Function at 0x180005e90
Capabilities:
Create mailslot
Get file size
Read file on windows
Read from mailslot

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x2f8]
sub rsp, 0x3c0
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
mov rax, qword [0x18005a098]
xor rax, rsp
mov qword [rbp + 0x290], rax
mov rbx, qword [rbp - 0x78]
lea rdi, [0x180000000]
mov r12, r8
mov qword [rsp + 0x78], r8
lea r8d, [r9 - 0xa]
mov qword [rbp - 0x68], rdx
xor r11d, r11d
mov dword [rsp + 0x64], r9d
mov qword [rbp - 0x60], rcx
mov rsi, rdx
mov dword [rsp + 0x5c], r9d
mov r10d, r9d
mov dword [rsp + 0x54], r8d
mov rdx, rcx
mov qword [rsp + 0x68], rbx
cmp r9d, r8d
jbe 0x1800063de
mov rax, qword [rbp - 0x78]
lea r8d, [r9 - 0xa3]
movsd xmm7, qword [0x180050b28]
movsd xmm6, qword [rbp - 0x48]
movzx r14d, word [rsp + 0x54]
mov r15d, dword [rsp + 0x70]
movzx esi, byte [rsp + 0x54]
mov r12, qword [rbp - 0x40]
mov r13, qword [rbp - 0x50]
mov qword [rbp - 0x58], rax
movzx eax, byte [rsp + 0x54]
mov byte [rsp + 0x51], al
movzx eax, byte [rsp + 0x54]
mov byte [rsp + 0x50], al
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x58], r8d
cmp r8d, 0x22
ja case.default.0x180005f7d
movzx eax, byte [rdi + r8 + 0x6a88]
mov ecx, dword [rdi + rax*4 + 0x6a5c]
add rcx, rdi
jmp rcx
mov rax, qword [rsp + 0x78]
mov qword [rax + 0x28], r11
jmp case.0x180005f7d.10
mov qword [rbp - 0x58], r11
jmp case.0x180005f7d.10
mov rdi, qword [rsp + 0x78]
mov rcx, rdi
cmp qword [rdi + 0x18], 8
jb 0x180005fa8
mov rcx, qword [rdi]
mov qword [rsp + 0x30], r11
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r8d, dword [rsp + 0x58]
xor r11d, r11d
mov r9d, dword [rsp + 0x5c]
mov rbx, rax
mov qword [rsp + 0x68], rax
jmp case.0x180005f7d.10
xorps xmm0, xmm0
mov dword [rbp - 0x38], 0xa
lea rcx, [rbp - 0x28]
movups xmmword [rbp - 0x28], xmm0
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov r8d, dword [rsp + 0x58]
xor r11d, r11d
mov r9d, dword [rsp + 0x5c]
jmp case.0x180005f7d.10
mov rbx, qword [rsp + 0x78]
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r8d, dword [rsp + 0x58]
xor r11d, r11d
mov r9d, dword [rsp + 0x5c]
mov rbx, qword [rsp + 0x68]
mov eax, dword [rsp + 0x54]
movzx edi, byte [rsp + 0x51]
movzx ecx, byte [rsp + 0x50]
dec r9d
dec r8d
mov dword [rsp + 0x5c], r9d
mov dword [rsp + 0x58], r8d
cmp r9d, eax
jbe 0x1800063f7
mov rdx, qword [rbp - 0x60]
lea rdi, [0x180000000]
jmp 0x180005f60
mov rax, qword [rsp + 0x78]
lea r9, [rbp - 0x48]
mov dword [rdx], r11d
xor ecx, ecx
xor edx, edx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r11
lea r8d, [rdx + 0x58]
call fcn.18000a750
test al, al
je case.0x18000678e.0
movsd xmm6, qword [rbp - 0x48]
xor r11d, r11d
mov r8d, dword [rsp + 0x58]
mov r9d, dword [rsp + 0x5c]
jmp case.0x180005f7d.10
mov eax, dword [rsp + 0x54]
mov dil, 1
movzx ecx, dil
mov byte [rsp + 0x51], dil
mov byte [rsp + 0x50], cl
jmp 0x180006044
mov rdi, qword [rsp + 0x78]
movaps xmm0, xmm6
addsd xmm0, qword [rdi + 0x110]
comisd xmm7, xmm0
jbe 0x1800061a2
mov rax, qword [rbp - 0x68]
lea r8, [rbp - 0x80]
add rdi, 0x108
mov ecx, 0x4c
mov rdx, rdi
mov eax, dword [rax]
mov dword [rbp - 0x80], eax
call fcn.180027e20
cmp eax, 0x1388
jb 0x18000616d
mov r13, qword [rbp - 0x60]
mov ebx, 0x91
nop dword [rax]
mov eax, ebx
sub eax, 0x91
je 0x180006124
cmp eax, 1
jne 0x18000615a
mov dword [r13], eax
jmp 0x18000615a
xor eax, eax
xor r8d, r8d
mov qword [rsp + 0x30], rax
xor edx, edx
mov qword [rsp + 0x28], rdi
xor ecx, ecx
mov qword [rsp + 0x20], rax
lea r9d, [rax + 0x51]
call fcn.18000b0e0
mov rcx, qword [rsp + 0x78]
xor r9d, r9d
xor edx, edx
mov r8d, 0xf1
call fcn.18003c580
inc ebx
cmp ebx, 0x93
jb 0x180006110
mov r13, qword [rbp - 0x50]
mov rbx, qword [rsp + 0x68]
mov dword [rsp + 0x30], 0x9a
xor eax, eax
mov qword [rsp + 0x28], rdi
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
xor ecx, ecx
call fcn.18000ade0
mov r8d, dword [rsp + 0x58]
xor r11d, r11d
mov r9d, dword [rsp + 0x5c]
jmp case.0x180005f7d.10
mov qword [rsp + 0x30], r11
lea rbx, [rdi + 0x108]
mov qword [rsp + 0x28], rbx
mov r9d, 0x51
xor r8d, r8d
mov qword [rsp + 0x20], r11
xor edx, edx
xor ecx, ecx
call fcn.18000b0e0
xor r9d, r9d
xor edx, edx
xor ecx, ecx
comisd xmm6, xmm7
jb 0x18000624a
mov rax, qword [rbp - 0x68]
lea r8, [rbp - 0x80]
mov dword [rsp + 0x40], 0x8b
mov eax, dword [rax]
mov dword [rbp - 0x80], eax
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call fcn.18000ab40
cmp eax, 0x1388
jb 0x180006024
lea r8, [rdi + 0x48]
xor edx, edx
mov ecx, 0xdc
call fcn.18000c280
xor eax, eax
mov dword [rsp + 0x30], 0x9a
mov qword [rsp + 0x28], rbx
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
xor ecx, ecx
call fcn.18000ade0
jmp 0x180006024
mov dword [rsp + 0x30], 0x9a
xor eax, eax
mov qword [rsp + 0x28], rbx
xor r8d, r8d
mov qword [rsp + 0x20], rax
call fcn.18000ade0
jmp 0x180006024
cmp rbx, 0xffffffffffffffff
jne 0x180006383
mov edi, 0x97
nop word [rax + rax]
cmp edi, 0x133
ja 0x1800062d3
je 0x1800062c6
mov eax, edi
sub eax, 0x97
je 0x1800062b1
sub eax, 0x34
je 0x1800062a9
cmp eax, 0x34
jne 0x180006365
mov r12, r11
jmp 0x180006365
mov r15d, r11d
jmp 0x180006365
mov sil, 1
mov qword [rbp - 0x50], r11
mov r14d, 0x100
mov r13, r11
jmp 0x180006365
movsx eax, r14w
mov dword [rsp + 0x70], eax
jmp 0x180006365
mov eax, edi
sub eax, 0x167
je 0x180006332
cmp eax, 0x34
jne 0x180006365
test sil, sil
je 0x1800062f5
xor edx, edx
mov ecx, r15d
call qword [sym.imp.GDI32.dll_SetMetaFileBitsEx]
mov byte [rsp + 0x5c], 0
mov eax, dword [rsp + 0x5c]
mov rcx, qword [rbp + 0x290]
xor rcx, rsp
call fcn.1800436f0
lea r11, [rsp + 0x3c0]
mov rbx, qword [r11 + 0x58]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r8, r12
mov edx, r15d
mov rcx, r13
call qword [sym.imp.GDI32.dll_GetMetaFileBitsEx]
lea rdx, [rsp + 0x70]
mov ebx, eax
lea rcx, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
test ebx, ebx
movzx esi, sil
mov r11d, 0
cmove esi, r11d
add edi, 0x34
cmp edi, 0x1cf
jb 0x180006280
mov r8d, dword [rsp + 0x58]
mov r9d, dword [rsp + 0x5c]
mov rbx, qword [rsp + 0x68]
xorps xmm0, xmm0
mov dword [rbp - 0x70], r11d
movups xmmword [rbp - 0x38], xmm0
jmp case.0x180005f7d.10
mov rcx, qword [rbp - 0x68]
mov rax, qword [rsp + 0x78]
cmp dword [rcx], 0
mov eax, dword [rax + 8]
je case.0x180005f7d.10
imul eax, eax
mov rbx, r11
shl eax, 2
movsxd rdi, eax
test eax, eax
jle 0x180006031
mov r13, qword [rsp + 0x78]
mov rcx, qword [r13]
mov rcx, qword [rcx + rbx*8]
call qword [r13 + 0x18]
inc rbx
cmp rbx, rdi
jl 0x1800063c1
mov r13, qword [rbp - 0x50]
jmp 0x180006024
movzx edi, byte [rsp + 0x54]
movzx ecx, byte [rsp + 0x54]
mov r13, qword [rbp - 0x78]
mov byte [rsp + 0x51], dil
mov byte [rsp + 0x50], cl
jmp 0x180006409
mov r12, qword [rsp + 0x78]
mov r13, qword [rbp - 0x58]
mov rsi, qword [rbp - 0x68]
mov r10d, dword [rsp + 0x64]
imul eax, r10d, 0x743
mov edx, r10d
mov dword [rsp + 0x58], edx
mov dword [rsp + 0x70], eax
cmp r10d, eax
ja case.0x18000678e.0
mov r14d, dword [rsp + 0x70]
mov r15, qword [rbp - 0x40]
nop dword [rax]
cmp edx, 0x186ec
ja 0x180006629
je 0x1800065ed
mov eax, edx
sub eax, 0xaf
je 0x18000651f
sub eax, 0x16
je 0x1800066ff
sub eax, 0x7371
je 0x180006a48
sub eax, 0xe9c
je 0x18000650e
cmp eax, 0x820d
jne 0x180006a23
mov rdx, qword [rsi + 0x10]
mov ecx, r14d
cmp rcx, rdx
ja 0x1800064a6
mov qword [rsi + 0x10], rcx
mov rax, rsi
cmp qword [rsi + 0x18], 0x10
jb 0x180006496
mov rax, qword [rsi]
mov byte [rax + rcx], 0
mov dword [rbp - 0x30], 0x64
jmp 0x180006a17
mov r8, qword [rsi + 0x18]
mov rdi, rcx
mov rax, r8
sub rdi, rdx
sub rax, rdx
cmp rdi, rax
ja 0x1800064e2
mov qword [rsi + 0x10], rcx
mov rax, rsi
cmp r8, 0x10
jb 0x1800064cb
mov rax, qword [rsi]
lea rbx, [rax + rdx]
mov r8, rdi
mov rcx, rbx
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov byte [rdi + rbx], 0
jmp 0x1800064f8
mov r9, rdi
mov byte [rsp + 0x20], 0
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call resource.0
movzx edi, byte [rsp + 0x51]
mov r10d, dword [rsp + 0x64]
mov dword [rbp - 0x30], 0x64
jmp 0x180006a17
add word [rbp - 0x1c], 3
mov dword [rbp - 0x34], 0x14
jmp 0x180006a23
lea r9, [r12 + 0x30]
mov qword [r12 + 0x18], 1
xor edx, edx
xor ecx, ecx
mov r8d, 0x10d
call fcn.180013970
xor ecx, ecx
mov esi, ecx
cmp qword [r12 + 0x78], rcx
jbe 0x180006a12
mov edi, ecx
nop dword [rax]
mov ebx, 0xbc
cmp ebx, 0xbc
je 0x1800065a6
cmp ebx, 0xb04
je 0x18000657f
cmp ebx, 0x154c
jne 0x1800065c3
mov rax, qword [r15]
test rax, rax
je 0x180006a50
mov qword [rax + 0x20], rcx
jmp 0x1800065c3
mov rax, qword [r12]
lea rdx, [rbp - 0x48]
xor r9d, r9d
mov qword [rbp - 0x48], rax
mov r8d, 0x125
mov qword [rsp + 0x20], r15
mov rcx, r12
call fcn.180032870
mov qword [r15], rax
jmp 0x1800065c1
mov r15, qword [r12 + 0x70]
xor edx, edx
add r15, rdi
xor ecx, ecx
mov r8d, 0x10d
lea r9, [r15 + 8]
call fcn.180013970
xor ecx, ecx
add ebx, 0xa48
cmp ebx, 0x1ed8
jbe 0x180006555
inc rsi
add rdi, 0x48
cmp rsi, qword [r12 + 0x78]
jb 0x180006550
movzx edi, byte [rsp + 0x51]
jmp 0x180006a12
xor edx, edx
mov rcx, rsi
call fcn.1800038b0
mov rdx, rax
lea r9, [rbp - 0x70]
xor eax, eax
mov r8d, r14d
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r10d, dword [rsp + 0x64]
xor r11d, r11d
mov qword [rbp - 0x78], r11
mov dword [rbp - 0x2c], 0x78
jmp 0x180006a1a
cmp edx, 0x208f9
je 0x180006a09
cmp edx, 0x28b06
je 0x1800069eb
cmp edx, 0x30d13
je 0x180006753
cmp edx, 0x38f20
je 0x180006712
cmp edx, 0x4112d
jne 0x180006a23
mov edi, 0x4a
nop word [rax + rax]
mov eax, edi
sub eax, 0x4a
je 0x180006682
cmp eax, 1
je case.0x18000678e.0
jmp 0x1800066ea
test cl, cl
je 0x1800066e5
mov ebx, 0xae
xor r12d, r12d
nop
mov eax, ebx
sub eax, 0xae
je 0x1800066a9
cmp eax, 0x74
jne 0x1800066d0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800066d0
xor r9d, r9d
mov dword [rsp + 0x28], r12d
lea rdx, [rbp - 0x78]
mov qword [rsp + 0x20], r12
mov rcx, r13
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_SetWaitableTimer]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
add ebx, 0x74
cmp ebx, 0x196
jb 0x180006690
mov r12, qword [rsp + 0x78]
movzx ecx, byte [rsp + 0x50]
mov byte [rsp + 0x5c], 1
inc edi
cmp edi, 0x4c
jb 0x180006670
mov rbx, qword [rsp + 0x68]
movzx edi, byte [rsp + 0x51]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r14d, eax
jmp 0x180006a12
mov rbx, qword [rbp - 0x40]
mov ecx, r11d
test rbx, rbx
movzx eax, dil
cmovne ecx, eax
movzx eax, byte [rsp + 0x50]
movzx edi, cl
mov byte [rsp + 0x51], cl
test r13, r13
mov ecx, r11d
cmovne ecx, eax
mov byte [rsp + 0x50], cl
test dil, dil
je 0x180006a23
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x180006a12
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
mov r13, rax
cmp r14d, dword [rbp - 0x70]
je 0x180006a12
mov ebx, 0x16
cmp ebx, 0x16
ja case.default.0x18000678e
lea rdx, [0x180000000]
mov eax, ebx
mov ecx, dword [rdx + rax*4 + 0x6aac]
add rcx, rdx
jmp rcx
xor r11d, r11d
mov rax, rsi
mov qword [rsi + 0x10], r11
cmp qword [rsi + 0x18], 0x10
jb 0x1800067a4
mov rax, qword [rsi]
mov byte [rax], r11b
jmp 0x1800069cc
mov eax, 0x6c
mov dword [rbp + 0x3a], 0x690061
mov word [rbp + 0x3e], ax
jmp case.default.0x18000678e
mov eax, 0x6c
mov dword [rbp + 0x5c], 0x6e0069
mov word [rbp + 0x5a], ax
jmp case.default.0x18000678e
mov eax, 0x67
mov word [rbp + 0x70], ax
jmp case.default.0x18000678e
mov eax, 0x53
mov dword [rbp + 0x78], 0x6b0063
mov word [rbp + 0x7c], ax
jmp case.default.0x18000678e
mov eax, 0x61
mov dword [rbp + 0x72], 0x420065
mov word [rbp + 0x76], ax
jmp case.default.0x18000678e
mov dword [rbp + 0x32], 0x2e005c
mov dword [rbp + 0x36], 0x6d005c
jmp case.default.0x18000678e
xorps xmm0, xmm0
mov byte [rsp + 0x60], 1
xor eax, eax
mov byte [rsp + 0x54], 1
movups xmmword [rbp - 0x18], xmm0
mov qword [rbp - 8], rax
jmp case.default.0x18000678e
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp], xmm0
mov dword [rbp + 0x20], eax
movups xmmword [rbp + 0x10], xmm0
jmp case.default.0x18000678e
mov dword [rbp + 0x7e], 0x6f0074
mov dword [rbp + 0x82], 0x70
jmp case.default.0x18000678e
mov eax, 0x69
mov dword [rbp + 0x54], 0x66006f
mov word [rbp + 0x58], ax
jmp case.default.0x18000678e
mov eax, 0x5c
mov word [rbp + 0x30], ax
jmp case.default.0x18000678e
mov eax, 0x6e
mov dword [rbp + 0x4e], 0x500064
mov word [rbp + 0x4c], ax
mov eax, 0x72
mov word [rbp + 0x52], ax
jmp case.default.0x18000678e
movzx eax, byte [rsp + 0x54]
xor r11d, r11d
cmp qword [rbp - 0x58], 0xffffffffffffffff
mov ecx, r11d
cmovne ecx, eax
mov byte [rsp + 0x54], cl
jmp 0x1800069cc
cmp byte [rsp + 0x60], 0
je 0x1800068d6
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, 0x7f
call qword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov byte [rsp + 0x5c], 0
jmp case.default.0x18000678e
mov eax, 0x61
mov dword [rbp + 0x60], 0x540067
mov word [rbp + 0x64], ax
mov dword [rbp + 0x66], 0x6c0069
jmp case.default.0x18000678e
mov dword [rbp + 0x44], 0x74006f
mov dword [rbp + 0x48], 0x45005c
jmp case.default.0x18000678e
movzx eax, byte [rsp + 0x60]
xor r11d, r11d
mov ecx, r11d
cmp qword [rbp - 0x60], rcx
cmovne ecx, eax
mov byte [rsp + 0x60], cl
cmp byte [rsp + 0x54], r11b
je 0x1800069cc
mov rdi, qword [rbp - 0x58]
lea r9, [rbp - 0x80]
mov rcx, rdi
mov qword [rsp + 0x20], r11
lea r8, [rbp - 0x50]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
test eax, eax
je 0x180006966
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.default.0x18000678e
mov eax, 0x73
mov word [rbp + 0x40], ax
jmp case.default.0x18000678e
mov eax, 0x6c
mov word [rbp + 0x42], ax
jmp case.default.0x18000678e
mov eax, 0x4d
mov dword [rbp + 0x6c], 0x720065
mov word [rbp + 0x6a], ax
jmp case.default.0x18000678e
xor r9d, r9d
lea rcx, [rbp + 0x30]
xor edx, edx
mov r8d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_CreateMailslotW]
lea r8, [rbp]
mov edx, 0x24
lea rcx, [rbp - 0x18]
mov qword [rbp - 0x58], rax
call qword [sym.imp.GDI32.dll_ExtCreateRegion]
mov qword [rbp - 0x60], rax
xor r11d, r11d
dec ebx
lea eax, [rbx + 0xee]
cmp eax, 0xed
ja 0x180006772
mov r10d, dword [rsp + 0x64]
movzx edi, byte [rsp + 0x51]
jmp 0x180006a1a
lea rdx, [rbp - 0x78]
lea rcx, [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea rcx, [rbp - 0x38]
call qword [sym.imp.GDI32.dll_CreateEllipticRgnIndirect]
mov qword [rbp - 0x40], rax
jmp 0x180006a12
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r10d, dword [rsp + 0x64]
xor r11d, r11d
mov edx, dword [rsp + 0x58]
movzx ecx, byte [rsp + 0x50]
imul eax, r10d, 0xa9
add edx, eax
mov dword [rsp + 0x58], edx
cmp edx, dword [rsp + 0x70]
ja case.0x18000678e.0
mov rsi, qword [rbp - 0x68]
mov rbx, qword [rsp + 0x68]
jmp 0x180006430
mov eax, r11d
jmp 0x1800062fe
mov eax, 2
jmp 0x1800062fe