Function at 0x180009d90
Capabilities:
Read file on windows
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x140]
sub rsp, 0x240
cmp edx, 1
jne 0x18000a131
lea rax, [0x1800092c0]
add rax, 0x13b
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x13b
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x50]
call fcn.180010070
lea rax, [0x180009980]
add rax, 0x1db
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x1db
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x50]
call fcn.180012410
xor ecx, ecx
call fcn.18007fabc
mov ecx, eax
call fcn.18007c6b4
lea rbx, [0x1800096f0]
lea rax, [rbx + 0x164]
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x164
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x50], xmm0
lea rdx, [rbp + 0x60]
lea rcx, [rsp + 0x50]
call fcn.180012590
add rbx, 0x1e4
mov qword [rsp + 0x60], rbx
mov dword [rsp + 0x68], 0x1e4
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x50], xmm0
lea rdx, [rbp - 0x10]
lea rcx, [rsp + 0x50]
call fcn.180012590
lea rax, [0x1800097e0]
add rax, 0x1b5
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], 0x1b5
xor eax, eax
mov word [rsp + 0x70], ax
mov byte [rsp + 0x72], al
xor ebx, ebx
mov qword [rsp + 0x78], rbx
mov qword [rbp - 0x80], rbx
mov qword [rbp - 0x78], rbx
mov qword [rbp - 0x70], rbx
mov qword [rbp - 0x68], rbx
mov ecx, 0x10
call fcn.180076898
mov qword [rax + 8], rbx
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x78]
mov qword [rax], rcx
mov word [rbp - 0x58], bx
mov qword [rbp - 0x52], rbx
mov qword [rbp - 0x4a], rbx
xor eax, eax
mov word [rbp - 0x55], ax
mov byte [rbp - 0x53], al
mov word [rbp - 0x52], ax
mov byte [rbp - 0x50], al
mov word [rbp - 0x4f], ax
mov byte [rbp - 0x4d], al
mov word [rbp - 0x4c], ax
mov byte [rbp - 0x4a], al
mov word [rbp - 0x49], ax
mov byte [rbp - 0x47], al
mov word [rbp - 0x46], ax
mov byte [rbp - 0x44], al
mov dword [rbp - 0x5c], ebx
mov dword [rsp + 0x74], ebx
lea rcx, [rsp + 0x70]
call fcn.180029690
test al, al
je 0x180009f59
lea rdx, [rbp + 0x158]
lea rcx, [rsp + 0x70]
call fcn.180029820
mov byte [rbp - 0x58], bl
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x60], rcx
and al, 1
mov byte [rsp + 0x68], al
mov dl, 1
lea rcx, [rsp + 0x60]
call fcn.180015350
lea rcx, [rsp + 0x70]
call fcn.180029920
lea rax, [rsp + 0x70]
mov qword [rbp + 0x168], rax
lea rdx, [rbp + 0x168]
call fcn.180015e10
mov byte [rbp + 0x158], 0
mov r8b, 1
lea rdx, [rbp + 0x158]
lea rcx, [rsp + 0x70]
call fcn.18001b140
mov byte [rbp + 0x158], 0
mov r8b, 1
lea rdx, [rbp + 0x158]
lea rcx, [rsp + 0x70]
call fcn.18001b210
mov byte [rbp + 0x158], 0
mov r8b, 1
lea rdx, [rbp + 0x158]
lea rcx, [rsp + 0x70]
call fcn.18001b3b0
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rbp - 0x40], xmm0
lea rax, [rbp + 0xd0]
mov qword [rbp - 0x30], rax
lea rax, [rbp - 0x10]
mov qword [rbp - 0x28], rax
lea rax, [rbp + 0x60]
mov qword [rbp - 0x20], rax
mov r8b, 1
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x70]
call fcn.18001b480
nop
lea rcx, [rsp + 0x78]
call fcn.1800140a0
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x78], rbx
mov edx, 0x10
call fcn.1800767ac
lea rax, [0x180004010]
add rax, 0x22b
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], 0x22b
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x50]
call fcn.180010070
cmp dword [0x18011ccd8], 0xc2002527
jne 0x18000a11b
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeServerSessionId]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseThreadpoolCleanupGroup]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeResource]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDefaultCommConfigW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTapeStatus]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDllDirectoryW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleHistoryInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleHistoryInfo]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumberEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ApplicationRecoveryFinished]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseThreadpoolCleanupGroupMembers]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GenerateConsoleCtrlEvent]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetComputerNameExW]
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReadFile]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaNodeNumberFromHandle]
mov eax, 1
mov rbx, qword [rsp + 0x250]
add rsp, 0x240
pop rbp
ret
cmp edx, 2
je 0x18000a11b
cmp edx, 3
jne 0x18000a214
cmp dword [0x18011ccd8], 0x809bd01e
jne 0x18000a11b
xor ecx, ecx
call qword [sym.imp.USER32.dll_RegisterClipboardFormatW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_ChangeDisplaySettingsW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_IsZoomed]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseThreadpoolCleanupGroupMembers]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitForThreadpoolTimerCallbacks]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateTapePartition]
xor ebx, ebx
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DrawIconEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenEventW]
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DnsHostnameToComputerNameW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorFromFileW]
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetNumaAvailableMemoryNodeEx]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateWaitableTimerExW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTapeStatus]
jmp 0x18000a11b
test edx, edx
jne 0x18000a11b
mov r10d, 0xd63
mov r9d, 0xffffebf1
nop dword [rax + rax]
inc r10d
mov eax, 0x55555556
imul r10d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r10d, ecx
jne 0x18000a230
nop word [rax + rax]
inc r9d
mov eax, 0x55555556
imul r9d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r9d, ecx
jne 0x18000a250
mov r8d, 0xffffe953
sub r8d, r9d
lea ecx, [r9*2 + 0xd5ec]
lea r11d, [r9 + rcx]
add r10d, r8d
sub ecx, r8d
add r8d, 0x16a7
lea r9d, [rcx + 0x4b6b]
add r10d, 0xffffbe7d
add r11d, 0xc26
sub r8d, r9d
lea ecx, [r8*2 + 0x91ee]
sub ecx, r10d
mov eax, 0xffffe9fd
sub eax, ecx
add r11d, eax
sub r10d, r11d
mov r8d, 0xffffd4ef
lea eax, [rcx*2 + 0x2a14]
lea ecx, [r9 - 0x9783]
sub r11d, eax
test cl, 1
lea ebx, [rcx - 0xe6e]
cmove ebx, ecx
lea r9d, [r10*2 + 0xe5d]
add r9d, r11d
mov eax, 0x55555556
imul r11d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r11d, ecx
je 0x18000a330
nop dword [rax]
nop word [rax + rax]
inc r11d
mov eax, 0x55555556
imul r11d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r11d, ecx
jne 0x18000a310
nop word [rax + rax]
mov r10d, r8d
inc r8d
test r8b, 1
jne 0x18000a330
mov eax, 0x55555556
imul r9d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r9d, ecx
je 0x18000a37a
nop dword [rax]
nop word [rax + rax]
inc r9d
mov eax, 0x55555556
imul r9d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r9d, ecx
jne 0x18000a360
lea edx, [rbx*2 - 0x34e7]
lea ecx, [r9 + r8]
add ecx, edx
lea ebx, [rcx + rdx]
lea edx, [rcx + r11]
lea r9d, [r10*2 - 0x42d7]
mov ecx, 0x314f
sub ecx, r8d
lea r10d, [rbx + 0x27d8]
add r10d, edx
mov eax, r10d
neg eax
lea r8d, [rcx + rax*2]
lea r11d, [rdx + 0x5ac7]
add r11d, ebx
mov eax, 0x55555556
imul r9d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r9d, ecx
je 0x18000a3fa
nop dword [rax]
nop word [rax + rax]
inc r9d
mov eax, 0x55555556
imul r9d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r9d, ecx
jne 0x18000a3e0
lea ecx, [r11 + rbx]
mov eax, 0xffffd946
sub eax, ecx
add r8d, eax
sub r10d, r9d
add r10d, r10d
sub r10d, r8d
mov eax, 0x1c2
sub eax, r10d
add ecx, eax
mov eax, 0xfffffd42
sub eax, r10d
add r8d, eax
test r8b, 1
je 0x18000a439
nop dword [rax]
inc r8d
test r8b, 1
jne 0x18000a430
lea edx, [r9 + 0x4cdd]
lea r11d, [rbx + r9*2]
mov eax, ecx
sub eax, edx
cmp eax, 0xffebc297
jne 0x18000a478
cmp r8d, 0xffd5ddea
jne 0x18000a478
cmp edx, 0xffffb3e6
jne 0x18000a478
cmp r11d, 0xffffb881
jne 0x18000a478
lea eax, [rcx + r10]
cmp eax, 0x602df
je 0x18000a11b
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]