Function at 0x180002b1c
Capabilities:
Get file size
Read file on windows
Resolve function by parsing pe exports
Terminate process

Disassembly:
inc r9d
lea r10d, [r9*8]
neg r10d
add r10d, r11d
lea esi, [r10 + 8]
mov word [rbp + rsi*2], di
lea r14d, [r10 + 6]
mov esi, r14d
movzx r8d, word [rbp + rsi*2]
lea r13d, [r10 + 7]
cmp r8d, 0x5c
je 0x180002b96
lea r15d, [r10 + 5]
mov r8d, r15d
mov word [rbp + r13*2], di
mov r13d, r14d
movzx r14d, word [rbp + r8*2]
cmp r14d, 0x5c
je 0x180002b96
mov r13d, r15d
lea r15d, [r10 + 4]
mov word [rbp + rsi*2], di
mov esi, r15d
movzx r14d, word [rbp + rsi*2]
cmp r14d, 0x5c
je 0x180002b96
mov r13d, r15d
lea r15d, [r10 + 3]
mov word [rbp + r8*2], di
mov r8d, r15d
movzx r14d, word [rbp + r8*2]
cmp r14d, 0x5c
je 0x180002b96
mov r13d, r15d
lea r15d, [r10 + 2]
mov word [rbp + rsi*2], di
mov esi, r15d
movzx r14d, word [rbp + rsi*2]
cmp r14d, 0x5c
je 0x180002b96
mov word [rbp + r8*2], di
lea r14d, [r10 + 1]
mov r13d, r15d
mov r15d, r14d
movzx r8d, word [rbp + r15*2]
cmp r8d, 0x5c
je 0x180002b96
mov r13d, r14d
mov word [rbp + rsi*2], di
movzx esi, word [rbp + r10*2]
cmp esi, 0x5c
je 0x180002b96
mov r13d, r10d
dec r10d
mov word [rbp + r15*2], di
movzx esi, word [rbp + r10*2]
cmp esi, 0x5c
jne 0x180002aa1
cmp byte [rax], 0
je 0x180002c79
mov esi, edi
add esi, 8
lea r8d, [rsi - 8]
movsx r10d, byte [r8 + rax]
lea r9d, [r13 + rsi - 8]
mov word [rbp + r9*2], r10w
lea r11d, [rsi - 7]
movsx r9d, byte [r11 + rax]
test r9d, r9d
je 0x180002c79
add byte [rax], al
lea r8d, [r13 + rsi - 7]
mov word [rbp + r8*2], r9w
lea r9d, [rsi - 6]
movsx r9d, byte [r9 + rax]
test r9d, r9d
je 0x180002c79
lea r8d, [r13 + rsi - 6]
mov word [rbp + r8*2], r9w
lea r9d, [rsi - 5]
movsx r9d, byte [r9 + rax]
test r9d, r9d
je 0x180002c79
lea r8d, [r13 + rsi - 5]
mov word [rbp + r8*2], r9w
lea r9d, [rsi - 4]
movsx r9d, byte [r9 + rax]
test r9d, r9d
je 0x180002c79
lea r8d, [r13 + rsi - 4]
mov word [rbp + r8*2], r9w
lea r9d, [rsi - 3]
movsx r9d, byte [r9 + rax]
test r9d, r9d
je 0x180002c79
lea r8d, [r13 + rsi - 3]
mov word [rbp + r8*2], r9w
lea r9d, [rsi - 2]
movsx r9d, byte [r9 + rax]
test r9d, r9d
je 0x180002c79
lea r8d, [r13 + rsi - 2]
mov word [rbp + r8*2], r9w
lea r9d, [rsi - 1]
movsx r9d, byte [r9 + rax]
test r9d, r9d
je 0x180002c79
lea r8d, [r13 + rsi - 1]
mov word [rbp + r8*2], r9w
cmp byte [rsi + rax], 0
jne 0x180002ba1
mov rax, rsp
mov rcx, rbp
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
mov dword [rax + 0x20], 3
mov dword [rax + 0x28], 0x80
mov qword [rax + 0x30], 0
mov dword [rax + 0x30], 0
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r13, rax
cmp r13, 0xffffffffffffffff
je 0x180002e4b
mov rcx, r13
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, dword [0x1803e6177]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbp, rax
mov rcx, rbp
mov edx, dword [0x1803e6177]
call fcn.180002fce
mov rax, rsp
mov rcx, r13
mov rdx, rbp
mov r8d, esi
mov dword [rsp + 0x58], 0
lea r9, [rsp + 0x58]
mov qword [rax + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180002e4b
mov r10d, dword [0x1803e610b]
mov esi, dword [rsp + 0x58]
add rsi, rbp
lea r8, [rbp + r10]
mov eax, dword [r8]
mov r9d, dword [r8 + 4]
test eax, eax
jbe 0x180002dda
cmp eax, 4
jb 0x180002e53
lea rbp, [rbp + r10 + 8]
and rbp, 0xf
test ebp, ebp
je 0x180002d92
test ebp, 3
jne 0x180002e53
neg ebp
add ebp, 0x10
shr ebp, 2
lea edx, [rbp + 4]
cmp eax, edx
jb 0x180002e53
mov edx, eax
xor ecx, ecx
sub edx, ebp
and edx, 3
neg edx
add edx, eax
test ebp, ebp
je 0x180002d9d
add dword [r8 + rcx*4 + 8], r9d
inc rcx
cmp rcx, rbp
jb 0x180002d83
jmp 0x180002d9d
mov edx, eax
xor ebp, ebp
and edx, 3
neg edx
add edx, eax
movd xmm0, r9d
pshufd xmm0, xmm0, 0
movsxd rdx, edx
movdqu xmm1, xmmword [r8 + rbp*4 + 8]
paddd xmm1, xmm0
movdqu xmmword [r8 + rbp*4 + 8], xmm1
add rbp, 4
cmp rbp, rdx
jb 0x180002daa
movsxd rax, eax
cmp rdx, rax
jae 0x180002dda
add dword [r8 + rdx*4 + 8], r9d
inc rdx
cmp rdx, rax
jb 0x180002dcd
mov eax, dword [0x1803e6187]
add r8, rax
test r12, r12
je 0x180002e4b
movsxd rax, dword [r12 + 0x3c]
xor r10d, r10d
mov r9d, dword [rax + r12 + 0x88]
mov ebp, dword [r9 + r12 + 0x20]
mov ecx, dword [r9 + r12 + 0x18]
add rbp, r12
test ecx, ecx
jbe 0x180002e4b
mov al, byte [r8 + 1]
mov r11d, dword [rbp + r10*4]
xor edx, edx
add r11, r12
mov r13b, byte [r11]
cmp r13b, al
jne 0x180002e3b
cmp byte [r11 + rdx], 0
je 0x180002e5a
cmp byte [r8 + rdx + 1], 0
je 0x180002e5a
inc edx
mov r13b, byte [rdx + r11]
cmp r13b, byte [r8 + rdx + 1]
je 0x180002e1f
nop dword [rax + rax]
inc r10d
cmp r10d, ecx
jb 0x180002e0d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
xor edx, edx
jmp 0x180002dc5
mov r14d, dword [r9 + r12 + 0x24]
add r14, r12
mov edx, dword [r9 + r12 + 0x1c]
add rdx, r12
movzx eax, word [r14 + r10*2]
mov eax, dword [rdx + rax*4]
add rax, r12
je 0x180002e4b
movsx r9, byte [r8]
add r8, r9
test r12, r12
je 0x180002e4b
xor r11d, r11d
mov r13b, byte [r8 + 1]
mov r10d, dword [rbp + r11*4]
xor r9d, r9d
add r10, r12
mov r15b, byte [r10]
cmp r15b, r13b
jne 0x180002eba
cmp byte [r10 + r9], 0
je 0x180002ecf
cmp byte [r8 + r9 + 1], 0
je 0x180002ecf
inc r9d
mov r15b, byte [r9 + r10]
cmp r15b, byte [r8 + r9 + 1]
je 0x180002e9d
nop dword [rax + rax]
inc r11d
cmp r11d, ecx
jb 0x180002e8a
jmp 0x180002e4b
movzx ecx, word [r14 + r11*2]
mov edx, dword [rdx + rcx*4]
add r12, rdx
je 0x180002e4b
movsx rdx, byte [r8]
lea rcx, [r8 + rdx + 1]
lea rbp, [r8 + rdx]
call rax
test rax, rax
je 0x180002e4b
movsx r13, byte [rbp]
add rbp, r13
mov r14d, dword [0x1803e615f]
lea r9, [rsp + 0x5c]
add r14, rbp
mov r8d, dword [0x1803e613f]
mov r13d, dword [rbp + 4]
mov r15d, dword [rbp + 8]
mov rdx, r15
movsxd rbp, dword [rax + 0x3c]
mov ebp, dword [rbp + rax + 0x2c]
add rbp, rax
mov rcx, rbp
mov dword [r9], 0
call r12
mov rcx, rbp
mov rdx, r14
mov r8d, r15d
call fcn.180003036
mov rcx, rbp
mov rdx, r15
mov r8d, dword [rsp + 0x5c]
lea r9, [rsp + 0x5c]
call r12
mov r8, qword [0x1803e612f]
xor eax, eax
cmp byte [r8], 0
je 0x180002f8b
mov r8, qword [0x1803e612f]
movsx r9d, byte [r8 + rax]
mov word [rsi + rax*2], r9w
inc rax
mov r10, qword [0x1803e612f]
cmp byte [r10 + rax], 0
jne 0x180002f69
add r13, rbp
lea rcx, [rsp + 0x40]
mov word [rsi + rax*2], di
add r14, r15
mov qword [rcx + 8], rsi
mov qword [rcx], r14
mov byte [rcx + 0x10], 1
call r13
add rsp, 0x60
pop rbp
pop r15
pop r14
pop r13
invalid