Function at 0x140003fc0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x7d0]
sub rsp, 0x8d0
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x920], rbx
mov rax, qword [0x140020008]
xor rax, rsp
mov qword [rbp + 0x7c0], rax
mov r13, rdx
mov r15, rcx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x60], rdx
xor esi, esi
mov dword [rsp + 0x50], esi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
lea rcx, str..pipexfrun
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x1400041c2
nop dword [rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe7
jne 0x140004148
mov edx, 0x1388
lea rcx, str..pipexfrun
call qword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
je 0x1400040ae
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
lea rcx, str..pipexfrun
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x140004050
jmp 0x1400041c2
cmp r14, 0xffffffffffffffff
je 0x1400040bd
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.140001930
mov rcx, rax
test rax, rax
setne sil
test esi, esi
jne 0x1400040db
mov ecx, 0x80004005
call fcn.1400013f0
int3
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [r15], rax
lea rdx, [0x14001c20e]
test rdx, 0xffffffffffff0000
jne 0x140004117
movzx ebx, dx
mov ecx, ebx
call fcn.1400014c0
test rax, rax
je 0x140004120
mov r8d, ebx
mov rdx, rax
mov rcx, r15
call fcn.140005be0
jmp 0x140004120
mov rcx, r15
call fcn.140005620
nop
mov rdx, qword [r13]
sub rdx, 0x18
or edi, 0xffffffff
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x140004534
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
jmp 0x140004534
cmp r14, 0xffffffffffffffff
je 0x140004157
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.140001930
mov rcx, rax
test rax, rax
setne sil
test esi, esi
jne 0x140004175
mov ecx, 0x80004005
call fcn.1400013f0
int3
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [r15], rax
lea rdx, [0x14001c20e]
test rdx, 0xffffffffffff0000
jne 0x1400041b1
movzx ebx, dx
mov ecx, ebx
call fcn.1400014c0
test rax, rax
je 0x1400041ba
mov r8d, ebx
mov rdx, rax
mov rcx, r15
call fcn.140005be0
jmp 0x1400041ba
mov rcx, r15
call fcn.140005620
nop
or edi, 0xffffffff
jmp 0x140004519
mov dword [rbp - 0x70], 2
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp - 0x70]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
test eax, eax
jne 0x14000425a
cmp r14, 0xffffffffffffffff
je 0x1400041ef
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.140001930
mov rcx, rax
test rax, rax
setne sil
test esi, esi
jne 0x14000420d
mov ecx, 0x80004005
call fcn.1400013f0
int3
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [r15], rax
lea rdx, [0x14001c20e]
test rdx, 0xffffffffffff0000
jne 0x140004249
movzx ebx, dx
mov ecx, ebx
call fcn.1400014c0
test rax, rax
je 0x140004252
mov r8d, ebx
mov rdx, rax
mov rcx, r15
call fcn.140005be0
jmp 0x140004252
mov rcx, r15
call fcn.140005620
nop
or edi, 0xffffffff
jmp 0x140004519
mov rcx, qword [r13]
mov edx, dword [rcx - 0x10]
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
test rax, rax
jne 0x140004272
call fcn.140005750
int3
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
add ebx, ebx
mov rcx, qword [r13]
mov edx, dword [rcx - 0x10]
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
test rax, rax
jne 0x140004297
call fcn.140005750
int3
mov qword [rsp + 0x20], rsi
lea r9, [rbp - 0x50]
mov r8d, ebx
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14000432d
cmp r14, 0xffffffffffffffff
je 0x1400042c2
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.140001930
mov rcx, rax
test rax, rax
setne sil
test esi, esi
jne 0x1400042e0
mov ecx, 0x80004005
call fcn.1400013f0
int3
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [r15], rax
lea rdx, [0x14001c20e]
test rdx, 0xffffffffffff0000
jne 0x14000431c
movzx ebx, dx
mov ecx, ebx
call fcn.1400014c0
test rax, rax
je 0x140004325
mov r8d, ebx
mov rdx, rax
mov rcx, r15
call fcn.140005be0
jmp 0x140004325
mov rcx, r15
call fcn.140005620
nop
or edi, 0xffffffff
jmp 0x140004519
call fcn.140001930
mov rdx, rax
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
jne 0x14000434c
mov ecx, 0x80004005
call fcn.1400013f0
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x78], rax
lea rdx, [0x14001c20e]
test rdx, 0xffffffffffff0000
jne 0x14000438d
movzx ebx, dx
mov ecx, ebx
call fcn.1400014c0
test rax, rax
je 0x140004397
mov r8d, ebx
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.140005be0
jmp 0x140004397
lea rcx, [rbp - 0x78]
call fcn.140005620
nop
or edi, 0xffffffff
nop word [rax + rax]
mov qword [rsp + 0x20], rsi
lea r9, [rbp - 0x80]
mov r8d, 0x800
lea rdx, [rbp - 0x40]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r12d, eax
test eax, eax
jne 0x1400043d4
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x1400044bb
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], rsi
mov word [rsp + 0x40], si
mov eax, dword [rbp - 0x80]
lea edx, [rax + rax]
lea r8, [rsp + 0x40]
lea rcx, [rbp - 0x68]
call fcn.140004fb0
mov r8d, dword [rbp - 0x80]
lea rdx, [rbp - 0x40]
mov rcx, qword [rbp - 0x68]
call fcn.1400073b0
mov r8, qword [rbp - 0x68]
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x48]
call fcn.1400052b0
nop
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.140005830
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140004448
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rcx, qword [rbp - 0x68]
mov qword [rsp + 0x68], rcx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
mov rax, qword [rbp - 0x58]
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x58], rsi
test rcx, rcx
je 0x1400044b1
sub rax, rcx
sar rax, 1
movabs rdx, 0x7fffffffffffffff
cmp rax, rdx
ja 0x1400044e4
add rax, rax
cmp rax, 0x1000
jb 0x1400044ab
test cl, 0x1f
jne 0x1400044de
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x1400044d8
sub rcx, rax
cmp rcx, 8
jb 0x1400044d2
cmp rcx, 0x27
ja 0x1400044cc
mov rcx, rax
call fcn.1400061e4
nop
test r12d, r12d
jne 0x1400044ea
jmp 0x1400043a0
cmp r14, 0xffffffffffffffff
je 0x1400044ea
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400044ea
call fcn.14000abfc
int3
call fcn.14000abfc
int3
call fcn.14000abfc
int3
call fcn.14000abfc
int3
call fcn.14000abfc
nop
mov rbx, qword [rbp - 0x78]
lea rcx, [rbx - 0x18]
call fcn.140005990
add rax, 0x18
mov qword [r15], rax
mov eax, edi
lock xadd dword [rbx - 8], eax
sub eax, 1
jg 0x140004519
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
lea rdx, [rbx - 0x18]
call qword [rax + 8]
nop
mov rdx, qword [r13]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x140004534
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, r15
mov rcx, qword [rbp + 0x7c0]
xor rcx, rsp
call fcn.140006200
mov rbx, qword [rsp + 0x920]
add rsp, 0x8d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret