Function at 0x140024b64
Capabilities:
Get file size
Read file on windows
Read from mailslot

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x198]
sub rsp, 0x260
mov qword [rbp - 0x58], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x1401a2e90]
xor rax, rsp
mov qword [rbp + 0x150], rax
mov r15, rdx
mov rsi, rcx
mov qword [rbp - 0x50], rcx
xor r12d, r12d
mov dword [rsp + 0x40], r12d
lea rcx, [0x1401a29a8]
mov rax, qword [0x1401a29a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsi], rax
lea edi, [r12 + 1]
mov dword [rsp + 0x40], edi
mov eax, dword [0x1401aad80]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
cmp ecx, 4
jne 0x140024c06
lea ecx, [rdi + 3]
call fcn.1400be0e0
mov ecx, dword [0x1401aad80]
mov dword [rax], ecx
mov rax, qword [r15]
mov ebx, 2
lea r13d, [rbx + 1]
cmp dword [rax - 0x10], r12d
je 0x140024c86
movzx eax, word [rax]
cmp ax, word [0x1401384c8]
jne 0x140024c29
mov eax, r12d
jmp 0x140024c2d
sbb eax, eax
or eax, edi
test eax, eax
je 0x140024c86
lea rcx, [rbp - 0x70]
call fcn.14002386c
nop
mov edi, r13d
mov dword [rsp + 0x40], r13d
mov rcx, qword [rax]
mov eax, r12d
test rcx, rcx
setne al
test eax, eax
jne 0x140024c5e
mov ecx, 0x80004005
call fcn.140001874
int3
mov rax, qword [r15]
sub rcx, rax
movzx edx, word [rax]
cmp dx, word [rax + rcx]
jne 0x140024c7a
add rax, rbx
test dx, dx
jne 0x140024c64
mov eax, r12d
jmp 0x140024c7f
sbb eax, eax
or eax, 1
test eax, eax
mov r14b, r12b
jne 0x140024c89
mov r14b, 1
test bl, dil
je 0x140024cb9
and edi, 0xfffffffd
mov dword [rsp + 0x40], edi
mov rdx, qword [rbp - 0x70]
add rdx, 0xffffffffffffffe8
or rdi, 0xffffffffffffffff
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x140024cbd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x140024cbd
or rdi, 0xffffffffffffffff
test r14b, r14b
je 0x140024cff
lea rcx, [rbp - 0x68]
call fcn.14002386c
nop
mov rdx, rax
mov rcx, rsi
call fcn.140002038
nop
mov rdx, qword [rbp - 0x68]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x140025156
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x140025156
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov rcx, qword [r15]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r13, rax
cmp rax, rdi
jne 0x140024d48
lea rcx, [rsp + 0x78]
call fcn.14002386c
nop
mov rdx, rax
mov rcx, rsi
call fcn.140002038
nop
mov rdx, qword [rsp + 0x78]
jmp 0x140024cdc
xor eax, eax
mov qword [rsp + 0x60], rax
lea rdx, [rsp + 0x60]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x140024d9e
lea rcx, [rbp - 0x60]
call fcn.14002386c
nop
mov rdx, rax
mov rcx, rsi
call fcn.140002038
nop
mov rdx, qword [rbp - 0x60]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x14002514d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14002514d
cmp dword [rsp + 0x64], r12d
je 0x140024dc1
lea rcx, [rbp - 0x78]
call fcn.14002386c
nop
mov rdx, rax
mov rcx, rsi
call fcn.140002038
nop
mov rdx, qword [rbp - 0x78]
jmp 0x140024d7b
cmp dword [rsp + 0x60], r12d
je 0x14002514d
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r12
mov edx, dword [rsp + 0x60]
lea rcx, [rsp + 0x48]
call fcn.1400253cc
mov dword [rsp + 0x70], r12d
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x70]
mov r8d, dword [rsp + 0x60]
mov rdi, qword [rsp + 0x48]
mov rdx, rdi
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140024e23
test rdi, rdi
je 0x14002514d
mov rcx, rdi
jmp 0x140025139
mov r15b, r12b
mov r14b, r12b
mov al, byte [rdi]
cmp al, 0xff
jne 0x140024e3a
cmp byte [rdi + 1], 0xfe
jne 0x140024e3a
mov r15b, 1
jmp 0x140024e6d
cmp al, 0xfe
jne 0x140024e4c
cmp byte [rdi + 1], 0xff
jne 0x140024e4c
mov r15b, 1
mov r14b, r15b
jmp 0x140024e6d
cmp al, 0xef
jne 0x140024f52
cmp byte [rdi + 1], 0xbb
jne 0x140024f52
cmp byte [rdi + 2], 0xbf
jne 0x140024f52
mov ebx, 3
movsxd rdx, ebx
add rdx, rdi
mov rbx, qword [rsp + 0x50]
cmp rdx, rbx
jne 0x140024e82
mov rbx, rdi
jmp 0x140024e98
cmp rdi, rdx
je 0x140024e9d
sub rbx, rdx
mov r8, rbx
mov rcx, rdi
call fcn.1400bd950
add rbx, rdi
mov qword [rsp + 0x50], rbx
mov r10d, dword [0x1401aad80]
test r14b, r14b
je 0x140024f5e
lea ecx, [r10 + 2]
lea eax, [r10 + 1]
imul ecx, eax
imul ecx, r10d
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
add eax, eax
sub ecx, eax
cmp ecx, 1
jne 0x140024ef9
lea eax, [rcx + 0x4c]
lea r8d, [rcx + 0x56]
test r8d, r8d
je 0x140024ef5
mov ecx, r8d
cdq
idiv r8d
mov r8d, edx
mov eax, ecx
test ecx, ecx
jne 0x140024ee0
lea r10d, [r8 + rax]
mov rcx, rdi
lea r9d, [r10 + 1]
lea r8d, [r10 + 2]
imul r8d, r9d
imul r8d, r10d
mov eax, 0x92492493
imul r8d
add edx, r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xe
sub r8d, edx
cmp r8d, 0xc
cmove r10d, r9d
mov dword [0x1401aad80], r10d
cmp rdi, rbx
je 0x140024f5e
mov r8b, byte [rcx + 1]
mov dl, byte [rcx]
mov byte [rcx + 1], dl
mov byte [rcx], r8b
add rcx, 2
cmp rcx, rbx
jne 0x140024f3b
jmp 0x140024f5e
mov rbx, qword [rsp + 0x50]
mov r10d, dword [0x1401aad80]
sub rbx, rdi
cmp byte [rdi + rbx - 1], r12b
je 0x14002507f
lea ecx, [r10 + 1]
imul ecx, r10d
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xf
sub ecx, edx
cmp ecx, 4
jne 0x140024fa6
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
lea rdx, [rbx + 1]
lea rcx, [rsp + 0x48]
call fcn.1400253cc
mov rdi, qword [rsp + 0x48]
mov byte [rdi + rbx], r12b
test r15b, r15b
je 0x140024fda
lea rdx, [rbx + 2]
lea rcx, [rsp + 0x48]
call fcn.1400253cc
mov rdi, qword [rsp + 0x48]
mov byte [rdi + rbx + 1], r12b
mov r9d, dword [0x1401aad80]
lea ecx, [r9 + 2]
lea eax, [r9 + 1]
imul ecx, eax
imul ecx, r9d
mov eax, 0x30c30c31
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub ecx, edx
cmp ecx, 8
jne 0x14002509c
mov r14d, r12d
lea r12, [rbp - 0x40]
xor r10d, r10d
lea ebx, [r10 + 1]
lea ecx, [r14 + 1]
mov eax, r9d
cdq
idiv ecx
mov r8d, edx
mov ecx, r9d
sub ecx, r14d
imul r8d, ecx
mov eax, r9d
cdq
idiv ebx
add r8d, eax
sub r8d, r10d
mov dword [r12], r8d
mov edx, r8d
lea rcx, [0x140138060]
call fcn.1400be234
mov r10d, ebx
add r12, 4
cmp ebx, 0xb
jge 0x140025068
mov r9d, dword [0x1401aad80]
jmp 0x140025019
inc r14d
cmp r14d, 9
jge 0x14002507a
mov r9d, dword [0x1401aad80]
jmp 0x140025016
xor r12d, r12d
jmp 0x14002509c
test r15b, r15b
je 0x1400250d4
lea rdx, [rbx + 2]
lea rcx, [rsp + 0x48]
call fcn.1400253cc
mov rdi, qword [rsp + 0x48]
mov word [rdi + rbx], r12w
test r15b, r15b
je 0x1400250d4
mov rdx, rdi
lea rcx, [rbp - 0x80]
call fcn.140001f6c
nop
mov rdx, rax
mov rcx, rsi
call fcn.140002038
nop
mov rdx, qword [rbp - 0x80]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14002512f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14002512f
lea rcx, [0x1401a29a8]
mov rax, qword [0x1401a29a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x68], rax
mov rdx, rdi
lea rcx, [rsp + 0x68]
call fcn.140002fb8
nop
lea rdx, [rsp + 0x68]
mov rcx, rsi
call fcn.140002038
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140025123
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, rsi
mov rcx, rsi
call fcn.140022eb0
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14002514d
call fcn.1400bd904
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], r12
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rsi
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.1400bd920
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x260
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret