Function at 0x4011e0
Capabilities:
Create mailslot

Disassembly:
push ecx
mov al, byte [0x410030]
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x14]
push edi
test al, al
je 0x401222
test esi, esi
mov al, 1
jne 0x401202
xor al, al
test ebx, ebx
jne 0x401208
xor al, al
mov ecx, dword [esp + 0x20]
test ecx, ecx
jne 0x401212
xor al, al
test ebp, ebp
je 0x40121a
test al, al
jne 0x401222
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret
mov eax, dword [esp + 0x20]
mov edi, str.Int20
or ecx, 0xffffffff
mov dword [esp + 0x1c], 0
mov dword [eax], 0
xor eax, eax
mov dword [ebx], 0
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.Int20
push esi
call fcn.00403670
add esp, 0xc
test eax, eax
je 0x401371
mov edi, str.CoInstaller
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.CoInstaller
push esi
call fcn.00403670
add esp, 0xc
test eax, eax
je 0x401371
mov edi, str.RunServices
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.RunServices
push esi
call fcn.00403670
add esp, 0xc
test eax, eax
je 0x401371
mov edi, str.NewInstance
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.NewInstance
push esi
call fcn.00403670
add esp, 0xc
test eax, eax
jne 0x40121a
mov edi, esi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
push ecx
call fcn.0040365b
add esp, 4
mov dword [ebx], eax
test eax, eax
je 0x401457
lea ecx, [esp + 0x10]
push eax
lea edx, [esp + 0x1c]
push ecx
lea eax, [esp + 0x24]
push edx
push eax
mov edi, str.NewInstance
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push str._x__x__x__s
add ecx, esi
push ecx
call fcn.00403627
mov eax, dword [esp + 0x34]
add esp, 0x18
test eax, eax
jbe 0x401457
mov ecx, dword [esp + 0x18]
mov byte [esp + 0x24], 0
push ecx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, 0xffffffff
je 0x40145c
push 2
push 1
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, dword [esp + 0x20]
push eax
push edx
push esi
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40145c
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
call fcn.0040365b
add esp, 4
mov dword [ebx], eax
test eax, eax
je 0x401457
mov edi, str.Int20
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.Int20
push esi
call fcn.00403670
add esp, 0xc
test eax, eax
jne 0x4013d3
mov eax, dword [ebx]
mov edi, str.Int20
push eax
or ecx, 0xffffffff
xor eax, eax
push 0x410070
repne scasb al, byte es:[edi]
not ecx
dec ecx
add ecx, esi
push ecx
call fcn.00403627
add esp, 0xc
mov edi, str.CoInstaller
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.CoInstaller
push esi
call fcn.00403670
add esp, 0xc
test eax, eax
jne 0x401415
mov ecx, dword [ebx]
mov edi, str.CoInstaller
push ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x410070
add ecx, esi
push ecx
call fcn.00403627
add esp, 0xc
mov edi, str.RunServices
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.RunServices
push esi
call fcn.00403670
add esp, 0xc
test eax, eax
jne 0x401457
mov edi, str.RunServices
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov edx, dword [ebx]
not ecx
dec ecx
push edx
add ecx, esi
push 0x410070
push ecx
call fcn.00403627
add esp, 0xc
mov byte [esp + 0x24], 1
mov edi, dword [ebx]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, str..mailslot_
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [edx + ecx + 1]
push eax
call fcn.0040365b
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x401525
mov edi, str..mailslot_
or ecx, 0xffffffff
xor eax, eax
push 0x2d
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx]
push eax
call fcn.00403600
mov edi, eax
add esp, 8
inc edi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push eax
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_CreateMailslotA]
cmp eax, 0xffffffff
mov dword [0x41004c], eax
jne 0x401512
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40151c
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov dword [ecx], eax
jmp 0x40151c
mov edx, dword [esp + 0x20]
mov dword [edx], 0
push ebp
call fcn.004035f0
add esp, 4
mov al, byte [esp + 0x24]
test al, al
je 0x40153e
mov eax, dword [esp + 0x20]
cmp dword [eax], 0
je 0x40153e
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret
mov eax, dword [ebx]
pop edi
test eax, eax
pop esi
pop ebp
setne al
pop ebx
pop ecx
ret