Function at 0x1400013a0
Capabilities:
Get common file path
Get file size
Read file on windows

Disassembly:
push rbp
push rbx
push r13
push r15
lea rbp, [rsp - 0x1b8]
sub rsp, 0x2b8
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
xor r13d, r13d
mov ecx, 0xb
mov r15d, r13d
call fcn.140001130
mov rbx, rax
test rax, rax
je 0x140001960
cmp dword [rax], r13d
jbe 0x140001960
mov rcx, qword [rax + 0x18]
mov edx, 0x104
mov qword [0x1400066c8], rcx
mov ecx, dword [rax + 0x20]
mov dword [0x1400066a0], ecx
lea rcx, [rbp + 0x90]
movzx r8d, word [rax + 0x2e]
add r8, 0x30
mov qword [rsp + 0x2e8], rdi
add r8, rax
mov qword [rsp + 0x2e0], rsi
mov qword [rsp + 0x2b0], r14
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov edx, 0x104
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea r8, [0x1400043dc]
mov edx, 0x104
lea rcx, [rbp - 0x80]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
lea r8, [rbp + 0x90]
mov edx, 0x104
lea rcx, [rbp - 0x80]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
mov qword [rsp + 0x30], r13
lea rcx, [rbp - 0x80]
mov dword [rsp + 0x28], r13d
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov r8d, 7
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400014dd
lea rdx, [rsp + 0x70]
mov dword [rsp + 0x70], r13d
mov rcx, rax
xor r14b, r14b
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
test eax, eax
je 0x140001589
cmp dword [rsp + 0x70], r13d
je 0x14000152f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r10, qword [0x1400066b8]
movzx eax, byte [0x14000668c]
test al, al
jne 0x140001512
test r10, r10
je 0x140001512
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_LocalFree]
movzx eax, byte [0x14000668c]
mov qword [0x1400066b8], r13
mov dword [0x140006688], r13d
mov r14, qword [rsp + 0x2b0]
mov rdi, qword [rsp + 0x2e8]
mov rsi, qword [rsp + 0x2e0]
jmp 0x140001962
mov rdx, rsi
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x140001589
xor r9d, r9d
mov dword [rsp + 0x74], r13d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea r9, [rsp + 0x74]
mov qword [rsp + 0x20], r13
mov r8d, esi
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140001580
mov r15, rbx
mov r14b, 1
jmp 0x140001589
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14b, r14b
je 0x1400014dd
mov esi, dword [r15 + 0x3c]
mov ecx, 0x40
add rsi, r15
mov qword [rsp + 0x2f0], r12
mov r12d, dword [rsi + 0x50]
movzx ebx, word [rsi + 0x14]
mov edx, r12d
add rbx, 0x20
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x1400016df
mov r8d, r12d
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov r8d, dword [rsi + 0x54]
mov rdx, r15
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov r14d, r13d
cmp r13w, word [rsi + 6]
jae 0x14000162c
add rbx, rsi
nop dword [rax]
mov ecx, dword [rbx + 8]
cmp ecx, dword [rbx]
mov edx, dword [rbx + 0xc]
cmovae ecx, dword [rbx]
add rdx, r15
mov r8d, ecx
mov ecx, dword [rbx + 4]
add rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
movzx eax, word [rsi + 6]
lea rbx, [rbx + 0x28]
inc r14d
cmp r14d, eax
jb 0x140001600
mov r11, qword [0x1400066c8]
mov qword [0x1400066b8], rdi
mov dword [0x140006688], r12d
mov eax, dword [rdi + 0x3c]
mov ecx, dword [rax + rdi + 0xb0]
mov rbx, qword [rax + rdi + 0x30]
mov r14d, dword [rax + rdi + 0xb4]
test ecx, ecx
je 0x1400016df
lea r9, [rdi + rcx]
mov esi, r13d
test r14d, r14d
je 0x1400016df
mov eax, dword [r9 + 4]
test eax, eax
je 0x1400016df
mov r10d, dword [r9 + 4]
lea r8, [r9 + 8]
sub r10, 8
mov edx, r13d
shr r10, 1
test r10d, r10d
je 0x1400016cd
nop dword [rax + rax]
movzx eax, word [r8]
movzx ecx, ax
test ax, ax
je 0x1400016c2
shr ax, 0xc
cmp ax, 0xa
je 0x1400016ad
test ax, ax
jne 0x1400016df
jmp 0x1400016c2
and ecx, 0xfff
mov rax, r11
add ecx, dword [r9]
sub rax, rbx
add rcx, rdi
add qword [rcx], rax
inc edx
add r8, 2
cmp edx, r10d
jb 0x140001690
mov eax, dword [r9 + 4]
add r9, rax
mov eax, dword [r9 + 4]
add esi, eax
cmp r14d, esi
ja 0x140001670
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r10, qword [0x1400066b8]
mov r12, qword [rsp + 0x2f0]
test r10, r10
je 0x1400014e4
mov eax, dword [r10 + 0x3c]
add rax, r10
movzx ecx, word [rax + 0x14]
movzx edx, word [rax + 6]
add rcx, 0x20
cmp r13w, dx
jae 0x1400018f6
mov rbx, qword [0x1400066c8]
lea r14, [rcx + rax]
mov r15d, edx
nop dword [rax + rax]
mov eax, dword [r14 + 0x1c]
and eax, 0x22000000
cmp eax, 0x20000000
jne 0x1400018e8
mov esi, dword [r14]
mov r11d, r13d
sub esi, 0x100
je 0x1400018e8
mov edi, dword [r14 + 4]
nop word [rax + rax]
lea r9d, [rdi + r11]
mov dword [rsp + 0x50], 0x24448b48
mov dword [rsp + 0x54], 0x4c8b4820
mov rax, r13
mov dword [rsp + 0x58], 0x8b482824
mov dword [rsp + 0x5c], 0x4c302454
mov dword [rsp + 0x60], 0x3824448b
mov dword [rsp + 0x64], 0x244c8b4c
mov dword [rsp + 0x68], 0xc4834840
mov dword [rsp + 0x6c], 0xe0ff4848
nop word [rax + rax]
movzx r8d, byte [rsp + rax + 0x50]
cmp r8b, 0xff
je 0x1400017c9
lea rcx, [r9 + rax]
mov edx, r9d
cmp r8b, byte [rcx + r10]
jne 0x1400017e0
inc rax
cmp rax, 0x20
jl 0x1400017b0
lea rax, [r9 + rbx]
mov edx, r9d
mov qword [0x140006678], rax
lea rcx, [rsp + 0x48]
mov dword [rsp + 0x48], 0x68c48348
sub rdx, rcx
mov byte [rsp + 0x4c], 0xc3
mov rax, r13
lea r8, [rdx + r10]
nop dword [rax]
lea rcx, [rsp + 0x48]
add rcx, rax
movzx edx, byte [rcx]
cmp dl, 0xff
je 0x140001816
cmp dl, byte [rcx + r8]
jne 0x14000182c
inc rax
cmp rax, 5
jl 0x140001800
mov eax, r9d
add rax, rbx
mov qword [0x140006670], rax
mov r8d, r9d
lea rdx, [rsp + 0x40]
sub r8, rdx
mov word [rsp + 0x40], 0xc359
add r8, r10
mov rcx, r13
nop dword [rax]
nop dword [rax + rax]
lea rax, [rsp + 0x40]
add rax, rcx
movzx edx, byte [rax]
cmp dl, 0xff
je 0x140001866
cmp dl, byte [rax + r8]
jne 0x14000187c
inc rcx
cmp rcx, 2
jl 0x140001850
mov eax, r9d
add rax, rbx
mov qword [0x140006690], rax
mov r8d, r9d
lea rdx, [rsp + 0x44]
sub r8, rdx
mov dword [rsp + 0x44], 0xc3018948
add r8, r10
mov rcx, r13
nop word [rax + rax]
lea rax, [rsp + 0x44]
add rax, rcx
movzx edx, byte [rax]
cmp dl, 0xff
je 0x1400018b6
cmp dl, byte [rax + r8]
jne 0x1400018dc
inc rcx
cmp rcx, 4
jl 0x1400018a0
lea ecx, [r11 + 3]
mov eax, r9d
add rax, rbx
add ecx, edi
add rcx, rbx
mov qword [0x140006698], rax
mov qword [0x140006680], rcx
inc r11d
cmp r11d, esi
jb 0x140001760
add r14, 0x28
sub r15, 1
jne 0x140001730
cmp qword [0x140006678], r13
je 0x1400014e4
cmp qword [0x140006670], r13
je 0x1400014e4
cmp qword [0x140006690], r13
je 0x1400014e4
cmp qword [0x140006698], r13
je 0x1400014e4
cmp qword [0x140006680], r13
je 0x1400014e4
lea rcx, str.ZwTerminateThread
call fcn.140001210
mov qword [0x140006668], rax
test rax, rax
je 0x1400014dd
mov al, 1
mov byte [0x14000668c], al
jmp 0x140001512
xor al, al
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.1400024c0
add rsp, 0x2b8
pop r15
pop r13
pop rbx
pop rbp
ret