Function at 0x180001024
Capabilities:
Accept command line arguments
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x130
mov rsi, qword [section..data]
mov r13d, edx
imul rbp, rsi, 0xa9
lea edi, [rsi + 0x61]
movzx edx, dil
movzx ebx, dil
add ebx, 0xad
mov ecx, ebx
lea rax, [rdx - 0x14e]
add rax, rcx
cmp r13, rax
jne 0x1800013e4
mov r15d, dword [rsp + 0x178]
cmp ebx, 0x20
jae 0x180001087
mov dil, 0xe
jmp 0x18000115b
cmp ebx, 0x5a
jbe 0x1800013b3
cmp ebx, 0x3e
jae 0x1800010a7
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, ebp
mov edi, eax
or ebx, 0x59
jmp 0x18000115b
cmp ebx, 0x54
je 0x180001428
cmp ebx, 0x3f
jae 0x1800010c6
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcatA]
jmp 0x1800013b3
cmp ebx, 0xc
jb 0x1800013b3
cmp ebx, 0x39
jae 0x1800010e0
xor edx, edx
mov eax, 0x3ac
div rcx
jmp 0x1800010f7
cmp ebx, 0x2b
jb 0x180001424
cmp ebx, 0x32
jne 0x1800010fc
mov edx, esi
mov ecx, ebx
call fcn.1800066b0
mov rbp, rax
jmp 0x18000115b
cmp ebx, 0xb
jne 0x180001111
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_lstrcatA]
imul ebx, esi, 0x2f6
jmp 0x18000115b
cmp ebx, 0xfe
jne 0x180001129
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x188], rax
jmp 0x18000115b
cmp ebx, 0x2f
ja 0x180001138
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
jmp 0x18000115b
cmp ebx, 0x61
jne 0x18000115b
mov r8, rdx
mov qword [rsp + 0x20], rbp
mov rdx, rsi
mov r9, rbp
mov rcx, rsi
call fcn.180004954
movzx edi, al
mov ebx, edi
and ebx, 0x60
mov rcx, qword [rsp + 0x188]
lea rdx, [rsp + 0x178]
mov r14d, ebx
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ecx, 0xe7
movzx edx, dil
sub rcx, r14
add rax, 0x1b60
xor rcx, r14
xor rcx, 0x383
lea r12, [rax + rcx*8]
movsxd rax, dword [rsp + 0x178]
imul rcx, r14, 0xb0
sub rcx, rdx
sub rcx, 0xae4e
cmp rax, rcx
jbe 0x1800013e4
cmp ebx, 0x27
jne 0x1800011cd
mov edx, ebx
mov r8d, esi
mov ecx, edx
call qword [sym.imp.SHELL32.dll_ExtractIconA]
mov dil, al
jmp 0x180001242
cmp ebx, 8
jae 0x1800011eb
mov r9, rdx
mov qword [rsp + 0x20], r14
mov r8d, esi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x1800013b3
cmp ebx, 0x59
jbe 0x180001242
cmp ebx, 0x40
je 0x180001424
cmp ebx, 0x49
je 0x1800013b3
cmp ebx, 0x5c
jne 0x180001215
mov edx, esi
mov ecx, ebx
call fcn.1800066b0
jmp 0x1800013b3
cmp ebx, 0x20
jae 0x180001229
mov edx, ebp
mov rcx, r14
call fcn.1800066b0
mov rsi, rax
jmp 0x180001242
cmp ebx, 0xfe
jne 0x180001242
mov r15d, esi
or r15d, 0x382
add r15d, 0x66ffe00e
mov rcx, rbp
mov r8d, r15d
or rcx, 0x2ba
movabs rax, 0x868c2e1ff7574038
add rax, r12
mov rcx, qword [rax + rcx*8]
cmp word [rcx + r8*2], 0
je 0x180001404
movzx r10d, dil
mov eax, 0x3fd
mov ecx, r10d
xor rcx, 0x25b
or rcx, r14
sub rax, rcx
cmp r8, rax
je 0x180001404
cmp ebx, 0x40
jne 0x1800012a1
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dil, al
jmp 0x18000136d
cmp ebx, 0x52
jae 0x1800012b9
lea rax, [r14 + 0xe2]
mov qword [0x18002f040], rax
jmp 0x18000136d
cmp ebx, 0x59
jbe 0x1800013a6
cmp ebx, 0x2a
jb 0x18000136d
cmp ebx, 0x27
jae 0x1800012e4
mov r8d, ebp
mov edx, ebx
mov rcx, rsi
call fcn.180002e2c
mov esi, eax
jmp 0x18000136d
cmp ebx, 0x45
jne 0x18000130e
mov r9, rbp
mov qword [rsp + 0x20], rbp
mov r8, rbp
mov rdx, rbp
mov rcx, r10
call fcn.180004954
mov rbp, rax
mov rsi, rax
xor rbp, 0xf8
jmp 0x18000136d
cmp ebx, 0xfe
jne 0x180001342
mov rax, qword [r12 + 8]
lea ecx, [rsi + 0xf]
and cl, 0x87
mov dl, byte [rax + r8*2]
movabs rax, 0x9339498066ffe010
add dl, 0x79
add dl, cl
lea rcx, [r8 + rsi]
lea rax, [rsp + rax + 0x30]
mov byte [rax + rcx], dl
jmp 0x18000136d
cmp ebx, 0x4d
jbe 0x1800013b3
cmp ebx, 0x37
jb 0x180001396
cmp ebx, 0x51
jne 0x18000135a
add dil, 0x1f
and dil, bl
jmp 0x18000136d
cmp ebx, 0x21
jbe 0x180001424
cmp ebx, 0x5d
je 0x1800013b3
cmp ebx, 0x4f
jb 0x1800013b3
cmp dil, 0x51
jne 0x18000137b
inc r15d
jmp 0x180001242
cmp dil, 0x1a
jb 0x180001242
cmp dil, 0x41
jbe 0x18000139a
cmp dil, 0x4f
jb 0x1800013b3
jmp 0x180001242
mov edx, ebp
jmp 0x1800013a8
movzx edx, dil
mov rcx, rbp
jmp 0x18000120b
mov edx, ebx
mov r8d, esi
mov rcx, rbp
call fcn.180002e2c
mov rsi, qword [section..data]
imul rbp, rsi, 0xa9
lea eax, [rsi + 0x61]
movzx edi, al
mov edx, edi
lea ebx, [rdi + 0xad]
mov ecx, ebx
lea rax, [rdi - 0x14e]
add rax, rcx
cmp r13, rax
je 0x18000107a
mov eax, 1
mov rbx, qword [rsp + 0x170]
add rsp, 0x130
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor edx, edx
movzx ecx, dil
mov eax, 0x31e
div rcx
lea rcx, [rsp + 0x30]
add edx, 0xffffffbb
add edx, r15d
call fcn.180001434
jmp 0x1800013e4
mov eax, esi
jmp 0x1800013e9
movzx eax, dil
jmp 0x1800013e9