Function at 0x418700
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Read file on windows
Read pipe
Resolve function by parsing pe exports
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x2490
call fcn.0043ec10
mov eax, dword [0x45115c]
xor eax, esp
mov dword [esp + 0x248c], eax
push esi
push edi
push 0x3ff
xor esi, esi
lea eax, [esp + 0x95]
push esi
push eax
mov edi, ecx
mov byte [esp + 0x9c], 0
call fcn.0043e300
push 0xfff
lea ecx, [esp + 0x14a1]
push esi
push ecx
mov byte [esp + 0x14a8], 0
call fcn.0043e300
push 0xfff
lea edx, [esp + 0x4ad]
push esi
push edx
mov byte [esp + 0x4b4], 0
call fcn.0043e300
push str.._adb_adb.exe
lea eax, [esp + 0xb8]
mov dword [esp + 0x38], esi
mov dword [esp + 0x44], esi
mov dword [esp + 0x4c], esi
push 0x400
mov dword [esp + 0x4c], esi
mov esi, dword [sym.imp.MSVCR100.dll_strcat_s]
push eax
mov byte [esp + 0x3f], 0
call esi
mov eax, dword [ebp + 8]
add esp, 0x30
dec eax
je 0x4187e0
dec eax
je 0x4187d9
push 0x445f6c
lea ecx, [esp + 0x94]
push 0x400
push ecx
call esi
push edi
lea edx, [esp + 0xa0]
push 0x400
push edx
call esi
add esp, 0x18
jmp 0x418820
push str.ftmex
jmp 0x4187e5
push str.shell
lea eax, [esp + 0x94]
push 0x400
push eax
call esi
push edi
push str.__s_
lea edx, [esp + 0x14a4]
call fcn.0040c760
lea ecx, [esp + 0x14a4]
push ecx
lea edx, [esp + 0xa8]
push 0x400
push edx
call esi
add esp, 0x20
push 0
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x20]
push edx
mov dword [esp + 0x48], 0xc
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x418897
mov eax, dword [str.CreatePipe_failed]
mov dword [ebx], eax
mov ecx, dword [0x445f9c]
mov dword [ebx + 4], ecx
mov edx, dword [0x445fa0]
mov dword [ebx + 8], edx
mov eax, dword [0x445fa4]
mov dword [ebx + 0xc], eax
mov cx, word [0x445fa8]
mov word [ebx + 0x10], cx
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x248c]
xor ecx, esp
call fcn.0043dda2
mov esp, ebp
pop ebp
ret 8
push 0x44
lea edx, [esp + 0x4c]
push 0
push edx
call fcn.0043e300
add esp, 0xc
lea eax, [esp + 0x48]
push eax
mov dword [esp + 0x4c], 0x44
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov eax, dword [esp + 0x18]
xor ecx, ecx
mov dword [esp + 0x88], eax
mov dword [esp + 0x84], eax
mov word [esp + 0x78], cx
mov dword [esp + 0x74], 0x101
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x4c]
push eax
push 0
push 0
push 0
push 1
push 0
push 0
lea ecx, [esp + 0xb0]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x418c42
mov edx, dword [esp + 0x28]
push 0xc350
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, eax
cmp esi, 0x102
je 0x418d17
cmp esi, 0xffffffff
je 0x418d17
cmp byte [ebp + 0xc], 0
je 0x418cd8
push 0x1000
lea eax, [esp + 0x494]
push 0
push eax
call fcn.0043e300
add esp, 0xc
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x20]
push edx
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x18]
push eax
push 1
lea ecx, [esp + 0x4a0]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
cmp dword [esp + 0x10], 0
je 0x418d0d
mov edx, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea eax, [esp + 0x14]
push eax
push 0xfff
lea ecx, [esp + 0x49c]
push ecx
push edx
call esi
mov edi, dword [0x4422f0]
lea eax, [esp + 0x490]
push str.daemon_not_running
push eax
call edi
add esp, 8
test eax, eax
je 0x4189f8
mov ecx, dword [str.daemon_not_running]
mov dword [ebx], ecx
mov edx, dword [0x445fc8]
mov dword [ebx + 4], edx
mov eax, dword [0x445fcc]
mov dword [ebx + 8], eax
mov ecx, dword [0x445fd0]
mov dword [ebx + 0xc], ecx
mov dx, word [0x445fd4]
mov word [ebx + 0x10], dx
mov al, byte [0x445fd6]
mov byte [ebx + 0x12], al
jmp 0x418c2b
lea ecx, [esp + 0x490]
push str.cannot_connect_to_daemon
push ecx
call edi
add esp, 8
test eax, eax
je 0x418aa7
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x4c]
push eax
push 0
push 0
mov ecx, 6
mov esi, str.cannot_connect_to_daemon
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
push 0
push 1
push 0
push 0
push str.._adb_adb.exe_kill_server
movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0
call esi
mov ecx, dword [esp + 0x28]
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xc350
push ecx
call edi
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x4c]
push eax
push 0
push 0
push 0
push 1
push 0
push 0
push str.._adb_adb.exe_start_server
push 0
call esi
mov ecx, dword [esp + 0x28]
push 0xc350
push ecx
call edi
mov ecx, dword [esp + 0x14]
push 0
lea edx, [esp + 0x14]
push edx
push 0xfff
lea eax, [esp + 0x49c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x418c2b
lea edx, [esp + 0x490]
push str.device_not_found
push edx
call edi
add esp, 8
test eax, eax
je 0x418b49
mov eax, dword [str.device_not_found]
mov dword [ebx], eax
mov ecx, dword [0x446030]
mov dword [ebx + 4], ecx
mov edx, dword [0x446034]
mov dword [ebx + 8], edx
mov eax, dword [0x446038]
mov dword [ebx + 0xc], eax
mov cl, byte [0x44603c]
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x4c]
push eax
push 0
push 0
push 0
push 1
push 0
push 0
push str.._adb_adb.exe_devices
push 0
mov byte [ebx + 0x10], cl
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ecx, dword [esp + 0x28]
push 0xc350
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
add dword [ebx + 0x6a14244c], ecx
add byte [ebp + 0x52142454], cl
push 0xfff
lea eax, [esp + 0x49c]
push eax
push ecx
call esi
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x418c2b
lea edx, [esp + 0x490]
push str.Segmentation_fault
push edx
call edi
add esp, 8
test eax, eax
jne 0x418c7a
lea eax, [esp + 0x490]
push str.No_such_file_or_directory
push eax
call edi
add esp, 8
test eax, eax
jne 0x418ca9
lea ecx, [esp + 0x490]
push str.offline
push ecx
call edi
add esp, 8
test eax, eax
je 0x418bb7
mov edx, dword [str.ADB_offline_]
mov dword [ebx], edx
mov eax, dword [0x4460a8]
mov dword [ebx + 4], eax
mov ecx, dword [0x4460ac]
mov dword [ebx + 8], ecx
mov dl, byte [0x4460b0]
mov byte [ebx + 0xc], dl
jmp 0x418c2b
lea eax, [esp + 0x490]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x418bc1
sub eax, edx
jne 0x418bfa
mov eax, dword [str.ResponseIsNULL]
mov dword [ebx], eax
mov ecx, dword [0x4460b8]
mov dword [ebx + 4], ecx
mov edx, dword [0x4460bc]
mov dword [ebx + 8], edx
mov ax, word [0x4460c0]
mov word [ebx + 0xc], ax
mov cl, byte [0x4460c2]
mov byte [ebx + 0xe], cl
jmp 0x418c2b
lea edx, [esp + 0x490]
push str.protocol_fault
push edx
call edi
add esp, 8
lea ecx, [esp + 0x490]
test eax, eax
je 0x418cbe
mov edx, ebx
mov eax, ecx
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x418c21
mov eax, dword [esp + 0x20]
inc eax
mov dword [esp + 0x20], eax
cmp eax, 0xa
jle 0x4188dc
jmp 0x418dbd
mov edx, dword [str.CreateProcess_failed]
mov dword [ebx], edx
mov eax, dword [0x445fb0]
mov dword [ebx + 4], eax
mov ecx, dword [0x445fb4]
mov dword [ebx + 8], ecx
mov edx, dword [0x445fb8]
mov dword [ebx + 0xc], edx
mov eax, dword [0x445fbc]
mov dword [ebx + 0x10], eax
mov cl, byte [0x445fc0]
mov byte [ebx + 0x14], cl
jmp 0x418dbd
mov edx, dword [str.Segmentation_fault_]
mov dword [ebx], edx
mov eax, dword [0x446070]
mov dword [ebx + 4], eax
mov ecx, dword [0x446074]
mov dword [ebx + 8], ecx
mov edx, dword [0x446078]
mov dword [ebx + 0xc], edx
mov eax, dword [0x44607c]
mov dword [ebx + 0x10], eax
jmp 0x418dbd
mov ecx, 6
mov esi, str.No_such_file_or_directory
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jmp 0x418dbd
push 0xffe
push ecx
push ebx
call dword [sym.imp.MSVCR100.dll_strncpy]
add esp, 0xc
mov byte [esp + 0xf], 1
jmp 0x418dbd
mov edx, dword [str.ADB_command_completes]
mov dword [ebx], edx
mov eax, dword [0x4460d8]
mov dword [ebx + 4], eax
mov ecx, dword [0x4460dc]
mov dword [ebx + 8], ecx
mov edx, dword [0x4460e0]
mov dword [ebx + 0xc], edx
mov eax, dword [0x4460e4]
mov dword [ebx + 0x10], eax
mov cx, word [0x4460e8]
mov word [ebx + 0x14], cx
mov byte [esp + 0xf], 1
jmp 0x418dbd
cmp byte [ebp + 0xc], 0
je 0x418d7e
push 0x1000
lea edx, [esp + 0x494]
push 0
push edx
call fcn.0043e300
add esp, 0xc
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x18]
push edx
push 1
lea eax, [esp + 0x4a0]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
cmp dword [esp + 0x10], 0
je 0x418d7e
mov ecx, dword [esp + 0x14]
push 0
lea edx, [esp + 0x14]
push edx
push 0xfff
lea eax, [esp + 0x49c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, ebx
cmp esi, 0x102
jne 0x418d96
mov ecx, 7
mov esi, str.WaitForSingleObject_timeout
rep movsd dword es:[edi], dword [esi]
jmp 0x418da5
mov ecx, 6
mov esi, str.WaitForSingleObject_failed
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov edx, dword [esp + 0x28]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 0x14]
push ecx
call esi
mov ecx, dword [esp + 0x2494]
mov al, byte [esp + 0xf]
pop edi
pop esi
xor ecx, esp
call fcn.0043dda2
mov esp, ebp
pop ebp
ret 8