Function at 0x180060720
Capabilities:
Read file on windows
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x100]
sub rsp, 0x200
mov rax, qword [0x1800dbea8]
xor rax, rsp
mov qword [rbp + 0xf0], rax
mov r10, qword [rbp + 0x160]
mov r11, r8
mov r14, qword [rbp + 0x168]
xor edi, edi
mov ebx, dword [rsp + 0x48]
mov esi, ecx
mov qword [rbp - 0x40], r8
mov r8, rdx
mov qword [rbp - 0x48], rdx
lea edx, [rcx + 0x750]
mov qword [rsp + 0x70], r9
mov dword [rsp + 0x44], ecx
mov qword [rsp + 0x58], r10
mov qword [rbp - 0x50], r14
mov dword [rsp + 0x78], ecx
mov dword [rsp + 0x50], edx
cmp ecx, edx
jae 0x180060bb7
mov edi, dword [rsp + 0x48]
lea r15, [0x180000000]
mov r13, qword [rsp + 0x70]
mov eax, 0x5773
mov r12d, dword [rsp + 0x48]
mov dword [rsp + 0x60], edi
mov ecx, 0x6f72
cmp esi, 0x130
ja 0x1800608fd
je 0x180060b3a
lea eax, [rsi - 0x18]
cmp eax, 0xb1
ja case.0x1800607f3.30
movzx eax, byte [r15 + rax + 0x61004]
mov ecx, dword [r15 + rax*4 + 0x60fe8]
add rcx, r15
jmp rcx
mov edi, 3
nop word [rax + rax]
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__close]
inc edi
cmp edi, 0x20
jl 0x180060800
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_signal]
xor edi, edi
cmp qword [0x1800dd4f0], rdi
jne 0x180060b02
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
lea rcx, str.PAGER
mov edx, 0x105
call fcn.1800b0190
mov edx, dword [rsp + 0x50]
mov qword [0x1800dd4f0], rax
test rax, rax
jne 0x180060b06
lea rax, str.more
mov qword [0x1800dd4f0], rax
mov eax, 0x5773
jmp 0x18006087e
mov eax, 0x57
mov word [rbp + 0x70], ax
mov eax, 0x5773
xor edi, edi
mov r10, qword [rsp + 0x58]
add esi, 0x90
mov dword [rsp + 0x78], esi
cmp esi, edx
jae 0x180060bbb
mov r8, qword [rbp - 0x48]
mov r11, qword [rbp - 0x40]
mov r9, qword [rsp + 0x70]
jmp 0x1800607ba
mov rax, qword [r9]
mov rdx, r11
mov r8, qword [r8]
mov r9, r14
mov rcx, r10
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_mbstowcs_s]
mov edx, dword [rsp + 0x50]
mov dword [rsp + 0x48], eax
jmp case.0x1800607f3.30
mov eax, 0x53
mov word [rbp + 0x71], ax
mov dword [rbp + 0x72], 0x6e4541
jmp case.0x1800607f3.30
mov rax, qword [r10]
xor edi, edi
mov dword [rsp + 0x60], edi
cmp dword [rax], 0x7f2bb705
jne 0x180060b27
mov r13, qword [rax + 0x70]
mov eax, 0x5773
jmp 0x18006087e
cmp esi, 0x1e9
ja 0x180060acd
je 0x180060a87
mov eax, esi
sub eax, 0x138
je 0x180060a77
sub eax, 0x21
je 0x180060948
xor edi, edi
cmp eax, 0x6f
jne 0x180060b06
mov eax, 0x74
mov word [rbp + 0x7a], ax
mov eax, 0x6f
mov word [rbp + 0x7b], ax
mov eax, 0x5773
jmp 0x18006087e
cmp dword [r13], 0x7f2bb706
jne 0x180060bad
mov rax, qword [r10]
dec dword [rax + 0x30]
cmp dword [rax + 0x30], 0
jg 0x180060ba6
mov r15, qword [r10]
mov r14d, 0xf9
mov qword [rbp - 0x70], r15
mov eax, r14d
sub eax, 0xf9
je 0x1800609e0
sub eax, 0x31
je 0x1800609c8
sub eax, 0x22
je 0x1800609c0
sub eax, 0x31
je 0x18006099a
cmp eax, 0x22
je 0x180060a5b
jmp 0x180060a4a
mov rax, qword [rbp - 0x68]
lea rdx, [rsp + 0x60]
mov r8d, 0x22
mov qword [rsp + 0x60], rax
lea rcx, [rbp - 0x70]
call fcn.18008e1f0
mov r15, qword [rbp - 0x70]
jmp 0x180060a4a
mov ebx, r12d
jmp 0x180060a4a
mov edx, 0x28
lea rcx, [rbp - 0x70]
call fcn.180084c40
add rax, qword [r13]
mov qword [rbp - 0x68], rax
jmp 0x180060a4a
xor r12d, r12d
lea rdi, [r13 + 0x18]
lea esi, [r12 + 8]
nop dword [rax]
mov eax, dword [rdi + 0x14]
test al, 2
je 0x180060a40
test al, 1
je 0x180060a40
mov rcx, qword [rdi]
lea r9, [rbp - 0x60]
mov rax, qword [rdi + 8]
lea r8, [rbp - 0x58]
mov qword [rsp + 0x28], rcx
mov edx, 0xaf
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x60], 1
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x60], r15
mov qword [rsp + 0x20], r13
call fcn.180085520
test eax, eax
je 0x180060a3c
mov r12d, eax
jmp 0x180060a40
and dword [rdi + 0x14], 0xfffffffe
add rdi, 0x18
sub rsi, 1
jne 0x1800609f0
add r14d, 0x53
cmp r14d, 0x298
jb 0x180060973
mov esi, dword [rsp + 0x78]
lea r15, [0x180000000]
mov edx, dword [rsp + 0x50]
mov r14, qword [rbp - 0x50]
mov dword [rsp + 0x60], ebx
jmp case.0x1800607f3.30
mov dword [rbp + 0x75], 0x506d75
mov word [rbp + 0x78], cx
jmp case.0x1800607f3.30
mov ecx, dword [r13 + 4]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__close]
test eax, eax
jns 0x180060aa1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov edi, dword [rax]
mov dword [rsp + 0x60], edi
xor edi, edi
xor r9d, r9d
mov qword [rsp + 0x28], rdi
mov r8, r13
xor edx, edx
mov dword [rsp + 0x20], 0xe0
xor ecx, ecx
call fcn.1800b9c80
mov edx, dword [rsp + 0x50]
mov eax, 0x5773
jmp 0x18006087e
cmp esi, 0x258
je 0x180060b10
cmp esi, 0x2e8
jne 0x18006087c
xor edi, edi
lea rdx, [0x1800cfc1c]
lea rcx, [rbp + 0x88]
mov word [rbp + 0x88], di
lea r8d, [rdi + 2]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov edx, dword [rsp + 0x50]
mov eax, 0x5773
jmp 0x18006087e
mov dword [rbp + 0x7c], 0x6c6f63
mov word [rbp + 0x7f], ax
mov byte [rbp + 0x81], 0
jmp 0x18006087c
mov eax, 0x7f2bb705
jmp 0x180060e32
mov eax, dword [rsp + 0x48]
jmp 0x180060e32
mov r8d, 0x50
lea rdx, [rbp + 0xa0]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
test eax, eax
jle 0x180060b97
mov eax, eax
lea r8, [rsp + 0x70]
mov r9d, 0xe3
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0x48]
mov dword [rsp + 0x48], 1
lea rcx, [rbp + 0xa0]
call fcn.18006cee0
mov r8d, 0x50
lea rdx, [rbp + 0xa0]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
test eax, eax
jg 0x180060b53
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [rax]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor eax, eax
jmp 0x180060e32
mov eax, 0x7f2bb706
jmp 0x180060e32
mov dword [rsp + 0x60], ebx
mov ebx, dword [rsp + 0x44]
lea r13d, [rbx + 0x69a]
cmp ebx, r13d
jae 0x180060e2e
mov r12, qword [rsp + 0x70]
movabs r11, 0x342da7f2f4960343
mov rsi, qword [rsp + 0x70]
mov r15d, dword [rsp + 0x48]
movzx r14d, byte [rsp + 0x40]
nop
cmp ebx, 0x220
ja 0x180060d5e
je 0x180060d47
cmp ebx, 0x11c
ja 0x180060d04
je 0x180060cf8
mov eax, ebx
sub eax, 0x18
je 0x180060cd2
sub eax, 0x82
je 0x180060c99
cmp eax, 0x2f
jne 0x180060f91
mov rcx, qword [r10]
xor r9d, r9d
mov qword [rsp + 0x38], rdi
add rcx, 0x70
mov dword [rsp + 0x30], 0xc7
xor r8d, r8d
mov qword [rsp + 0x28], rdi
xor edx, edx
mov qword [rsp + 0x20], rdi
call fcn.180059440
mov r10, qword [rsp + 0x58]
mov rcx, qword [r10]
add rcx, 0x10
cmp qword [rcx], 0
je 0x180060f87
mov qword [rsp + 0x38], rdi
xor r9d, r9d
mov dword [rsp + 0x30], 0xc7
xor r8d, r8d
mov qword [rsp + 0x28], rdi
xor edx, edx
mov qword [rsp + 0x20], rdi
call fcn.180059440
jmp 0x180060f82
mov r8d, 0xa
lea rdx, [rbp + 0x90]
lea ecx, [r8 + 0x16]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__itow]
mov r8d, 5
lea rdx, str..dll
lea rcx, [rbp + 0x94]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov r14b, 1
jmp 0x180060f82
mov r8d, 0xa
lea rdx, [rbp + 0x8c]
lea ecx, [r8 - 8]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ultow]
mov dword [rbp + 0x8e], 0x5f
jmp 0x180060f82
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
jmp 0x180060f91
mov eax, ebx
sub eax, 0x14b
je 0x180060fab
cmp eax, 0x53
jne 0x180060f91
xorps xmm0, xmm0
lea r9, [rbp + 0x88]
xor r8d, r8d
lea rdx, [rbp + 0x70]
lea ecx, [rax + 6]
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
movups xmmword [rbp - 8], xmm0
call fcn.18009e510
mov r12, rax
jmp 0x180060f82
mov dword [rbp - 0x28], 0x30
mov r15d, edi
mov dword [rsp + 0x68], edi
mov qword [rbp - 0x80], rdi
jmp 0x180060f91
cmp ebx, 0x428
ja 0x180060e02
je 0x180060de9
cmp ebx, 0x2a2
je 0x180060dd8
cmp ebx, 0x324
je 0x180060dbe
cmp ebx, 0x3a6
jne 0x180060f91
mov eax, dword [rsp + 0x68]
cmp eax, 0x274
jb 0x180060fdb
xorps xmm0, xmm0
mov qword [rbp - 0x78], rdi
mov ecx, eax
mov rax, r11
mul rcx
movups xmmword [rbp + 0x40], xmm0
movups xmmword [rbp + 0x50], xmm0
movups xmmword [rbp + 0x60], xmm0
mov rsi, rdx
shr rsi, 7
jmp 0x180060f91
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 8], xmm0
mov qword [rbp + 0x38], rax
movups xmmword [rbp + 0x18], xmm0
movups xmmword [rbp + 0x28], xmm0
jmp 0x180060f91
lea r8, [rsp + 0x68]
xor edx, edx
xor ecx, ecx
call r12
jmp 0x180060f82
lea r9, [rbp - 0x80]
mov r8d, r15d
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x38]
call sub.ADVAPI32.dll_LsaOpenPolicy
jmp 0x180060f82
cmp ebx, 0x4aa
je 0x180060e5c
cmp ebx, 0x52c
jne 0x180060f91
mov rdx, qword [r10]
lea r8, [rsp + 0x68]
xor ecx, ecx
call r12
movsxd rcx, eax
cmp rcx, rsi
sete byte [rsp + 0x44]
mov eax, dword [rsp + 0x44]
mov rcx, qword [rbp + 0xf0]
xor rcx, rsp
call fcn.1800c0ae0
mov rbx, qword [rsp + 0x240]
add rsp, 0x200
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rdi, qword [r10 + 8]
mov rax, r11
mov r9, qword [r10]
mov rcx, rdi
sub rcx, r9
mov byte [rsp + 0x40], 0
imul rcx
mov r8, rdx
sar r8, 7
mov rax, r8
shr rax, 0x3f
add r8, rax
cmp rsi, r8
jae 0x180060e9a
imul rax, rsi, 0x274
add rax, r9
mov qword [r10 + 8], rax
jmp 0x180060eff
jbe 0x180060eff
mov rcx, qword [r10 + 0x10]
mov rax, r11
sub rcx, r9
imul rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rsi, rdx
jbe 0x180060ed3
lea r8, [rsp + 0x40]
mov rdx, rsi
mov rcx, r10
call fcn.1800323a0
mov r10, qword [rsp + 0x58]
jmp 0x180060eff
mov rax, rsi
sub rax, r8
je 0x180060efb
imul rbx, rax, 0x274
xor edx, edx
mov rcx, rdi
mov r8, rbx
call sub.VCRUNTIME140.dll_memset
mov r10, qword [rsp + 0x58]
add rdi, rbx
mov ebx, dword [rsp + 0x44]
mov qword [r10 + 8], rdi
cmp qword [rbp - 0x80], 0
jne 0x180060f0b
xor r14b, r14b
jmp 0x180060f87
test r14b, r14b
je 0x180060f87
mov rcx, qword [rbp - 0x80]
lea rax, [rbp - 0x78]
mov r9d, r15d
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x40]
lea rdx, [rbp + 8]
call sub.ADVAPI32.dll_LsaCreateTrustedDomainEx
cmp qword [rbp - 0x78], 0
jne 0x180060f42
mov rcx, qword [rbp - 0x80]
call sub.ADVAPI32.dll_LsaClose
xor r14b, r14b
jmp 0x180060f82
mov ebx, 0x9a
mov eax, ebx
sub eax, 0x9a
je 0x180060f69
cmp eax, 1
jne 0x180060f74
mov rcx, qword [rbp - 0x78]
call sub.ADVAPI32.dll_LsaClose
mov rcx, qword [rbp - 0x80]
call sub.ADVAPI32.dll_LsaClose
jmp 0x180060f74
xor edx, edx
lea rcx, [rbp - 0x78]
call sub.ADVAPI32.dll_LsaDeleteTrustedDomain
inc ebx
cmp ebx, 0x9c
jb 0x180060f47
mov ebx, dword [rsp + 0x44]
mov r10, qword [rsp + 0x58]
movabs r11, 0x342da7f2f4960343
add ebx, 0x82
mov dword [rsp + 0x44], ebx
cmp ebx, r13d
jae 0x180060e2e
xor edi, edi
jmp 0x180060bf0
mov qword [rsp + 0x38], rdi
xor r9d, r9d
mov dword [rsp + 0x30], 0xc7
xor r8d, r8d
mov qword [rsp + 0x28], rdi
xor edx, edx
mov rcx, r10
mov qword [rsp + 0x20], rdi
call fcn.180059440
mov eax, dword [rsp + 0x60]
jmp 0x180060e32
mov byte [rsp + 0x44], 0
jmp 0x180060e2e