Function at 0x401cf0
Capabilities:
Create thread
Read file on windows
Write file on windows

Disassembly:
push edi
lea edi, [esp + 8]
and esp, 0xfffffff8
push dword [edi - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x170
test byte [section..data], 8
jne 0x401f20
mov dword [esp + 8], 0xa
mov dword [esp + 4], 0
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_wcstol]
mov dword [section..bss], eax
test eax, eax
jne 0x401d58
test byte [section..data], 2
mov eax, 1
jne 0x402008
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
lea esp, [edi - 8]
pop edi
ret
lea ebx, [ebp - 0x13c]
mov dword [esp + 0x10], 0x20
mov dword [esp + 0xc], eax
mov dword [esp + 8], str..pipemsica__x__d
mov dword [esp + 4], 0x18
mov dword [esp], ebx
call fcn.00401300
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xc0000000
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CreateFileW]
sub esp, 0x1c
mov esi, eax
cmp eax, 0xffffffff
je 0x4021c0
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
lea edi, [ebp - 0x15c]
lea ebx, [ebp - 0x14c]
push eax
push eax
lea esi, [esi]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0x10
mov dword [esp + 4], ebx
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_ReadFile]
sub esp, 0x14
test eax, eax
je 0x402208
cmp dword [ebp - 0x15c], 0x10
jne 0x402208
mov eax, dword [ebx]
test eax, eax
jne 0x401e48
mov ecx, dword [ebx + 4]
test ecx, ecx
jne 0x401e48
mov edx, dword [ebx + 8]
test edx, edx
jne 0x401e48
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x401fe8
mov dword [esp], 0x10
call dword [sym.imp.ucrtbase.dll_malloc]
mov edx, dword [ebp - 0x14c]
mov dword [eax], edx
mov edx, dword [ebp - 0x148]
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x144]
mov dword [eax + 8], edx
mov edx, dword [ebp - 0x140]
mov dword [eax + 0xc], edx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x4012b0
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateThread]
mov dword [ebp - 0x154], 0
sub esp, 0x18
mov dword [ebp - 0x158], eax
lea eax, [ebp - 0x158]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], 8
mov dword [esp + 4], eax
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_WriteFile]
sub esp, 0x14
test eax, eax
je 0x401ef7
cmp dword [ebp - 0x15c], 8
je 0x401df0
test byte [section..data], 2
jne 0x402408
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
lea esp, [edi - 8]
pop edi
ret
test eax, eax
je 0x402330
shr eax, 0x10
je 0x4020e8
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
test eax, eax
push edi
push edi
jne 0x402320
mov dx, word [ebx]
test dx, dx
je 0x4023c3
mov ecx, eax
lea eax, [eax + 1]
cmp word [ebx + ecx*2 + 2], 0
jne 0x401f58
mov word [ebp - 0x13c], 0x224c
mov esi, ebx
lea eax, [ebp - 0x13a]
mov dword [ebp - 0x160], ebx
jmp 0x401fbb
cmp dx, 9
je 0x4021b0
cmp dx, 0xa
jne 0x402139
mov word [eax], 0x6e5c
add eax, 2
lea esi, [esi]
lea edi, [ecx - 1]
test ecx, ecx
jle 0x402250
lea ecx, [ebp - 0x1a]
cmp eax, ecx
ja 0x402250
mov dx, word [esi]
mov ecx, edi
add esi, 2
cmp dx, 0xd
je 0x4021a0
jbe 0x401f80
cmp dx, 0x22
je 0x402190
cmp dx, 0x5c
jne 0x40212c
mov word [eax], 0x5c5c
add eax, 2
jmp 0x401fa0
xor eax, eax
mov dword [ebp - 0x160], eax
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [ebp - 0x160]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
lea esp, [edi - 8]
pop edi
ret
test ebx, ebx
je 0x402448
mov eax, ebx
shr eax, 0x10
je 0x4023e8
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
test eax, eax
push esi
push esi
jne 0x40243e
mov dx, word [ebx]
test dx, dx
je 0x4023a8
lea esi, [esi]
mov ecx, eax
lea eax, [eax + 1]
cmp word [ebx + ecx*2 + 2], 0
jne 0x402048
mov word [ebp - 0x13c], 0x224c
lea eax, [ebp - 0x13a]
lea edi, [ebp - 0x1a]
mov dword [ebp - 0x160], ebx
jmp 0x4020ae
cmp dx, 9
je 0x402298
cmp dx, 0xa
jne 0x4022b2
mov word [eax], 0x6e5c
add eax, 2
lea esi, [esi]
lea esi, [ecx - 1]
cmp eax, edi
ja 0x402340
test ecx, ecx
jle 0x402340
mov ecx, dword [ebp - 0x160]
mov dx, word [ecx]
mov ecx, esi
mov ebx, dword [ebp - 0x160]
add ebx, 2
cmp dx, 0xd
mov dword [ebp - 0x160], ebx
je 0x402288
jbe 0x402070
cmp dx, 0x22
je 0x402308
cmp dx, 0x5c
jne 0x4022a5
mov word [eax], 0x5c5c
add eax, 2
jmp 0x402090
mov eax, ebx
mov dword [esp], str._04x
and eax, 0xffff
mov dword [esp + 4], eax
call fcn.00401c20
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x40807e
mov dword [esp + 8], 0x4088e8
mov dword [esp + 4], 0x406000
mov dword [esp], 3
call fcn.004017e0
jmp 0x401d16
lea edi, [edx - 0x20]
cmp di, 0x5e
jbe 0x402318
mov edi, edx
mov byte [eax], 0x5c
shr di, 0xc
add eax, 5
and edi, 0xffff
mov bl, byte [edi + str.0123456789abcdefcustom_action_server]
mov edi, edx
shr di, 8
mov byte [eax - 4], bl
and edi, 0xf
mov bl, byte [edi + str.0123456789abcdefcustom_action_server]
mov edi, edx
shr di, 4
and edx, 0xf
and edi, 0xf
mov byte [eax - 3], bl
mov bl, byte [edi + str.0123456789abcdefcustom_action_server]
mov byte [eax - 2], bl
mov bl, byte [edx + str.0123456789abcdefcustom_action_server]
mov byte [eax - 1], bl
jmp 0x401fa0
mov word [eax], 0x225c
add eax, 2
jmp 0x401fa0
mov word [eax], 0x725c
add eax, 2
jmp 0x401fa0
mov word [eax], 0x745c
add eax, 2
jmp 0x401fa0
test byte [section..data], 2
je 0x401f0a
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 0xc], str.Failed_to_create_custom_action_server_pipe:__lu_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0x4088e8
mov dword [esp + 4], 0x406000
mov dword [esp], 1
call fcn.004017e0
jmp 0x401f0a
test byte [section..data], 2
je 0x401f04
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 0xc], str.Failed_to_read_from_custom_action_server_pipe:__lu_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0x4088e8
mov dword [esp + 4], 0x406000
mov dword [esp], 1
call fcn.004017e0
jmp 0x401f04
mov ebx, dword [ebp - 0x160]
mov byte [eax], 0x22
test edi, edi
jle 0x4023d9
lea edx, [eax + 4]
mov word [eax + 1], 0x2e2e
mov byte [eax + 3], 0x2e
lea eax, [ebp - 0x13c]
mov byte [edx], 0
mov dword [esp], eax
call fcn.00405190
jmp 0x4020ff
mov word [eax], 0x725c
add eax, 2
jmp 0x402090
mov word [eax], 0x745c
add eax, 2
jmp 0x402090
lea esi, [edx - 0x20]
cmp si, 0x5e
jbe 0x4023a0
mov esi, edx
mov byte [eax], 0x5c
shr si, 0xc
add eax, 5
and esi, 0xffff
mov bl, byte [esi + str.0123456789abcdefcustom_action_server]
mov esi, edx
shr si, 8
mov byte [eax - 4], bl
and esi, 0xf
mov bl, byte [esi + str.0123456789abcdefcustom_action_server]
mov esi, edx
shr si, 4
and edx, 0xf
and esi, 0xf
mov byte [eax - 3], bl
mov bl, byte [esi + str.0123456789abcdefcustom_action_server]
mov byte [eax - 2], bl
mov bl, byte [edx + str.0123456789abcdefcustom_action_server]
mov byte [eax - 1], bl
jmp 0x402090
mov word [eax], 0x225c
add eax, 2
jmp 0x402090
mov byte [eax], dl
inc eax
jmp 0x401fa0
mov eax, str._invalid_
jmp 0x4020ff
mov eax, str._null_
jmp 0x4020ff
mov byte [eax], 0x22
test esi, esi
jle 0x4023be
lea edx, [eax + 4]
mov word [eax + 1], 0x2e2e
mov byte [eax + 3], 0x2e
lea eax, [ebp - 0x13c]
mov byte [edx], 0
mov dword [esp], eax
call fcn.00405190
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Invalid_parameter__s_n
mov dword [esp + 8], 0x4088e8
mov dword [esp + 4], 0x406000
mov dword [esp], 1
call fcn.004017e0
lea esp, [ebp - 0xc]
pop ebx
mov eax, 1
pop esi
pop edi
pop ebp
lea esp, [edi - 8]
pop edi
ret
mov byte [eax], dl
inc eax
jmp 0x402090
mov word [ebp - 0x13c], 0x224c
mov byte [ebp - 0x13a], 0x22
lea eax, [ebp - 0x13a]
lea edx, [eax + 1]
jmp 0x402354
mov word [ebp - 0x13c], 0x224c
mov byte [ebp - 0x13a], 0x22
lea eax, [ebp - 0x13a]
lea edx, [eax + 1]
jmp 0x40226e
and ebx, 0xffff
mov dword [esp], str._04x
mov dword [esp + 4], ebx
call fcn.00401c20
jmp 0x402365
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 0xc], str.Failed_to_write_to_custom_action_server_pipe:__lu_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0x4088e8
mov dword [esp + 4], 0x406000
mov dword [esp], 1
call fcn.004017e0
jmp 0x401f04
mov eax, str._invalid_
jmp 0x402365
mov eax, str._null_
jmp 0x402365