function utils.NormalizePath()

in ransomware/artifact.lua [150:190]


function utils.NormalizePath(filePath)
    
    filePath = filePath:lower()

    
    
    filePath = filePath:gsub('progra~1', 'program files')
    filePath = filePath:gsub('progra~2', 'program files (x86)')

    
    local match = filePath:match('^%a:\\')
    if match == nil then
        return nil
    end

    local match = filePath:match('^%a:\\programdata\\.-\\')
    if match ~= nil then
        return match
    end

    match = filePath:match('^%a:\\program files\\.-\\')
    if match ~= nil then
        return match
    end

    match = filePath:match('^%a:\\program files %(x86%)\\.-\\')
    if match ~= nil then
        return match
    end

    match = filePath:match('^%a:\\.-\\')
    if match ~= nil then
        return match
    end

    match = filePath:match('(.*[/\\])')
    if match ~= nil then
        return match
    end
    return nil
end