Function at 0x4dfd88
Capabilities:
Read file on windows
Read pipe

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x190
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov qword [rbp + 0x28], r9
mov rax, qword [rbp + 0x18]
add rax, 0x88
mov rcx, qword [rax]
mov qword [rbp - 8], rcx
mov rax, qword [rbp - 8]
cmp rax, 0
jne 0x4dfe54
lea rax, [0x00551377]
mov qword [rbp - 0x30], rax
mov eax, 0
mov dword [rbp - 0x28], eax
mov eax, 1
mov dword [rbp - 0x24], eax
mov eax, 0x10
mov r8, rax
lea rax, [rbp - 0x30]
mov r11, rax
lea rax, [rbp - 0x20]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov eax, 0
mov dword [rbp - 0x10], eax
movabs rax, 4
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0xc]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov rax, qword [rbp + 0x10]
mov ecx, 0x18
mov r8, rcx
lea rcx, [rbp - 0x20]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
jmp 0x4e02ac
movabs rax, 0
mov qword [rbp - 0x38], rax
mov eax, dword [rbp + 0x20]
cmp eax, 1
jne 0x4dfe80
mov rax, qword [rbp - 8]
add rax, 0x10020
mov rcx, qword [rax]
mov qword [rbp - 0x38], rcx
mov eax, dword [rbp + 0x20]
cmp eax, 2
jne 0x4dfe9e
mov rax, qword [rbp - 8]
add rax, 0x10030
mov rcx, qword [rax]
mov qword [rbp - 0x38], rcx
mov rax, qword [rbp - 0x38]
cmp rax, 0
jne 0x4dff3d
lea rax, [0x00551378]
mov qword [rbp - 0x60], rax
mov eax, 0
mov dword [rbp - 0x58], eax
mov eax, 1
mov dword [rbp - 0x54], eax
mov eax, 0x10
mov r8, rax
lea rax, [rbp - 0x60]
mov r11, rax
lea rax, [rbp - 0x50]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov eax, 0
mov dword [rbp - 0x40], eax
movabs rax, 4
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x3c]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov rax, qword [rbp + 0x10]
mov ecx, 0x18
mov r8, rcx
lea rcx, [rbp - 0x50]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
jmp 0x4e02ac
mov eax, 0
mov dword [rbp - 0x64], eax
movabs rax, 0
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x64]
mov qword [rsp + 0x20], rax
movabs rax, 0
mov r9, rax
mov eax, 0
mov r8, rax
movabs rax, 0
mov r11, rax
mov rax, qword [rbp - 0x38]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_PeekNamedPipe
cmp eax, 0
jne 0x4e0037
lea rax, [0x00551379]
mov qword [rbp - 0x90], rax
mov eax, 0
mov dword [rbp - 0x88], eax
mov eax, 1
mov dword [rbp - 0x84], eax
mov eax, 0x10
mov r8, rax
lea rax, [rbp - 0x90]
mov r11, rax
lea rax, [rbp - 0x80]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov eax, 0
mov dword [rbp - 0x70], eax
movabs rax, 4
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x6c]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov rax, qword [rbp + 0x10]
mov ecx, 0x18
mov r8, rcx
lea rcx, [rbp - 0x80]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
jmp 0x4e02ac
mov eax, dword [rbp - 0x64]
cmp eax, 0
jne 0x4e00ec
lea rax, [0x0055137a]
mov qword [rbp - 0xb8], rax
mov eax, 0
mov dword [rbp - 0xb0], eax
mov eax, 1
mov dword [rbp - 0xac], eax
mov eax, 0x10
mov r8, rax
lea rax, [rbp - 0xb8]
mov r11, rax
lea rax, [rbp - 0xa8]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov eax, 0
mov dword [rbp - 0x98], eax
movabs rax, 4
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x94]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov rax, qword [rbp + 0x10]
mov ecx, 0x18
mov r8, rcx
lea rcx, [rbp - 0xa8]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
jmp 0x4e02ac
mov eax, 0
mov dword [rbp - 0xbc], eax
mov eax, dword [rbp - 0x64]
add eax, 0x12c
movabs rcx, 0
mov qword [rsp + 0x20], rcx
mov ecx, 1
mov r9, rcx
mov ecx, 0
mov r8, rcx
mov r11, rax
lea rax, [rbp - 0x100]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.004567f7
mov eax, 0x20
mov r8, rax
lea rax, [rbp - 0x100]
mov r11, rax
lea rax, [rbp - 0xe0]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov rax, qword [rbp - 0xd8]
movabs rcx, 0
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0xbc]
mov r9, rcx
mov ecx, dword [rbp - 0xc8]
mov r8, rcx
mov r11, rax
mov rax, qword [rbp - 0x38]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_ReadFile
lea rax, [rsp + 0x20]
mov ecx, 0x20
mov r8, rcx
lea rcx, [rbp - 0xe0]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov eax, dword [rbp - 0xbc]
mov r9, rax
mov eax, 0
mov r8, rax
lea r11, [rsp + 0x20]
lea rax, [rbp - 0x148]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.004545fb
lea rax, [rsp + 0x20]
mov ecx, 0x20
mov r8, rcx
lea rcx, [rbp - 0x148]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea r11, [rsp + 0x20]
lea rax, [rbp - 0x128]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0045f5ea
mov eax, 0x10
mov r8, rax
lea rax, [rbp - 0x128]
mov r11, rax
lea rax, [rbp - 0x118]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov eax, dword [rbp - 0xbc]
mov dword [rbp - 0x108], eax
movabs rax, 4
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x104]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov rax, qword [rbp + 0x10]
mov ecx, 0x18
mov r8, rcx
lea rcx, [rbp - 0x118]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
leave
ret