Function at 0x14001135c
Capabilities:
Get common file path

Disassembly:
jmp 0x140015010
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
sub rsp, 0xf90
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x2b8
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0xfb8]
mov rax, qword [0x140025018]
xor rax, rbp
mov qword [rbp + 0xf58], rax
lea rcx, [0x14002b252]
call fcn.1400114e2
lea rax, [rbp + 0x30]
lea rcx, str.ProcExp64
mov rdi, rax
mov rsi, rcx
mov ecx, 0x14
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x44]
mov rdi, rax
xor eax, eax
mov ecx, 0x1f4
rep stosb byte [rdi], al
mov qword [rbp + 0x258], 0
lea rax, [rbp + 0x280]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov qword [rbp + 0x4c8], 0
mov qword [rbp + 0x4e8], 0
mov dword [rbp + 0x504], 0
lea rax, [rbp + 0x530]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov dword [rbp + 0x754], 0
mov qword [rbp + 0x778], 0
mov dword [rbp + 0x794], 0
mov dword [rbp + 0x7b4], 0
mov dword [rbp + 0x7d4], 0
mov dword [rbp + 0x7f4], 0
mov dword [rbp + 0x814], 0
mov dword [rbp + 0x834], 0
mov dword [rbp + 0x854], 0
mov dword [rbp + 0x874], 0
mov dword [rbp + 0x894], 0
call fcn.1400111a4
test eax, eax
jne 0x140015164
lea rcx, str.You_need_elevated_privileges_to_run_this_tool__n
call fcn.140011221
mov eax, 0xffffffff
jmp 0x1400156c4
call fcn.1400111d1
test eax, eax
jne 0x140015179
lea rcx, str.Setting_Debug_Privilege_failed__this_might_cause_access_denied__5__error_on_some_hosts
call fcn.1400113ac
lea r8, str.hukln:p:s:d:x:
mov rdx, qword [rbp + 0xf88]
mov ecx, dword [rbp + 0xf80]
call fcn.140011465
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0xffffffff
je 0x14001534f
mov eax, dword [rbp + 4]
mov dword [rbp + 0xf54], eax
mov eax, dword [rbp + 0xf54]
sub eax, 0x64
mov dword [rbp + 0xf54], eax
cmp dword [rbp + 0xf54], 0x14
ja case.0x1400151dc.1
movsxd rax, dword [rbp + 0xf54]
lea rcx, [0x140000000]
mov eax, dword [rcx + rax*4 + 0x156f4]
add rax, rcx
jmp rax
mov dword [rbp + 0x794], 1
mov rcx, qword [0x140025920]
call fcn.1400111ea
lea rdx, [rbp + 0x504]
mov rcx, rax
call fcn.140011550
mov dword [rbp + 0x894], eax
cmp dword [rbp + 0x894], 0
jne 0x140015223
mov ecx, 1
call fcn.1400110c3
jmp 0x1400156c4
mov rcx, qword [0x140025920]
call fcn.1400111ea
mov qword [rbp + 0x258], rax
jmp case.0x1400151dc.1
mov dword [rbp + 0x7b4], 1
mov rcx, qword [0x140025920]
call qword [sym.imp.ucrtbased.dll_atoi]
mov dword [rbp + 0x504], eax
mov ecx, dword [rbp + 0x504]
call fcn.140011483
test eax, eax
jne 0x140015276
mov ecx, 1
call fcn.1400110c3
jmp 0x1400156c4
jmp case.0x1400151dc.1
mov dword [rbp + 0x7d4], 1
mov r8d, 0x208
xor edx, edx
lea rcx, [rbp + 0x280]
call fcn.1400113d4
mov rcx, qword [0x140025920]
call fcn.1400111ea
mov r8, rax
mov edx, 0x104
lea rcx, [rbp + 0x30]
call qword [sym.imp.ucrtbased.dll_wcscpy_s]
jmp case.0x1400151dc.1
mov dword [rbp + 0x7f4], 1
mov r8d, 0x208
xor edx, edx
lea rcx, [rbp + 0x280]
call fcn.1400113d4
mov rcx, qword [0x140025920]
call fcn.1400111ea
mov r8, rax
mov edx, 0x104
lea rcx, [rbp + 0x280]
call qword [sym.imp.ucrtbased.dll_wcscpy_s]
jmp case.0x1400151dc.1
mov dword [rbp + 0x814], 1
mov rax, qword [0x140025920]
mov qword [rbp + 0x4e8], rax
jmp case.0x1400151dc.1
mov dword [rbp + 0x834], 1
jmp case.0x1400151dc.1
mov dword [rbp + 0x854], 1
jmp case.0x1400151dc.1
mov ecx, 0xffffffff
call fcn.1400110c3
jmp 0x1400156c4
mov dword [rbp + 0x874], 1
jmp 0x140015179
cmp dword [rbp + 0x794], 0
jne 0x140015372
cmp dword [rbp + 0x7b4], 0
jne 0x140015372
mov ecx, 1
call fcn.1400110c3
jmp 0x1400156c4
cmp dword [rbp + 0x794], 0
je 0x140015393
cmp dword [rbp + 0x7b4], 0
je 0x140015393
mov ecx, 2
call fcn.1400110c3
jmp 0x1400156c4
call fcn.1400114d3
test eax, eax
jne 0x1400153a6
mov eax, 0xffffffff
jmp 0x1400156c4
cmp dword [rbp + 0x7f4], 0
jne 0x140015412
lea rcx, str.no_special_driver_dir_specified__extracting_to_current_dir
call fcn.1400113ac
lea rdx, [rbp + 0x8c0]
mov ecx, 0x105
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rax, str.PROCEXP
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x8c0]
mov qword [rsp + 0x20], rax
lea r9, str._ws_ws
mov r8, 0xffffffffffffffff
mov edx, 0x104
lea rcx, [rbp + 0x280]
call fcn.1400114ab
lea rcx, [rbp + 0x280]
call fcn.14001137f
jmp 0x140015431
lea rdx, [rbp + 0x280]
lea rcx, str.extracting_the_drive_to__ws
call fcn.1400113ac
lea rcx, [rbp + 0x280]
call fcn.14001137f
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x280]
call fcn.1400112bc
test eax, eax
jne 0x140015471
cmp dword [rbp + 0x874], 0
je 0x14001545e
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x280]
call fcn.14001114a
lea rcx, str.Could_not_load_driver
call fcn.1400110fa
jmp 0x1400156c4
lea rdx, [rbp + 0x30]
lea rcx, str.Driver_loaded_as__ws_n
call fcn.140011221
mov dword [rbp + 0x874], 1
call fcn.140011479
mov qword [rbp + 0x4c8], rax
cmp qword [rbp + 0x4c8], 0
jne 0x1400154d0
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x280]
call fcn.14001114a
lea rcx, [rbp + 0x280]
call fcn.1400111ef
lea rcx, str.ConnectToProcExpDevice
call fcn.1400110fa
jmp 0x1400156c4
lea rcx, str.Connected_to_Driver_successfully
call fcn.140011032
mov eax, dword [rbp + 0x504]
mov ecx, eax
call fcn.140011172
mov qword [rbp + 0x4a8], rax
cmp qword [rbp + 0x4a8], 0xffffffffffffffff
jne 0x14001550b
lea rcx, str.could_not_get_handle_to_protected_process
call fcn.1400110fa
jmp 0x1400156c4
cmp dword [rbp + 0x834], 0
jne 0x14001552a
cmp dword [rbp + 0x854], 0
jne 0x14001552a
cmp dword [rbp + 0x814], 0
je 0x1400155b9
lea rcx, [0x1400215cc]
call fcn.140011221
cmp dword [rbp + 0x794], 0
je 0x140015552
mov rdx, qword [rbp + 0x258]
lea rcx, str.Process_Name:__ws_n
call fcn.140011221
mov edx, dword [rbp + 0x504]
lea rcx, str.___Process_PID:__d_n
call fcn.140011221
lea rdx, [rbp + 0x754]
mov ecx, dword [rbp + 0x504]
call fcn.1400113b6
test eax, eax
jne 0x14001558e
mov edx, dword [rbp + 0x504]
lea rcx, str.____Failed_to_get_the_protection_level_of_process_with_PID__d_n
call fcn.140011221
jmp 0x1400155b9
lea rdx, [rbp + 0x778]
mov ecx, dword [rbp + 0x504]
call fcn.1400114a6
mov r8, qword [rbp + 0x778]
mov edx, dword [rbp + 0x754]
lea rcx, str.___Process_Protection_level:__d____ws_n
call fcn.140011221
cmp dword [rbp + 0x834], 0
je 0x1400155df
lea rcx, str.Listing_Handles_n
call fcn.1400113ac
mov rcx, qword [rbp + 0x4a8]
call fcn.1400114c4
jmp 0x140015679
cmp dword [rbp + 0x854], 0
je 0x14001560e
lea rcx, str.Killing_process_n
call fcn.1400113ac
mov rcx, qword [rbp + 0x4a8]
call fcn.140011505
lea rcx, str.Killing_process_succeeded
call fcn.140011032
jmp 0x140015679
cmp dword [rbp + 0x814], 0
je 0x14001566d
mov r8d, 0x10
xor edx, edx
mov rcx, qword [rbp + 0x4e8]
call qword [sym.imp.ucrtbased.dll_strtol]
mov edx, eax
lea rcx, str.Closing_Handle_:_0x_x_n
call fcn.1400113ac
mov r8d, 0x10
xor edx, edx
mov rcx, qword [rbp + 0x4e8]
call qword [sym.imp.ucrtbased.dll_strtol]
cdqe
mov rdx, rax
mov ecx, dword [rbp + 0x504]
call fcn.1400113ed
lea rcx, str.Closing_handle_succeeded
call fcn.140011032
jmp 0x140015679
lea rcx, str.Please_select_an_operation_n
call fcn.140011221
cmp dword [rbp + 0x874], 0
je 0x1400156c2
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x280]
call fcn.14001114a
mov rcx, qword [rbp + 0x4c8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x1400156b6
mov rdx, qword [rbp + 0x4c8]
lea rcx, str.Error_ClosingHandle_to_driver_file__p
call fcn.140011221
lea rcx, [rbp + 0x280]
call fcn.1400111ef
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x140020de0]
call fcn.140011433
mov rax, rdi
mov rcx, qword [rbp + 0xf58]
xor rcx, rbp
call fcn.140011244
lea rsp, [rbp + 0xf60]
pop rdi
pop rsi
pop rbp
ret