Function at 0x140056910
Capabilities:
Get file attributes
Read file on windows
Read pipe

Disassembly:
mov r11, rsp
push rbx
push r15
sub rsp, 0xa8
mov rax, qword [0x1400f54e0]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov r15d, edx
mov rbx, rcx
cmp rcx, 0x1000
jb 0x140056c89
movabs rax, 0xffff800000000000
test rax, rcx
jne 0x140056c89
cmp dword [rcx], 0x19570528
jne 0x140056c89
mov qword [r11 - 0x20], rdi
mov qword [r11 - 0x28], r12
mov qword [r11 - 0x30], r13
call fcn.140041b40
lea rcx, [rbx + 0x60]
mov r13, rax
call fcn.1400518e0
mov edi, eax
test eax, eax
js 0x140056c59
mov qword [rsp + 0xd0], rbp
mov qword [rsp + 0xa0], rsi
xor esi, esi
mov qword [rsp + 0x80], r14
mov r14d, esi
nop dword [rax]
nop word [rax + rax]
cmp byte [rbx + 0x10], 0
mov rbp, 0xffffffffffffffff
movzx eax, byte [rbx + 0x12]
je 0x140056a9e
test al, al
je 0x1400569d2
mov rbp, qword [rbx + 0x38]
jmp 0x140056a85
mov rcx, qword [rbx + 8]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rsi
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x140056a02
cmp dword [rsp + 0x30], 0
ja 0x140056bc6
test r15d, r15d
je 0x140056bd1
cmp dword [rbx + 0x18], 0
jne 0x140056bca
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, qword [rbx + 8]
lea rdx, [rbx + 0x90]
mov edi, eax
mov dword [rsp + 0x34], esi
lea rax, [rbx + 0x20]
xor r8d, r8d
lea r9, [rsp + 0x34]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140056a5a
mov edi, esi
cmp r14d, 0xa
jbe 0x140056ac2
call fcn.140041a20
jmp 0x140056ac2
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x140056a76
inc dword [rbx + 0x18]
mov rbp, qword [rbx + 0x38]
mov word [rbx + 0x12], 0x101
jmp 0x140056a85
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14005db40
mov edi, eax
test edi, edi
jns 0x140056ac2
cmp edi, 0xfffffed3
jne 0x140056c36
mov byte [rbx + 0x14], 1
jmp 0x140056c36
test al, al
je 0x140056bd8
mov rcx, rbx
call fcn.140055780
mov edi, eax
test eax, eax
js 0x140056a89
cmp byte [rbx + 0x12], 0
je 0x140056bd8
mov rbp, qword [rbx + 0x38]
mov esi, 0xffffffff
cmp r15d, esi
je 0x140056af2
cmp rbp, 0xffffffffffffffff
jne 0x140056adc
cmp r14d, 0xa
jbe 0x140056bbc
call fcn.140041b40
sub rax, r13
cmp rax, r15
jae 0x140056bd1
mov esi, r15d
sub esi, eax
cmp rbp, 0xffffffffffffffff
je 0x140056bbc
lea rcx, [rbx + 0x60]
call fcn.140051ac0
mov edx, esi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140056b18
xor edi, edi
jmp 0x140056b53
cmp eax, 0x102
jne 0x140056b26
mov edi, 0xffffffd8
jmp 0x140056b47
cmp eax, 0x80
jne 0x140056b34
mov edi, 0xfffffffc
jmp 0x140056b47
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14005db40
mov edi, eax
test eax, eax
jns 0x140056b53
cmp dword [rbx], 0x19570528
jne 0x140056c3f
lea rcx, [rbx + 0x60]
call fcn.1400518e0
cmp byte [rbx + 0x13], 0
je 0x140056bb4
dec dword [rbx + 0x18]
mov byte [rbx + 0x12], 0
test edi, edi
je 0x140056b93
mov rcx, qword [rbx + 8]
lea rdx, [rsp + 0x40]
xor eax, eax
mov dword [rsp + 0x40], 0xc0000365
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x48], 0xffffffffffffffd5
call qword [sym.imp.ntdll.dll_NtCancelIoFile]
mov rcx, qword [rbx + 8]
lea rdx, [rbx + 0x20]
mov r9d, 1
mov dword [rsp + 0x38], 0
lea r8, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test edi, edi
js 0x140056a89
inc r14d
xor esi, esi
jmp 0x1400569b0
mov edi, esi
jmp 0x140056c36
mov edi, 0xffffff1b
jmp 0x140056c36
mov edi, 0xffffffd8
jmp 0x140056c36
xor edx, edx
lea rcx, [rsp + 0x40]
mov edi, esi
lea r8d, [rdx + 0x10]
call sym.vkat.exe_nocrt_memset
xor edx, edx
lea rcx, [rsp + 0x50]
lea r8d, [rdx + 0x28]
call sym.vkat.exe_nocrt_memset
mov rcx, qword [rbx + 8]
lea r8, [rsp + 0x50]
mov r9d, 0x28
mov dword [rsp + 0x20], 0x18
lea rdx, [rsp + 0x40]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
js 0x140056c32
cmp dword [rsp + 0x70], 4
jne 0x140056c32
mov edi, 0xfffffed3
mov byte [rbx + 0x14], 1
jmp 0x140056c36
mov byte [rbx + 0x15], 1
lea rcx, [rbx + 0x60]
call fcn.140051ac0
mov rbp, qword [rsp + 0xd0]
mov eax, edi
mov rsi, qword [rsp + 0xa0]
mov r14, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x98]
mov r12, qword [rsp + 0x90]
mov r13, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140001270
add rsp, 0xa8
pop r15
pop rbx
ret
mov eax, 0xfffffffc
jmp 0x140056c71