Function at 0x1800f4850
Capabilities:
Read file on windows
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x420]
sub rsp, 0x520
mov rax, qword [0x180121650]
xor rax, rsp
mov qword [rbp + 0x410], rax
mov r13, qword [rsp + 0x48]
mov eax, ecx
imul edx, ecx, 0x2a0
mov esi, ecx
mov dword [rsp + 0x70], ecx
mov rbx, r9
xor ecx, ecx
mov qword [rsp + 0x78], r8
mov r9, r8
mov dword [rsp + 0x38], edx
cmp eax, edx
ja 0x1800f4d80
mov rax, qword [rsp + 0x48]
mov r15d, dword [rsp + 0x60]
mov r12, qword [rsp + 0x48]
mov r14, qword [rsp + 0x48]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x50], eax
mov r10d, 0x73
movabs r11, 0x6c006c0064
lea r8d, [r10 - 0x2a]
lea edi, [r10 - 0x45]
cmp esi, 0x1a09
ja 0x1800f4bf9
je 0x1800f4bbe
cmp esi, 0xca
ja 0x1800f4b2a
je 0x1800f4b1b
mov eax, esi
sub eax, 4
je 0x1800f4b13
sub eax, r10d
je 0x1800f4a4e
sub eax, 0x24
je 0x1800f49b4
cmp eax, 0x11
jne 0x1800f4d1d
mov ecx, dword [r9]
lea r8d, [r10 - 0x6f]
lea rdx, str.e_6n
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__write]
cmp eax, 4
jne 0x1800f4d39
cmp r15d, 0x1f
jae 0x1800f4991
mov eax, r15d
lea rdi, [rbp + 0x3f0]
add rdi, rax
nop
mov ecx, dword [rbx]
lea rdx, [rbp + 0x3f0]
mov eax, r15d
mov r8d, 1
add rdx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
cmp eax, 1
jne 0x1800f4991
cmp byte [rdi], 0x52
je 0x1800f4991
inc r15d
inc rdi
cmp r15d, 0x1f
jb 0x1800f4960
mov eax, r15d
mov esi, 0xac
cmp rax, 0x20
jae 0x1800f504f
mov edx, dword [rsp + 0x38]
mov byte [rbp + rax + 0x3f0], 0
jmp 0x1800f4d1d
test byte [rbx], 4
je 0x1800f4a34
mov edi, 0x55
nop
cmp edi, 0x55
je 0x1800f49fb
cmp edi, 0x3b1a
je 0x1800f49db
cmp edi, 0x75df
je 0x1800f5047
jmp 0x1800f4a1d
and dword [rbx], 7
test byte [rbx], 1
je 0x1800f4a1d
mov rdx, qword [rsp + 0x68]
xor r9d, r9d
mov r8d, 0xc2
mov rcx, rbx
call fcn.1800eb500
jmp 0x1800f4a1d
test byte [rbx], 1
mov qword [rsp + 0x68], rcx
je 0x1800f4a1a
xor edx, edx
mov r8d, 0x110
mov rcx, rbx
call fcn.1800e8ed0
mov qword [rsp + 0x68], rax
and dword [rbx], 0xfffffff9
add edi, 0x3ac5
mov ecx, 0
cmp edi, 0xb04f
jbe 0x1800f49c0
mov edx, dword [rsp + 0x38]
mov ecx, dword [rbx]
lea r10, [rbx + 4]
shr rcx, 3
add r10, rcx
mov qword [rsp + 0x30], r10
mov r13, r10
jmp 0x1800f4d22
mov rax, qword [rbx + 0x60]
mov r12, qword [rax + 0xf0]
mov rax, qword [r12]
test rax, rax
je 0x1800f4a85
test byte [r12 + 0xd8], 1
je 0x1800f4a7a
mov r12, rax
mov rax, qword [rax]
test rax, rax
jne 0x1800f4a62
jmp 0x1800f4a85
cmp qword [r12], 0
jne 0x1800f4d1d
mov edi, 0xe2
nop word [rax + rax]
mov eax, edi
sub eax, 0xe2
je 0x1800f4afc
sub eax, 0x76
je 0x1800f4ad2
cmp eax, 0x76
jne 0x1800f4aff
mov rax, qword [rsp + 0x40]
mov rcx, qword [rbp + 0x410]
xor rcx, rsp
call fcn.1800fd9d0
mov rbx, qword [rsp + 0x560]
add rsp, 0x520
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r9d, 0xaa
mov dword [rsp + 0x58], 0xffffffff
lea r8, [rsp + 0x58]
mov rdx, rbx
xor ecx, ecx
call fcn.1800e4c20
mov r9, qword [rsp + 0x78]
xor ecx, ecx
mov dword [rsp + 0x40], ecx
jmp 0x1800f4aff
mov dword [r9], ecx
add edi, 0x76
cmp edi, 0x244
jb 0x1800f4a90
mov edx, dword [rsp + 0x38]
jmp 0x1800f4d1d
mov r15d, ecx
jmp 0x1800f4d1d
mov dword [rbp + 0x3b0], 0x53575f5f
jmp 0x1800f4d1d
mov eax, esi
sub eax, 0xe1
je 0x1800f4ba8
sub eax, 0x73
je 0x1800f4b58
mov r10, qword [rsp + 0x30]
cmp eax, 0x12a9
jne 0x1800f4d22
mov eax, dword [r12 + 0x98]
mov dword [r9], eax
jmp 0x1800f4d22
cmp byte [rbp + 0x3f0], 0x1b
jne 0x1800f4d39
cmp byte [rbp + 0x3f1], 0x5b
jne 0x1800f4d39
lea r9, [rsp + 0x60]
lea r8, [rbp - 0x80]
lea rdx, str._d__d
lea rcx, [rbp + 0x3f2]
call fcn.1800fd060
cmp eax, 2
jne 0x1800f4d39
mov eax, dword [rsp + 0x60]
mov edx, dword [rsp + 0x38]
mov dword [rsp + 0x40], eax
jmp 0x1800f4d1d
lea rcx, str.Profile_violation_detected.__POC_marker_segments_may_not_be_included_in_tile_part_headers_of_Digital_Cinema__CINEMA2K_or_CINEMA4K__code_streams.__You_should_either_remove_the__Sprofile_attribute__or_remove_the_tile_specific__Porder_attribute.
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
mov edx, dword [rsp + 0x38]
jmp 0x1800f4d1d
lea r14, [rbx + 4]
mov eax, 0x7f
cmp eax, 0x7f
je 0x1800f4be5
cmp eax, 0x11b
je 0x1800f4bdf
cmp eax, 0x1b7
jne 0x1800f4beb
inc r14
jmp 0x1800f4beb
add r13, 8
jmp 0x1800f4beb
cmp qword [r13], r9
je 0x1800f4c23
add eax, 0x9c
cmp eax, 0x253
jb 0x1800f4bc7
jmp 0x1800f4bc2
cmp esi, 0x4312
ja 0x1800f4cbc
je 0x1800f4c86
cmp esi, 0x21ee
je 0x1800f4c67
cmp esi, 0x25cb
je 0x1800f4c51
cmp esi, 0x3377
jne 0x1800f4d1d
mov eax, dword [rbx]
lea edi, [rbx + 3]
shr eax, 3
lea rdx, [r14 + 1]
sub eax, r14d
mov rcx, r14
add edi, eax
mov esi, 0x3377
movsxd r8, edi
mov dword [rsp + 0x50], edi
call sub.VCRUNTIME140.dll_memmove
mov edx, dword [rsp + 0x38]
jmp 0x1800f4d1d
lea rcx, str.This_command_cannot_be_used_at_the_top_level.
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
mov edx, dword [rsp + 0x38]
jmp 0x1800f4d1d
mov dword [rbp + 0x3b4], 0x444641
mov word [rbp + 0x3b7], r8w
mov word [rbp + 0x3b8], r10w
jmp 0x1800f4d1d
mov eax, dword [0x1801089a4]
movsd xmm0, qword [str.2_32]
mov dword [rbp + 0x3d8], eax
movzx eax, word [0x1801089b8]
mov word [rbp + 0x3e4], ax
mov dword [rbp + 0x3b9], 0x746553
movsd qword [rbp + 0x3dc], xmm0
jmp 0x1800f4d1d
cmp esi, 0x4ab5
je 0x1800f4d50
cmp esi, 0x6436
je 0x1800f4cf5
cmp esi, 0x855a
jne 0x1800f4d1d
mov r8d, 0xa
lea rdx, [rbp + 0x3c4]
lea ecx, [r8 - 8]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ultow]
mov edx, dword [rsp + 0x38]
jmp 0x1800f4d1d
mov eax, dword [0x1801089a4]
mov dword [rbp + 0x3c0], eax
movzx eax, word [0x1801089a8]
mov word [rbp + 0x3c4], ax
mov word [rbp + 0x3e4], di
mov qword [rbp + 0x3e6], r11
mov r10, qword [rsp + 0x30]
imul eax, dword [rsp + 0x70], 0x2a
mov r9, qword [rsp + 0x78]
add esi, eax
cmp esi, edx
ja 0x1800f4d46
xor ecx, ecx
jmp 0x1800f48cd
mov dword [rsp + 0x40], 0xffffffff
jmp case.0x1800f4de0.0
mov edx, dword [rsp + 0x50]
mov eax, dword [rsp + 0x70]
jmp 0x1800f4d92
lea rcx, str.Extensions_Panel_List_Item_Separator
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
lea rcx, str.pfnWTSQueryUserToken_____d
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
lea rcx, str.wxRichTextAction::ApplyParagraphs
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov r10, qword [rsp + 0x48]
mov edx, dword [rsp + 0x60]
mov qword [rsp + 0x30], r10
mov dword [rsp + 0x50], edx
lea esi, [rax + 0x11]
cmp eax, esi
jae case.0x1800f4de0.0
mov r14, qword [rsp + 0x48]
lea edi, [rax - 4]
mov r12, qword [rsp + 0x48]
lea r8, [0x180000000]
mov r15, qword [rsp + 0x48]
movabs r11, 0x64002e0032
cmp edi, 0xce
ja case.0x1800f4de0.6
movzx eax, byte [r8 + rdi + 0xf509c]
mov ecx, dword [r8 + rax*4 + 0xf5058]
add rcx, r8
jmp rcx
mov ecx, dword [rbx]
mov eax, ecx
and eax, 4
je 0x1800f4df2
mov eax, 8
jmp 0x1800f4df9
mov rax, rcx
and rax, 0xfffffffffffffff8
mov rdx, rcx
test cl, 1
je 0x1800f4e0b
test cl, 2
mov ecx, 0xc
je 0x1800f4e10
mov ecx, 4
shr rdx, 3
add rdx, rax
add rdx, rcx
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
mov r14, rax
jmp 0x1800f4ff8
mov eax, dword [0x1801089c4]
mov qword [rbp + 0x3ca], r11
mov dword [rbp + 0x3d0], eax
movzx eax, word [0x1801089c8]
mov word [rbp + 0x3d4], ax
jmp case.0x1800f4de0.6
xor eax, eax
lea rcx, [rbp + 0x3c0]
mov qword [rsp + 0x28], rax
xor edx, edx
mov qword [rsp + 0x20], rax
lea r9d, [rax + 0x33]
lea r8d, [rax + 0x12]
call fcn.18000cad0
cmp qword [rbx], 0xffffffffffffffff
mov r12, rax
jne 0x1800f4ff8
mov byte [rsp + 0x40], 0
jmp case.0x1800f4de0.0
mov eax, dword [r9]
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x48], eax
jmp case.0x1800f4de0.6
mov eax, dword [r9]
lea r8, [rsp + 0x58]
mov r9d, 0xaa
mov dword [rsp + 0x58], eax
mov rdx, rbx
xor ecx, ecx
call fcn.1800e4c20
jmp 0x1800f4ff8
mov ecx, dword [rbx]
lea rax, [rsp + 0x48]
inc ecx
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x1a0]
xor r8d, r8d
lea rdx, [rbp - 0x70]
call r12
cmp eax, 0xffffffff
je 0x1800f4e80
jmp 0x1800f4ff8
mov rcx, qword [rbx]
lea rdx, [rbp + 0x1a0]
call r15
test eax, eax
jne 0x1800f4e80
mov rcx, qword [rbx]
lea rdx, [rbp - 0x70]
call r15
test eax, eax
jne 0x1800f5029
mov byte [rsp + 0x40], 1
jmp 0x1800f4ff8
xor eax, eax
lea r8, [rbp + 0x3b0]
mov qword [rsp + 0x28], rax
lea rcx, [rbp + 0x3d8]
xor edx, edx
mov qword [rsp + 0x20], rax
lea r9d, [rax + 0x33]
call fcn.18000cad0
mov r15, rax
jmp 0x1800f4ff8
mov eax, dword [0x1801089cc]
mov dword [rbp + 0x3c6], eax
movzx eax, word [0x1801089d0]
mov word [rbp + 0x3ca], ax
jmp case.0x1800f4de0.6
mov eax, dword [rbx]
test al, 1
je 0x1800f4f73
test al, 2
jne 0x1800f4f73
mov ecx, 8
jmp 0x1800f4f75
xor ecx, ecx
movsxd rax, edx
lea rdx, [r13 + 8]
lea r8, [rcx + rax*8]
lea rcx, [r13 - 1]
call sub.VCRUNTIME140.dll_memmove
mov ecx, dword [rbx]
mov eax, ecx
shr eax, 3
and ecx, 7
lea eax, [rax*8 - 8]
or eax, ecx
mov dword [rbx], eax
jmp 0x1800f4ff8
mov rax, qword [rbx]
lea r8, [rbp - 0x70]
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x68], rax
mov ecx, 0xf1
call fcn.1800ebe40
mov rax, qword [rbx]
lea r8, [rbp + 0x1a0]
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x68], rax
mov ecx, 0xf1
call fcn.1800ebe40
jmp 0x1800f4ff8
mov r8d, dword [rbx]
lea rcx, [r10 - 1]
shr r8d, 3
sub r8d, edx
mov rdx, r10
dec r8d
shl r8, 3
call sub.VCRUNTIME140.dll_memmove
mov r10, qword [rsp + 0x30]
lea r8, [0x180000000]
movabs r11, 0x64002e0032
inc edi
lea eax, [rdi + 4]
cmp eax, esi
jae case.0x1800f4de0.0
mov edx, dword [rsp + 0x50]
mov r9, qword [rsp + 0x78]
jmp 0x1800f4dc0
mov byte [rsp + 0x40], 2
jmp case.0x1800f4de0.0
mov dword [rsp + 0x40], 0
jmp case.0x1800f4de0.0
test r14, r14
cmovne rbx, r14
mov rax, rbx
jmp 0x1800f4aa8
call fcn.1800fd6bc
int3