Function at 0x6104cd40
Capabilities:
Create process on windows
Resume thread
Terminate process

Disassembly:
push ebp
xor ecx, ecx
mov ebp, esp
push edi
xor edx, edx
push esi
push ebx
sub esp, 0xec
mov ebx, 0xffffffff
mov eax, dword [ebp + 8]
mov dword [eax + 0x12c], ebx
mov dword [eax + 0x128], ecx
mov dword [eax + 0x130], edx
mov dword [ebp - 0xa0], eax
mov eax, dword [0x61107568]
mov dword [esp], eax
call sub.KERNEL32.dll_GetPriorityClass
sub esp, 4
test byte [0x6110c854], 1
mov ebx, eax
jne 0x6104d0ee
mov dword [esp], 0x61125eb1
xor eax, eax
mov edi, 0x40000000
mov dword [esp + 0x18], eax
mov eax, pe_nt_image_headers32
mov dword [esp + 0x14], eax
mov eax, 3
mov dword [esp + 0x10], eax
mov eax, 0x6110943c
mov dword [esp + 0xc], eax
mov eax, 2
mov dword [esp + 8], eax
mov dword [esp + 4], edi
call sub.KERNEL32.dll_CreateFileA
sub esp, 0x1c
cmp eax, 0xffffffff
je 0x6104d0e6
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov eax, dword [0x61106ec4]
add eax, 0x198
mov esi, dword [eax + 0x14]
test esi, esi
jle 0x6104cdf9
or ebx, 4
mov eax, dword [0x61107598]
mov edx, dword [ebp - 0xa0]
mov ecx, dword [0x611076dc]
mov dword [edx], eax
xor eax, eax
test ecx, ecx
je 0x6104ce20
mov edx, dword [0x611076d8]
test edx, edx
jne 0x6104d004
mov esi, dword [ebp - 0xa0]
mov byte [esi + 4], al
mov eax, dword fs:[4]
mov eax, dword [eax - 0x2ff0]
mov dword [esp], eax
call sym._fflush_1
mov dword [esp], 0x61109430
xor eax, eax
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], eax
call sub.KERNEL32.dll_CreateEventA
mov dword [ebp - 0xa4], eax
sub esp, 0x10
test eax, eax
je 0x6104d7ee
mov dword [esi + 0x44], eax
mov edx, dword fs:[4]
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0xc]
mov edi, edx
mov dword [esi + 0x120], edx
sub edi, eax
mov dword [esi + 0x11c], ecx
mov dword [esi + 0x48], edi
test byte [0x6110c854], 1
jne 0x6104d189
mov eax, 0x44
mov edi, 0x44
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], eax
lea eax, [ebp - 0x98]
mov dword [esp], eax
call sym.cygwin1.dll__memset
mov dword [ebp - 0x98], edi
mov word [ebp - 0x66], 0x120
add esi, 8
test byte [0x6110c854], 1
mov dword [ebp - 0x64], esi
jne 0x6104d138
mov edx, 0xffffffff
mov eax, 0x61108b28
call method.muto.acquire_unsigned_long_
mov dword [esp], 0
test eax, eax
setne byte [ebp - 0xa5]
call sym._time_1
mov dword [ebp - 0xac], eax
mov eax, dword [0x61106ec4]
add eax, 0x88
mov ecx, dword [eax + 0xd4]
test ecx, ecx
je 0x6104cf6e
jmp 0x6104d11e
mov eax, dword [ebp - 0x44]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [ebp - 0x40]
sub esp, 4
mov edx, esi
mov dword [esp], eax
mov eax, 0x6110c854
call method.strace.write_childpid_child_info__unsigned_long_
mov dword [esp], 0x493e0
mov edx, dword [ebp - 0x40]
lea ecx, [ebp - 0x48]
mov eax, esi
call method.child_info.sync_int__void__unsigned_long_
test al, al
jne 0x6104d282
mov edx, dword [ebp - 0x48]
mov eax, esi
call method.child_info.proc_retry_void_
test eax, eax
jne 0x6104d010
mov dword [esp + 0x14], ebx
mov eax, dword [0x61109170]
lea edx, [ebp - 0x48]
mov dword [esp + 0x24], edx
lea edi, [ebp - 0x98]
xor edx, edx
mov dword [esp + 0x20], edi
xor edi, edi
add eax, 0x18
mov dword [esp + 0x1c], edx
mov ecx, 1
mov edx, 0x6110943c
mov dword [esp + 0x18], edi
mov edi, 0x6110943c
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], edx
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov dword [esp], eax
call sub.KERNEL32.dll_CreateProcessA
mov dword [ebp - 0xbc], eax
sub esp, 0x28
test eax, eax
je 0x6104d23d
test bl, 4
je 0x6104cf20
mov eax, dword [ebp - 0x40]
mov dword [esp + 4], eax
mov eax, dword [0x61106ec4]
add eax, 0x198
mov dword [esp], eax
call method.dtable.fixup_before_fork_unsigned_long_
mov eax, dword [ebp - 0x44]
mov dword [esp], eax
call sub.KERNEL32.dll_ResumeThread
sub esp, 4
jmp 0x6104cf20
mov al, 1
jmp 0x6104ce20
mov edx, dword [ebp - 0xa0]
mov esi, 0xb
mov ebx, str.died_waiting_for_longjmp_before_initialization__retry__d__exit_code__p
lea edi, [ebp - 0x38]
mov dword [edx + 0x130], esi
mov dword [esp + 0xc], eax
mov eax, dword [edx + 0x3c]
mov dword [esp + 4], ebx
mov dword [esp], 0x61141f00
mov dword [esp + 8], eax
call sym.___small_sprintf
mov dword [ebp - 0xb0], edi
mov esi, dword [ebp - 0xa0]
mov ecx, 0x61141f00
mov dword [esi + 0x128], ecx
mov eax, dword [0x61106ec4]
add eax, 0x88
mov eax, dword [eax + 0xd4]
test eax, eax
jne 0x6104d074
mov eax, dword [0x6110755c]
mov dword [esp], eax
call fcn.610ff4b8
sub esp, 4
cmp byte [ebp - 0xa5], 0
jne 0x6104d21b
mov eax, dword [ebp - 0x48]
test eax, eax
je 0x6104d09e
mov edx, dword [ebp - 0x28]
test edx, edx
je 0x6104d60a
mov eax, dword [ebp - 0xa4]
test eax, eax
je 0x6104d0b9
mov eax, dword [ebp - 0xa4]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
test byte [0x6110c854], 1
jne 0x6104d1ef
cmp byte [ebp - 0x30], 0
je 0x6104d0d7
mov eax, dword [ebp - 0x34]
test eax, eax
jne 0x6104d22a
mov eax, 0xffffffff
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 8
or ebx, 8
jmp 0x6104cde5
mov dword [esp + 0x10], eax
mov eax, 0x61125f03
mov edi, 0x40
mov dword [esp + 0xc], eax
mov eax, str.int_frok::parent_volatile_char_
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [esp], 0x6110c854
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x6104cd8f
call fcn.610ffa08
mov eax, dword [0x6110755c]
mov dword [esp], eax
call fcn.610ff4b8
sub esp, 4
jmp 0x6104cf6e
mov dword [esp + 0x18], ebx
mov eax, dword [0x61109170]
lea edi, [ebp - 0x48]
mov dword [esp + 0x20], edi
lea edx, [ebp - 0x98]
mov edi, 0x10
mov dword [esp + 0x1c], edx
add eax, 0x18
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov eax, str.CreateProcess___s___s__0__0__1___p__0__0___p___p_
mov dword [esp + 0xc], eax
mov eax, str.int_frok::parent_volatile_char_
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [esp], 0x6110c854
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x6104cedd
mov dword [esp + 0x14], ecx
mov eax, 0x40
mov ecx, str.stack___bottom__p__top__p__size__d
mov dword [esp + 0x10], edx
mov edx, str.int_frok::parent_volatile_char_
lea esi, [ebp - 0x98]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp + 0x18], edi
mov dword [esp], 0x6110c854
call method.strace.prntf_unsigned_int__char_const__char_const__..._
mov dword [esp], esi
mov eax, 0x44
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], eax
call sym.cygwin1.dll__memset
mov esi, dword [ebp - 0xa0]
mov eax, 0x44
mov dword [ebp - 0x98], eax
jmp 0x6104cec4
mov dword [esp], 0x6110c854
mov esi, str.returning__1
mov ebx, str.int_frok::parent_volatile_char_
mov dword [esp + 0xc], esi
mov ecx, 0x40
mov dword [esp + 8], ebx
mov dword [esp + 4], ecx
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x6104d0c6
mov eax, 0x61108b28
call method.muto.release__
jmp 0x6104d08c
mov edx, dword [ebp - 0xb0]
mov dword [esp], edx
call method.pinfo.release__
jmp 0x6104d0d7
call sub.KERNEL32.dll_GetLastError
mov edx, 0xd
mov edi, str.CreateProcessA_failed
call sym.__Z23geterrno_from_win_errormi_8
cld
mov edx, dword [ebp - 0xa0]
mov ecx, 4
mov dword [edx + 0x130], eax
mov eax, dword [ebp - 0xbc]
mov dword [edx + 0x128], edi
lea edi, [ebp - 0x48]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x38]
mov dword [ebp - 0xb0], eax
jmp 0x6104d05b
mov eax, dword [0x61106ec4]
add eax, 0x88
mov eax, dword [eax + 0xd4]
test eax, eax
jne 0x6104d29b
mov eax, dword [0x6110755c]
mov dword [esp], eax
call fcn.610ff4b8
mov eax, dword [0x611650ec]
sub esp, 4
mov ecx, dword [ebp - 0x40]
test byte [eax + 0x13], 4
mov edx, ecx
je 0x6104d2b8
neg edx
mov edi, dword [ebp - 0xa0]
lea eax, [ebp - 0x38]
mov ecx, 1
mov dword [ebp - 0xb0], eax
mov dword [edi + 0x12c], edx
mov dword [esp], 0
call method.pinfo.init_int__unsigned_long__void_
mov ecx, dword [ebp - 0x34]
test ecx, ecx
je 0x6104d798
mov edx, dword [ebp - 0xac]
mov eax, dword [0x61109170]
mov dword [ecx + 0x134], edx
mov edx, dword [eax + 0x1c8]
add eax, 0x18
mov dword [ecx + 0x1c8], edx
lea edx, [ecx + 0x18]
mov dword [esp], edx
mov dword [esp + 4], eax
call sym.cygwin1.dll__strcpy
mov edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x34]
mov dword [eax + 0x14], edx
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0xb0]
mov dword [ebp - 0x28], eax
mov eax, 1
call sym.__Z12proc_subprocmm_8
test eax, eax
sete byte [ebp - 0x30]
je 0x6104d6c9
test byte [0x6110c854], 1
jne 0x6104d666
mov eax, dword fs:[4]
sub eax, 0x319c
cmp eax, dword [0x61107538]
je 0x6104d692
mov eax, dword [sym.cygwin1.dll__impure_ptr]
mov ecx, str.impure
lea edx, [eax + 0x428]
mov dword [esp + 0x1c], edx
mov edi, dword [ebp - 0xa0]
xor ebx, ebx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x18], eax
mov eax, dword [edi + 0x120]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], eax
mov eax, str.stack
mov dword [esp + 8], eax
mov eax, 1
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x48]
mov dword [esp], eax
call sym.child_copy_void__bool__..._
movzx eax, al
mov dword [ebp - 0xbc], eax
mov eax, 0x61108b28
call method.muto.release__
mov edi, dword [ebp - 0xbc]
test edi, edi
je 0x6104d6f6
mov edi, dword [0x61107598]
mov ebx, 1
mov edx, 0x6110758c
mov dword [0x61107594], ebx
test edi, edi
mov dword [0x61107590], edi
jne 0x6104d416
jmp 0x6104d4be
mov eax, dword [edi]
test eax, eax
mov dword [edx + 4], eax
je 0x6104d62f
mov edi, dword [0x61107590]
cmp dword [edi + 0x30], 1
jne 0x6104d403
test edi, edi
je 0x6104d4be
test byte [0x6110c854], 1
jne 0x6104d63a
xor ecx, ecx
mov edx, str.linked_dll_bss
mov dword [esp + 0x20], ecx
mov eax, dword [edi + 0x20]
mov dword [esp + 0x1c], eax
mov eax, dword [edi + 0x1c]
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], eax
mov eax, dword [edi + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [esp + 0xc], eax
mov eax, str.linked_dll_data
mov dword [esp + 8], eax
mov eax, 1
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x48]
mov dword [esp], eax
call sym.child_copy_void__bool__..._
test al, al
je 0x6104d839
mov eax, dword [0x61107590]
mov edi, dword [eax]
test edi, edi
mov dword [0x61107590], edi
je 0x6104d4be
mov eax, dword [0x61107594]
mov esi, esi
lea edi, [edi]
cmp eax, 3
je 0x6104d41c
cmp dword [edi + 0x30], eax
je 0x6104d41c
mov edi, dword [edi]
test edi, edi
mov dword [0x61107590], edi
jne 0x6104d4a0
mov eax, dword [ebp - 0xa4]
call sym.resume_child_void_
mov dword [esp], 0x493e0
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x48]
mov edx, dword [eax]
mov eax, esi
call method.child_info.sync_int__void__unsigned_long_
test al, al
je 0x6104d69d
mov edx, dword [ebp - 0xa0]
cmp byte [edx + 4], 0
je 0x6104d5d9
mov edi, dword [0x61107598]
mov eax, 2
mov edx, 0x6110758c
mov dword [0x61107594], eax
test edi, edi
mov dword [0x61107590], edi
jne 0x6104d533
jmp 0x6104d5ce
mov eax, dword [edi]
test eax, eax
mov dword [edx + 4], eax
je 0x6104d6be
mov edi, dword [0x61107590]
cmp dword [edi + 0x30], 2
jne 0x6104d520
test edi, edi
je 0x6104d5ce
test byte [0x6110c854], 1
jne 0x6104d76c
xor ecx, ecx
mov edx, str.loaded_dll_bss
mov dword [esp + 0x20], ecx
mov eax, dword [edi + 0x20]
mov dword [esp + 0x1c], eax
mov eax, dword [edi + 0x1c]
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], eax
mov eax, dword [edi + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [esp + 0xc], eax
mov eax, str.loaded_dll_data
mov dword [esp + 8], eax
mov eax, 1
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x48]
mov dword [esp], eax
call sym.child_copy_void__bool__..._
test al, al
je 0x6104d851
mov eax, dword [0x61107590]
mov edi, dword [eax]
test edi, edi
mov dword [0x61107590], edi
je 0x6104d5ce
mov eax, dword [0x61107594]
cmp eax, 3
je 0x6104d539
cmp dword [edi + 0x30], eax
je 0x6104d539
mov edi, dword [edi]
test edi, edi
mov dword [0x61107590], edi
jne 0x6104d5b4
mov eax, dword [ebp - 0xa4]
call sym.resume_child_void_
mov edi, dword [ebp - 0xa4]
mov dword [esp], edi
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
cmp byte [ebp - 0x30], 0
mov eax, dword [ebp - 0xa0]
mov ebx, dword [eax + 0x12c]
je 0x6104d603
mov eax, dword [ebp - 0x34]
test eax, eax
jne 0x6104d61a
mov eax, ebx
jmp 0x6104d0dc
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
jmp 0x6104d09e
mov edx, dword [ebp - 0xb0]
mov dword [esp], edx
call method.pinfo.release__
mov eax, ebx
jmp 0x6104d0dc
mov edi, dword [0x61107590]
jmp 0x6104d41c
mov dword [esp], 0x6110c854
mov eax, str.copying_data_bss_of_a_linked_dll
mov dword [esp + 0xc], eax
mov eax, str.int_frok::parent_volatile_char_
mov dword [esp + 8], eax
mov eax, 0x40
mov dword [esp + 4], eax
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x6104d431
mov dword [esp], 0x6110c854
mov eax, str.child_is_alive__but_stopped_
mov dword [esp + 0xc], eax
mov eax, str.int_frok::parent_volatile_char_
mov dword [esp + 8], eax
mov eax, 0x40
mov dword [esp + 4], eax
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x6104d350
xor ecx, ecx
xor edx, edx
xor eax, eax
jmp 0x6104d377
mov esi, dword [ebp - 0xa0]
mov edi, 0xb
mov ebx, str.died_waiting_for_dll_loading
mov dword [esi + 0x130], edi
mov dword [esi + 0x128], ebx
jmp 0x6104d08c
mov edi, dword [0x61107590]
jmp 0x6104d539
mov eax, 1
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x48]
mov dword [esp], eax
call sub.KERNEL32.dll_TerminateProcess
mov esi, dword [ebp - 0xa0]
mov eax, 0xb
sub esp, 8
mov dword [esi + 0x130], eax
jmp 0x6104d07f
call sym.cygwin1.dll___errno
mov eax, dword [eax]
mov edi, dword [ebp - 0xa0]
mov dword [edi + 0x130], eax
lea eax, [ebp - 0x9c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x48]
mov dword [esp], eax
call sub.KERNEL32.dll_GetExitCodeProcess
sub esp, 8
test eax, eax
jne 0x6104d730
mov edi, 0xdeadbeef
mov dword [ebp - 0x9c], edi
mov dword [esp], 0x61141f00
mov eax, dword [ebp - 0x9c]
mov esi, str.pid__u__exitval__p
mov dword [esp + 4], esi
mov ebx, 0x61141f00
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x40]
mov dword [esp + 8], eax
call sym.___small_sprintf
mov eax, dword [ebp - 0xa0]
mov dword [eax + 0x128], ebx
jmp 0x6104d08c
mov dword [esp], 0x6110c854
mov eax, str.copying_data_bss_for_a_loaded_dll
mov dword [esp + 0xc], eax
mov eax, str.int_frok::parent_volatile_char_
mov dword [esp + 8], eax
mov eax, 0x40
mov dword [esp + 4], eax
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x6104d54e
call sym.cygwin1.dll___errno
cmp dword [eax], 0xc
mov edx, dword [ebp - 0xa0]
sete al
movzx eax, al
add eax, 0xb
mov dword [edx + 0x130], eax
test byte [0x6110c854], 1
je 0x6104d07f
mov dword [esp], 0x6110c854
mov ecx, 0x61126072
mov edx, str.int_frok::parent_volatile_char_
mov dword [esp + 0xc], ecx
mov eax, 0x10
mov dword [esp + 8], edx
mov dword [esp + 4], eax
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x6104d07f
call sub.KERNEL32.dll_GetLastError
mov edx, 0xd
mov esi, str.unable_to_allocate_forker_finished_event
call sym.__Z23geterrno_from_win_errormi_8
cmp byte [ebp - 0x30], 0
mov edx, dword [ebp - 0xa0]
mov dword [edx + 0x130], eax
lea eax, [ebp - 0x38]
mov dword [edx + 0x128], esi
je 0x6104d0d7
mov ebx, dword [ebp - 0x34]
test ebx, ebx
je 0x6104d0d7
mov dword [esp], eax
call method.pinfo.release__
jmp 0x6104d0d7
call sym.cygwin1.dll___errno
mov eax, dword [eax]
mov esi, dword [ebp - 0xa0]
mov dword [esi + 0x130], eax
jmp 0x6104d08c
call sym.cygwin1.dll___errno
mov eax, dword [eax]
mov edi, dword [ebp - 0xa0]
mov dword [edi + 0x130], eax
jmp 0x6104d08c