Function at 0x180029ac0
Capabilities:
Get file size
Query environment variable
Read file on windows
Set environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x40]
sub rsp, 0x140
mov rax, qword [0x180071748]
xor rax, rsp
mov qword [rbp + 0x38], rax
mov r15, qword [rbp + 0xa0]
mov r12, r8
imul r13d, ecx, 0x5d8
xor r8d, r8d
mov qword [rsp + 0x68], r9
mov ebx, ecx
mov dword [rsp + 0x5c], ecx
mov esi, ecx
mov qword [rsp + 0x70], rdx
cmp ecx, r13d
ja 0x180029e63
mov ebx, dword [rsp + 0x60]
lea ecx, [r8 + 0x6f]
mov r14, qword [rbp - 0x60]
nop word [rax + rax]
cmp esi, 0x49da
ja 0x180029dc0
je 0x180029db6
mov eax, esi
sub eax, 0x61
je 0x180029c37
sub eax, 0x17
je 0x180029ed0
sub eax, 0x12
je 0x180029b9f
sub eax, 0x7c
je 0x180029b72
cmp eax, 0x32e3
jne 0x180029e4c
mov eax, ebx
jmp 0x18002a2d5
mov r8d, 2
lea rdx, [0x18006af8c]
lea rcx, [rbp - 8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov r9, qword [rsp + 0x68]
xor r8d, r8d
mov word [rbp - 4], r8w
lea ecx, [r8 + 0x6f]
jmp 0x180029e4c
cmp dword [r15], 0
jne 0x180029c05
mov edi, 6
nop word [rax + rax]
cmp edi, 6
je 0x180029bef
cmp edi, 0x3a8
je 0x180029bd1
cmp edi, 0x74a
jne 0x180029bf4
test r14, r14
je 0x180029bf4
xor eax, eax
jmp 0x18002a2d5
mov r8d, 1
lea rdx, [rsp + 0x40]
mov rcx, r9
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov r9, qword [rsp + 0x68]
mov r14d, eax
jmp 0x180029bf4
mov byte [rsp + 0x40], 0
add edi, 0x3a2
cmp edi, 0xae6
jbe 0x180029bb0
xor r8d, r8d
mov rax, qword [rsp + 0x70]
mov rdx, r8
mov rcx, r9
cmp byte [rax], 0
cmovne rdx, rax
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
je 0x180029ec6
mov r9, qword [rsp + 0x68]
mov ecx, 0x6f
xor r8d, r8d
jmp 0x180029e4c
mov rax, qword [r9]
mov rdx, r15
mov r9d, 0xc1
mov rcx, r12
cmp byte [rax + 0x384], 0
mov r8, qword [rax + 0x120]
mov qword [rbp - 0x70], rax
sete byte [rsp + 0x48]
lea rax, [rbp - 0x70]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call fcn.18003ea50
mov rbx, rax
test eax, eax
jne 0x18002a2d5
cmp qword [rsp + 0x70], 0
mov r9, qword [rsp + 0x68]
je 0x180029da9
mov rax, qword [r9]
cmp qword [rax + 0x378], 0
je 0x180029d34
mov edi, 0xa2
cmp edi, 0xa2
je 0x180029d08
cmp edi, 0xb64
je 0x180029ccf
cmp edi, 0x1626
je case.0x180029ec4.11
jmp 0x180029d19
mov rax, qword [r9]
mov r8, r15
mov qword [rsp + 0x78], rax
mov r9, r12
mov rax, qword [rsp + 0x70]
xor edx, edx
mov qword [rsp + 0x28], rax
mov ecx, 0x150
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
call fcn.1800351e0
mov r9, qword [rsp + 0x68]
mov dword [rsp + 0x58], eax
jmp 0x180029d19
mov rax, qword [r9]
lea rcx, [0x18004ccf0]
mov qword [rax + 0x218], rcx
add edi, 0xac2
cmp edi, 0x2046
jbe 0x180029cb1
mov ecx, 0x6f
xor r8d, r8d
jmp 0x180029e4c
mov edi, 0xd0
nop dword [rax]
mov eax, edi
sub eax, 0xd0
je 0x180029d8d
sub eax, 0x7c
je 0x180029d59
cmp eax, 0x7c
je case.0x180029ec4.11
jmp 0x180029d9e
mov rax, qword [r9]
lea r8, [rsp + 0x78]
mov rdx, qword [rsp + 0x70]
mov r9, r15
mov qword [rsp + 0x28], r12
xor ecx, ecx
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x20], 0x3d
call fcn.180033660
mov r9, qword [rsp + 0x68]
mov dword [rsp + 0x58], eax
jmp 0x180029d9e
mov rax, qword [r9]
lea rcx, [0x18003e890]
mov qword [rax + 0x218], rcx
add edi, 0x7c
cmp edi, 0x244
jb 0x180029d40
mov ecx, 0x6f
xor r8d, r8d
jmp 0x180029e4c
mov dword [rsp + 0x58], r8d
jmp 0x180029e4c
cmp esi, 0x8c36
je 0x180029e38
cmp esi, 0x932a
je case.0x180029ec4.11
cmp esi, 0x11766
je 0x180029e31
cmp esi, 0x1a296
je 0x180029e17
cmp esi, 0x22dc6
jne 0x180029e4c
mov word [rbp + 0xa], r8w
lea rdx, [0x18006aff0]
mov r8d, 5
lea rcx, [rbp + 0xa]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov r9, qword [rsp + 0x68]
mov ecx, 0x6f
xor r8d, r8d
jmp 0x180029e4c
mov eax, dword [0x18006ae72]
mov dword [rbp + 2], eax
movzx eax, word [0x18006ae76]
mov word [rbp + 6], ax
mov word [rbp + 8], cx
jmp 0x180029e4c
mov word [rbp + 2], r8w
jmp 0x180029e4c
mov eax, dword [0x18006aee4]
mov dword [rbp - 4], eax
movzx eax, word [0x18006aee8]
mov word [rbp], ax
imul eax, dword [rsp + 0x5c], 0x88
add esi, eax
cmp esi, r13d
jbe 0x180029b30
mov ebx, dword [rsp + 0x5c]
lea edx, [rbx + 0xc]
mov dword [rsp + 0x44], edx
cmp ebx, edx
jae case.0x180029ec4.11
mov r12, qword [rbp - 0x70]
lea edx, [rbx - 0x106]
mov esi, dword [rsp + 0x60]
lea r11, [0x180000000]
mov r13d, dword [rsp + 0x60]
mov r10d, 0x28
movzx r15d, byte [rsp + 0x48]
mov r14, qword [rbp - 0x60]
mov eax, dword [rsp + 0x44]
mov edi, dword [rsp + 0x54]
mov dword [rsp + 0x50], edx
nop dword [rax + rax]
cmp edx, 0xb
ja case.default.0x180029ec4
mov ecx, dword [r11 + rdx*4 + 0x2a2fc]
add rcx, r11
jmp rcx
mov eax, 0xffffffff
jmp 0x18002a2d5
mov rax, qword [r9]
mov eax, dword [rax + 0x220]
jmp 0x18002a2d5
mov dword [rbp - 0x80], r8d
jmp 0x18002a2a7
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x54]
cmp eax, dword [rbp - 0x80]
je 0x18002a0c4
mov edi, 0x33
cmp edi, 0x17b
ja 0x180029fa1
je 0x180029f8c
mov eax, edi
sub eax, 0x33
je 0x180029f7f
sub eax, 0x52
je 0x180029f73
sub eax, 0x52
je 0x180029f53
cmp eax, 0x52
jne 0x18002a07b
xor r8d, r8d
xor edx, edx
mov rcx, r12
call qword [sym.imp.GDI32.dll_GetEnhMetaFileBits]
lea r9, [rbp - 0x58]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov esi, eax
call sub.RPCRT4.dll_MesEncodeIncrementalHandleCreate
mov r13d, eax
jmp 0x18002a07b
mov rax, qword [rsp + 0x70]
xor ecx, ecx
mov qword [rbp - 0x58], rcx
mov qword [rax + 0x10], rcx
cmp qword [rax + 0x18], 0x10
jb 0x180029f6c
mov rax, qword [rax]
mov byte [rax], cl
jmp 0x18002a07b
xor r12d, r12d
mov qword [rbp - 0x70], r12
jmp 0x18002a07b
mov byte [rsp + 0x40], 1
mov r15b, 1
jmp 0x18002a07b
movzx eax, byte [rsp + 0x40]
xor ecx, ecx
test esi, esi
cmovne ecx, eax
mov byte [rsp + 0x40], cl
jmp 0x18002a07b
mov eax, edi
sub eax, 0x1cd
je 0x180029fc7
sub eax, 0x52
je 0x180029fbd
cmp eax, 0x52
je case.0x180029ec4.11
jmp 0x18002a07b
mov byte [rsp + 0x58], 0
jmp 0x18002a07b
xor ecx, ecx
movzx eax, r15b
test r13d, r13d
cmove ecx, eax
cmp byte [rsp + 0x40], 0
movzx r15d, cl
je 0x18002a023
mov ebx, 0xd3
cmp ebx, 0xd3
je 0x18002a00b
cmp ebx, 0x331a
jne 0x18002a015
mov r8, r14
mov edx, esi
mov rcx, r12
call qword [sym.imp.GDI32.dll_GetEnhMetaFileBits]
mov rcx, r14
call fcn.180064900
jmp 0x18002a015
mov ecx, esi
call fcn.180064908
mov r14, rax
add ebx, 0x3247
cmp ebx, 0x648e
jbe 0x180029fe3
test r15b, r15b
je 0x18002a07b
mov ebx, 0x17
xor r12d, r12d
cmp ebx, 0x17
je 0x18002a06a
cmp ebx, 0x32
jne 0x18002a06f
lea r8, [rsp + 0x78]
xor edx, edx
xor ecx, ecx
call sub.RPCRT4.dll_MesDecodeIncrementalHandleCreate
mov rcx, qword [rbp - 0x58]
mov r13d, eax
test rcx, rcx
je 0x18002a059
call sub.RPCRT4.dll_MesHandleFree
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x18002a06f
call sub.RPCRT4.dll_MesHandleFree
jmp 0x18002a06f
mov qword [rsp + 0x78], r12
add ebx, 0x1b
cmp ebx, 0x4d
jb 0x18002a030
mov r12, qword [rbp - 0x70]
add edi, 0x52
cmp edi, 0x2c3
jb 0x180029f03
mov edx, dword [rsp + 0x50]
xor r8d, r8d
mov edi, dword [rsp + 0x54]
mov ebx, dword [rsp + 0x5c]
jmp 0x18002a2a7
mov rcx, qword [rbp - 0x78]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov rcx, qword [rsp + 0x70]
xor r8d, r8d
mov edx, eax
mov dword [rsp + 0x54], eax
mov dword [rbp - 0x68], 0
call fcn.18005cf00
mov edx, dword [rsp + 0x50]
xor r8d, r8d
mov edi, dword [rsp + 0x54]
jmp 0x18002a2a7
mov r8d, dword [rsp + 0x60]
mov edx, dword [rbp - 0x68]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.GDI32.dll_PtInRegion]
lea r9, [rbp - 0x48]
lea r8, [rbp - 0x40]
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 8]
call qword [sym.imp.SHELL32.dll_SHGetDiskFreeSpaceExW]
mov edx, dword [rsp + 0x50]
xor r8d, r8d
mov byte [rsp + 0x58], 1
jmp 0x18002a2a7
mov r8d, 3
lea rdx, [0x18006b088]
lea rcx, [rbp + 0x1c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov edx, dword [rsp + 0x50]
xor r8d, r8d
mov word [rbp + 0x22], r8w
jmp 0x18002a2a7
cmp qword [r9 + 0x18], 8
mov rcx, r9
mov word [rbp + 0x34], r8w
jb 0x18002a147
mov rcx, qword [r9]
mov qword [rsp + 0x30], r8
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov edx, dword [rsp + 0x50]
xor r8d, r8d
mov qword [rbp - 0x78], rax
jmp 0x18002a2a7
cmp qword [rbp - 0x78], 0xffffffffffffffff
jne 0x18002a21d
mov ebx, 0xd0
nop
mov eax, ebx
sub eax, 0xd0
je 0x18002a1e8
sub eax, 1
je 0x18002a1d2
sub eax, 1
je 0x18002a1ba
sub eax, 1
je 0x18002a1b3
cmp eax, 1
je case.0x180029ec4.11
jmp 0x18002a201
mov byte [rsp + 0x58], 0
jmp 0x18002a201
mov rcx, qword [rbp - 0x50]
lea r8, [rbp - 0x30]
xor edx, edx
call qword [sym.imp.GDI32.dll_GetEnhMetaFilePixelFormat]
mov r10d, 0x28
jmp 0x18002a201
mov ecx, dword [rbp - 0x64]
mov word [rbp - 0x30], r10w
call qword [sym.imp.RPCRT4.dll_I_RpcMapWin32Status]
mov r10d, 0x28
jmp 0x18002a201
xorps xmm0, xmm0
mov qword [rbp - 0x50], r8
xor eax, eax
mov dword [rbp - 0x64], r8d
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x10], rax
movups xmmword [rbp - 0x20], xmm0
inc ebx
mov r8d, 0
cmp ebx, 0xd5
jb 0x18002a190
mov edx, dword [rsp + 0x50]
mov ebx, dword [rsp + 0x5c]
mov qword [rbp - 0x60], r8
jmp 0x18002a2a7
mov word [rbp + 0x1c], r8w
jmp 0x18002a2a7
mov rax, qword [rsp + 0x70]
cmp qword [rax + 0x18], 0x10
jb 0x18002a23c
mov rax, qword [rax]
mov rcx, qword [rbp - 0x78]
lea r9, [rbp - 0x80]
mov qword [rsp + 0x20], r8
mov rdx, rax
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [rsp + 0x50]
xor r8d, r8d
mov dword [rsp + 0x60], 0xa
jmp 0x18002a2a7
movabs rax, 0x7300650052006d
mov word [rbp + 0x2a], r8w
mov r8d, 5
mov qword [rbp + 0x22], rax
lea rdx, [0x18006b104]
lea rcx, [rbp + 0x2a]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov edx, dword [rsp + 0x50]
xor r8d, r8d
jmp 0x18002a2a7
movabs rax, 0x65007200750074
mov qword [rbp + 0x14], rax
mov eax, dword [rsp + 0x44]
mov r9, qword [rsp + 0x68]
lea r11, [0x180000000]
inc ebx
inc edx
mov dword [rsp + 0x5c], ebx
mov r10d, 0x28
mov dword [rsp + 0x50], edx
cmp ebx, eax
jb 0x180029eb0
mov eax, dword [rsp + 0x58]
mov rcx, qword [rbp + 0x38]
xor rcx, rsp
call fcn.180064e10
mov rbx, qword [rsp + 0x180]
add rsp, 0x140
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret