Function at 0x1000c380
Capabilities:
Create pipe
Create process on windows
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xea4
mov eax, dword [0x10014018]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0xea4], ecx
mov byte [ebp - 1], 0
xor eax, eax
mov word [ebp - 0xa80], ax
push 0x7fe
push 0
lea ecx, [ebp - 0xa7e]
push ecx
call sub.MSVCR100.dll_memset
add esp, 0xc
xor edx, edx
mov word [ebp - 0x210], dx
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x400
lea ecx, [ebp - 0xa80]
push ecx
push str.adb.exe
call fcn.10007970
add esp, 0xc
test eax, eax
jne 0x1000c40f
push 0
push 0xcd
call fcn.1000bb60
add esp, 8
or eax, 0xffffffff
jmp 0x1000c734
push 0x104
lea edx, [ebp - 0x210]
push edx
push 0x13ad
call fcn.10008190
add esp, 0xc
mov byte [ebp - 1], al
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1000c541
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0xa80]
push edx
call dword [sym.imp.MSVCR100.dll__wcsicmp]
add esp, 8
test eax, eax
jne 0x1000c532
push 0
push 0xd3
call fcn.1000bb60
add esp, 8
mov dword [ebp - 0xa88], 0xffffffff
mov eax, 0x20
mov word [ebp - 0xc90], ax
mov ecx, 0x62
mov word [ebp - 0xc8e], cx
mov edx, 0x79
mov word [ebp - 0xc8c], dx
mov eax, 0x65
mov word [ebp - 0xc8a], ax
mov ecx, 0x21
mov word [ebp - 0xc88], cx
mov edx, 0x62
mov word [ebp - 0xc86], dx
mov eax, 0x61
mov word [ebp - 0xc84], ax
mov ecx, 0x62
mov word [ebp - 0xc82], cx
mov edx, 0x79
mov word [ebp - 0xc80], dx
push 0x1f6
push 0
lea eax, [ebp - 0xc7e]
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x104
lea ecx, [ebp - 0xe98]
push ecx
push 0x1000f4c8
call fcn.10007970
add esp, 0xc
lea edx, [ebp - 0xa88]
push edx
lea eax, [ebp - 0xe98]
push eax
push 0
lea ecx, [ebp - 0xc90]
push ecx
lea edx, [ebp - 0xa80]
push edx
call fcn.10007fa0
add esp, 0x14
jmp 0x1000c541
push 0
push 0xd4
call fcn.1000bb60
add esp, 8
mov dword [ebp - 0x274], 0xc
mov dword [ebp - 0x270], 0
mov dword [ebp - 0x26c], 1
push 0
lea eax, [ebp - 0x274]
push eax
lea ecx, [ebp - 0xa84]
push ecx
lea edx, [ebp - 0x27c]
push edx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 0
jne 0x1000c5a2
push 0
push 0xcc
call fcn.1000bb60
add esp, 8
or eax, 0xffffffff
jmp 0x1000c734
push 0
push 1
mov eax, dword [ebp - 0x27c]
push eax
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
xor ecx, ecx
mov dword [ebp - 0x268], ecx
mov dword [ebp - 0x264], ecx
mov dword [ebp - 0x260], ecx
mov dword [ebp - 0x25c], ecx
push 0x44
push 0
lea edx, [ebp - 0x258]
push edx
call sub.MSVCR100.dll_memset
add esp, 0xc
mov dword [ebp - 0x258], 0x44
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebp - 0x220], eax
mov eax, dword [ebp - 0xa84]
mov dword [ebp - 0x21c], eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x22c], 0x100
lea ecx, [ebp - 0x268]
push ecx
lea edx, [ebp - 0x258]
push edx
push 0
push 0
push 8
push 1
push 0
push 0
push str.adb_fork_server_server
lea eax, [ebp - 0xa80]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x278], eax
mov ecx, dword [ebp - 0xa84]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x278], 0
jne 0x1000c688
mov edx, dword [ebp - 0x27c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0xce
call fcn.1000bb60
add esp, 8
or eax, 0xffffffff
jmp 0x1000c734
mov eax, dword [ebp - 0x268]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x264]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
lea edx, [ebp - 0xe9c]
push edx
push 3
lea eax, [ebp - 0xea0]
push eax
mov ecx, dword [ebp - 0x27c]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x278], eax
mov edx, dword [ebp - 0x27c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x278], 0
jne 0x1000c6f1
push 0
push 0xcf
call fcn.1000bb60
add esp, 8
or eax, 0xffffffff
jmp 0x1000c734
cmp dword [ebp - 0xe9c], 3
jne 0x1000c71e
movsx eax, byte [ebp - 0xea0]
cmp eax, 0x4f
jne 0x1000c71e
movsx ecx, byte [ebp - 0xe9f]
cmp ecx, 0x4b
jne 0x1000c71e
movsx edx, byte [ebp - 0xe9e]
cmp edx, 0xa
je 0x1000c732
push 0
push 0xd0
call fcn.1000bb60
add esp, 8
or eax, 0xffffffff
jmp 0x1000c734
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1000d8d6
mov esp, ebp
pop ebp
ret