Function at 0x85b3d0
Capabilities:
Check os version
Read file on windows
Resolve function by parsing pe exports
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x198
mov esi, dword [rcx + 0x18]
mov rbx, rcx
mov r13d, edx
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov edx, 0x400
movzx eax, al
cmp eax, 5
mov eax, 0x1000
cmovle eax, edx
cmp qword [0x00a2f798], 0
mov dword [rbx + 0xec], eax
je 0x85b7d0
mov r15d, 2
xor edi, edi
lea r12, [rsp + 0x40]
lea r14, [rsp + 0x3c]
lea rbp, [rsp + 0xf0]
mov qword [r12], 0
mov rcx, qword [rbx]
mov r9, r14
mov r8d, 0x98
mov qword [r12 + 8], 0
mov rdx, rbp
mov qword [r12 + 0x10], 0
mov qword [r12 + 0x18], 0
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x85b660
mov eax, dword [rsp + 0x3c]
cmp eax, 0xffffffff
je 0x85b7a0
cmp eax, 0x98
jne 0x85b7b1
test byte [rsp + 0xfa], 8
je 0x85b890
cmp dword [rsp + 0x100], 0xbeefc0de
jne 0x85b890
cmp dword [rsp + 0x104], 1
jne 0x85b8b0
test edi, edi
je 0x85b4f0
mov rdx, qword [rsp + 0x180]
mov rax, qword [rsp + 0xe0]
test r13d, r13d
je 0x85b718
cmp rdx, rax
jae 0x85b582
nop word [rax + rax]
movdqu xmm0, xmmword [rsp + 0x100]
movdqu xmm1, xmmword [rsp + 0x110]
mov rax, qword [rsp + 0x180]
movdqu xmm2, xmmword [rsp + 0x120]
movdqu xmm3, xmmword [rsp + 0x130]
movups xmmword [rsp + 0x60], xmm0
movdqu xmm4, xmmword [rsp + 0x140]
movdqu xmm5, xmmword [rsp + 0x150]
movups xmmword [rsp + 0x70], xmm1
movdqu xmm0, xmmword [rsp + 0x160]
movdqu xmm1, xmmword [rsp + 0x170]
mov qword [rsp + 0xe0], rax
movups xmmword [rsp + 0x80], xmm2
movups xmmword [rsp + 0x90], xmm3
movups xmmword [rsp + 0xa0], xmm4
movups xmmword [rsp + 0xb0], xmm5
movups xmmword [rsp + 0xc0], xmm0
movups xmmword [rsp + 0xd0], xmm1
mov eax, dword [rsp + 0x78]
add edi, eax
cmp r15d, 1
jne 0x85b650
mov rdi, qword [rsp + 0xd8]
mov rdx, qword [rbx + 0x78]
mov dword [rbx + 0x1c], eax
xor r8d, r8d
lea rcx, [rdi + 1]
test rdx, rdx
jne 0x85b5b6
mov rdx, qword [rsp + 0x70]
mov qword [rbx + 0x78], rdx
imul rax, rcx
cmp rax, rdx
jbe 0x85b5c6
mov qword [rbx + 0x78], rax
mov rdx, rax
mov qword [rsp + 0x70], rdx
and esi, 1
test r8d, r8d
jne 0x85b730
test esi, esi
jne 0x85b848
xor edx, edx
mov rcx, rbx
call fcn.0085b270
test eax, eax
jne 0x85b636
mov ecx, dword [rbx + 0x1c]
lea eax, [rcx - 0x10]
mov edx, eax
shr eax, 1
and eax, 0xfffffffe
shr edx, 3
sub eax, 2
sub edx, 1
mov dword [rbx + 0xe4], eax
mov rax, qword [rbx + 0x78]
mov dword [rbx + 0xe0], edx
xor edx, edx
div rcx
mov qword [rbx + 0x88], rax
mov rax, qword [rbx + 0x48]
test rax, rax
je 0x85b636
mov rdx, qword [rsp + 0xe0]
mov qword [rax + 8], rdx
xor eax, eax
add rsp, 0x198
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov r15d, 1
jmp 0x85b433
mov r13, qword [sym.imp.KERNEL32.dll_GetLastError]
call r13
cmp eax, 0x26
je 0x85b888
call r13
test eax, eax
je 0x85b8ba
cmp eax, 2
jne 0x85b636
mov eax, dword [rbx + 0x20]
lea r8, [rsp + 0x68]
mov edx, 0x8000
mov ecx, 0x10
mov rdi, r8
mov r8d, 1
cmp eax, 0x8000
cmovbe edx, eax
xor eax, eax
rep stosq qword [rdi], rax
mov ecx, 2
movabs rax, 0x1beefc0de
mov qword [rsp + 0xd8], 1
mov dword [rbx + 0x1c], edx
mov qword [rsp + 0x60], rax
mov eax, edx
movzx edx, word [rbx + 0x18]
mov dword [rsp + 0x78], eax
mov qword [rsp + 0xa0], 0xffffffffffffffff
or edx, 8
mov word [rsp + 0x7c], dx
mov rdx, qword [rbx + 0x78]
mov qword [rsp + 0xd0], 0xffffffffffffffff
mov qword [rsp + 0x70], 0x100000
test rdx, rdx
jne 0x85b5b6
jmp 0x85b5ad
cmp rdx, rax
jbe 0x85b582
jmp 0x85b4f0
test esi, esi
je 0x85b868
mov byte [rsp + 0x40], 0
mov rcx, qword [rbx]
mov r9, rbp
mov rdx, r12
mov qword [rsp + 0x20], 0
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x85b8a0
mov rdx, qword [rsp + 0x68]
mov rcx, rbx
call fcn.0085b270
test eax, eax
jne 0x85b636
mov rax, qword [rbx + 0x40]
lea rdx, [rsp + 0x60]
mov rcx, rbx
mov qword [rsp + 0x68], rax
call fcn.0085b000
test eax, eax
je 0x85b5ed
jmp 0x85b636
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x26
setne al
movzx eax, al
neg eax
or edi, eax
je 0x85b683
test eax, eax
jns 0x85b890
mov r13, qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x85b673
lea rcx, str.NTDLL.DLL
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r12, rax
test rax, rax
je 0x85b838
mov rdi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtClose
mov rcx, rax
call rdi
mov qword [0x00a2f788], rax
test rax, rax
je 0x85b838
lea rdx, str.NtMapViewOfSection
mov rcx, r12
call rdi
mov qword [0x00a2f790], rax
test rax, rax
je 0x85b838
lea rdx, str.NtCreateSection
mov rcx, r12
call rdi
mov qword [0x00a2f798], rax
test rax, rax
jne 0x85b419
mov eax, 0xffff87b5
jmp 0x85b636
mov rdx, qword [rsp + 0x68]
mov rcx, rbx
call fcn.0085b270
test eax, eax
jne 0x85b636
jmp 0x85b5ed
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.0085b000
test eax, eax
je 0x85b5df
jmp 0x85b636
test edi, edi
je 0x85b683
mov eax, 0xffff87b7
jmp 0x85b636
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x85b636
mov eax, 0xffff87b6
jmp 0x85b636
mov eax, dword [rsp + 0x78]
jmp 0x85b592