Function at 0x140005d7d
Capabilities:
Read file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xf0
mov qword [rbp + 0x10], rcx
mov edx, 0x780000
mov ecx, 0x40
mov rax, qword [sym.imp.KERNEL32.dll_LocalAlloc]
call rax
mov qword [rbp - 0x10], rax
lea rax, [0x14004d007]
mov qword [str.BABUBE], rax
mov eax, dword [0x14004c210]
cmp eax, 0x29
jne 0x140005de5
mov rax, qword [str.BABUBE]
mov qword [rbp - 0x18], rax
mov byte [0x14004c1f0], 0
mov dword [0x14004c210], 0x349
mov rax, qword [rbp - 0x18]
mov qword [str.BABUBE], rax
jmp 0x140005e30
mov byte [0x14004c220], 1
mov dword [0x14004c210], 0x1218e
mov edx, dword [0x14004c210]
lea rax, [rbp - 0x90]
mov rcx, rax
call method.std::__cxx11.to_string_int_
lea rax, [rbp - 0x90]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.c_str___const
mov qword [str.BABUBE], rax
lea rax, [rbp - 0x90]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string__
mov dword [0x14004c210], 0x29
cmp qword [rbp - 0x10], 0
je 0x1400060a0
mov dword [rbp - 4], 0x77fd0
jmp 0x14000602b
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 0xb0]
mov ecx, dword [rbp - 4]
mov rdx, qword [rbp - 0x10]
mov r8d, ecx
mov rcx, rax
call sym.PipePeek_void__void__int_
lea rax, [0x14004d007]
mov qword [str.BABUBE], rax
mov eax, dword [0x14004c210]
cmp eax, 0x29
jne 0x140005eb0
mov rax, qword [str.BABUBE]
mov qword [rbp - 0x20], rax
mov byte [0x14004c1f0], 0
mov dword [0x14004c210], 0x349
mov rax, qword [rbp - 0x20]
mov qword [str.BABUBE], rax
jmp 0x140005ef2
mov byte [0x14004c220], 1
mov dword [0x14004c210], 0x1218e
mov edx, dword [0x14004c210]
lea rax, [rbp - 0x70]
mov rcx, rax
call method.std::__cxx11.to_string_int_
lea rax, [rbp - 0x70]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.c_str___const
mov qword [str.BABUBE], rax
lea rax, [rbp - 0x70]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string__
mov dword [0x14004c210], 0x29
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 0xa0]
mov dword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x11001c
lea rdx, [rbp - 0xa0]
mov qword [rsp + 0x20], rdx
mov r9d, 0
mov r8d, 0
mov edx, 0
mov rcx, rax
call sym.NtFsControlFile
not eax
shr eax, 0x1f
test al, al
je 0x140006024
mov rax, qword [rbp + 0x10]
mov rcx, rax
call sym.ResetImpersioationToken_mm_
test eax, eax
sete al
test al, al
je 0x140006024
lea rax, [0x14004d007]
mov qword [str.BABUBE], rax
mov eax, dword [0x14004c210]
cmp eax, 0x29
jne 0x140005fbe
mov rax, qword [str.BABUBE]
mov qword [rbp - 0x28], rax
mov byte [0x14004c1f0], 0
mov dword [0x14004c210], 0x349
mov rax, qword [rbp - 0x28]
mov qword [str.BABUBE], rax
jmp 0x140006000
mov byte [0x14004c220], 1
mov dword [0x14004c210], 0x1218e
mov edx, dword [0x14004c210]
lea rax, [rbp - 0x50]
mov rcx, rax
call method.std::__cxx11.to_string_int_
lea rax, [rbp - 0x50]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.c_str___const
mov qword [str.BABUBE], rax
lea rax, [rbp - 0x50]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string__
mov dword [0x14004c210], 0x29
mov rax, qword [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LocalFree]
call rax
mov eax, 0
jmp 0x1400060bc
add dword [rbp - 4], 0x77fd0
cmp dword [rbp - 4], 0x7f7ccf
jle 0x140005e51
mov dword [rbp - 8], 0
jmp 0x140006098
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 0xb0]
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0x77fd0
mov rdx, qword [rbp - 0x10]
mov qword [rsp + 0x28], rdx
lea rdx, [rbp - 0xa0]
mov qword [rsp + 0x20], rdx
mov r9d, 0
mov r8d, 0
mov edx, 0
mov rcx, rax
call sym.NtReadFile
add dword [rbp - 8], 1
cmp dword [rbp - 8], 0xf
jle 0x140006041
jmp 0x1400060a7
mov eax, 1
jmp 0x1400060bc
mov rax, qword [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LocalFree]
call rax
mov eax, 0
add rsp, 0xf0
pop rbp
ret