Function at 0x401d60
Capabilities:
Create thread
Read file on windows
Write file on windows

Disassembly:
push edi
lea edi, [esp + 8]
and esp, 0xfffffff8
push dword [edi - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x170
test byte [section..data], 8
jne 0x401fa0
mov dword [esp + 8], 0xa
mov dword [esp + 4], 0
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_wcstol]
mov dword [section..bss], eax
test eax, eax
jne 0x401dd0
mov eax, 1
test byte [section..data], 2
jne 0x4020a0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
lea esp, [edi - 8]
pop edi
ret
lea ebx, [ebp - 0x13c]
mov dword [esp + 0x10], 0x20
mov dword [esp + 0xc], eax
mov dword [esp + 8], str..pipemsica__x__d
mov dword [esp + 4], 0x18
mov dword [esp], ebx
call fcn.00401310
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xc0000000
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CreateFileW]
sub esp, 0x1c
mov esi, eax
cmp eax, 0xffffffff
je 0x4022c8
mov dword [esp + 4], 0
lea edi, [ebp - 0x15c]
lea ebx, [ebp - 0x14c]
mov dword [esp], 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
sub esp, 8
lea esi, [esi]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0x10
mov dword [esp + 4], ebx
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_ReadFile]
sub esp, 0x14
test eax, eax
je 0x402310
cmp dword [ebp - 0x15c], 0x10
jne 0x402310
mov eax, dword [ebx]
test eax, eax
jne 0x401ec0
mov eax, dword [ebx + 4]
test eax, eax
jne 0x401ec0
mov eax, dword [ebx + 8]
test eax, eax
jne 0x401ec0
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x402080
mov dword [esp], 0x10
call dword [sym.imp.ucrtbase.dll_malloc]
mov edx, dword [ebp - 0x14c]
mov dword [eax], edx
mov edx, dword [ebp - 0x148]
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x144]
mov dword [eax + 8], edx
mov edx, dword [ebp - 0x140]
mov dword [eax + 0xc], edx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x4012c0
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateThread]
mov dword [ebp - 0x154], 0
sub esp, 0x18
mov dword [ebp - 0x158], eax
lea eax, [ebp - 0x158]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], 8
mov dword [esp + 4], eax
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_WriteFile]
sub esp, 0x14
test eax, eax
je 0x401f6f
cmp dword [ebp - 0x15c], 8
je 0x401e68
test byte [section..data], 2
jne 0x4024c0
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
lea esp, [edi - 8]
pop edi
ret
test eax, eax
je 0x402448
shr eax, 0x10
je 0x402180
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov esi, eax
sub esp, 8
mov eax, str._invalid_
test esi, esi
jne 0x402193
movzx edx, word [ebx]
test dx, dx
je 0x402483
mov ecx, esi
lea esi, [esi + 1]
cmp word [ebx + ecx*2 + 2], 0
jne 0x401fe0
mov esi, 0x224c
mov dword [ebp - 0x160], ebx
lea eax, [ebp - 0x13a]
mov word [ebp - 0x13c], si
mov esi, ebx
jmp 0x40204b
cmp dx, 9
je 0x402240
cmp dx, 0xa
jne 0x40225e
mov edi, 0x6e5c
add eax, 2
mov word [eax - 2], di
lea edi, [ecx - 1]
test ecx, ecx
jle 0x402358
lea ecx, [ebp - 0x1a]
cmp eax, ecx
ja 0x402358
movzx edx, word [esi]
mov ecx, edi
add esi, 2
cmp dx, 0xd
je 0x402228
jbe 0x402010
cmp dx, 0x22
je 0x4022b0
cmp dx, 0x5c
jne 0x402251
mov ebx, 0x5c5c
add eax, 2
mov word [eax - 2], bx
jmp 0x402030
xor eax, eax
mov dword [ebp - 0x160], eax
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [ebp - 0x160]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
lea esp, [edi - 8]
pop edi
ret
test ebx, ebx
je 0x4024f6
mov eax, ebx
shr eax, 0x10
je 0x4024a8
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov esi, eax
sub esp, 8
mov eax, str._invalid_
test esi, esi
jne 0x4021ec
movzx edx, word [ebx]
test dx, dx
je 0x402462
lea esi, [esi]
mov ecx, esi
lea esi, [esi + 1]
cmp word [ebx + ecx*2 + 2], 0
jne 0x4020e8
mov edi, 0x224c
lea esi, [ebp - 0x13a]
mov word [ebp - 0x13c], di
lea edi, [ebp - 0x1a]
jmp 0x402148
cmp dx, 9
je 0x402408
cmp dx, 0xa
jne 0x40239c
mov eax, 0x6e5c
add esi, 2
mov word [esi - 2], ax
lea eax, [ecx - 1]
cmp esi, edi
ja 0x4021c0
test ecx, ecx
jle 0x4021c0
movzx edx, word [ebx]
mov ecx, eax
add ebx, 2
cmp dx, 0xd
je 0x402420
jbe 0x402110
cmp dx, 0x22
je 0x4023f0
cmp dx, 0x5c
jne 0x40238f
mov eax, 0x5c5c
add esi, 2
mov word [esi - 2], ax
jmp 0x402130
movzx eax, bx
mov dword [esp], str._04x
mov dword [esp + 4], eax
call fcn.00401c90
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x40807e
mov dword [esp + 8], 0x4088e8
mov dword [esp + 4], 0x406000
mov dword [esp], 3
call fcn.00401840
jmp 0x401d86
mov byte [esi], 0x22
test eax, eax
jle 0x40247b
mov edx, 0x2e2e
mov byte [esi + 3], 0x2e
lea eax, [esi + 4]
mov word [esi + 1], dx
mov byte [eax], 0
lea eax, [ebp - 0x13c]
mov dword [esp], eax
call fcn.004051e0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Invalid_parameter__s_n
mov dword [esp + 8], 0x4088e8
mov dword [esp + 4], 0x406000
mov dword [esp], 1
call fcn.00401840
lea esp, [ebp - 0xc]
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
lea esp, [edi - 8]
pop edi
ret
mov ebx, 0x725c
add eax, 2
mov word [eax - 2], bx
jmp 0x402030
mov edx, 0x745c
add eax, 2
mov word [eax - 2], dx
jmp 0x402030
lea edi, [edx - 0x20]
cmp di, 0x5e
jbe 0x402438
mov edi, edx
mov byte [eax], 0x5c
add eax, 5
shr di, 0xc
movzx edi, di
movzx ebx, byte [edi + str.0123456789abcdefcustom_action_server]
mov edi, edx
shr di, 8
and edi, 0xf
mov byte [eax - 4], bl
movzx ebx, byte [edi + str.0123456789abcdefcustom_action_server]
mov edi, edx
and edx, 0xf
shr di, 4
movzx edx, byte [edx + str.0123456789abcdefcustom_action_server]
and edi, 0xf
mov byte [eax - 3], bl
movzx ebx, byte [edi + str.0123456789abcdefcustom_action_server]
mov byte [eax - 1], dl
mov byte [eax - 2], bl
jmp 0x402030
mov edi, 0x225c
add eax, 2
mov word [eax - 2], di
jmp 0x402030
test byte [section..data], 2
je 0x401f82
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 0xc], str.Failed_to_create_custom_action_server_pipe:__lu_n
mov dword [esp + 8], 0x4088e8
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x406000
mov dword [esp], 1
call fcn.00401840
jmp 0x401f82
test byte [section..data], 2
je 0x401f7c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 0xc], str.Failed_to_read_from_custom_action_server_pipe:__lu_n
mov dword [esp + 8], 0x4088e8
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x406000
mov dword [esp], 1
call fcn.00401840
jmp 0x401f7c
mov byte [eax], 0x22
mov ebx, dword [ebp - 0x160]
test edi, edi
jle 0x40249c
mov ecx, 0x2e2e
mov byte [eax + 3], 0x2e
lea edx, [eax + 4]
mov word [eax + 1], cx
lea eax, [ebp - 0x13c]
mov byte [edx], 0
mov dword [esp], eax
call fcn.004051e0
jmp 0x402193
lea eax, [edx - 0x20]
cmp ax, 0x5e
jbe 0x402458
mov eax, edx
mov byte [esi], 0x5c
add esi, 5
shr ax, 0xc
movzx eax, ax
movzx eax, byte [eax + str.0123456789abcdefcustom_action_server]
mov byte [esi - 4], al
mov eax, edx
shr ax, 8
and eax, 0xf
movzx eax, byte [eax + str.0123456789abcdefcustom_action_server]
mov byte [esi - 3], al
mov eax, edx
and edx, 0xf
shr ax, 4
and eax, 0xf
movzx eax, byte [eax + str.0123456789abcdefcustom_action_server]
mov byte [esi - 2], al
movzx eax, byte [edx + str.0123456789abcdefcustom_action_server]
mov byte [esi - 1], al
jmp 0x402130
mov eax, 0x225c
add esi, 2
mov word [esi - 2], ax
jmp 0x402130
mov eax, 0x745c
add esi, 2
mov word [esi - 2], ax
jmp 0x402130
mov eax, 0x725c
add esi, 2
mov word [esi - 2], ax
jmp 0x402130
mov byte [eax], dl
add eax, 1
jmp 0x402030
mov eax, str._null_
jmp 0x402193
mov byte [esi], dl
add esi, 1
jmp 0x402130
mov eax, 0x224c
mov byte [ebp - 0x13a], 0x22
lea esi, [ebp - 0x13a]
mov word [ebp - 0x13c], ax
lea eax, [esi + 1]
jmp 0x4021db
mov byte [ebp - 0x13a], 0x22
mov eax, 0x224c
mov word [ebp - 0x13c], ax
lea eax, [ebp - 0x13a]
lea edx, [eax + 1]
jmp 0x402379
movzx ebx, bx
mov dword [esp], str._04x
mov dword [esp + 4], ebx
call fcn.00401c90
jmp 0x4021ec
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 0xc], str.Failed_to_write_to_custom_action_server_pipe:__lu_n
mov dword [esp + 8], 0x4088e8
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x406000
mov dword [esp], 1
call fcn.00401840
jmp 0x401f7c
mov eax, str._null_
jmp 0x4021ec