Function at 0x18001d870
Capabilities:
Get common file path
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1d0
mov rax, qword [0x180079880]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
lea eax, [r8 - 0xe]
mov dword [rsp + 0x48], r8d
mov qword [rsp + 0x50], rcx
mov rsi, rdx
mov dword [rsp + 0x40], eax
mov rdx, rcx
cmp r8d, eax
jbe case.0x18001d93b.6
mov r13d, dword [rsp + 0x60]
lea edi, [r8 - 0x2f]
movzx r14d, byte [rsp + 0x4c]
xor ebx, ebx
mov r12, qword [rsp + 0x80]
mov eax, r8d
movzx ebp, byte [rsp + 0x4c]
mov r15d, dword [rsp + 0x60]
mov ecx, dword [rsp + 0x40]
mov dword [rsp + 0x58], edi
lea r8, [0x180000000]
cmp edi, 0x20
ja case.default.0x18001d90c
movzx eax, byte [r8 + rdi + 0x1dce8]
mov ecx, dword [r8 + rax*4 + 0x1dcac]
add rcx, r8
jmp rcx
mov eax, dword [rsp + 0x5c]
cmp eax, dword [rsp + 0x64]
je case.0x18001d90c.14
mov edi, ebx
nop
cmp edi, 0x54
ja case.0x18001d93b.7
mov eax, edi
movzx eax, byte [r8 + rax + 0x1dd2c]
mov ecx, dword [r8 + rax*4 + 0x1dd0c]
add rcx, r8
jmp rcx
mov qword [rsi + 0x10], rbx
mov r14b, 1
cmp qword [rsi + 0x18], 0x10
mov r13d, 0xc
mov rax, rsi
jb 0x18001d957
mov rax, qword [rsi]
mov byte [rax], bl
jmp case.0x18001d93b.7
test r14b, r14b
je case.0x18001d93b.7
lea rcx, [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_GetConsoleDisplayMode]
test eax, eax
je 0x18001d984
lea r8, [rsp + 0x60]
mov edx, 2
mov rcx, r12
call sub.KERNEL32.dll_SetConsoleDisplayMode
lea r8, [0x180000000]
add edi, 0xe
lea eax, [rdi + 0xd6]
cmp eax, 0x138
jb 0x18001d920
jmp 0x18001dc0c
mov dword [rsp + 0x60], ebx
jmp case.0x18001d93b.7
mov edx, r13d
lea rcx, [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_IsBadHugeWritePtr]
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumSystemCodePagesA]
jmp 0x18001d984
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r8, [0x180000000]
mov r12, rax
cmp rax, 0xffffffffffffffff
jne case.0x18001d93b.7
xor r14b, r14b
jmp case.0x18001d93b.7
mov byte [rsp + 0x70], bl
jmp case.0x18001d93b.7
mov rcx, qword [rsp + 0x68]
mov dword [rcx + 0x30], ebx
mov eax, dword [rsi]
mov dword [rcx + 0x4c], eax
jmp case.0x18001d90c.14
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18001dc10
test rdx, rdx
je 0x18001da34
cmp dword [rsi], ebx
jl 0x18001da34
mov ecx, 0x58
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rsp + 0x68], rax
cmp rax, 0
jne 0x18001dc10
mov rax, rbx
jmp 0x18001dc7e
cmp qword [rsi + 0x18], 0x10
mov rdx, rsi
jb 0x18001da49
mov rdx, qword [rsi]
mov r8d, dword [rsp + 0x5c]
lea r9, [rsp + 0x64]
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x18001dc10
mov rcx, qword [rsp + 0x78]
xor edx, edx
mov dword [rsp + 0x64], ebx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, eax
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x5c], eax
call fcn.18004d050
jmp 0x18001dc10
mov rdi, qword [rsp + 0x68]
mov qword [rdi], rbx
mov qword [rdi + 8], rbx
mov qword [rdi + 0x40], rbx
mov eax, dword [rsi]
inc eax
movsxd rcx, eax
shl rcx, 2
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rdi + 0x10], rax
jmp 0x18001dc0c
mov rcx, qword [rsp + 0x68]
mov qword [rcx + 0x50], rdx
mov eax, dword [rsi]
inc eax
mov dword [rcx + 0x1c], ebx
mov dword [rcx + 0x18], eax
mov dword [rcx + 0x2c], ebx
jmp case.0x18001d90c.14
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18001dc10
xor eax, eax
lock cmpxchg qword [0x180079950], rbx
mov qword [rsp + 0x90], rax
je case.0x18001d93b.6
mov rcx, rbx
lea r8, [rsp + 0x80]
xchg qword [0x180079950], rcx
xor ecx, ecx
mov qword [rsp + 0x80], rax
mov edx, 0xfe
call fcn.180021c80
jmp 0x18001dc10
xor r9d, r9d
mov qword [rsp + 0x28], rbx
mov r8d, 0x80000000
mov dword [rsp + 0x20], 0x20000000
lea edx, [r9 + 0xb]
lea ecx, [rdx + 0x74]
call qword [sym.imp.KERNEL32.dll_GetCalendarInfoW]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
jmp 0x18001dc10
cmp qword [rdx + 0x18], 8
mov rcx, rdx
jb 0x18001db68
mov rcx, qword [rdx]
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x78], rax
cmp rax, 0xffffffffffffffff
jne 0x18001dc10
mov edi, 0xd1
nop
cmp edi, 0xd1
je 0x18001dbf2
cmp edi, 0x4494
je 0x18001dbc1
cmp edi, 0x8857
jne 0x18001dbfe
mov byte [rsp + 0x70], bl
jmp case.0x18001d93b.6
mov edx, 0x104
lea rcx, [rsp + 0xb0]
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryA]
test r15d, r15d
movzx eax, bpl
mov ecx, ebx
cmovne ecx, eax
movzx ebp, cl
test cl, cl
je 0x18001dbfe
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_SetConsoleCP]
jmp 0x18001dbfe
mov bpl, 1
call qword [sym.imp.KERNEL32.dll_GetConsoleCP]
mov r15d, eax
add edi, 0x43c3
cmp edi, 0xcb49
jbe 0x18001dba0
mov edi, dword [rsp + 0x58]
mov rdx, qword [rsp + 0x50]
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x40]
dec eax
dec edi
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x58], edi
cmp eax, ecx
jbe case.0x18001d93b.6
jmp 0x18001d8e8
mov rdi, qword [rsp + 0x68]
cmp qword [rdi + 0x10], rbx
je 0x18001dc5a
mov eax, dword [rdx + 0x10]
lea r8, [rsp + 0x40]
mov edx, 0x86
mov dword [rsp + 0x40], eax
mov rcx, rdi
call fcn.180006ca0
test eax, eax
jne 0x18001dc6f
mov r9, rdi
xor r8d, r8d
xor edx, edx
mov ecx, 0xb2
call fcn.1800314c0
mov rdi, rbx
mov rax, rdi
jmp 0x18001dc7e
mov byte [rsp + 0x70], 1
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.180050c90
mov rbx, qword [rsp + 0x220]
add rsp, 0x1d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret