Function at 0x14007fc20
Capabilities:
Get common file path
Link many functions at runtime
Query environment variable
Query or enumerate registry value

Disassembly:
sub rsp, 0x268
mov rax, qword [0x1401222f0]
xor rax, rsp
mov qword [rsp + 0x250], rax
call fcn.140080c30
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.NtQuerySystemInformation
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140130cc8], rax
test rax, rax
jne 0x14007fcb3
lea r8, str.Ntdll_NtQuerySystemInformation
lea rdx, str.Not_able_to_run_on_this_version_of_Windows:_nMissing_function:__s
lea rcx, [rsp + 0x40]
call fcn.14002d7d0
lea r8, [0x1400d25b0]
lea rdx, [rsp + 0x40]
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetDim
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor al, al
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400ab140
add rsp, 0x268
ret
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.NtQuerySymbolicLinkObject
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140130ce8], rax
test rax, rax
jne 0x14007fce5
lea r8, str.Ntdll_NtQuerySymbolicLinkObject
jmp 0x14007fc6e
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.NtQueryDirectoryObject
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140130cf8], rax
test rax, rax
jne 0x14007fd32
lea rcx, str.Ntdll_NtQueryDirectoryObject
call fcn.140081dd0
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400ab140
add rsp, 0x268
ret
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.NtOpenSymbolicLinkObject
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140130cd0], rax
test rax, rax
jne 0x14007fd7f
lea rcx, str.Ntdll_NtOpenSymbolicLinkObject
call fcn.140081dd0
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400ab140
add rsp, 0x268
ret
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.NtOpenDirectoryObject
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140130cd8], rax
test rax, rax
jne 0x14007fdcc
lea rcx, str.Ntdll_NtOpenDirectoryObject
call fcn.140081dd0
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400ab140
add rsp, 0x268
ret
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.NtQueryObject
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140130ce0], rax
test rax, rax
jne 0x14007fe19
lea rcx, str.Ntdll_NtQueryObject
call fcn.140081dd0
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400ab140
add rsp, 0x268
ret
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.NtQueryInformationProcess
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140130d20], rax
test rax, rax
jne 0x14007fe66
lea rcx, str.Ntdll_NtQueryInformationProcess
call fcn.140081dd0
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400ab140
add rsp, 0x268
ret
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.NtSetInformationProcess
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14012ca08], rax
test rax, rax
jne 0x14007feb3
lea rcx, str.Ntdll_NtSetInformationProcess
call fcn.140081dd0
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400ab140
add rsp, 0x268
ret
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.NtQuerySemaphore
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140130d00], rax
test rax, rax
jne 0x14007ff00
lea rcx, str.Ntdll_NtQuerySemaphore
call fcn.140081dd0
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400ab140
add rsp, 0x268
ret
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.NtOpenSymbolicLinkObject
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140130cd0], rax
test rax, rax
je 0x14007fd5b
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.NtQuerySection
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140130d08], rax
test rax, rax
jne 0x14007ff7a
lea rcx, str.Ntdll_NtQuerySection
call fcn.140081dd0
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400ab140
add rsp, 0x268
ret
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.NtQueryEvent
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140130d10], rax
test rax, rax
jne 0x14007ffc7
lea rcx, str.Ntdll_NtQueryEvent
call fcn.140081dd0
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400ab140
add rsp, 0x268
ret
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.NtQueryMutant
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140130d18], rax
test rax, rax
jne 0x140080014
lea rcx, str.Ntdll_NtQueryMutant
call fcn.140081dd0
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400ab140
add rsp, 0x268
ret
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.NtResumeThread
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140130d40], rax
test rax, rax
jne 0x140080061
lea rcx, str.Ntdll_NtResumeThread
call fcn.140081dd0
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400ab140
add rsp, 0x268
ret
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.NtSuspendThread
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140130d38], rax
test rax, rax
jne 0x1400800ae
lea rcx, str.Ntdll_NtSuspendThread
call fcn.140081dd0
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400ab140
add rsp, 0x268
ret
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.NtOpenThread
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140130d58], rax
test rax, rax
jne 0x1400800fb
lea rcx, str.Ntdll_NtOpenThread
call fcn.140081dd0
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400ab140
add rsp, 0x268
ret
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.NtQueryInformationThread
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140130d28], rax
test rax, rax
jne 0x140080148
lea rcx, str.Ntdll_NtQueryInformationThread
call fcn.140081dd0
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400ab140
add rsp, 0x268
ret
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.NtQueryVirtualMemory
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140130d30], rax
test rax, rax
jne 0x140080195
lea rcx, str.Ntdll_NtQueryVirtualMemory
call fcn.140081dd0
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400ab140
add rsp, 0x268
ret
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.RtlCreateQueryDebugBuffer
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140130d68], rax
test rax, rax
jne 0x1400801e2
lea rcx, str.Ntdll_RtlCreateQueryDebugBuffer
call fcn.140081dd0
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400ab140
add rsp, 0x268
ret
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.RtlQueryProcessDebugInformation
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140130d70], rax
test rax, rax
jne 0x14008022f
lea rcx, str.Ntdll_RtlQueryProcessDebugInformation
call fcn.140081dd0
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400ab140
add rsp, 0x268
ret
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.RtlDestroyQueryDebugBuffer
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140130d78], rax
test rax, rax
jne 0x14008027c
lea rcx, str.Ntdll_RtlDestroyQueryDebugBuffer
call fcn.140081dd0
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400ab140
add rsp, 0x268
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.RtlTimeToTimeFields
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140130cf0], rax
test rax, rax
jne 0x1400802c9
lea rcx, str.Ntdll_RtlTimeToTimeFields
call fcn.140081dd0
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400ab140
add rsp, 0x268
ret
lea rcx, str.aclui.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.CreateSecurityPage
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14012cc50], rax
test rax, rax
jne 0x1400803dd
lea rcx, str.acledit.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.SedDiscretionaryAclEditor
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140130d80], rax
test rax, rax
jne 0x140080343
lea rcx, str.Acledit_SedDiscretionaryAclEditor
call fcn.140081dd0
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400ab140
add rsp, 0x268
ret
lea rcx, str.acledit.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.SedSystemAclEditor
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140130d90], rax
test rax, rax
jne 0x140080390
lea rcx, str.Acledit_SedSystemAclEditor
call fcn.140081dd0
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400ab140
add rsp, 0x268
ret
lea rcx, str.acledit.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.SedTakeOwnership
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140130d88], rax
test rax, rax
jne 0x1400803dd
lea rcx, str.Acledit_SedTakeOwnership
call fcn.140081dd0
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400ab140
add rsp, 0x268
ret
lea rcx, str.shcore.dll
mov qword [rsp + 0x270], rbx
mov qword [rsp + 0x260], rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.GetProcessDpiAwareness
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.iphlpapi.dll
mov qword [0x14012ccb0], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.GetTcpTable
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.iphlpapi.dll
mov qword [0x140130eb8], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.GetUdpTable
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.iphlpapi.dll
mov qword [0x140130ec0], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.AllocateAndGetTcpExTableFromStack
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.iphlpapi.dll
mov qword [0x140130e88], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.AllocateAndGetUdpExTableFromStack
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.iphlpapi.dll
mov qword [0x140130e90], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.GetExtendedTcpTable
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.iphlpapi.dll
mov qword [0x140130ea8], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.GetExtendedUdpTable
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.iphlpapi.dll
mov qword [0x140130eb0], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.AllocateAndGetTcpExTable2FromStack
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.iphlpapi.dll
mov qword [0x140130ea0], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.AllocateAndGetUdpExTable2FromStack
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.user32.dll
mov qword [0x140130e98], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.GetGuiResources
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.psapi.dll
mov qword [0x14012ca40], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.QueryWorkingSet
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.psapi.dll
mov qword [0x14012cc70], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.GetMappedFileNameW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.psapi.dll
mov qword [0x140130cc0], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.EnumProcessModulesEx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.kernel32.dll
mov qword [0x14012cc78], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.GlobalMemoryStatusEx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.user32.dll
mov qword [0x140130e70], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.IsHungAppWindow
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.user32.dll
mov qword [0x140130ec8], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.HungWindowFromGhostWindow
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.kernel32.dll
mov qword [0x14012ccb8], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.GetLogicalProcessorInformation
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.kernel32.dll
mov qword [0x14012c560], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.GetLogicalProcessorInformationEx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.kernel32.dll
mov qword [0x140130ed8], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.SetThreadGroupAffinity
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.wtsapi32.dll
mov qword [0x140130ee0], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.WTSEnumerateSessionsW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.wtsapi32.dll
mov qword [0x140130ee8], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.WTSDisconnectSession
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.winsta.dll
mov qword [0x140130ef0], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.WinStationConnectW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.winsta.dll
mov qword [0x140130ef8], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.WinStationShadow
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.wtsapi32.dll
mov qword [0x140130f00], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.WTSLogoffSession
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.wtsapi32.dll
mov qword [0x140130f18], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.WTSSendMessageW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.wtsapi32.dll
mov qword [0x140130f20], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
invalid
invalid
invalid