Function at 0x180002bf3
Capabilities:
Terminate process

Disassembly:
jmp 0x180012aa0
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]

Function at 0x180002d5b
Capabilities:
Parse pe header

Disassembly:
jmp 0x180055c24
xor r8d, r8d
lea edx, [r8 + 2]
jmp 0x180055970

Function at 0x1800031de
Capabilities:
Clear file content

Disassembly:
jmp 0x1800817f4
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.180001848
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.180001848
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x180081944
cmp rax, 0xffffffffffffffff
je 0x180081944
xor edi, edi
test rbp, rbp
jle 0x1800818ef
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.180003d32
mov rbx, rax
test rax, rax
jne 0x18008187c
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x1800818e5
mov edx, 0x8000
mov ecx, r14d
call fcn.18000338c
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.180003a1c
cmp eax, 0xffffffff
je 0x1800818c5
cdqe
sub rbp, rax
test rbp, rbp
jg 0x18008188c
mov edx, r15d
mov ecx, r14d
call fcn.18000338c
jmp 0x1800818e5
cmp byte [rsi + 0x38], dil
je 0x1800818dc
cmp dword [rsi + 0x34], 5
jne 0x1800818dc
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x1800818e5
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.18000117c
jmp 0x180081958
jns 0x180081958
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.180001848
cmp rax, 0xffffffffffffffff
jne 0x180081910
cmp byte [rsi + 0x30], dil
je 0x180081958
mov edi, dword [rsi + 0x2c]
jmp 0x180081958
mov ecx, r14d
call fcn.1800043f9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x180081958
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x180081958
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x180081951
mov eax, dword [rsi + 0x2c]
jmp 0x180081956
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.180001848
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x180003715
Capabilities:
Terminate process

Disassembly:
jmp 0x18005bbd8
sub rsp, 0x28
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x18005bbf2
mov ecx, 5
int 0x29
mov r8d, 1
mov edx, 0xc0000417
lea ecx, [r8 + 1]
call fcn.180003ea9
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000417
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]