Function at 0x180083af0
Capabilities:
Contain obfuscated stackstrings
Get common file path
Get file size

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x238]
sub rsp, 0x330
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x180208090]
xor rax, rsp
mov qword [rbp + 0x220], rax
mov rdi, rdx
mov dword [rbp - 0x40], 0x61004d
mov ebx, 0x63
mov dword [rbp - 0x3c], 0x720063
mov dword [rbp - 0x38], 0x6d006f
mov dword [rbp - 0x34], 0x640065
mov dword [rbp - 0x30], 0x46005c
mov dword [rbp - 0x2c], 0x61006c
mov dword [rbp - 0x28], 0x680073
mov dword [rbp - 0x24], 0x46005c
mov dword [rbp - 0x20], 0x61006c
mov dword [rbp - 0x1c], 0x680073
mov dword [rbp - 0x18], 0x650048
mov dword [rbp - 0x14], 0x70006c
mov dword [rbp - 0x10], 0x720065
mov dword [rbp - 0xc], 0x650053
mov dword [rbp - 8], 0x760072
mov dword [rbp - 4], 0x630069
mov dword [rbp], 0x2e0065
mov dword [rbp + 4], 0x780065
mov dword [rbp + 8], 0x65
xor esi, esi
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x10]
call fcn.1800f7810
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [rbx - 0x3a]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x48]
call fcn.180003bb0
nop
lea rdx, [rbp + 0x10]
lea rcx, [rbp - 0x68]
call fcn.180003bb0
nop
lea r8, [rsp + 0x48]
lea rdx, [rbp - 0x68]
lea rcx, [rsp + 0x78]
call fcn.180099c60
nop
lea rcx, [rbp - 0x68]
call fcn.180003b80
nop
lea rcx, [rsp + 0x48]
call fcn.180003b80
lea rcx, [rsp + 0x78]
call fcn.180098ee0
test al, al
je 0x180083e81
mov qword [rdi], rsi
mov qword [rsp + 0x68], rsi
lea rcx, [rsp + 0x68]
call fcn.1800038c0
nop
lea ecx, [rbx - 0x5b]
call fcn.1800d8074
mov qword [rsp + 0x70], rax
mov qword [rax], 0xffffffffffffffff
mov qword [rsp + 0x68], rax
cmp qword [rsp + 0x68], rsi
je 0x180083e45
lea rcx, [rsp + 0x78]
call fcn.180003a80
mov rcx, rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [rbx - 0x62]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rcx, qword [rsp + 0x68]
mov qword [rcx], rax
mov rax, qword [rsp + 0x68]
cmp qword [rax], 0xffffffffffffffff
jne 0x180083dce
lea rcx, [rbp - 0x68]
call fcn.180003c60
nop
lea rcx, [rsp + 0x78]
call fcn.180006030
cmp rax, 2
jbe 0x180083db1
lea rcx, [rsp + 0x78]
call fcn.1800038c0
mov rcx, rax
call fcn.180003ef0
cmp word [rax + 2], 0x3a
jne 0x180083db1
lea rcx, [rsp + 0x78]
call fcn.1800038c0
mov rcx, rax
call fcn.180003ef0
cmp word [rax], 0x41
jb 0x180083d26
lea rcx, [rsp + 0x78]
call fcn.1800038c0
mov rcx, rax
call fcn.180003ef0
cmp word [rax], 0x5a
jbe 0x180083d56
lea rcx, [rsp + 0x78]
call fcn.1800038c0
mov rcx, rax
call fcn.180003ef0
cmp word [rax], 0x61
jb 0x180083db1
lea rcx, [rsp + 0x78]
call fcn.1800038c0
mov rcx, rax
call fcn.180003ef0
cmp word [rax], 0x7a
ja 0x180083db1
lea rdx, str.__
lea rcx, [rbp - 0x68]
call fcn.180004070
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x68]
call fcn.180012d20
lea rcx, [rbp - 0x68]
call fcn.180003a80
mov rcx, rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rcx, qword [rsp + 0x68]
mov qword [rcx], rax
jmp 0x180083dc0
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x68]
call fcn.180003ae0
nop
lea rcx, [rbp - 0x68]
call fcn.180003b80
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax]
cmp rcx, 0xffffffffffffffff
je 0x180083e45
lea rdx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x180083df7
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x180083df7
xor bl, bl
jmp 0x180083e07
mov ecx, dword [rsp + 0x70]
shl rcx, 0x20
add rcx, rbx
mov qword [rdi], rcx
mov bl, 1
mov rdi, qword [rsp + 0x68]
test rdi, rdi
je 0x180083e39
mov rcx, qword [rdi]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x180083e27
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi], rsi
mov edx, 8
mov rcx, rdi
call fcn.1800d80b0
mov qword [rsp + 0x68], rsi
lea rcx, [rsp + 0x68]
call fcn.180003800
jmp 0x180083e83
mov rbx, qword [rsp + 0x68]
test rbx, rbx
je 0x180083e77
mov rcx, qword [rbx]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x180083e65
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx], rsi
mov edx, 8
mov rcx, rbx
call fcn.1800d80b0
mov qword [rsp + 0x68], rsi
lea rcx, [rsp + 0x68]
call fcn.180003800
xor bl, bl
lea rcx, [rsp + 0x78]
call fcn.180003b80
movzx eax, bl
mov rcx, qword [rbp + 0x220]
xor rcx, rsp
call fcn.1800d8050
lea r11, [rsp + 0x330]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret