Function at 0x50fd90
Capabilities:
Connect pipe
Contain obfuscated stackstrings
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1fc
mov eax, dword [0x5c0290]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x30]
push ebx
mov ebx, ecx
mov dword [ebp - 0x1fc], eax
push esi
or ecx, 0xffffffff
mov dword [ebp - 0x1d8], ebx
push edi
cmp byte [ebx + 0x24], 0
je 0x50fdc7
xor bl, bl
jmp 0x51093f
cmp byte [ebx + 0x25], 0
jne 0x50fdeb
push dword [ebx + 0x28]
mov byte [ebx + 0x24], 0
call dword [sym.imp.KERNEL32.dll_SetEvent]
cmp dword [ebx + 4], 0
je 0x50fde7
mov ecx, ebx
call fcn.00539810
mov byte [ebx + 0x25], 1
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
xor ecx, ecx
mov dword [ebx + 0x34], ecx
mov dword [ebx + 0x38], ecx
mov dword [ebx + 0x3c], ecx
mov dword [ebx + 0x40], ecx
mov dword [ebx + 0x44], ecx
push ecx
mov dword [ebx + 0x48], ecx
push 1
mov dword [ebx + 0x4c], ecx
mov dword [ebx + 0x50], ecx
push 1
mov dword [ebx + 0x54], ecx
push ecx
mov dword [ebx + 0x58], ecx
call esi
push 0
push 0
push 0
push 0
mov dword [ebp - 0x1f4], eax
mov dword [ebx + 0x44], eax
mov dword [ebx + 0x58], 0
call esi
mov dword [ebx + 0x28], eax
mov dword [ebp - 0x1e4], 0
mov dword [ebp - 0x1d4], 0x366c5147
mov dword [ebp - 0x1d0], 0x6f307a44
mov dword [ebp - 0x1cc], 0x51596a4f
mov dword [ebp - 0x1c8], 0x4949544f
mov dword [ebp - 0x1c4], 0x4f776e43
mov dword [ebp - 0x1c0], 0x3970514e
mov dword [ebp - 0x1bc], 0x6c77774a
mov dword [ebp - 0x1b8], 0x6a396a50
mov dword [ebp - 0x1b4], 0x726b674d
mov dword [ebp - 0x1b0], 0x49636a4a
mov dword [ebp - 0x1ac], 0x68707745
mov dword [ebp - 0x1a8], 0x37736849
mov dword [ebp - 0x1a4], 0x304e774b
mov dword [ebp - 0x1a0], 0x3046534f
mov dword [ebp - 0x19c], 0x44414146
mov dword [ebp - 0x198], 0x44515144
mov dword [ebp - 0x194], 0x6963684b
mov dword [ebp - 0x190], 0x4463514d
mov dword [ebp - 0x18c], 0x6856424f
mov dword [ebp - 0x188], 0x45497863
mov dword [ebp - 0x184], 0x38416964
mov dword [ebp - 0x180], 0x626f694f
mov dword [ebp - 0x17c], 0x4f385442
mov dword [ebp - 0x178], 0x46415250
mov dword [ebp - 0x174], 0x776f5850
mov dword [ebp - 0x170], 0x4a67424c
mov dword [ebp - 0x16c], 0x34567a4c
mov dword [ebp - 0x168], 0x796b7846
mov dword [ebp - 0x164], 0x67526850
mov dword [ebp - 0x160], 0x79305443
mov dword [ebp - 0x15c], 0x58515444
mov dword [ebp - 0x158], 0x4677544d
mov dword [ebp - 0x154], 0x596f5242
mov dword [ebp - 0x150], 0x4b30694f
mov dword [ebp - 0x14c], 0x62557849
mov dword [ebp - 0x148], 0x6e63774b
mov dword [ebp - 0x144], 0x6e59794d
mov dword [ebp - 0x140], 0x75517946
mov dword [ebp - 0x13c], 0x36777747
mov dword [ebp - 0x138], 0x79514249
mov dword [ebp - 0x134], 0x6d6c784b
mov dword [ebp - 0x130], 0x31526e46
mov dword [ebp - 0x12c], 0x43736a44
mov dword [ebp - 0x128], 0x79636e4f
mov dword [ebp - 0x124], 0x576b5845
mov dword [ebp - 0x120], 0x7a555348
mov dword [ebp - 0x11c], 0x68307842
mov dword [ebp - 0x118], 0x75516d62
mov dword [ebp - 0x114], 0x2f35524f
mov dword [ebp - 0x110], 0x4b415341
mov dword [ebp - 0x10c], 0x53455766
mov dword [ebp - 0x108], 0x6b41514e
mov dword [ebp - 0x104], 0x354a6d42
mov dword [ebp - 0x100], 0x30424247
sub esp, 0xc
mov dword [ebp - 0xfc], 0x356c5842
mov ecx, esp
mov dword [ebp - 0xf8], 0x334a6a47
lea eax, [ebp - 0x11]
mov dword [ebp - 0xf4], 0x4c6b4349
mov dword [ebp - 0xf0], 0x2f516843
push dword [ebp - 0x1f4]
mov dword [ebp - 0xec], 0x68385342
push eax
lea eax, [ebp - 0x1d4]
mov dword [ebp - 0xe8], 0x7735544d
mov dword [ebp - 0xe4], 0x7a6f514b
mov dword [ebp - 0xe0], 0x5441474f
mov dword [ebp - 0xdc], 0x46553243
mov dword [ebp - 0xd8], 0x6e51684b
mov dword [ebp - 0xd4], 0x6a734447
mov dword [ebp - 0xd0], 0x5463514b
mov dword [ebp - 0xcc], 0x4e38794e
mov dword [ebp - 0xc8], 0x67397a43
mov dword [ebp - 0xc4], 0x546f7965
mov dword [ebp - 0xc0], 0x78647a4e
mov dword [ebp - 0xbc], 0x7a457945
mov dword [ebp - 0xb8], 0x6a736a5a
mov dword [ebp - 0xb4], 0x434d5142
mov dword [ebp - 0xb0], 0x774d6e42
mov dword [ebp - 0xac], 0x7a307a4b
mov dword [ebp - 0xa8], 0x56496a47
mov dword [ebp - 0xa4], 0x38464163
mov dword [ebp - 0xa0], 0x6d524347
mov dword [ebp - 0x9c], 0x6241474c
mov dword [ebp - 0x98], 0x3235794b
mov dword [ebp - 0x94], 0x6c595246
mov dword [ebp - 0x90], 0x326b4245
mov dword [ebp - 0x8c], 0x49516a44
mov dword [ebp - 0x88], 0x3256675a
mov dword [ebp - 0x84], 0x34777764
mov dword [ebp - 0x80], 0x536b6a64
mov dword [ebp - 0x7c], 0x714d4247
mov dword [ebp - 0x78], 0x4d385745
mov dword [ebp - 0x74], 0x71306850
mov dword [ebp - 0x70], 0x36743346
mov dword [ebp - 0x6c], 0x51637741
mov dword [ebp - 0x68], 0x7874514d
mov dword [ebp - 0x64], 0x63775446
mov dword [ebp - 0x60], 0x774e4146
mov dword [ebp - 0x5c], 0x2f594141
mov dword [ebp - 0x58], 0x31395843
mov dword [ebp - 0x54], 0x2f4e774e
mov dword [ebp - 0x50], 0x67674462
mov dword [ebp - 0x4c], 0x714e684f
mov dword [ebp - 0x48], 0x4b38434c
mov dword [ebp - 0x44], 0x7749674d
mov dword [ebp - 0x40], 0x65734441
mov dword [ebp - 0x3c], 0x3951424d
mov dword [ebp - 0x38], 0x504d3350
mov dword [ebp - 0x34], 0x54347850
mov dword [ebp - 0x30], 0x68344145
mov dword [ebp - 0x2c], 0x36685345
mov dword [ebp - 0x28], 0x55414141
mov dword [ebp - 0x24], 0x3073514d
mov dword [ebp - 0x20], 0x4b634444
mov dword [ebp - 0x1c], 0x2b596a4a
mov dword [ebp - 0x18], 0x41414144
mov word [ebp - 0x14], 0x5541
mov byte [ebp - 0x12], 0x51
push eax
push 0
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
call fcn.004660a0
lea eax, [ebp - 0x10]
push eax
call fcn.00480790
add esp, 0x10
mov ecx, dword [eax]
mov eax, dword [eax + 4]
sub eax, ecx
sar eax, 1
je 0x510986
push ecx
lea ecx, [ebp - 0x1e4]
call fcn.004672d0
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x5102c1
push eax
call fcn.0053c1e0
add esp, 4
mov eax, dword [ebp + 8]
test eax, eax
jne 0x5102cc
xor edx, edx
jmp 0x5102e0
mov edx, eax
lea esi, [edx + 2]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x5102d1
sub edx, esi
sar edx, 1
push edx
push eax
lea ecx, [ebp - 0x1e4]
call fcn.004be590
sub esp, 0xc
mov dword [ebp - 0x10c], 0x366c5147
mov ecx, esp
mov dword [ebp - 0x108], 0x6f307a44
lea eax, [ebp - 0x12]
mov dword [ebp - 0x104], 0x51596a4f
mov dword [ebp - 0x100], 0x714d7a50
push dword [ebp - 0x1f4]
mov dword [ebp - 0xfc], 0x6e677941
push eax
lea eax, [ebp - 0x10c]
mov dword [ebp - 0xf8], 0x385a794a
mov dword [ebp - 0xf4], 0x37464265
mov dword [ebp - 0xf0], 0x5473334e
mov dword [ebp - 0xec], 0x71344363
mov dword [ebp - 0xe8], 0x4c34434f
mov dword [ebp - 0xe4], 0x6a456949
mov dword [ebp - 0xe0], 0x3067434e
mov dword [ebp - 0xdc], 0x706f4143
mov dword [ebp - 0xd8], 0x4a344841
mov dword [ebp - 0xd4], 0x77384865
mov dword [ebp - 0xd0], 0x33395343
mov dword [ebp - 0xcc], 0x376c7747
mov dword [ebp - 0xc8], 0x764d7745
mov dword [ebp - 0xc4], 0x38306750
mov dword [ebp - 0xc0], 0x6f4d5363
mov dword [ebp - 0xbc], 0x2f453249
mov dword [ebp - 0xb8], 0x416f4149
mov dword [ebp - 0xb4], 0x32633244
mov dword [ebp - 0xb0], 0x5a4d4447
mov dword [ebp - 0xac], 0x66774348
mov dword [ebp - 0xa8], 0x614d6a4e
mov dword [ebp - 0xa4], 0x374a5445
mov dword [ebp - 0xa0], 0x4355784c
mov dword [ebp - 0x9c], 0x2f684149
mov dword [ebp - 0x98], 0x54775845
mov dword [ebp - 0x94], 0x6a5a7a63
mov dword [ebp - 0x90], 0x58775349
mov dword [ebp - 0x8c], 0x46497849
mov dword [ebp - 0x88], 0x77464347
mov dword [ebp - 0x84], 0x61306943
mov dword [ebp - 0x80], 0x33565343
mov dword [ebp - 0x7c], 0x6d775265
mov dword [ebp - 0x78], 0x43415443
mov dword [ebp - 0x74], 0x42733246
mov dword [ebp - 0x70], 0x59306a4d
mov dword [ebp - 0x6c], 0x57495448
mov dword [ebp - 0x68], 0x44456749
mov dword [ebp - 0x64], 0x4b595347
mov dword [ebp - 0x60], 0x444d7a45
mov dword [ebp - 0x5c], 0x68776749
mov dword [ebp - 0x58], 0x3934414e
mov dword [ebp - 0x54], 0x6d304162
mov dword [ebp - 0x50], 0x686f7862
mov dword [ebp - 0x4c], 0x72685445
mov dword [ebp - 0x48], 0x4a77514a
mov dword [ebp - 0x44], 0x6864434b
mov dword [ebp - 0x40], 0x516b6941
mov dword [ebp - 0x3c], 0x5a594149
mov dword [ebp - 0x38], 0x63457948
mov dword [ebp - 0x34], 0x3634514f
mov dword [ebp - 0x30], 0x39514344
mov dword [ebp - 0x2c], 0x39385146
mov dword [ebp - 0x28], 0x62634244
mov dword [ebp - 0x24], 0x7a6b5342
mov dword [ebp - 0x20], 0x78734442
mov dword [ebp - 0x1c], 0x77385141
mov dword [ebp - 0x18], 0x41414141
mov word [ebp - 0x14], 0x5172
push eax
push 0
mov dword [ebp - 0x1e8], 0
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
call fcn.004660a0
lea eax, [ebp - 0x10]
push eax
call fcn.00480790
add esp, 0x10
mov ecx, dword [eax]
mov eax, dword [eax + 4]
sub eax, ecx
sar eax, 1
je 0x510990
push ecx
lea ecx, [ebp - 0x1e8]
call fcn.004672d0
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x510580
push eax
call fcn.0053c1e0
add esp, 4
mov eax, dword [ebp + 8]
test eax, eax
jne 0x51058b
xor edx, edx
jmp 0x51059f
mov edx, eax
lea esi, [edx + 2]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x510590
sub edx, esi
sar edx, 1
push edx
push eax
lea ecx, [ebp - 0x1e8]
call fcn.004be590
cmp dword [ebp + 0x24], 0
je 0x5106ed
push 0x14
call fcn.0053c5e4
add esp, 4
mov dword [ebp - 0xc], eax
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push 0
push 1
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov edi, dword [ebp - 0x1e4]
lea eax, [ebp - 0x10]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
push eax
push 0xffffffffffffffff
push 0x2000
push 0x2000
push 0xff
push 6
push 0x40000001
push edi
mov dword [ebp - 0x10], 0xc
mov dword [ebp - 8], 1
call ebx
mov ecx, dword [ebp - 0x1d8]
mov esi, dword [ebp - 0x1e8]
mov dword [ecx + 0x2c], eax
lea eax, [ebp - 0x10]
push eax
push 0xffffffffffffffff
push 0x2000
push 0x2000
push 0xff
push 6
push 0x40000002
push esi
call ebx
mov ebx, dword [ebp - 0x1d8]
mov dword [ebx + 0x30], eax
lea eax, [ebx + 0x34]
push eax
push dword [ebx + 0x2c]
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
je 0x510667
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x510888
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1dc], eax
cmp eax, 0x217
je 0x51069c
cmp eax, 0x3e5
jne 0x510888
push dword [ebp + 0x28]
push dword [ebx + 0x44]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x510882
lea eax, [ebx + 0x48]
push eax
push dword [ebx + 0x2c]
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
je 0x5106b9
call eax
jmp 0x510888
call eax
cmp eax, 0x217
je 0x510825
cmp eax, 0x3e5
jne 0x510888
push dword [ebp + 0x28]
push dword [ebx + 0x58]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x510825
jmp 0x510888
mov edi, dword [ebp - 0x1e4]
mov eax, 0x10624dd3
imul dword [ebp + 0x28]
mov esi, dword [ebp - 0x1e8]
mov cl, 0
sar edx, 5
mov eax, edx
mov dword [ebp - 0x1e0], 0
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0x1f0], ecx
mov dword [ebp - 0x1dc], eax
mov al, cl
mov dword [ebp - 0x1ec], eax
je 0x51065c
mov eax, dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
mov ebx, dword [ebp - 0x1ec]
lea esp, [esp]
test cl, cl
je 0x51074a
test bl, bl
jne 0x5107b4
jmp 0x510774
push 0x3e8
push edi
call eax
mov ecx, dword [ebp - 0x1f0]
test eax, eax
movzx ecx, cl
mov eax, 1
cmovne ecx, eax
mov dword [ebp - 0x1f0], ecx
test bl, bl
jne 0x510789
mov eax, dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
push 0x3e8
push esi
call eax
test eax, eax
movzx ebx, bl
mov eax, 1
cmovne ebx, eax
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x1e0]
mov ecx, dword [ebp - 0x1f0]
inc eax
cmp eax, dword [ebp - 0x1dc]
mov dword [ebp - 0x1e0], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
jb 0x510740
mov dword [ebp - 0x1ec], ebx
mov ebx, dword [ebp - 0x1d8]
test cl, cl
je 0x51065c
mov eax, dword [ebp - 0x1ec]
test al, al
je 0x51065c
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
push 0x60000000
push 3
push 0
push 0
push 0x40000000
push edi
call ebx
mov ecx, dword [ebp - 0x1d8]
push 0
push 0x60000000
push 3
push 0
push 0
push SysReAllocString
push esi
mov dword [ecx + 0x30], eax
call ebx
mov ebx, dword [ebp - 0x1d8]
mov dword [ebx + 0x2c], eax
cmp eax, 0xffffffff
jne 0x510825
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x510888
lea eax, [ebp + 0xc]
mov word [ebx + 0x24], 1
push eax
lea ecx, [ebx + 8]
call fcn.004b7d70
mov eax, dword [ebp + 0x2c]
lea ecx, [ebp - 0x1f8]
mov dword [ebx + 0x20], eax
lea eax, [ebp - 0x1dc]
push eax
lea eax, [ebp - 0x1e0]
mov dword [ebp - 0x1dc], ebx
push eax
mov dword [ebp - 0x1e0], 0x4eb470
call fcn.004ac8d0
push eax
mov ecx, ebx
call fcn.004b8010
cmp dword [ebp - 0x1f4], 0
jne 0x51099a
mov bl, 1
jmp 0x510908
mov eax, dword [ebp - 0x1dc]
mov ecx, dword [ebp - 0x1fc]
test ecx, ecx
je 0x510894
mov dword [ecx], eax
mov ecx, dword [ebx + 0x28]
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
test ecx, ecx
je 0x5108af
push ecx
call eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 0x28], 0
mov ecx, dword [ebx + 0x2c]
test ecx, ecx
je 0x5108c0
push ecx
call eax
mov dword [ebx + 0x2c], 0
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x5108d5
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 0x30], 0
mov eax, dword [ebp - 0x1f4]
test eax, eax
je 0x5108e6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
mov dword [ebx + 0x34], ecx
mov dword [ebx + 0x38], ecx
mov dword [ebx + 0x3c], ecx
mov dword [ebx + 0x40], ecx
mov dword [ebx + 0x44], ecx
mov dword [ebx + 0x48], ecx
mov dword [ebx + 0x4c], ecx
mov dword [ebx + 0x50], ecx
mov dword [ebx + 0x54], ecx
mov dword [ebx + 0x58], ecx
xor bl, bl
add esi, 0xfffffff0
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x510922
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0xfffffff0
or ecx, 0xffffffff
lea eax, [edi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x51093c
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
or ecx, 0xffffffff
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x510959
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp + 0x1c]
test ecx, ecx
je 0x510971
mov esi, dword [ecx]
lea eax, [ebp + 0xc]
cmp ecx, eax
setne dl
movzx edx, dl
push edx
call dword [esi + 0x10]
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0053d3a0
mov esp, ebp
pop ebp
ret 0x2c
push str.invalid_vector_T__subscript
call fcn.0053af06
push str.invalid_vector_T__subscript
call fcn.0053af06
call fcn.005406d0
int3