Function at 0x18004a720
Capabilities:
Read file on windows
Terminate process

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2a8
mov rax, qword [0x180087e88]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov eax, dword [rsp + 0x310]
mov r14, r9
xor r9d, r9d
mov r12, r8
mov rbp, rdx
mov r15, rcx
mov r13d, eax
lea edi, [rax + 0x6cc]
mov dword [rsp + 0x44], edi
cmp eax, edi
jae 0x18004ab4c
movzx eax, byte [rsp + 0x40]
lea r8d, [r9 + 0x3f]
mov rcx, qword [rsp + 0x48]
mov r10d, 0x3d76
mov byte [rsp + 0x40], al
mov qword [rsp + 0x48], rcx
mov edx, 0x772f
cmp r13d, 0x1bc
ja 0x18004aa1e
je 0x18004aa0b
cmp r13d, 0x12b
ja 0x18004a99c
je 0x18004a992
mov eax, r13d
sub eax, 0x46
je 0x18004a917
sub eax, 0x91
je 0x18004a7f0
movzx edx, byte [rsp + 0x40]
cmp eax, 0x1a
jne 0x18004aadf
mov dword [r15 + 0x1060], r9d
jmp 0x18004aadf
mov esi, 0x50
mov eax, esi
sub eax, 0x50
je 0x18004a8c6
cmp eax, 0x5c
jne 0x18004a8e4
mov rax, qword [r12]
cmp qword [r14], rax
jne 0x18004a8a0
mov edi, 0x6b
nop dword [rax + rax]
mov eax, edi
sub eax, 0x6b
je 0x18004a88a
sub eax, 0x79
je 0x18004a878
cmp eax, 0x79
jne 0x18004a895
cmp qword [r15], 0
jne 0x18004a895
mov ebx, 0x28
nop dword [rax]
cmp ebx, 0x28
je 0x18004a854
cmp ebx, 0x4e
jne 0x18004a86e
lea ecx, [rbx - 0x4d]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.MaxHeapVectorElements_WithDestructor
call fcn.180079020
add ebx, 0x26
cmp ebx, 0x74
jb 0x18004a840
jmp 0x18004a895
mov rdx, qword [r12]
mov rcx, qword [r15]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
mov qword [r15], rax
jmp 0x18004a895
mov rax, qword [r12]
add rax, rax
mov qword [r12], rax
add edi, 0x79
cmp edi, 0x1d6
jb 0x18004a820
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ferror]
test eax, eax
je 0x18004a8e4
lea rcx, str.ReplaceEnvironmentVariableTokens
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [r14]
mov r9, rbp
mov r8, qword [r12]
mov edx, 1
sub r8, rcx
add rcx, qword [r15]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add qword [r14], rax
add esi, 0x5c
cmp esi, 0x108
jb 0x18004a7f5
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_feof]
test eax, eax
je 0x18004a7f0
cmp qword [r14], 0
je 0x18004ab43
mov edi, dword [rsp + 0x44]
jmp 0x18004aacb
cmp qword [r12], 0
jne 0x18004aada
mov ebx, 0x56
mov eax, ebx
sub eax, 0x56
je 0x18004a97e
sub eax, 1
je 0x18004a979
sub eax, 1
je 0x18004a967
cmp eax, 1
jne 0x18004a986
cmp qword [r15], 0
jne 0x18004a986
lea ecx, [rax + 1]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.Requested_opration_was_not_supported
call fcn.180079020
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [r12]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [r15], rax
xor r9d, r9d
jmp 0x18004a986
mov qword [r14], r9
jmp 0x18004a986
mov qword [r12], 0xfa0
inc ebx
cmp ebx, 0x5a
jb 0x18004a927
jmp 0x18004aace
mov word [rsp + 0x68], dx
jmp 0x18004aada
mov eax, r13d
sub eax, 0x168
je 0x18004a9f3
cmp eax, 0x1a
jne 0x18004aada
lea r9, [r15 + 0x106c]
mov qword [rsp + 0x50], 2
mov r8, r15
lea rdx, [rsp + 0x50]
mov ecx, 0xce
call fcn.180064b30
cmp rax, 2
je 0x18004aacb
cmp dword [r15 + 0x10c8], 0
je 0x18004aacb
mov eax, 1
jmp 0x18004ad30
mov rdx, qword [r14]
mov qword [r12], rdx
mov rcx, qword [r15]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
mov qword [r15], rax
jmp 0x18004aacb
mov dword [rsp + 0x6a], 0x68637461
mov word [rsp + 0x6e], r8w
jmp 0x18004aada
mov eax, r13d
sub eax, 0x213
je 0x18004aaa6
sub eax, 0x3a
je 0x18004aa99
sub eax, 0x91
je 0x18004aa91
sub eax, 0x91
je 0x18004aa75
cmp eax, 0x91
jne 0x18004aada
lea rax, [rsp + 0x68]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x18004aa52
lea rcx, [r12 + 0x20]
lea rdx, [rsp + 0x68]
call fcn.180063650
xor r9d, r9d
mov qword [rsp + 0x60], r9
jmp 0x18004aace
mov r8d, ILRemoveLastID
mov qword [rsp + 0x48], r9
lea rdx, str.www.youtube.com
mov rcx, r12
call fcn.180063650
jmp 0x18004aacb
mov dl, 1
mov byte [rsp + 0x40], dl
jmp 0x18004aadf
mov word [rsp + 0x6f], r10w
mov byte [rsp + 0x71], 0
jmp 0x18004aada
cmp byte [r15 + 0x106d], 2
lea r8, [r15 + 0x40]
mov eax, r9d
lea rdx, [rsp + 0x50]
sete al
mov ecx, 0x46
mov dword [rsp + 0x50], eax
call fcn.18004d0c0
xor r9d, r9d
mov r10d, 0x3d76
mov r8d, 0x3f
movzx edx, byte [rsp + 0x40]
add r13d, 0x91
cmp r13d, edi
jb 0x18004a78e
mov r10, qword [rsp + 0x48]
mov r13d, dword [rsp + 0x310]
mov ebx, dword [rsp + 0x44]
lea esi, [r13 - 0xc]
cmp r13d, esi
jbe case.0x18004ab41.1
mov ebp, dword [rsp + 0x50]
lea edi, [r13 - 0x46]
mov r14d, dword [rsp + 0x50]
lea r8, [0x180000000]
cmp edi, 0xe5
ja case.0x18004ab41.12
movzx eax, byte [r8 + rdi + 0x4ad88]
mov ecx, dword [r8 + rax*4 + 0x4ad54]
add rcx, r8
jmp rcx
mov eax, dword [rsp + 0x44]
jmp 0x18004ad30
movzx edx, byte [rsp + 0x40]
mov r10, qword [rsp + 0x48]
mov byte [rsp + 0x40], dl
mov qword [rsp + 0x48], r10
jmp 0x18004aaf4
lea rax, [rsp + 0x80]
mov dword [rsp + 0x28], ebp
lea r9, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x58]
xor edx, edx
mov rcx, r10
call sub.SHELL32.dll_SHGetUnreadMailCountW
movzx edx, byte [rsp + 0x40]
mov r14d, eax
mov eax, 0x1bb
mov word [r12 + 0x60], ax
jmp case.0x18004ab41.12
mov dword [r15 + 0x10b0], 1
jmp case.0x18004ab41.12
test r14d, r14d
movzx eax, dl
mov ecx, r9d
cmove ecx, eax
mov byte [rsp + 0x40], cl
movzx edx, cl
test cl, cl
je case.0x18004ab41.12
lea r8, [rsp + 0x80]
xor edx, edx
xor ecx, ecx
call sub.SHELL32.dll_SHSetUnreadMailCountW
movzx edx, byte [rsp + 0x40]
jmp case.0x18004ab41.12
cmp qword [r15 + 0x18], 0x10
mov rdx, r15
jb 0x18004abf1
mov rdx, qword [r15]
mov r8, qword [r15 + 0x10]
lea rcx, [r12 + 0x20]
call fcn.1800626c0
movzx edx, byte [rsp + 0x40]
mov ebp, 0x104
jmp case.0x18004ab41.12
mov dword [r15 + 0x1088], r9d
jmp case.0x18004ab41.12
mov eax, 0x50
nop
cmp eax, 0x50
je 0x18004ad02
add eax, 0xfa0
cmp eax, 0xfa0
jbe 0x18004ac20
mov eax, dword [r15 + 0xc]
and eax, 0x20
mov dword [r15 + 0x1060], eax
jmp case.0x18004ab41.12
mov dword [r15 + 0x1094], r9d
jmp case.0x18004ab41.12
mov qword [rsp + 0x38], r9
lea rax, [r12 + 0x40]
mov dword [rsp + 0x30], 0x107
xor r8d, r8d
mov qword [rsp + 0x28], rax
xor edx, edx
mov qword [rsp + 0x20], r9
xor ecx, ecx
xor r9d, r9d
call fcn.18004f9e0
movzx edx, byte [rsp + 0x40]
jmp case.0x18004ab41.12
cmp byte [r15 + 0x106d], 3
jne 0x18004acdf
mov ecx, 0x76
mov eax, ecx
sub eax, 0x76
je 0x18004acd0
sub eax, 0x5e
je 0x18004acc3
sub eax, 0x5e
je 0x18004acb5
cmp eax, 0x5e
jne 0x18004acd4
mov dword [r15 + 0x1c], 0xffffffff
jmp 0x18004acd4
mov dword [r15 + 0x14], r9d
mov dword [r15 + 0x18], 0xffffffff
jmp 0x18004acd4
mov dword [r15 + 0x10b4], 1
jmp 0x18004acd4
mov dword [r15 + 0x38], r9d
add ecx, 0x5e
cmp ecx, 0x1ee
jb 0x18004ac95
mov ebx, r9d
jmp case.0x18004ab41.12
mov dword [r15 + 0x1098], r9d
dec r13d
dec edi
cmp r13d, esi
jbe case.0x18004ab41.1
mov r10, qword [rsp + 0x48]
xor r9d, r9d
jmp 0x18004ab1a
cmp qword [r15], 0
jne case.0x18004ab41.1
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.Rejected_push_stream__d_on_secure_connection
call fcn.180079020
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov eax, ebx
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.180079740
add rsp, 0x2a8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret