Function at 0x44aa40
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov eax, dword [rdx + 0x58]
mov rdi, rcx
mov rbx, rdx
test ah, 1
je 0x44a981
test eax, 0x20000
jne 0x44a963
cmp qword [rbx + 0x118], 0xffffffffffffffff
je 0x44a9d0
mov edx, dword [rbx + 0x58]
lea rsi, [rbx + 0x80]
test edx, 0x1000000
je 0x44a830
mov r8d, 0x10
mov rdx, rsi
lea rcx, [0x0044a440]
call qword [sym.imp.KERNEL32.dll_QueueUserWorkItem]
test eax, eax
je 0x44a900
mov rcx, rbx
call fcn.0044a750
or dword [rbx + 0x58], 0x20000
add dword [rbx + 0x78], 1
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rax, [rbx + 0xc0]
and edx, 0x100000
mov qword [rbx + 0xc0], 0
mov qword [rax + 8], 0
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0
je 0x44a874
mov rdx, qword [rbx + 0xf0]
or rdx, 1
mov qword [rbx + 0xd8], rdx
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbx + 0x118]
mov qword [rsp + 0x20], rax
lea rdx, [0x0054c860]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x44a9a2
test byte [rbx + 0x5a], 0x10
je 0x44a813
cmp qword [rbx + 0xf0], 0
je 0x44aa00
cmp qword [rbx + 0xf8], 0xffffffffffffffff
jne 0x44a813
mov rdx, qword [rbx + 0xd8]
lea rcx, [rbx + 0xf8]
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0xffffffff
mov r9, rsi
lea r8, [0x0044abe0]
call qword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
test eax, eax
jne 0x44a813
nop word [rax + rax]
mov rbp, qword [sym.imp.KERNEL32.dll_GetLastError]
call rbp
test eax, eax
jle 0x44a9c0
call rbp
movzx eax, ax
or eax, 0x80070000
cdqe
mov qword [rbx + 0xc0], rax
mov rax, qword [rdi + 0x48]
mov qword [rbx + 0xe8], 0
test rax, rax
je 0x44a9f0
mov rdx, qword [rax + 0x68]
mov qword [rbx + 0xe8], rdx
mov qword [rax + 0x68], rsi
mov qword [rdi + 0x48], rsi
or dword [rbx + 0x58], 0x20000
add dword [rbx + 0x78], 1
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rdx, str.src_win_pipe.c
lea rcx, [0x0051b538]
mov r8d, 0x44a
call fcn.00472160
jmp 0x44a7d5
lea rdx, str.src_win_pipe.c
lea rcx, [0x0051b510]
mov r8d, 0x449
call fcn.00472160
mov eax, dword [rbx + 0x58]
jmp 0x44a7ca
mov rbp, qword [sym.imp.KERNEL32.dll_GetLastError]
call rbp
cmp eax, 0x3e5
jne 0x44a907
jmp 0x44a89b
call rbp
cdqe
jmp 0x44a91d
lea rdx, str.src_win_pipe.c
lea rcx, str.handle__handle___INVALID_HANDLE_VALUE
mov r8d, 0x44c
call fcn.00472160
jmp 0x44a7e3
mov qword [rbx + 0xe8], rsi
mov qword [rdi + 0x48], rsi
jmp 0x44a94f
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
test rax, rax
mov qword [rbx + 0xf0], rax
jne 0x44a8b3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x0051b58f]
mov ecx, eax
call fcn.00440240
nop
nop
nop word cs:[rax + rax]
push rdi
push rsi
push rbx
sub rsp, 0x40
cmp dword [rcx + 8], 3
mov rsi, qword [rcx + 0x80]
mov rbx, rcx
mov rdi, qword [rsi + 8]
je 0x44aa74
lea rdx, str.src_win_pipe.c
lea rcx, str.req__type__UV_WRITE
mov r8d, 0x40c
call fcn.00472160
cmp dword [rsi + 0x10], 7
je 0x44aa93
lea rdx, str.src_win_pipe.c
lea rcx, str.handle__type__UV_NAMED_PIPE
mov r8d, 0x40d
call fcn.00472160
mov rdx, qword [rbx + 0x98]
test rdx, rdx
je 0x44ab20
mov rcx, qword [rsi + 0x118]
lea r9, [rsp + 0x3c]
mov qword [rsp + 0x20], 0
mov r8d, dword [rbx + 0x90]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x44aaf0
xor r8d, r8d
xor edx, edx
mov rcx, qword [rdi + 0x38]
lea r9, [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
test eax, eax
je 0x44ab45
xor eax, eax
add rsp, 0x40
pop rbx
pop rsi
pop rdi
ret
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
call rsi
test eax, eax
jle 0x44ab10
call rsi
movzx eax, ax
or eax, 0x80070000
cdqe
mov qword [rbx + 0x40], rax
jmp 0x44aac9
call rsi
cdqe
jmp 0x44ab09
lea rdx, str.src_win_pipe.c
lea rcx, str.req__write_buffer.base
mov r8d, 0x40e
call fcn.00472160
mov rdx, qword [rbx + 0x98]
jmp 0x44aaa3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x0051b4f5]
mov ecx, eax
call fcn.00440240
nop
nop word [rax + rax]