Function at 0x439140
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a6387
mov eax, dword fs:[0]
push eax
sub esp, 0x264
push esi
push edi
lea edi, [ebp - 0x270]
mov ecx, 0x99
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x614088]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, esp
mov eax, dword [ebp + 8]
push eax
push 0
push 0x40
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp esi, esp
call fcn.00406e97
push eax
lea ecx, [ebp - 0x18]
call fcn.00402b3f
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00404124
cmp eax, 0xffffffff
jne 0x43922e
lea ecx, [ebp + 8]
push ecx
lea edx, [ebp - 0x38]
push edx
call fcn.0040352b
add esp, 8
mov dword [ebp - 0x1f0], eax
mov eax, dword [ebp - 0x1f0]
mov dword [ebp - 0x1f4], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x1f4]
push ecx
push str.Unable_to_open_parent_process
lea edx, [ebp - 0x54]
push edx
call fcn.00407fc7
add esp, 0xc
mov dword [ebp - 0x1f8], eax
mov eax, dword [ebp - 0x1f8]
mov dword [ebp - 0x1fc], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x1fc]
push ecx
call fcn.00436370
add esp, 4
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x54]
call fcn.00406546
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x38]
call fcn.00406546
mov dword [ebp - 0x200], 0
push 1
call fcn.0040a32b
add esp, 4
movzx edx, al
test edx, edx
je 0x43924b
jmp 0x4392a0
push str.Condition_sizeof_HANDLE____sizeof_size_t__failed.
push 0x590
push 0x5bb268
push 3
lea ecx, [ebp - 0x1e8]
call fcn.004027e3
mov dword [ebp - 0x204], eax
mov eax, dword [ebp - 0x204]
mov dword [ebp - 0x208], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x208]
call fcn.0040600f
push eax
call fcn.00405afb
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1e8]
call fcn.004050e7
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x58], ecx
mov esi, esp
push 2
push 0
push 0
lea edx, [ebp - 0x60]
push edx
mov edi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp edi, esp
call fcn.00406e97
push eax
mov eax, dword [ebp - 0x58]
push eax
lea ecx, [ebp - 0x18]
call fcn.00404124
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
cmp esi, esp
call fcn.00406e97
test eax, eax
jne 0x43941f
lea ecx, [ebp + 8]
push ecx
lea edx, [ebp - 0xd4]
push edx
call fcn.0040352b
add esp, 8
mov dword [ebp - 0x20c], eax
mov eax, dword [ebp - 0x20c]
mov dword [ebp - 0x210], eax
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x210]
push ecx
push 0x5bb2b0
lea edx, [ebp + 0xc]
push edx
lea eax, [ebp - 0x80]
push eax
call fcn.0040352b
add esp, 8
mov dword [ebp - 0x214], eax
mov ecx, dword [ebp - 0x214]
mov dword [ebp - 0x218], ecx
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x218]
push edx
push str.Unable_to_duplicate_the_pipe_handle
lea eax, [ebp - 0x9c]
push eax
call fcn.00407fc7
add esp, 0xc
mov dword [ebp - 0x21c], eax
mov ecx, dword [ebp - 0x21c]
mov dword [ebp - 0x220], ecx
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x220]
push edx
lea eax, [ebp - 0xb8]
push eax
call fcn.004095cf
add esp, 0xc
mov dword [ebp - 0x224], eax
mov ecx, dword [ebp - 0x224]
mov dword [ebp - 0x228], ecx
mov byte [ebp - 4], 7
mov edx, dword [ebp - 0x228]
push edx
lea eax, [ebp - 0xf0]
push eax
call fcn.004030f3
add esp, 0xc
mov dword [ebp - 0x22c], eax
mov ecx, dword [ebp - 0x22c]
mov dword [ebp - 0x230], ecx
mov byte [ebp - 4], 8
mov edx, dword [ebp - 0x230]
push edx
call fcn.00436370
add esp, 4
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xf0]
call fcn.00406546
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xb8]
call fcn.00406546
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x9c]
call fcn.00406546
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x80]
call fcn.00406546
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xd4]
call fcn.00406546
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xf4], eax
mov esi, esp
push 2
push 0
push 0
lea ecx, [ebp - 0xfc]
push ecx
mov edi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp edi, esp
call fcn.00406e97
push eax
mov edx, dword [ebp - 0xf4]
push edx
lea ecx, [ebp - 0x18]
call fcn.00404124
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
cmp esi, esp
call fcn.00406e97
test eax, eax
jne 0x4395ad
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x170]
push ecx
call fcn.0040352b
add esp, 8
mov dword [ebp - 0x234], eax
mov edx, dword [ebp - 0x234]
mov dword [ebp - 0x238], edx
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x238]
push eax
push str._from_the_parent_process
lea ecx, [ebp + 0x10]
push ecx
lea edx, [ebp - 0x11c]
push edx
call fcn.0040352b
add esp, 8
mov dword [ebp - 0x23c], eax
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x240], eax
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x240]
push ecx
push str.Unable_to_duplicate_the_event_handle
lea edx, [ebp - 0x138]
push edx
call fcn.00407fc7
add esp, 0xc
mov dword [ebp - 0x244], eax
mov eax, dword [ebp - 0x244]
mov dword [ebp - 0x248], eax
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x248]
push ecx
lea edx, [ebp - 0x154]
push edx
call fcn.004095cf
add esp, 0xc
mov dword [ebp - 0x24c], eax
mov eax, dword [ebp - 0x24c]
mov dword [ebp - 0x250], eax
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x250]
push ecx
lea edx, [ebp - 0x18c]
push edx
call fcn.004030f3
add esp, 0xc
mov dword [ebp - 0x254], eax
mov eax, dword [ebp - 0x254]
mov dword [ebp - 0x258], eax
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x258]
push ecx
call fcn.00436370
add esp, 4
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x18c]
call fcn.00406546
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x154]
call fcn.00406546
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x138]
call fcn.00406546
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x11c]
call fcn.00406546
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x170]
call fcn.00406546
push 8
mov edx, dword [ebp - 0x60]
push edx
call fcn.00407766
add esp, 8
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 0xffffffff
jne 0x439695
push str._to_a_file_descriptor
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x1ac]
push ecx
call fcn.0040352b
add esp, 8
mov dword [ebp - 0x25c], eax
mov edx, dword [ebp - 0x25c]
mov dword [ebp - 0x260], edx
mov byte [ebp - 4], 0xe
mov eax, dword [ebp - 0x260]
push eax
push str.Unable_to_convert_pipe_handle
lea ecx, [ebp - 0x1c8]
push ecx
call fcn.00407fc7
add esp, 0xc
mov dword [ebp - 0x264], eax
mov edx, dword [ebp - 0x264]
mov dword [ebp - 0x268], edx
mov byte [ebp - 4], 0xf
mov eax, dword [ebp - 0x268]
push eax
lea ecx, [ebp - 0x1e4]
push ecx
call fcn.004095cf
add esp, 0xc
mov dword [ebp - 0x26c], eax
mov edx, dword [ebp - 0x26c]
mov dword [ebp - 0x270], edx
mov byte [ebp - 4], 0x10
mov eax, dword [ebp - 0x270]
push eax
call fcn.00436370
add esp, 4
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x1e4]
call fcn.00406546
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x1c8]
call fcn.00406546
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1ac]
call fcn.00406546
mov esi, esp
mov ecx, dword [ebp - 0xfc]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEvent]
cmp esi, esp
call fcn.00406e97
mov edx, dword [ebp - 0x190]
mov dword [ebp - 0x1ec], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0040a6d7
mov eax, dword [ebp - 0x1ec]
push edx
mov ecx, ebp
push eax
lea edx, [0x439708]
call fcn.0040728e
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00406361
add esp, 0x270
cmp ebp, esp
call fcn.00406e97
mov esp, ebp
pop ebp
ret