Function at 0x40b080
Capabilities:
Read file on windows
Read pipe

Disassembly:
mov dword [ebx + 0x3c], esi
mov esi, dword [ebp + 0x10]
mov dword [ebp + 0x78], edx
test eax, eax
jbe 0x40b04d
clc
je 0xffa6af0b
jmp 0x40b017
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x49]
mov cl, 0x89
push es
je 0x40b02a
mov dword [ebp + 8], 0x8f00
pop dword [eax]
add byte [ebx - 0x17afa7b4], cl
or eax, 0x8bfffff3
inc ebp
or byte [edi - 0xf], bl
mov ecx, dword [eax + ebx*2 + 0x50]
call int.0040a340
mov eax, dword [ebp + 8]
pop edi
int1
mov eax, dword [0xc2cb5b8b]
add byte [ebx + 0xc4d8d16], cl
lea ecx, [ebp + 0xc]
push ecx
mov edx, dword [eax + 0x78]
call 0x40b080
add esp, 0x10
cmp eax, 0xe201117e
mov dword [edi + 8], edi
jne 0x40b041
mov dword [ebx + 0x28], 0x9f000001
lea eax, [ebp + 0xc]
or eax, 0x848b0689
cmp ebx, dword [esi + 0x5b]
mov esp, ebp
sub eax, edx
or al, 0xd6
nop
nop
nop
nop
nop
nop
nop
nop
pause
nop
nop
nop
nop
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
or eax, ecx
mov ebp, 0x43001048
add byte [eax], al
das
jno 0x40b027
enter 0xffffffffffff8408, 0x3a
and ah, byte [0x8d04568b]
dec ebp
or byte [edx], ch
push ecx
push edx
add byte [edx + 0x69], ch
push 0x69
push edx
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
jne 0x40b0f2
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileA]
call esi
test eax, eax
jne 0x40b0d2
mov ecx, dword [ebp + 0x14]
pop edi
cmp dl, bl
add dword [ecx], esi
ret
fiadd dword [ecx]
xor ebx, eax
call esi
add eax, 0xafc80
cmp eax, 0xfced
pop esi
cli
movsd dword es:[edi], dword [esi]
mov al, byte [0x8b000111]
dec ebp
adc al, 0x5f
pop esi
invalid
mov eax, dword [ebp - 0x31]
test eax, eax
jne 0x40b107
mov edx, dword [ebp + 0x14]
pop edi
pop esi
mov dword [edx], eax
mov eax, 0x710b
pop ebp
ret
cmp edi, eax
jbe 0x40b10d
sub al, 0xf9
mov eax, dword [esi - 0x25]
test eax, eax
je 0x40b137
mov al, byte [ebp + 0x75c98408]
mov dword [0x89af4e8b], eax
dec eax
or byte [ebx + 0x568b5046], cl
or byte [ecx], ah
and byte [eax], al
add byte [eax], al
arpl di, bx
fild dword [eax]
add byte [ebx + 0x42890c56], cl
or al, 0x31
inc esi
or al, 0x8b
pushal
or al, 0x53
xor dword [esi + 0xc], eax
mov esp, dword [eax + 0xc]
push ebx
lea eax, [esi + 0x59]
jo 0x40b0ce
push ebp
add al, 0x51
push edi
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40b15a
xor eax, eax
jmp 0x840b2d9
mov edi, dword [0xe475c098]
call edi
test eax, eax
pushfd
sub cl, byte [eax + 1]
add byte [eax], al
call edi
add eax, 0x540afc80
cmp eax, 0x725a0565
jne 0x40b24f
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, esp
adc al, 0x8b
invalid
cmp eax, 0xafca2
jne 0x40b268
mov ecx, dword [ebp + 0x14]
mov esi, dword [0x305f5b10]
loope 0x40b272
add dword [eax], eax
mov dword [ecx], edx
pop esi
pop ebp
ret
invalid
mov edx, dword [ebp + 0x10]
or eax, 0x147eb85f
add dword [eax], eax
pop ebx
adc dword [esi + 0x3f], ebx
or eax, dword [ebp - 0x74c78a40]
mov edi, 0x75c98510
adc cl, byte [ebx + 0x55de264d]
adc byte [edi + 0x5f], dh
mov eax, 0x5a013d7e
mov dword [ecx], edx
push ecx
pop ebp
mov ecx, dword [ebx - 0x2d7af3fe]
mov eax, dword [edx]
or al, 0x85
invalid
je 0x40b2bd
mov dl, byte [esi + 0x5e]