Function at 0x140016b10
Capabilities:
Read file on windows
Read pipe

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xa0
mov rax, qword [0x1404953c0]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov r14, rcx
xor r15d, r15d
mov esi, r15d
mov dword [rbp - 0x11], r15d
lea rax, [rbp - 0x11]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x140016d89
lea r12, str.Sledgehammer
lea r13, str.Invalid_parameter__p__u
mov ecx, dword [rbp - 0x11]
test ecx, ecx
je 0x140016d89
mov eax, esi
inc esi
cmp eax, 0x64
ja 0x140016e5c
mov dword [rbp - 0xd], r15d
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 9], xmm0
mov qword [rbp + 7], rax
mov edi, ecx
movdqu xmmword [rbp - 9], xmm0
mov qword [rbp + 7], r15
test ecx, ecx
je 0x140016be6
mov edx, ecx
lea rcx, [rbp - 9]
call fcn.14001fd90
lea rax, [rbp - 9]
mov qword [rbp - 0x19], rax
mov rcx, qword [rbp - 9]
lea rbx, [rdi + rcx]
mov r8d, edi
xor edx, edx
call fcn.140306610
mov qword [rbp - 1], rbx
mov qword [rbp - 0x19], r15
mov r8d, dword [rbp - 1]
mov rdx, qword [rbp - 9]
sub r8d, edx
mov qword [rsp + 0x20], r15
lea r9, [rbp - 0xd]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140016db8
mov ebx, dword [rbp - 0xd]
test ebx, ebx
je 0x140016db8
mov rdi, qword [rbp - 9]
test rdi, rdi
je 0x140016cda
cmp ebx, 8
jb 0x140016cda
movzx ecx, word [rdi + 4]
lea eax, [rcx*2 + 8]
cmp ebx, eax
jae 0x140016c6a
call fcn.14001d6f0
mov rcx, qword [rax]
mov r10, qword [rcx + 0x20]
movzx ecx, word [rdi + 4]
mov dword [rsp + 0x40], ecx
mov dword [rsp + 0x38], ebx
lea rcx, str.Inconsistent_length__u__u
mov qword [rsp + 0x30], rcx
mov r9d, 0x7e
jmp 0x140016cfa
mov r8, rcx
xorps xmm0, xmm0
movups xmmword [rbp + 0xf], xmm0
mov qword [rbp + 0x1f], r15
mov qword [rbp + 0x27], r15
lea rdx, [rdi + 6]
lea rcx, [rbp + 0xf]
call fcn.140030be0
nop
call fcn.14001d6f0
mov rcx, qword [rax]
mov r10, qword [rcx + 0x18]
lea rdx, [rbp + 0xf]
cmp qword [rbp + 0x27], 7
cmova rdx, qword [rbp + 0xf]
mov ecx, dword [rdi]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], ecx
mov r9d, 0x83
lea r8, str.D:JenkinsworkspaceA_MBAM3_UPDATEREXE_srcPackagesSledgehammer.5.1.0.88_build_nativeincludeLogging.h
lea rdx, [0x140412418]
mov rcx, rax
call r10
nop
lea rcx, [rbp + 0xf]
call fcn.1400166f0
jmp 0x140016d1c
call fcn.14001d6f0
mov rcx, qword [rax]
mov r10, qword [rcx + 0x20]
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r13
mov r9d, 0x77
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], 2
lea r8, str.D:JenkinsworkspaceA_MBAM3_UPDATEREXE_srcPackagesSledgehammer.5.1.0.88_build_nativeincludeLogging.h
lea rdx, [0x140412418]
mov rcx, rax
call r10
nop
mov rcx, qword [rbp - 9]
test rcx, rcx
je 0x140016d62
mov rdx, qword [rbp + 7]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016d51
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140016e9f
call fcn.1402b5c4c
xorps xmm0, xmm0
movdqu xmmword [rbp - 9], xmm0
mov qword [rbp + 7], r15
lea rax, [rbp - 0x11]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
jne 0x140016b81
mov al, 1
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.1402b5c00
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14001d6f0
nop
mov rdi, rax
mov rcx, qword [rax]
mov rbx, qword [rcx + 0x20]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x48], eax
mov ecx, dword [rbp - 0xd]
mov dword [rsp + 0x40], ecx
mov ecx, dword [rbp - 0x11]
mov dword [rsp + 0x38], ecx
lea rax, str.Read_error.__u__u__u
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], 2
mov r9d, 0x67
lea r8, str.D:JenkinsworkspaceA_MBAM3_UPDATEREXE_srcPackagesSledgehammer.5.1.0.88_build_nativeincludeLogging.h
lea rdx, [0x140412418]
mov rcx, rdi
call rbx
nop
mov rcx, qword [rbp - 9]
test rcx, rcx
je 0x140016e55
mov rdx, qword [rbp + 7]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016e44
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140016e9f
call fcn.1402b5c4c
xorps xmm0, xmm0
movdqu xmmword [rbp - 9], xmm0
mov qword [rbp + 7], r15
xor al, al
jmp 0x140016d8b
call fcn.14001d6f0
mov r10, qword [rax]
lea rcx, str.Limit_reached
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], 2
mov r9d, 0x5f
lea r8, str.D:JenkinsworkspaceA_MBAM3_UPDATEREXE_srcPackagesSledgehammer.5.1.0.88_build_nativeincludeLogging.h
lea rdx, [0x140412418]
mov rcx, rax
call qword [r10 + 0x18]
xor al, al
jmp 0x140016d8b
call fcn.1402c5d0c
int3