Function at 0x434a1f
Capabilities:
Get common file path
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2460
call fcn.0042dfe0
push esi
push edi
mov dword [ebp - 0x2460], ecx
mov word [ebp - 0x2454], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x2452]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 8], 0
mov word [ebp - 0x2228], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x2226]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 0x2020], 0
mov dword [ebp - 0x201c], 0
mov dword [ebp - 0x222c], 0
mov dword [ebp - 0x2018], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x2458], 0
mov dword [ebp - 0x2014], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x2230], 0x94
lea eax, [ebp - 0x1f7c]
mov dword [ebp - 0xc], eax
push 0x104
lea ecx, [ebp - 0x2454]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.winsta.dll
lea edx, [ebp - 0x2454]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x2454]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x201c], eax
cmp dword [ebp - 0x201c], 0
je 0x434b63
push str.WinStationQueryInformationW
mov ecx, dword [ebp - 0x201c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x245c], eax
cmp dword [ebp - 0x245c], 0
je 0x434b56
lea edx, [ebp - 0x2020]
push edx
push 0x208
lea eax, [ebp - 0x2228]
push eax
push 0x21
mov ecx, dword [ebp + 8]
push ecx
push 0
call dword [ebp - 0x245c]
and eax, 0xff
mov dword [ebp - 8], eax
mov edx, dword [ebp - 0x201c]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp - 8], 0
je 0x434b78
mov eax, dword [ebp - 0x2228]
and eax, 0xffff
test eax, eax
jne 0x434b91
mov ecx, dword [ebp + 8]
push ecx
push str..PipeTerminalServerSystemExecSrvr_d
lea edx, [ebp - 0x2228]
push edx
call dword [sym.imp.MSVCRT.dll_swprintf]
add esp, 0xc
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
lea eax, [ebp - 0x2228]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x222c], eax
cmp dword [ebp - 0x222c], 0xffffffff
jne 0x434bef
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe7
jne 0x434be8
push 0x7530
lea ecx, [ebp - 0x2228]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
jne 0x434be6
xor eax, eax
jmp 0x434ebf
jmp 0x434bef
xor eax, eax
jmp 0x434ebf
cmp dword [ebp - 0x222c], 0xffffffff
je 0x434b91
push 0x94
push 0
lea edx, [ebp - 0x2010]
push edx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x1fe0], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x2008], ecx
mov edx, dword [ebp + 0x28]
mov dword [ebp - 0x1fdc], edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x200c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2004], eax
lea ecx, [ebp - 0x2230]
push ecx
lea edx, [ebp - 0xc]
push edx
push 0x2000
lea eax, [ebp - 0x2010]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov ecx, dword [ebp - 0x2460]
call fcn.00434999
mov dword [ebp - 0x2000], eax
lea edx, [ebp - 0x2230]
push edx
lea eax, [ebp - 0xc]
push eax
push 0x2000
lea ecx, [ebp - 0x2010]
push ecx
mov edx, dword [ebp + 0x18]
push edx
mov ecx, dword [ebp - 0x2460]
call fcn.00434999
mov dword [ebp - 0x1ffc], eax
mov esi, dword [ebp + 0x34]
mov ecx, 0x11
lea edi, [ebp - 0x1fd0]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x2230]
push eax
lea ecx, [ebp - 0xc]
push ecx
push 0x2000
lea edx, [ebp - 0x2010]
push edx
mov eax, dword [ebp - 0x1fc8]
push eax
mov ecx, dword [ebp - 0x2460]
call fcn.00434999
mov dword [ebp - 0x1fc8], eax
lea ecx, [ebp - 0x2230]
push ecx
lea edx, [ebp - 0xc]
push edx
push 0x2000
lea eax, [ebp - 0x2010]
push eax
mov ecx, dword [ebp - 0x1fc4]
push ecx
mov ecx, dword [ebp - 0x2460]
call fcn.00434999
mov dword [ebp - 0x1fc4], eax
cmp dword [ebp + 0x2c], 0
je 0x434e01
mov edx, dword [ebp + 0x28]
and edx, 0x400
test edx, edx
je 0x434d68
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x2230]
cmp eax, 0x2000
ja 0x434d66
mov ecx, dword [ebp - 0x10]
shr ecx, 1
mov edx, dword [ebp + 0x2c]
xor eax, eax
mov ax, word [edx + ecx*2]
test eax, eax
jne 0x434d5b
mov ecx, dword [ebp - 0x10]
shr ecx, 1
mov edx, dword [ebp + 0x2c]
xor eax, eax
mov ax, word [edx + ecx*2 + 2]
test eax, eax
jne 0x434d5b
mov ecx, dword [ebp - 0x10]
add ecx, 4
mov dword [ebp - 0x10], ecx
jmp 0x434d66
mov edx, dword [ebp - 0x10]
add edx, 2
mov dword [ebp - 0x10], edx
jmp 0x434d1b
jmp 0x434da9
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x2230]
cmp eax, 0x2000
ja 0x434da9
mov ecx, dword [ebp + 0x2c]
add ecx, dword [ebp - 0x10]
movsx edx, byte [ecx]
test edx, edx
jne 0x434d9e
mov eax, dword [ebp + 0x2c]
add eax, dword [ebp - 0x10]
movsx ecx, byte [eax + 1]
test ecx, ecx
jne 0x434d9e
mov edx, dword [ebp - 0x10]
add edx, 2
mov dword [ebp - 0x10], edx
jmp 0x434da9
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
jmp 0x434d68
mov ecx, dword [ebp - 0x10]
add ecx, dword [ebp - 0x2230]
cmp ecx, 0x2000
ja 0x434df5
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp + 0x2c]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.MSVCRT.dll_memmove]
add esp, 0xc
mov edx, dword [ebp - 0x2230]
mov dword [ebp - 0x1fd8], edx
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x2230]
add ecx, dword [ebp - 0x10]
mov dword [ebp - 0x2230], ecx
jmp 0x434dff
mov dword [ebp - 0x1fd8], 0
jmp 0x434e0b
mov dword [ebp - 0x1fd8], 0
mov edx, dword [ebp - 0x2230]
mov dword [ebp - 0x2010], edx
push 0
lea eax, [ebp - 0x2014]
push eax
mov ecx, dword [ebp - 0x2010]
push ecx
lea edx, [ebp - 0x2010]
push edx
mov eax, dword [ebp - 0x222c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x434ea8
push 0
lea ecx, [ebp - 0x2458]
push ecx
push 0x1c
lea edx, [ebp - 0x224c]
push edx
mov eax, dword [ebp - 0x222c]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x434ea8
mov ecx, dword [ebp - 0x2248]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
je 0x434e99
mov edx, dword [ebp + 0x38]
mov eax, dword [ebp - 0x2240]
mov dword [edx], eax
mov ecx, dword [ebp - 0x223c]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0x2238]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 0x2234]
mov dword [edx + 0xc], ecx
jmp 0x434ea6
mov edx, dword [ebp - 0x2244]
push edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x434eaf
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x222c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x34