Function at 0x10009bf5
Capabilities:
Create pipe
Read file on windows
Terminate process

Disassembly:
sub esp, 0x88
push ebx
push ebp
xor eax, eax
mov dword [esp + 0x2c], 0xc
push esi
push edi
push eax
mov ebp, eax
mov dword [esp + 0x3c], eax
mov edi, eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov ebx, ecx
lea eax, [esp + 0x38]
mov dword [esp + 0x1c], ebp
push eax
lea eax, [esp + 0x28]
mov dword [esp + 0x44], 1
push eax
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x10009e4e
mov esi, dword [sym.imp.NTDLL.dll_RtlZeroMemory]
lea eax, [esp + 0x50]
push 0x44
push eax
call esi
mov eax, dword [esp + 0x20]
mov dword [esp + 0x90], eax
mov dword [esp + 0x8c], eax
lea eax, [esp + 0x40]
push 0x10
push eax
mov dword [esp + 0x58], 0x44
mov dword [esp + 0x84], 0x101
call esi
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x54]
push eax
xor eax, eax
push eax
push eax
push 0x8000000
push 1
push eax
push eax
push ebx
push eax
call dword [0x100268bc]
push dword [esp + 0x20]
mov ebx, dword [sym.imp.NTDLL.dll_NtClose]
mov esi, eax
call ebx
test esi, esi
je 0x10009e48
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x401
call ebp
push 8
pop edx
mov ecx, eax
call fcn.10007d5c
mov esi, eax
test esi, esi
je 0x10009e38
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 0xdbba0
and dword [esp + 0x14], edi
mov dword [esp + 0x30], eax
jmp 0x10009e01
mov eax, dword [esp + 0x14]
test eax, eax
je 0x10009e2e
xor ecx, ecx
push ecx
push ecx
mov byte [eax + esi], cl
push dword [esp + 0x1c]
push esi
push ecx
push 1
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [esp + 0x24], eax
test eax, eax
je 0x10009df1
lea eax, [eax*2 + 2]
push eax
call ebp
push 8
pop edx
mov ecx, eax
call fcn.10007d5c
mov dword [esp + 0x28], eax
test eax, eax
je 0x10009df1
push dword [esp + 0x24]
push eax
push dword [esp + 0x1c]
push esi
push 0
push 1
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x10009de4
xor eax, eax
push eax
push eax
push eax
push eax
push dword [esp + 0x34]
push dword [esp + 0x3c]
push eax
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, eax
mov dword [esp + 0x2c], ecx
test ecx, ecx
je 0x10009de4
mov eax, dword [esp + 0x18]
add eax, ecx
mov dword [esp + 0x18], eax
inc eax
push eax
test edi, edi
jne 0x10009d9b
call ebp
push 8
pop edx
mov ecx, eax
call fcn.10007d5c
jmp 0x10009da9
push edi
call ebp
mov ecx, eax
call fcn.1000501a
test eax, eax
je 0x10009dad
mov edi, eax
jmp 0x10009db9
push edi
call ebp
mov ecx, eax
call fcn.1000350d
xor edi, edi
test edi, edi
je 0x10009de4
mov ecx, dword [esp + 0x2c]
mov eax, edi
push 0
push 0
push ecx
sub eax, ecx
add eax, dword [esp + 0x24]
push eax
push dword [esp + 0x34]
push dword [esp + 0x3c]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push dword [esp + 0x28]
call ebp
mov ecx, eax
call fcn.1000350d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [esp + 0x30]
jae 0x10009e22
test edi, edi
je 0x10009e22
push 0
lea eax, [esp + 0x18]
push eax
push 0x400
push esi
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10009cf0
jmp 0x10009e2e
push 0
push dword [esp + 0x44]
call dword [sym.imp.NTDLL.dll_NtTerminateProcess]
push esi
call ebp
mov ecx, eax
call fcn.1000350d
push dword [esp + 0x44]
call ebx
push dword [esp + 0x40]
call ebx
mov ebp, dword [esp + 0x18]
push dword [esp + 0x1c]
call ebx
mov eax, dword [esp + 0x9c]
mov dword [eax], ebp
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x88
ret