Function at 0x1800d6230
Capabilities:
Read file on windows
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xe0
mov rax, qword [0x1801eef68]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov r15d, dword [rsp + 0x140]
mov r13, rdx
mov r14, qword [rsp + 0x148]
mov esi, r15d
mov rbx, qword [rsp + 0x150]
imul r12d, r15d, 0x118
mov qword [rsp + 0x68], r8
cmp r15d, r12d
ja 0x1800d6414
mov edi, dword [rsp + 0x68]
xor ebp, ebp
mov ecx, 0xfffe
nop word [rax + rax]
cmp esi, 0xce
ja 0x1800d6443
je 0x1800d65e0
cmp esi, 3
je 0x1800d63c7
cmp esi, 0x21
je 0x1800d658f
cmp esi, 0x26
je 0x1800d6351
cmp esi, 0x6c
jne 0x1800d656d
mov qword [rsp + 0x28], rbp
lea ecx, [rsi + 0xc]
xor r9d, r9d
mov qword [rsp + 0x20], rbp
xor r8d, r8d
xor edx, edx
call fcn.18008b9b0
xor r8d, r8d
xor ecx, ecx
cmp rax, 2
je 0x1800d6581
mov qword [rsp + 0x40], rbp
xor r9d, r9d
mov qword [rsp + 0x38], rbp
xor edx, edx
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0xc7
mov qword [rsp + 0x20], rbx
call fcn.180039c20
test al, al
je 0x1800d633f
lea r9d, [rsi - 0xc]
xor r8d, r8d
mov rdx, rbx
xor ecx, ecx
call fcn.180083480
jmp 0x1800d6568
mov edx, 0x87
mov rcx, rbx
call fcn.180006ea0
jmp 0x1800d6568
lea rax, [rsp + 0x60]
mov word [rsp + 0x60], cx
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov qword [rsp + 0x28], rbp
mov edx, 0x130
xor ecx, ecx
mov qword [rsp + 0x20], rbp
call fcn.180062b60
mov eax, dword [r14]
mov edi, 1
test eax, eax
jle 0x1800d639e
cmp eax, 0x7f
jle 0x1800d63ad
inc edi
shr eax, 8
cmp eax, 0x7f
ja 0x1800d6392
jmp 0x1800d63ad
cmp eax, 0xffffff80
jge 0x1800d63ad
inc edi
sar eax, 8
cmp eax, 0xffffff80
jl 0x1800d63a3
lea eax, [rdi + 1]
mov ecx, 1
movsxd rdx, eax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov qword [rbx + 8], rax
jmp 0x1800d6568
xor eax, eax
lock cmpxchg dword [rbx + 0x11c], ebp
cmp eax, 1
je 0x1800d65c2
xor eax, eax
lock cmpxchg dword [rbx + 0x120], ebp
cmp eax, 1
je 0x1800d65aa
mov edx, 0x117
xor ecx, ecx
call fcn.180005c70
test al, al
jne 0x1800d6568
xor r8d, r8d
mov r9d, 0x60
xor ecx, ecx
mov rdx, rbx
call fcn.180083480
mov eax, dword [rsp + 0x60]
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.1800d7250
mov rbx, qword [rsp + 0x120]
add rsp, 0xe0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
cmp esi, 0x558
je 0x1800d653c
cmp esi, 0xa8a
je 0x1800d64b4
cmp esi, 0xfbc
jne 0x1800d656d
test byte [rbx + 0x18], 0x40
je 0x1800d66aa
mov qword [rsp + 0x50], rbp
xor r9d, r9d
mov qword [rsp + 0x48], rbp
mov r8, rbx
mov qword [rsp + 0x40], rbp
xor edx, edx
mov qword [rsp + 0x38], rbp
mov ecx, 0xaa
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbp
call fcn.18001f7c0
test eax, eax
jns 0x1800d66aa
mov eax, 0xffffffff
jmp 0x1800d6418
cmp dword [r14], ebp
jge 0x1800d64c5
mov rax, qword [rbx + 8]
cmp byte [rax], bpl
jne 0x1800d64c5
mov byte [rax], 0xff
mov qword [rsp + 0x30], rbp
mov r9d, reloc.SHELL32.dll_ILFindLastID
mov qword [rsp + 0x28], rbp
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rbp
xor ecx, ecx
mov dword [rbx + 0x10], edi
call fcn.180067aa0
test rax, rax
je 0x1800d6501
mov ecx, 0x8000
test word [rax + 0x18], cx
jbe 0x1800d6501
or word [rbx + 0x18], 1
jmp 0x1800d6568
lea r8, [rsp + 0x70]
mov dword [rsp + 0x70], 1
mov rdx, rbx
mov ecx, 0x11c
call fcn.180028530
test eax, eax
jns 0x1800d6568
neg eax
lea r8, [rsp + 0x68]
mov rdx, rbx
mov dword [rsp + 0x68], eax
mov ecx, 0xc0
call fcn.180017ee0
jmp 0x1800d6418
mov eax, dword [r14]
movsxd rcx, edi
add rcx, qword [rbx + 8]
test eax, eax
je 0x1800d6568
nop word [rax + rax]
cmp eax, 0xffffffff
je 0x1800d6568
mov byte [rcx - 1], al
dec rcx
mov eax, dword [r14]
sar eax, 8
mov dword [r14], eax
test eax, eax
jne 0x1800d6550
mov ecx, 0xfffe
imul eax, r15d, 0x23
add esi, eax
cmp esi, r12d
jbe 0x1800d62a0
jmp 0x1800d6414
mov r9d, 0x60
mov rdx, rbx
jmp 0x1800d640f
mov rax, qword [rsp + 0x68]
mov rdx, r14
mov r9, qword [r13 + 8]
mov rcx, qword [rbx]
mov r8d, dword [rax]
call qword [r13]
jmp 0x1800d6418
mov edx, ILAppendID
mov rcx, rbx
call fcn.180047410
xchg dword [rbx + 0x120], ebp
jmp 0x1800d6414
mov r9d, 0x60
xor r8d, r8d
mov rdx, rbx
xor ecx, ecx
call fcn.180083480
xchg dword [rbx + 0x11c], ebp
jmp 0x1800d6414
mov ebx, 3
mov ecx, ebx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__close]
inc ebx
cmp ebx, 0x20
jl 0x1800d65e5
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_signal]
cmp qword [0x1801ef0d8], rbp
jne 0x1800d6630
lea r8, str.PAGER
mov edx, 0xd7
xor ecx, ecx
call fcn.1800c6fd0
test rax, rax
lea rcx, str.more
cmovne rcx, rax
mov qword [0x1801ef0d8], rcx
mov r8d, 0x50
lea rdx, [rsp + 0x80]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
test eax, eax
jle 0x1800d669b
nop word [rax + rax]
mov eax, eax
lea r9, [rsp + 0x80]
xor edx, edx
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x78]
mov dword [rsp + 0x68], 1
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea r8d, [rdx + 0x16]
call fcn.18000f180
mov r8d, 0x50
lea rdx, [rsp + 0x80]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
test eax, eax
jg 0x1800d6650
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [rax]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov eax, edi
jmp 0x1800d6418