Function at 0x18002e5d0
Capabilities:
Execute command
Read file on windows
Schedule task via at
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
lea eax, [r8 - 0xb]
movaps xmmword [rsp + 0x40], xmm6
mov dword [rsp + 0x24], eax
mov r10, r9
mov ebp, r8d
mov rbx, rdx
mov r13, rcx
cmp r8d, eax
jbe 0x18002ea17
movsxd rdx, dword [rsp + 0x20]
lea r9, [0x180000000]
movsd xmm6, qword [0x18005dd50]
mov r8, rdx
mov edi, dword [rsp + 0xa0]
xor r11d, r11d
mov esi, dword [rsp + 0xa0]
movabs r15, 0xc069000000000000
mov r14, qword [rsp + 0x28]
mov qword [rsp + 0x30], rdx
lea eax, [rbp - 0xe2]
cmp eax, 0x10
ja case.0x18002e66b.232
mov ecx, dword [r9 + rax*4 + 0x2ea3c]
add rcx, r9
jmp rcx
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
lea rcx, str.Phx::BitOffset___________________________instructionBitOffset__0
call fcn.1800432b0
jmp 0x18002e9d3
mov edi, dword [r10]
mov esi, 0xffffff9c
cmp edi, 0xffffffff
je case.0x18002e66b.232
nop dword [rax + rax]
cmp edi, 0xffffff9c
je 0x18002e9de
movsxd rax, edi
lea rdx, [rax + rax*2]
movsxd r8, dword [rbx + rdx*8 + 0xc]
cmp r8d, 0xffffffff
je 0x18002e7e0
movsxd rax, dword [rbx + rdx*8 + 0x10]
lea r9, [r8 + r8*2]
movsxd rcx, dword [rbx + r9*8 + 0x10]
shl rcx, 5
shl rax, 5
movsd xmm0, qword [rcx + r13 + 8]
subsd xmm0, qword [rax + r13 + 8]
comisd xmm6, xmm0
jbe 0x18002e74f
movsd xmm0, qword [rbx + r9*8]
comisd xmm0, xmmword [rbx + rdx*8]
jbe 0x18002e728
cmp esi, 0xffffff9c
jne 0x18002e70d
mov dword [r10], r8d
mov edi, dword [rbx + rdx*8 + 0xc]
mov dword [rbx + rdx*8 + 8], r11d
mov qword [rbx + rdx*8], r15
jmp 0x18002e754
movsxd rax, esi
lea rcx, [rax + rax*2]
mov dword [rbx + rcx*8 + 0xc], r8d
mov edi, dword [rbx + rdx*8 + 0xc]
mov dword [rbx + rdx*8 + 8], r11d
mov qword [rbx + rdx*8], r15
jmp 0x18002e754
mov dword [rbx + r9*8 + 8], r11d
mov esi, edi
movsxd rax, dword [rbx + rdx*8 + 0xc]
lea rcx, [rax + rax*2]
mov qword [rbx + rcx*8], r15
movsxd rax, dword [rbx + rdx*8 + 0xc]
lea rcx, [rax + rax*2]
mov eax, dword [rbx + rcx*8 + 0xc]
mov dword [rbx + rdx*8 + 0xc], eax
jmp 0x18002e754
mov esi, edi
mov edi, r8d
cmp edi, 0xffffffff
jne 0x18002e6a0
jmp 0x18002e9de
lea rcx, str.2000000:____milionom_____spellout_cardinal_masculine_dative_ones___
call fcn.1800432b0
lea rcx, str.mixed_mask_utilization
call fcn.1800432b0
lea rcx, str.7_777_7_7_7174777:77_7C7E7H7K7N7Q7T7W7Y77_7b7e7h7k7n7q7t7v7y77
call fcn.1800432b0
jmp 0x18002e9d3
mov esi, 0xffffff9c
jmp case.0x18002e66b.232
lea rcx, [0x180059a88]
mov dword [rsp + 0x20], r11d
mov qword [rsp + 0x30], r11
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [0x18005a444]
lea rcx, str.data.dat
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov qword [rsp + 0x28], rax
cmp rax, 0
je 0x18002ea02
lea rcx, str.QCA::DHContext
call fcn.1800432b0
jmp 0x18002e9ce
lea r9, [0x180000000]
mov ebp, 0xee
jmp case.0x18002e66b.232
lea rcx, str.ERROR_DS_NO_REF_DOMAIN
call fcn.1800432b0
jmp 0x18002e9d3
cmp edi, 0xffffffff
je 0x18002e85b
cmp edi, 0xffffff9c
je 0x18002e85b
movsxd rax, edi
lea rdx, [rax + rax*2]
movsxd rax, dword [rbx + rdx*8 + 0x10]
shl rax, 5
movsd xmm0, qword [rax + r13 + 0x10]
comisd xmm0, xmmword [rbx + rdx*8]
jbe 0x18002e850
mov r8d, dword [rbx + rdx*8 + 0xc]
mov dword [rbx + rdx*8 + 8], r11d
mov qword [rbx + rdx*8], r15
cmp esi, 0xffffff9c
jne 0x18002e842
mov dword [r10], r8d
jmp 0x18002e852
movsxd rax, esi
lea rcx, [rax + rax*2]
mov dword [rbx + rcx*8 + 0xc], r8d
jmp 0x18002e852
mov esi, edi
mov edi, dword [rbx + rdx*8 + 0xc]
cmp edi, 0xffffffff
jne 0x18002e807
mov rcx, qword [rsp + 0xb0]
mov esi, 0xffffff9c
mov edi, dword [rcx]
cmp edi, 0xffffffff
je case.0x18002e66b.232
cmp edi, 0xffffff9c
je case.0x18002e66b.232
movsxd rax, edi
lea rdx, [rax + rax*2]
movsxd rax, dword [rbx + rdx*8 + 0x10]
shl rax, 5
movsd xmm0, qword [rax + r13 + 0x10]
comisd xmm0, xmmword [rbx + rdx*8]
jbe 0x18002e8c8
mov r8d, dword [rbx + rdx*8 + 0xc]
mov dword [rbx + rdx*8 + 8], r11d
mov qword [rbx + rdx*8], r15
cmp esi, 0xffffff9c
jne 0x18002e8b2
mov dword [rcx], r8d
jmp 0x18002e8ca
movsxd rax, esi
lea rcx, [rax + rax*2]
mov dword [rbx + rcx*8 + 0xc], r8d
mov rcx, qword [rsp + 0xb0]
jmp 0x18002e8ca
mov esi, edi
mov edi, dword [rbx + rdx*8 + 0xc]
cmp edi, 0xffffffff
jne 0x18002e873
jmp case.0x18002e66b.232
mov edi, dword [r10]
jmp case.0x18002e66b.232
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0xd9
xor ecx, ecx
call fcn.18000bee0
jmp 0x18002e9d3
cmp edx, 0xa
jge case.0x18002e66b.232
mov rbx, qword [rsp + 0x28]
lea rax, [r8 + r8*2]
lea r12, [rax*8 + 0x64200]
movsxd rax, edx
lea r14d, [rdx + rdx*2]
add r12, r9
lea ebp, [rdx + 1]
shl r14d, 3
lea rcx, [rax + rax*2]
mov eax, 0xa
sub eax, edx
lea r15, [rcx*8 + 0x64204]
add edx, eax
mov ecx, eax
add r15, r9
mov dword [rsp + 0x20], edx
add r8, rcx
mov qword [rsp + 0x30], r8
nop dword [rax]
xor r8d, r8d
mov edx, r14d
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov edx, 0x18
lea rcx, [r15 - 4]
mov r9, rbx
lea r8d, [rdx - 0x17]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, 1
je 0x18002e989
mov edx, ebp
lea rcx, str.Event.Latency.OS.TOUCH_PRESSED
call fcn.1800432b0
mov r8d, dword [r12]
lea rcx, str.Write_HD_DVD_RW
mov r9, r15
mov edx, ebp
call fcn.1800432b0
add r14d, 0x18
add r15, 0x18
inc ebp
add r12, 0x18
cmp r14d, 0xf0
jl 0x18002e950
mov rbx, qword [rsp + 0x98]
movabs r15, 0xc069000000000000
mov ebp, dword [rsp + 0xa0]
mov r14, qword [rsp + 0x28]
mov r10, qword [rsp + 0xa8]
xor r11d, r11d
lea r9, [0x180000000]
dec ebp
mov dword [rsp + 0xa0], ebp
cmp ebp, dword [rsp + 0x24]
jbe 0x18002ea17
mov edx, dword [rsp + 0x20]
mov r8, qword [rsp + 0x30]
jmp 0x18002e651
lea rcx, str.Chrome_SxSApplication
call fcn.1800432b0
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov eax, dword [rsp + 0xa0]
mov rbx, qword [rsp + 0x90]
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret