Function at 0x140003f80
Capabilities:
Get common file path
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x370]
sub rsp, 0x470
mov rax, qword [0x1417380a0]
xor rax, rsp
mov qword [rbp + 0x360], rax
xor r14d, r14d
mov qword [rsp + 0x58], 7
lea rdx, [0x1400b0c10]
mov qword [rsp + 0x40], r14
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x50], r14
lea r8d, [r14 + 0x11]
call fcn.140006d50
lea r8d, [r14 + 0x10]
mov qword [rsp + 0x60], r14
lea rdx, [0x1400b0c38]
mov qword [rsp + 0x70], r14
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x78], 7
call fcn.140006d50
lea r8d, [r14 + 0x1d]
mov qword [rbp - 0x80], r14
lea rdx, [0x1400b0c60]
mov qword [rbp - 0x70], r14
lea rcx, [rbp - 0x80]
mov qword [rbp - 0x68], 7
call fcn.140006d50
lea r8d, [r14 + 0x1c]
mov qword [rbp - 0x60], r14
lea rdx, [0x1400b0ca0]
mov qword [rbp - 0x50], r14
lea rcx, [rbp - 0x60]
mov qword [rbp - 0x48], 7
call fcn.140006d50
mov qword [rsp + 0x30], 0xffffffff80000001
lea rdi, [rsp + 0x40]
mov esi, r14d
mov rbx, r14
cmp qword [rdi + 0x18], 8
mov rdx, rdi
jb 0x140004071
mov rdx, qword [rdi]
mov rcx, qword [rsp + rbx*8 + 0x30]
lea rax, [rsp + 0x38]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400040d1
inc rbx
cmp rbx, 1
jb 0x140004064
inc rsi
add rdi, 0x20
cmp rsi, 4
jb 0x140004061
call fcn.140003870
test al, al
jne 0x1400040dc
mov edx, 0x20
lea r9, [fcn.140005b50]
lea rcx, [rsp + 0x40]
lea r8d, [rdx - 0x1c]
call fcn.14003aac4
jmp 0x140004505
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, 0x20
lea r9, [fcn.140005b50]
lea rcx, [rsp + 0x40]
lea r8d, [rdx - 0x1c]
call fcn.14003aac4
mov ecx, 0x1f4
mov rdi, r14
mov rbx, r14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [0x1400b0acc]
mov qword [rbp - 0x40], rax
lea r8, [0x1400b0b20]
lea rax, [0x1400b0ad0]
mov qword [rbp + 0x68], r8
mov qword [rbp - 0x38], rax
lea r9, [0x1400b0ae4]
lea rax, [0x1400b0ad4]
mov qword [rbp - 0x10], r9
mov qword [rbp - 0x30], rax
lea rdx, [0x1400b0b18]
lea rax, [0x1400b0ad8]
mov qword [rbp + 0x58], rdx
mov qword [rbp - 0x28], rax
lea rcx, [0x1400b0b34]
lea rax, [0x1400b0adc]
mov qword [rbp + 0x90], r8
mov qword [rbp - 0x20], rax
lea rax, [0x1400b0ae0]
mov qword [rbp - 0x18], rax
lea rax, [0x1400b0ae8]
mov qword [rbp - 8], rax
lea rax, [0x1400b0aec]
mov qword [rbp], rax
lea rax, [0x1400b0af0]
mov qword [rbp + 8], rax
lea rax, [0x1400b0af4]
mov qword [rbp + 0x10], rax
lea rax, [0x1400b0af8]
mov qword [rbp + 0x18], rax
lea rax, [0x1400b0afc]
mov qword [rbp + 0x20], rax
lea rax, [0x1400b0b00]
mov qword [rbp + 0x28], rax
lea rax, [0x1400b0b04]
mov qword [rbp + 0x30], rax
lea rax, [0x1400b0b08]
mov qword [rbp + 0x38], rax
lea rax, [0x1400b0b0c]
mov qword [rbp + 0x40], rax
lea rax, [0x1400b0b10]
mov qword [rbp + 0x48], rax
lea rax, [0x1400b0b14]
mov qword [rbp + 0x50], rax
lea rax, [0x1400b0b1c]
mov qword [rbp + 0x60], rax
lea rax, [0x1400b0b24]
mov qword [rbp + 0x70], rax
lea rax, [0x1400b0b28]
mov qword [rbp + 0x78], rax
lea rax, [0x1400b0b2c]
mov qword [rbp + 0x80], rax
lea rax, [0x1400b0b30]
mov qword [rbp + 0x88], rax
lea rax, [0x1400b0b38]
mov qword [rbp + 0xa0], rax
lea rax, [0x1400b0b3c]
mov qword [rbp + 0xb8], rax
lea rax, [0x1400b0b40]
mov qword [rbp + 0xc0], rax
lea rax, [0x1400b0b44]
mov qword [rbp + 0xc8], rax
lea rax, [0x1400b0b48]
mov qword [rbp + 0xd8], rax
lea rax, [0x1400b0b4c]
mov qword [rbp + 0xe8], rax
lea rax, [0x1400b0b50]
mov qword [rbp + 0x98], rcx
mov qword [rbp + 0xa8], rcx
mov qword [rbp + 0xb0], rdx
mov qword [rbp + 0xd0], r8
mov qword [rbp + 0xe0], r9
mov qword [rbp + 0xf0], rax
mov rdx, r14
lea rax, [0x1400b0b54]
mov qword [rbp + 0x100], r9
mov qword [rbp + 0xf8], rax
mov r8, r14
lea rax, [0x1400b0b58]
mov r9, 0xffffffffffffffff
mov qword [rbp + 0x108], rax
lea rax, [0x1400b0b5c]
mov qword [rbp + 0x110], rax
lea rax, [0x1400b0b60]
mov qword [rbp + 0x118], rax
lea rax, [0x1400b0b64]
mov qword [rbp + 0x120], rax
lea rax, [0x1400b0b68]
mov qword [rbp + 0x128], rax
lea rax, [0x1400b0b6c]
mov qword [rbp + 0x130], rax
nop dword [rax]
nop dword [rax + rax]
mov rcx, qword [rbp + r8*8 - 0x40]
mov rax, r9
inc rax
cmp byte [rcx + rax], dl
jne 0x140004348
mov rcx, qword [rbp + r8*8 - 0x38]
add rdi, rax
mov rax, r9
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], dl
jne 0x140004360
add rbx, rax
add r8, 2
cmp r8, 0x2e
jb 0x140004340
cmp r8, 0x2f
jae 0x14000438c
mov rax, qword [rbp + r8*8 - 0x40]
mov rdx, r9
inc rdx
cmp byte [rax + rdx], r14b
jne 0x140004383
lea rcx, [rdi + rbx]
add rcx, rdx
add rcx, 1
cmovb rcx, r9
call fcn.1400652ec
mov rbx, rax
test rax, rax
jne 0x1400043c4
lea ecx, [rax + 2]
call fcn.14004c090
mov rcx, rax
lea rdx, [0x1400b0b70]
call fcn.1400010f0
mov rbx, r14
jmp 0x140004409
mov byte [rax], r14b
mov r9, r14
nop word [rax + rax]
lea rax, [rbx - 1]
cmp byte [rax + 1], r14b
lea rax, [rax + 1]
jne 0x1400043d4
mov r8, qword [rbp + r9*8 - 0x40]
xor edx, edx
nop word [rax + rax]
movzx ecx, byte [r8 + rdx]
mov byte [rax + rdx], cl
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400043f0
inc r9
cmp r9, 0x2f
jb 0x1400043d0
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x30], r14
xor r8d, r8d
lea rcx, [0x14009f220]
xor edx, edx
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
mov rdx, qword [rsp + 0x30]
lea rcx, [rbp + 0x250]
mov r8d, 0x104
call fcn.140064354
lea r8, [rbp + 0x250]
lea rdx, [0x1400b0ce0]
lea rcx, [rbp + 0x140]
call fcn.140008420
lea rdx, [rbp + 0x140]
mov rcx, rbx
call fcn.140002d40
test al, al
je 0x140004505
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1400b0ac8]
lea rcx, [rbp + 0x140]
call fcn.14004bebc
mov r14, rax
test rax, rax
je 0x140004505
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 2]
call fcn.14004cb28
mov rcx, r14
call fcn.14004ba4c
xor r8d, r8d
mov esi, eax
xor edx, edx
mov rcx, r14
call fcn.14004cb28
mov ecx, esi
call fcn.14003abe4
mov r9, r14
mov r8d, esi
mov edx, 1
mov rcx, rax
mov rdi, rax
call fcn.140064d98
mov rcx, r14
call fcn.14004c85c
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, esi
mov rcx, rdi
call fcn.1400035f0
mov rcx, rdi
call fcn.14003aa80
xor eax, eax
mov rcx, qword [rbp + 0x360]
xor rcx, rsp
call fcn.14003aa60
lea r11, [rsp + 0x470]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret