Function at 0x457410
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov eax, dword [rdx + 0x58]
mov rdi, rcx
mov rbx, rdx
test ah, 1
je 0x457370
test eax, 0x20000
jne 0x457323
cmp qword [rbx + 0x118], 0xffffffffffffffff
je 0x45734a
mov eax, dword [rbx + 0x58]
lea rsi, [rbx + 0x80]
test eax, 0x1000000
je 0x4571f0
mov r8d, 0x10
mov rdx, rsi
lea rcx, [0x00456de0]
call qword [sym.imp.KERNEL32.dll_QueueUserWorkItem]
test eax, eax
je 0x4572c0
mov rcx, rbx
call fcn.00457110
or dword [rbx + 0x58], 0x20000
add dword [rbx + 0x78], 1
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rdx, [rbx + 0xc0]
test eax, 0x100000
mov qword [rbx + 0xc0], 0
mov qword [rbx + 0xc8], 0
mov qword [rdx + 0x10], 0
mov qword [rdx + 0x18], 0
je 0x457236
mov rax, qword [rbx + 0xf0]
or rax, 1
mov qword [rbx + 0xd8], rax
mov qword [rsp + 0x20], rdx
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbx + 0x118]
lea rdx, [0x004e58a0]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x457391
test byte [rbx + 0x5a], 0x10
je 0x4571d2
cmp qword [rbx + 0xf0], 0
je 0x4573d0
cmp qword [rbx + 0xf8], 0xffffffffffffffff
jne 0x4571d2
mov rdx, qword [rbx + 0xd8]
lea rcx, [rbx + 0xf8]
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0xffffffff
mov r9, rsi
lea r8, [0x004576a0]
call qword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
test eax, eax
jne 0x4571d2
nop dword [rax]
mov rbp, qword [sym.imp.KERNEL32.dll_GetLastError]
call rbp
test eax, eax
jle 0x4573b0
call rbp
movzx eax, ax
or eax, 0x80070000
cdqe
mov qword [rbx + 0xc0], rax
mov rax, qword [rdi + 0x48]
mov qword [rbx + 0xe8], 0
test rax, rax
je 0x4573c0
mov rdx, qword [rax + 0x68]
mov qword [rbx + 0xe8], rdx
mov qword [rax + 0x68], rsi
mov qword [rdi + 0x48], rsi
or dword [rbx + 0x58], 0x20000
add dword [rbx + 0x78], 1
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rdx, str.src_win_pipe.c
lea rcx, [0x004c9d08]
mov r8d, 0x442
call fcn.0048c6c0
cmp qword [rbx + 0x118], 0xffffffffffffffff
jne 0x4571a3
lea rdx, str.src_win_pipe.c
lea rcx, str.handle__handle___INVALID_HANDLE_VALUE
mov r8d, 0x444
call fcn.0048c6c0
jmp 0x4571a3
lea rdx, str.src_win_pipe.c
lea rcx, [0x004c9ce0]
mov r8d, 0x441
call fcn.0048c6c0
mov eax, dword [rbx + 0x58]
jmp 0x45718a
mov rbp, qword [sym.imp.KERNEL32.dll_GetLastError]
call rbp
cmp eax, 0x3e5
je 0x45725d
jmp 0x4572c7
call rbp
cdqe
jmp 0x4572dd
mov qword [rbx + 0xe8], rsi
mov qword [rdi + 0x48], rsi
jmp 0x45730f
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
test rax, rax
mov qword [rbx + 0xf0], rax
jne 0x457275
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x004c9d5f]
mov ecx, eax
call fcn.0044c530
nop
nop
nop word cs:[rax + rax]
push rdi
push rsi
push rbx
sub rsp, 0x40
cmp dword [rcx + 8], 3
mov rsi, qword [rcx + 0x80]
mov rbx, rcx
mov rdi, qword [rsi + 8]
je 0x457444
lea rdx, str.src_win_pipe.c
lea rcx, str.req__type__UV_WRITE
mov r8d, 0x404
call fcn.0048c6c0
cmp dword [rsi + 0x10], 7
je 0x457463
lea rdx, str.src_win_pipe.c
lea rcx, str.handle__type__UV_NAMED_PIPE
mov r8d, 0x405
call fcn.0048c6c0
mov rdx, qword [rbx + 0x98]
test rdx, rdx
je 0x4574e0
mov rcx, qword [rsi + 0x118]
lea r9, [rsp + 0x3c]
mov qword [rsp + 0x20], 0
mov r8d, dword [rbx + 0x90]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4574c0
xor r8d, r8d
xor edx, edx
mov rcx, qword [rdi + 0x38]
lea r9, [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
test eax, eax
je 0x45750b
xor eax, eax
add rsp, 0x40
pop rbx
pop rsi
pop rdi
ret
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
call rsi
test eax, eax
jle 0x457505
call rsi
movzx eax, ax
or eax, 0x80070000
cdqe
mov qword [rbx + 0x40], rax
jmp 0x457495
lea rdx, str.src_win_pipe.c
lea rcx, str.req__write_buffer.base
mov r8d, 0x406
call fcn.0048c6c0
mov rdx, qword [rbx + 0x98]
jmp 0x45746f
call rsi
cdqe
jmp 0x4574d9
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x004c9cc5]
mov ecx, eax
call fcn.0044c530
nop