Function at 0x4222a6
Capabilities:
Persist via application shimming
Read file on windows
Read pipe
Reference sql statements
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4a68
call fcn.00430730
push esi
push edi
mov ecx, 0xa
mov esi, str.ProcessTSXEnlistment
lea edi, [ebp - 0x930]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ax, word [0x4496c4]
mov word [ebp - 0x45ac], ax
mov ecx, 0x3ff
xor eax, eax
lea edi, [ebp - 0x45aa]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov cx, word [0x4496cc]
mov word [ebp - 0x7f8], cx
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x7f6]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dx, word [0x4496d4]
mov word [ebp - 0x35ac], dx
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x35aa]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ax, word [0x4496dc]
mov word [ebp - 0x31ac], ax
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x31aa]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov cx, word [0x4496e4]
mov word [ebp - 0x46b4], cx
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x46b2]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dx, word [0x4496ec]
mov word [ebp - 0x1d30], dx
mov ecx, 0x3ff
xor eax, eax
lea edi, [ebp - 0x1d2e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ax, word [0x4496f4]
mov word [ebp - 0xd30], ax
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0xd2e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov cx, word [0x4496fc]
mov word [ebp - 0x904], cx
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x902]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 0x4a5c], 0
mov dword [ebp - 0x28fc], 0
mov dword [ebp - 0x7fc], 0
mov dword [ebp - 0x3f8], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x28f8], 0
mov dword [ebp - 0x28f4], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x46b8], 4
push str.ProcessTSXEnlistment___n
call fcn.0042fc9e
add esp, 4
push 0x3ec
push 0
lea edx, [ebp - 0x3f4]
push edx
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x7a8
push 0
lea eax, [ebp - 0x30a4]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 0x28f4], 0
mov ecx, dword [ebp - 0x28f4]
mov dword [ebp - 0x28fc], ecx
mov edx, dword [ebp - 0x28fc]
mov dword [ebp - 0x4a5c], edx
mov dword [ebp - 0x30a4], 0
push 0x200
lea eax, [ebp - 0x309c]
push eax
push 0x116
mov ecx, dword [0x4492ac]
push ecx
call dword [sym.imp.SQLUNIRL.dll__LoadString_16]
push 0
lea edx, [ebp - 0x7fc]
push edx
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4224da
cmp dword [ebp - 0x7fc], 0
jne 0x4224da
push 0x1f4
mov ecx, dword [0x44b940]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4224d8
jmp 0x4224da
jmp 0x422495
cmp dword [ebp - 8], 0
je 0x422574
cmp dword [ebp - 0x7fc], 0
je 0x422574
cmp dword [ebp - 0x7fc], 0x3ec
je 0x422572
push 0x109
lea edx, [ebp - 0x930]
push edx
mov eax, dword [ebp - 0x7fc]
push eax
call fcn.00420465
add esp, 0xc
mov dword [ebp - 0x28f8], eax
cmp dword [ebp - 0x28f8], 0
je 0x42255a
push 0
lea ecx, [ebp - 0x4a5c]
push ecx
mov edx, dword [ebp - 0x7fc]
push edx
mov eax, dword [ebp - 0x28f8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 0x28f8]
push edx
call fcn.004209ff
add esp, 4
push 0
lea eax, [ebp - 0x309c]
push eax
push 1
call fcn.0041b8d1
add esp, 0xc
jmp 0x42300b
jmp 0x422583
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
jmp 0x4230c3
push 0
lea edx, [ebp - 0x4a5c]
push edx
push 0x3ec
lea eax, [ebp - 0x3f4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4230b9
cmp dword [ebp - 0x4a5c], 0
je 0x4230b9
cmp dword [ebp - 0x4a5c], 0x3ec
jne 0x42300b
push 0
call fcn.00426ca2
add esp, 4
test eax, eax
je 0x422618
push 0x200
lea edx, [ebp - 0xd30]
push edx
push 0x11e
mov eax, dword [0x4492ac]
push eax
call dword [sym.imp.SQLUNIRL.dll__LoadString_16]
push 0x449194
lea ecx, [ebp - 0xd30]
push ecx
lea edx, [ebp - 0x309c]
push edx
mov eax, dword [0x449ba0]
call dword [eax + 0x4cc]
add esp, 0xc
jmp 0x42300b
call fcn.00427032
test eax, eax
je 0x422666
push 0x200
lea ecx, [ebp - 0xd30]
push ecx
push 0x11f
mov edx, dword [0x4492ac]
push edx
call dword [sym.imp.SQLUNIRL.dll__LoadString_16]
push 0x449194
lea eax, [ebp - 0xd30]
push eax
lea ecx, [ebp - 0x309c]
push ecx
mov edx, dword [0x449ba0]
call dword [edx + 0x4cc]
add esp, 0xc
jmp 0x42300b
push str.SQLAgent___Enlistment_Manager
lea eax, [ebp - 0x28f0]
push eax
call fcn.00407820
add esp, 8
push 0
push 1
lea ecx, [ebp - 0x28f0]
push ecx
call fcn.004078f6
add esp, 0xc
test eax, eax
je 0x422fee
lea edx, [ebp - 0x3f0]
push edx
call fcn.0042fab9
add esp, 4
lea eax, [ebp - 0x3b0]
push eax
call fcn.0042fab9
add esp, 4
push 0x5c
lea ecx, [ebp - 0x3f0]
push ecx
call dword [sym.imp.MSVCRT.dll_wcschr]
add esp, 8
test eax, eax
je 0x4226f0
push 0x108
lea edx, [ebp - 0x904]
push edx
push 0x4405ec
push 0x4405f0
lea eax, [ebp - 0x3f0]
push eax
call fcn.0042f530
add esp, 0x14
jmp 0x422707
lea ecx, [ebp - 0x3f0]
push ecx
lea edx, [ebp - 0x904]
push edx
call dword [sym.imp.MSVCRT.dll_wcscpy]
add esp, 8
push 0x4405f4
lea eax, [ebp - 0x904]
push eax
push 0x44060c
lea ecx, [ebp - 0x46b4]
push ecx
mov edx, dword [0x449ba0]
call dword [edx + 0x4cc]
add esp, 0x10
mov eax, dword [ebp - 0x3f4]
mov dword [ebp - 0x4a60], eax
cmp dword [ebp - 0x4a60], 0
je 0x422762
cmp dword [ebp - 0x4a60], 1
je 0x422abd
cmp dword [ebp - 0x4a60], 2
je 0x422cd9
jmp 0x422ecf
mov ecx, dword [ebp - 0x3f0]
and ecx, 0xffff
test ecx, ecx
je 0x422782
mov edx, dword [ebp - 0x114]
and edx, 0xffff
test edx, edx
jne 0x422787
jmp 0x422ecf
lea eax, [ebp - 0x3f0]
push eax
lea ecx, [ebp - 0x114]
push ecx
push 0x138
push 0
push 2
call fcn.0041b8d1
add esp, 0x14
mov edx, dword [0x4492c0]
and edx, 0x100
cmp edx, 0x100
jne 0x4227dd
push 0x200
lea eax, [ebp - 0x309c]
push eax
push 0x191
mov ecx, dword [0x4492ac]
push ecx
call dword [sym.imp.SQLUNIRL.dll__LoadString_16]
jmp 0x422ecf
lea edx, [ebp - 0x4a58]
push edx
lea eax, [ebp - 0x1d30]
push eax
lea ecx, [ebp - 0x28f4]
push ecx
lea edx, [ebp - 0x28f0]
push edx
call fcn.0042718b
add esp, 0x10
test eax, eax
je 0x42280e
cmp dword [ebp - 0x28f4], 0
je 0x422853
push 0x200
lea eax, [ebp - 0xd30]
push eax
push 0x12c
mov ecx, dword [0x4492ac]
push ecx
call dword [sym.imp.SQLUNIRL.dll__LoadString_16]
push 0x440618
lea edx, [ebp - 0xd30]
push edx
lea eax, [ebp - 0x309c]
push eax
mov ecx, dword [0x449ba0]
call dword [ecx + 0x4cc]
add esp, 0xc
jmp 0x422ecf
mov ecx, 0xe8
lea esi, [ebp - 0x4a58]
lea edi, [ebp - 0x2c9c]
rep movsd dword es:[edi], dword [esi]
push 0x84
lea edx, [ebp - 0x31ac]
push edx
lea eax, [ebp - 0x3f0]
push eax
call fcn.004230c9
add esp, 0xc
lea ecx, [ebp - 0x46b4]
push ecx
lea edx, [ebp - 0x31ac]
push edx
lea eax, [ebp - 0x46b4]
push eax
push 0x440630
lea ecx, [ebp - 0x45ac]
push ecx
mov edx, dword [0x449ba0]
call dword [edx + 0x4cc]
add esp, 0x14
lea eax, [ebp - 0x930]
push eax
lea ecx, [ebp - 0x1d30]
push ecx
lea edx, [ebp - 0x28f4]
push edx
push 1
push 1
lea eax, [ebp - 0x45ac]
push eax
lea ecx, [ebp - 0x28f0]
push ecx
call fcn.00407c09
add esp, 0x1c
test eax, eax
je 0x4228f9
cmp dword [ebp - 0x28f4], 0
je 0x42291b
cmp dword [ebp - 0x28f4], 0x3aaf
je 0x42291b
push 0x200
lea edx, [ebp - 0x309c]
push edx
push 0x117
mov eax, dword [0x4492ac]
push eax
call dword [sym.imp.SQLUNIRL.dll__LoadString_16]
jmp 0x422ecf
mov dword [ebp - 0x28f4], 0
lea ecx, [ebp - 0x46b4]
push ecx
lea edx, [ebp - 0x46b4]
push edx
push 0x440794
lea eax, [ebp - 0x45ac]
push eax
mov ecx, dword [0x449ba0]
call dword [ecx + 0x4cc]
add esp, 0x10
lea edx, [ebp - 0x930]
push edx
lea eax, [ebp - 0x1d30]
push eax
lea ecx, [ebp - 0x28f4]
push ecx
push 1
push 1
lea edx, [ebp - 0x45ac]
push edx
lea eax, [ebp - 0x28f0]
push eax
call fcn.00407c09
add esp, 0x1c
test eax, eax
je 0x42298a
cmp dword [ebp - 0x28f4], 0
je 0x4229ad
push 0x200
lea ecx, [ebp - 0x309c]
push ecx
push 0x11a
mov edx, dword [0x4492ac]
push edx
call dword [sym.imp.SQLUNIRL.dll__LoadString_16]
jmp 0x422ecf
mov eax, dword [ebp - 0x3b0]
and eax, 0xffff
test eax, eax
je 0x422a06
push 0x400
lea ecx, [ebp - 0x7f8]
push ecx
push 0x440844
push 0x44084c
lea edx, [ebp - 0x3b0]
push edx
call fcn.0042f530
add esp, 0x14
push 0xcc
lea eax, [ebp - 0x7f8]
push eax
lea ecx, [ebp - 0x3b0]
push ecx
call dword [sym.imp.MSVCRT.dll_wcsncpy]
add esp, 0xc
mov word [ebp - 0x21a], 0
lea edx, [ebp - 0x3f0]
push edx
mov eax, dword [ebp - 0xc]
push eax
lea ecx, [ebp - 0x114]
push ecx
lea edx, [ebp - 0x214]
push edx
mov eax, dword [ebp - 0x218]
push eax
lea ecx, [ebp - 0x3b0]
push ecx
lea edx, [ebp - 0x3f0]
push edx
push 0x440850
lea eax, [ebp - 0x45ac]
push eax
mov ecx, dword [0x449ba0]
call dword [ecx + 0x4cc]
add esp, 0x24
lea edx, [ebp - 0x930]
push edx
lea eax, [ebp - 0x1d30]
push eax
lea ecx, [ebp - 0x28f4]
push ecx
push 1
push 1
lea edx, [ebp - 0x45ac]
push edx
lea eax, [ebp - 0x28f0]
push eax
call fcn.00407c09
add esp, 0x1c
test eax, eax
je 0x422a8b
cmp dword [ebp - 0x28f4], 0
je 0x422aae
push 0x200
lea ecx, [ebp - 0x309c]
push ecx
push 0x118
mov edx, dword [0x4492ac]
push edx
call dword [sym.imp.SQLUNIRL.dll__LoadString_16]
jmp 0x422ecf
mov dword [ebp - 0x30a4], 1
jmp 0x422ecf
mov eax, dword [ebp - 0x3f0]
and eax, 0xffff
test eax, eax
je 0x422adc
mov ecx, dword [ebp - 0x114]
and ecx, 0xffff
test ecx, ecx
jne 0x422ae1
jmp 0x422ecf
lea edx, [ebp - 0x3f0]
push edx
lea eax, [ebp - 0x114]
push eax
push 0x139
push 0
push 2
call fcn.0041b8d1
add esp, 0x14
mov dword [ebp - 4], 0
jmp 0x422b12
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
lea edx, [ebp - 0x46b4]
push edx
lea eax, [ebp - 0x28f0]
push eax
call fcn.00408400
add esp, 8
test eax, eax
je 0x422b51
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x46b8]
jge 0x422b51
push 0x1f4
mov edx, dword [0x44b940]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x422b4f
jmp 0x422b51
jmp 0x422b09
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x46b8]
jne 0x422b7f
push 0x200
lea ecx, [ebp - 0x309c]
push ecx
push 0x162
mov edx, dword [0x4492ac]
push edx
call dword [sym.imp.SQLUNIRL.dll__LoadString_16]
jmp 0x422ecf
lea eax, [ebp - 0x46b4]
push eax
lea ecx, [ebp - 0x46b4]
push ecx
lea edx, [ebp - 0x46b4]
push edx
lea eax, [ebp - 0x46b4]
push eax
push 0x440ad0
lea ecx, [ebp - 0x45ac]
push ecx
mov edx, dword [0x449ba0]
call dword [edx + 0x4cc]
add esp, 0x18
lea eax, [ebp - 0x930]
push eax
lea ecx, [ebp - 0x1d30]
push ecx
lea edx, [ebp - 0x28f4]
push edx
push 1
push 1
lea eax, [ebp - 0x45ac]
push eax
lea ecx, [ebp - 0x28f0]
push ecx
call fcn.00407c09
add esp, 0x1c
test eax, eax
je 0x422bfe
cmp dword [ebp - 0x28f4], 0
je 0x422c20
cmp dword [ebp - 0x28f4], 0x3aa0
je 0x422c20
push 0x200
lea edx, [ebp - 0x309c]
push edx
push 0x11b
mov eax, dword [0x4492ac]
push eax
call dword [sym.imp.SQLUNIRL.dll__LoadString_16]
jmp 0x422ecf
mov dword [ebp - 0x28f4], 0
lea ecx, [ebp - 0x3f0]
push ecx
lea edx, [ebp - 0x3f0]
push edx
lea eax, [ebp - 0x3f0]
push eax
push str.IF__EXISTS__SELECT__FROM_msdb.dbo.systargetservers_WHERE__server_name__N_s____EXECUTE_msdb.dbo.sp_delete_targetserver__server_name__N_s___post_defection__0_ELSE_DELETE_FROM_msdb.dbo.sysdownloadlist_WHERE__target_server__N_s_
lea ecx, [ebp - 0x45ac]
push ecx
mov edx, dword [0x449ba0]
call dword [edx + 0x4cc]
add esp, 0x14
lea eax, [ebp - 0x930]
push eax
lea ecx, [ebp - 0x1d30]
push ecx
lea edx, [ebp - 0x28f4]
push edx
push 1
push 1
lea eax, [ebp - 0x45ac]
push eax
lea ecx, [ebp - 0x28f0]
push ecx
call fcn.00407c09
add esp, 0x1c
cmp dword [ebp - 0x28f4], 0
je 0x422cc0
cmp dword [ebp - 0x28f4], 0x37b6
je 0x422cc0
push 0x200
lea edx, [ebp - 0x309c]
push edx
push 0x11c
mov eax, dword [0x4492ac]
push eax
call dword [sym.imp.SQLUNIRL.dll__LoadString_16]
jmp 0x422ecf
mov dword [ebp - 0x28f4], 0
mov dword [ebp - 0x30a4], 1
jmp 0x422ecf
mov ecx, dword [ebp - 0x3f0]
and ecx, 0xffff
test ecx, ecx
jne 0x422cee
jmp 0x422ecf
lea edx, [ebp - 0x3f0]
push edx
lea eax, [ebp - 0x28f0]
push eax
call fcn.0042755b
add esp, 8
test eax, eax
jne 0x422d4e
push 0x200
lea ecx, [ebp - 0xd30]
push ecx
push 0x186
mov edx, dword [0x4492ac]
push edx
call dword [sym.imp.SQLUNIRL.dll__LoadString_16]
lea eax, [ebp - 0x3f0]
push eax
lea ecx, [ebp - 0xd30]
push ecx
lea edx, [ebp - 0x309c]
push edx
mov eax, dword [0x449ba0]
call dword [eax + 0x4cc]
add esp, 0xc
jmp 0x422ecf
lea ecx, [ebp - 0x4a58]
push ecx
lea edx, [ebp - 0x1d30]
push edx
lea eax, [ebp - 0x28f4]
push eax
lea ecx, [ebp - 0x28f0]
push ecx
call fcn.0042718b
add esp, 0x10
test eax, eax
je 0x422d7f
cmp dword [ebp - 0x28f4], 0
je 0x422dc2
push 0x200
lea edx, [ebp - 0xd30]
push edx
push 0x12c
mov eax, dword [0x4492ac]
push eax
call dword [sym.imp.SQLUNIRL.dll__LoadString_16]
push 0x440e98
lea ecx, [ebp - 0xd30]
push ecx
lea edx, [ebp - 0x309c]
push edx
mov eax, dword [0x449ba0]
call dword [eax + 0x4cc]
add esp, 0xc
jmp 0x422ecf
mov ecx, 0xe8
lea esi, [ebp - 0x4a58]
lea edi, [ebp - 0x2c9c]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x3b0]
and ecx, 0xffff
test ecx, ecx
je 0x422e20
lea edx, [ebp - 0x3b0]
push edx
push str._s
lea eax, [ebp - 0x7f8]
push eax
mov ecx, dword [0x449ba0]
call dword [ecx + 0x4cc]
add esp, 0xc
lea edx, [ebp - 0x7f8]
push edx
lea eax, [ebp - 0x3b0]
push eax
call dword [sym.imp.MSVCRT.dll_wcscpy]
add esp, 8
jmp 0x422e35
push str.location
lea ecx, [ebp - 0x3b0]
push ecx
call dword [sym.imp.MSVCRT.dll_wcscpy]
add esp, 8
lea edx, [ebp - 0x3f0]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x218]
push ecx
lea edx, [ebp - 0x3b0]
push edx
push str.UPDATE_msdb.dbo.systargetservers_SET_location___s__time_zone_adjustment___ld__poll_interval___ld_WHERE__server_name__N_s_
lea eax, [ebp - 0x45ac]
push eax
mov ecx, dword [0x449ba0]
call dword [ecx + 0x4cc]
add esp, 0x18
lea edx, [ebp - 0x930]
push edx
lea eax, [ebp - 0x1d30]
push eax
lea ecx, [ebp - 0x28f4]
push ecx
push 1
push 1
lea edx, [ebp - 0x45ac]
push edx
lea eax, [ebp - 0x28f0]
push eax
call fcn.00407c09
add esp, 0x1c
test eax, eax
je 0x422ea5
cmp dword [ebp - 0x28f4], 0
je 0x422ec5
push 0x200
lea ecx, [ebp - 0x309c]
push ecx
push pe_nt_image_headers32
mov edx, dword [0x4492ac]
push edx
call dword [sym.imp.SQLUNIRL.dll__LoadString_16]
jmp 0x422ecf
mov dword [ebp - 0x30a4], 1
cmp dword [ebp - 0x3f4], 0
jne 0x422f3d
cmp dword [ebp - 0x30a4], 0
jne 0x422f3d
lea eax, [ebp - 0x46b4]
push eax
lea ecx, [ebp - 0x46b4]
push ecx
lea edx, [ebp - 0x46b4]
push edx
lea eax, [ebp - 0x46b4]
push eax
push 0x440fd0
lea ecx, [ebp - 0x45ac]
push ecx
mov edx, dword [0x449ba0]
call dword [edx + 0x4cc]
add esp, 0x18
lea eax, [ebp - 0x930]
push eax
push 0
push 0
push 1
push 1
lea ecx, [ebp - 0x45ac]
push ecx
lea edx, [ebp - 0x28f0]
push edx
call fcn.00407c09
add esp, 0x1c
cmp dword [ebp - 0x30a4], 0
je 0x422fdc
cmp dword [ebp - 0x3f4], 0
jne 0x422f5f
mov dword [ebp - 0x4a64], 0x13b
jmp 0x422f9d
cmp dword [ebp - 0x3f4], 1
jne 0x422f74
mov dword [ebp - 0x4a68], 0x13c
jmp 0x422f91
mov eax, dword [ebp - 0x3f4]
sub eax, 2
neg eax
sbb eax, eax
and eax, 0xfffffeda
add eax, 0x13d
mov dword [ebp - 0x4a68], eax
mov ecx, dword [ebp - 0x4a68]
mov dword [ebp - 0x4a64], ecx
push 0x200
lea edx, [ebp - 0xd30]
push edx
mov eax, dword [ebp - 0x4a64]
push eax
mov ecx, dword [0x4492ac]
push ecx
call dword [sym.imp.SQLUNIRL.dll__LoadString_16]
lea edx, [ebp - 0x3f0]
push edx
lea eax, [ebp - 0xd30]
push eax
push 0x13a
push 0
push 4
call fcn.0041b8d1
add esp, 0x14
lea ecx, [ebp - 0x28f0]
push ecx
call dword [sym.imp.SQLSVC.dll_QSQLLogoff]
add esp, 4
jmp 0x42300b
push 0x200
lea edx, [ebp - 0x309c]
push edx
push 0x119
mov eax, dword [0x4492ac]
push eax
call dword [sym.imp.SQLUNIRL.dll__LoadString_16]
cmp dword [ebp - 0x30a4], 0
je 0x42302b
push 0x449700
lea ecx, [ebp - 0x309c]
push ecx
call dword [sym.imp.MSVCRT.dll_wcscpy]
add esp, 8
jmp 0x423090
mov edx, dword [ebp - 0x28f4]
mov dword [ebp - 0x30a0], edx
mov eax, dword [ebp - 0x1d30]
and eax, 0xffff
test eax, eax
je 0x423081
lea ecx, [ebp - 0x309c]
push ecx
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
mov edx, 0x200
sub edx, eax
sub edx, 1
push edx
lea eax, [ebp - 0x1d30]
push eax
lea ecx, [ebp - 0x309c]
push ecx
call dword [sym.imp.MSVCRT.dll_wcsncat]
add esp, 0xc
mov word [ebp - 0x2c9e], 0
lea edx, [ebp - 0x309c]
push edx
call fcn.0042fab9
add esp, 4
push 0
lea eax, [ebp - 0x28fc]
push eax
push 0x7a8
lea ecx, [ebp - 0x30a4]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
pop edi
pop esi
mov esp, ebp
pop ebp
ret