Function at 0x180085060
Capabilities:
Get file attributes
Read file on windows
Read pipe

Disassembly:
push rbx
push r12
sub rsp, 0x98
lea rax, [rcx + 0x1000]
mov r12d, edx
mov rbx, rcx
cmp rax, 0x2000
jb 0x180085097
movabs rax, 0xffff800000000000
test rax, rcx
jne 0x180085097
cmp dword [rcx], 0x19570528
je 0x1800850a7
mov eax, 0xfffffffc
add rsp, 0x98
pop r12
pop rbx
ret
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x70], r15
call sym.VBoxRT.dll_RTTimeMilliTS
lea rcx, [rbx + 0x60]
mov r15, rax
call sym.VBoxRT.dll_RTCritSectEnter
mov edi, eax
test eax, eax
js 0x1800853b6
mov qword [rsp + 0xb8], rbp
mov qword [rsp + 0x90], rsi
xor esi, esi
mov qword [rsp + 0x80], r13
mov r13d, esi
or rbp, 0xffffffffffffffff
cmp byte [rbx + 0x10], 0
je 0x1800851dc
cmp byte [rbx + 0x11], 0
je 0x18008510e
mov rbp, qword [rbx + 0x38]
jmp 0x180085270
mov rcx, qword [rbx + 8]
lea rax, [rsp + 0xb0]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x180085144
cmp dword [rsp + 0xb0], 0
ja 0x180085391
test r12d, r12d
je 0x180085367
cmp dword [rbx + 0x18], 0
jne 0x180085360
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, qword [rbx + 8]
lea rdx, [rbx + 0x90]
mov edi, eax
lea rax, [rbx + 0x20]
lea r9, [rsp + 0xc0]
xor r8d, r8d
mov dword [rsp + 0xc0], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1800851a9
mov edi, esi
cmp r13d, 0xa
jbe 0x180085278
call sym.VBoxRT.dll_RTThreadYield
jmp 0x180085278
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x1800851c8
inc dword [rbx + 0x18]
mov rbp, qword [rbx + 0x38]
mov word [rbx + 0x11], 0x101
jmp 0x180085270
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.VBoxRT.dll_RTErrConvertFromWin32
mov edi, eax
jmp 0x180085270
cmp byte [rbx + 0x11], 0
je 0x180085200
mov rcx, rbx
call fcn.1800840c0
mov edi, eax
test eax, eax
js 0x18008536e
cmp byte [rbx + 0x11], 0
je 0x180085200
mov rbp, qword [rbx + 0x38]
jmp 0x180085270
xor eax, eax
lea rcx, [rsp + 0x40]
xor edx, edx
lea r8d, [rax + 0x28]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
call sub.MSVCR100.dll_memset
mov rcx, qword [rbx + 8]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x30]
mov r9d, 0x28
mov dword [rsp + 0x20], 0x18
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
js 0x18008538d
cmp dword [rsp + 0x60], 4
je 0x180085382
cmp dword [rsp + 0x5c], 0
ja 0x18008537c
cmp dword [rsp + 0x58], 0
je 0x18008538d
test r12d, r12d
jne 0x18008538d
test edi, edi
js 0x18008536e
or esi, 0xffffffff
cmp r12d, esi
je 0x1800852a6
cmp rbp, 0xffffffffffffffff
jne 0x180085290
cmp r13d, 0xa
jbe 0x180085356
call sym.VBoxRT.dll_RTTimeMilliTS
sub rax, r15
cmp rax, r12
jae 0x180085367
mov esi, r12d
sub esi, eax
cmp rbp, 0xffffffffffffffff
je 0x180085356
lea rcx, [rbx + 0x60]
call sym.VBoxRT.dll_RTCritSectLeave
mov edx, esi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1800852cc
xor edi, edi
jmp 0x180085307
cmp eax, 0x102
jne 0x1800852da
mov edi, 0xffffffd8
jmp 0x1800852fb
cmp eax, 0x80
jne 0x1800852e8
mov edi, 0xfffffffc
jmp 0x1800852fb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.VBoxRT.dll_RTErrConvertFromWin32
mov edi, eax
test eax, eax
jns 0x180085307
cmp dword [rbx], 0x19570528
jne 0x18008539c
lea rcx, [rbx + 0x60]
call sym.VBoxRT.dll_RTCritSectEnter
cmp byte [rbx + 0x12], 0
je 0x180085352
dec dword [rbx + 0x18]
mov byte [rbx + 0x11], 0
test edi, edi
je 0x18008532b
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CancelIo]
mov rcx, qword [rbx + 8]
lea rdx, [rbx + 0x20]
lea r8, [rsp + 0xc8]
mov r9d, 1
mov dword [rsp + 0xc8], 0
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test edi, edi
js 0x18008536e
inc r13d
xor esi, esi
jmp 0x1800850f1
mov edi, 0xffffff1b
jmp 0x180085393
mov edi, 0xffffffd8
jmp 0x180085393
cmp edi, 0xfffffed3
jne 0x180085393
mov byte [rbx + 0x13], 1
jmp 0x180085393
mov byte [rbx + 0x14], 0
jmp 0x180085391
mov edi, 0xfffffed3
mov byte [rbx + 0x13], 1
jmp 0x180085393
mov byte [rbx + 0x14], 1
mov edi, esi
lea rcx, [rbx + 0x60]
call sym.VBoxRT.dll_RTCritSectLeave
mov rsi, qword [rsp + 0x90]
mov r13, qword [rsp + 0x80]
mov rbp, qword [rsp + 0xb8]
mov eax, edi
mov rdi, qword [rsp + 0x88]
mov r14, qword [rsp + 0x78]
mov r15, qword [rsp + 0x70]
add rsp, 0x98
pop r12
pop rbx
ret