Function at 0x10034530
Capabilities:
Read file on windows
Read pipe
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005b777
mov eax, dword fs:[0]
push eax
sub esp, 0x454
mov eax, dword [0x101c200c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x418], ebx
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x444], eax
mov ecx, dword [esi + 0x14]
mov dword [ebp - 0x438], ecx
cmp ecx, 0xffff
jle 0x1003461b
mov edi, dword [esi + 0xc]
lea ebx, [ecx - 0xffff]
add ebx, edi
cmp edi, ebx
ja 0x100345ac
push 0xa
push edi
call fcn.1003ec92
add esp, 8
test eax, eax
je 0x100345ac
lea edi, [eax + 2]
cmp edi, ebx
jbe 0x10034596
mov eax, dword [esi + 0x14]
test eax, eax
jne 0x100345b7
xor ecx, ecx
jmp 0x100345ba
mov ecx, dword [esi + 0xc]
sub edi, ecx
test edi, edi
jle 0x1003460a
cmp edi, eax
jge 0x100345ed
mov ecx, dword [esi + 0xc]
sub eax, edi
push eax
lea eax, [ecx + edi]
push eax
push ecx
call fcn.10040960
mov eax, dword [esi + 0x14]
add esp, 0xc
cmp eax, edi
je 0x100345ed
sub eax, edi
mov ecx, esi
push eax
call fcn.10036b10
mov ecx, dword [esi + 0x14]
jmp 0x1003460f
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x100345fc
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 0xc]
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
xor ecx, ecx
mov dword [esi + 0x14], ecx
mov ebx, dword [ebp - 0x418]
mov dword [ebp - 0x438], ecx
cmp ecx, 2
jb 0x10034633
mov eax, dword [esi + 0xc]
movzx eax, word [eax + ecx - 2]
test ax, ax
jne 0x10034633
lea eax, [ecx - 2]
mov dword [esi + 0x14], eax
mov dword [ebp - method.CWString.virtual_0], vtable.CVolCommonBaseWithMemManager.0
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov dword [ebp - 0x430], 0
mov dword [ebp - 0x42c], 0
mov dword [ebp - 4], 0
mov dword [ebp - method.CWString.virtual_0], vtable.CVolMem.0
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x420], 0
mov dword [ebp - 0x424], 0
mov dword [ebp - 0x41c], 0x40
mov dword [ebp - 4], 1
lea eax, [ebp - 0x414]
push 0
push eax
push 0
push 0
push 0
push ebx
mov dword [ebp - 0x43c], 1
mov dword [ebp - 0x414], 0
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x10034803
nop dword [eax]
cmp dword [ebp - 0x414], 0
je 0x1003480d
push 0
lea eax, [ebp - 0x414]
mov dword [ebp - 0x414], 0
push eax
push 0x400
lea eax, [ebp - 0x410]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10034803
mov edi, dword [ebp - 0x414]
test edi, edi
je 0x1003480d
mov eax, dword [ebp - 0x424]
mov ebx, dword [ebp - 0x420]
sub eax, ebx
cmp eax, edi
jl 0x100347af
cmp edi, 1
jne 0x1003474f
mov eax, dword [ebp - 0x428]
movzx ecx, byte [ebp - 0x410]
mov byte [ebx + eax], cl
inc dword [ebp - 0x420]
jmp 0x100347d5
cmp edi, 2
jne 0x1003476d
mov eax, dword [ebp - 0x428]
movzx ecx, word [ebp - 0x410]
mov word [ebx + eax], cx
add dword [ebp - 0x420], edi
jmp 0x100347d5
cmp edi, 4
jne 0x10034789
mov ecx, dword [ebp - 0x428]
mov eax, dword [ebp - 0x410]
mov dword [ebx + ecx], eax
add dword [ebp - 0x420], edi
jmp 0x100347d5
cmp edi, 8
jne 0x100347af
mov eax, dword [ebp - 0x428]
mov ecx, dword [ebp - 0x410]
mov edx, dword [ebp - 0x40c]
mov dword [ebx + eax], ecx
mov dword [ebx + eax + 4], edx
add dword [ebp - 0x420], edi
jmp 0x100347d5
test edi, edi
jle 0x100347d5
lea eax, [edi + ebx]
push eax
lea ecx, [ebp - 0x434]
call fcn.10036b10
push edi
lea ecx, [ebp - 0x410]
add eax, ebx
push ecx
push eax
call fcn.10040960
add esp, 0xc
mov ebx, dword [ebp - 0x418]
lea eax, [ebp - 0x414]
push 0
push eax
push 0
push 0
push 0
push ebx
mov dword [ebp - 0x414], 0
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
jne 0x100346d0
mov dword [ebp - 0x43c], 0
mov ecx, dword [ebp - 0x420]
mov dword [ebp - 0x418], ecx
test ecx, ecx
je 0x10034bbd
mov edx, dword [ebp - 0x424]
mov eax, edx
sub eax, ecx
cmp eax, 4
jl 0x10034849
mov eax, dword [ebp - 0x428]
mov dword [ecx + eax], 0
add dword [ebp - 0x420], 4
jmp 0x10034931
lea ebx, [ecx + 4]
cmp ebx, ecx
mov ecx, dword [ebp - 0x428]
je 0x10034924
test ebx, ebx
jne 0x100348a9
test ecx, ecx
je 0x10034887
mov eax, dword [ebp - 0x434]
push ecx
mov eax, dword [eax + 0xc]
cmp eax, method.CWString.virtual_12
jne 0x1003487f
mov ecx, 0x101c40b8
call fcn.100377b0
jmp 0x10034887
lea ecx, [ebp - 0x434]
call eax
mov dword [ebp - 0x428], 0
xor ecx, ecx
mov dword [ebp - 0x420], 0
mov dword [ebp - 0x424], 0
jmp 0x10034924
test ecx, ecx
jne 0x100348bd
push ebx
lea ecx, [ebp - 0x434]
call fcn.10036ab0
mov ecx, eax
jmp 0x10034924
mov edi, dword [ebp - 0x41c]
mov eax, 0x40
test edi, edi
cmovle edi, eax
cmp edx, ebx
jl 0x100348d7
sub edx, ebx
cmp edx, edi
jle 0x1003491e
mov eax, ebx
cdq
idiv edi
mov eax, dword [ebp - 0x434]
sub edi, edx
add edi, ebx
push edi
mov eax, dword [eax + 8]
push ecx
cmp eax, method.CWString.virtual_8
jne 0x10034908
mov ecx, 0x101c40b8
call fcn.10037720
mov ecx, eax
test ecx, ecx
je 0x10034d1f
jmp 0x10034912
lea ecx, [ebp - 0x434]
call eax
mov ecx, eax
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x424], edi
mov dword [ebp - 0x420], ebx
mov eax, dword [ebp - 0x418]
mov dword [ecx + eax], 0
mov dword [ebp - method.CWString.virtual_0], vtable.CVolCommonBaseWithMemManager.0
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov dword [ebp - 0x45c], 0
mov dword [ebp - 0x458], 0
mov byte [ebp - 4], 2
mov dword [ebp - method.CWString.virtual_0], vtable.CVolMem.0
mov dword [ebp - 0x454], 0
mov dword [ebp - 0x44c], 0
mov dword [ebp - 0x450], 0
mov dword [ebp - 0x448], 0x40
mov byte [ebp - 4], 3
cmp dword [ebp - 0x420], 0
je 0x10034b50
mov edx, dword [ebp - 0x428]
mov dword [ebp - 0x440], edx
test edx, edx
je 0x10034b50
cmp byte [edx], 0
je 0x10034b50
mov ecx, edx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100349c2
push 0
sub ecx, edi
push 0
lea eax, [ecx + 1]
push eax
push edx
push 0
push 0
mov dword [ebp - 0x418], eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
mov dword [ebp - 0x414], ecx
add ecx, ecx
cmp dword [ebp - 0x454], 0
je 0x10034a0d
push ecx
lea ecx, [ebp - 0x460]
call fcn.10036b10
mov ecx, dword [ebp - 0x414]
mov edi, eax
jmp 0x10034a7f
test ecx, ecx
jne 0x10034a1b
mov ecx, dword [ebp - 0x414]
xor edi, edi
jmp 0x10034a7f
mov ebx, dword [ebp - 0x448]
mov eax, 0x40
test ebx, ebx
cmovle ebx, eax
mov eax, ecx
cdq
idiv ebx
mov eax, dword [ebp - 0x460]
sub ebx, edx
add ebx, ecx
push ebx
mov eax, dword [eax]
cmp eax, method.CWString.virtual_0
jne 0x10034a5a
mov ecx, 0x101c40b8
call fcn.100376c0
mov edi, eax
test edi, edi
je 0x10034d1f
jmp 0x10034a64
lea ecx, [ebp - 0x460]
call eax
mov edi, eax
mov ecx, dword [ebp - 0x414]
mov dword [ebp - 0x454], edi
mov dword [ebp - 0x450], ebx
lea eax, [ecx + ecx]
mov dword [ebp - 0x44c], eax
push ecx
push edi
push dword [ebp - 0x418]
push dword [ebp - 0x440]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jle 0x10034b50
test edi, edi
je 0x10034b50
movzx eax, word [edi]
mov dword [ebp - 0x440], eax
test ax, ax
je 0x10034b50
mov ecx, edi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10034ac0
mov eax, dword [esi + 0x10]
sub ecx, edx
mov edx, dword [esi + 0x14]
sub eax, edx
sar ecx, 1
mov dword [ebp - 0x418], edx
lea ebx, [ecx + ecx]
cmp eax, ebx
jl 0x10034b30
cmp ebx, 2
jne 0x10034afe
mov eax, dword [ebp - 0x440]
movzx ecx, ax
mov eax, dword [esi + 0xc]
mov word [edx + eax], cx
add dword [esi + 0x14], ebx
jmp 0x10034b50
cmp ebx, 4
jne 0x10034b10
mov eax, dword [esi + 0xc]
mov ecx, dword [edi]
mov dword [edx + eax], ecx
add dword [esi + 0x14], ebx
jmp 0x10034b50
cmp ebx, 8
jne 0x10034b30
mov eax, dword [esi + 0xc]
mov ebx, dword [ebp - 0x418]
mov ecx, dword [edi]
mov edx, dword [edi + 4]
mov dword [ebx + eax], ecx
mov dword [ebx + eax + 4], edx
add dword [esi + 0x14], 8
jmp 0x10034b50
test ebx, ebx
jle 0x10034b50
lea eax, [edx + ebx]
mov ecx, esi
push eax
call fcn.10036b10
add eax, dword [ebp - 0x418]
push ebx
push edi
push eax
call fcn.10040960
add esp, 0xc
mov byte [ebp - 4], 1
mov dword [ebp - method.CWString.virtual_0], vtable.CVolMem.0
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x454]
test ecx, ecx
je 0x10034b91
mov eax, dword [ebp - 0x460]
push ecx
mov eax, dword [eax + 0xc]
cmp eax, method.CWString.virtual_12
jne 0x10034b89
mov ecx, 0x101c40b8
call fcn.100377b0
jmp 0x10034b91
lea ecx, [ebp - 0x460]
call eax
mov dword [ebp - 0x454], 0
mov dword [ebp - 0x44c], 0
mov dword [ebp - 0x450], 0
mov byte [ebp - 4], 1
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov ecx, dword [ebp - 0x444]
test ecx, ecx
je 0x10034bd2
mov eax, dword [esi + 0x14]
sub eax, dword [ebp - 0x438]
mov dword [ecx], eax
mov edx, dword [esi + 0x10]
mov eax, edx
mov ecx, dword [esi + 0x14]
sub eax, ecx
mov dword [ebp - 0x444], ecx
cmp eax, 2
jl 0x10034bf9
mov eax, dword [esi + 0xc]
xor edx, edx
mov word [ecx + eax], dx
add dword [esi + 0x14], 2
jmp 0x10034c87
lea ebx, [ecx + 2]
cmp ebx, ecx
mov ecx, dword [esi + 0xc]
je 0x10034c7b
test ebx, ebx
jne 0x10034c2c
test ecx, ecx
je 0x10034c13
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 0xc]
mov dword [esi + 0xc], 0
xor ecx, ecx
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
jmp 0x10034c7b
mov edi, dword [esi + 0x18]
mov eax, 0x40
test ecx, ecx
jne 0x10034c4f
test edi, edi
mov ecx, esi
cmovle edi, eax
mov eax, ebx
cdq
idiv edi
mov eax, dword [esi]
sub edi, edx
add edi, ebx
push edi
call dword [eax]
jmp 0x10034c70
test edi, edi
cmovle edi, eax
cmp edx, ebx
jl 0x10034c5e
sub edx, ebx
cmp edx, edi
jle 0x10034c78
mov eax, ebx
cdq
idiv edi
mov eax, dword [esi]
sub edi, edx
add edi, ebx
push edi
push ecx
mov ecx, esi
call dword [eax + 8]
mov ecx, eax
mov dword [esi + 0x10], edi
mov dword [esi + 0xc], ecx
mov dword [esi + 0x14], ebx
mov eax, dword [ebp - 0x444]
xor edx, edx
mov word [ecx + eax], dx
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - method.CWString.virtual_0], vtable.CVolMem.0
mov dword [ebp - 4], 5
mov edx, dword [ebp - 0x428]
test edx, edx
je 0x10034cce
mov eax, dword [ebp - 0x434]
push edx
mov eax, dword [eax + 0xc]
cmp eax, method.CWString.virtual_12
jne 0x10034cc6
mov ecx, 0x101c40b8
call fcn.100377b0
jmp 0x10034cce
lea ecx, [ebp - 0x434]
call eax
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x420], 0
mov dword [ebp - 0x424], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x43c]
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003d892
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.10041c16
int3