Function at 0x4bd5f0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a0bd2
mov eax, dword fs:[0]
push eax
mov eax, 0x11b8
call fcn.0053d5e0
mov eax, dword [0x61ce74]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x11a4], eax
mov dword [ebp - 0x11c4], ecx
test edi, edi
je 0x4bdbdf
cmp word [edi], 0
je 0x4bdbdf
test eax, eax
je 0x4bdbdf
cmp word [eax], 0
je 0x4bdbdf
or esi, 0xffffffff
call fcn.00421b80
mov ecx, eax
test ecx, ecx
je 0x4bdc00
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x11a0], eax
push edi
lea eax, [ebp - 0x11a0]
mov dword [ebp - 4], 0
push 0x5cd140
push eax
call fcn.004289d0
mov ecx, dword [ebp + 0x14]
add esp, 0xc
mov edi, dword [ebp - 0x11a0]
mov ebx, 0x80004005
test ecx, ecx
je 0x4bd734
lea ecx, [ecx]
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
dec ecx
push edi
mov dword [ebp + 0x14], ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4bd716
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, 0xe7
jne 0x4bd7ac
push 0x1388
push edi
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
je 0x4bd7a5
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4bd6d1
push 0
push 0
lea eax, [ebp - 0x11b8]
mov dword [ebp - 0x11b8], 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
xor ebx, ebx
mov dword [ebp - 4], 0xffffffff
add edi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x4bd753
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
test ebx, ebx
js 0x4bdbcf
push 0xfde9
push dword [ebp - 0x11a4]
lea eax, [ebp - 0x1094]
mov dword [ebp - 0x11b4], 0
lea ecx, [ebp - 0x1098]
mov dword [ebp - 0x1098], eax
call fcn.00448f10
mov ebx, dword [ebp - 0x1098]
mov dword [ebp - 4], 1
call fcn.00421b80
mov ecx, eax
test ecx, ecx
je 0x4bdc0a
jmp 0x4bd7d1
mov ebx, 0x800700e7
jmp 0x4bd7c1
test ebx, ebx
jle 0x4bd7bb
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
jns 0x4bd734
mov ecx, dword [ebp + 0x14]
test ecx, ecx
jne 0x4bd6b0
jmp 0x4bd734
mov eax, dword [ecx]
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0x11a8], edi
mov byte [ebp - 4], 2
test ebx, ebx
je 0x4bd8c8
test ebx, 0xffff0000
jne 0x4bd8c8
movzx ebx, bx
push 0
push ebx
call fcn.00432bc0
add esp, 8
mov dword [ebp - 0x11a4], eax
test eax, eax
je 0x4bd8da
mov ecx, ebx
shr ecx, 4
push 6
inc ecx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4bd8da
push ebx
push eax
push dword [ebp - 0x11a4]
call fcn.00426500
add esp, 0xc
mov dword [ebp - 0x11a4], eax
test eax, eax
je 0x4bd8da
movzx ecx, word [eax]
add eax, 2
push 0
push 0
push 0
push 0
push ecx
push eax
push 0
push 3
mov dword [ebp - 0x11a0], eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, eax
test ebx, ebx
js 0x4bdc14
mov ecx, dword [edi - 8]
mov edx, 1
sub edx, dword [edi - 4]
sub ecx, ebx
or ecx, edx
jge 0x4bd896
push ebx
lea ecx, [ebp - 0x11a8]
call fcn.00432e90
mov edi, dword [ebp - 0x11a8]
mov eax, dword [ebp - 0x11a4]
push 0
push 0
push ebx
movzx eax, word [eax]
push edi
push eax
push dword [ebp - 0x11a0]
push 0
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp ebx, dword [edi - 8]
jg 0x4bdc14
mov dword [edi - 0xc], ebx
mov byte [ebx + edi], 0
jmp 0x4bd8da
push ebx
lea ecx, [ebp - 0x11a8]
call fcn.004bc6d0
mov edi, dword [ebp - 0x11a8]
mov eax, dword [ebp - 0x1098]
lea ecx, [ebp - 0x1094]
mov byte [ebp - 4], 4
cmp eax, ecx
je 0x4bd8f7
push eax
call fcn.0054acf4
add esp, 4
cmp dword [edi - 4], 1
mov eax, dword [edi - 0xc]
mov dword [ebp - 0x11a0], eax
jle 0x4bd91e
push eax
lea ecx, [ebp - 0x11a8]
call fcn.00432ce0
mov edi, dword [ebp - 0x11a8]
mov eax, dword [ebp - 0x11a0]
test edi, edi
je 0x4bd952
test eax, eax
je 0x4bd952
cmp esi, 0xffffffff
jne 0x4bd932
mov ebx, 0x80004005
jmp 0x4bd957
push 0
lea ecx, [ebp - 0x11b4]
push ecx
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
xor ecx, ecx
mov ebx, 0x80004005
test eax, eax
cmovne ebx, ecx
jmp 0x4bd957
mov ebx, 0x80070057
push dword [edi - 8]
push edi
call fcn.0054b1a0
add esp, 8
test eax, eax
js 0x4bdc14
cmp eax, dword [edi - 8]
jg 0x4bdc14
mov dword [edi - 0xc], eax
mov byte [eax + edi], 0
test ebx, ebx
js 0x4bdbc4
mov eax, dword [ebp - 0x11a0]
cmp dword [ebp - 0x11b4], eax
jne 0x4bdbc4
call fcn.00421b80
mov ecx, eax
test ecx, ecx
je 0x4bdc1e
mov eax, dword [ecx]
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0x11ac], edi
push 0x1001
lea eax, [ebp - 0x1014]
mov byte [ebp - 4], 5
push 0
push eax
call fcn.00540d70
add esp, 0xc
lea esp, [esp]
mov ebx, 0x1000
cmp esi, 0xffffffff
je 0x4bdbb4
xor eax, eax
xor edi, edi
mov dword [ebp - 0x11a0], eax
push 0
lea eax, [ebp - 0x11a4]
mov dword [ebp - 0x11a4], 0
push eax
push ebx
lea eax, [ebp - 0x1014]
add eax, edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x11b0], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x11a4]
mov edx, eax
add dword [ebp - 0x11a0], ecx
mov eax, dword [ebp - 0x11b0]
test eax, eax
jne 0x4bda38
cmp edx, 0xea
jne 0x4bda40
add edi, ecx
sub ebx, ecx
test eax, eax
je 0x4bd9e8
mov edi, dword [ebp - 0x11ac]
xor ecx, ecx
test eax, eax
mov ebx, 0x80004005
cmovne ebx, ecx
je 0x4bdbb9
mov ebx, dword [edi - 0xc]
lea eax, [ebp - 0x1014]
mov dword [ebp - 0x11c0], eax
sub eax, edi
mov dword [ebp - 0x11bc], eax
mov eax, dword [ebp - 0x11a0]
mov dword [ebp - 0x11a4], ebx
test eax, eax
js 0x4bdc14
push eax
lea eax, [ebp - 0x1014]
push eax
call fcn.0054b1a0
mov edx, eax
mov ecx, 0x7fffffff
sub ecx, edx
mov dword [ebp - 0x11b0], edx
add esp, 8
cmp ecx, ebx
jl 0x4bdc14
add ebx, edx
js 0x4bdc14
mov eax, dword [edi - 8]
mov ecx, 1
sub ecx, dword [edi - 4]
sub eax, ebx
or eax, ecx
jge 0x4bdadb
push ebx
lea ecx, [ebp - 0x11ac]
call fcn.00432e90
mov edi, dword [ebp - 0x11ac]
mov edx, dword [ebp - 0x11b0]
mov eax, dword [ebp - 0x11a4]
mov ecx, dword [ebp - 0x11bc]
cmp ecx, eax
ja 0x4bdaef
add ecx, edi
jmp 0x4bdaf5
mov ecx, dword [ebp - 0x11c0]
add eax, edi
test edx, edx
je 0x4bdb2b
test eax, eax
je 0x4bdb1b
push edx
test ecx, ecx
je 0x4bdb10
push ecx
push eax
call fcn.00541450
add esp, 0xc
jmp 0x4bdb2b
push 0
push eax
call fcn.00540d70
add esp, 0xc
call fcn.0054b18d
mov dword [eax], 0x16
call fcn.0054b0b3
cmp ebx, dword [edi - 8]
jg 0x4bdc14
cmp dword [ebp - 0x11a0], 0x1000
mov dword [edi - 0xc], ebx
mov byte [ebx + edi], 0
je 0x4bd9d0
mov ebx, dword [ebp - 0x11c4]
test ebx, ebx
je 0x4bdba3
push 0xfde9
lea eax, [ebp - 0x1198]
push edi
lea ecx, [ebp - 0x119c]
mov dword [ebp - 0x119c], eax
call fcn.00448db0
mov eax, dword [ebp - 0x119c]
mov byte [ebp - 4], 6
test eax, eax
jne 0x4bdba7
push 0
mov dword [ebx], eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x119c]
lea ecx, [ebp - 0x1198]
cmp eax, ecx
je 0x4bdba3
push eax
call fcn.0054acf4
add esp, 4
xor ebx, ebx
jmp 0x4bdbb9
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
je 0x4bdc28
jmp 0x4bdb80
mov ebx, 0x80004005
lea ecx, [ebp - 0x11ac]
call fcn.00425b40
lea ecx, [ebp - 0x11a8]
call fcn.00425b40
cmp esi, 0xffffffff
je 0x4bdbdb
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x4bdbe4
mov eax, 0x80070057
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0053d079
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00425f50
push 0x80004005
call fcn.00425f50
push 0x80070057
call fcn.00425f50
push 0x80004005
call fcn.00425f50
push 0x8007000e
call fcn.00425f50
int3