Function at 0x180065a80
Capabilities:
Get common file path
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x450]
sub rsp, 0x550
mov rax, qword [0x18008a300]
xor rax, rsp
mov qword [rbp + 0x440], rax
mov r10, qword [rbp + 0x4b0]
mov r12, r9
imul ebx, ecx, 0x8e8
mov r15, rdx
mov qword [rbp - 0x48], r8
mov esi, ecx
mov dword [rbp - 0x74], ecx
mov edi, ecx
mov qword [rsp + 0x68], r10
mov dword [rsp + 0x58], ebx
cmp ecx, ebx
ja 0x180065ff1
mov eax, dword [rsp + 0x40]
mov ecx, dword [rsp + 0x40]
mov esi, dword [rsp + 0x40]
movzx r14d, byte [rbp - 0x78]
mov r13d, dword [rsp + 0x40]
mov dword [rsp + 0x4c], eax
mov rax, qword [rbp - 0x70]
mov qword [rsp + 0x78], rax
mov rax, qword [rbp - 0x70]
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x48], ecx
nop
cmp edi, 0x3f5a
ja 0x180065cdb
je 0x180066209
cmp edi, 0x104
ja 0x180065bca
je 0x180065bbe
cmp edi, 5
je 0x180065ba9
cmp edi, 0x36
je 0x180065fcc
cmp edi, 0x6a
jne 0x180065f20
mov eax, dword [r12]
lea rdx, [rbp - 0x80]
mov dword [rsp + 0x50], eax
lea rcx, [rsp + 0x50]
mov eax, dword [r10]
mov r9, r15
mov r8d, 0x11c
mov dword [rbp - 0x80], eax
call fcn.18005e4d0
cmp eax, 0xffffffff
je 0x1800662f4
mov eax, dword [r15 + 0xc]
lea edx, [rdi + 0x33]
sub eax, dword [r15 + 4]
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], eax
mov r9, r15
mov rax, qword [rbp - 0x48]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call fcn.180066850
mov dword [rbp - 0x80], eax
jmp 0x180065f1b
xor r8d, r8d
mov rdx, r15
mov ecx, 0xef
call fcn.180043bf0
jmp 0x180065f1b
mov rax, qword [r15]
mov qword [rbp - 0x40], rax
jmp 0x180065f20
cmp edi, 0x122
je 0x180065cce
cmp edi, 0x2fd
je 0x180065c90
cmp edi, 0x5f5
jne 0x180065f20
mov r9d, 0x117
mov dword [rsp + 0x70], 0xa
lea r8, [rsp + 0x50]
mov dword [rsp + 0x50], 0x10078
lea rdx, [rsp + 0x70]
mov rcx, r15
call fcn.180020e50
mov eax, dword [0x18008af88]
lea rcx, [rsp + 0x50]
cdq
mov r9, r15
sub eax, edx
mov r8d, 0x11c
sar eax, 1
sub eax, 0xa
mov dword [rsp + 0x50], eax
mov eax, dword [0x18008af8c]
cdq
sub eax, edx
lea rdx, [rsp + 0x70]
sar eax, 1
mov dword [rsp + 0x70], eax
call fcn.18005e4d0
lea rax, [rsp + 0x70]
mov dword [rsp + 0x50], 0x14
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x70], 0x10071
mov rdx, r15
mov ecx, 0xeb
call fcn.180065a80
mov rdx, r15
mov ecx, 0xea
call fcn.1800303b0
jmp 0x180065f1b
mov eax, dword [0x18008af88]
lea rcx, [rsp + 0x50]
cdq
mov r9, r15
sub eax, edx
mov r8d, 0x11c
sar eax, 1
mov dword [rsp + 0x50], eax
mov eax, dword [0x18008af8c]
cdq
sub eax, edx
lea rdx, [rsp + 0x70]
sar eax, 1
sub eax, 5
mov dword [rsp + 0x70], eax
call fcn.18005e4d0
jmp 0x180065f1b
mov qword [rbp - 0x30], 0
jmp 0x180065f20
cmp edi, 0x15982
ja 0x180065d70
je 0x180065d59
cmp edi, 0x9b64
je 0x180065d3b
cmp edi, 0xad52
je 0x180065d33
cmp edi, 0x135c4
jne 0x180065f20
cmp dword [r15 + 0x18], 0
je 0x180065d23
mov r8, r10
mov dword [rsp + 0x40], r13d
lea rdx, [rsp + 0x40]
mov ecx, SHTestTokenMembership
call fcn.18001afc0
movsx ecx, word [r15 + 8]
mov eax, r13d
cdq
idiv ecx
jmp 0x18006620c
mov r14b, 1
jmp 0x180065f20
movsxd r8, dword [r12]
mov edx, 2
mov r9, qword [rbp - 0x40]
mov rcx, r10
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov r13, rax
jmp 0x180065f1b
xor ecx, ecx
mov dword [rbp - 0x68], 0x36
mov qword [rsp + 0x60], rcx
mov qword [rbp - 0x38], rcx
jmp 0x180065f25
cmp edi, 0x205b2
je 0x180065efa
cmp edi, 0x2b1e2
je 0x180065ed7
cmp edi, 0x35e12
jne 0x180065f20
mov r9d, dword [rsp + 0x40]
xor eax, eax
mov r8, qword [rbp - 0x38]
xor ecx, ecx
mov edx, dword [rbp - 0x68]
test esi, esi
mov dword [rsp + 0x4c], eax
movzx eax, r14b
cmove ecx, eax
lea rax, [rbp + 0x20]
movzx r14d, cl
mov qword [rsp + 0x28], rax
mov rcx, qword [rbp - 0x30]
mov qword [rsp + 0x20], 0
call qword [sym.imp.SHELL32.dll_SHGetFolderPathAndSubDirW]
test r14b, r14b
je 0x180065f1b
mov ebx, 0x28
nop
cmp ebx, 0x57d0
ja 0x180065e47
je 0x180065e3e
cmp ebx, 0x28
je 0x180065e31
cmp ebx, 0x1d60
je 0x180065e1f
cmp ebx, 0x3a98
jne 0x180065ebf
lea r8, [rbp - 0x58]
mov qword [rbp - 0x20], 0
xor edx, edx
xor ecx, ecx
call sub.RPCRT4.dll_MesDecodeIncrementalHandleCreate
mov esi, eax
jmp 0x180065ebf
xor eax, eax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x58], rax
mov dword [rbp - 0x60], eax
jmp 0x180065ebf
mov qword [rbp - 0x70], 0
jmp 0x180065ebf
mov dword [rbp - 0x64], 0
jmp 0x180065ebf
cmp ebx, 0x7508
je 0x180065e67
cmp ebx, 0x9240
jne 0x180065ebf
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x180065ebf
call sub.RPCRT4.dll_MesHandleFree
jmp 0x180065ebf
mov rcx, qword [rbp - 0x50]
mov qword [rbp - 0x28], 0
test rcx, rcx
je 0x180065e7d
call sub.RPCRT4.dll_MesHandleFree
xor eax, eax
lea r9, [rbp - 0x20]
mov qword [rbp + 0x10], rax
lea r8, [rbp - 0x60]
xorps xmm0, xmm0
lea rax, [rbp - 0x10]
mov qword [rsp + 0x30], rax
lea rdx, [rbp - 0x18]
lea rax, [rbp - 0x28]
mov qword [rsp + 0x28], rax
lea rcx, [rbp - 0x70]
lea rax, [rbp - 0x64]
mov qword [rsp + 0x20], rax
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
call qword [sym.imp.ADVAPI32.dll_LookupSecurityDescriptorPartsW]
add ebx, 0x1d38
cmp ebx, 0xaf50
jbe 0x180065de0
mov ebx, dword [rsp + 0x58]
jmp 0x180065f1b
xor eax, eax
lea r9, [rbp - 0x50]
xor r8d, r8d
mov qword [rsp + 0x78], rax
xor edx, edx
xor ecx, ecx
call sub.RPCRT4.dll_MesEncodeIncrementalHandleCreate
mov esi, eax
mov dword [rsp + 0x40], 0
jmp 0x180065f1b
xor r8d, r8d
mov dword [rsp + 0x48], 0x36
xor edx, edx
mov qword [rbp - 0x50], 0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov qword [r15 + 0x40], rax
mov r10, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
imul eax, dword [rbp - 0x74], 0x98
add edi, eax
cmp edi, ebx
jbe 0x180065b10
mov esi, dword [rbp - 0x74]
mov rdx, qword [rsp + 0x78]
mov r11d, dword [rsp + 0x48]
mov r8d, dword [rsp + 0x4c]
imul r13d, esi, 0xa8c
mov ebx, esi
cmp esi, r13d
ja 0x180066209
mov edi, dword [rsp + 0x40]
mov esi, dword [rsp + 0x40]
mov r14, qword [rbp - 0x70]
lea rax, str.Property.Name.TotalProcesses
cmp ebx, 0xa627
ja 0x1800661db
je 0x18006618c
cmp ebx, 0x389
ja 0x1800660d6
je 0x18006607f
mov eax, ebx
sub eax, 5
je 0x180066039
sub eax, 0xe6
je 0x18006601c
cmp eax, 0x37
jne 0x18006610f
mov r9d, r8d
lea rax, [rbp + 0x230]
mov r8, rdx
mov qword [rsp + 0x20], rax
mov edx, r11d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
jmp 0x1800660fb
mov rax, qword [0x18008a9d8]
mov r9d, 0x10f
mov r8, r10
mov qword [rsp + 0x20], rax
mov rdx, r15
mov rcx, r12
call fcn.180020150
jmp 0x18006620c
mov rdx, qword [rbp - 0x70]
mov rcx, qword [rbp - 0x70]
mov r8d, dword [rsp + 0x40]
mov r11d, dword [rsp + 0x40]
mov qword [rsp + 0x78], rdx
mov qword [rsp + 0x60], rcx
mov dword [rsp + 0x4c], r8d
mov dword [rsp + 0x48], r11d
jmp 0x180065f48
test r15, r15
je 0x1800662f4
cmp dword [r12], 1
jl 0x1800662f4
mov esi, dword [r15 + 4]
jmp 0x18006610f
mov edx, 0x3b
xor ecx, ecx
call fcn.180010640
xor r8d, r8d
mov rdx, r15
mov ecx, 0xef
call fcn.180043bf0
mov r9d, 0x9d
mov dword [rsp + 0x40], 0x10071
mov r8, r15
mov dword [rsp + 0x58], 0x10078
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x58]
call fcn.1800284e0
jmp 0x1800660fb
xor r9d, r9d
mov dword [rsp + 0x20], 0xc7
mov r8, r15
xor edx, edx
xor ecx, ecx
call fcn.18001f350
xor edx, edx
lea ecx, [rdx + 0x60]
call fcn.1800226a0
lea rax, str.Packet_is_too_small_to_contain_cursor___d_vs__d_bytes_.
mov dword [rsp + 0x40], 1
lea r9, [rsp + 0x40]
mov dword [rsp + 0x58], 1
mov r8d, 0x105
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x58]
mov rcx, r15
call fcn.180035650
jmp 0x1800660fb
cmp ebx, 0x70d
je 0x18006615a
cmp ebx, 0xa91
je 0x18006612b
cmp ebx, 0xe15
jne 0x18006610f
mov rdx, r15
mov ecx, 0xea
call fcn.1800303b0
mov r10, qword [rsp + 0x68]
mov r11d, dword [rsp + 0x48]
mov r8d, dword [rsp + 0x4c]
mov rdx, qword [rsp + 0x78]
imul eax, dword [rbp - 0x74], 0xb4
add ebx, eax
cmp ebx, r13d
ja 0x180066209
mov rcx, qword [rsp + 0x60]
jmp 0x180065f66
xor r9d, r9d
mov qword [rsp + 0x20], 0
xor r8d, r8d
mov edx, 0xa2
xor ecx, ecx
call fcn.1800533b0
lea rax, str.CompressedMultiTexImage1DEXT
mov dword [rsp + 0x40], 3
jmp 0x1800660af
lea r9, [rsp + 0x40]
mov dword [rsp + 0x58], 1
mov r8d, 0x105
mov dword [rsp + 0x40], 2
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov rcx, r15
call fcn.180035650
jmp 0x1800660ee
movsxd rcx, dword [r15]
lea r9, [rsp + 0x40]
mov rax, qword [r15 + 0x30]
mov r8d, 0xc0
mov edi, dword [r12]
mov rdx, r15
add edi, esi
cmp edi, dword [r15 + 0xc]
mov r14, qword [rax + rcx*8]
mov ecx, 0x10071
cmovge edi, dword [r15 + 0xc]
mov eax, dword [r10]
dec edi
test eax, eax
cmovne ecx, eax
mov dword [rsp + 0x40], ecx
xor ecx, ecx
call fcn.180019b50
mov r10, qword [rsp + 0x68]
mov dword [r10], eax
jmp 0x180066100
cmp ebx, 0x1f09f
ja 0x180066292
je 0x18006626f
cmp ebx, 0xcd0a
je 0x180066261
cmp ebx, 0x14b63
je 0x180066236
cmp ebx, 0x198f2
jne 0x18006610f
mov eax, dword [rbp - 0x80]
mov rcx, qword [rbp + 0x440]
xor rcx, rsp
call fcn.18006b180
mov rbx, qword [rsp + 0x590]
add rsp, 0x550
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov dword [r12], esi
cmp esi, edi
jg 0x180066255
nop
movsxd rcx, dword [r12]
mov eax, dword [r10]
mov dword [r14 + rcx*4], eax
inc dword [r12]
cmp dword [r12], edi
jle 0x180066240
mov eax, dword [r15]
mov dword [r12], eax
jmp 0x18006610f
cmp qword [r15 + 0x40], 0
setne byte [rbp - 0x80]
jmp 0x18006610f
mov rax, qword [r15 + 0x38]
movsxd rcx, dword [r12]
lea rdx, [rax + rcx*4]
mov eax, dword [rax + rcx*4]
cmp esi, eax
jl 0x18006628b
cmp eax, 0xffffffff
jne 0x18006610a
mov dword [rdx], esi
jmp 0x18006610a
cmp ebx, 0x295db
je 0x1800662db
cmp ebx, 0x33b17
je 0x1800662b3
cmp ebx, 0x3e053
je 0x180066209
jmp 0x18006610f
xor r9d, r9d
mov qword [rsp + 0x20], 0
xor r8d, r8d
mov rdx, r15
mov ecx, 0x12d
call fcn.18001c340
mov dword [rbp - 0x80], 0
jmp 0x1800660fb
movsxd rcx, dword [r12]
mov rax, qword [r15 + 0x40]
cmp edi, dword [rax + rcx*4]
jle 0x18006610f
mov dword [rax + rcx*4], edi
jmp 0x18006610f
mov eax, 0xffffffff
jmp 0x18006620c