Function at 0x18000e020
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp + 0x48]
sub rsp, 0x148
xor eax, eax
xor edi, edi
mov rsi, rcx
mov qword [rbp - 0x77], rax
mov qword [rbp - 0x6f], rax
mov qword [rbp - 0x67], rax
mov dword [rbp - 0x5f], eax
mov word [rbp - 0x5b], ax
mov byte [rbp - 0x59], al
mov rax, qword [rcx + 8]
mov rcx, qword [rcx + 0x28]
mov byte [rbp - 0x78], dil
mov r14, qword [rax + 0x60]
xor ebx, ebx
lea r15d, [rdi + 1]
mov qword [rbp - 0x80], r14
mov qword [rbp + 0x18], rbx
call fcn.1800126f4
mov rdx, qword [r14 + 8]
lea rcx, str._PIPE_PACKET_RECEIVE__reading_in_the_header_from_pipe_handle:__p
call fcn.18000dd9c
mov rcx, qword [r14 + 8]
and qword [rsp + 0x20], rbx
mov r8d, 0x20
mov eax, edi
lea rdx, [rbp - 0x78]
lea r9, [rbp + 0x10]
add rdx, rax
sub r8d, edi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18000e556
add edi, dword [rbp + 0x10]
cmp edi, 0x20
je 0x18000e0d5
lea rcx, str._PIPE__More_bytes_required
call fcn.18000dd9c
jmp 0x18000e0d8
xor r15d, r15d
test r15d, r15d
jne 0x18000e092
cmp edi, 0x20
je 0x18000e0f3
lea rcx, str._PIPE__we_didnt_get_enough_header_bytes
call fcn.18000dd9c
jmp 0x18000e561
movzx eax, byte [rbp - 0x75]
movzx r9d, byte [rbp - 0x76]
movzx r8d, byte [rbp - 0x77]
movzx edx, byte [rbp - 0x78]
lea rcx, str._PIPE__the_XOR_key_is:__02x_02x_02x_02x
mov dword [rsp + 0x20], eax
call fcn.18000dd9c
movzx eax, byte [rbp - 0x59]
movzx ecx, byte [rbp - 0x5a]
mov dword [rsp + 0x100], eax
movzx eax, byte [rbp - 0x64]
movzx r10d, byte [rbp - 0x5b]
movzx r11d, byte [rbp - 0x5c]
movzx ebx, byte [rbp - 0x5d]
movzx edi, byte [rbp - 0x5e]
movzx esi, byte [rbp - 0x5f]
movzx r14d, byte [rbp - 0x60]
movzx r15d, byte [rbp - 0x61]
movzx r12d, byte [rbp - 0x62]
movzx r13d, byte [rbp - 0x63]
movzx r9d, byte [rbp - 0x76]
movzx r8d, byte [rbp - 0x77]
movzx edx, byte [rbp - 0x78]
mov dword [rsp + 0xf8], ecx
mov dword [rsp + 0xf0], r10d
mov dword [rsp + 0xe8], r11d
mov dword [rsp + 0xe0], ebx
mov dword [rsp + 0xd8], edi
mov dword [rsp + 0xd0], esi
mov dword [rsp + 0xc8], r14d
mov dword [rsp + 0xc0], r15d
mov dword [rsp + 0xb8], r12d
mov dword [rsp + 0xb0], r13d
mov dword [rsp + 0xa8], eax
movzx eax, byte [rbp - 0x65]
lea rcx, str._PIPE__Packet_header:__0x_02X_0x_02X_0x_02X_0x_02X___0x_02X_0x_02X_0x_02X_0x_02X_0x_02X_0x_02X_0x_02X_0x_02X_0x_02X_0x_02X_0x_02X_0x_02X_0x_02X_0x_02X_0x_02X_0x_02X___0x_02X_0x_02X_0x_02X_0x_02X___0x_02X_0x_02X_0x_02X_0x_02X___0x_02X_0x_02X_0x_02X_0x_02X_
mov dword [rsp + 0xa0], eax
movzx eax, byte [rbp - 0x66]
mov dword [rsp + 0x98], eax
movzx eax, byte [rbp - 0x67]
mov dword [rsp + 0x90], eax
movzx eax, byte [rbp - 0x68]
mov dword [rsp + 0x88], eax
movzx eax, byte [rbp - 0x69]
mov dword [rsp + 0x80], eax
movzx eax, byte [rbp - 0x6a]
mov dword [rsp + 0x78], eax
movzx eax, byte [rbp - 0x6b]
mov dword [rsp + 0x70], eax
movzx eax, byte [rbp - 0x6c]
mov dword [rsp + 0x68], eax
movzx eax, byte [rbp - 0x6d]
mov dword [rsp + 0x60], eax
movzx eax, byte [rbp - 0x6e]
mov dword [rsp + 0x58], eax
movzx eax, byte [rbp - 0x6f]
mov dword [rsp + 0x50], eax
movzx eax, byte [rbp - 0x70]
mov dword [rsp + 0x48], eax
movzx eax, byte [rbp - 0x71]
mov dword [rsp + 0x40], eax
movzx eax, byte [rbp - 0x72]
mov dword [rsp + 0x38], eax
movzx eax, byte [rbp - 0x73]
mov dword [rsp + 0x30], eax
movzx eax, byte [rbp - 0x74]
mov dword [rsp + 0x28], eax
movzx eax, byte [rbp - 0x75]
mov dword [rsp + 0x20], eax
call fcn.18000dd9c
cmp byte [rbp - 0x75], 0
jne 0x18000e2cc
mov ebx, dword [rbp - 0x78]
lea rcx, str._PIPE__discovered_a_length_header__assuming_its_metsrv_of_length__d
mov edx, ebx
call fcn.18000dd9c
lea edi, [rbx - 0x1c]
movsxd rcx, edi
call fcn.180018f98
mov rcx, qword [rbp - 0x80]
lea r9, [rbp + 0x10]
mov rdx, rax
mov r8d, edi
mov rbx, rax
call fcn.18000df28
mov rcx, rbx
call fcn.180018f58
mov r8d, dword [rbp + 0x10]
cmp edi, r8d
je 0x18000e2ba
lea rcx, str._PIPE__Failed_to_read_all_bytes_when_flushing_the_buffer:__u_vs__u
mov edx, edi
call fcn.18000dd9c
mov rbx, qword [rbp + 0x18]
mov rsi, qword [rbp]
jmp 0x18000e561
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rdx, qword [rbp + 8]
and qword [rdx], 0
jmp 0x18000e2ad
lea rcx, str._PIPE__XOR_key_looks_fine__moving_on
call fcn.18000dd9c
lea rdx, [rbp - 0x74]
lea rcx, [rbp - 0x78]
mov r8d, 0x1c
call fcn.180007568
movzx eax, byte [rbp - 0x59]
movzx ecx, byte [rbp - 0x5a]
mov dword [rsp + 0x100], eax
movzx eax, byte [rbp - 0x64]
movzx r10d, byte [rbp - 0x5b]
movzx r11d, byte [rbp - 0x5c]
movzx ebx, byte [rbp - 0x5d]
movzx edi, byte [rbp - 0x5e]
movzx esi, byte [rbp - 0x5f]
movzx r14d, byte [rbp - 0x60]
movzx r15d, byte [rbp - 0x61]
movzx r12d, byte [rbp - 0x62]
movzx r13d, byte [rbp - 0x63]
movzx r9d, byte [rbp - 0x76]
movzx r8d, byte [rbp - 0x77]
movzx edx, byte [rbp - 0x78]
mov dword [rsp + 0xf8], ecx
mov dword [rsp + 0xf0], r10d
mov dword [rsp + 0xe8], r11d
mov dword [rsp + 0xe0], ebx
mov dword [rsp + 0xd8], edi
mov dword [rsp + 0xd0], esi
mov dword [rsp + 0xc8], r14d
mov dword [rsp + 0xc0], r15d
mov dword [rsp + 0xb8], r12d
mov dword [rsp + 0xb0], r13d
mov dword [rsp + 0xa8], eax
movzx eax, byte [rbp - 0x65]
lea rcx, str._PIPE__Packet_header:__0x_02X_0x_02X_0x_02X_0x_02X___0x_02X_0x_02X_0x_02X_0x_02X_0x_02X_0x_02X_0x_02X_0x_02X_0x_02X_0x_02X_0x_02X_0x_02X_0x_02X_0x_02X_0x_02X_0x_02X___0x_02X_0x_02X_0x_02X_0x_02X___0x_02X_0x_02X_0x_02X_0x_02X___0x_02X_0x_02X_0x_02X_0x_02X_
mov dword [rsp + 0xa0], eax
movzx eax, byte [rbp - 0x66]
mov dword [rsp + 0x98], eax
movzx eax, byte [rbp - 0x67]
mov dword [rsp + 0x90], eax
movzx eax, byte [rbp - 0x68]
mov dword [rsp + 0x88], eax
movzx eax, byte [rbp - 0x69]
mov dword [rsp + 0x80], eax
movzx eax, byte [rbp - 0x6a]
mov dword [rsp + 0x78], eax
movzx eax, byte [rbp - 0x6b]
mov dword [rsp + 0x70], eax
movzx eax, byte [rbp - 0x6c]
mov dword [rsp + 0x68], eax
movzx eax, byte [rbp - 0x6d]
mov dword [rsp + 0x60], eax
movzx eax, byte [rbp - 0x6e]
mov dword [rsp + 0x58], eax
movzx eax, byte [rbp - 0x6f]
mov dword [rsp + 0x50], eax
movzx eax, byte [rbp - 0x70]
mov dword [rsp + 0x48], eax
movzx eax, byte [rbp - 0x71]
mov dword [rsp + 0x40], eax
movzx eax, byte [rbp - 0x72]
mov dword [rsp + 0x38], eax
movzx eax, byte [rbp - 0x73]
mov dword [rsp + 0x30], eax
movzx eax, byte [rbp - 0x74]
mov dword [rsp + 0x28], eax
movzx eax, byte [rbp - 0x75]
mov dword [rsp + 0x20], eax
call fcn.18000dd9c
mov rsi, qword [rbp]
mov rcx, qword [rsi + 0x20]
mov r15d, 0x20
add rcx, r15
call fcn.1800075e0
test eax, eax
je 0x18000e45a
mov rcx, qword [rsi + 0x20]
lea r8d, [r15 - 0x10]
lea rdx, [rbp - 0x74]
add rcx, r15
call fcn.180019130
mov ecx, dword [rbp - 0x60]
call qword [sym.imp.WS2_32.dll_ntohl]
lea rcx, str._PIPE__Payload_length_is__u_0x_08x
lea edi, [rax - 8]
mov r8d, edi
mov edx, edi
call fcn.18000dd9c
lea r14d, [rdi + 0x20]
lea rcx, str._PIPE__total_buffer_size_for_the_packet_is__u_0x_08x
mov r8d, r14d
mov edx, r14d
call fcn.18000dd9c
mov ecx, r14d
call fcn.180018f98
mov rbx, rax
test rax, rax
jne 0x18000e4b1
lea rcx, str._PIPE__Failed_to_create_the_packet_buffer
call fcn.18000dd9c
lea ecx, [rbx + 8]
jmp 0x18000e55b
lea rcx, str._PIPE__Allocated_packet_buffer_at__p
mov rdx, rax
call fcn.18000dd9c
lea rdx, [rbp - 0x74]
lea rcx, [rbp - 0x78]
mov r8d, 0x1c
call fcn.180007568
lea r8, [rbp - 0x78]
mov r9, r15
mov rdx, r15
mov rcx, rbx
call fcn.18001ad08
mov rcx, qword [rbp - 0x80]
lea rdx, [rbx + 0x20]
lea r9, [rbp + 0x10]
mov r8d, edi
call fcn.18000df28
mov r8d, dword [rbp + 0x10]
lea rcx, str._PIPE__wanted__u_read__u
mov edx, edi
mov r15d, eax
call fcn.18000dd9c
cmp dword [rbp + 0x10], edi
je 0x18000e524
lea rcx, str._PIPE__Failed_to_get_all_the_payload_bytes
call fcn.18000dd9c
mov ecx, r15d
jmp 0x18000e55b
lea rcx, str._PIPE__decrypting_packet
call fcn.18000dd9c
mov rdx, qword [rbp + 8]
mov r9d, r14d
mov r8, rbx
mov rcx, rsi
call fcn.180007f44
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, rbx
call fcn.180018f58
xor ebx, ebx
jmp 0x18000e561
mov ecx, 0x490
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test rbx, rbx
je 0x18000e576
mov rcx, rbx
call fcn.180018f58
mov rcx, qword [rsi + 0x28]
call fcn.180012714
mov eax, edi
add rsp, 0x148
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret