Function at 0x180027ee0
Capabilities:
Execute command
Set console window title

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x18007b130]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov ebx, dword [rsp + 0x48]
lea r13d, [rdx + 0x5ac]
mov r14, r8
mov ebp, edx
mov r15, rcx
cmp edx, r13d
jae 0x180028115
movzx r12d, byte [rsp + 0x30]
xor esi, esi
nop word [rax + rax]
cmp ebp, 0x19d
ja 0x1800280ee
je 0x1800280d8
mov eax, ebp
sub eax, 0xb3
je 0x180028096
sub eax, 0x11
je 0x18002807e
sub eax, 0x55
je 0x180028028
sub eax, 0x1e
je 0x180027fa0
cmp eax, 0x11
jne 0x180028234
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rcx, str.nap__break_addr__________0x_016lx
mov qword [0x18007b2a8], rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
lea rcx, [0x180059a88]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
jmp 0x180028234
lea rax, [rsp + 0x48]
mov rsi, 0xffffffffffffffff
nop dword [rax]
inc rsi
cmp byte [rax + rsi], 0
jne 0x180027fb0
mov rdx, qword [r14 + 0x18]
mov rcx, qword [r14 + 0x10]
mov rax, rdx
sub rax, rcx
cmp rsi, rax
ja 0x180028004
lea rax, [rcx + rsi]
mov qword [r14 + 0x10], rax
mov rax, r14
cmp rdx, 0x10
jb 0x180027fe0
mov rax, qword [r14]
lea rdi, [rax + rcx]
mov r8, rsi
mov rcx, rdi
lea rdx, [rsp + 0x48]
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + rsi], 0
xor esi, esi
mov qword [rsp + 0x38], rsi
jmp 0x180028234
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov rdx, rsi
mov rcx, r14
call fcn.180001ef0
xor esi, esi
mov qword [rsp + 0x38], rsi
jmp 0x180028234
mov qword [r15 + 0x3000], 0
mov rax, r15
mov qword [r15 + 0x3008], 0
mov ecx, 0x80
nop word [rax + rax]
mov qword [rax], rsi
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rsi
lea rax, [rax + 0x40]
mov qword [rax - 0x28], rsi
mov qword [rax - 0x20], rsi
mov qword [rax - 0x18], rsi
mov qword [rax - 0x10], rsi
mov qword [rax - 8], rsi
sub rcx, 1
jne 0x180028050
jmp 0x180028234
lea r8, [0x18007b2c0]
mov edx, 0xe9
xor ecx, ecx
call fcn.18000fdc0
jmp 0x180028234
mov r8d, 3
lea rdx, [0x18005d21c]
lea rcx, [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov r8d, 2
mov byte [rsp + 0x4b], 0
lea rdx, [0x18005d2f3]
lea rcx, [rsp + 0x4b]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov byte [rsp + 0x4d], 0
mov r12b, 1
jmp 0x180028234
lea rdx, [r15 + 0x2000]
mov ecx, 0x25
call fcn.1800222f0
jmp 0x180028234
mov eax, ebp
sub eax, 0x1bb
je 0x180028157
sub eax, 0x11
je 0x180028146
sub eax, 0x55
je 0x180028248
sub eax, 0x2f
je 0x18002813f
cmp eax, 0x84
jne 0x180028234
mov eax, ebx
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1800439f0
mov rbx, qword [rsp + 0xc8]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ebx, esi
jmp 0x180028234
mov edx, 0xd9
xor ecx, ecx
call fcn.18000bee0
jmp 0x180028234
lea r9, [rsp + 0x38]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call sub.RPCRT4.dll_MesEncodeIncrementalHandleCreate
movsd xmm0, qword [r15]
lea r9, [rsp + 0x50]
xor r8d, r8d
movsd qword [rsp + 0x40], xmm0
mov edx, 0x112
lea rcx, [rsp + 0x40]
mov edi, eax
call fcn.1800158c0
test edi, edi
je 0x180028195
xor r12b, r12b
jmp 0x1800281c4
test r12b, r12b
je 0x1800281c4
mov rcx, qword [rsp + 0x38]
xor r9d, r9d
mov dword [rsp + 0x28], esi
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rsi
call sub.RPCRT4.dll_MesIncrementalHandleReset
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1800281c4
call sub.RPCRT4.dll_MesHandleFree
lea rax, [rsp + 0x50]
mov rsi, 0xffffffffffffffff
inc rsi
cmp byte [rax + rsi], 0
jne 0x1800281d0
mov rdx, qword [r14 + 0x18]
mov rcx, qword [r14 + 0x10]
mov rax, rdx
sub rax, rcx
cmp rsi, rax
ja 0x18002821a
lea rax, [rcx + rsi]
mov qword [r14 + 0x10], rax
mov rax, r14
cmp rdx, 0x10
jb 0x180028200
mov rax, qword [r14]
lea rdi, [rax + rcx]
mov r8, rsi
mov rcx, rdi
lea rdx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + rsi], 0
jmp 0x180028232
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov rdx, rsi
mov rcx, r14
call fcn.180001ef0
xor esi, esi
add ebp, 0x84
cmp ebp, r13d
jb 0x180027f30
jmp 0x180028115
mov eax, esi
jmp 0x180028117