Function at 0x2100c5680
Capabilities:
Connect pipe
Read file on windows
Write file on windows
Write pipe

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xf8
lea r12, [0x210273880]
movabs rax, 0x200000001
mov qword [rsp + 0x70], rax
mov rbx, rcx
movabs rax, 0x300000000
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 0
mov dword [rsp + 0x88], 0
test byte [0x210273880], 1
jne 0x2100c5b90
lea r13, [rsp + 0x80]
lea rdi, [rsp + 0x58]
lea rbp, [rsp + 0x54]
lea r14, [rsp + 0x5c]
jmp 0x2100c5783
test byte [r12], 1
jne 0x2100c5940
call sym.GetLastError
mov rcx, r13
lea r15, [rsp + 0xb0]
mov dword [rsp + 0xe0], eax
call method.security_descriptor.free__
movzx esi, byte [r12]
and esi, 1
jne 0x2100c5ac0
mov rcx, qword [rbx + 0x30]
mov r9, rdi
mov r8d, 0x38
mov rdx, r15
mov qword [rsp + 0x20], 0
call sym.WriteFile
test eax, eax
jne 0x2100c5762
test byte [r12], 1
jne 0x2100c59d8
mov rcx, qword [rbx + 0x30]
call sym.DisconnectNamedPipe
test eax, eax
jne 0x2100c577a
test byte [r12], 1
jne 0x2100c5980
test sil, sil
jne 0x2100c59a8
mov rcx, qword [rbx + 0x30]
xor edx, edx
call sym.ConnectNamedPipe
test eax, eax
jne 0x2100c57a2
call sym.GetLastError
cmp eax, 0x217
jne 0x2100c59a8
mov rcx, qword [rbx + 0x30]
mov r9, rdi
mov r8d, 4
mov rdx, rbp
mov qword [rsp + 0x20], 0
mov qword [rsp + 0xb0], 0
mov qword [rsp + 0xb8], 0
mov qword [rsp + 0xc0], 0
mov qword [rsp + 0xc8], 0
mov qword [rsp + 0xd0], 0
mov qword [rsp + 0xd8], 0
mov qword [rsp + 0xe0], 0
mov dword [rsp + 0x60], 0xc0000022
mov dword [rsp + 0x64], 2
call sym.ReadFile
test eax, eax
je 0x2100c5700
mov rcx, qword [rbx + 0x30]
mov rdx, r14
call sym.GetNamedPipeClientProcessId
test eax, eax
jne 0x2100c5844
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x5c], eax
mov rcx, qword [rbx + 0x38]
mov rdx, r13
call sym.get_object_sd_void__security_descriptor_
test eax, eax
je 0x2100c58e0
movzx esi, byte [r12]
and esi, 1
jne 0x2100c5ad0
call sym.GetLastError
lea r15, [rsp + 0xb0]
mov dword [rsp + 0xe0], eax
nop word [rax + rax]
mov rcx, r13
call method.security_descriptor.free__
test byte [r12], 1
je 0x2100c5735
mov eax, dword [rsp + 0xe0]
lea r9, str.Reply:_from__p__to__p__error__u
mov edx, 0x100
mov rcx, r12
lea r8, str.static_DWORD_fhandler_pty_master::pty_master_thread_const_fhandler_pty_master::master_thread_param_t_
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x20], rax
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x2100c5735
call sym.RevertToSelf
mov rcx, qword [rbx + 0x30]
call sym.ImpersonateNamedPipeClient
test eax, eax
jne 0x2100c5a00
movzx esi, byte [r12]
and esi, 1
jne 0x2100c5b40
call sym.GetLastError
mov dword [rsp + 0xe0], eax
mov rax, qword [0x21023d810]
lea r15, [rsp + 0xb0]
cmp qword [rax + 0x4878], 0
je 0x2100c5880
mov rcx, qword [rax + 0x4870]
call sym.ImpersonateLoggedOnUser
jmp 0x2100c5880
lea r9, str.ReadFile___E
lea r8, str.static_DWORD_fhandler_pty_master::pty_master_thread_const_fhandler_pty_master::master_thread_param_t_
mov edx, 0x100
mov rcx, r12
xor esi, esi
call method.strace.prntf_unsigned_int__char_const__char_const__..._
lea r15, [rsp + 0xb0]
call sym.GetLastError
mov dword [rsp + 0xe0], eax
jmp 0x2100c5880
lea r9, str.DisconnectNamedPipe___E
lea r8, str.static_DWORD_fhandler_pty_master::pty_master_thread_const_fhandler_pty_master::master_thread_param_t_
mov edx, 0x100
mov rcx, r12
call method.strace.prntf_unsigned_int__char_const__char_const__..._
test sil, sil
je 0x2100c5783
nop dword [rax]
test byte [0x210273880], 1
jne 0x2100c5b70
mov rcx, r13
call method.security_descriptor.free__
xor eax, eax
add rsp, 0xf8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea r9, str.WriteFile___E
lea r8, str.static_DWORD_fhandler_pty_master::pty_master_thread_const_fhandler_pty_master::master_thread_param_t_
mov edx, 0x100
mov rcx, r12
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x2100c5762
call sym.GetCurrentThread
lea r9, [rsp + 0x68]
mov r8d, 1
mov edx, 8
mov rcx, rax
call sym.NtOpenThreadToken
mov r15d, eax
test eax, eax
js 0x2100c5ae0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rdi
mov r8d, dword [rsp + 0x64]
lea r9, [rsp + 0x70]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x64]
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x90]
mov rdx, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x58], 0x14
call sym.NtAccessCheck
mov rcx, qword [rsp + 0x68]
mov r15d, eax
call sym.NtClose
test r15d, r15d
js 0x2100c5b10
call sym.RevertToSelf
test eax, eax
je 0x2100c5c80
cmp dword [rsp + 0x54], 0xffffffff
je 0x2100c5d1e
mov eax, dword [rsp + 0x60]
test eax, eax
jns 0x2100c5bd4
call sym.GetLastError
xor esi, esi
mov dword [rsp + 0xe0], eax
jmp 0x2100c5910
xor esi, esi
lea r15, [rsp + 0xb0]
jmp 0x2100c5893
lea r9, str.get_object_sd___E
jmp 0x2100c5947
test byte [r12], 1
jne 0x2100c5bb0
mov ecx, r15d
xor esi, esi
call sym.RtlNtStatusToDosError
mov ecx, eax
call sym.SetLastError
call sym.GetLastError
mov dword [rsp + 0xe0], eax
jmp 0x2100c5910
test byte [r12], 1
je 0x2100c5aeb
mov dword [rsp + 0x20], r15d
lea r9, str.NtAccessCheck___y
mov edx, 0x100
mov rcx, r12
lea r8, str.static_DWORD_fhandler_pty_master::pty_master_thread_const_fhandler_pty_master::master_thread_param_t_
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x2100c5aeb
lea r9, str.ImpersonateNamedPipeClient___E
lea r8, str.static_DWORD_fhandler_pty_master::pty_master_thread_const_fhandler_pty_master::master_thread_param_t_
mov edx, 0x100
mov rcx, r12
xor esi, esi
call method.strace.prntf_unsigned_int__char_const__char_const__..._
call sym.GetLastError
mov dword [rsp + 0xe0], eax
jmp 0x2100c5910
lea r9, str.Leaving
lea r8, str.static_DWORD_fhandler_pty_master::pty_master_thread_const_fhandler_pty_master::master_thread_param_t_
mov edx, 0x100
mov rcx, r12
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x2100c59b5
lea r9, str.Entered
lea r8, str.static_DWORD_fhandler_pty_master::pty_master_thread_const_fhandler_pty_master::master_thread_param_t_
mov edx, 0x100
mov rcx, r12
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x2100c56df
mov dword [rsp + 0x20], eax
lea r9, str.NtOpenThreadToken___y
mov edx, 0x100
mov rcx, r12
lea r8, str.static_DWORD_fhandler_pty_master::pty_master_thread_const_fhandler_pty_master::master_thread_param_t_
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x2100c5aeb
mov r8d, dword [rsp + 0x5c]
xor edx, edx
mov ecx, 0x40
call sym.OpenProcess
mov rsi, rax
test rax, rax
je 0x2100c5d04
mov rdx, qword [rbx]
lea r15, [rsp + 0xb0]
mov qword [rsp + 0x48], rdx
call sym.GetCurrentProcess
mov rdx, qword [rsp + 0x48]
mov r9, r15
mov r8, rsi
mov dword [rsp + 0x30], 2
mov rcx, rax
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0
call sym.DuplicateHandle
test eax, eax
jne 0x2100c5c97
test byte [r12], 1
jne 0x2100c5db0
call sym.GetLastError
mov rcx, rsi
xor esi, esi
mov dword [rsp + 0xe0], eax
call sym.CloseHandle
mov rax, qword [0x21023d810]
cmp qword [rax + 0x4878], 0
je 0x2100c5880
mov rcx, qword [rax + 0x4870]
call sym.ImpersonateLoggedOnUser
jmp 0x2100c5880
test byte [r12], 1
je 0x2100c5aac
lea r9, str.RevertToSelf___E
jmp 0x2100c5b47
mov rdx, qword [rbx + 8]
mov qword [rsp + 0x48], rdx
call sym.GetCurrentProcess
mov dword [rsp + 0x30], 2
mov rdx, qword [rsp + 0x48]
mov r8, rsi
mov dword [rsp + 0x28], 1
mov rcx, rax
lea r9, [rsp + 0xb8]
mov dword [rsp + 0x20], 0
call sym.DuplicateHandle
test eax, eax
jne 0x2100c5d43
test byte [r12], 1
je 0x2100c5c40
lea r9, str.DuplicateHandle__from_master____E
lea r8, str.static_DWORD_fhandler_pty_master::pty_master_thread_const_fhandler_pty_master::master_thread_param_t_
mov edx, 0x100
mov rcx, r12
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x2100c5c40
movzx esi, byte [r12]
and esi, 1
je 0x2100c5904
lea r9, str.OpenProcess___E
jmp 0x2100c5b47
call sym.GetCurrentProcessId
cmp eax, dword [rsp + 0x5c]
jne 0x2100c5aac
call sym.GetLastError
mov esi, 1
mov dword [rsp + 0xe0], eax
jmp 0x2100c5910
mov rdx, qword [rbx + 0x10]
mov qword [rsp + 0x48], rdx
call sym.GetCurrentProcess
mov dword [rsp + 0x30], 2
mov rdx, qword [rsp + 0x48]
mov r8, rsi
mov dword [rsp + 0x28], 1
mov rcx, rax
lea r9, [rsp + 0xc0]
mov dword [rsp + 0x20], 0
call sym.DuplicateHandle
test eax, eax
jne 0x2100c5dd0
test byte [r12], 1
je 0x2100c5c40
lea r9, str.DuplicateHandle__to_master_nat____E
lea r8, str.static_DWORD_fhandler_pty_master::pty_master_thread_const_fhandler_pty_master::master_thread_param_t_
mov edx, 0x100
mov rcx, r12
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x2100c5c40
lea r9, str.DuplicateHandle__from_master_nat____E
lea r8, str.static_DWORD_fhandler_pty_master::pty_master_thread_const_fhandler_pty_master::master_thread_param_t_
mov edx, 0x100
mov rcx, r12
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x2100c5c40
mov rdx, qword [rbx + 0x18]
mov qword [rsp + 0x48], rdx
call sym.GetCurrentProcess
mov dword [rsp + 0x30], 2
mov rdx, qword [rsp + 0x48]
mov r8, rsi
mov dword [rsp + 0x28], 1
mov rcx, rax
lea r9, [rsp + 0xc8]
mov dword [rsp + 0x20], 0
call sym.DuplicateHandle
test eax, eax
jne 0x2100c5e3d
test byte [r12], 1
je 0x2100c5c40
lea r9, str.DuplicateHandle__to_master____E
lea r8, str.static_DWORD_fhandler_pty_master::pty_master_thread_const_fhandler_pty_master::master_thread_param_t_
mov edx, 0x100
mov rcx, r12
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x2100c5c40
mov rdx, qword [rbx + 0x20]
mov qword [rsp + 0x48], rdx
call sym.GetCurrentProcess
mov dword [rsp + 0x30], 2
mov rdx, qword [rsp + 0x48]
mov r8, rsi
mov dword [rsp + 0x28], 1
mov rcx, rax
lea r9, [rsp + 0xd0]
mov dword [rsp + 0x20], 0
call sym.DuplicateHandle
test eax, eax
jne 0x2100c5eaa
test byte [r12], 1
je 0x2100c5c40
lea r9, str.DuplicateHandle__to_slave_nat____E
lea r8, str.static_DWORD_fhandler_pty_master::pty_master_thread_const_fhandler_pty_master::master_thread_param_t_
mov edx, 0x100
mov rcx, r12
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x2100c5c40
mov rdx, qword [rbx + 0x28]
mov qword [rsp + 0x48], rdx
call sym.GetCurrentProcess
mov dword [rsp + 0x30], 2
mov rdx, qword [rsp + 0x48]
mov r8, rsi
mov dword [rsp + 0x28], 1
mov rcx, rax
lea r9, [rsp + 0xd8]
mov dword [rsp + 0x20], 0
call sym.DuplicateHandle
test eax, eax
jne 0x2100c5c40
test byte [r12], 1
je 0x2100c5c40
lea r9, str.DuplicateHandle__to_slave____E
lea r8, str.static_DWORD_fhandler_pty_master::pty_master_thread_const_fhandler_pty_master::master_thread_param_t_
mov edx, 0x100
mov rcx, r12
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x2100c5c40