Function at 0x4b9327
Capabilities:
Read file on windows
Read pipe

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x190
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov qword [rbp + 0x28], r9
mov rax, qword [rbp + 0x18]
add rax, 0x88
mov rcx, qword [rax]
mov qword [rbp - 8], rcx
mov rax, qword [rbp - 8]
cmp rax, 0
jne 0x4b93e8
lea rax, [0x0051e7d7]
mov qword [rbp - 0x30], rax
mov eax, 0
mov dword [rbp - 0x28], eax
mov eax, 1
mov dword [rbp - 0x24], eax
mov eax, 0x10
mov r8, rax
lea rax, [rbp - 0x30]
mov r11, rax
lea rax, [rbp - 0x20]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov eax, 0
mov dword [rbp - 0x10], eax
movabs rax, 4
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0xc]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov rax, qword [rbp + 0x10]
mov ecx, 0x18
mov r8, rcx
lea rcx, [rbp - 0x20]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
jmp 0x4b9840
movabs rax, 0
mov qword [rbp - 0x38], rax
mov eax, dword [rbp + 0x20]
cmp eax, 1
jne 0x4b9414
mov rax, qword [rbp - 8]
add rax, 0x10020
mov rcx, qword [rax]
mov qword [rbp - 0x38], rcx
mov eax, dword [rbp + 0x20]
cmp eax, 2
jne 0x4b9432
mov rax, qword [rbp - 8]
add rax, 0x10030
mov rcx, qword [rax]
mov qword [rbp - 0x38], rcx
mov rax, qword [rbp - 0x38]
cmp rax, 0
jne 0x4b94d1
lea rax, [0x0051e7d8]
mov qword [rbp - 0x60], rax
mov eax, 0
mov dword [rbp - 0x58], eax
mov eax, 1
mov dword [rbp - 0x54], eax
mov eax, 0x10
mov r8, rax
lea rax, [rbp - 0x60]
mov r11, rax
lea rax, [rbp - 0x50]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov eax, 0
mov dword [rbp - 0x40], eax
movabs rax, 4
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x3c]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov rax, qword [rbp + 0x10]
mov ecx, 0x18
mov r8, rcx
lea rcx, [rbp - 0x50]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
jmp 0x4b9840
mov eax, 0
mov dword [rbp - 0x64], eax
movabs rax, 0
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x64]
mov qword [rsp + 0x20], rax
movabs rax, 0
mov r9, rax
mov eax, 0
mov r8, rax
movabs rax, 0
mov r11, rax
mov rax, qword [rbp - 0x38]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_PeekNamedPipe
cmp eax, 0
jne 0x4b95cb
lea rax, [0x0051e7d9]
mov qword [rbp - 0x90], rax
mov eax, 0
mov dword [rbp - 0x88], eax
mov eax, 1
mov dword [rbp - 0x84], eax
mov eax, 0x10
mov r8, rax
lea rax, [rbp - 0x90]
mov r11, rax
lea rax, [rbp - 0x80]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov eax, 0
mov dword [rbp - 0x70], eax
movabs rax, 4
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x6c]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov rax, qword [rbp + 0x10]
mov ecx, 0x18
mov r8, rcx
lea rcx, [rbp - 0x80]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
jmp 0x4b9840
mov eax, dword [rbp - 0x64]
cmp eax, 0
jne 0x4b9680
lea rax, [0x0051e7da]
mov qword [rbp - 0xb8], rax
mov eax, 0
mov dword [rbp - 0xb0], eax
mov eax, 1
mov dword [rbp - 0xac], eax
mov eax, 0x10
mov r8, rax
lea rax, [rbp - 0xb8]
mov r11, rax
lea rax, [rbp - 0xa8]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov eax, 0
mov dword [rbp - 0x98], eax
movabs rax, 4
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x94]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov rax, qword [rbp + 0x10]
mov ecx, 0x18
mov r8, rcx
lea rcx, [rbp - 0xa8]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
jmp 0x4b9840
mov eax, 0
mov dword [rbp - 0xbc], eax
mov eax, dword [rbp - 0x64]
add eax, 0x12c
movabs rcx, 0
mov qword [rsp + 0x20], rcx
mov ecx, 1
mov r9, rcx
mov ecx, 0
mov r8, rcx
mov r11, rax
lea rax, [rbp - 0x100]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.00446845
mov eax, 0x20
mov r8, rax
lea rax, [rbp - 0x100]
mov r11, rax
lea rax, [rbp - 0xe0]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov rax, qword [rbp - 0xd8]
movabs rcx, 0
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0xbc]
mov r9, rcx
mov ecx, dword [rbp - 0xc8]
mov r8, rcx
mov r11, rax
mov rax, qword [rbp - 0x38]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_ReadFile
lea rax, [rsp + 0x20]
mov ecx, 0x20
mov r8, rcx
lea rcx, [rbp - 0xe0]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov eax, dword [rbp - 0xbc]
mov r9, rax
mov eax, 0
mov r8, rax
lea r11, [rsp + 0x20]
lea rax, [rbp - 0x148]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.00444649
lea rax, [rsp + 0x20]
mov ecx, 0x20
mov r8, rcx
lea rcx, [rbp - 0x148]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea r11, [rsp + 0x20]
lea rax, [rbp - 0x128]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0044f638
mov eax, 0x10
mov r8, rax
lea rax, [rbp - 0x128]
mov r11, rax
lea rax, [rbp - 0x118]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov eax, dword [rbp - 0xbc]
mov dword [rbp - 0x108], eax
movabs rax, 4
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x104]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov rax, qword [rbp + 0x10]
mov ecx, 0x18
mov r8, rcx
lea rcx, [rbp - 0x118]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
leave
ret