Function at 0x140007350
Capabilities:
Read file on windows
Read pipe

Disassembly:
push rbx
push rsi
push rdi
push r12
push r14
push r15
push rbp
sub rsp, 0x50
xor edi, edi
mov ebp, dword [rsp + 0xb8]
mov rsi, r9
mov r14, rdx
xor r15d, r15d
test rcx, rcx
je 0x140007bc6
test rsi, rsi
je 0x140007bc6
test r14, r14
je 0x140007bc6
xor eax, eax
mov dword [rsp + 0x4c], eax
mov dword [rsp + 0x48], eax
cmp dword [rcx], 1
jne 0x1400077c1
test byte [rsi], 5
je 0x14000773d
mov r12, qword [rsp + 0xc0]
mov eax, dword [r12]
test eax, eax
jne 0x1400073e8
mov ecx, 1
mov edx, 0x10000
call qword [sym.imp.MSVCR100.dll_calloc]
mov rdx, qword [rsp + 0xb0]
test rax, rax
mov qword [rdx], rax
je 0x140007b27
mov dword [r12], 0x10000
mov eax, 0x10000
cmp eax, ebp
jg 0x14000742e
mov ebx, eax
sar ebx, 0xf
shr ebx, 0x10
add ebx, eax
and ebx, 0xffff0000
mov rax, qword [rsp + 0xb0]
add ebx, 0x10000
mov rdx, rbx
mov rcx, qword [rax]
call qword [sym.imp.MSVCR100.dll_realloc]
mov rdx, qword [rsp + 0xb0]
test rax, rax
mov qword [rdx], rax
je 0x140007a97
mov dword [r12], ebx
mov rbx, qword [rsp + 0xc8]
mov dword [rbx], 0
cmp qword [rsi + 8], 0xffffffffffffffff
jne 0x1400074d6
mov dword [r14], 0xeb
mov dword [r14 + 0xd4], 0
mov byte [r14 + 0x1e], 0
mov word [r14 + 0x1c], 0x7475
mov dword [r14 + 0x18], 0x7074756f
mov dword [r14 + 0x14], 0x5f746567
mov dword [r14 + 0x10], 0x5f737365
mov dword [r14 + 0xc], 0x636f7270
mov dword [r14 + 8], 0x5f73706d
mov dword [r14 + 4], 0x76727073
mov word [r14 + 0x3d], 0x65
mov dword [r14 + 0x39], 0x6c646e61
mov dword [r14 + 0x35], 0x48206570
mov dword [r14 + 0x31], 0x69702064
mov dword [r14 + 0x2d], 0x657a696c
mov dword [r14 + 0x29], 0x61697469
mov dword [r14 + 0x25], 0x6e696e75
mov edi, 0xeb
jmp 0x14000783b
mov rcx, qword [rsi + 0x18]
lea rdx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [rsp + 0x4c], 0x103
je 0x140007534
xor edx, edx
xor r8d, r8d
mov rcx, qword [rsi + 8]
xor r9d, r9d
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x140007520
mov eax, dword [rsp + 0x48]
test eax, eax
jne 0x140007576
cmp dword [rsi + 0x38], 1
je 0x14000784c
mov edi, 3
jmp 0x14000783b
xor edx, edx
xor r8d, r8d
mov rcx, qword [rsi + 8]
xor r9d, r9d
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
jne 0x140007567
mov edi, 3
jmp 0x14000783b
mov eax, dword [rsp + 0x48]
test eax, eax
jne 0x140007576
xor edi, edi
jmp 0x14000783b
mov dword [rsp + 0x40], r15d
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], r13
mov r13d, eax
mov edx, dword [r12]
mov r15d, edx
sub r15d, ebp
xor r14d, r14d
cmp r13d, r15d
jbe 0x1400075f5
mov r15d, edx
sar r15d, 0xf
shr r15d, 0x10
add r15d, edx
and r15d, 0xffff0000
mov r8, qword [rsp + 0xb0]
add r15d, 0x10000
mov rdx, r15
mov rcx, qword [r8]
call qword [sym.imp.MSVCR100.dll_realloc]
mov rdx, qword [rsp + 0xb0]
test rax, rax
mov qword [rdx], rax
je 0x140007956
mov dword [r12], r15d
sub r15d, ebp
cmp r13d, r15d
jbe 0x1400075f5
mov r14d, 1
jmp 0x140007678
cmp r15d, 1
jne 0x140007631
cmp dword [rsi + 0x38], 1
je 0x14000786f
mov rax, qword [rsp + 0xb0]
mov r8d, 1
movsxd rdx, ebp
mov r9, rbx
mov rcx, qword [rsi + 8]
add rdx, qword [rax]
mov qword [rsp + 0x20], 0
call qword [sym.imp.orauts.dll_ReadFile]
jmp 0x14000765b
mov rax, qword [rsp + 0xb0]
dec r15d
movsxd rdx, ebp
mov r8d, r15d
mov rcx, qword [rsi + 8]
mov r9, rbx
add rdx, qword [rax]
mov qword [rsp + 0x20], 0
call qword [sym.imp.orauts.dll_ReadFile]
test eax, eax
je 0x1400078df
mov edx, 3
cmp dword [rsp + 0x4c], 0x103
mov r13d, dword [rsp + 0x48]
cmovne edi, edx
test r14d, r14d
jne 0x140007588
mov rcx, qword [rsp + 0xb0]
xor eax, eax
mov r15d, dword [rsp + 0x40]
mov r13, qword [rsp + 0x38]
mov rcx, qword [rcx]
cmp dword [rsi + 0x38], 0
je 0x1400076cd
cmp byte [rcx], 0xa
je 0x14000789f
mov eax, dword [rbx]
test eax, eax
jbe 0x1400076bd
mov edx, eax
dec edx
movzx ebp, byte [rdx + rcx]
mov byte [rax + rcx], bpl
mov eax, edx
jne 0x1400076ad
mov byte [rcx], 0xd
mov eax, 1
mov edx, dword [rbx]
inc edx
mov dword [rbx], edx
jmp 0x1400076cf
mov edx, dword [rbx]
dec edx
cmp byte [rdx + rcx], 0xd
je 0x1400078c5
mov dword [rsi + 0x38], 0
mov esi, dword [rbx]
mov ebp, eax
lea r8d, [rsi - 2]
mov edx, esi
cmp eax, r8d
ja 0x140007719
cmp esi, 2
jb 0x140007719
mov eax, eax
movsx esi, byte [rax + rcx]
inc eax
cmp esi, 0xd
je 0x1400078ab
mov byte [rbp + rcx], sil
inc ebp
mov esi, dword [rbx]
lea r8d, [rsi - 2]
cmp eax, r8d
jbe 0x1400076f1
dec esi
cmp eax, esi
jne 0x14000772a
mov eax, eax
movzx esi, byte [rax + rcx]
mov byte [rbp + rcx], sil
mov dword [rbx], edx
test r15d, r15d
je 0x14000783b
add dword [rbx], r15d
jmp 0x14000783b
mov dword [r14], 0xeb
mov edi, 7
mov dword [r14 + 0xd4], 0
mov byte [r14 + 0x1e], 0
mov word [r14 + 0x1c], 0x7475
mov dword [r14 + 0x18], 0x7074756f
mov dword [r14 + 0x14], 0x5f746567
mov dword [r14 + 0x10], 0x5f737365
mov dword [r14 + 0xc], 0x636f7270
mov dword [r14 + 8], 0x5f73706d
mov dword [r14 + 4], 0x76727073
mov word [r14 + 0x39], 0x64
mov dword [r14 + 0x35], 0x657a696c
mov dword [r14 + 0x31], 0x61697469
mov dword [r14 + 0x2d], 0x6e696e75
mov dword [r14 + 0x29], 0x206c6468
mov dword [r14 + 0x25], 0x636f7270
jmp 0x14000783b
mov dword [r14], 0xeb
mov edi, 6
mov dword [r14 + 0xd4], 0
mov byte [r14 + 0x1e], 0
mov word [r14 + 0x1c], 0x7475
mov dword [r14 + 0x18], 0x7074756f
mov dword [r14 + 0x14], 0x5f746567
mov dword [r14 + 0x10], 0x5f737365
mov dword [r14 + 0xc], 0x636f7270
mov dword [r14 + 8], 0x5f73706d
mov dword [r14 + 4], 0x76727073
mov word [r14 + 0x35], 0x64
mov dword [r14 + 0x31], 0x657a696c
mov dword [r14 + 0x2d], 0x61697469
mov dword [r14 + 0x29], 0x6e696e75
mov dword [r14 + 0x25], 0x20787463
mov eax, edi
add rsp, 0x50
pop rbp
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
ret
mov rax, qword [rsp + 0xb0]
xor edi, edi
movsxd rbp, ebp
mov rdx, qword [rax]
mov byte [rdx + rbp], 0xd
mov dword [rsi + 0x38], 0
mov dword [rbx], 1
jmp 0x14000783b
mov rax, qword [rsp + 0xb0]
xor edi, edi
mov r15d, dword [rsp + 0x40]
mov r13, qword [rsp + 0x38]
movsxd rbp, ebp
mov rdx, qword [rax]
mov byte [rdx + rbp], 0xd
mov dword [rsi + 0x38], 0
mov dword [rbx], 1
jmp 0x14000772c
mov edx, dword [rbx]
mov eax, 1
jmp 0x1400076cf
cmp byte [rax + rcx], 0xa
jne 0x140007707
dec edx
inc eax
mov byte [rbp + rcx], 0xa
inc ebp
jmp 0x14000770e
mov dword [rsi + 0x38], 1
mov edx, dword [rbx]
dec edx
mov byte [rdx + rcx], 0
mov esi, dword [rbx]
dec esi
mov dword [rbx], esi
jmp 0x1400076e4
call qword [sym.imp.orauts.dll_GetLastError]
cmp eax, 0xea
jne 0x140007a14
mov eax, dword [r12]
mov r13d, eax
sar r13d, 0xf
shr r13d, 0x10
add r13d, eax
and r13d, 0xffff0000
mov r8, qword [rsp + 0xb0]
add r13d, 0x10000
mov rdx, r13
mov rcx, qword [r8]
call qword [sym.imp.MSVCR100.dll_realloc]
mov rdx, qword [rsp + 0xb0]
test rax, rax
mov qword [rdx], rax
je 0x140007956
mov dword [r12], r13d
mov r14d, 1
mov eax, dword [rbx]
add ebp, eax
mov dword [rsp + 0x40], eax
mov dword [rbx], 0
mov r13d, dword [rsp + 0x48]
jmp 0x140007678
mov r14, qword [rsp + 0x30]
mov edi, 4
mov r15d, dword [rsp + 0x40]
mov r13, qword [rsp + 0x38]
mov dword [r14], 0xeb
mov dword [r14 + 0xd4], 0
mov byte [r14 + 0x1e], 0
mov word [r14 + 0x1c], 0x7475
mov dword [r14 + 0x18], 0x7074756f
mov dword [r14 + 0x14], 0x5f746567
mov dword [r14 + 0x10], 0x5f737365
mov dword [r14 + 0xc], 0x636f7270
mov dword [r14 + 8], 0x5f73706d
mov dword [r14 + 4], 0x76727073
mov word [r14 + 0x4d], 0x67
mov dword [r14 + 0x49], 0x6e696461
mov dword [r14 + 0x45], 0x65722065
mov dword [r14 + 0x41], 0x6c696877
mov dword [r14 + 0x3d], 0x2079726f
mov dword [r14 + 0x39], 0x6d656d20
mov dword [r14 + 0x35], 0x65746163
mov dword [r14 + 0x31], 0x6f6c6c61
mov dword [r14 + 0x2d], 0x6572206f
mov dword [r14 + 0x29], 0x7420656c
mov dword [r14 + 0x25], 0x62616e75
jmp 0x14000772c
mov r14, qword [rsp + 0x30]
mov r15d, dword [rsp + 0x40]
mov r13, qword [rsp + 0x38]
mov dword [r14], 0xed
mov dword [r14 + 0xd4], eax
mov byte [r14 + 0x1e], 0
mov word [r14 + 0x1c], 0x7475
mov dword [r14 + 0x18], 0x7074756f
mov dword [r14 + 0x14], 0x5f746567
mov dword [r14 + 0x10], 0x5f737365
mov dword [r14 + 0xc], 0x636f7270
mov dword [r14 + 8], 0x5f73706d
mov dword [r14 + 4], 0x76727073
mov dword [r14 + 0x31], 0x64656c
mov dword [r14 + 0x2d], 0x69616620
mov dword [r14 + 0x29], 0x656c6946
mov dword [r14 + 0x25], 0x64616552
mov edi, 0xeb
jmp 0x14000772c
mov dword [r14], 0xeb
mov edi, 4
mov dword [r14 + 0xd4], 0
mov byte [r14 + 0x1e], 0
mov word [r14 + 0x1c], 0x7475
mov dword [r14 + 0x18], 0x7074756f
mov dword [r14 + 0x14], 0x5f746567
mov dword [r14 + 0x10], 0x5f737365
mov dword [r14 + 0xc], 0x636f7270
mov dword [r14 + 8], 0x5f73706d
mov dword [r14 + 4], 0x76727073
mov dword [r14 + 0x3d], 0x79726f
mov dword [r14 + 0x39], 0x6d656d20
mov dword [r14 + 0x35], 0x65746163
mov dword [r14 + 0x31], 0x6f6c6c61
mov dword [r14 + 0x2d], 0x6572206f
mov dword [r14 + 0x29], 0x7420656c
mov dword [r14 + 0x25], 0x62616e75
jmp 0x14000783b
mov dword [r14], 0xeb
mov edi, 4
mov dword [r14 + 0xd4], 0
mov byte [r14 + 0x1e], 0
mov word [r14 + 0x1c], 0x7475
mov dword [r14 + 0x18], 0x7074756f
mov dword [r14 + 0x14], 0x5f746567
mov dword [r14 + 0x10], 0x5f737365
mov dword [r14 + 0xc], 0x636f7270
mov dword [r14 + 8], 0x5f73706d
mov dword [r14 + 4], 0x76727073
mov word [r14 + 0x45], 0x79
mov dword [r14 + 0x41], 0x726f6d65
mov dword [r14 + 0x3d], 0x6d206c61
mov dword [r14 + 0x39], 0x6974696e
mov dword [r14 + 0x35], 0x69206574
mov dword [r14 + 0x31], 0x61636f6c
mov dword [r14 + 0x2d], 0x6c61206f
mov dword [r14 + 0x29], 0x7420656c
mov dword [r14 + 0x25], 0x62616e75
jmp 0x14000783b
mov edi, 5
jmp 0x14000783b