Function at 0x402690
Capabilities:
Create thread
Terminate process

Disassembly:
sub esp, 0x80
push ebx
push ebp
push esi
push edi
xor ebp, ebp
push 0xbb8
push ebp
push 2
mov dword [esp + 0x20], 0x40
mov dword [esp + 0x1c], ebp
call fcn.00403ab0
add esp, 0xc
test eax, eax
je 0x402905
mov esi, 1
push esi
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
lea eax, [esp + 0x1c]
mov dword [0x411b88], ebp
push eax
push ebp
push ebp
push 0x404120
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebp
je 0x4026f5
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call ebx
jmp 0x4026fb
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x14]
lea edx, [esp + 0x50]
push ecx
push edx
call fcn.00403110
add esp, 8
test eax, eax
je 0x402a82
lea eax, [esp + 0x3c]
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x402a82
lea ecx, [esp + 0x50]
push ebp
push ecx
lea edx, [esp + 0x44]
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x402a82
push ebp
mov eax, 0xc
lea ecx, [esp + 0x40]
push ebp
push 4
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], esi
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ebp
mov dword [esp + 0x38], esi
call fcn.00403ab0
add esp, 0xc
test eax, eax
je 0x40290b
cmp dword [0x411b88], ebp
jne 0x40292b
mov edi, dword [0x411944]
mov edx, dword [0x411948]
cmp edi, edx
je 0x402801
lea ebx, [edi + 4]
mov ecx, dword [edi]
cmp dword [ecx + 0x68c], ebp
jne 0x4027f1
cmp ebx, edx
mov eax, ebx
je 0x4027bf
mov esi, edi
sub esi, ebx
mov ebp, dword [eax]
mov dword [esi + eax], ebp
add eax, 4
cmp eax, edx
jne 0x4027ab
mov edx, dword [0x411948]
xor ebp, ebp
add edx, 0xfffffffc
cmp ecx, ebp
mov dword [esp + 0x18], edx
mov dword [0x411948], edx
je 0x4027dc
mov edx, dword [ecx]
push 1
call dword [edx]
mov edx, dword [0x411948]
mov eax, dword [0x411944]
cmp eax, ebp
je 0x4027fb
mov ecx, edx
sub ecx, eax
test ecx, 0xfffffffc
je 0x4027fb
add edi, 4
add ebx, 4
cmp edi, edx
jne 0x402797
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x89c
call fcn.0040560d
add esp, 4
cmp eax, ebp
je 0x40281d
mov ecx, eax
call fcn.004034e0
mov esi, eax
jmp 0x40281f
xor esi, esi
mov eax, dword [0x411948]
lea edx, [esp + 0x18]
push edx
push 1
push eax
mov ecx, 0x411940
mov dword [esp + 0x24], esi
call fcn.004032d0
lea ecx, [esp + 0x10]
lea edx, [esi + 0x660]
push ecx
lea eax, [esi + 0x65c]
push edx
lea ecx, [esp + 0x2c]
push eax
lea edx, [esp + 0x3c]
push ecx
push edx
push esi
mov dword [esp + 0x28], ebp
call fcn.00402a90
add esp, 0x18
test eax, eax
je 0x40290b
cmp dword [0x411b88], ebp
jne 0x40290b
mov eax, dword [esp + 0x10]
cmp eax, ebp
jne 0x40289c
lea eax, [esp + 0x10]
push eax
push 1
push 2
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
je 0x40290b
jmp 0x4028a2
mov dword [esi + 0x684], eax
mov ecx, dword [esp + 0x10]
lea edi, [esi + 0x684]
push edi
push 1
push 2
push ebp
push 0x2000f
push ecx
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x40290b
mov edx, dword [edi]
push edx
call fcn.00401360
add esp, 4
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov eax, dword [esp + 0x10]
push eax
call ebx
lea ecx, [esp + 0x20]
mov dword [esp + 0x10], ebp
push ecx
push ebp
push esi
push section..text
push ebp
push ebp
mov dword [esi + 0x68c], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebp
je 0x40290b
push eax
call ebx
jmp 0x40290b
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x10], ebp
je 0x402778
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov edx, dword [esp + 0x10]
push edx
call ebx
mov dword [esp + 0x10], ebp
jmp 0x402778
push 0xbb8
push ebp
push 3
call fcn.00403ab0
add esp, 0xc
push 0x3e8
push str..pipeDNTUS26
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
test eax, eax
je 0x40297d
push ebp
push 0x40000000
push 3
push ebp
push 3
push 0xc0000000
push str..pipeDNTUS26
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push ebp
mov esi, eax
call edi
cmp esi, 0xffffffff
je 0x40297d
push esi
call ebx
push ebp
call edi
mov edi, dword [0x411944]
mov eax, dword [0x411948]
cmp edi, eax
je 0x402a49
mov ebx, dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov esi, dword [edi]
cmp esi, ebp
je 0x402a3e
cmp dword [esi + 0x68c], ebp
je 0x402a31
mov eax, dword [esi + 0x684]
cmp eax, ebp
je 0x4029c6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x684], ebp
mov eax, dword [esi + 0x688]
cmp eax, ebp
je 0x4029eb
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [esi + 0x688]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x688], ebp
mov eax, dword [esi + 0x65c]
mov dword [esi + 0x68c], ebp
cmp eax, ebp
je 0x402a11
push eax
call ebx
mov ecx, dword [esi + 0x65c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x65c], ebp
mov eax, dword [esi + 0x660]
cmp eax, ebp
je 0x402a31
push eax
call ebx
mov edx, dword [esi + 0x660]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x660], ebp
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
mov eax, dword [0x411948]
add edi, 4
cmp edi, eax
jne 0x402999
mov ecx, dword [0x411944]
mov edx, eax
cmp eax, edx
je 0x402a68
mov esi, dword [eax]
add eax, 4
mov dword [ecx], esi
add ecx, 4
cmp eax, edx
jne 0x402a55
mov eax, dword [0x411948]
push 0xbb8
push ebp
push 3
mov dword [esp + 0x2c], eax
mov dword [0x411948], ecx
call fcn.00403ab0
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x80
ret