Function at 0x4197b0
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
push eax
mov eax, 0x12c8
call fcn.00bd0e20
sub esp, eax
mov ecx, dword [0xeea1cc]
mov eax, dword [esp + eax]
test ecx, ecx
jne 0x41a01a
mov ecx, eax
sub ecx, dword [0xeea1b8]
mov ebx, edx
sbb ebx, dword [0xeea1bc]
cmp ebx, 0
jl 0x4197f7
jle 0x419a70
mov ecx, dword [0xeea1f8]
test ecx, ecx
je 0x419804
xor eax, eax
add esp, 0x12cc
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, eax
mov eax, dword [0xeea1b4]
mov edi, edx
test eax, eax
je 0x41a080
mov eax, dword [0xeea1b0]
test eax, eax
je 0x419e70
mov eax, dword [0xeea1b4]
lea ebp, [esp + 0x2c0]
mov dword [esp + 0x14], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 0x10], ebp
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.KERNEL32.dll_PeekNamedPipe
sub esp, 0x18
test eax, eax
je 0x41a06f
mov eax, dword [esp + 0x2c0]
test eax, eax
je 0x41a06f
lea eax, [esp + 0xc0]
mov dword [esp + 8], 1
mov dword [esp], 0
mov dword [esp + 4], eax
call sub.msvcrt.dll__read
movzx eax, byte [esp + 0xc0]
mov dword [esp + 0x28], eax
cmp eax, 0x71
mov dword [0xeea1b8], esi
mov dword [0xeea1bc], edi
je 0x41a01a
mov ebx, eax
and ebx, 0xffffffdf
cmp eax, 0x2b
je 0x419e1f
cmp dword [esp + 0x28], 0x2d
jne 0x419bf1
call fcn.008919b0
sub eax, 0xa
mov dword [esp], eax
call fcn.008919c0
cmp ebx, 0x43
jne 0x419af0
lea edi, [esp + 0x1c0]
xor eax, eax
mov ecx, 0x40
mov esi, dword [sym.imp.msvcrt.dll__iob]
lea ebp, [esp + 0x80]
xor ebx, ebx
rep stosd dword es:[edi], eax
mov dword [esp + 4], str._nEnter_command:__target_all__time__1__command____argument___n
lea eax, [esi + 0x40]
mov dword [esp], eax
call fcn.00416fa0
lea edi, [esp + 0xc0]
jmp 0x4199b2
mov eax, dword [0xeea1b4]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.KERNEL32.dll_PeekNamedPipe
sub esp, 0x18
test eax, eax
je 0x419a81
mov ecx, dword [esp + 0xc0]
test ecx, ecx
je 0x419a81
lea eax, [esp + 0x40]
mov dword [esp + 8], 1
mov dword [esp], 0
mov dword [esp + 4], eax
call sub.msvcrt.dll__read
movzx eax, byte [esp + 0x40]
cmp eax, 0xa
je 0x4199e3
cmp eax, 0xd
je 0x419e34
cmp ebx, 0xffe
ja 0x419e34
test eax, eax
jg 0x419e10
mov eax, dword [0xeea1b4]
test eax, eax
je 0x419ab3
mov eax, dword [0xeea1b0]
test eax, eax
jne 0x419924
call sub.msvcrt.dll__kbhit
test eax, eax
je 0x419a81
call sub.msvcrt.dll__getch
cmp eax, 0xa
jne 0x419995
lea eax, [esi + 0x40]
mov byte [esp + ebx + 0x2c0], 0
mov dword [esp + 4], 0xc26b5d
mov dword [esp], eax
call fcn.00416fa0
lea eax, [esp + 0x1c0]
lea ebp, [esp + 0x2c0]
mov dword [esp + 4], str._63_____lf__255_____255__n_
mov dword [esp + 0x14], eax
lea eax, [esp + 0xc0]
mov dword [esp], ebp
mov dword [esp + 0x10], eax
lea eax, [esp + 0x38]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x40]
mov dword [esp + 8], eax
call sub.msvcrt.dll_sscanf
cmp eax, 2
jg 0x419ec0
mov dword [esp + 0x10], ebp
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.Parse_error__at_least_3_arguments_were_expected__only__d_given_in_string__s_n
mov dword [esp + 4], 0x10
mov dword [esp], 0
call fcn.00891920
jmp 0x419bc1
cmp ecx, 0x1869f
jbe 0x4197f7
jmp 0x4197ed
cmp ebx, 0xffe
jle 0x4199b2
add esi, 0x40
mov byte [esp + ebx + 0x2c0], 0
mov dword [esp + 4], 0xc26b5d
mov dword [esp], esi
lea ebp, [esp + 0x2c0]
call fcn.00416fa0
xor eax, eax
jmp 0x419a44
mov dword [esp], 0xfffffff6
call sub.KERNEL32.dll_GetStdHandle
sub esp, 4
mov dword [0xeea1b4], eax
mov dword [esp + 4], ebp
mov dword [esp], eax
call sub.KERNEL32.dll_GetConsoleMode
sub esp, 8
test eax, eax
sete al
movzx eax, al
mov dword [0xeea1b0], eax
jmp 0x4199c4
cmp ebx, 0x44
jne 0x419bc1
cmp dword [esp + 0x28], 0x44
mov dword [esp + 0x80], 0
jne 0x419c13
mov eax, dword [0xeea0bc]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x2a8]
add edx, edx
test edx, edx
mov dword [esp + 0x80], edx
jne 0x419e90
mov esi, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 0x80], 1
mov edx, 1
lea esi, [esi]
mov ecx, dword [0xeea0b8]
mov eax, dword [0xeea0bc]
test ecx, ecx
lea ebx, [eax + ecx*4]
jle 0x419b77
mov ecx, dword [eax]
add eax, 4
cmp ebx, eax
mov ecx, dword [ecx + 4]
mov ecx, dword [ecx + 8]
mov dword [ecx + 0x2a8], edx
jne 0x419b62
mov ecx, dword [0xeea0a8]
mov eax, dword [0xeea0ac]
test ecx, ecx
lea ebx, [eax + ecx*4]
jle 0x419ba2
lea esi, [esi]
mov ecx, dword [eax]
add eax, 4
cmp eax, ebx
mov ecx, dword [ecx + 0x44]
mov dword [ecx + 0x2a8], edx
jne 0x419b90
test edx, edx
jne 0x419df4
add esi, 0x40
mov dword [esp + 8], edx
mov dword [esp + 4], str.debug_d_n
mov dword [esp], esi
call fcn.00416fa0
cmp dword [esp + 0x28], 0x3f
jne 0x4197f7
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 4], str.key____function_n_______show_this_help_n______increase_verbosity_n_______decrease_verbosity_nc______Send_command_to_first_matching_filter_supporting_it_nC______Send_Queue_command_to_all_matching_filters_nD______cycle_through_available_debug_modes_nh______dump_packets_hex_press_to_cycle_through_the_3_states_nq______quit_ns______Show_QP_histogram_n
add eax, 0x40
mov dword [esp], eax
call fcn.00416fa0
add esp, 0x12cc
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
cmp dword [esp + 0x28], 0x73
jne 0x41a0bc
xor dword [0xeea03c], 1
cmp ebx, 0x44
jne 0x419bc1
mov dword [esp + 0x80], 0
lea edi, [esp + 0xc0]
xor ebx, ebx
lea esi, [esp + 0x1c0]
jmp 0x419cbb
mov eax, dword [0xeea1b4]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.KERNEL32.dll_PeekNamedPipe
sub esp, 0x18
test eax, eax
je 0x419d50
mov eax, dword [esp + 0x1c0]
test eax, eax
je 0x419d50
lea eax, [esp + 0x40]
mov dword [esp + 8], 1
mov dword [esp], 0
mov dword [esp + 4], eax
call sub.msvcrt.dll__read
movzx eax, byte [esp + 0x40]
cmp eax, 0xa
je 0x419ce9
cmp eax, 0xd
je 0x419dc4
cmp ebx, 0x1e
ja 0x419dc4
test eax, eax
jg 0x419db5
mov edx, dword [0xeea1b4]
test edx, edx
je 0x419d80
mov eax, dword [0xeea1b0]
test eax, eax
jne 0x419c30
call sub.msvcrt.dll__kbhit
test eax, eax
je 0x419d50
call sub.msvcrt.dll__getch
cmp eax, 0xa
jne 0x419ca1
mov esi, dword [sym.imp.msvcrt.dll__iob]
mov byte [esp + ebx + 0x2c0], 0
mov dword [esp + 4], 0xc26b5d
lea eax, [esi + 0x40]
mov dword [esp], eax
call fcn.00416fa0
lea eax, [esp + 0x80]
mov dword [esp + 4], 0xc26f56
mov dword [esp + 8], eax
lea eax, [esp + 0x2c0]
mov dword [esp], eax
call sub.msvcrt.dll_sscanf
cmp eax, 1
je 0x419d44
lea eax, [esi + 0x40]
mov dword [esp + 4], str.error_parsing_debug_value_n
mov dword [esp], eax
call fcn.00416fa0
mov edx, dword [esp + 0x80]
jmp 0x419b50
cmp ebx, 0x1e
jle 0x419cbb
mov esi, dword [sym.imp.msvcrt.dll__iob]
mov byte [esp + ebx + 0x2c0], 0
mov dword [esp + 4], 0xc26b5d
lea eax, [esi + 0x40]
mov dword [esp], eax
call fcn.00416fa0
jmp 0x419d31
mov dword [esp], 0xfffffff6
call sub.KERNEL32.dll_GetStdHandle
sub esp, 4
mov dword [0xeea1b4], eax
mov dword [esp + 4], edi
mov dword [esp], eax
call sub.KERNEL32.dll_GetConsoleMode
sub esp, 8
test eax, eax
sete al
movzx eax, al
mov dword [0xeea1b0], eax
jmp 0x419cce
add ebx, 1
mov byte [esp + ebx + 0x2bf], al
jmp 0x419c1c
mov esi, dword [sym.imp.msvcrt.dll__iob]
mov ebp, eax
mov byte [esp + ebx + 0x2c0], 0
mov dword [esp + 4], 0xc26b5d
lea eax, [esi + 0x40]
mov dword [esp], eax
call fcn.00416fa0
test ebp, ebp
jg 0x419d0a
jmp 0x419d31
mov dword [esp], 0x30
call fcn.008919c0
mov edx, dword [esp + 0x80]
jmp 0x419baa
add ebx, 1
mov byte [esp + ebx + 0x2bf], al
jmp 0x419918
call fcn.008919b0
add eax, 0xa
mov dword [esp], eax
call fcn.008919c0
jmp 0x4198dd
mov dword [esp + 0x2c], eax
lea eax, [esi + 0x40]
mov byte [esp + ebx + 0x2c0], 0
mov dword [esp + 4], 0xc26b5d
mov dword [esp], eax
call fcn.00416fa0
mov edx, dword [esp + 0x2c]
test edx, edx
jg 0x4199fe
xor eax, eax
lea ebp, [esp + 0x2c0]
jmp 0x419a44
call sub.msvcrt.dll__kbhit
test eax, eax
je 0x41a06f
call sub.msvcrt.dll__getch
mov dword [esp + 0x28], eax
jmp 0x41989f
test edx, 0x6040
je 0x419eb1
nop
lea esi, [esi]
add edx, edx
test edx, 0x6040
jne 0x419ea0
mov dword [esp + 0x80], edx
mov esi, dword [sym.imp.msvcrt.dll__iob]
jmp 0x419b50
lea eax, [esp + 0x1c0]
fld qword [esp + 0x38]
mov dword [esp + 8], str.Processing_command_target:_s_time:_f_command:_s_arg:_s
mov dword [esp + 4], 0x30
mov dword [esp], 0
xor ebx, ebx
mov dword [esp + 0x1c], eax
lea eax, [esp + 0xc0]
fstp qword [esp + 0x10]
add esi, 0x40
mov dword [esp + 0x18], eax
lea eax, [esp + 0x40]
mov dword [esp + 0xc], eax
call fcn.00891920
mov eax, dword [0x1019f58]
test eax, eax
jle 0x419bc1
mov dword [esp + 0x2c], ebp
mov ebp, dword [esp + 0x28]
jmp 0x419f6c
lea eax, [esp + 0x1c0]
fstp qword [esp + 0x14]
mov dword [esp], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc0]
mov dword [esp + 8], eax
lea eax, [esp + 0x40]
mov dword [esp + 4], eax
call fcn.0042dd00
test eax, eax
mov edx, eax
js 0x41a024
mov eax, dword [0x1019f58]
add ebx, 1
cmp ebx, eax
jge 0x419bc1
mov edx, dword [0x1019f54]
mov edx, dword [edx + ebx*4]
mov edx, dword [edx + 8]
test edx, edx
je 0x419f61
fld qword [esp + 0x38]
fldz
fucomp st(1)
fnstsw ax
sahf
ja 0x419fb0
cmp ebp, 0x63
jne 0x419f20
fstp st(0)
mov dword [esp + 4], str.Queuing_commands_only_on_filters_supporting_the_specific_command_is_unsupported_n
mov dword [esp], esi
call fcn.00416fa0
mov eax, dword [0x1019f58]
jmp 0x419f61
fstp st(0)
xor eax, eax
cmp ebp, 0x63
mov edi, dword [esp + 0x2c]
sete al
mov dword [esp], edx
mov dword [esp + 0x14], 0x1000
mov dword [esp + 0x18], eax
lea eax, [esp + 0x1c0]
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc0]
mov dword [esp + 8], eax
lea eax, [esp + 0x40]
mov dword [esp + 4], eax
call fcn.0042db80
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
mov dword [esp + 4], str.Command_reply_for_stream__d:_ret:_d_res:_n_s
mov dword [esp], esi
call fcn.00416fa0
mov eax, dword [0x1019f58]
jmp 0x419f61
mov eax, 0xabb6a7bb
jmp 0x4197f9
lea edi, [esp + 0x80]
xor eax, eax
mov ecx, 0x10
rep stosd dword es:[edi], eax
lea eax, [esp + 0x80]
mov dword [esp + 8], 0x40
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.0087c950
lea eax, [esp + 0x80]
mov dword [esp + 4], str.Queuing_command_failed_with_error__s_n
mov dword [esp], esi
mov dword [esp + 8], eax
call fcn.00416fa0
jmp 0x419f5c
mov dword [0xeea1b8], esi
mov dword [0xeea1bc], edi
jmp 0x4197f7
mov dword [esp], 0xfffffff6
call sub.KERNEL32.dll_GetStdHandle
sub esp, 4
mov dword [0xeea1b4], eax
lea edx, [esp + 0x1c0]
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.KERNEL32.dll_GetConsoleMode
sub esp, 8
test eax, eax
sete al
movzx eax, al
mov dword [0xeea1b0], eax
jmp 0x41981a
cmp dword [esp + 0x28], 0x68
jne 0x4198dd
mov eax, dword [0xeea058]
test eax, eax
je 0x41a0f5
mov dword [0xeea054], 0
mov dword [0xeea058], 0
mov dword [esp], 0x30
call fcn.008919c0
jmp 0x419c03
mov eax, dword [0xeea054]
test eax, eax
je 0x41a110
mov dword [0xeea058], 1
jmp 0x41a0e4
mov dword [0xeea054], 1
jmp 0x41a0e4