Function at 0x140054920
Capabilities:
Check os version
Create pipe
Create thread
Create two anonymous pipes
Read file on windows
Terminate thread
Write file on windows
Write pipe

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
mov eax, 0xac20
call sub.ntdll.dll___chkstk
sub rsp, rax
mov rax, qword [0x14042d950]
xor rax, rsp
mov qword [rsp + 0xac00], rax
mov rax, r8
mov qword [rcx + 0x1b0], rdx
mov rbp, rcx
mov qword [rcx + 0x1b8], rax
mov r13, rdx
lea rcx, [rsp + 0x70]
xor edx, edx
mov r8d, Ordinal_280
mov qword [rsp + 0x9b0], rax
call sub.ntdll.dll_memset
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], Ordinal_280
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x74], 5
jne 0x1400549a8
cmp dword [rsp + 0x78], 0
jne 0x1400549a8
mov rcx, rbp
call fcn.140054460
mov qword [rbp + 0x198], rax
lea r8, [rsp + 0x58]
lea rdx, [rbp + 0x170]
lea rcx, [rbp + 0x168]
xor r12d, r12d
xor r9d, r9d
mov qword [rsp + 0xac68], rbx
mov dword [rsp + 0x58], 0x18
mov dword [rsp + 0x68], 1
mov qword [rsp + 0x60], r12
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x140054acd
call fcn.140049470
lea rsi, [0x140433950]
xor edx, edx
mov rcx, rsi
mov r8d, 0x80
mov rbx, rax
call sub.ntdll.dll_memset
lea edx, [r12 + 0x5c]
lea rcx, str...cnvfat.cpp
call qword [sym.imp.ntdll.dll_strrchr]
test rax, rax
mov rdi, rax
je 0x140054ab3
xor eax, eax
lea rdx, [0x1402dfd08]
lea rcx, [rsp + 0x9b0]
mov r8d, 0xfd
mov byte [rsp + 0x9b0], r12b
mov qword [rsp + 0x9b1], rax
mov word [rsp + Ordinal_2492], ax
mov byte [rsp + reloc.MFC80U.DLL_Ordinal_2491], al
call qword [sym.imp.ntdll.dll_sprintf]
lea rdx, [rdi + 1]
mov rcx, rsi
sub rcx, rdx
nop
movzx eax, byte [rdx]
add rdx, 1
test al, al
mov byte [rcx + rdx - 1], al
jne 0x140054a70
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x9b0]
nop
nop
nop
movzx eax, byte [rdx + rcx]
add rcx, 1
test al, al
mov byte [rdi + rcx - 2], al
jne 0x140054aa0
mov r12, rsi
mov rax, qword [rbx]
lea rdx, str._s:_Stdout_pipe_creation_failed
mov r8, r12
mov rcx, rbx
call qword [rax + 0x10]
xor eax, eax
jmp 0x140055462
mov rcx, qword [rbp + 0x168]
xor r8d, r8d
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
lea r8, [rsp + 0x58]
lea rdx, [rbp + 0x160]
lea rcx, [rbp + 0x158]
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x140054b34
call fcn.140049470
lea rcx, str...cnvfat.cpp
mov edx, Ordinal_265
mov rbx, qword [rax]
mov rdi, rax
call fcn.140052f30
lea rdx, str._s:_Stdin_pipe_creation_failed
mov rcx, rdi
mov r8, rax
call qword [rbx + 0x10]
xor eax, eax
jmp 0x140055462
mov rcx, qword [rbp + 0x160]
xor r8d, r8d
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
call fcn.140049400
mov r8, qword [rbp + 8]
mov rdi, qword [rax]
mov edx, dword [rbp]
mov rcx, rax
call qword [rdi + 0x30]
test eax, eax
jne 0x140054b8d
call fcn.140049470
lea rcx, str...cnvfat.cpp
mov edx, 0x10e
mov rbx, qword [rax]
mov rdi, rax
call fcn.140052f30
lea rdx, str._s:_Dismount_the_volume_failed_in_StartConvert.
mov rcx, rdi
mov r8, rax
call qword [rbx + 0x10]
mov rcx, rbp
call fcn.140053210
test eax, eax
jne 0x140054bcc
call fcn.140049470
lea rcx, str...cnvfat.cpp
mov edx, Ordinal_280
mov rbx, qword [rax]
mov rdi, rax
call fcn.140052f30
lea rdx, str._s:_Create_process_failed_with_convert.exe
mov rcx, rdi
mov r8, rax
call qword [rbx + 0x10]
xor eax, eax
jmp 0x140055462
mov rcx, qword [rbp + 0x170]
mov qword [rsp + 0xac18], r14
mov qword [rsp + 0xac10], r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x140054c19
call fcn.140049470
lea rcx, str...cnvfat.cpp
mov edx, Ordinal_285
mov rbx, qword [rax]
mov rdi, rax
call fcn.140052f30
lea rdx, str._s:_Closing_handle_failed
mov rcx, rdi
mov r8, rax
call qword [rbx + 0x10]
lea rcx, [rsp + 0x190]
xor edx, edx
mov r8d, Ordinal_2070
call sub.ntdll.dll_memset
lea rcx, [rsp + 0xc01]
xor edx, edx
mov r8d, 0x1fff
mov byte [rsp + Ordinal_3079], r12b
call sub.ntdll.dll_memset
lea rcx, [rsp + 0x2c01]
xor edx, edx
mov r8d, 0x7fff
mov byte [rsp + 0x2c00], r12b
call sub.ntdll.dll_memset
cmp qword [0x140423218], 0xffffffffffffffff
mov r15d, r12d
mov edi, r12d
mov dword [rsp + 0x3c], r12d
mov dword [rsp + 0x40], r12d
mov dword [rsp + 0x38], r12d
mov r14d, r12d
mov esi, r12d
mov dword [rsp + 0x34], r12d
je 0x140055122
nop
nop
nop
lea rcx, [rsp + 0xc00]
xor edx, edx
mov r8d, 0x2000
call sub.ntdll.dll_memset
mov rcx, qword [rbp + 0x168]
lea r9, [rsp + 0x4c]
lea rdx, [rsp + 0xc00]
mov r8d, 0x2000
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14005511e
cmp dword [rsp + 0x4c], r12d
je 0x14005511e
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0xc00]
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
add r15d, ecx
mov rdi, rcx
cmp r15d, 0x2000
jl 0x140054da2
lea rcx, [rsp + 0x2c00]
xor edx, edx
mov r8d, 0x8000
call sub.ntdll.dll_memset
cmp edi, 0x1f40
mov r15d, r12d
jl 0x140054d72
lea eax, [rdi - 0x1f40]
lea rdi, [rsp + 0x2c00]
movsxd rcx, eax
xor eax, eax
lea rdx, [rsp + rcx + 0xc00]
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor ecx, ecx
nop
nop
movzx eax, byte [rdx + rcx]
add rcx, 1
test al, al
mov byte [rdi + rcx - 2], al
jne 0x140054d60
jmp 0x140054dd0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x2c00]
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0xc00]
nop
movzx eax, byte [rdx + rcx]
add rcx, 1
test al, al
mov byte [rdi + rcx - 2], al
jne 0x140054d90
jmp 0x140054dd0
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x2c00]
lea rdx, [rsp + 0xc00]
repne scasb al, byte [rdi]
xor ecx, ecx
nop
nop
movzx eax, byte [rdx + rcx]
add rcx, 1
test al, al
mov byte [rdi + rcx - 2], al
jne 0x140054dc0
lea rdx, [rbp + 0x50]
lea rcx, [rsp + 0x2c00]
call qword [sym.imp.ntdll.dll_strstr]
test rax, rax
je 0x140054ed3
xor eax, eax
lea r8, [rbp + 0x10]
lea rdx, [0x1402e0cac]
lea rcx, [rsp + 0x9c0]
mov byte [rsp + 0x9c0], r12b
mov qword [rsp + 0x9c1], rax
mov qword [rsp + 0x9c9], rax
mov qword [rsp + Ordinal_2520], rax
mov qword [rsp + 0x9d9], rax
mov qword [rsp + 0x9e1], rax
mov qword [rsp + 0x9e9], rax
mov qword [rsp + Ordinal_2552], rax
mov dword [rsp + Ordinal_2558], eax
mov word [rsp + Ordinal_2562], ax
mov byte [rsp + Ordinal_2562], al
call qword [sym.imp.ntdll.dll_sprintf]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x9c0]
lea r9, [rsp + 0x50]
lea rdx, [rsp + 0x9c0]
repne scasb al, byte [rdi]
lea rdi, [rbp + 0x160]
mov dword [rsp + 0x50], r12d
not rcx
mov qword [rsp + 0x20], r12
lea r8, [rcx - 1]
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140054eda
call fcn.140049470
lea rcx, str...cnvfat.cpp
mov edx, 0x157
mov rbx, qword [rax]
mov rdi, rax
call fcn.140052f30
lea rdx, str._s:_Failed_to_write_label_to_pipe.
mov rcx, rdi
mov r8, rax
call qword [rbx + 0x10]
lea rdi, [rbp + 0x160]
jmp 0x140054eda
lea rdi, [rbp + 0x160]
lea rdx, str._Y_N_
lea rcx, [rsp + 0x2c00]
call qword [sym.imp.ntdll.dll_strstr]
test rax, rax
je 0x140054f56
mov rcx, qword [rdi]
lea r9, [rsp + 0x48]
lea rdx, [rsp + 0x30]
mov r8d, 3
mov byte [rsp + 0x30], 0x59
mov byte [rsp + 0x31], 0xd
mov byte [rsp + 0x32], 0xa
mov dword [rsp + 0x48], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140054f56
call fcn.140049470
lea rcx, str...cnvfat.cpp
mov edx, Ordinal_355
mov rbx, qword [rax]
mov rdi, rax
call fcn.140052f30
lea rdx, str._s:_Failed_to_write_data_to_pipe.
mov rcx, rdi
mov r8, rax
call qword [rbx + 0x10]
lea rcx, [rsp + 0x70]
xor edx, edx
mov r8d, Ordinal_280
call sub.ntdll.dll_memset
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], Ordinal_280
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x74], 5
jne 0x14005527f
cmp dword [rsp + 0x78], r12d
jne 0x14005527f
mov esi, 1
mov dword [rsp + 0x34], esi
cmp qword [rbp + reloc.MFC80U.DLL_Ordinal_336], 0xffffffffffffffff
jne 0x1400550d1
lea rcx, [rsp + 0xa01]
xor edx, edx
mov r8d, Ordinal_512
mov byte [rsp + Ordinal_2562], r12b
call sub.ntdll.dll_memset
lea r8, [rsp + 0xa00]
lea rdx, [rsp + 0xc00]
mov rcx, rbp
call fcn.1400541c0
add qword [rbp + 0x1a0], rax
cmp qword [rbp + 0x198], r12
jne 0x140054ff8
mov qword [rbp + 0x198], 1
mov ecx, dword [0x140423228]
cvtsi2sd xmm2, qword [rbp + 0x1a0]
cvtsi2sd xmm0, qword [rbp + 0x198]
divsd xmm2, xmm0
cvtsi2sd xmm1, ecx
mulsd xmm2, xmm1
cvttsd2si eax, xmm2
cmp eax, ecx
jl 0x140055035
mov r14d, 1
lea eax, [rcx - 1]
mov dword [rsp + 0x5a0], r14d
add eax, 1
lea rcx, [rsp + 0x190]
xor edx, edx
mov r8d, 0x400
mov dword [rsp + Ordinal_1435], 1
mov dword [rsp + 0x59c], r12d
mov dword [rsp + Ordinal_1435], r12d
mov dword [rsp + 0x3c], eax
mov dword [rsp + 0x590], eax
call sub.ntdll.dll_memset
cmp dword [rsp + 0x40], r12d
jne 0x1400550b9
lea r8, [rsp + 0xa00]
lea rdx, str.Converting_Partition:__s
lea rcx, [rsp + 0x190]
call qword [sym.imp.ntdll.dll_sprintf]
test r14d, r14d
je 0x1400550b9
lea rdx, str.Converting_Partition__please_wait...
lea rcx, [rsp + 0x190]
call qword [sym.imp.ntdll.dll_sprintf]
mov dword [rsp + 0x40], 1
test r13, r13
je 0x1400550d1
mov rdx, qword [rsp + 0x9b0]
lea rcx, [rsp + 0x190]
call r13
cmp qword [rbp + reloc.MFC80U.DLL_Ordinal_336], 0xffffffffffffffff
jne 0x140055105
test r14d, r14d
je 0x140055105
lea r8, [0x1400535c0]
mov r9, rbp
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
call qword [sym.imp.MSVCR80.dll__beginthreadex]
mov qword [rbp + reloc.MFC80U.DLL_Ordinal_336], rax
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp qword [0x140423218], 0xffffffffffffffff
jne 0x140054ca0
mov edi, dword [rsp + 0x3c]
mov rcx, qword [rbp + reloc.MFC80U.DLL_Ordinal_336]
mov r15, qword [rsp + 0xac10]
mov r14, qword [rsp + 0xac18]
cmp rcx, 0xffffffffffffffff
je 0x14005515f
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbp + reloc.MFC80U.DLL_Ordinal_336]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + reloc.MFC80U.DLL_Ordinal_336], 0xffffffffffffffff
mov rcx, qword [rbp + 0x168]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x158]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x160]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x140423218]
cmp rcx, 0xffffffffffffffff
je 0x14005545d
lea rdx, [rsp + 0x44]
mov dword [rsp + 0x44], 0xffffffff
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [0x140423218]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x44]
mov qword [0x140423218], 0xffffffffffffffff
test eax, eax
je 0x1400553ac
lea rcx, [rsp + 0x190]
xor edx, edx
mov r8d, 0x400
mov dword [rsp + Ordinal_1435], 1
mov dword [rsp + Ordinal_1435], eax
mov dword [rsp + 0x590], edi
mov dword [rsp + 0x59c], 1
call sub.ntdll.dll_memset
mov r8, qword [rbp + 0x198]
lea rdx, str.Converting_Partition_to_fail_
lea rcx, [rsp + 0x190]
call qword [sym.imp.ntdll.dll_sprintf]
lea r8, [rsp + 0x2c00]
lea rdx, [rsp + 0x190]
mov rcx, rbp
call fcn.1400536d0
call fcn.140049470
lea rcx, str...cnvfat.cpp
mov rbx, qword [rax]
mov edx, 0x1e7
mov rdi, rax
call fcn.140052f30
mov rcx, qword [rbp + 0x198]
mov r9, qword [rbp + 0x1a0]
mov qword [rsp + 0x20], rcx
lea rdx, str._s:_Converting_Partition_to_fail__Convert_File_Count:_I64d__Check_File_Count:_I64d
mov r8, rax
mov rcx, rdi
call qword [rbx + 0x10]
jmp 0x140055445
test esi, esi
jne 0x140054f9a
lea rcx, [rsp + 0xa01]
xor edx, edx
mov r8d, Ordinal_512
mov byte [rsp + Ordinal_2562], r12b
call sub.ntdll.dll_memset
lea r9, [rsp + 0xa00]
lea r8, [rsp + 0x34]
lea rdx, [rsp + 0xc00]
mov rcx, rbp
call fcn.140053cd0
mov esi, dword [rsp + 0x34]
add qword [rbp + 0x198], rax
test esi, esi
je 0x1400552fc
call fcn.140049470
lea rcx, str...cnvfat.cpp
mov edx, 0x173
mov rbx, qword [rax]
mov rdi, rax
call fcn.140052f30
lea rdx, str._s:_Checking_partition_completely.
mov rcx, rdi
mov r8, rax
call qword [rbx + 0x10]
lea rcx, [rsp + 0x190]
xor edx, edx
mov r8d, 0x400
mov dword [rsp + 0x594], esi
mov dword [rsp + 0x59c], r12d
mov dword [rsp + Ordinal_1435], r12d
mov dword [rsp + 0x590], r12d
call sub.ntdll.dll_memset
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0xa00]
repne scasb al, byte [rdi]
not rcx
cmp rcx, 1
je 0x140055368
lea r8, [rsp + 0xa00]
lea rdx, str.Checking_Partition:__s
lea rcx, [rsp + 0x190]
call qword [sym.imp.ntdll.dll_sprintf]
jmp 0x14005538b
cmp dword [rsp + 0x38], eax
jne 0x14005538b
lea rdx, str.Check_Partition__please_wait...
lea rcx, [rsp + 0x190]
call qword [sym.imp.ntdll.dll_sprintf]
mov dword [rsp + 0x38], 1
test r13, r13
je 0x140055105
mov rdx, qword [rsp + 0x9b0]
lea rcx, [rsp + 0x190]
call r13
jmp 0x140055105
lea rcx, [rsp + 0x190]
xor edx, edx
mov r8d, 0x400
mov dword [rsp + Ordinal_1435], 1
mov dword [rsp + 0x59c], 1
mov dword [rsp + Ordinal_1435], r12d
mov dword [rsp + 0x590], 0x64
call sub.ntdll.dll_memset
mov r8, qword [rbp + 0x198]
lea rdx, str.Successed_in_Converting_Partition_
lea rcx, [rsp + 0x190]
call qword [sym.imp.ntdll.dll_sprintf]
call fcn.140049470
lea rcx, str...cnvfat.cpp
mov rbx, qword [rax]
mov edx, 0x1f2
mov rdi, rax
call fcn.140052f30
mov rcx, qword [rbp + 0x198]
mov r9, qword [rbp + 0x1a0]
mov qword [rsp + 0x20], rcx
lea rdx, str._s:_Successed_in_Converting_Partition__Convert_File_Count:_I64d__Check_File_Count:_I64d
mov r8, rax
mov rcx, rdi
call qword [rbx + 0x10]
test r13, r13
je 0x14005545d
mov rdx, qword [rsp + 0x9b0]
lea rcx, [rsp + 0x190]
call r13
mov eax, 1
mov rbx, qword [rsp + 0xac68]
mov rcx, qword [rsp + 0xac00]
xor rcx, rsp
call fcn.140161080
add rsp, 0xac20
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret