Function at 0x403530
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x5c
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
test ebx, ebx
movzx eax, word [esi]
jne 0x4037a0
mov ecx, dword [ebp + 0x1c]
test eax, eax
mov edx, esi
lea edi, [ecx + 0x12]
je 0x40356d
lea esi, [esi]
lea edi, [edi]
add edx, 2
cmp word [edx], 0
jne 0x403560
sub edx, esi
add edi, edx
mov dword [esp + 8], edi
xor edx, edx
mov dword [esp + 4], edx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [eax], 0x57494e45
mov ebx, eax
mov eax, dword [ebp + 0x14]
mov dword [ebx + 4], edi
sub esp, 0xc
mov dword [ebx + 0xc], eax
cmp word [esi], 0
je 0x403a33
mov eax, esi
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x4035b0
sub eax, esi
sar eax, 1
inc eax
mov dword [ebx + 8], eax
xor eax, eax
lea esi, [esi]
lea edi, [edi]
movzx edx, word [esi + eax]
mov word [ebx + eax + 0x10], dx
add eax, 2
test edx, edx
jne 0x4035d0
mov eax, dword [ebp + 0x1c]
test eax, eax
jne 0x403820
mov eax, dword [ebp + 8]
lea esi, [ebp - 0x2c]
mov edx, dword [ebx + 4]
lea edi, [ebp - 0x30]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov eax, dword [eax + 0x24]
mov dword [esp + 8], edx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], ebx
mov dword [ebp - 0x3c], edx
mov eax, dword [eax + 0x20]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WriteFile]
mov edx, dword [ebp - 0x3c]
sub esp, 0x14
test eax, eax
jne 0x4036c0
mov eax, dword fs:[0x18]
cmp dword [eax + 0x34], 0x3e5
je 0x403668
test byte [0x41901c], 2
jne 0x403928
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
jmp 0x4036d7
mov eax, dword [0x41908c]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov edx, dword [ebp - 0x3c]
sub esp, 8
cmp eax, 0x102
je 0x403999
mov dword [esp + 8], edi
xor eax, eax
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], esi
mov dword [ebp - 0x3c], edx
mov eax, dword [eax + 0x20]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetOverlappedResult]
mov edx, dword [ebp - 0x3c]
sub esp, 0x10
test eax, eax
je 0x40364a
nop
lea esi, [esi]
cmp edx, dword [ebp - 0x30]
je 0x403710
test byte [0x41901c], 2
jne 0x4038f8
mov eax, 0x1d
mov ecx, dword [ebp + 0x20]
xor esi, esi
mov dword [ecx], eax
mov dword [esp + 8], ebx
xor edx, edx
mov dword [esp + 4], edx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, esi
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x10], esi
mov eax, 4
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x20]
mov dword [esp + 0xc], edi
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x20]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_ReadFile]
sub esp, 0x14
test eax, eax
jne 0x4038d0
mov eax, dword fs:[0x18]
cmp dword [eax + 0x34], 0x3e5
je 0x403875
test byte [0x41901c], 2
je 0x403657
mov eax, dword [ebp - 0x30]
xor ecx, ecx
mov esi, str.service_protocol_error___failed_to_read_pipe_r___d__count___d__n
mov dword [esp + 0x10], ecx
mov edi, str.process_send_command
mov dword [esp + 0xc], esi
mov dword [esp + 8], edi
mov dword [esp + 0x14], eax
mov eax, 0x41901c
mov dword [esp + 4], eax
mov dword [esp], 1
call fcn.00401740
jmp 0x403657
mov ecx, dword [ebp + 0x14]
or ecx, 0x80000000
test eax, eax
mov dword [ebp - 0x3c], ecx
je 0x403954
mov edx, esi
lea esi, [esi]
lea edi, [edi]
add edx, 2
cmp word [edx], 0
jne 0x4037c0
sub edx, esi
lea eax, [edx + 2]
mov dword [ebp + 0x1c], eax
lea edi, [edx + 0x14]
mov dword [esp + 8], edi
xor ecx, ecx
mov dword [esp + 4], ecx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebp + 0x18], esi
mov esi, 0x41abc6
mov dword [eax], 0x57494e45
mov ebx, eax
mov eax, dword [ebp - 0x3c]
mov dword [ebx + 4], edi
sub esp, 0xc
mov dword [ebx + 0xc], eax
mov eax, 1
jmp 0x4035be
mov ecx, dword [ebp + 0x1c]
mov eax, dword [ebx + 8]
mov esi, dword [ebp + 0x18]
cmp ecx, 8
lea edi, [ebx + eax*2 + 0x10]
jae 0x403840
rep movsb byte es:[edi], byte [esi]
jmp 0x4035eb
test edi, 1
jne 0x4039c7
test edi, 2
jne 0x4039b2
test edi, 4
je 0x403832
mov eax, dword [esi]
add edi, 4
add esi, 4
sub ecx, 4
mov dword [edi - 4], eax
rep movsb byte es:[edi], byte [esi]
jmp 0x4035eb
mov eax, dword [0x41908c]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
sub esp, 8
cmp eax, 0x102
je 0x4039fe
mov dword [esp + 8], edi
xor eax, eax
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], esi
mov eax, dword [eax + 0x20]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetOverlappedResult]
sub esp, 0x10
test eax, eax
je 0x403755
lea esi, [esi]
lea edi, [edi]
mov edx, dword [ebp - 0x30]
mov esi, 1
cmp edx, 4
je 0x4036de
test byte [0x41901c], 2
jne 0x403965
mov eax, 0x1e
jmp 0x4036d7
mov dword [esp], 1
mov eax, str.service_protocol_error___failed_to_write_pipe__n
mov dword [esp + 0xc], eax
mov eax, str.process_send_command
mov dword [esp + 8], eax
mov eax, 0x41901c
mov dword [esp + 4], eax
call fcn.00401740
jmp 0x4036d2
mov edx, str.process_send_command
mov ecx, 0x41901c
mov dword [esp + 8], edx
mov eax, str.service_protocol_error___failed_to_write_pipe__n
mov dword [esp + 0xc], eax
mov dword [esp + 4], ecx
mov dword [esp], 1
call fcn.00401740
jmp 0x403657
mov dword [ebp + 0x1c], 2
mov edi, 0x14
jmp 0x4037d4
mov dword [esp + 0x10], eax
mov eax, str.service_protocol_error___failed_to_read_pipe_r___d__count___d__n
mov dword [esp + 0xc], eax
mov eax, str.process_send_command
mov dword [esp + 8], eax
mov eax, 0x41901c
mov dword [esp + 0x14], edx
mov dword [esp + 4], eax
mov dword [esp], 1
call fcn.00401740
jmp 0x4038ea
test byte [0x41901c], 2
jne 0x4039d5
mov eax, dword [ebp + 0x20]
xor esi, esi
mov dword [eax], 0x41d
jmp 0x4036de
movzx eax, word [esi]
add edi, 2
add esi, 2
sub ecx, 2
mov word [edi - 2], ax
jmp 0x403858
movzx eax, byte [esi]
inc edi
inc esi
dec ecx
mov byte [edi - 1], al
jmp 0x40384c
mov dword [esp], 1
mov eax, str.sending_command_timed_out_n
mov dword [esp + 0xc], eax
mov eax, str.process_send_command
mov dword [esp + 8], eax
mov eax, 0x41901c
mov dword [esp + 4], eax
call fcn.00401740
jmp 0x4039a2
test byte [0x41901c], 2
je 0x4039a2
mov edx, str.receiving_command_result_timed_out_n
mov ecx, str.process_send_command
mov dword [esp + 0xc], edx
mov esi, 0x41901c
mov dword [esp + 8], ecx
mov dword [esp + 4], esi
mov dword [esp], 1
call fcn.00401740
jmp 0x4039a2
mov eax, 1
jmp 0x4035be