Function at 0x1400062d0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x330
mov rax, qword [0x140035030]
xor rax, rsp
mov qword [rsp + 0x320], rax
mov rsi, rcx
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ebp, ebp
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x24], ebp
mov dword [rsp + 0x20], ebp
call fcn.140002530
mov rdi, rax
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.AddDllDirectory
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000634e
mov r8d, 0x800
lea rcx, str.wintrust.dll
jmp 0x1400063bb
mov edx, 0x104
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ecx, eax
test eax, eax
je 0x14000644e
lea rax, [rcx + 0xe]
cmp rax, 0x104
ja 0x14000644e
lea rax, [rcx + rcx]
mov ecx, 0x5c
mov word [rsp + rax + 0x50], cx
lea rcx, str.wintrust.dll
sub rax, rcx
lea rdx, [rsp + 0x52]
add rdx, rax
nop dword [rax + rax]
movzx eax, word [rcx]
mov word [rdx + rcx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x1400063a0
mov r8d, 8
lea rcx, [rsp + 0x50]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbx, rax
test rax, rax
je 0x14000644e
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1400377bc], eax
jle 0x140006423
lea rcx, [0x1400377bc]
call fcn.14000bd10
cmp dword [0x1400377bc], 0xffffffff
jne 0x140006423
lea rdx, str.CryptCATAdminAcquireContext2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400377c0], rax
lea rcx, [0x1400377bc]
call fcn.14000bcb0
lea rax, [0x14002f378]
lea rdx, [0x14002f32c]
cmp qword [0x1400377c0], rbp
cmovne rdx, rax
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], bpl
jne 0x140006443
jmp 0x14000645b
mov r8d, 1
lea rdx, [0x14002f37c]
lea rcx, [rdi + 0x88]
call fcn.140001280
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], bpl
mov r8d, 2
lea rdx, [0x14002f330]
lea rcx, [rsp + 0x30]
call fcn.140001280
nop
call fcn.140002530
mov rcx, rax
lea r9, [rsp + 0x30]
xor r8d, r8d
xor edx, edx
call fcn.140002000
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x1400064ec
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400064e7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400066f7
call fcn.14000bb4c
mov rcx, qword [rsi]
cmp qword [rcx + 0x18], 8
jb 0x1400064f9
mov rcx, qword [rcx]
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x24]
lea rdx, [rsp + 0x28]
call fcn.140002c70
test eax, eax
mov rax, qword [0x1400375f0]
jne 0x14000655c
test rax, rax
jne 0x14000654e
lea r8d, [rax + 0x2f]
lea rdx, str.verifyDlls._IsFileSignedByTencent_return_false.
lea rcx, [0x140035a48]
call fcn.1400013e0
mov r8d, 2
lea rdx, [0x14002ef58]
mov rcx, rax
call fcn.1400013e0
xor sil, sil
jmp 0x14000659b
lea rcx, str.verifyDlls._IsFileSignedByTencent_return_false.
call rax
xor sil, sil
jmp 0x14000659b
test rax, rax
jne 0x14000658f
lea r8d, [rax + 0x31]
lea rdx, str.verifyDlls_OK._IsFileSignedByTencent_return_true.
lea rcx, [0x140035a48]
call fcn.1400013e0
mov r8d, 2
lea rdx, [0x14002ef58]
mov rcx, rax
call fcn.1400013e0
jmp 0x140006598
lea rcx, str.verifyDlls_OK._IsFileSignedByTencent_return_true.
call rax
mov sil, 1
call fcn.140002530
mov rdi, rax
lea rdx, [rax + 8]
cmp qword [rax + 0x20], 0x10
jb 0x1400065b2
mov rdx, qword [rax + 8]
lea rbx, [rax + 0x68]
mov r8, qword [rax + 0x18]
mov rcx, rbx
call fcn.1400013e0
mov r8d, 1
lea rdx, [0x14002f380]
mov rcx, rbx
call fcn.1400013e0
lea rdx, [rdi + 0x28]
cmp qword [rdi + 0x40], 0x10
jb 0x1400065e6
mov rdx, qword [rdi + 0x28]
mov r8, qword [rdi + 0x38]
mov rcx, rbx
call fcn.1400013e0
mov r8d, 1
lea rdx, [0x14002f380]
mov rcx, rbx
call fcn.1400013e0
lea rdx, [rdi + 0x48]
cmp qword [rdi + 0x60], 0x10
jb 0x140006616
mov rdx, qword [rdi + 0x48]
mov r8, qword [rdi + 0x58]
mov rcx, rbx
call fcn.1400013e0
mov r8d, 1
lea rdx, [0x14002f380]
mov rcx, rbx
call fcn.1400013e0
lea rdx, [rdi + 0x88]
cmp qword [rdi + 0xa0], 0x10
jb 0x14000664f
mov rdx, qword [rdi + 0x88]
mov r8, qword [rdi + 0x98]
mov rcx, rbx
call fcn.1400013e0
mov rax, qword [rdi]
test rax, rax
je 0x140006686
mov rcx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x140006673
mov rcx, qword [rbx]
call rax
mov qword [rbx + 0x10], rbp
cmp qword [rbx + 0x18], 0x10
jb 0x140006683
mov rbx, qword [rbx]
mov byte [rbx], 0
test sil, sil
jne 0x1400066ce
mov rax, qword [0x1400375f0]
test rax, rax
jne 0x1400066c5
lea r8d, [rax + 0x11]
lea rdx, str.verifyDlls_faild.
lea rcx, [0x140035a48]
call fcn.1400013e0
mov r8d, 2
lea rdx, [0x14002ef58]
mov rcx, rax
call fcn.1400013e0
jmp 0x1400066ce
lea rcx, str.verifyDlls_faild.
call rax
mov rcx, qword [rsp + 0x320]
xor rcx, rsp
call fcn.14000b8a0
lea r11, [rsp + 0x330]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.140011f28
int3