Function at 0x1800b7c90
Capabilities:
Get common file path
Terminate process

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2d0
mov rax, qword [0x1800e5c38]
xor rax, rsp
mov qword [rsp + 0x2c0], rax
mov r12, qword [rsp + 0x60]
mov r13d, r9d
mov dword [rsp + 0x58], r9d
xor ebx, ebx
mov r9, qword [rsp + 0x330]
mov r10, r8
mov qword [rsp + 0x70], r8
mov r14, rdx
lea eax, [r13 + 0xa]
mov qword [rsp + 0xa0], r9
mov dword [rsp + 0x44], r13d
mov r15, rcx
mov dword [rsp + 0x40], eax
mov r8d, r13d
cmp r13d, eax
jae 0x1800b7fd3
mov rax, qword [rsp + 0x60]
lea edx, [r13 - 0x109]
mov r13d, dword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov edi, dword [rsp + 0x58]
mov qword [rsp + 0x50], rax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x48], edx
lea r11, [0x180000000]
cmp edx, 0x2a
ja case.default.0x1800b7d4a
movzx eax, byte [r11 + rdx + 0xb815c]
mov ecx, dword [r11 + rax*4 + 0xb8130]
add rcx, r11
jmp rcx
mov rax, qword [rsp + 0x60]
cmp byte [rax], bl
jne 0x1800b7d8a
mov ecx, 0x72
nop word [rax + rax]
mov eax, ecx
sub eax, 0x72
je 0x1800b7d72
cmp eax, 0x3d
je 0x1800b80fe
jmp 0x1800b7d7f
test r14, r14
je 0x1800b7d7a
mov dword [r14], ebx
mov dword [rsp + 0x68], r13d
add ecx, 0x3d
cmp ecx, 0xec
jb 0x1800b7d60
mov qword [rsp + 0x20], r9
lea r8, str.Media_Audio
mov r9, r10
xor edx, edx
mov rcx, r15
call fcn.18006e9e0
mov edx, dword [rsp + 0x48]
mov r8d, dword [rsp + 0x44]
mov rcx, qword [rsp + 0x50]
mov eax, dword [rsp + 0x40]
inc r8d
inc edx
mov dword [rsp + 0x44], r8d
mov dword [rsp + 0x48], edx
cmp r8d, eax
jae 0x1800b7fdf
mov r9, qword [rsp + 0xa0]
mov r10, qword [rsp + 0x70]
jmp 0x1800b7d26
mov esi, 0x4c
cmp esi, 0x4c
je 0x1800b7df6
cmp esi, 0xdf
je 0x1800b80fe
jmp 0x1800b7e63
mov eax, dword [r10]
lea rdx, [rsp + 0x88]
mov dword [rsp + 0x78], eax
mov r8d, 0x12d
mov eax, dword [r15]
mov rcx, r14
mov dword [rsp + 0x88], eax
mov rax, qword [r9]
lea r9, [rsp + 0x80]
mov qword [rsp + 0xa8], rax
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x80], 0x7f2bb709
call fcn.1800c04d0
mov r9, qword [rsp + 0xa0]
mov r10, qword [rsp + 0x70]
mov dword [rsp + 0x68], eax
add esi, 0x93
cmp esi, 0x172
jb 0x1800b7de3
mov rcx, r9
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbp, rax
test rax, rax
jne 0x1800b7da3
mov rax, rbx
jmp 0x1800b8103
mov esi, 0x93
mov eax, esi
sub eax, 0x93
je 0x1800b7eab
cmp eax, 0x4a
je 0x1800b80fe
jmp 0x1800b7ebc
mov rdx, r15
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x68], rax
add esi, 0x4a
cmp esi, 0x127
jb 0x1800b7e97
mov edx, dword [rsp + 0x48]
mov r8d, dword [rsp + 0x44]
mov rcx, rbx
mov qword [rsp + 0x50], rbx
xor eax, eax
lock cmpxchg qword [0x1800e5d20], rbx
mov r12, rax
jmp 0x1800b7db1
mov ecx, edi
mov dword [r15], ebx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__close]
jmp 0x1800b7da3
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, r9
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtoul]
mov r13d, eax
jmp 0x1800b7da3
test r14, r14
je 0x1800b7fc7
mov dword [r14], 1
mov dword [rsp + 0x68], ebx
jmp case.0x1800b7d4a.10
mov qword [rsp + 0x38], r9
lea rax, [rsp + 0x90]
mov qword [rsp + 0x30], rbx
lea rcx, [rsp + 0x98]
mov qword [rsp + 0x28], rbx
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0xcd
mov dword [rsp + 0x98], ebx
mov dword [rsp + 0x90], ebx
call fcn.180090dd0
mov rdi, rax
jmp 0x1800b7da3
test edi, edi
jns case.0x1800b7d4a.10
mov esi, 0xc3
nop dword [rax]
nop dword [rax + rax]
mov eax, esi
sub eax, 0xc2
je 0x1800b80fe
cmp eax, 1
jne 0x1800b7fae
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [rax]
mov dword [rsp + 0x68], ecx
dec esi
cmp esi, 0xc1
ja 0x1800b7f90
jmp 0x1800b7da3
mov rcx, qword [rsp + 0x50]
jmp 0x1800b7db5
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x50], rcx
jmp 0x1800b7fe4
mov r13d, dword [rsp + 0x58]
imul r15d, r13d, 0x60e
mov edi, r13d
cmp r13d, r15d
ja 0x1800b80fe
mov esi, dword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov r14d, dword [rsp + 0x58]
cmp edi, 0x16661
ja 0x1800b8067
je 0x1800b805f
mov eax, edi
sub eax, 0x109
je 0x1800b80fe
sub eax, 0x1e
je 0x1800b8054
sub eax, 0xa
je 0x1800b804b
sub eax, 0xb293
je 0x1800b803d
cmp eax, 0x618
je 0x1800b80fe
jmp 0x1800b80ec
test r12, r12
je 0x1800b80fe
jmp 0x1800b80ec
mov dword [rsp + 0x68], ebx
jmp 0x1800b80ec
mov r14d, 0x36
jmp 0x1800b80ec
mov rbp, rbx
jmp 0x1800b80ec
cmp edi, 0x218fe
je 0x1800b80e0
cmp edi, 0x2cb9b
je 0x1800b80ba
cmp edi, 0x37e38
je 0x1800b8097
cmp edi, 0x430d5
jne 0x1800b80ec
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
jmp 0x1800b80ec
lea rax, [rsp + 0xb0]
mov r9d, esi
mov r8, rbp
mov qword [rsp + 0x20], rax
mov edx, r14d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov rcx, qword [rsp + 0x50]
jmp 0x1800b80ec
xor r9d, r9d
mov qword [rsp + 0x70], r12
xor r8d, r8d
mov dword [rsp + 0x20], 0xee
xor edx, edx
lea rcx, [rsp + 0x70]
call fcn.180064c30
mov rcx, qword [rsp + 0x50]
jmp 0x1800b80ec
mov rax, rbx
mov esi, ebx
xchg qword [0x1800e5d20], rax
imul eax, r13d, 0x9b
add edi, eax
cmp edi, r15d
jbe 0x1800b8005
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x2c0]
xor rcx, rsp
call fcn.1800d0500
mov rbx, qword [rsp + 0x328]
add rsp, 0x2d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret