Function at 0x415d23
Capabilities:
Connect pipe
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x56a78f
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x20d4
call fcn.0053e720
mov eax, dword [0x5c9030]
xor eax, esp
mov dword [esp + 0x20d0], eax
push ebx
push esi
push edi
mov eax, dword [0x5c9030]
xor eax, esp
push eax
lea eax, [esp + 0x20e8]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push 0x2f
mov ebx, str.EventPipe.cpp
push ebx
mov dword [esp + 0x18], eax
call fcn.005392c0
pop ecx
pop ecx
test eax, eax
je 0x415d86
push 0x2f
jmp 0x415d96
push 0x5c
push ebx
call fcn.005392c0
pop ecx
pop ecx
test eax, eax
je 0x415da1
push 0x5c
push ebx
call fcn.005392c0
pop ecx
pop ecx
inc eax
jmp 0x415da3
mov eax, ebx
push 1
push 0x73
push eax
lea esi, [esp + 0x48]
call fcn.00404b01
xor esi, esi
push str.CEventPipe::WaitEventData
push esi
mov ecx, eax
mov dword [esp + 0x20f8], esi
call fcn.00404bdf
mov edi, eax
call fcn.00402776
or dword [esp + 0x20f4], 0xffffffff
pop ecx
lea ecx, [esp + 0x3c]
call fcn.00404b6d
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x28], esi
mov esi, dword [esp + 0x10]
lea edi, [esp + 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x38], eax
lea eax, [esp + 0x28]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov ecx, dword [esp + 0x18]
push esi
call fcn.0041649e
test eax, eax
je 0x41646e
push 0x2f
push ebx
call fcn.005392c0
pop ecx
pop ecx
test eax, eax
je 0x415e3a
push 0x2f
jmp 0x415e4a
push 0x5c
push ebx
call fcn.005392c0
pop ecx
pop ecx
test eax, eax
je 0x415e55
push 0x5c
push ebx
call fcn.005392c0
pop ecx
pop ecx
inc eax
jmp 0x415e57
mov eax, ebx
xor edi, edi
inc edi
push edi
push 0x7e
push eax
lea esi, [esp + 0x48]
call fcn.00404b01
push str.ConnectNamedPipe_succeeded
push 0
mov ecx, eax
mov dword [esp + 0x20f8], edi
call fcn.00404bdf
mov edi, eax
call fcn.00402776
or dword [esp + 0x20f4], 0xffffffff
pop ecx
mov ecx, esi
call fcn.00404b6d
push 0
lea eax, [esp + 0x18]
push eax
push 0x2000
lea eax, [esp + 0xe8]
push eax
mov eax, dword [esp + 0x20]
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0x2f
push ebx
test eax, eax
je 0x4163db
call fcn.005392c0
pop ecx
pop ecx
test eax, eax
je 0x415ece
push 0x2f
jmp 0x415ede
push 0x5c
push ebx
call fcn.005392c0
pop ecx
pop ecx
test eax, eax
je 0x415ee9
push 0x5c
push ebx
call fcn.005392c0
pop ecx
pop ecx
inc eax
jmp 0x415eeb
mov eax, ebx
push 1
push 0x89
push eax
lea esi, [esp + 0x48]
call fcn.00404b01
push str.ReadFile_succeeded
push 0
mov ecx, eax
mov dword [esp + 0x20f8], 2
call fcn.00404bdf
mov edi, eax
call fcn.00402776
or dword [esp + 0x20f4], 0xffffffff
pop ecx
mov ecx, esi
call fcn.00404b6d
cmp dword [esp + 0x14], 0x28c
push 0x2f
push ebx
jne 0x416374
call fcn.005392c0
pop ecx
pop ecx
test eax, eax
je 0x415f4c
push 0x2f
jmp 0x415f5c
push 0x5c
push ebx
call fcn.005392c0
pop ecx
pop ecx
test eax, eax
je 0x415f67
push 0x5c
push ebx
call fcn.005392c0
pop ecx
pop ecx
inc eax
jmp 0x415f69
mov eax, ebx
push 1
push 0x8c
push eax
lea esi, [esp + 0x48]
call fcn.00404b01
push str.WaitEventData_Received
push 0
mov ecx, eax
mov dword [esp + 0x20f8], 3
call fcn.00404bdf
mov edi, eax
call fcn.00402776
or dword [esp + 0x20f4], 0xffffffff
pop ecx
mov ecx, esi
call fcn.00404b6d
push dword [esp + 0x14]
mov edi, dword [esp + 0x14]
lea eax, [esp + 0xe0]
push eax
add edi, 0x14
push 0x28c
push edi
call fcn.00538b01
push 0x2f
push ebx
call fcn.005392c0
add esp, 0x18
test eax, eax
je 0x415fdb
push 0x2f
jmp 0x415feb
push 0x5c
push ebx
call fcn.005392c0
pop ecx
pop ecx
test eax, eax
je 0x415ff6
push 0x5c
push ebx
call fcn.005392c0
pop ecx
pop ecx
inc eax
jmp 0x415ff8
mov eax, ebx
push 1
push 0x8f
push eax
lea esi, [esp + 0x48]
call fcn.00404b01
mov dword [esp + 0x20f0], 4
push dword [edi]
mov ecx, eax
push str.m_EventInfo.Size:__d
push 0
call fcn.00404bdf
mov edi, eax
call fcn.00402776
or dword [esp + 0x20f8], 0xffffffff
pop ecx
pop ecx
mov ecx, esi
call fcn.00404b6d
push 0x2f
push ebx
call fcn.005392c0
pop ecx
pop ecx
test eax, eax
je 0x41604e
push 0x2f
jmp 0x41605e
push 0x5c
push ebx
call fcn.005392c0
pop ecx
pop ecx
test eax, eax
je 0x416069
push 0x5c
push ebx
call fcn.005392c0
pop ecx
pop ecx
inc eax
jmp 0x41606b
mov eax, ebx
push 1
push 0x90
push eax
lea esi, [esp + 0x48]
call fcn.00404b01
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x20f0], 5
push dword [ecx + 0x18]
mov ecx, eax
push str.m_EventInfo.EventType:__d
push 0
call fcn.00404bdf
mov edi, eax
call fcn.00402776
or dword [esp + 0x20f8], 0xffffffff
pop ecx
pop ecx
mov ecx, esi
call fcn.00404b6d
push 0x2f
push ebx
call fcn.005392c0
pop ecx
pop ecx
test eax, eax
je 0x4160c6
push 0x2f
jmp 0x4160d6
push 0x5c
push ebx
call fcn.005392c0
pop ecx
pop ecx
test eax, eax
je 0x4160e1
push 0x5c
push ebx
call fcn.005392c0
pop ecx
pop ecx
inc eax
jmp 0x4160e3
mov eax, ebx
push 1
push 0x91
push eax
lea esi, [esp + 0x48]
call fcn.00404b01
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x20f0], 6
push dword [ecx + 0x1c]
mov ecx, eax
push str.m_EventInfo.EventId:__d
push 0
call fcn.00404bdf
mov edi, eax
call fcn.00402776
or dword [esp + 0x20f8], 0xffffffff
pop ecx
pop ecx
mov ecx, esi
call fcn.00404b6d
push 0x2f
push ebx
call fcn.005392c0
pop ecx
pop ecx
test eax, eax
je 0x41613e
push 0x2f
jmp 0x41614e
push 0x5c
push ebx
call fcn.005392c0
pop ecx
pop ecx
test eax, eax
je 0x416159
push 0x5c
push ebx
call fcn.005392c0
pop ecx
pop ecx
inc eax
jmp 0x41615b
mov eax, ebx
push 1
push 0x92
push eax
lea esi, [esp + 0x48]
call fcn.00404b01
mov edx, dword [esp + 0x10]
add edx, 0x20
push edx
push str.m_EventInfo.DeviceInternalName:__s
push 0
mov ecx, eax
mov dword [esp + 0x20fc], 7
call fcn.00404bdf
mov edi, eax
call fcn.0040cbe5
or dword [esp + 0x20f8], 0xffffffff
pop ecx
pop ecx
mov ecx, esi
call fcn.00404b6d
push 0x2f
push ebx
call fcn.005392c0
pop ecx
pop ecx
test eax, eax
je 0x4161b7
push 0x2f
jmp 0x4161c7
push 0x5c
push ebx
call fcn.005392c0
pop ecx
pop ecx
test eax, eax
je 0x4161d2
push 0x5c
push ebx
call fcn.005392c0
pop ecx
pop ecx
inc eax
jmp 0x4161d4
mov eax, ebx
push 1
push 0x93
push eax
lea esi, [esp + 0x48]
call fcn.00404b01
mov ecx, dword [esp + 0x10]
add ecx, 0x120
push ecx
push str.m_EventInfo.DeviceName:__s
push 0
mov ecx, eax
mov dword [esp + 0x20fc], 8
call fcn.00404bdf
mov edi, eax
call fcn.0040cbe5
or dword [esp + 0x20f8], 0xffffffff
pop ecx
pop ecx
mov ecx, esi
call fcn.00404b6d
push 0x2f
push ebx
call fcn.005392c0
pop ecx
pop ecx
test eax, eax
je 0x416233
push 0x2f
jmp 0x416243
push 0x5c
push ebx
call fcn.005392c0
pop ecx
pop ecx
test eax, eax
je 0x41624e
push 0x5c
push ebx
call fcn.005392c0
pop ecx
pop ecx
inc eax
jmp 0x416250
mov eax, ebx
push 1
push 0x94
push eax
lea esi, [esp + 0x48]
call fcn.00404b01
mov esi, dword [esp + 0x10]
lea edx, [esi + 0x220]
push edx
push str.m_EventInfo.TwainDriverName:__s
push 0
mov ecx, eax
mov dword [esp + 0x20fc], 9
call fcn.00404bdf
mov edi, eax
call fcn.0040cbe5
or dword [esp + 0x20f8], 0xffffffff
pop ecx
pop ecx
lea ecx, [esp + 0x3c]
call fcn.00404b6d
xor edi, edi
cmp dword [esi + 8], edi
je 0x41645e
cmp dword [esi + 0x18], 4
jne 0x4162f0
push ecx
lea eax, [esi + 0x20]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.0040235d
push ecx
mov dword [esp + 0x20f8], 0xa
lea eax, [esi + 0x220]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.0040235d
or dword [esp + 0x20f8], 0xffffffff
call fcn.0041e8ae
jmp 0x41645e
push 0x3c
call fcn.004385a6
pop ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20f0], 0xb
cmp eax, edi
je 0x41634f
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push 0x5990a0
call fcn.0040235d
push edi
push edi
push ecx
lea eax, [esi + 0x220]
mov ecx, esp
mov dword [esp + 0x34], esp
push eax
mov byte [esp + 0x2104], 0xc
call fcn.0040235d
push dword [esi + 0x1c]
mov byte [esp + 0x2104], 0xb
push dword [esp + 0x30]
call fcn.0041309e
mov edi, eax
or dword [esp + 0x20f0], 0xffffffff
lea eax, [esi + 0x20]
push eax
lea ecx, [edi + 8]
call fcn.00402337
push dword [esi + 0x1c]
mov esi, dword [esi + 8]
push edi
call fcn.00419f99
jmp 0x41645a
call fcn.005392c0
pop ecx
pop ecx
test eax, eax
je 0x416383
push 0x2f
jmp 0x416393
push 0x5c
push ebx
call fcn.005392c0
pop ecx
pop ecx
test eax, eax
je 0x41639e
push 0x5c
push ebx
call fcn.005392c0
pop ecx
pop ecx
inc eax
jmp 0x4163a0
mov eax, ebx
push 4
push 0xad
push eax
lea esi, [esp + 0x48]
call fcn.00404b01
mov dword [esp + 0x20f0], 0xd
push dword [esp + 0x14]
mov ecx, eax
push str.Data_size_is_invalid:__d
push 0
call fcn.00404bdf
mov edi, eax
call fcn.00402776
pop ecx
pop ecx
mov ecx, esi
jmp 0x41644d
call fcn.005392c0
pop ecx
pop ecx
test eax, eax
je 0x4163ea
push 0x2f
jmp 0x4163fa
push 0x5c
push ebx
call fcn.005392c0
pop ecx
pop ecx
test eax, eax
je 0x416405
push 0x5c
push ebx
call fcn.005392c0
pop ecx
pop ecx
inc eax
jmp 0x416407
mov eax, ebx
push 4
push 0xb0
push eax
lea esi, [esp + 0x98]
call fcn.00404b01
mov esi, eax
mov dword [esp + 0x20f0], 0xe
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ReadFile_failed___d_
push 0
mov ecx, esi
call fcn.00404bdf
mov edi, eax
call fcn.00402776
pop ecx
pop ecx
lea ecx, [esp + 0x8c]
or dword [esp + 0x20f0], 0xffffffff
call fcn.00404b6d
mov esi, dword [esp + 0x10]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
xor esi, esi
jmp 0x415dee
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x20e8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20d0]
xor ecx, esp
call fcn.005384ff
mov esp, ebp
pop ebp
ret 4