Function at 0x180030a90
Capabilities:
Terminate process
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xb8
lea eax, [rdx - 0xd]
mov r10, r8
mov dword [rbp + 0x6f], eax
mov r9, rcx
cmp edx, eax
jbe case.0x180030b18.22
mov rdi, qword [rbp - 0x59]
lea ebx, [rdx - 0x121]
mov esi, dword [rbp + 0x6f]
lea r11, [0x180000000]
mov r14d, dword [rbp + 0x6f]
xor edx, edx
mov r12, qword [rbp - 9]
mov ecx, eax
mov dword [rbp + 0x7f], ebx
mov r15, qword [rbp + 0x7f]
mov r13, qword [rbp + 0x7f]
mov r8d, dword [rbp + 0x7f]
mov rbx, qword [rbp - 0x61]
nop dword [rax]
cmp r8d, 0x17
ja case.default.0x180030b18
mov eax, r8d
mov ecx, dword [r11 + rax*4 + 0x31090]
add rcx, r11
jmp rcx
mov eax, dword [rbx + 0x14]
lea r8, [rbp - 0x51]
mov r9d, 0x6b
mov dword [rbp - 0x51], eax
mov rdx, rdi
xor ecx, ecx
call fcn.18001b8c0
mov eax, dword [rbx + 0x14]
lea rcx, [rbp - 0x49]
mov r8d, 0x35
mov dword [rbp - 0x49], eax
mov rdx, rdi
call fcn.18003e770
mov r8d, 0xe
mov dword [rbp - 0x41], 0xc0
lea rdx, [rbp - 0x41]
mov rcx, rdi
call fcn.18003d6d0
mov r8d, dword [rbp + 0x7f]
lea r11, [0x180000000]
mov r9, qword [rbp + 0x67]
xor edx, edx
mov r10, qword [rbp + 0x77]
jmp case.0x180030b18.8
cmp dword [r10], 3
mov esi, edx
mov r14d, edx
mov qword [rbp - 0x61], rdx
mov rbx, rdx
je 0x180030ba3
xor r9d, r9d
xor r8d, r8d
mov edx, 0x86
xor ecx, ecx
call fcn.18000e9a0
mov edx, 2
mov ecx, 0x2400
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov qword [rbp - 9], rax
mov r12, rax
test rax, rax
jne 0x180030b65
lea ecx, [rax + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.Proc_header_not_found.
call fcn.180043240
lea ecx, [r12 + 0x63]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea r9, [rbp - 0x69]
mov dword [rbp - 0x69], 0x2400
mov r8, rbx
mov rdx, r12
mov ecx, 0xad
call fcn.1800425a0
mov esi, eax
test eax, eax
je 0x180030cce
nop dword [rax + rax]
mov ebx, 0xe6
cmp ebx, 0xe6
jne 0x180030c92
mov qword [rsp + 0x28], rdi
lea r9, [rbp - 0x39]
lea r8, [rbp - 0x31]
mov dword [rsp + 0x20], 0x93
mov rdx, r15
mov dword [rbp - 0x39], 0x4000
mov rcx, r12
mov dword [rbp - 0x31], esi
call fcn.180038dc0
movsxd r8, eax
mov r9, r13
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov eax, 0x38e38e39
lea rcx, str.__04i__r
imul esi
sar edx, 8
mov eax, edx
shr eax, 0x1f
add edx, eax
add r14d, edx
mov edx, r14d
call fcn.1800432b0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
add ebx, 0x91
cmp ebx, 0x177
jb 0x180030c15
mov r8, qword [rbp - 0x61]
lea r9, [rbp - 0x69]
mov rdx, r12
mov dword [rbp - 0x69], 0x2400
mov ecx, 0xad
call fcn.1800425a0
mov esi, eax
test eax, eax
jne 0x180030c10
mov rbx, qword [rbp - 0x61]
mov r9d, 0xee
mov dword [rbp - 0x29], 0x4000
lea r8, [rbp - 0x29]
mov rdx, r15
mov rcx, rdi
call fcn.1800396e0
mov esi, eax
jmp 0x180030b65
movsxd r8, esi
mov r9, r13
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov edx, 6
lea rcx, [rbp - 0x59]
call fcn.1800387d0
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rcx, str.Go_To_Intranet_Bar
call fcn.1800432b0
jmp 0x180030b65
cmp dword [r9], 3
ja 0x180030ff8
mov rcx, rdx
lea rdx, [r10 + 0x10]
nop
movsxd rax, dword [r9]
lea rdx, [rdx + 0x48]
imul rax, rax, 0x201
add rax, rcx
mov rax, qword [r11 + rax*8 + 0x535b0]
mov qword [rdx - 0x58], rax
movsxd rax, dword [r9]
imul rax, rax, 0x201
add rax, rcx
mov rax, qword [r11 + rax*8 + 0x535b8]
mov qword [rdx - 0x50], rax
movsxd rax, dword [r9]
imul rax, rax, 0x201
add rax, rcx
mov rax, qword [r11 + rax*8 + 0x535c0]
mov qword [rdx - 0x48], rax
movsxd rax, dword [r9]
imul rax, rax, 0x201
add rax, rcx
mov rax, qword [r11 + rax*8 + 0x535c8]
mov qword [rdx - 0x40], rax
movsxd rax, dword [r9]
imul rax, rax, 0x201
add rax, rcx
mov rax, qword [r11 + rax*8 + 0x535d0]
mov qword [rdx - 0x38], rax
movsxd rax, dword [r9]
imul rax, rax, 0x201
add rax, rcx
mov rax, qword [r11 + rax*8 + 0x535d8]
mov qword [rdx - 0x30], rax
movsxd rax, dword [r9]
imul rax, rax, 0x201
add rax, rcx
mov rax, qword [r11 + rax*8 + 0x535e0]
mov qword [rdx - 0x28], rax
movsxd rax, dword [r9]
imul rax, rax, 0x201
add rax, rcx
mov rax, qword [r11 + rax*8 + 0x535e8]
mov qword [rdx - 0x20], rax
movsxd rax, dword [r9]
imul rax, rax, 0x201
add rax, rcx
add rcx, 9
mov rax, qword [r11 + rax*8 + 0x535f0]
mov qword [rdx - 0x18], rax
cmp rcx, 0x201
jl 0x180030d40
xor edx, edx
jmp case.0x180030b18.8
mov rax, qword [r9 + 0x10]
mov qword [rbp - 1], rax
jmp case.0x180030b18.8
mov ecx, 0x12c
call fcn.18003b850
mov rdx, rax
lea rcx, str.InterPred_LCU32x32_genx_8.asm
call fcn.1800432b0
mov rcx, qword [rbp + 7]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xde
call fcn.18002b280
mov qword [rbp - 0x61], rax
test rax, rax
je 0x180031014
movsx ebx, word [rax + 8]
mov ecx, 0x5d
xor edx, edx
nop
mov eax, ecx
sub eax, 0x5d
je 0x180030ef7
sub eax, 0x23
je 0x180030ea5
cmp eax, 0x4600
je 0x180030ee2
jmp 0x180030ee7
mov eax, 1
xchg dword [rdi + 0x120], eax
xor eax, eax
lock cmpxchg dword [rdi + 0x120], edx
je 0x180030ede
xor r12d, r12d
nop
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
lock cmpxchg dword [rdi + 0x120], r12d
jne 0x180030ec0
mov r12, qword [rbp - 9]
xor edx, edx
mov rdi, qword [rbp - 0x59]
mov ecx, 0x4680
add ecx, 0x32dc
cmp ecx, 0x9894
jbe 0x180030e90
jmp 0x180030efa
mov dword [rdi + 8], ebx
mov rbx, qword [rbp - 0x61]
mov edx, 0x29
mov rcx, rdi
cmp word [rbx + 8], 1
jne 0x180030f22
lea r8, [rbp - 0x19]
mov dword [rbp - 0x19], 3
call fcn.18003e070
jmp 0x180030b65
xor eax, eax
lea r8, [rbp - 0x11]
mov dword [rbp - 0x11], eax
call fcn.18003e070
jmp 0x180030b65
mov edx, 1
mov ecx, 0x4000
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov r15, rax
test rax, rax
je 0x18003103a
mov ecx, 0x11a
call fcn.18003b850
mov rdi, rax
mov qword [rbp - 0x59], rax
jmp 0x180030b65
mov edx, 0xb1
mov rcx, rdi
call fcn.18003bb60
test eax, eax
jne 0x180031060
mov rcx, qword [rbp - 1]
lea rdx, [0x18005b538]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov r13, rax
test rax, rax
jne 0x180030b65
lea ecx, [rax + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, qword [rbp - 1]
lea rdx, str.Could_not_enable_polling_page
mov rcx, rax
call fcn.180043240
lea ecx, [r13 + 0x63]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rax, qword [r9 + 8]
mov qword [rbp + 7], rax
mov ecx, dword [rbp + 0x6f]
dec r8d
mov dword [rbp + 0x7f], r8d
lea eax, [r8 + 0x121]
cmp eax, ecx
ja 0x180030b00
mov eax, dword [rbp + 0x6f]
add rsp, 0xb8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str._s:__s__opening_automation_socket.
call fcn.180043240
jmp case.0x180030b18.22
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.Fjern_Oppstarts_informasjon
call fcn.180043240
mov ecx, 0x63
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.Exiting_on_pipe_command
call fcn.180043240
mov ecx, 0x63
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.More_than_one_valid_value_parsed_from_string_
call fcn.180043240
mov ecx, 0x63
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov eax, edx
jmp 0x180030fe4