Function at 0x1400020e0
Capabilities:
Allocate or change rwx memory
Get file size
Read file on windows

Disassembly:
push rbx
push rdi
push r13
sub rsp, 0x270
mov rax, qword [0x1400731f0]
xor rax, rsp
mov qword [rsp + 0x260], rax
lea rdx, str._syshost.exe
mov rbx, rcx
call fcn.14000b480
xor r13d, r13d
test rax, rax
je 0x1400021cd
lea rcx, [rsp + 0x52]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x50], r13w
call fcn.14000cb60
lea rcx, [rsp + 0x50]
sub rcx, rbx
mov rdx, rbx
nop dword [rax]
movzx eax, word [rdx]
add rdx, 2
mov word [rcx + rdx - 2], ax
test ax, ax
jne 0x140002140
lea rcx, [rsp + 0x50]
mov edx, 0x5c
call fcn.14000b400
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x50]
mov word [rax], r13w
xor eax, eax
mov qword [rsp + 0x30], r13
repne scasw ax, word [rdi]
mov rax, qword [str.mfc42.dll]
lea rcx, [rsp + 0x50]
mov qword [rdi - 2], rax
mov rax, qword [0x14005fca8]
xor r9d, r9d
mov qword [rdi + 6], rax
mov eax, dword [0x14005fcb0]
xor r8d, r8d
mov dword [rdi + 0xe], eax
movzx eax, word [0x14005fcb4]
mov edx, 0x40000000
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], 2
mov word [rdi + 0x12], ax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.Roamingee
mov rcx, rbx
call fcn.14000b480
test rax, rax
jne 0x14000244d
lea rdx, [0x14005fc68]
mov rcx, rbx
call fcn.14000b480
test rax, rax
jne 0x14000244d
lea rdx, str.AFXDK_S1
mov rcx, rbx
call fcn.14000b480
test rax, rax
jne 0x14000244d
lea rdx, str.putty.exe
mov rcx, rbx
call fcn.14000b480
test rax, rax
je 0x140002230
xor eax, eax
jmp 0x140002419
xor r9d, r9d
mov qword [rsp + 0x298], rbp
mov qword [rsp + 0x30], r13
lea r8d, [r9 + 1]
mov edx, 0x80000000
mov rcx, rbx
mov qword [rsp + 0x2a0], rsi
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x2a8], r12
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400023ff
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r8d, 0x3000
mov esi, eax
mov eax, 0x500000
cmp esi, eax
cmova esi, eax
xor ecx, ecx
lea r9d, [rcx + 4]
lea edx, [rsi + 0x400]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea r9, [rsp + 0x40]
mov r8d, esi
mov rcx, rdi
mov rdx, rax
mov qword [rsp + 0x20], r13
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, r13
test esi, esi
je 0x1400023ee
mov r12d, 0x5000
movzx edx, byte [rbx + rbp]
movzx eax, byte [rbx + rbp + 2]
lea ecx, [rdx + 4]
cmp eax, ecx
jne 0x1400023dc
movzx ecx, byte [rbx + rbp + 4]
lea eax, [rdx + 1]
cmp ecx, eax
jne 0x1400023dc
movzx ecx, byte [rbx + rbp + 6]
lea eax, [rdx - 2]
cmp ecx, eax
jne 0x1400023dc
movzx ecx, byte [rbx + rbp + 8]
lea eax, [rdx - 3]
cmp ecx, eax
jne 0x1400023dc
mov r11d, r12d
cmp r12d, esi
jae 0x1400023dc
lea r9, [rbx + rbp + 0x5000]
lea r10d, [r12 + 0xc8]
nop word [rax + rax]
movzx edx, byte [r9]
movzx ecx, byte [r9 + 2]
lea eax, [rdx + 4]
cmp ecx, eax
jne 0x1400023ca
movzx eax, byte [r9 + 4]
lea ecx, [rdx + 1]
cmp eax, ecx
jne 0x1400023ca
movzx ecx, byte [r9 + 6]
lea eax, [rdx - 2]
cmp ecx, eax
jne 0x1400023ca
movzx ecx, byte [r9 + 8]
lea eax, [rdx - 3]
cmp ecx, eax
jne 0x1400023ca
mov r8d, r11d
cmp r11d, r10d
jae 0x1400023ca
mov rdx, r9
nop
movzx edi, byte [rdx]
movzx ecx, byte [rdx + 2]
lea eax, [rdi - 4]
cmp ecx, eax
jne 0x1400023bf
movzx eax, byte [rdx + 4]
lea ecx, [rdi - 1]
cmp eax, ecx
jne 0x1400023bf
movzx ecx, byte [rdx + 6]
lea eax, [rdi + 2]
cmp ecx, eax
jne 0x1400023bf
movzx ecx, byte [rdx + 8]
lea eax, [rdi + 3]
cmp ecx, eax
je 0x140002435
inc r8d
inc rdx
cmp r8d, r10d
jb 0x140002390
inc r11d
inc r10d
inc r9
cmp r11d, esi
jb 0x140002350
inc r13d
inc r12d
inc rbx
cmp r13d, esi
jb 0x1400022e1
xor edx, edx
mov r8d, 0x8000
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rsi, qword [rsp + 0x2a0]
mov rbp, qword [rsp + 0x298]
mov r12, qword [rsp + 0x2a8]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.14000cad0
add rsp, 0x270
pop r13
pop rdi
pop rbx
ret
xor edx, edx
mov r8d, 0x8000
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, 1
jmp 0x140002401
mov eax, 1
jmp 0x140002419