Function at 0x40c360
Capabilities:
Create pipe
Create process on windows

Disassembly:
mov eax, 0x3170
call fcn.0040dab0
push ebx
push ebp
mov ebp, dword [esp + 0x3194]
push ebp
mov word [esp + 0x90], 0x10
mov word [esp + 0xc0], 0x50
call sym.ptapdl.exe__sys_error_none_4
mov ecx, dword [esp + 0x317c]
push 0x2000
lea eax, [esp + 0x117c]
push eax
xor ebx, ebx
push ecx
mov dword [esp + 0x18], ebx
call sym.ptapdl.exe__string_t_c_12
call sub.KERNEL32.dll_GetCurrentProcess
lea edx, [esp + 0x110]
mov dword [esp + 0x10], eax
push edx
lea eax, [esp + 0xc0]
push eax
push 0x420958
mov byte [esp + 0x17], 5
call sym.ptapdl.exe__sys_envvar_get_12
lea ecx, [esp + 0x110]
push ecx
call sym.ptapdl.exe__sys_error_4
test al, al
jne 0x40c465
lea edx, [esp + 0x110]
push edx
lea eax, [esp + 0x90]
push eax
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0xc8]
push edx
mov dword [esp + 0x30], 1
call sym.ptapdl.exe__string_token_16
lea eax, [esp + 0x110]
push eax
call sym.ptapdl.exe__sys_error_4
test al, al
jne 0x40c465
lea ecx, [esp + 0x8c]
push ecx
call sym.ptapdl.exe__string_upcase_4
lea edx, [esp + 0x24]
push edx
push str.LOW_NORMAL_HIGH
lea eax, [esp + 0x94]
push eax
call sym.ptapdl.exe__string_tkpick80_12
mov eax, dword [esp + 0x24]
dec eax
je 0x40c460
dec eax
je 0x40c459
dec eax
jne 0x40c465
mov byte [esp + 0xb], 7
jmp 0x40c465
mov byte [esp + 0xb], 5
jmp 0x40c465
mov byte [esp + 0xb], 6
mov eax, dword [esp + 0x3180]
mov cl, byte [esp + 0xb]
push esi
mov esi, 1
and eax, 0xff
shl esi, cl
cmp eax, 3
mov dword [esp + 0x2c], 0x44
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], 0x50
mov dword [esp + 0x50], 0x14
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], ebx
mov word [esp + 0x5c], 1
mov word [esp + 0x5e], bx
mov dword [esp + 0x60], ebx
mov dword [esp + 0x64], ebx
mov dword [esp + 0x68], ebx
mov dword [esp + 0x6c], ebx
mov byte [esp + 0x1c], bl
ja case.default.0x40c4e2
jmp dword [eax*4 + 0x40c7c0]
or esi, 8
jmp 0x40c740
mov edx, dword [0x4209d4]
lea ecx, [esp + 0x14]
push ecx
push edx
call sub.KERNEL32.dll_GetStdHandle
push eax
call fcn.0040c7f0
lea ecx, [esp + 0x70]
push ecx
lea edx, [esp + 0x14]
push edx
push eax
mov dword [esp + 0x70], eax
call fcn.0040c7d0
mov ecx, dword [0x4209d8]
lea eax, [esp + 0x14]
push eax
push ecx
call sub.KERNEL32.dll_GetStdHandle
push eax
call fcn.0040c7f0
lea edx, [esp + 0x70]
push edx
lea ecx, [esp + 0x14]
push ecx
push eax
mov dword [esp + 0x74], eax
call fcn.0040c7d0
mov eax, dword [0x4209dc]
lea edx, [esp + 0x14]
push edx
push eax
call sub.KERNEL32.dll_GetStdHandle
push eax
call fcn.0040c7f0
lea ecx, [esp + 0x70]
push ecx
lea edx, [esp + 0x14]
push edx
push eax
mov dword [esp + 0x78], eax
call fcn.0040c7d0
or dword [esp + 0x58], 0x100
mov byte [esp + 0x1c], 1
jmp 0x40c740
mov eax, dword [0x4289d4]
mov ecx, dword [0x4289d0]
mov edx, dword [esp + 0x3188]
push eax
push ecx
push edx
lea eax, [esp + 0x24]
push eax
call sub.KERNEL32.dll_CreatePipe
test al, al
je 0x40c76e
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x14]
push ecx
push edx
call fcn.0040c7f0
cmp eax, ebx
mov dword [esp + 0x64], eax
je 0x40c76e
lea ecx, [esp + 0x70]
push ecx
lea edx, [esp + 0x14]
push edx
push eax
call fcn.0040c7d0
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x70]
push eax
lea ecx, [esp + 0x14]
push ecx
push edx
call fcn.0040c7d0
mov eax, dword [0x4289d4]
mov ecx, dword [0x4289d0]
push eax
mov eax, dword [esp + 0x3190]
push ecx
lea edx, [esp + 0x20]
push edx
push eax
call sub.KERNEL32.dll_CreatePipe
test al, al
je 0x40c76e
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x14]
push ecx
push edx
call fcn.0040c7f0
cmp eax, ebx
mov dword [esp + 0x68], eax
je 0x40c76e
lea ecx, [esp + 0x70]
push ecx
lea edx, [esp + 0x14]
push edx
push eax
call fcn.0040c7d0
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x70]
push eax
lea ecx, [esp + 0x14]
push ecx
push edx
call fcn.0040c7d0
mov eax, dword [0x4289d4]
mov ecx, dword [0x4289d0]
push eax
mov eax, dword [esp + 0x3194]
push ecx
lea edx, [esp + 0x20]
push edx
push eax
call sub.KERNEL32.dll_CreatePipe
test al, al
je 0x40c76e
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x14]
push ecx
push edx
call fcn.0040c7f0
cmp eax, ebx
mov dword [esp + 0x6c], eax
je 0x40c76e
lea ecx, [esp + 0x70]
push ecx
lea edx, [esp + 0x14]
push edx
push eax
call fcn.0040c7d0
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x70]
push eax
lea ecx, [esp + 0x14]
push ecx
push edx
call fcn.0040c7d0
jmp 0x40c6ff
mov ecx, dword [esp + 0x3188]
mov edx, dword [ecx]
lea eax, [esp + 0x14]
push eax
push edx
call fcn.0040c7f0
mov ecx, dword [esp + 0x318c]
mov edx, dword [ecx]
mov dword [esp + 0x64], eax
lea eax, [esp + 0x14]
push eax
push edx
call fcn.0040c7f0
mov ecx, dword [esp + 0x3190]
mov edx, dword [ecx]
mov dword [esp + 0x68], eax
lea eax, [esp + 0x14]
push eax
push edx
call fcn.0040c7f0
mov dword [esp + 0x6c], eax
or dword [esp + 0x58], 0x100
or esi, 8
mov byte [esp + 0x1c], 1
jmp 0x40c740
mov dword [esp + 0x20], eax
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0xb8]
push ecx
call sym.ptapdl.exe__sys_msg_parm_int_8
push 1
lea edx, [esp + 0xb8]
push edx
push str.proc_stdio_method_unknown
push 0x4209e0
call sym.ptapdl.exe__sys_message_bomb_16
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0xa4]
push eax
mov eax, dword [0x4289d0]
lea ecx, [esp + 0x30]
push ecx
push ebx
push ebx
push esi
push edx
push eax
push eax
lea eax, [esp + 0x119c]
push eax
push ebx
call sub.KERNEL32.dll_CreateProcessA
test al, al
jne 0x40c778
call sub.KERNEL32.dll_GetLastError
mov dword [ebp + 0xc], eax
jmp 0x40c795
mov eax, dword [esp + 0xa8]
mov ecx, dword [esp + 0x3194]
mov edx, dword [esp + 0xa4]
push eax
mov dword [ecx], edx
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [esp + 0x10]
cmp eax, ebx
pop esi
jle 0x40c7b5
mov ecx, dword [esp + eax*4 + 0x68]
push ecx
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [esp + 0xc]
dec eax
cmp eax, ebx
mov dword [esp + 0xc], eax
jg 0x40c79e
pop ebp
pop ebx
add esp, 0x3170
ret 0x1c