
mov dword [rbx + 0x364], 0x6553206c
mov dword [rbx + 0x368], 0x72657672
mov dword [rbx + 0x36c], 0x6e69575c
mov dword [rbx + 0x370], 0x74617453
mov dword [rbx + 0x374], 0x736e6f69
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140013680
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r13
pop r12
pop rdi
ret