Function at 0x4ead10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4724
call fcn.00609980
mov eax, dword [0x7286bc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str..pipePCMasterSvc
lea ecx, [ebp - 0x46f8]
call fcn.004177e7
mov esi, dword [ebp - 0x46f8]
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push ebx
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x4700], eax
cmp eax, 0xffffffff
je 0x4eb057
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
je 0x4eb051
push 0x800
mov dword [ebp - 0x46f4], ebx
call fcn.00609926
mov edi, eax
mov dword [esp], 0x800
push ebx
push edi
mov dword [ebp - 0x4704], edi
call fcn.0060b7a0
mov ecx, dword [ebp - 0x46f4]
lea eax, [ebp - 0x46f8]
push eax
mov eax, 0x800
mov dword [ebp - 0x46f8], 0x1000
sub eax, ecx
push eax
lea eax, [edi + ecx]
push eax
call fcn.00435bac
mov ecx, dword [ebp - 0x46f4]
add ecx, eax
lea eax, [ebp + 0x10]
push eax
mov eax, 0x800
mov dword [ebp - 0x46f4], ecx
sub eax, ecx
push eax
lea eax, [edi + ecx]
push eax
call fcn.00435bd4
mov ecx, dword [ebp - 0x46f4]
add ecx, eax
lea eax, [ebp + 8]
push eax
mov eax, 0x800
mov dword [ebp - 0x46f4], ecx
sub eax, ecx
push eax
lea eax, [edi + ecx]
push eax
call fcn.005083ba
mov ecx, dword [ebp - 0x46f4]
add ecx, eax
lea eax, [ebp + 0xc]
push eax
mov eax, 0x800
mov dword [ebp - 0x46f4], ecx
sub eax, ecx
push eax
lea eax, [edi + ecx]
push eax
call fcn.005083ba
add dword [ebp - 0x46f4], eax
push ebx
call fcn.00643abc
add esp, 0x40
mov dword [ebp - 0x470c], eax
lea eax, [ebp - 0x46fc]
mov dword [ebp - 0x4708], edx
lea ecx, [ebp - 0x470c]
push 0x68c058
push eax
call fcn.00472996
lea eax, [ebp + 8]
mov ebx, 0x68c080
push eax
lea eax, [ebp - 0x46f8]
push ebx
push eax
call fcn.0044c94c
add esp, 0xc
lea ecx, [ebp - 0x46fc]
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
call fcn.00419f48
mov ecx, dword [ebp - 0x46f8]
lea ecx, [ecx - 0x10]
call fcn.00419521
mov eax, dword [ebp + 0xc]
cmp dword [eax - 0xc], 0
je 0x4eaed1
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x46f8]
push ebx
push eax
call fcn.0044c94c
add esp, 0xc
lea ecx, [ebp - 0x46fc]
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
call fcn.00419f48
mov ecx, dword [ebp - 0x46f8]
lea ecx, [ecx - 0x10]
call fcn.00419521
lea ecx, [ebp - 0x4724]
call fcn.00417833
push ecx
mov ecx, esp
push 0x68c084
call fcn.004177e7
push ecx
push esp
lea ecx, [ebp - 0x4724]
call fcn.00454cc3
lea eax, [ebp - 0x46f8]
push eax
lea ecx, [ebp - 0x4724]
call fcn.0041934b
mov eax, dword [ebp - 0x46fc]
push 1
push ecx
add eax, 0xfffffff0
mov ebx, esp
push eax
mov dword [ebp - 0x46fc], eax
call fcn.00418dea
pop ecx
push dword [ebp - 0x46f8]
add eax, 0x10
mov dword [ebx], eax
call fcn.00508654
mov ecx, dword [ebp - 0x46f4]
add esp, 0xc
mov edx, ecx
and edx, 7
je 0x4eaf50
push 8
pop eax
sub eax, edx
add ecx, eax
mov dword [ebp - 0x46f4], ecx
push 0x1000
xor ebx, ebx
lea eax, [ebp - 0x1004]
push ebx
push eax
call fcn.0060b7a0
push 0x1000
lea eax, [ebp - 0x2004]
push ebx
push eax
call fcn.0060b7a0
add esp, 0x18
lea ecx, [ebp - 0x46f0]
push ebx
push str._ruanmeipcmaster_svc_named_pipe
call fcn.004a6f7b
push ebx
push dword [ebp - 0x46f4]
lea ecx, [ebp - 0x46f0]
push edi
call fcn.0046abc9
mov ebx, dword [ebp - 0x46f4]
lea eax, [ebp - 0x1004]
shl ebx, 3
lea ecx, [ebp - 0x46f0]
push ebx
push eax
lea eax, [ebp - 0x4005]
push eax
call fcn.00456635
push ebx
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x2004]
push eax
lea ecx, [ebp - 0x46f0]
call fcn.004565c5
lea eax, [ebp - 0x2004]
mov ebx, 0x800
push eax
push ebx
push edi
call fcn.0061816b
add esp, 0xc
lea eax, [ebp - 0x46f4]
push 0
push eax
push ebx
push edi
mov edi, dword [ebp - 0x4700]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x46f8]
xor ebx, ebx
inc ebx
lea ecx, [ecx - 0x10]
call fcn.00419521
lea ecx, [ebp - 0x4724]
call fcn.00418dd0
mov ecx, dword [ebp - 0x4714]
lea ecx, [ecx - 0x10]
call fcn.00419521
mov ecx, dword [ebp - 0x46fc]
call fcn.00419521
lea ecx, [ebp - 0x4704]
call fcn.00447a37
jmp 0x4eb057
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esi - 0x10]
call fcn.00419521
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00419521
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.00419521
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00609802
mov esp, ebp
pop ebp
ret