Function at 0x140002290
Capabilities:
Allocate or change rwx memory
Get file size
Read file on windows

Disassembly:
push rbx
push rdi
push r13
sub rsp, 0x270
mov rax, qword [0x14001a0c0]
xor rax, rsp
mov qword [rsp + 0x260], rax
lea rdx, str._syshost.exe
mov rbx, rcx
call fcn.140005490
xor r13d, r13d
test rax, rax
je 0x14000237d
lea rcx, [rsp + 0x52]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x50], r13w
call fcn.1400051e0
lea rcx, [rsp + 0x50]
sub rcx, rbx
mov rdx, rbx
nop dword [rax]
movzx eax, word [rdx]
add rdx, 2
mov word [rcx + rdx - 2], ax
test ax, ax
jne 0x1400022f0
lea rcx, [rsp + 0x50]
mov edx, 0x5c
call fcn.140005464
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x50]
mov word [rax], r13w
xor eax, eax
mov qword [rsp + 0x30], r13
repne scasw ax, word [rdi]
mov rax, qword [str.mfc42.dll]
lea rcx, [rsp + 0x50]
mov qword [rdi - 2], rax
mov rax, qword [0x1400139d0]
xor r9d, r9d
mov qword [rdi + 6], rax
mov eax, dword [0x1400139d8]
xor r8d, r8d
mov dword [rdi + 0xe], eax
movzx eax, word [0x1400139dc]
mov edx, 0x40000000
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], 2
mov word [rdi + 0x12], ax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.Roamingee
mov rcx, rbx
call fcn.140005490
test rax, rax
jne 0x1400025fd
lea rdx, [0x140013990]
mov rcx, rbx
call fcn.140005490
test rax, rax
jne 0x1400025fd
lea rdx, str.AFXDK_S1
mov rcx, rbx
call fcn.140005490
test rax, rax
jne 0x1400025fd
lea rdx, str.putty.exe
mov rcx, rbx
call fcn.140005490
test rax, rax
je 0x1400023e0
xor eax, eax
jmp 0x1400025c9
xor r9d, r9d
mov qword [rsp + 0x298], rbp
mov qword [rsp + 0x30], r13
lea r8d, [r9 + 1]
mov edx, 0x80000000
mov rcx, rbx
mov qword [rsp + 0x2a0], rsi
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x2a8], r12
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400025af
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r8d, 0x3000
mov esi, eax
mov eax, 0x500000
cmp esi, eax
cmova esi, eax
xor ecx, ecx
lea r9d, [rcx + 4]
lea edx, [rsi + 0x400]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea r9, [rsp + 0x40]
mov r8d, esi
mov rcx, rdi
mov rdx, rax
mov qword [rsp + 0x20], r13
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, r13
test esi, esi
je 0x14000259e
mov r12d, 0x5000
movzx edx, byte [rbx + rbp]
movzx eax, byte [rbx + rbp + 2]
lea ecx, [rdx + 4]
cmp eax, ecx
jne 0x14000258c
movzx ecx, byte [rbx + rbp + 4]
lea eax, [rdx + 1]
cmp ecx, eax
jne 0x14000258c
movzx ecx, byte [rbx + rbp + 6]
lea eax, [rdx - 2]
cmp ecx, eax
jne 0x14000258c
movzx ecx, byte [rbx + rbp + 8]
lea eax, [rdx - 3]
cmp ecx, eax
jne 0x14000258c
mov r11d, r12d
cmp r12d, esi
jae 0x14000258c
lea r9, [rbx + rbp + 0x5000]
lea r10d, [r12 + 0xc8]
nop word [rax + rax]
movzx edx, byte [r9]
movzx ecx, byte [r9 + 2]
lea eax, [rdx + 4]
cmp ecx, eax
jne 0x14000257a
movzx eax, byte [r9 + 4]
lea ecx, [rdx + 1]
cmp eax, ecx
jne 0x14000257a
movzx ecx, byte [r9 + 6]
lea eax, [rdx - 2]
cmp ecx, eax
jne 0x14000257a
movzx ecx, byte [r9 + 8]
lea eax, [rdx - 3]
cmp ecx, eax
jne 0x14000257a
mov r8d, r11d
cmp r11d, r10d
jae 0x14000257a
mov rdx, r9
nop
movzx edi, byte [rdx]
movzx ecx, byte [rdx + 2]
lea eax, [rdi - 4]
cmp ecx, eax
jne 0x14000256f
movzx eax, byte [rdx + 4]
lea ecx, [rdi - 1]
cmp eax, ecx
jne 0x14000256f
movzx ecx, byte [rdx + 6]
lea eax, [rdi + 2]
cmp ecx, eax
jne 0x14000256f
movzx ecx, byte [rdx + 8]
lea eax, [rdi + 3]
cmp ecx, eax
je 0x1400025e5
inc r8d
inc rdx
cmp r8d, r10d
jb 0x140002540
inc r11d
inc r10d
inc r9
cmp r11d, esi
jb 0x140002500
inc r13d
inc r12d
inc rbx
cmp r13d, esi
jb 0x140002491
xor edx, edx
mov r8d, 0x8000
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rsi, qword [rsp + 0x2a0]
mov rbp, qword [rsp + 0x298]
mov r12, qword [rsp + 0x2a8]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140004e00
add rsp, 0x270
pop r13
pop rdi
pop rbx
ret
xor edx, edx
mov r8d, 0x8000
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, 1
jmp 0x1400025b1
mov eax, 1
jmp 0x1400025c9