Function at 0x140038450
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rbx
push rdi
mov eax, 0x8158
call fcn.1400a12b0
sub rsp, rax
test rcx, rcx
mov rdi, rdx
mov rbx, rcx
jne 0x140038493
mov eax, dword [0x1400dd138]
test dword [0x1400dd39c], eax
je 0x140038b76
lea rcx, str.CSessionPipeClient::NamePipeInstance:_NULL_session_pipe_client_instance_
call fcn.14000cbb0
add rsp, 0x8158
pop rdi
pop rbx
ret
mov eax, dword [0x1400df4cc]
mov qword [rsp + 0x8150], rsi
lea r9, [rsp + 0x8170]
lea rdx, [rsp + 0x6d0]
xor esi, esi
mov r8d, 0x7a80
mov rcx, rdi
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x34], 0x2c
mov dword [rsp + 0x38], 0xf
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140038b03
mov eax, dword [rsp + 0x8170]
test eax, eax
je 0x140038b03
lea rdx, [rsp + 0x6d0]
lea rcx, [rsp + 0xb0]
mov r8, rax
call fcn.14007d090
cmp dword [rsp + 0xb0], 0x8001
jne 0x140038adf
cmp dword [rsp + 0xb4], 0x620
jne 0x140038adf
mov edx, dword [rsp + 0xb8]
mov dword [rsp + 0x58], 2
lea eax, [rdx - 1]
cmp eax, 0x3c
ja case.0x140038562.3
lea r8, [0x140000000]
movzx eax, byte [r8 + rax + 0x38bb8]
mov ecx, dword [r8 + rax*4 + 0x38b80]
add rcx, r8
jmp rcx
mov eax, dword [0x1400dd138]
mov ecx, dword [0x1400dd39c]
test ecx, eax
je 0x14003858c
lea rcx, str.NamePipeInstance:_EXTEVENT_REQTYPE_CLT_INFORMKBEVENT_is_called
call fcn.14000cbb0
mov ecx, dword [0x1400dd39c]
mov eax, dword [0x1400dd138]
mov r8, qword [0x1400df398]
test r8, r8
jne 0x1400385b1
test ecx, eax
je case.0x140038562.3
lea rcx, str.WARNING...SOFTWARE_BUG..._g_pExtEvent_is_NULL
call fcn.14000cbb0
jmp case.0x140038562.3
lea rdx, [rsp + 0xc0]
mov rcx, r8
call fcn.140003700
jmp case.0x140038562.3
mov eax, dword [0x1400dd138]
test dword [0x1400dd39c], eax
je 0x1400385e0
lea rcx, str.NamePipeInstance:_EXTEVENT_REQTYPE_CLT_REGISTERCOMOBJECT_is_called
call fcn.14000cbb0
lea rcx, [rsp + 0xc0]
mov dword [rsp + 0x58], 2
call fcn.14005cc00
cmp eax, 0x80000000
jne 0x140038611
lea rcx, [rbx + 0x68]
lea r8, [rsp + 0xc0]
mov edx, eax
call fcn.14005ccd0
jmp 0x14003864d
cmp eax, 0x80000001
jne 0x140038630
lea rcx, [rbx + 0x1f0]
lea r8, [rsp + 0xc0]
mov edx, eax
call fcn.14005ccd0
jmp 0x14003864d
cmp eax, 0x80000002
jne 0x140038659
lea r8, [rsp + 0xc0]
lea rcx, [0x1400e03a0]
mov edx, eax
call fcn.14005ccd0
cmp dword [0x1400c0428], eax
jne case.0x140038562.3
mov eax, dword [0x1400dd138]
test dword [0x1400dd39c], eax
je 0x140038673
lea rcx, str.NamePipeInstance:_EXTEVENT_REQTYPE_CLT_REGISTERCOMOBJECT__failed_to_register_ADC_COM_callback
call fcn.14000cbb0
mov dword [rsp + 0x58], 1
jmp case.0x140038562.3
mov eax, dword [0x1400dd138]
test dword [0x1400dd39c], eax
je 0x14003869a
lea rcx, str.NamePipeInstance:_EXTEVENT_REQTYPE_CLT_UNREGISTERCOMOBJECT_is_called
call fcn.14000cbb0
lea rcx, [rsp + 0xc0]
mov dword [rsp + 0x58], 2
call fcn.14005cc00
cmp eax, 0x80000000
jne 0x1400386cb
lea rcx, [rbx + 0x68]
lea r8, [rsp + 0xc0]
mov edx, eax
call fcn.14005ceb0
jmp 0x140038707
cmp eax, 0x80000001
jne 0x1400386ea
lea rcx, [rbx + 0x1f0]
lea r8, [rsp + 0xc0]
mov edx, eax
call fcn.14005ceb0
jmp 0x140038707
cmp eax, 0x80000002
jne 0x14003870f
lea r8, [rsp + 0xc0]
lea rcx, [0x1400e03a0]
mov edx, eax
call fcn.14005ceb0
test al, al
jne case.0x140038562.3
mov eax, dword [0x1400dd138]
test dword [0x1400dd39c], eax
je 0x140038729
lea rcx, str.NamePipeInstance:_EXTEVENT_REQTYPE_CLT_UNREGISTERCOMOBJECT__failed_to_unregister_ADC_COM_callback
call fcn.14000cbb0
mov dword [rsp + 0x58], 1
jmp case.0x140038562.3
mov eax, dword [0x1400dd138]
test dword [0x1400dd39c], eax
je 0x140038757
lea rcx, str.NamePipeInstance:_EXTEVENT_REQTYPE_SVR_APPLYADCBYSELECTED_is_called
call fcn.14000cbb0
mov edx, dword [rsp + 0xb8]
cmp qword [0x1400df3c0], rsi
mov dword [rsp + 0x58], 1
je case.0x140038562.3
cmp edx, 0x38
lea rcx, [rsp + 0xc0]
lea r8, [rsp + 0x80]
mov rax, qword [rcx]
mov dword [rsp + 0x58], 2
mov dword [rsp + 0x8180], esi
mov qword [r8], rax
mov rax, qword [rcx + 8]
mov qword [r8 + 8], rax
mov rax, qword [rcx + 0x10]
mov qword [r8 + 0x10], rax
mov rax, qword [rcx + 0x18]
mov qword [r8 + 0x18], rax
mov rax, qword [rcx + 0x20]
lea rcx, [rsp + 0x80]
mov qword [r8 + 0x20], rax
jne 0x1400387f1
lea rcx, [0x1400e0890]
xor edx, edx
call fcn.14003a760
test rax, rax
je 0x140038848
xor edx, edx
mov rcx, rax
call fcn.1400471a0
bt eax, 0xf
jb 0x1400387ee
mov dword [rsp + 0x58], 1
jmp case.0x140038562.3
mov rcx, rsi
mov eax, dword [0x1400e18dc]
mov rdx, rcx
lea r9, [rsp + 0x8180]
lea rcx, [0x140037af0]
xor r8d, r8d
mov dword [rsp + 0x20], eax
call fcn.14002d550
test rax, rax
mov rbx, rax
jne 0x140038855
mov eax, dword [0x1400dd138]
test dword [0x1400dd39c], eax
je case.0x140038562.3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.CSessionPipeClient::NamePipeInstance__CreateThread_for_ADC_failed__err_d
mov edx, eax
call fcn.14000cbb0
jmp case.0x140038562.3
mov dword [rsp + 0x58], 1
jmp case.0x140038562.3
mov eax, dword [0x1400dd138]
test dword [0x1400dd39c], eax
je 0x14003886f
lea rcx, str.CSessionPipeClient::NamePipeInstance__CreateThread_for_ADC_success
call fcn.14000cbb0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.0x140038562.3
mov eax, dword [0x1400dd138]
test dword [0x1400dd39c], eax
je 0x140038897
lea rcx, str.NamePipeInstance:_EXTEVENT_REQTYPE_SVR_APPLYADCBYSELECTED_is_called
call fcn.14000cbb0
cmp qword [0x1400df3c0], rsi
mov dword [rsp + 0x58], 1
je case.0x140038562.3
mov eax, dword [0x1400e18dc]
lea r9, [rsp + 0x8180]
lea rdx, [rsp + 0xc0]
lea rcx, [0x140037b70]
xor r8d, r8d
mov dword [rsp + 0x58], 2
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x8180], esi
call fcn.14002d550
test rax, rax
mov rbx, rax
jne 0x140038917
mov eax, dword [0x1400dd138]
test dword [0x1400dd39c], eax
je case.0x140038562.3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.CSessionPipeClient::NamePipeInstance__CreateThread_for_ADC_failed__err_d
mov edx, eax
call fcn.14000cbb0
jmp case.0x140038562.3
mov eax, dword [0x1400dd138]
test dword [0x1400dd39c], eax
je 0x140038931
lea rcx, str.CSessionPipeClient::NamePipeInstance__CreateThread_for_ADC_success
call fcn.14000cbb0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.0x140038562.3
mov eax, dword [0x1400dd138]
test dword [0x1400dd39c], eax
je 0x140038959
lea rcx, str.NamePipeInstance:_EXTEVENT_REQTYPE_CLT_KILLCLIENTPROCESS_is_called
call fcn.14000cbb0
mov rcx, qword [0x1400df388]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x12]
call qword [sym.imp.USER32.dll_PostMessageA]
jmp case.0x140038562.3
cmp dword [0x1400df34c], 6
ja case.0x140038562.3
mov rcx, qword [0x1400df3c0]
test rcx, rcx
je case.0x140038562.3
call fcn.14001dff0
jmp case.0x140038562.3
mov rcx, qword [0x1400df390]
test rcx, rcx
jne 0x1400389cb
mov eax, dword [0x1400dd138]
test dword [0x1400dd39c], eax
je case.0x140038562.3
lea rcx, str.Session:_g_pHKPoller_is_NULL
call fcn.14000cbb0
jmp case.0x140038562.3
mov eax, dword [0x1400dd138]
test dword [0x1400dd39c], eax
je 0x1400389ec
lea rcx, str.Client_got_m_hSMIBiosEvent_request_n
call fcn.14000cbb0
mov rcx, qword [0x1400df390]
mov rcx, qword [rcx + 0x38]
call qword [sym.imp.KERNEL32.dll_SetEvent]
jmp case.0x140038562.3
mov rcx, qword [0x1400df390]
test rcx, rcx
jne 0x140038a2a
mov eax, dword [0x1400dd138]
test dword [0x1400dd39c], eax
je case.0x140038562.3
lea rcx, str.Session:_g_pHKPoller_is_NULL
call fcn.14000cbb0
jmp case.0x140038562.3
mov rcx, qword [rcx + 0x28]
call qword [sym.imp.KERNEL32.dll_SetEvent]
jmp case.0x140038562.3
mov eax, dword [0x1400dd138]
test dword [0x1400dd39c], eax
je case.0x140038562.29
lea rcx, str.Session:_NamePipeInstance._Got_AutoDisplay_or_SaveProfile_n
call fcn.14000cbb0
mov edx, dword [rsp + 0xb8]
test byte [0x1400df4d4], 4
jne case.0x140038562.3
mov eax, dword [0x1400dd138]
test dword [0x1400dd39c], eax
je 0x140038a88
lea rcx, str.Session:_NamePipeInstance._prepare_to_add_task__d__to_queue_n
call fcn.14000cbb0
mov edx, dword [rsp + 0xb8]
mov eax, dword [rsp + 0xc0]
mov dword [rsp + 0x60], edx
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x64], eax
mov rax, qword [rcx]
lea rdx, [rsp + 0x70]
mov qword [rdx], rax
mov eax, dword [rcx + 8]
lea rcx, [rbx + 0x28]
mov dword [rdx + 8], eax
lea rdx, [rsp + 0x70]
call fcn.140039210
mov rcx, qword [0x1400e3b58]
call qword [sym.imp.KERNEL32.dll_SetEvent]
jmp case.0x140038562.3
mov rcx, qword [0x1400df3c0]
test rcx, rcx
je case.0x140038562.3
xor edx, edx
call fcn.14001e030
jmp case.0x140038562.3
mov eax, dword [0x1400dd138]
mov dword [rsp + 0x58], 1
test dword [0x1400dd39c], eax
je case.0x140038562.3
lea rcx, str.NamePipeSessionInstance:_Pipe_read_msg_contents_error__something_wrong
call fcn.14000cbb0
jmp case.0x140038562.3
mov eax, dword [0x1400dd138]
test dword [0x1400dd39c], eax
je 0x140038b1d
lea rcx, str.NamePipeSessionInstanceThread:_Read_from_Pipe_Failed
call fcn.14000cbb0
mov dword [rsp + 0x58], 1
lea r9, [rsp + 0x8188]
lea rdx, [rsp + 0x30]
mov r8d, 0x2c
mov rcx, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rsi, qword [rsp + 0x8150]
test eax, eax
je 0x140038b5c
cmp dword [rsp + 0x8188], 0x2c
je 0x140038b76
mov eax, dword [0x1400dd138]
test dword [0x1400dd39c], eax
je 0x140038b76
lea rcx, str.Write_to_Pipe_Failed
call fcn.14000cbb0
add rsp, 0x8158
pop rdi
pop rbx
ret