Function at 0x1800035a0
Capabilities:
Create pipe
Get file size
Query environment variable
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], r8
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xd0
lea ebx, [rcx + 0x67c]
mov r14d, ecx
mov dword [rbp + 0x7f], ebx
mov r13d, ecx
cmp ecx, ebx
mov r10, r8
mov rcx, qword [rbp + 0x7f]
mov rdi, rdx
mov qword [rbp - 0x69], rcx
jae 0x1800039f7
mov eax, dword [rbp + 0x67]
mov edx, 0xf3ff
mov r14d, dword [rbp + 0x67]
movzx r15d, byte [rbp + 0x67]
mov r12, qword [rbp + 0x7f]
mov dword [rbp - 0x61], eax
cmp r13d, 0x166
ja 0x1800037fa
je 0x1800036a3
mov eax, r13d
sub eax, 0x1d
je 0x180003910
sub eax, 0x3c
je 0x180003697
sub eax, 0x67
je 0x18000364a
cmp eax, 0x3f
jne 0x18000383b
mov edx, dword [rdi + 8]
shr edx, 3
and edx, 1
mov dword [rbp - 0x61], edx
mov edx, 0xf3ff
jmp 0x18000383b
cmp qword [rdi + 0x18], 8
mov rcx, rdi
jb 0x180003657
mov rcx, qword [rdi]
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r10, qword [rbp + 0x77]
mov edx, 0xf3ff
mov rcx, rax
mov qword [rbp - 0x69], rax
jmp 0x18000383b
mov dword [rbp - 0x61], 0
jmp 0x18000383b
cmp rcx, 0xffffffffffffffff
jne 0x18000383b
mov esi, 0x113
cmp esi, 0x14357
ja 0x180003731
je 0x180003720
cmp esi, 0x113
je 0x18000370f
cmp esi, 0x6c7f
je 0x1800036ef
cmp esi, 0xd7eb
jne 0x1800037d6
test r12, r12
je 0x1800037d6
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1800037d6
lea r9, [rbp - 0x51]
mov qword [rbp - 0x51], 0
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call sub.RPCRT4.dll_MesEncodeIncrementalHandleCreate
mov r14d, eax
jmp 0x1800037d6
mov r15b, 1
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov r12, rax
jmp 0x1800037d6
test r14d, r14d
je 0x1800037d6
xor r15b, r15b
jmp 0x1800037d6
cmp esi, 0x1aec3
je 0x180003772
cmp esi, 0x21a2f
jne 0x1800037d6
nop word [rax + rax]
mov byte [rbp + 0x7f], 0
mov eax, dword [rbp + 0x7f]
mov rbx, qword [rsp + 0x118]
add rsp, 0xd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
test r15b, r15b
je 0x1800037d6
mov ebx, 0xc5
nop dword [rax]
mov eax, ebx
sub eax, 0xc5
je 0x1800037b3
sub eax, 0x16
je 0x1800037a3
cmp eax, 0x16
jne 0x1800037cb
mov rcx, qword [rbp - 0x59]
test rcx, rcx
je 0x1800037cb
call sub.RPCRT4.dll_MesHandleFree
jmp 0x1800037cb
mov rcx, qword [rbp - 0x51]
test rcx, rcx
je 0x1800037cb
call sub.RPCRT4.dll_MesHandleFree
jmp 0x1800037cb
lea r8, [rbp - 0x59]
mov qword [rbp - 0x59], 0
xor edx, edx
xor ecx, ecx
call sub.RPCRT4.dll_MesDecodeIncrementalHandleCreate
mov r14d, eax
add ebx, 0x16
cmp ebx, 0x107
jb 0x180003780
add esi, 0x6b6c
cmp esi, 0x28488
jbe 0x1800036b2
mov ebx, dword [rbp + 0x7f]
mov edx, 0xf3ff
mov r10, qword [rbp + 0x77]
mov rcx, qword [rbp - 0x69]
jmp 0x18000383b
mov eax, r13d
sub eax, 0x1df
je 0x180003830
sub eax, 0x2d
je 0x180003827
cmp eax, 0x79
jne 0x18000383b
movzx eax, word [rdi + 0x18]
movzx ecx, word [r10]
shl cx, 8
or cx, ax
mov word [rdi + 0x18], cx
mov rcx, qword [rbp - 0x69]
jmp 0x18000383b
mov dword [rbp - 0x5d], 0
jmp 0x18000383b
movzx eax, word [rdi + 0x18]
and ax, dx
mov word [rdi + 0x18], ax
add r13d, 0xa6
cmp r13d, ebx
jb 0x180003602
mov r14d, dword [rbp + 0x67]
imul eax, r14d, 0x55f
mov esi, r14d
mov dword [rbp - 0x51], eax
cmp r14d, eax
ja case.0x180003b63.9
mov r14d, dword [rbp + 0x67]
lea rdx, [0x180000000]
mov r13d, dword [rbp + 0x67]
mov r12d, dword [rbp + 0x67]
movzx r15d, byte [rbp + 0x67]
nop dword [rax]
cmp esi, 0x177c0
ja 0x180003ad6
je 0x180003ac4
mov eax, esi
sub eax, 0x59
je 0x180003c63
sub eax, 0x67
je 0x180003aae
sub eax, 0x5dc0
je 0x180003a97
sub eax, 0x5dc0
je 0x180003a02
cmp eax, 0x5dc0
jne 0x180003c4b
xor edx, edx
mov qword [rbp - 0x39], 0
mov rcx, r10
call fcn.180003530
mov rcx, qword [rbp - 0x69]
lea r9, [rbp - 0x5d]
mov rdx, rax
mov qword [rsp + 0x20], 0
mov r8d, r14d
call qword [sym.imp.KERNEL32.dll_ReadFile]
lea rdx, [0x180000000]
jmp 0x180003c47
mov ebx, 0x6e
mov eax, ebx
sub eax, 0x6a
je 0x1800039dc
sub eax, 1
je 0x1800039cf
sub eax, 1
je 0x18000398c
sub eax, 1
je 0x180003954
cmp eax, 1
jne 0x1800039e7
mov rcx, qword [rdi + 0x18]
lea rdx, [rdi + 0x58]
call qword [rdi + ILRemoveLastID]
test al, al
je 0x180003750
jmp 0x1800039e7
cmp qword [rdi + 0x70], 0x10
lea r8, [rdi + 0x58]
jb 0x180003962
mov r8, qword [r8]
movzx eax, word [rdi + 0x78]
lea r9, [rbp + 0x67]
mov rdx, qword [0x180094fa8]
mov ecx, 0xb0
mov word [rbp + 0x67], ax
call fcn.180036430
test al, al
je 0x1800039e7
mov byte [rbp + 0x7f], 1
jmp case.0x180003b63.9
mov r8, qword [0x180094fa8]
mov r9d, 0x130
xor edx, edx
xor ecx, ecx
call fcn.18005f6b0
test al, al
jne 0x1800039e7
mov ecx, 0x38
nop dword [rax + rax]
mov eax, ecx
sub eax, 0x38
je 0x1800039c2
cmp eax, 1
je case.0x180003b63.9
jmp 0x1800039c6
mov byte [rbp + 0x7f], 0
inc ecx
cmp ecx, 0x3a
jb 0x1800039b0
jmp 0x1800039e7
mov rcx, qword [rdi + 0x38]
lea rdx, [rdi + 0x58]
call qword [rdi + 0x30]
jmp 0x1800039e7
mov ecx, 0x7530
call qword [sym.imp.KERNEL32.dll_Sleep]
dec ebx
cmp ebx, 0x69
ja 0x180003915
jmp 0x180003910
mov edx, dword [rbp + 0x67]
mov dword [rbp - 0x61], edx
jmp 0x18000384f
mov rdx, qword [r10 + 0x10]
mov ecx, r14d
cmp rcx, rdx
ja 0x180003a2f
mov qword [r10 + 0x10], rcx
mov rax, r10
cmp qword [r10 + 0x18], 0x10
jb 0x180003a1f
mov rax, qword [r10]
mov byte [rax + rcx], 0
lea rdx, [0x180000000]
jmp 0x180003c47
mov r8, qword [r10 + 0x18]
mov rdi, rcx
mov rax, r8
sub rdi, rdx
sub rax, rdx
cmp rdi, rax
ja 0x180003a75
mov qword [r10 + 0x10], rcx
mov rax, r10
cmp r8, 0x10
jb 0x180003a54
mov rax, qword [r10]
lea rbx, [rax + rdx]
mov r8, rdi
mov rcx, rbx
xor edx, edx
call fcn.180063be0
lea rdx, [0x180000000]
mov byte [rbx + rdi], 0
jmp 0x180003c47
mov r9, rdi
mov byte [rsp + 0x20], 0
xor r8d, r8d
mov rdx, rdi
mov rcx, r10
call fcn.180002040
lea rdx, [0x180000000]
jmp 0x180003c47
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r14d, eax
lea rdx, [0x180000000]
jmp 0x180003c47
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 9], xmm0
mov qword [rbp + 0x17], rax
movups xmmword [rbp + 7], xmm0
jmp 0x180003c4b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [0x180000000]
jmp 0x180003c47
cmp esi, 0x1d580
je 0x180003b40
cmp esi, 0x23340
je 0x180003b2e
cmp esi, 0x29100
je 0x180003b10
cmp esi, 0x2eec0
je 0x180003b07
cmp esi, 0x34c80
je case.0x180003b63.9
jmp 0x180003c4b
mov byte [rbp + 0x7f], 1
jmp 0x180003c4b
lea r8, [rbp - 0x41]
lea rdx, [rbp - 0x39]
lea rcx, [rbp - 9]
call qword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorGroup]
lea rdx, [0x180000000]
jmp 0x180003c47
call qword [sym.imp.dbghelp.dll_ImagehlpApiVersion]
lea rdx, [0x180000000]
jmp 0x180003c47
cmp r14d, dword [rbp - 0x5d]
je 0x180003c4b
xor ebx, ebx
nop dword [rax]
cmp ebx, 9
ja case.default.0x180003b63
mov ecx, dword [rdx + rbx*4 + 0x3c6c]
add rcx, rdx
jmp rcx
mov r9d, dword [rbp - 0x49]
lea rax, [rbp - 0x19]
mov r8d, dword [rbp - 0x59]
mov edx, dword [rbp - 0x45]
mov rcx, qword [rbp - 0x31]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r13d
call qword [sym.imp.SHELL32.dll_SHChangeNotifyRegister]
mov rcx, qword [rbp - 0x21]
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.default.0x180003b63
mov qword [r10 + 0x10], 0
mov rax, r10
cmp qword [r10 + 0x18], 0x10
jb 0x180003baf
mov rax, qword [r10]
mov byte [rax], 0
mov r13d, 1
jmp case.default.0x180003b63
mov dword [rbp - 0x49], 0
jmp case.default.0x180003b63
xor ecx, ecx
movzx eax, r15b
test r12d, r12d
cmovne ecx, eax
movzx r15d, cl
test cl, cl
je case.default.0x180003b63
mov ecx, r12d
call qword [sym.imp.SHELL32.dll_SHChangeNotifyDeregister]
jmp case.default.0x180003b63
mov r15b, 1
mov qword [rbp - 0x31], 0
jmp case.default.0x180003b63
mov dword [rbp - 0x45], 1
mov dword [rbp - 0x59], 0x2381f
jmp case.default.0x180003b63
mov rcx, qword [rbp - 0x29]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [rbp + 0x7f], 0
jmp case.default.0x180003b63
xor r9d, r9d
lea rdx, [rbp - 0x29]
xor r8d, r8d
lea rcx, [rbp - 0x21]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
jmp case.default.0x180003b63
xor eax, eax
mov qword [rbp - 0x19], rax
mov dword [rbp - 0x11], eax
mov r10, qword [rbp + 0x77]
lea rdx, [0x180000000]
inc ebx
lea eax, [rbx + 0x2e]
cmp eax, 0x38
jb 0x180003b50
mov rcx, qword [rbp - 0x69]
imul eax, dword [rbp + 0x67], 0x7d
add esi, eax
cmp esi, dword [rbp - 0x51]
ja case.0x180003b63.9
mov r10, qword [rbp + 0x77]
jmp 0x180003880
mov eax, dword [rbp - 0x61]
jmp 0x180003757