Function at 0x1400026b0
Capabilities:
Get common file path
Read file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x6d8
mov edx, 0x105
lea rcx, [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea r8, [0x140011984]
mov edx, 0x105
lea rcx, [rsp + 0x160]
call fcn.140005b24
lea r8, [rsp + 0x160]
mov edx, 0x105
lea rcx, [rsp + 0x40]
call fcn.140005ab0
lea r8, [0x140011990]
mov edx, 0x105
lea rcx, [rsp + 0x40]
call fcn.140005b24
lea r8, [rsp + 0x160]
mov edx, 0x105
lea rcx, [rsp + 0x380]
call fcn.140005ab0
lea r8, [0x1400119a8]
mov edx, 0x105
lea rcx, [rsp + 0x380]
call fcn.140005b24
lea r8, [rsp + 0x160]
mov edx, 0x105
lea rcx, [rsp + 0x270]
call fcn.140005ab0
lea r8, [0x1400119c0]
mov edx, 0x105
lea rcx, [rsp + 0x270]
call fcn.140005b24
mov qword [rsp + 0x158], 0
mov qword [rsp + 0x4a0], 0
mov qword [rsp + 0x150], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x158], rax
cmp qword [rsp + 0x158], 0xffffffffffffffff
jne 0x1400027ee
jmp 0x140002baf
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 3
mov edx, 0x40000000
lea rcx, [rsp + 0x380]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x4a0], rax
cmp qword [rsp + 0x4a0], 0xffffffffffffffff
jne 0x140002840
jmp 0x140002baf
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 3
mov edx, 0x40000000
lea rcx, [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x150], rax
cmp qword [rsp + 0x150], 0xffffffffffffffff
jne 0x140002892
jmp 0x140002baf
mov dword [rsp + 0x490], 0
mov dword [rsp + 0x494], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x494]
mov r8d, 4
lea rdx, [rsp + 0x490]
mov rcx, qword [rsp + 0x158]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400028e6
mov eax, dword [rsp + 0x494]
cmp rax, 4
je 0x1400028f0
jmp 0x140002baf
mov edx, dword [rsp + 0x490]
mov rcx, qword [rsp + 0x150]
call fcn.140002310
mov dword [rsp + 0x498], 0
mov eax, dword [rsp + 0x490]
cmp dword [rsp + 0x498], eax
je 0x140002ba2
mov dword [rsp + 0x4a8], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x494]
mov r8d, 4
lea rdx, [rsp + 0x4a8]
mov rcx, qword [rsp + 0x158]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14000296c
mov eax, dword [rsp + 0x494]
cmp rax, 4
je 0x140002976
jmp 0x140002baf
cmp dword [rsp + 0x4a8], 1
je 0x140002994
cmp dword [rsp + 0x4a8], 2
je 0x140002994
jmp 0x140002baf
mov dword [rsp + 0x4ac], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x494]
mov r8d, 4
lea rdx, [rsp + 0x4ac]
mov rcx, qword [rsp + 0x158]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400029dd
mov eax, dword [rsp + 0x494]
cmp rax, 4
je 0x1400029e7
jmp 0x140002baf
cmp dword [rsp + 0x4ac], 0
jbe 0x140002b9d
mov dword [rsp + 0x4b0], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x494]
mov r8d, 4
lea rdx, [rsp + 0x4b0]
mov rcx, qword [rsp + 0x158]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140002a59
mov eax, dword [rsp + 0x494]
cmp rax, 4
jne 0x140002a59
cmp dword [rsp + 0x4b0], 0x200
ja 0x140002a59
mov eax, dword [rsp + 0x4b0]
and eax, 1
test eax, eax
je 0x140002a63
jmp 0x140002baf
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x494]
mov r8d, dword [rsp + 0x4b0]
lea rdx, [rsp + 0x4c0]
mov rcx, qword [rsp + 0x158]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140002aa6
mov eax, dword [rsp + 0x4b0]
cmp dword [rsp + 0x494], eax
je 0x140002ab0
jmp 0x140002baf
xor edx, edx
mov eax, dword [rsp + 0x4b0]
mov ecx, 2
div ecx
mov ecx, eax
xor eax, eax
mov word [rsp + rcx*2 + 0x4c0], ax
mov dword [rsp + 0x4b4], 0
cmp dword [rsp + 0x4a8], 1
jne 0x140002b02
lea rcx, [rsp + 0x4c0]
call fcn.140002440
movzx eax, al
test eax, eax
je 0x140002b00
mov dword [rsp + 0x4b4], 1
jmp 0x140002b2b
cmp dword [rsp + 0x4a8], 2
jne 0x140002b2b
lea rcx, [rsp + 0x4c0]
call fcn.1400024e0
movzx eax, al
test eax, eax
je 0x140002b2b
mov dword [rsp + 0x4b4], 1
mov r9d, dword [rsp + 0x4b4]
lea r8, [rsp + 0x4c0]
mov edx, dword [rsp + 0x4a8]
mov rcx, qword [rsp + 0x4a0]
call fcn.140002590
movzx eax, al
test eax, eax
jne 0x140002b5a
jmp 0x140002baf
mov r8d, dword [rsp + 0x490]
mov edx, dword [rsp + 0x498]
mov rcx, qword [rsp + 0x150]
call fcn.1400021b0
mov eax, dword [rsp + 0x4ac]
sub eax, 1
mov dword [rsp + 0x4ac], eax
mov eax, dword [rsp + 0x498]
add eax, 1
mov dword [rsp + 0x498], eax
jmp 0x1400029e7
jmp 0x14000290f
mov rcx, qword [rsp + 0x150]
call fcn.140002350
cmp qword [rsp + 0x158], 0
je 0x140002bc8
mov rcx, qword [rsp + 0x158]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsp + 0x4a0], 0
je 0x140002be1
mov rcx, qword [rsp + 0x4a0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsp + 0x150], 0
je 0x140002bfa
mov rcx, qword [rsp + 0x150]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x6d8
ret