Function at 0x1400010e0
Capabilities:
Acquire debug privileges
Connect pipe
Create pipe
Read file on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xb0]
sub rsp, 0x1b0
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x208], rbx
mov rax, qword [0x14001f008]
xor rax, rsp
mov qword [rbp + 0xa0], rax
mov r15, r8
mov r14d, edx
mov rdi, rcx
mov r8d, edx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
xor r12d, r12d
test rax, rax
jne 0x1400012af
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x1400012af
mov ebx, r12d
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
lea r9, [rsp + 0x48]
xor r8d, r8d
lea edx, [r12 + 0x28]
call qword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x1400011b3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3f0
jne 0x1400011e6
lea ecx, [r12 + 2]
call qword [sym.imp.ADVAPI32.dll_ImpersonateSelf]
test eax, eax
je 0x1400011e6
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
lea r9, [rsp + 0x48]
xor r8d, r8d
lea edx, [r12 + 0x28]
call qword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
je 0x1400011e6
lea r8, [rsp + 0x78]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x1400011f9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov qword [rdi], r12
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, 0xffffffff
jmp 0x140001554
mov dword [rbp - 0x80], 1
mov dword [rbp - 0x74], 2
mov rax, qword [rsp + 0x78]
mov qword [rbp - 0x7c], rax
mov esi, r12d
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x10
lea r8, [rbp - 0x80]
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x140001294
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14000126d
mov r8d, r14d
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
jne 0x140001272
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x140001272
mov esi, 5
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
mov r9d, dword [rsp + 0x50]
lea r8, [rbp - 0x70]
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
jmp 0x14000129c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov qword [rdi], rbx
test rbx, rbx
jne 0x1400012c5
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [rbx - 1]
jmp 0x140001554
xor edx, edx
mov r8d, pe_nt_image_headers64
lea rcx, [rbp - 0x60]
call fcn.140003850
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r9d, eax
mov dword [rsp + 0x20], ebx
lea r8, str..pipejavatool_d_d
mov edx, pe_nt_image_headers64
lea rcx, [rbp - 0x60]
call fcn.140001010
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], 0x2000
mov dword [rsp + 0x20], 0x80
mov r9d, 1
xor r8d, r8d
mov edx, r9d
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov rsi, rax
lea rcx, [rax + 1]
test rcx, 0xfffffffffffffffe
jne 0x140001350
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, 0xfffffffe
jmp 0x140001554
lea rax, [fcn.1400019a0]
lea r13, [0x1400018f0]
sub eax, r13d
mov ebx, eax
mov ecx, eax
call fcn.140007290
mov r14, rax
test rax, rax
je 0x140001546
mov r8d, ebx
mov rdx, r13
mov rcx, rax
call fcn.140005680
mov qword [rsp + 0x20], r15
lea r9, [rbp - 0x60]
mov r8d, ebx
mov rdx, r14
mov rcx, qword [rdi]
call fcn.1400019b0
mov ebx, eax
mov rcx, r14
call fcn.140006f98
mov rcx, rsi
test ebx, ebx
je 0x1400013bc
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xfffffffc
jmp 0x140001554
xor edx, edx
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x1400013e8
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x217
je 0x1400013e8
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xfffffffb
jmp 0x140001554
mov dword [rsp + 0x54], r12d
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], 0xf
mov byte [rsp + 0x58], r12b
mov word [rsp + 0x50], r12w
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x54]
mov r8d, 1
lea rdx, [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400014e1
nop dword [rax]
cmp byte [rsp + 0x50], 0xa
je 0x1400014e7
lea rax, [rsp + 0x50]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x140001447
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
mov rax, rdx
sub rax, rcx
cmp rbx, rax
ja 0x140001496
lea rax, [rcx + rbx]
mov qword [rsp + 0x68], rax
lea rdi, [rsp + 0x58]
cmp rdx, 0x10
cmovae rdi, qword [rsp + 0x58]
add rdi, rcx
mov r8, rbx
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.140005680
mov byte [rdi + rbx], 0
jmp 0x1400014ad
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x50]
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.1400015f0
cmp qword [rsp + 0x68], 0x20
ja 0x1400014e7
mov word [rsp + 0x50], r12w
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x54]
mov r8d, 1
lea rdx, [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140001430
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x58]
cmp qword [rsp + 0x70], 0x10
cmovae rcx, qword [rsp + 0x58]
call qword [sym.imp.SHLWAPI.dll_StrToIntA]
mov ebx, eax
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x140001542
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000153d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000157e
call fcn.140001ef0
mov eax, ebx
jmp 0x140001554
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xfffffffd
mov rcx, qword [rbp + 0xa0]
xor rcx, rsp
call fcn.140001e90
mov rbx, qword [rsp + 0x208]
add rsp, 0x1b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1400071e0
int3