Function at 0x1800276e0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x750]
sub rsp, 0x850
imul r12d, r9d, 0x9e6
mov r14d, r9d
mov r13, r8
mov rdi, rdx
mov rsi, rcx
mov ebx, r9d
cmp r9d, r12d
ja 0x18002795b
mov r15, qword [rsp + 0x38]
mov edx, 0x73
xor ecx, ecx
lea r8d, [rdx - 0x12]
lea r9d, [rdx + 6]
lea r10d, [rdx - 0x45]
lea r11d, [rdx - 0xf]
mov eax, 0x6c
cmp ebx, 0x152e5
ja 0x18002788d
je 0x18002795b
cmp ebx, 0x643e
ja 0x18002782f
je 0x180027803
mov eax, ebx
sub eax, 0x8d
je 0x1800277d7
sub eax, 0x62
je 0x180027797
cmp eax, 0xc
jne 0x1800279bc
mov dword [rsp + 0x40], 0x730073
mov dword [rsp + 0x44], 0x65006c
jmp 0x1800279bc
mov rax, qword [rbp + 0x7a0]
xor r8d, r8d
mov rcx, rdi
mov rdx, qword [rax]
call fcn.1800749cc
test eax, eax
jne 0x1800279d8
mov r9, rdi
lea edx, [rax + 4]
lea r8d, [rax + 1]
lea rcx, [rsp + 0x30]
call fcn.180074690
cmp rax, 1
jne 0x1800279d8
jmp 0x1800279a5
xor r9d, r9d
mov dword [rsp + 0x38], 0x200
lea r8, [rsp + 0x38]
mov dword [rsp + 0x20], 0x157
mov rdx, rdi
lea rcx, [rbp + 0x160]
call fcn.1800108e0
jmp 0x1800279a5
mov ecx, 0xfffffe06
lea rdx, [rbp + 0x160]
call qword [0x1800ce8f0]
mov eax, dword [rbp + 0x6bc]
xor ecx, ecx
mov word [0x1800ce8f8], cx
mov dword [rbp + 0x798], eax
jmp 0x1800279a7
cmp ebx, 0xa9ea
je 0x18002785d
cmp ebx, 0xb272
je 0x180027850
cmp ebx, 0xc7ef
je 0x18002795b
jmp 0x1800279bc
mov dword [rsp + 0x48], 0x790061
jmp 0x1800279bc
movzx eax, byte [rsp + 0x32]
movzx ecx, byte [rsp + 0x33]
shl ecx, 8
or ecx, eax
movzx eax, byte [rsp + 0x31]
shl ecx, 8
or ecx, eax
movzx eax, byte [rsp + 0x30]
shl ecx, 8
or ecx, eax
mov dword [rbp + 0x798], ecx
xor ecx, ecx
jmp 0x1800279bc
cmp ebx, 0x3784e
ja 0x180027944
je 0x1800278e3
cmp ebx, 0x163e9
je 0x1800278ce
cmp ebx, 0x21560
je 0x1800278c4
cmp ebx, 0x2c6d7
jne 0x1800279bc
mov dword [rsp + 0x56], 0x6c
jmp 0x1800279bc
mov word [rsp + 0x54], ax
jmp 0x1800279bc
mov dword [rsp + 0x4c], 0x320033
mov dword [rsp + 0x50], 0x64002e
jmp 0x1800279bc
mov r9, rax
lea r8, [rsp + 0x40]
mov edx, 0xe5
xor ecx, ecx
call fcn.1800588e0
cmp qword [rsi + 0x18], 0x10
mov rdx, rsi
jb 0x180027904
mov rdx, qword [rsi]
mov r8d, dword [rsi + 0x10]
mov rcx, rdi
call rax
cmp eax, dword [rsi + 0x10]
jne 0x1800279cf
mov rax, qword [rbp + 0x7a0]
lea rcx, [rsp + 0x38]
mov r15, qword [sym.imp.SHELL32.dll_IsUserAnAdmin]
mov r9d, 0x57
mov r8, rdi
mov rdx, r13
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
call fcn.180010510
jmp 0x1800279a5
cmp ebx, 0x429c5
je 0x180027982
cmp ebx, 0x4db3c
jne 0x1800279bc
mov byte [rbp + 0x798], 1
mov eax, dword [rbp + 0x798]
lea r11, [rsp + 0x850]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
xor r8d, r8d
mov rdx, r13
lea ecx, [r8 + 0x1c]
call fcn.180067fe0
mov r8, r15
lea rdx, str.IsUserAnAdmin__p_n
lea rcx, [rsp + 0x60]
call fcn.18006ad90
xor ecx, ecx
mov edx, 0x73
lea r8d, [rdx - 0x12]
lea r9d, [rdx + 6]
lea r10d, [rdx - 0x45]
lea r11d, [rdx - 0xf]
imul eax, r14d, 0xb5
add ebx, eax
cmp ebx, r12d
ja 0x18002795b
jmp 0x180027742
mov byte [rbp + 0x798], 0
jmp 0x18002795b
xor ecx, ecx
call fcn.1800726e0
mov ecx, 1
call fcn.18007267c
int3