Function at 0x1800026c0
Capabilities:
Get common file path
Get file size
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1d0]
sub rsp, 0x2d0
mov rax, qword [0x180007010]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
mov dword [rsp + 0x40], 0xa1b8c4af
mov dword [rsp + 0x44], 0xb3e1f2d3
xor esi, esi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180002aca
lea rdx, [rbp - 0x78]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r12, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, edi
mov rdx, r12
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180002aca
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14d, esi
mov r9d, esi
lea r8, [0x180007360]
mov rcx, r8
lea r13, [0x1800053f0]
movzx edx, word [rcx]
test dx, dx
jne 0x1800027b3
cmp word [rcx + 2], si
je 0x1800027d8
mov eax, r9d
and eax, 0x80000007
jge 0x1800027c4
dec eax
or eax, 0xfffffff8
inc eax
cdqe
xor dx, word [r13 + rax*2]
mov word [rcx], dx
inc r9d
add rcx, 2
jmp 0x1800027a5
lea eax, [rdi - 1]
movsxd rcx, eax
cmp rcx, 1
jle 0x1800027f6
cmp byte [rcx + r12], sil
je 0x1800027f6
inc r14d
dec rcx
cmp rcx, 1
jg 0x1800027e4
mov r15d, edi
sub r15d, r14d
movsxd rdx, r15d
cmp edx, edi
jae 0x18000282a
lea r9, [r12 + rdx]
mov eax, edx
and eax, 0x80000007
jge 0x180002817
dec eax
or eax, 0xfffffff8
inc eax
cdqe
movzx ecx, byte [rsp + rax + 0x40]
xor byte [r9], cl
inc edx
inc r9
cmp edx, edi
jb 0x180002807
mov edx, esi
nop dword [rax]
movzx ecx, word [r8]
test cx, cx
jne 0x180002840
cmp word [r8 + 2], si
je 0x180002864
mov eax, edx
and eax, 0x80000007
jge 0x180002850
dec eax
or eax, 0xfffffff8
inc eax
cdqe
xor cx, word [r13 + rax*2]
mov word [r8], cx
inc edx
add r8, 2
jmp 0x180002830
mov qword [rsp + 0x68], rsi
mov qword [rbp - 0x80], 7
mov qword [rsp + 0x78], rsi
mov word [rsp + 0x68], si
mov edx, 0x149
call fcn.1800011d0
lea rdx, [rbp - 0x50]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov rsi, 0xffffffffffffffff
test eax, eax
je 0x1800028f9
lea rax, [rbp - 0x50]
mov rdx, rsi
inc rdx
cmp word [rax + rdx*2], 0
jne 0x1800028a6
mov rax, qword [rbp - 0x80]
cmp rdx, rax
ja 0x1800028e8
lea rdi, [rsp + 0x68]
cmp rax, 8
cmovae rdi, qword [rsp + 0x68]
mov qword [rsp + 0x78], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
lea rdx, [rbp - 0x50]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
xor eax, eax
mov word [rbx + rdi], ax
jmp 0x1800028f9
lfence
lea r9, [rbp - 0x50]
lea rcx, [rsp + 0x68]
call fcn.1800035a0
mov ecx, 0x72
call fcn.1800012d0
xor edi, edi
mov r8d, edi
lea rbx, [0x1800072b0]
mov rcx, rbx
movzx edx, word [rcx]
test dx, dx
jne 0x180002920
cmp word [rcx + 2], di
je 0x180002945
mov eax, r8d
and eax, 0x80000007
jge 0x180002931
dec eax
or eax, 0xfffffff8
inc eax
cdqe
xor dx, word [r13 + rax*2]
mov word [rcx], dx
inc r8d
add rcx, 2
jmp 0x180002912
inc rsi
cmp word [rbx + rsi*2], di
jne 0x180002945
movabs rax, 0x7ffffffffffffffe
sub rax, qword [rsp + 0x78]
cmp rax, rsi
jb 0x180002afa
lfence
lea r9, [rsp + 0x68]
cmp qword [rbp - 0x80], 8
cmovae r9, qword [rsp + 0x68]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rbx
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x48]
call fcn.180003710
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x1800029db
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800029d6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800029d6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180003c54
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rsp + 0x68], xmm0
movups xmm1, xmmword [rsp + 0x58]
movups xmmword [rsp + 0x78], xmm1
mov edx, edi
movzx ecx, word [rbx]
test cx, cx
jne 0x1800029ff
cmp word [rbx + 2], cx
je 0x180002a22
mov eax, edx
and eax, 0x80000007
jge 0x180002a0f
dec eax
or eax, 0xfffffff8
inc eax
cdqe
xor cx, word [r13 + rax*2]
mov word [rbx], cx
inc edx
add rbx, 2
jmp 0x1800029f1
lea rcx, [rsp + 0x68]
cmp qword [rsp + 0x60], 8
cmovae rcx, qword [rsp + 0x48]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x120116
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180002a86
mov edx, r15d
add rdx, r12
mov qword [rsp + 0x20], rdi
xor r9d, r9d
mov r8d, r14d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x180002aca
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180002ac5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180002ac5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180003c54
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.180003870
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1800011b0
nop