Function at 0x180006580
Capabilities:
Create thread

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x150
mov esi, r8d
mov rdi, rdx
mov ebx, ecx
mov rax, qword [0x1805560a0]
xor rax, rsp
mov qword [rsp + 0x148], rax
movups xmm0, xmmword [0x18054b1cf]
movaps xmmword [rsp + 0x50], xmm0
movups xmm0, xmmword [0x18054b1bf]
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x60], 0
mov rax, qword [0x180556b90]
test rax, rax
je 0x180006638
test ebx, 0xfffffffb
je 0x180006668
mov dword [rsp + 0x68], 0xef
mov ebx, ebx
mov qword [rsp + 0x6c], rbx
mov qword [rsp + 0x74], rdi
mov ecx, esi
mov qword [rsp + 0x7c], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x38], rcx
lea rcx, [rsp + 0x38]
call rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x1800061a0]
xor ecx, ecx
xor edx, edx
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_CreateThread]
movzx esi, byte [rsp + 0x84]
jmp 0x180006682
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.NtDrawText
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180556b90], rax
test ebx, 0xfffffffb
jne 0x1800065dd
lea rdx, [0x18054b1a8]
xor esi, esi
xor ecx, ecx
xor r8d, r8d
mov r9d, 0x10
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, qword [rsp + 0x148]
xor rcx, rsp
call fcn.18001a3d0
mov eax, esi
add rsp, 0x150
pop rbx
pop rdi
pop rsi
ret

Function at 0x1800066a0
Capabilities:
Get file size
Read file on windows

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov r14d, ecx
mov rax, qword [0x1805560a0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor esi, esi
mov rcx, rdx
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
je 0x180006782
mov rdi, rax
xor esi, esi
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
je 0x18000678b
mov ebp, eax
mov edx, eax
xor esi, esi
xor ecx, ecx
mov r8d, 0x3000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x18000679d
mov rbx, rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov rcx, rdi
mov rdx, rax
mov r8d, ebp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1800067af
cmp dword [rsp + 0x44], ebp
jne 0x1800067af
mov ecx, r14d
mov rdx, rbx
mov r8d, ebp
call fcn.180006580
mov esi, eax
mov rcx, rbx
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800067e3
lea rdx, [0x18054b16e]
jmp 0x1800067d2
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [0x18054b17d]
jmp 0x1800067d2
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [0x18054b18c]
jmp 0x1800067d2
xor esi, esi
mov rcx, rbx
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [0x18054b197]
xor ecx, ecx
xor r8d, r8d
mov r9d, 0x10
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.18001a3d0
mov eax, esi
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret