Function at 0x44cfa0
Capabilities:
Write file on windows

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x2d0
cmp qword [r8 + 0x118], 0xffffffffffffffff
mov rdi, qword [rsp + 0x338]
mov rbp, rcx
mov rbx, rdx
mov rsi, r8
mov r14, r9
je 0x44d535
mov rax, qword [rsp + 0x340]
lea r13, [rbx + 0x40]
mov qword [rbx + 0x40], 0
mov qword [rbx + 0x48], 0
mov dword [rbx + 8], 3
mov qword [rbx + 0x80], rsi
mov dword [rbx + 0x88], 0
mov qword [rbx + 0x70], rax
mov qword [rbx + 0xa0], 0
mov qword [rbx + 0xa8], 0xffffffffffffffff
mov qword [r13 + 0x10], 0
mov qword [r13 + 0x18], 0
mov edx, dword [rsi + 0x110]
test edx, edx
je 0x44d1c4
test byte [rsi + 0x5b], 1
jne 0x44d390
test rdi, rdi
mov dword [rsp + 0x40], 0
je 0x44d3ba
mov edx, dword [rsi + 0x1e0]
test edx, edx
je 0x44d620
lea r8, [rsp + 0x50]
mov rcx, rdi
call fcn.00457190
test eax, eax
mov r12d, eax
jne 0x44d378
mov eax, dword [rdi + 0x118]
mov edx, dword [rsp + 0x40]
mov dword [rsp + 0x2c4], eax
mov eax, edx
or eax, 2
test byte [rdi + 0x59], 0x10
mov dword [rsp + 0x40], eax
je 0x44d0a9
mov eax, edx
or eax, 6
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x330], 1
je 0x44d4e1
test al, 1
mov r12, r13
mov rdi, rbx
jne 0x44d4f0
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov qword [r12], 0
mov qword [r12 + 8], 0
mov edx, 1
mov qword [r12 + 0x10], 0
mov qword [r12 + 0x18], 0
call qword [sym.imp.KERNEL32.dll_CreateEventA]
test rax, rax
mov qword [rdi + 0x58], rax
je 0x44d869
mov eax, dword [rsp + 0x40]
mov rcx, qword [rsi + 0x118]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x20], r12
and eax, 2
cmp eax, 1
sbb eax, eax
xor r9d, r9d
and eax, 0xfffffd88
lea r8d, [rax + 0x288]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x44d632
mov rcx, qword [rdi + 0x58]
mov qword [rdi + 0x60], 0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsi + 0x7c]
mov qword [rdi + 0x58], 0
mov ecx, eax
lea edx, [rax + 1]
test ecx, ecx
mov eax, edx
mov dword [rsi + 0x7c], edx
jne 0x44d4bb
mov edx, dword [rsi + 0x58]
test dl, 1
jne 0x44d480
test dl, 0x40
je 0x44d4a8
nop word cs:[rax + rax]
lea rax, [rbp + 0x20]
mov r12d, dword [rsp + 0x40]
add rdi, 0x10
mov qword [rdi], rax
mov rax, qword [rbp + 0x28]
mov qword [rdi + 8], rax
mov qword [rax], rdi
mov qword [rbp + 0x28], rdi
add dword [rsi + 0x78], 1
add dword [rsi + 0x100], 1
and r12d, 1
je 0x44d378
mov eax, dword [rsi + 0x58]
mov edx, eax
and edx, 0x1200000
cmp edx, 0x1200000
je 0x44d553
test eax, 0x1000000
je 0x44d2a5
mov rax, qword [r14]
mov rdx, qword [r14 + 8]
mov qword [rbx + 0x68], 0
mov qword [rbx + 0x90], rax
mov qword [rbx + 0x98], rdx
mov rax, qword [rsi + 0x208]
test rax, rax
je 0x44d470
mov rax, qword [rax + 0x68]
mov qword [rbx + 0x68], rax
mov rax, qword [rsi + 0x208]
mov qword [rax + 0x68], rbx
mov qword [rsi + 0x208], rbx
mov eax, dword [rsi + 0x100]
test eax, eax
je 0x44d670
mov eax, dword [r14]
mov qword [rbx + 0x60], rax
add qword [rsi + 0x60], rax
mov eax, dword [rsi + 0x7c]
mov ecx, eax
lea edx, [rax + 1]
test ecx, ecx
mov eax, edx
mov dword [rsi + 0x7c], edx
jne 0x44d27f
mov edx, dword [rsi + 0x58]
test dl, 1
jne 0x44d680
test dl, 0x40
jne 0x44d350
mov ecx, edx
or ecx, 0x40
and edx, 0x20
mov dword [rsi + 0x58], ecx
jne 0x44d6c0
mov edx, eax
test edx, edx
jg 0x44d350
lea rdx, str.src_win_pipe.c
lea rcx, [0x004b1450]
mov r8d, 0x5b6
call fcn.00480c40
jmp 0x44d350
test eax, 0x200000
je 0x44d3d3
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov edx, 1
call qword [sym.imp.KERNEL32.dll_CreateEventA]
test rax, rax
mov qword [rbx + 0x58], rax
je 0x44d869
mov rcx, qword [rsi + 0x118]
xor r9d, r9d
mov rdx, qword [r14 + 8]
mov qword [rsp + 0x20], r13
mov r8d, dword [r14]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x44d744
mov qword [rbx + 0x60], 0
mov rcx, qword [rbx + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsi + 0x7c]
mov ecx, eax
lea edx, [rax + 1]
test ecx, ecx
mov eax, edx
mov dword [rsi + 0x7c], edx
jne 0x44d33f
mov edx, dword [rsi + 0x58]
test dl, 1
jne 0x44d802
test dl, 0x40
jne 0x44d350
mov ecx, edx
or ecx, 0x40
and edx, 0x20
mov dword [rsi + 0x58], ecx
je 0x44d33d
mov rdx, qword [rsi + 8]
add dword [rdx + 8], 1
mov edx, eax
test edx, edx
jle 0x44d793
nop word [rax + rax]
lea rax, [rbp + 0x20]
add rbx, 0x10
mov qword [rbx], rax
mov rax, qword [rbp + 0x28]
mov qword [rbx + 8], rax
mov qword [rax], rbx
mov qword [rbp + 0x28], rbx
add dword [rsi + 0x78], 1
add dword [rsi + 0x100], 1
xor r12d, r12d
mov eax, r12d
add rsp, 0x2d0
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
lea rdx, str.src_win_pipe.c
lea rcx, str.__handle__flags__UV_HANDLE_NON_OVERLAPPED_PIPE_
mov r8d, 0x4e5
call fcn.00480c40
test rdi, rdi
mov dword [rsp + 0x40], 0
jne 0x44d05a
cmp dword [rsp + 0x330], 1
je 0x44d6b0
mov r12, r13
mov rdi, rbx
jmp 0x44d0c5
mov rcx, qword [rsi + 0x118]
xor r9d, r9d
mov rdx, qword [r14 + 8]
mov qword [rsp + 0x20], r13
mov r8d, dword [r14]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x44d720
mov qword [rbx + 0x60], 0
test byte [rsi + 0x5a], 0x10
je 0x44d246
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
test rax, rax
mov qword [rbx + 0xa0], rax
je 0x44d869
mov rdx, qword [rbx + 0x58]
lea rcx, [rbx + 0xa8]
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0xffffffff
mov r9, rbx
lea r8, [0x0044ca90]
call qword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
test eax, eax
jne 0x44d246
nop dword [rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
jmp 0x44d378
mov qword [rbx + 0x68], rbx
mov qword [rsi + 0x208], rbx
jmp 0x44d22d
lea rdx, str.src_win_pipe.c
lea rcx, [0x004b1420]
mov r8d, 0x543
call fcn.00480c40
mov edx, dword [rsi + 0x58]
test dl, 0x40
jne 0x44d7b1
mov eax, dword [rsi + 0x7c]
mov ecx, edx
or ecx, 0x40
and edx, 0x20
mov dword [rsi + 0x58], ecx
jne 0x44d6d0
mov edx, eax
test edx, edx
jg 0x44d190
lea rdx, str.src_win_pipe.c
lea rcx, [0x004b1450]
mov r8d, 0x543
call fcn.00480c40
jmp 0x44d190
or eax, 1
mov dword [rsp + 0x40], eax
mov eax, dword [r14]
mov qword [rsp + 0x48], rax
cmp dword [rsi + 0x138], 3
je 0x44d6f0
lea rdi, [rsi + 0x130]
mov dword [rdi + 8], 3
mov qword [rdi + 0x40], 0
lea r12, [rdi + 0x40]
mov qword [rdi + 0x80], rsi
mov qword [rdi + 0x70], 0
mov dword [rdi + 0x88], 1
jmp 0x44d0c5
lea rdx, str.src_win_pipe.c
lea rcx, str.handle__handle___INVALID_HANDLE_VALUE
mov r8d, 0x4da
call fcn.00480c40
jmp 0x44cfd3
mov rcx, qword [rsi + 0x118]
mov rdx, qword [r14 + 8]
lea r9, [rsp + 0x3c]
mov qword [rsp + 0x20], 0
mov r8d, dword [r14]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x44d460
mov eax, dword [rsi + 0x7c]
mov qword [rbx + 0x60], 0
mov ecx, eax
lea edx, [rax + 1]
test ecx, ecx
mov eax, edx
mov dword [rsi + 0x7c], edx
jne 0x44d5be
mov edx, dword [rsi + 0x58]
test dl, 1
jne 0x44d830
test dl, 0x40
jne 0x44d5c6
mov ecx, edx
or ecx, 0x40
and edx, 0x20
mov dword [rsi + 0x58], ecx
je 0x44d5bc
mov rdx, qword [rsi + 8]
add dword [rdx + 8], 1
mov edx, eax
test edx, edx
jle 0x44d7e4
lea rax, [rbp + 0x20]
add rbx, 0x10
xor r8d, r8d
xor edx, edx
mov r9, r13
mov qword [rbx], rax
mov rax, qword [rbp + 0x28]
mov qword [rbx + 8], rax
mov qword [rax], rbx
mov qword [rbp + 0x28], rbx
add dword [rsi + 0x78], 1
add dword [rsi + 0x100], 1
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
test eax, eax
jne 0x44d375
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x004b1255]
mov ecx, eax
call fcn.00441940
nop dword [rax]
call fcn.00460260
mov edx, eax
mov dword [rsi + 0x1e0], eax
jmp 0x44d068
mov r12, qword [sym.imp.KERNEL32.dll_GetLastError]
call r12
cmp eax, 0x3e5
jne 0x44d65a
mov rcx, qword [rdi + 0x58]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x44d142
call r12
mov rcx, qword [rdi + 0x58]
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x44d378
mov rcx, rsi
call fcn.0044cb50
jmp 0x44d23b
lea rdx, str.src_win_pipe.c
lea rcx, [0x004b1420]
mov r8d, 0x5b6
call fcn.00480c40
mov edx, dword [rsi + 0x58]
test dl, 0x40
je 0x44d6e0
mov edx, dword [rsi + 0x7c]
jmp 0x44d27f
mov eax, 1
jmp 0x44d4e4
mov rdx, qword [rsi + 8]
add dword [rdx + 8], 1
jmp 0x44d27d
mov rdx, qword [rsi + 8]
add dword [rdx + 8], 1
jmp 0x44d4b9
mov eax, dword [rsi + 0x7c]
jmp 0x44d26c
mov ecx, 0xb0
call fcn.0043ebc0
test rax, rax
mov rdi, rax
jne 0x44d504
lea rdx, [0x004b1411]
mov ecx, 0xe
call fcn.00441940
nop word [rax + rax]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
call rdi
cmp eax, 0x3e5
jne 0x44d7c0
mov eax, dword [r14]
mov qword [rbx + 0x60], rax
add qword [rsi + 0x60], rax
jmp 0x44d3ff
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
call rdi
cmp eax, 0x3e5
jne 0x44d7d0
mov eax, dword [r14]
mov rcx, qword [rbx + 0x58]
mov edx, 0xffffffff
mov qword [rbx + 0x60], rax
add qword [rsi + 0x60], rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x44d2fc
call rdi
mov esi, eax
mov rcx, qword [rbx + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, esi
call fcn.00441a00
mov r12d, eax
jmp 0x44d378
lea rdx, str.src_win_pipe.c
lea rcx, [0x004b1450]
mov r8d, 0x591
call fcn.00480c40
jmp 0x44d350
mov edx, dword [rsi + 0x7c]
jmp 0x44d4bb
call rdi
mov r12d, eax
jmp 0x44d378
call rdi
mov rcx, qword [rbx + 0x58]
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x44d378
lea rdx, str.src_win_pipe.c
lea rcx, [0x004b1450]
mov r8d, 0x55f
call fcn.00480c40
jmp 0x44d5c6
lea rdx, str.src_win_pipe.c
lea rcx, [0x004b1420]
mov r8d, 0x591
call fcn.00480c40
mov edx, dword [rsi + 0x58]
test dl, 0x40
jne 0x44d859
mov eax, dword [rsi + 0x7c]
jmp 0x44d328
lea rdx, str.src_win_pipe.c
lea rcx, [0x004b1420]
mov r8d, 0x55f
call fcn.00480c40
mov edx, dword [rsi + 0x58]
test dl, 0x40
jne 0x44d861
mov eax, dword [rsi + 0x7c]
jmp 0x44d5a7
mov edx, dword [rsi + 0x7c]
jmp 0x44d33f
mov edx, dword [rsi + 0x7c]
jmp 0x44d5be
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x004b12ef]
mov ecx, eax
call fcn.00441940
nop
nop