Function at 0x418c07
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x458
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x10], 0
call sym._agent_named_pipe_name
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._connect_to_named_pipe
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
je 0x418df2
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strbuf_finalise_agent_query
mov dword [ebp - 0x18], 0
jmp 0x418cbe
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
sub eax, dword [ebp - 0x18]
mov edx, dword [ebp + 8]
mov ecx, dword [edx]
mov edx, dword [ebp - 0x18]
add ecx, edx
mov dword [esp + 0x10], 0
lea edx, [ebp - 0x30]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WriteFile]
call eax
sub esp, 0x14
test eax, eax
setne al
mov byte [ebp - 0x25], al
movzx eax, byte [ebp - 0x25]
xor eax, 1
test al, al
jne 0x418df5
mov eax, dword [ebp - 0x30]
add dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
cmp dword [ebp - 0x18], eax
jb 0x418c67
cmp dword [ebp + 0x14], 0
jne 0x418d7d
call sym._strbuf_new_nm
mov dword [ebp - 0x10], eax
mov dword [esp + 0x10], 0
lea eax, [ebp - 0x34]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x400
lea eax, [ebp - 0x434]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_ReadFile]
call eax
sub esp, 0x14
test eax, eax
setne al
mov byte [ebp - 0x1d], al
movzx eax, byte [ebp - 0x1d]
xor eax, 1
test al, al
jne 0x418df8
mov eax, dword [ebp - 0x34]
mov dword [esp + 8], eax
lea eax, [ebp - 0x434]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._named_pipe_agent_accumulate_response
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x418cdb
cmp dword [ebp - 0x24], 0xffffffff
je 0x418dfb
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._strbuf_to_str
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp - 0x24]
mov dword [eax], edx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
jmp 0x418e15
mov dword [esp + 8], 0
mov dword [esp + 4], 0x14
mov dword [esp], 1
call sym._safemalloc
mov dword [ebp - 0xc], eax
mov dword [esp + 0xc], 0
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], sym._named_pipe_agent_gotdata
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._handle_input_new
mov edx, dword [ebp - 0xc]
mov dword [edx], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
mov dword [eax + 4], edx
mov dword [ebp - 0x14], 0xffffffff
call sym._strbuf_new_nm
mov edx, dword [ebp - 0xc]
mov dword [edx + 8], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + 0x14]
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + 0x18]
mov dword [eax + 0x10], edx
jmp 0x418e15
nop
jmp 0x418dfc
nop
jmp 0x418dfc
nop
jmp 0x418dfc
nop
mov eax, dword [ebp + 0xc]
mov dword [eax], 0
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
call sym._safefree
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._safefree
cmp dword [ebp - 0x14], 0xffffffff
je 0x418e41
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
cmp dword [ebp - 0x10], 0
je 0x418e52
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._strbuf_free
mov eax, dword [ebp - 0xc]
leave
ret