Function at 0x40f6b0
Capabilities:
Get common file path
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x26a8
call fcn.004bd3b0
mov eax, dword [0x4ea5e0]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
lea edi, [ebp - 0x61c]
mov dword [ebp - 0x2628], eax
mov dword [ebp - 0x2634], ecx
call fcn.0040f640
push 0x44
xor esi, esi
lea edx, [ebp - 0x26a4]
push esi
push edx
call fcn.004b2d10
push 0x206
lea edx, [ebp - 0x212]
mov eax, 5
xor ecx, ecx
push esi
push edx
mov word [ebp - 0x2674], ax
mov dword [ebp - 0x269c], 0x4d6770
mov dword [ebp - 0x26a4], 0x44
mov word [ebp - 0x214], cx
call fcn.004b2d10
add esp, 0x18
push 0x104
lea ecx, [ebp - 0x41c]
lea eax, [ebp - 0x2588]
push ecx
mov dword [ebp - 0x262c], esi
mov dword [ebp - 0x2620], esi
mov ebx, 0x94
mov dword [ebp - 0x2624], eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x4d6798
lea edx, [ebp - 0x41c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x40f7cb
push str.WinStationQueryInformationW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40f7b6
lea ecx, [ebp - 0x265c]
push ecx
mov ecx, dword [ebp + 8]
push 0x208
lea edx, [ebp - 0x214]
push edx
push 0x21
push ecx
push esi
call eax
movzx esi, al
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test esi, esi
je 0x40f7cb
cmp word [ebp - 0x214], 0
jne 0x40f7e8
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x214]
push str..PipeTerminalServerSystemExecSrvr_d
push eax
mov edx, 0x104
call fcn.0040f620
add esp, 0xc
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
lea ecx, [ebp - 0x214]
push ecx
call esi
mov dword [ebp - 0x2630], eax
cmp eax, 0xffffffff
jne 0x40f849
call edi
cmp eax, 0xe7
jne 0x40f836
push 0x7530
lea edx, [ebp - 0x214]
push edx
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
jne 0x40f7f4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004a8a2f
mov esp, ebp
pop ebp
ret
push 0x94
xor esi, esi
lea eax, [ebp - 0x261c]
push esi
push eax
call fcn.004b2d10
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov dword [ebp - 0x25ec], esi
mov dword [ebp - 0x2614], 1
mov dword [ebp - 0x25e8], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, dword [ebp - 0x2628]
mov dword [ebp - 0x2618], eax
lea eax, [ebp - 0x61c]
mov dword [ebp - 0x2610], edx
mov dword [ebp - 0x260c], esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x40f8a0
sub eax, edx
sar eax, 1
lea edi, [eax + eax + 2]
lea esi, [edi + 0x94]
cmp esi, 0x2000
jbe 0x40f8c5
xor eax, eax
jmp 0x40f8f0
push edi
lea eax, [ebp - 0x61c]
push eax
lea ecx, [ebp - 0x2588]
push ecx
call fcn.004a8cb0
lea edx, [ebp + edi - 0x2588]
add esp, 0xc
mov ebx, esi
mov dword [ebp - 0x2624], edx
mov eax, 0x94
mov ecx, 0x11
lea esi, [ebp - 0x26a4]
lea edi, [ebp - 0x25dc]
mov dword [ebp - 0x2608], eax
rep movsd dword es:[edi], dword [esi]
lea esi, [ebx + 0x22]
mov edi, ebx
cmp esi, 0x2000
jbe 0x40f91a
xor eax, eax
jmp 0x40f93b
mov eax, dword [ebp - 0x2624]
push 0x22
push 0x4d6770
push eax
call fcn.004a8cb0
add esp, 0xc
add dword [ebp - 0x2624], 0x22
mov ebx, esi
mov eax, edi
mov edx, dword [ebp - 0x25d0]
mov dword [ebp - 0x25d4], eax
mov dword [ebp - 0x2628], ebx
test edx, edx
jne 0x40f955
xor eax, eax
jmp 0x40f9a1
mov eax, edx
lea esi, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40f960
sub eax, esi
sar eax, 1
lea esi, [eax + eax + 2]
lea edi, [esi + ebx]
cmp edi, 0x2000
jbe 0x40f982
xor eax, eax
jmp 0x40f9a1
mov ecx, dword [ebp - 0x2624]
push esi
push edx
push ecx
call fcn.004a8cb0
mov eax, dword [ebp - 0x2628]
add esp, 0xc
add dword [ebp - 0x2624], esi
mov ebx, edi
mov edx, dword [ebp - 0x2634]
xor edi, edi
mov dword [ebp - 0x25d0], eax
cmp edx, edi
je 0x40fa72
test dword [ebp + 0x10], 0x400
je 0x40fa04
cmp ebx, 0x2000
ja 0x40fa4a
lea esp, [esp]
mov eax, dword [ebp - 0x2620]
mov ecx, eax
shr ecx, 1
cmp word [edx + ecx*2], di
lea ecx, [edx + ecx*2]
jne 0x40f9e9
cmp word [ecx + 2], di
je 0x40f9ff
add eax, 2
lea ecx, [ebx + eax]
mov dword [ebp - 0x2620], eax
cmp ecx, 0x2000
jbe 0x40f9d0
jmp 0x40fa4c
add eax, 4
jmp 0x40fa4c
cmp ebx, 0x2000
ja 0x40fa4a
mov ecx, edx
mov eax, ebx
sub ecx, ebx
cmp byte [ecx + eax], 0
jne 0x40fa25
mov esi, dword [ebp - 0x2620]
cmp byte [edx + esi + 1], 0
je 0x40fa3b
inc dword [ebp - 0x2620]
inc eax
cmp eax, 0x2000
jbe 0x40fa12
mov eax, dword [ebp - 0x2620]
jmp 0x40fa4c
add dword [ebp - 0x2620], 2
mov eax, dword [ebp - 0x2620]
jmp 0x40fa4c
mov eax, edi
lea esi, [ebx + eax]
cmp esi, 0x2000
ja 0x40fa72
push eax
push edx
mov edx, dword [ebp - 0x2624]
push edx
call fcn.004a8cb0
mov dword [ebp - 0x25e4], ebx
add esp, 0xc
mov ebx, esi
jmp 0x40fa78
mov dword [ebp - 0x25e4], edi
push edi
mov edi, dword [ebp - 0x2630]
lea eax, [ebp - 0x2654]
push eax
push ebx
lea ecx, [ebp - 0x261c]
push ecx
push edi
mov dword [ebp - 0x261c], ebx
xor esi, esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
test eax, eax
je 0x40fb33
push 0xfa
call ebx
push esi
lea edx, [ebp - 0x2658]
push edx
push 0x1c
lea eax, [ebp - 0x2650]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40fb39
mov ecx, dword [ebp - 0x263c]
push ecx
push esi
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov eax, dword [ebp - 0x264c]
mov dword [ebp - 0x262c], eax
test eax, eax
je 0x40fb24
mov edx, dword [ebp - 0x2644]
mov eax, dword [ebp - 0x2640]
mov ecx, dword [ebp - 0x263c]
mov dword [0x4ef1f8], edx
mov edx, dword [ebp - 0x2638]
mov dword [0x4ef1fc], eax
mov dword [0x4ef200], ecx
mov dword [0x4ef204], edx
jmp 0x40fb39
mov eax, dword [ebp - 0x2648]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x40fb39
mov dword [ebp - 0x262c], esi
cmp dword [0x4ef1f8], 0
jne 0x40fb53
mov dword [0x4ef1f8], esi
test esi, esi
jne 0x40fb53
push 0x1388
call ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x262c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a8a2f
mov esp, ebp
pop ebp
ret