Function at 0x1800373e0
Capabilities:
Read file on windows
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x180090f80]
xor rax, rsp
mov qword [rsp + 0x78], rax
lea ebx, [rcx + 0x6c0]
mov qword [rsp + 0x38], r8
mov dword [rsp + 0x30], ebx
cmp ecx, ebx
mov rbx, qword [rsp + 0x38]
mov r14, rdx
mov esi, ecx
jae 0x1800377ab
mov r15, qword [rsp + 0x38]
xor edi, edi
mov r13, qword [rsp + 0x38]
mov r12, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x38]
mov eax, dword [rsp + 0x30]
nop dword [rax]
cmp esi, 0x1e1
ja 0x1800376ce
je 0x180037693
cmp esi, 0x120
ja 0x180037591
je 0x18003754f
mov eax, esi
sub eax, 0x20
je 0x180037532
sub eax, 0x28
je 0x1800374e4
sub eax, 0x6c
je 0x1800374aa
cmp eax, 0x55
jne 0x180037830
lea rdx, [0x180079aa0]
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rbp, rax
jmp 0x18003782b
mov r8d, 4
mov byte [rsp + 0x4d], 0
lea rdx, [0x180080b0f]
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov r8d, 2
lea rdx, [0x180080b40]
lea rcx, [rsp + 0x51]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp 0x18003782b
movzx eax, word [0x180080a13]
lea rdx, [0x180080a4b]
mov word [rsp + 0x40], ax
lea rcx, [rsp + 0x48]
movzx eax, byte [0x180080a15]
mov r8d, 5
mov byte [rsp + 0x42], al
mov eax, dword [0x180080a30]
mov dword [rsp + 0x43], eax
movzx eax, byte [0x180080a34]
mov byte [rsp + 0x47], al
mov byte [rsp + 0x48], 0
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp 0x18003782b
mov rcx, qword [r14 + 0x10]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, qword [r14 + 8]
mov qword [r14 + 0x10], rdi
mov qword [r14], rdi
mov qword [rax], rdi
jmp 0x18003782b
mov r8d, 5
mov byte [rsp + 0x53], 0
lea rdx, [0x180080b73]
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov r8d, 5
mov dword [rsp + 0x60], 0x75
lea rdx, str.ser32
lea rcx, [rsp + 0x60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
jmp 0x18003782b
mov eax, esi
sub eax, 0x123
je 0x180037629
sub eax, 0x52
je 0x1800375e7
cmp eax, 0x17
jne 0x180037830
lea r8d, [rax - 0x15]
lea rdx, [0x18007a3e0]
lea rcx, [rsp + 0x6c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov r8d, 2
mov dword [rsp + 0x6e], 0x64
lea rdx, [0x18007a3e4]
lea rcx, [rsp + 0x60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
jmp 0x18003782b
test rbp, rbp
jne 0x180037830
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [rax]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_strerror]
lea ecx, [rbp + 2]
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9, rbx
lea rdx, str.safe_browsing::SafeBrowsingService::Start
mov rcx, rax
mov r8, r14
call fcn.180076250
lea ecx, [rbp + 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
add r8, 2
lea rdx, [r14 + 4]
mov r9d, 0x10
nop word [rax + rax]
movzx ecx, byte [r8 - 2]
lea r8, [r8 + 4]
movsx eax, word [rdx - 4]
lea rdx, [rdx + 8]
imul eax, ecx
mov word [rdx - 0xc], ax
movzx ecx, byte [r8 - 5]
movsx eax, word [rdx - 0xa]
imul eax, ecx
mov word [rdx - 0xa], ax
movzx ecx, byte [r8 - 4]
movsx eax, word [rdx - 8]
imul eax, ecx
mov word [rdx - 8], ax
movzx ecx, byte [r8 - 3]
movsx eax, word [rdx - 6]
imul eax, ecx
mov word [rdx - 6], ax
sub r9, 1
jne 0x180037640
jmp 0x18003782b
xor edx, edx
mov rcx, rbp
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
xor r8d, r8d
xor edx, edx
mov rcx, rbp
movsxd r13, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
lea rcx, [r13 + 1]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r15, rax
jmp 0x18003782b
cmp esi, 0x325
ja 0x180037794
je 0x18003778a
mov eax, esi
sub eax, 0x1f8
je 0x18003775b
sub eax, 0x55
je 0x180037736
cmp eax, 0x6c
jne 0x180037830
cmp r12, r13
je 0x180037830
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [rax]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_strerror]
mov ecx, 2
mov rdi, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9, rdi
lea rdx, str._GHT_Ballard_PosScale_info_auto.name__.empty__
mov rcx, rax
mov r8, r14
call fcn.180076250
jmp 0x180037829
test r15, r15
je 0x180037844
mov r9, rbp
mov r8, r13
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov r12, rax
jmp 0x18003782b
lea r8, [rsp + 0x40]
mov edx, 0xb2
lea rcx, [rsp + 0x60]
call fcn.18005f890
lea rcx, [r14 + 0x78]
mov qword [rsp + 0x20], rdi
mov r9d, 4
xor r8d, r8d
xor edx, edx
call rax
jmp 0x18003782b
mov byte [r12 + r15], 0
jmp 0x180037834
mov eax, esi
sub eax, 0x391
je 0x1800377e1
sub eax, 0x6c
je 0x1800377dc
cmp eax, 0x6c
jne 0x180037830
mov rax, rbx
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.180076c30
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rbx, r15
jmp 0x180037830
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
cmp eax, 0xffffffff
jne 0x18003782b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [rax]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_strerror]
mov ecx, 2
mov rdi, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9, rdi
lea rdx, str.VMODL_VIM_HOST_DIAGNOSTIC_PARTITION_SINGLEHOST
mov rcx, rax
mov r8, r14
call fcn.180076250
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_clearerr]
xor edi, edi
mov r8, qword [rsp + 0x38]
mov eax, dword [rsp + 0x30]
add esi, 0x6c
cmp esi, eax
jb 0x180037450
jmp 0x1800377ab
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [rax]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_strerror]
mov ecx, 2
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9, rbx
lea r8, [r13 + 1]
mov rcx, rax
lea rdx, str.Unable_to_find_master_PkgDef_file._Using_defaults
call fcn.180076250
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3