Function at 0x180031910
Capabilities:
Execute command
Read file on windows
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
lea ebx, [r9 + 0xd]
mov r14d, r9d
mov dword [rsp + 0x30], ebx
cmp r9d, ebx
mov ebx, dword [rsp + 0xa8]
mov r13, rcx
jae case.0x18003199a.11
movsxd r15, dword [rsp + 0xa8]
lea esi, [r9 - 0xfd]
mov ebp, dword [rsp + 0x40]
lea r10, [0x18000b4a0]
mov eax, dword [rsp + 0x30]
mov r12, r15
mov dword [rsp + 0x38], esi
lea r9, [0x180000000]
cmp esi, 0x27
ja case.default.0x18003199a
movzx eax, byte [r9 + rsi + 0x31e30]
mov ecx, dword [r9 + rax*4 + 0x31df8]
add rcx, r9
jmp rcx
xor r15d, r15d
lea rcx, [0x1800535e8]
xor r12d, r12d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov r8, qword [rsp + 0xa0]
lea r10, [0x18000b4a0]
mov rdx, qword [rsp + 0x98]
jmp case.0x18003199a.13
cmp r15d, 0xa
jge case.0x18003199a.13
nop word [rax + rax]
lea esi, [r15 + r15*2]
mov edi, 0xf2
lea rax, [r12 + r12*2]
shl esi, 3
lea r14, [rax*8 + 0x5b200]
add r14, r9
nop dword [rax + rax]
cmp edi, 0xf2
je 0x180031a55
cmp edi, 0x18e
je 0x180031a2e
cmp edi, 0x22a
jne 0x180031aaf
inc r15d
add esi, 0x18
inc r12
add r14, 0x18
jmp 0x180031aaf
mov r8d, dword [r14]
lea edx, [r15 + 1]
movsxd rax, r15d
lea rcx, [rax + rax*2]
lea r9, [r9 + rcx*8]
lea r9, [r9 + 0x5b204]
lea rcx, str.LIGHTCANCEL_BTN
call fcn.18003c270
jmp 0x180031aa8
mov rcx, qword [rsp + 0x48]
xor r8d, r8d
mov edx, esi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov r9, qword [rsp + 0x48]
mov edx, 0x18
movsxd rax, r15d
lea r8d, [rdx - 0x17]
lea rcx, [rax + rax*2]
lea rcx, [rcx*8 + 0x5b200]
lea rax, [0x180000000]
add rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, 1
je 0x180031aa8
lea edx, [r15 + 1]
lea rcx, str.____int_____gmpfr_flags__16__
call fcn.18003c270
lea r9, [0x180000000]
add edi, 0x9c
cmp edi, 0x2c6
jb 0x180031a00
cmp r15d, 0xa
jl 0x1800319e0
mov r14d, dword [rsp + 0xa8]
mov esi, dword [rsp + 0x38]
lea r10, [0x18000b4a0]
mov r8, qword [rsp + 0xa0]
mov rdx, qword [rsp + 0x98]
jmp case.0x18003199a.13
mov edx, 0x107
xor ecx, ecx
call fcn.18001d230
mov r8, qword [rsp + 0xa0]
lea r10, [0x18000b4a0]
mov rdx, qword [rsp + 0x98]
jmp case.0x18003199a.13
mov esi, dword [0x18006f8a4]
test esi, esi
jle 0x180031db1
nop dword [rax]
mov edi, 0xb2
cmp edi, 0xb2
je 0x180031b53
cmp edi, 0x8580
jne 0x180031ba2
cmp dword [r13], ebp
je 0x180031df0
dec esi
jmp 0x180031ba2
xor r9d, r9d
lea rax, [rsp + 0x40]
xor edx, edx
mov qword [rsp + 0x20], rax
lea rcx, [0x18006f8c0]
lea r8d, [r9 + 0xe]
call fcn.180028e00
mov ecx, 0x10
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
test rax, rax
je 0x180031bf1
mov ebp, dword [rsp + 0x40]
mov dword [rax], ebp
mov qword [rax + 8], 0
mov rcx, qword [0x18006f8c8]
mov qword [rcx + 8], rax
mov qword [0x18006f8c8], rax
add edi, 0x84ce
cmp edi, 0x1099c
jbe 0x180031b35
test esi, esi
jg 0x180031b30
jmp 0x180031ad3
lea rdx, [0x180053898]
lea rcx, str.data.dat
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov qword [rsp + 0x48], rax
cmp rax, 0
jne 0x1800319af
mov edi, 0x3d
mov eax, edi
sub eax, 0x3d
je 0x180031bfa
cmp eax, 1
jne 0x180031c06
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, str.face3ds__sface__i___
call fcn.18003c270
inc edi
cmp edi, 0x3f
jb 0x180031be5
mov r8, qword [rsp + 0xa0]
lea r10, [0x18000b4a0]
mov rdx, qword [rsp + 0x98]
jmp case.0x18003199a.13
lea rcx, str.backupRestoreSupported
call fcn.18003c270
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8, qword [rsp + 0xa0]
lea r10, [0x18000b4a0]
mov rdx, qword [rsp + 0x98]
jmp case.0x18003199a.13
mov eax, dword [rdx]
lea rcx, [rsp + 0x38]
mov rdx, qword [rsp + 0xb0]
mov r9d, 0xe9
mov dword [rsp + 0xa8], eax
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x38], r10
call fcn.180037200
mov r8, qword [rsp + 0xa0]
lea r10, [0x18000b4a0]
mov rdx, qword [rsp + 0x98]
jmp case.0x18003199a.13
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
lea rcx, str.ushort_map2Value___ushort__map2_map2Idx____INTER_TAB_SIZE2___1___
call fcn.18003c270
mov r8, qword [rsp + 0xa0]
lea r10, [0x18000b4a0]
mov rdx, qword [rsp + 0x98]
jmp case.0x18003199a.13
test r13, r13
je case.0x18003199a.11
cmp qword [r13], 0
je case.0x18003199a.11
mov edi, 0x114
nop dword [rax]
cmp edi, 0x114
je 0x180031d1a
cmp edi, 0x9078
jne 0x180031d24
mov qword [r13], 0
jmp 0x180031d24
mov rcx, qword [r13]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add edi, 0x8f64
cmp edi, 0x11ec8
jbe 0x180031d00
mov r8, qword [rsp + 0xa0]
lea r10, [0x18000b4a0]
mov rdx, qword [rsp + 0x98]
jmp case.0x18003199a.13
lea rcx, str.0_end_at_1
call fcn.18003c270
lea rcx, str.highp_float2_midpoint__bezierpts__float4_.125__.375__.375__.125__
call fcn.18003c270
mov r8, qword [rsp + 0xa0]
lea r10, [0x18000b4a0]
mov rdx, qword [rsp + 0x98]
jmp case.0x18003199a.13
xor ebx, ebx
jmp case.0x18003199a.13
lea rcx, str.Ustaw_atrybut_ukryty
call fcn.18003c270
lea rcx, str.C:BuildAgentwork11a22189164a1f21_bm_updReleaseyupdate_exec.pdb
call fcn.18003c270
mov r8, qword [rsp + 0xa0]
lea r10, [0x18000b4a0]
mov rdx, qword [rsp + 0x98]
jmp case.0x18003199a.13
mov esi, dword [rsp + 0x38]
mov eax, dword [rsp + 0x30]
inc r14d
inc esi
mov dword [rsp + 0xa8], r14d
mov dword [rsp + 0x38], esi
cmp r14d, eax
jb 0x180031976
mov eax, ebx
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov eax, 1
jmp 0x180031dd5