Function at 0x517680
Capabilities:
Check for protected handle exception
Create pipe
Create reverse shell
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x304
mov edi, dword [sym.imp.kernel32.dll_GetStdHandle]
mov dword [esp], 0xfffffff6
call edi
sub esp, 4
mov ebx, eax
mov dword [esp], 0xfffffff5
call edi
sub esp, 4
mov dword [ebp - 0x2e0], eax
mov dword [esp], 0xfffffff4
call edi
sub esp, 4
mov edi, eax
lea eax, [ebp - 0x2b8]
mov dword [esp], eax
call fcn.0057d960
mov esi, dword [sym.imp.kernel32.dll_GetTempPathA]
mov dword [esp + 4], 0x7ffb60
mov dword [esp], 0x104
call esi
sub esp, 8
mov dword [esp], 0x7ffb60
call sub.msvcrt.dll_strlen
mov ecx, 2
mov edx, 0x7ffb60
mov dword [eax + 0x7ffb60], 0x636f7270
mov dword [eax + 0x7ffb64], 0x5f737365
mov dword [eax + 0x7ffb68], 0x2e697567
mov dword [eax + 0x7ffb6c], 0x657865
mov eax, dword [ebp - 0x2b8]
mov eax, dword [eax]
call fcn.005146a0
mov dword [esp + 4], 0x7ffa40
mov dword [esp], 0x104
mov dword [ebp - 0x2d8], esi
call esi
lea esi, [ebp - 0x254]
sub esp, 8
mov dword [esp], 0x7ffa40
call sub.msvcrt.dll_strlen
mov ecx, 3
mov edx, 0x7ffa40
mov dword [eax + 0x7ffa40], 0x636f7270
mov dword [eax + 0x7ffa44], 0x5f737365
mov dword [eax + 0x7ffa48], 0x2e697563
mov dword [eax + 0x7ffa4c], 0x657865
mov eax, dword [ebp - 0x2b8]
mov eax, dword [eax]
call fcn.005146a0
mov byte [0x80fc80], 0
mov dword [esp + 4], esi
mov dword [esp], 0x104
mov eax, dword [ebp - 0x2d8]
call eax
mov eax, dword [sym.imp.kernel32.dll_GetTempFileNameA]
sub esp, 8
mov dword [esp + 0xc], 0x80fc80
mov dword [esp + 8], 0
mov dword [esp + 4], 0x5eee65
mov dword [esp], esi
mov dword [ebp - 0x2dc], eax
call eax
mov dword [ebp - 0x2e4], ebx
mov dword [ebp - 0x2cc], 0x5f3620
sub esp, 0x10
mov dword [ebp - 0x2e8], edi
mov ebx, dword [ebp - 0x2cc]
mov eax, dword [ebx + 8]
mov ebx, dword [ebx + 0xc]
mov dword [ebp - 0x2d0], ebx
test ebx, ebx
je 0x517cb9
mov dword [ebp - 0x2bc], 0
mov ebx, dword [ebp - 0x2cc]
mov ebx, dword [ebx + 0x10]
mov dword [ebp - 0x2d4], ebx
mov ebx, eax
lea esi, [esi]
mov eax, dword [ebp - 0x2bc]
lea edi, [ebp - 0x294]
mov dword [ebp - 0x2b0], 0
mov dword [ebp - 0x2ac], 0
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2d4]
mov dword [esp], str._s__u_
mov dword [esp + 4], eax
call fcn.0050dbd0
mov edx, dword [ebx]
xor eax, eax
mov dword [ebp - 0x254], 0xc
mov dword [ebp - 0x250], 0
mov ecx, eax
mov dword [ebp - 0x24c], 1
test edx, 0x20000000
mov dword [ebp - 0x298], 0x44
cmovne ecx, esi
mov dword [ebp - 0x2c0], ecx
mov ecx, 0x10
rep stosd dword es:[edi], eax
mov edi, edx
and edi, 0xffffff
cmp edi, 6
ja case.default.0x5178c7
jmp dword [edi*4 + 0x5f1028]
mov dword [ebp - 0x2ac], 0xffffffff
mov eax, 0xffffffff
mov dword [ebp - 0x2b0], 0xffffffff
mov dword [ebp - 0x2c8], 0
lea esi, [esi]
nop
test edx, edx
js 0x517d90
mov dword [ebp - 0x260], eax
mov eax, dword [ebp - 0x2ac]
or dword [ebp - 0x26c], 0x100
mov dword [ebp - 0x25c], eax
mov eax, dword [ebp - 0x2cc]
mov edi, dword [ebx]
mov edx, 0x7ffb60
mov byte [0x84fdc0], 0
mov ecx, dword [eax]
shr edi, 0x1e
and edi, 1
mov dword [ebp - 0x2c4], ecx
mov ecx, dword [eax + 4]
mov eax, 0x7ffa40
test ecx, ecx
cmovne edx, eax
mov dword [ebp - 0x2c0], edx
mov dword [esp + 4], esi
mov dword [esp], 0x104
mov eax, dword [ebp - 0x2d8]
call eax
sub esp, 8
mov dword [esp + 0xc], 0x84fdc0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x5eee65
mov dword [esp], esi
mov eax, dword [ebp - 0x2dc]
call eax
sub esp, 0x10
mov dword [esp + 0xc], 0x84fdc0
mov edx, dword [ebp - 0x2c0]
mov dword [esp + 4], str.__s__process_dump___s_
mov dword [esp + 8], edx
mov dword [esp], esi
call fcn.0050d7a0
lea eax, [ebp - 0x2a8]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x298]
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], 0
mov ecx, dword [ebp - 0x2c4]
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateProcessA]
sub esp, 0x28
mov edi, eax
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov edx, dword fs:[0x18]
mov dword [eax + 4], 0xce6
mov dword [esp + 0xc], esi
mov eax, dword [edx + 0x34]
mov dword [ebp - 0x2c0], edx
mov dword [esp + 8], eax
mov dword [esp], edi
mov dword [esp + 4], str.CreateProcess_failed:__lu__s_n
call fcn.0050e8b0
mov eax, dword [ebp - 0x2a4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
mov dword [esp + 4], 0x7530
mov eax, dword [ebp - 0x2a8]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
sub esp, 8
mov edi, eax
call fcn.0057d110
mov edx, dword [ebp - 0x2c0]
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0xce9
mov eax, dword [edx + 0x34]
mov dword [esp + 8], edi
mov dword [esp + 0xc], eax
xor eax, eax
test edi, edi
sete al
mov dword [esp + 4], str.Could_not_wait_for_the_child_process:__ld_le_lu_n
mov dword [esp], eax
call fcn.0050e8b0
lea eax, [ebp - 0x2b4]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x2a8]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetExitCodeProcess]
sub esp, 8
mov edi, eax
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0xcec
xor eax, eax
test edi, edi
je 0x517aec
mov edx, dword [ebp - 0x2b4]
xor eax, eax
test edx, edx
sete al
mov dword [esp], eax
mov dword [esp + 4], str.Couldnt_get_exit_code_n
call fcn.0050e8b0
mov eax, dword [ebp - 0x2a8]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0xdce
mov dword [esp], edi
mov dword [esp + 4], str.Couldnt_run_child_n
call fcn.0050e8b0
mov dword [esp + 0xc], 0x84fdc0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_WritePrivateProfileStringA]
mov edi, dword [ebx + 4]
sub esp, 0x10
test edi, 0x80
je 0x5181e8
mov edi, dword [ebx]
mov edx, dword [ebx + 8]
mov eax, 0xffffffff
test edi, edi
js 0x517b7b
mov eax, dword [ebp - 0x2b0]
mov dword [esp + 4], edx
mov ecx, str.hStdInput
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0xdda
call fcn.00510560
mov ecx, dword [ebx]
mov edx, dword [ebx + 8]
mov eax, 0xffffffff
test ecx, ecx
js 0x517baa
mov eax, dword [ebp - 0x2ac]
mov dword [esp + 4], edx
mov ecx, str.hStdOutput
mov edx, str.StartupInfoA
mov dword [esp], eax
mov eax, 0xddb
call fcn.00510560
mov edi, dword [ebx]
test edi, edi
js 0x517c13
mov eax, dword [ebx + 8]
mov ecx, str.hStdInput
mov edx, str.StartupInfoW
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x2b0]
mov dword [esp], eax
mov eax, 0xdde
call fcn.00510560
mov eax, dword [ebx + 8]
mov ecx, str.hStdOutput
mov edx, str.StartupInfoW
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x2ac]
mov dword [esp], eax
mov eax, 0xddf
call fcn.00510560
mov eax, dword [ebx + 8]
mov ecx, str.hStdInput
mov edx, 0x5f1000
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x2b0]
mov dword [esp], eax
mov eax, 0xde2
call fcn.00510560
mov eax, dword [ebx + 8]
mov ecx, str.hStdOutput
mov edx, 0x5f1000
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x2ac]
mov dword [esp], eax
mov eax, 0xde3
call fcn.00510560
mov dword [0x57f4a4], 0x80fda0
mov dword [esp], 0x84fdc0
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov eax, dword [ebp - 0x2c8]
sub esp, 4
test eax, eax
jne 0x5182c8
call fcn.0057d110
mov edx, dword [eax + 0xbec]
test edx, edx
je 0x517c9b
sub edx, 1
mov dword [eax + 0xbec], edx
add dword [ebp - 0x2bc], 1
mov ecx, dword [ebp - 0x2d0]
add ebx, 0xc
mov eax, dword [ebp - 0x2bc]
cmp eax, ecx
jne 0x517838
add dword [ebp - 0x2cc], 0x14
mov eax, dword [ebp - 0x2cc]
mov ebx, str.0123456789abcdefDeviceHarddiskVolume
cmp ebx, eax
jne 0x5177fc
mov ebx, dword [ebp - 0x2e4]
mov edi, dword [ebp - 0x2e8]
mov dword [esp], 0x7ffb60
call dword [sym.imp.kernel32.dll_DeleteFileA]
sub esp, 4
mov dword [esp], 0x7ffa40
call dword [sym.imp.kernel32.dll_DeleteFileA]
sub esp, 4
mov dword [esp], 0x80fc80
call dword [sym.imp.kernel32.dll_DeleteFileA]
sub esp, 4
mov dword [esp + 4], ebx
mov dword [esp], 0xfffffff6
call dword [sym.imp.kernel32.dll_SetStdHandle]
mov eax, dword [ebp - 0x2e0]
sub esp, 8
mov dword [esp + 4], eax
mov dword [esp], 0xfffffff5
call dword [sym.imp.kernel32.dll_SetStdHandle]
sub esp, 8
mov dword [esp + 4], edi
mov dword [esp], 0xfffffff4
call dword [sym.imp.kernel32.dll_SetStdHandle]
sub esp, 8
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ebp - 0x2ac], 0
xor eax, eax
mov dword [ebp - 0x2b0], 0
mov dword [ebp - 0x2c8], 0
test edx, edx
jns 0x517900
lea esi, [esi]
nop
mov dword [esp + 4], eax
mov dword [esp], 0xfffffff6
call dword [sym.imp.kernel32.dll_SetStdHandle]
mov eax, dword [ebp - 0x2ac]
sub esp, 8
mov dword [esp + 4], eax
mov dword [esp], 0xfffffff5
call dword [sym.imp.kernel32.dll_SetStdHandle]
sub esp, 8
jmp 0x51791c
mov dword [ebp - 0x2c4], edx
mov edi, dword [sym.imp.kernel32.dll_CreateFileA]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov eax, dword [ebp - 0x2c0]
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x80000000
mov dword [esp], str.CONIN_
call edi
sub esp, 0x1c
mov dword [ebp - 0x2b0], eax
mov eax, 0xd02
call fcn.0050dc60
mov dword [esp + 4], str.Couldnt_create_input_to_console_n
xor eax, eax
cmp dword [ebp - 0x2b0], 0xffffffff
setne al
mov dword [esp], eax
call fcn.0050e8b0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov eax, dword [ebp - 0x2c0]
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0xc0000000
mov dword [esp], str.CONOUT_
call edi
mov dword [ebp - 0x2ac], eax
sub esp, 0x1c
mov eax, 0xd04
call fcn.0050dc60
mov dword [esp + 4], str.Couldnt_create_input_to_console_n
xor eax, eax
cmp dword [ebp - 0x2ac], 0xffffffff
setne al
mov dword [esp], eax
call fcn.0050e8b0
mov edx, dword [ebp - 0x2c4]
test edx, 0x10000000
je 0x51816a
mov dword [ebp - 0x2c0], edx
mov dword [esp + 8], 2
mov dword [esp + 4], 2
mov eax, dword [ebp - 0x2b0]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_SetHandleInformation]
sub esp, 0xc
mov edi, eax
mov eax, 0xd2b
call fcn.0050dc60
mov dword [esp], edi
mov dword [esp + 4], str.Couldnt_set_inherit_flag_to_hstd_0__n
call fcn.0050e8b0
mov dword [esp + 8], 2
mov dword [esp + 4], 2
mov eax, dword [ebp - 0x2ac]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_SetHandleInformation]
sub esp, 0xc
mov edi, eax
mov eax, 0xd2d
call fcn.0050dc60
mov dword [esp + 4], str.Couldnt_set_inherit_flag_to_hstd_1__n
mov dword [esp], edi
call fcn.0050e8b0
mov eax, dword [ebp - 0x2b0]
mov dword [ebp - 0x2c8], 1
mov edx, dword [ebp - 0x2c0]
jmp 0x5178f8
mov dword [ebp - 0x2b0], 0x66600
mov eax, 0x66600
mov dword [ebp - 0x2ac], 0x66610
mov dword [ebp - 0x2c8], 0
jmp 0x5178f8
mov dword [ebp - 0x2c4], edx
mov edi, dword [sym.imp.kernel32.dll_CreateFileA]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov eax, dword [ebp - 0x2c0]
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x80000000
mov dword [esp], 0x5f0eba
call edi
sub esp, 0x1c
mov dword [ebp - 0x2b0], eax
mov eax, 0xd10
call fcn.0050dc60
mov dword [esp + 4], str.Couldnt_create_input_to_NUL_n
xor eax, eax
cmp dword [ebp - 0x2b0], 0xffffffff
setne al
mov dword [esp], eax
call fcn.0050e8b0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov eax, dword [ebp - 0x2c0]
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0xc0000000
mov dword [esp], 0x5f0eba
call edi
mov dword [ebp - 0x2ac], eax
sub esp, 0x1c
mov eax, 0xd12
call fcn.0050dc60
mov dword [esp + 4], str.Couldnt_create_input_to_NUL_n
jmp 0x517e94
mov dword [ebp - 0x2c4], edx
mov edi, dword [sym.imp.kernel32.dll_CreateFileA]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov eax, dword [ebp - 0x2c0]
mov dword [esp + 8], 3
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x80000000
mov dword [esp], 0x80fc80
call edi
sub esp, 0x1c
mov dword [ebp - 0x2b0], eax
mov eax, 0xd09
call fcn.0050dc60
mov dword [esp + 8], 0x80fc80
xor eax, eax
mov dword [esp + 4], str.Couldnt_create_input_to_file__s_n
cmp dword [ebp - 0x2b0], 0xffffffff
setne al
mov dword [esp], eax
call fcn.0050e8b0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov eax, dword [ebp - 0x2c0]
mov dword [esp + 8], 3
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0xc0000000
mov dword [esp], 0x80fc80
call edi
sub esp, 0x1c
mov dword [ebp - 0x2ac], eax
mov eax, 0xd0b
call fcn.0050dc60
mov dword [esp + 8], 0x80fc80
xor eax, eax
mov dword [esp + 4], str.Couldnt_create_input_to_file__s_n
cmp dword [ebp - 0x2ac], 0xffffffff
setne al
mov dword [esp], eax
call fcn.0050e8b0
mov edx, dword [ebp - 0x2c4]
test edx, 0x10000000
jne 0x517eba
mov dword [ebp - 0x2c8], 1
mov eax, dword [ebp - 0x2b0]
jmp 0x5178f8
mov dword [ebp - 0x2c4], edx
lea ecx, [ebp - 0x2ac]
mov dword [esp + 0xc], 0
mov eax, dword [ebp - 0x2c0]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
lea eax, [ebp - 0x2b0]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CreatePipe]
sub esp, 0x10
mov edi, eax
mov eax, 0xd17
call fcn.0050dc60
mov dword [esp + 4], str.Couldnt_create_anon_pipe_n
mov dword [esp], edi
call fcn.0050e8b0
mov edx, dword [ebp - 0x2c4]
test edx, 0x10000000
jne 0x517eba
jmp 0x51816a
mov edx, dword [ebx]
mov eax, 4
mov ecx, str.hStdInputEncode
test edx, edx
mov edx, str.StartupInfoA
cmovs edi, eax
mov eax, dword [ebx + 8]
mov dword [esp], edi
mov dword [esp + 4], eax
mov eax, 0xde9
call fcn.00510560
mov eax, dword [ebx + 8]
mov dword [esp], edi
mov ecx, str.hStdOutputEncode
mov edx, str.StartupInfoA
mov edi, 0x10
mov dword [esp + 4], eax
mov eax, 0xdea
call fcn.00510560
mov ecx, dword [ebx]
test ecx, ecx
js 0x51823e
mov edi, dword [ebx + 4]
mov eax, dword [ebx + 8]
mov dword [esp], edi
mov ecx, str.hStdInputEncode
mov edx, str.StartupInfoW
mov dword [esp + 4], eax
mov eax, 0xdee
call fcn.00510560
mov eax, dword [ebx + 8]
mov dword [esp], edi
mov ecx, str.hStdOutputEncode
mov edx, str.StartupInfoW
mov dword [esp + 4], eax
mov eax, 0xdef
call fcn.00510560
mov eax, dword [ebx + 8]
mov ecx, str.hStdInputEncode
mov edx, 0x5f1000
mov dword [esp + 4], eax
mov eax, dword [ebx + 4]
mov dword [esp], eax
mov eax, 0xdf1
call fcn.00510560
mov eax, dword [ebx + 8]
mov ecx, str.hStdOutputEncode
mov edx, 0x5f1000
mov dword [esp + 4], eax
mov eax, dword [ebx + 4]
mov dword [esp], eax
mov eax, 0xdf2
call fcn.00510560
jmp 0x517c5b
mov dword [esp + 8], 0
mov edi, dword [sym.imp.kernel32.dll_SetHandleInformation]
mov dword [esp + 4], 2
mov eax, dword [ebp - 0x2b0]
mov dword [esp], eax
call edi
mov eax, dword [ebp - 0x2b0]
sub esp, 0xc
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
mov dword [esp + 8], 0
mov dword [esp + 4], 2
mov eax, dword [ebp - 0x2ac]
mov dword [esp], eax
call edi
mov eax, dword [ebp - 0x2ac]
sub esp, 0xc
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
jmp 0x517c83
mov eax, 0xd25
call fcn.0050dc60
mov dword [esp + 8], edi
mov dword [esp + 4], str.Unsupported_handle_type__x_n
mov dword [esp], 0
call fcn.0050e8b0
mov dword [ebp - 0x2c8], 0
jmp 0x51791c