Function at 0x402d1e
Capabilities:
Read file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov qword [rbp + 0x28], r9
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x10], rax
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x10]
mov dword [rbp - 4], eax
mov dword [rbp - 0x1c], 0
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x14]
test eax, eax
je 0x402e8b
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x14], 0
mov rax, qword [rbp + 0x10]
lea rdx, [rax + 0x18]
lea rcx, [rbp - 0x1c]
mov rax, qword [rbp + 0x18]
mov r9d, 0
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
call rax
test eax, eax
jne 0x402de0
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
cmp eax, 0xea
jne 0x402dbb
mov eax, dword [rbp - 0x1c]
mov r8d, eax
lea rdx, str.GetOverlappedResult:_ERROR_MORE_DATA__len_d_
mov ecx, 0
call fcn.004019b6
jmp 0x402de0
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 0x30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ResetEvent]
call rax
lea rcx, str.GetOverlappedResult
call fcn.00402b93
jmp 0x403014
mov eax, dword [rbp - 0x1c]
test eax, eax
jne 0x402e0c
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 0x30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ResetEvent]
call rax
lea rcx, str.fd_closed
call fcn.00401a4b
jmp 0x403014
mov eax, dword [rbp - 0x1c]
cmp dword [rbp - 4], eax
jne 0x402e31
shl dword [rbp - 4], 1
cmp dword [rbp - 4], 0x4000
jbe 0x402e27
mov dword [rbp - 4], 0x4000
mov rax, qword [rbp + 0x10]
mov edx, dword [rbp - 4]
mov dword [rax + 0x10], edx
mov edx, dword [rbp - 0x1c]
mov rax, qword [rbp + 0x20]
mov r8d, edx
mov edx, 0x72
mov rcx, rax
call fcn.00401a92
mov edx, dword [rbp - 0x1c]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call fcn.00401703
mov rdx, qword [rbp + 0x30]
mov rax, qword [rbp - 0x10]
mov r8, qword [rbp + 0x28]
mov rcx, rax
call r8
test eax, eax
jns 0x402e8b
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 0x30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ResetEvent]
call rax
mov eax, 0xffffffff
jmp 0x403014
lea rcx, [rbp - 0x24]
mov edx, dword [rbp - 4]
mov rax, qword [rbp - 0x10]
mov r8, rcx
mov rcx, rax
call fcn.00401649
mov qword [rbp - 0x18], rax
cmp qword [rbp - 0x18], 0
jne 0x402ed8
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 0x30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ResetEvent]
call rax
mov rax, qword [rbp + 0x20]
mov rdx, rax
lea rcx, str.failed_to_allocate__s_buffer
call fcn.00401a4b
jmp 0x403014
mov dword [rbp - 0x20], 0
mov rax, qword [rbp + 0x10]
lea rcx, [rax + 0x18]
mov r8d, dword [rbp - 0x24]
lea r9, [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
mov rax, qword [rbp + 0x18]
mov qword [rsp + 0x20], rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ReadFile]
call rax
test eax, eax
je 0x402fb8
mov eax, dword [rbp - 0x20]
test eax, eax
jne 0x402f3c
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 0x30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ResetEvent]
call rax
lea rcx, str.fd_closed
call fcn.00401a4b
jmp 0x403014
mov eax, dword [rbp - 0x20]
cmp dword [rbp - 4], eax
jne 0x402f61
shl dword [rbp - 4], 1
cmp dword [rbp - 4], 0x4000
jbe 0x402f57
mov dword [rbp - 4], 0x4000
mov rax, qword [rbp + 0x10]
mov edx, dword [rbp - 4]
mov dword [rax + 0x10], edx
mov edx, dword [rbp - 0x20]
mov rax, qword [rbp + 0x20]
mov r8d, edx
mov edx, 0x72
mov rcx, rax
call fcn.00401a92
mov edx, dword [rbp - 0x20]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call fcn.00401703
mov rdx, qword [rbp + 0x30]
mov rax, qword [rbp - 0x10]
mov r8, qword [rbp + 0x28]
mov rcx, rax
call r8
test eax, eax
jns 0x40300f
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 0x30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ResetEvent]
call rax
mov eax, 0xffffffff
jmp 0x403014
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
cmp eax, 0x6d
je 0x402fda
cmp eax, 0x3e5
jne 0x402fed
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x14], 1
jmp 0x40300f
lea rdx, str.child_process_has_closed_pipe
mov ecx, 0
call fcn.004019b6
jmp 0x40300f
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 0x30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ResetEvent]
call rax
lea rcx, str.failed_to_read
call fcn.00402b93
jmp 0x403014
mov eax, 0
add rsp, 0x60
pop rbp
ret