Function at 0x422ca0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x475c
call fcn.00517a10
mov eax, dword [0x58f860]
xor eax, ebp
mov dword [ebp - 0x48], eax
push str..pipePCMasterSvc
lea ecx, [ebp - 4]
call fcn.0041c8a0
mov dword [ebp - 0x10], 0x800
mov dword [ebp - 0xc], 0
push 0
push 0
push 3
push 0
push 0
push 0x40000000
lea ecx, [ebp - 4]
call fcn.0041cb20
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x423026
push 0xffffffffffffffff
lea ecx, [ebp - 4]
call fcn.0041cb20
push eax
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
je 0x423010
mov dword [ebp - 0x14], 0
push 0x800
call fcn.004c8580
add esp, 4
mov dword [ebp - 0x4740], eax
mov eax, dword [ebp - 0x4740]
push eax
lea ecx, [ebp - 0x40]
call fcn.0048b9f0
push 0x800
push 0
lea ecx, [ebp - 0x40]
call fcn.0048ba50
push eax
call fcn.00512af0
add esp, 0xc
mov dword [ebp - 0x4744], 0x1000
lea ecx, [ebp - 0x4744]
push ecx
mov edx, 0x800
sub edx, dword [ebp - 0x14]
push edx
lea ecx, [ebp - 0x40]
call fcn.0048ba50
add eax, dword [ebp - 0x14]
push eax
call fcn.004bf270
add esp, 0xc
add eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x10]
push eax
mov ecx, 0x800
sub ecx, dword [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x40]
call fcn.0048ba50
add eax, dword [ebp - 0x14]
push eax
call fcn.004bf2b0
add esp, 0xc
add eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
lea edx, [ebp + 8]
push edx
mov eax, 0x800
sub eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 0x40]
call fcn.0048ba50
add eax, dword [ebp - 0x14]
push eax
call fcn.0042ff40
add esp, 0xc
add eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
lea ecx, [ebp + 0xc]
push ecx
mov edx, 0x800
sub edx, dword [ebp - 0x14]
push edx
lea ecx, [ebp - 0x40]
call fcn.0048ba50
add eax, dword [ebp - 0x14]
push eax
call fcn.0042ff40
add esp, 0xc
add eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push eax
call fcn.0042ffc0
push 0x54db14
lea ecx, [ebp - 0x44]
push ecx
lea ecx, [ebp - 0x20]
call fcn.00430000
lea edx, [ebp + 8]
push edx
push 0x54db3c
lea eax, [ebp - 0x4748]
push eax
call fcn.0047e630
add esp, 0xc
push eax
lea ecx, [ebp - 0x44]
call fcn.0047dc30
lea ecx, [ebp - 0x4748]
call fcn.0040f740
lea ecx, [ebp + 0xc]
call fcn.0041cc40
movzx ecx, al
test ecx, ecx
jne 0x422e81
lea edx, [ebp + 0xc]
push edx
push 0x54db40
lea eax, [ebp - 0x474c]
push eax
call fcn.0047e630
add esp, 0xc
push eax
lea ecx, [ebp - 0x44]
call fcn.0047dc30
lea ecx, [ebp - 0x474c]
call fcn.0040f740
lea ecx, [ebp - 0x3c]
call fcn.0042e670
push ecx
mov ecx, esp
push str.pcmasterconfigpcmastersrv.cfg
call fcn.0041c8a0
push ecx
push esp
lea ecx, [ebp - 0x3c]
call fcn.0042f0c0
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x3c]
call fcn.0042e910
push 1
push ecx
mov ecx, esp
lea edx, [ebp - 0x44]
push edx
call fcn.0041c880
lea ecx, [ebp - 0x18]
call fcn.0041cb20
push eax
call fcn.00423060
add esp, 0xc
mov eax, dword [ebp - 0x14]
xor edx, edx
mov ecx, 8
div ecx
test edx, edx
je 0x422ef4
mov eax, dword [ebp - 0x14]
xor edx, edx
mov ecx, 8
div ecx
mov eax, 8
sub eax, edx
add eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x3738], 0
push 0xfff
push 0
lea ecx, [ebp - 0x3737]
push ecx
call fcn.00512af0
add esp, 0xc
mov byte [ebp - 0x4738], 0
push 0xfff
push 0
lea edx, [ebp - 0x4737]
push edx
call fcn.00512af0
add esp, 0xc
push 0
push str._ruanmeipcmaster_svc_named_pipe
lea ecx, [ebp - 0x2738]
call fcn.0042f150
push 0
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 0x40]
call fcn.0048ba50
push eax
lea ecx, [ebp - 0x2738]
call fcn.0042f6a0
mov ecx, dword [ebp - 0x14]
shl ecx, 3
push ecx
lea edx, [ebp - 0x3738]
push edx
lea ecx, [ebp - 0x2738]
call fcn.0042f680
push eax
lea ecx, [ebp - 0x2738]
call fcn.0042f550
mov eax, dword [ebp - 0x14]
shl eax, 3
push eax
lea ecx, [ebp - 0x3738]
push ecx
lea edx, [ebp - 0x4738]
push edx
lea ecx, [ebp - 0x2738]
call fcn.0042f5b0
lea eax, [ebp - 0x4738]
push eax
push 0x800
lea ecx, [ebp - 0x40]
call fcn.0048ba50
push eax
call fcn.00511c09
add esp, 0xc
push 0
lea ecx, [ebp - 0x14]
push ecx
push 0x800
lea ecx, [ebp - 0x40]
call fcn.0048ba50
push eax
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xc], 1
lea ecx, [ebp - 0x18]
call fcn.0040f740
lea ecx, [ebp - 0x3c]
call fcn.0042e690
lea ecx, [ebp - 0x44]
call fcn.0040f740
lea ecx, [ebp - 0x40]
call fcn.0048ba10
jmp 0x423026
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x473c], eax
mov dword [ebp - 0x473c], 0
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x475c], ecx
lea ecx, [ebp - 4]
call fcn.0040f740
lea ecx, [ebp + 8]
call fcn.0040f740
lea ecx, [ebp + 0xc]
call fcn.0040f740
mov eax, dword [ebp - 0x475c]
mov ecx, dword [ebp - 0x48]
xor ecx, ebp
call fcn.00512610
mov esp, ebp
pop ebp
ret