Function at 0x1800400b0
Capabilities:
Get common file path
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x230]
sub rsp, 0x330
mov rax, qword [0x18005b6d8]
xor rax, rsp
mov qword [rbp + 0x220], rax
movzx ebx, byte [rsp + 0x60]
mov esi, r9d
mov dword [rsp + 0x7c], r9d
mov rdi, rcx
mov r9, r8
mov qword [rbp + 0x20], r8
mov r8, rdx
mov qword [rbp + 0x10], rdx
mov rdx, qword [rbp + 0x290]
lea eax, [rsi + 0x142]
mov qword [rbp - 0x20], rcx
mov qword [rbp + 0x18], rdx
mov dword [rbp - 0x80], eax
cmp esi, eax
jae case.0x180040987.0
mov r15d, dword [rbp - 0x80]
xor r10d, r10d
movzx r14d, byte [rsp + 0x60]
mov r13d, dword [rsp + 0x74]
mov r12, qword [rbp - 0x40]
mov qword [rbp - 0x28], r15
lea eax, [rsi - 0x67]
lea r11, [0x180000000]
cmp eax, 0xe6
ja case.0x180040161.117
movzx eax, byte [r11 + rax + 0x40b34]
mov ecx, dword [r11 + rax*4 + 0x40af8]
add rcx, r11
jmp rcx
mov rax, qword [r8 + 0x47fc8]
mov edx, dword [rdi]
mov ecx, dword [rax + 0x32c]
sar edx, cl
mov dword [rbp - 0x78], edx
jmp case.0x180040161.117
mov rax, qword [r8 + 0x47fc8]
mov edx, dword [rdx]
mov ecx, dword [rax + 0x32c]
sar edx, cl
mov dword [rbp - 0x7c], edx
jmp case.0x180040161.117
lea rcx, [rbp + 0x80]
call qword [sym.imp.WINMM.dll_mciGetDeviceIDA]
mov dword [rsp + 0x6c], eax
jmp 0x180040ac7
mov eax, 0x45
mov word [rbp + 0x82], ax
mov dword [rbp + 0x83], 0x4c414943
jmp case.0x180040161.117
mov rax, qword [r8 + 0x47fc8]
mov ecx, dword [rax + 0x33c]
imul ecx, dword [rbp - 0x7c]
movzx eax, byte [r9]
add ecx, dword [rbp - 0x78]
movsxd rdx, ecx
mov rcx, qword [r8 + 0x49838]
mov byte [rcx + rdx*8 + 4], al
jmp case.0x180040161.117
cmp qword [r8 + 0x18], 8
mov eax, 0x45
mov word [rbp + 0x8f], ax
mov rcx, r8
jb 0x18004020a
mov rcx, qword [r8]
mov qword [rsp + 0x30], r10
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbp - 0x38], rax
jmp 0x180040ac7
cmp qword [rdi + 0x18], 0x10
mov rdx, rdi
jb 0x180040247
mov rdx, qword [rdi]
mov r8d, dword [rsp + 0x64]
lea r9, [rsp + 0x78]
mov rcx, qword [rbp - 0x38]
mov qword [rsp + 0x20], r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r10d, r10d
movzx eax, r14b
cmp dword [rsp + 0x6c], r10d
mov ecx, r10d
cmovne ecx, eax
movzx r14d, cl
jmp case.0x180040161.117
mov eax, 0x53
mov word [rbp + 0x80], ax
mov eax, 0x50
mov word [rbp + 0x81], ax
jmp case.0x180040161.117
mov eax, dword [rsp + 0x64]
cmp eax, dword [rsp + 0x78]
je 0x180040863
mov esi, 0x6d
nop word [rax + rax]
cmp esi, 0x34141
ja 0x1800405c3
je 0x1800405b9
cmp esi, 0x1a0d7
ja 0x18004049d
je 0x180040481
cmp esi, 0xd0a2
ja 0x1800403cc
je 0x18004039b
cmp esi, 0x6d
je 0x180040374
cmp esi, 0x45d4
je 0x180040359
cmp esi, 0x8b3b
jne 0x18004084d
mov r8d, 3
lea rdx, [0x180054758]
lea rcx, [rbp + 0xa8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
movabs rax, 0x4000640041
mov qword [rbp + 0xb8], rax
mov eax, dword [0x180054760]
mov dword [rbp + 0xc0], eax
movzx eax, word [0x180054764]
mov word [rbp + 0xc4], ax
jmp 0x18004084a
mov eax, 0x65
mov dword [rbp + 0xb0], 0x54
mov word [rbp + 0xae], ax
jmp 0x18004084d
mov r8d, 3
mov word [rbp + 0xa8], r10w
lea rdx, [0x180054740]
lea rcx, [rbp + 0xa8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
jmp 0x18004084a
movups xmm0, xmmword [str.mpun_Ba]
movzx eax, word [0x180054780]
movsd xmm1, qword [str.hasa]
movups xmmword [rbp + 0xc4], xmm0
mov word [rbp + 0xda], ax
movsd qword [rbp + 0xd2], xmm1
jmp 0x18004084d
cmp esi, 0x11609
je 0x18004042e
cmp esi, 0x15b70
jne 0x18004084d
mov eax, dword [0x180054708]
lea rdx, str.ahara
mov dword [rbp + 0xe4], eax
lea rcx, [rbp + 0xc0]
movzx eax, word [0x18005470c]
mov r8d, 5
mov word [rbp + 0xe8], ax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
movzx eax, word [0x18005471c]
mov word [rbp + 0x68], ax
movzx eax, byte [0x18005471e]
mov byte [rbp + 0x6a], al
jmp 0x18004084a
mov r8d, 2
lea rdx, [0x180054720]
lea rcx, [rbp + 0xda]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov r8d, 3
lea rdx, [0x180054724]
lea rcx, [rbp + 0xdc]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov eax, dword [0x18005472c]
mov dword [rbp + 0xe0], eax
movzx eax, word [0x180054730]
mov word [rbp + 0xe4], ax
jmp 0x18004084a
mov r8d, 2
lea rdx, [0x180054738]
lea rcx, [rbp + 0x6a]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp 0x18004084a
cmp esi, 0x1e63e
je 0x180040567
cmp esi, 0x22ba5
je 0x18004053b
cmp esi, 0x2710c
je 0x180040521
cmp esi, 0x2b673
je 0x180040507
cmp esi, 0x2fbda
jne 0x18004084d
mov eax, 0x3a
lea rcx, [rbp + 0x68]
mov word [rbp + 0x79], ax
dec rcx
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x1800404e1
mov eax, dword [str.__s_]
mov dword [rcx], eax
movzx eax, byte [0x180054704]
mov byte [rcx + 4], al
mov byte [rsp + 0x61], 1
jmp 0x18004084d
movzx eax, word [0x180054784]
mov word [rbp + 0x77], ax
movzx eax, byte [0x180054786]
mov byte [rbp + 0x79], al
jmp 0x18004084d
movzx eax, word [0x180054734]
mov word [rbp + 0x75], ax
movzx eax, byte [0x180054736]
mov byte [rbp + 0x77], al
jmp 0x18004084d
lea rcx, [rbp + 0x68]
mov word [rbp + 0x71], 0x3b
dec rcx
nop dword [rax + rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x180040550
mov eax, dword [0x180054750]
mov dword [rcx], eax
jmp 0x18004084d
mov r8d, 3
lea rdx, [0x180054748]
lea rcx, [rbp + 0x68]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
movzx eax, word [0x18005474c]
lea rcx, [rbp + 0x68]
mov word [rbp + 0x6e], ax
dec rcx
movzx eax, byte [0x18005474e]
mov byte [rbp + 0x70], al
nop word [rax + rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x1800405a0
movzx eax, word [0x1800543c0]
mov word [rcx], ax
jmp 0x18004084a
mov byte [rsp + 0x60], 1
jmp 0x18004084d
cmp esi, 0x52712
ja 0x1800406c3
je 0x18004069b
cmp esi, 0x456dd
ja 0x18004064c
je 0x180040627
cmp esi, 0x386a8
je 0x18004061e
cmp esi, 0x3cc0f
je 0x180040608
cmp esi, 0x41176
jne 0x18004084d
mov qword [rbp - 0x10], 0xffffffffffffffff
jmp 0x18004084d
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x28], xmm0
mov qword [rbp + 0x48], rax
movups xmmword [rbp + 0x38], xmm0
jmp 0x18004084d
mov qword [rbp - 0x30], r10
jmp 0x18004084d
lea rax, [rbp + 0x68]
mov r15, 0xffffffffffffffff
inc r15
cmp byte [rax + r15], 0
jne 0x180040632
mov qword [rbp - 0x28], r15
mov dword [rbp - 0x5c], 0x2000000
jmp 0x18004084d
cmp esi, 0x49c44
je 0x180040679
cmp esi, 0x4e1ab
jne 0x18004084d
xorps xmm0, xmm0
mov qword [rbp - 0x48], r10
xor eax, eax
mov dword [rbp - 0x60], r10d
movups xmmword [rbp + 0x50], xmm0
mov dword [rbp + 0x60], eax
jmp 0x18004084d
mov qword [rdi + 0x10], r10
mov rax, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18004068a
mov rax, qword [rdi]
mov byte [rax], 0
mov dword [rsp + 0x68], r10d
mov dword [rbp - 0x64], r10d
jmp 0x18004084d
lea r9, [rbp - 0x48]
mov dword [rbp - 0x68], r10d
lea r8, [rsp + 0x68]
mov edx, r15d
lea rcx, [rbp + 0x68]
call sub.RPCRT4.dll_MesEncodeFixedBufferHandleCreate
xor r10d, r10d
mov dword [rbp - 0x70], eax
mov dword [rbp - 0x6c], r10d
jmp 0x18004084d
cmp esi, 0x56c79
je 0x1800407ed
cmp esi, 0x5b1e0
je 0x1800407d8
cmp esi, 0x5f747
je 0x18004072b
cmp esi, 0x63cae
je 0x180040724
cmp esi, 0x68215
jne 0x18004084d
movzx eax, bl
mov rcx, qword [rbp + 0x220]
xor rcx, rsp
call fcn.180046be0
mov rbx, qword [rsp + 0x380]
add rsp, 0x330
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor bl, bl
jmp 0x18004084d
cmp dword [rbp - 0x58], 0
mov ecx, r10d
movzx eax, byte [rsp + 0x61]
cmovne ecx, eax
mov byte [rsp + 0x61], cl
cmp cl, 0
je 0x180040755
xor r8d, r8d
lea rdx, [rbp - 0x30]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_ObjectCloseAuditAlarmW]
xor r10d, r10d
cmp byte [rsp + 0x60], 0
je 0x18004084a
mov r12d, dword [rbp - 0x74]
mov edi, 0x77
nop dword [rax]
mov eax, edi
sub eax, 0x76
je 0x180040788
cmp eax, 1
jne 0x1800407b8
mov r13d, eax
mov qword [rbp - 0x18], r10
mov r12d, r10d
jmp 0x1800407b8
mov rcx, qword [rbp - 0x48]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x18]
mov r8d, r12d
mov dword [rsp + 0x20], r15d
mov edx, r13d
call sub.RPCRT4.dll_MesBufferHandleReset
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x1800407b8
call sub.RPCRT4.dll_MesHandleFree
dec edi
mov r10d, 0
cmp edi, 0x75
ja 0x180040770
mov rdi, qword [rbp - 0x20]
mov dword [rbp - 0x74], r12d
mov r12, qword [rbp - 0x40]
mov dword [rsp + 0x74], r13d
jmp 0x18004084a
movzx eax, byte [rsp + 0x60]
mov ecx, r10d
cmp dword [rbp - 0x70], 0
cmove ecx, eax
mov byte [rsp + 0x60], cl
jmp 0x18004084d
lea rax, [rbp - 0x6c]
xor ecx, ecx
mov qword [rsp + 0x58], rax
lea r9, [rbp + 0xc0]
mov eax, dword [rbp - 0x68]
lea r8, [rbp + 0xa8]
mov dword [rsp + 0x50], eax
lea rdx, [rbp - 0x30]
mov eax, dword [rbp - 0x64]
mov dword [rsp + 0x48], eax
lea rax, [rbp + 0x50]
mov qword [rsp + 0x40], rax
mov eax, dword [rbp - 0x60]
mov dword [rsp + 0x38], eax
mov eax, dword [rbp - 0x5c]
mov dword [rsp + 0x30], eax
mov rax, qword [rbp - 0x10]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x28]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_ObjectOpenAuditAlarmW]
mov dword [rbp - 0x58], eax
xor r10d, r10d
add esi, 0x4567
cmp esi, 0x6c70f
jbe 0x1800402c0
mov esi, dword [rsp + 0x7c]
mov edx, 1
lea rcx, [rbp + 0xf8]
call qword [sym.imp.SHLWAPI.dll_PathBuildRootW]
test r14b, r14b
je 0x180040ac7
mov r12, qword [rbp]
mov edi, 0x81
mov r13d, dword [rsp + 0x6c]
mov r15, qword [rbp - 8]
mov eax, edi
sub eax, 0x81
je 0x180040930
sub eax, 1
je 0x180040914
sub eax, 1
je 0x1800408fe
sub eax, 1
je 0x1800408ee
cmp eax, 1
jne 0x1800408c7
test r14b, r14b
je 0x1800408c7
mov r8d, dword [rsp + 0x70]
mov rdx, r12
mov ecx, r13d
call qword [sym.imp.WINMM.dll_mciSetYieldProc]
xor r10d, r10d
inc edi
cmp edi, 0x86
jb 0x180040890
mov r13d, dword [rsp + 0x74]
mov qword [rbp - 8], r15
mov r15, qword [rbp - 0x28]
mov qword [rbp], r12
mov r12, qword [rbp - 0x40]
jmp case.0x180040161.117
mov edx, 1
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_HeapCompact]
jmp 0x1800408c7
xor r10d, r10d
movzx eax, r14b
test r12, r12
mov ecx, r10d
cmovne ecx, eax
movzx r14d, cl
jmp 0x1800408ca
lea rdx, [rsp + 0x70]
mov ecx, r13d
call qword [sym.imp.WINMM.dll_mciGetYieldProc]
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r15, rax
jmp 0x1800408c7
xor r10d, r10d
mov dword [rsp + 0x70], r10d
jmp 0x1800408ca
mov eax, 0x5f
mov word [rbp + 0x87], ax
mov eax, 0x41
mov word [rbp + 0x8c], ax
mov dword [rbp + 0x88], 0x49524156
jmp case.0x180040161.117
cmp qword [rbp - 0x38], 0xffffffffffffffff
jne 0x180040a86
mov edi, 8
cmp edi, 8
ja case.default.0x180040987
mov eax, edi
mov ecx, dword [r11 + rax*4 + 0x40c1c]
add rcx, r11
jmp rcx
movzx eax, word [0x180054788]
mov word [rbp + 0x99], ax
mov word [rbp + 0x9b], 0x52
jmp case.default.0x180040987
lea rax, [rbp + 0x98]
dec rax
nop
cmp byte [rax + 1], 0
lea rax, [rax + 1]
jne 0x1800409b0
movsd xmm0, qword [str.AQZ128m]
lea rcx, [rbp + 0x98]
movsd qword [rax], xmm0
dec rcx
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x1800409d0
movzx eax, word [0x180054798]
mov r12, r10
mov word [rcx], ax
movzx eax, byte [0x18005479a]
mov byte [rcx + 2], al
mov qword [rbp - 0x40], r10
jmp case.default.0x180040987
lea rcx, [rbp + 0x98]
mov qword [rbp + 8], r10
mov dword [rbp - 0x54], r10d
call qword [sym.imp.dbghelp.dll_MakeSureDirectoryPathExists]
jmp 0x180040a69
mov byte [rbp + 0x98], 0
jmp case.default.0x180040987
lea rcx, [rbp + 0x98]
dec rcx
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x180040a21
movzx eax, word [0x18005479c]
mov word [rcx], ax
jmp case.default.0x180040987
xor bl, bl
jmp case.default.0x180040987
mov dword [rbp - 0x50], 0x36
jmp case.default.0x180040987
mov r9d, dword [rbp - 0x54]
lea rax, [rbp + 0x110]
mov r8, qword [rbp + 8]
mov rcx, r12
mov edx, dword [rbp - 0x50]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r10
call qword [sym.imp.SHELL32.dll_SHGetFolderPathAndSubDirA]
lea r11, [0x180000000]
xor r10d, r10d
dec edi
lea eax, [rdi + 0xf7]
cmp eax, 0xf6
ja 0x180040971
mov r14b, 1
mov dword [rsp + 0x78], r10d
jmp case.0x180040161.117
mov eax, 0x42
mov word [rbp + 0x8d], ax
mov eax, 0x4c
mov word [rbp + 0x8e], ax
jmp case.0x180040161.117
mov rcx, qword [rbp - 0x38]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, eax
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x64], eax
call fcn.18003ee20
xor r10d, r10d
add esi, 0x17
mov dword [rsp + 0x7c], esi
cmp esi, dword [rbp - 0x80]
jae case.0x180040987.0
mov rdi, qword [rbp - 0x20]
mov r8, qword [rbp + 0x10]
mov rdx, qword [rbp + 0x18]
mov r9, qword [rbp + 0x20]
jmp 0x180040138
mov al, 1
jmp 0x1800406fa