Function at 0x495560
Capabilities:
Create pipe
Create thread

Disassembly:
push 0x340
mov eax, 0x6c2351
call fcn.00432a44
mov di, dx
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x2e4], eax
mov dword [ebp - 0x2f0], ebx
test ecx, ecx
je 0x49595d
test eax, eax
je 0x49595d
lea edx, [ebp - 0x218]
mov dword [eax], ebx
call fcn.00495972
test eax, eax
js 0x495962
lea eax, [ebp - 0x2ec]
mov dword [ebp - 0x2ec], ebx
push eax
call fcn.0060ff78
test eax, eax
js 0x495962
mov eax, dword [ebp - 0x2ec]
lea ecx, [ebp - 0x278]
push ebx
push dword [eax]
call fcn.0048ec0a
mov dword [ebp - 4], ebx
push dword [ebp - 0x2ec]
call fcn.00439b57
mov dword [ebp - 0x2e0], 0x47e068
mov dword [ebp - 0x2dc], ebx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x34c]
call fcn.0048e91d
mov byte [ebp - 4], 3
xor esi, esi
push ebx
inc esi
lea eax, [ebp - 0x2d8]
push esi
push 0x49596c
push eax
call fcn.0048de80
add esp, 0x10
mov dword [ebp - 0x2f0], esi
lea ecx, [ebp - 0x34c]
push ebx
push reloc.OLEAUT32.dll_VarUI2FromUI1
push eax
call fcn.0048e1b5
mov eax, esi
mov dword [ebp - 0x2f0], eax
and eax, 0xfffffffe
mov dword [ebp - 0x2f0], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2d8]
call fcn.0048e967
push ecx
lea eax, [ebp - 0x34c]
push eax
lea ecx, [ebp - 0x2e0]
call fcn.0048da69
push ecx
lea eax, [ebp - 0x278]
push eax
lea ecx, [ebp - 0x2e0]
call fcn.0048d617
push ecx
lea eax, [ebp - 0x278]
push eax
lea ecx, [ebp - 0x2e0]
call fcn.0048d6d3
mov eax, dword [ebp - 0x2dc]
mov dword [ebp - 0x320], eax
lea eax, [ebp - 0x324]
push eax
push 0xffffffffffffffff
push esi
push 2
push esi
push 6
push 0xc0003
lea eax, [ebp - 0x218]
mov dword [ebp - 0x324], 0xc
push eax
mov dword [ebp - 0x31c], ebx
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov esi, eax
mov dword [ebp - 0x2e8], eax
mov dword [ebp - 0x2fc], esi
mov byte [ebp - 4], 4
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
push ecx
call fcn.004050cb
mov ebx, eax
cmp ebx, 0x800700b7
je 0x495801
cmp ebx, 0x800700e7
je 0x495801
cmp ebx, 0x80070005
je 0x495801
test ebx, ebx
js 0x495806
xor ebx, ebx
mov dword [ebp - 0x2f8], ebx
mov byte [ebp - 4], 5
push 0xc
call fcn.0040251c
pop ecx
mov dword [ebp - 0x304], eax
mov byte [ebp - 4], 6
mov ecx, ebx
mov dword [ebp - 0x2fc], ecx
mov dword [ebp - 0x308], ecx
mov ecx, esi
mov dword [eax], ecx
mov byte [ebp - 4], 7
mov dword [eax + 4], ebx
mov byte [ebp - 4], 8
mov word [eax + 8], di
mov byte [ebp - 4], 5
mov edi, eax
mov dword [ebp - 0x2f8], edi
mov dword [ebp - 0x2f4], ebx
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x328]
push ecx
push ebx
push eax
push 0x495ab2
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
xor eax, eax
test esi, esi
mov dword [ebp - 0x2f4], esi
setne al
push eax
call fcn.004050cb
mov ebx, eax
test ebx, ebx
js 0x4957c3
mov ecx, edi
mov eax, esi
xor esi, esi
xor edi, edi
mov dword [ebp - 0x2f4], esi
xor ebx, ebx
mov dword [ebp - 0x2f8], edi
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x2e4]
mov dword [eax], ecx
mov byte [ebp - 4], 5
test esi, esi
je 0x4957d9
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0x2f4], 0
mov byte [ebp - 4], 4
test edi, edi
je 0x4957f2
mov ecx, edi
call fcn.004954fe
push 0xc
push edi
call fcn.0043af7a
pop ecx
pop ecx
and dword [ebp - 0x2f8], 0
mov esi, dword [ebp - 0x308]
jmp 0x495806
mov ebx, 0x805e0003
mov byte [ebp - 4], 2
test esi, esi
je 0x49581c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0x2fc], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x34c]
call fcn.0048e278
mov byte [ebp - 4], 0
cmp dword [ebp - 0x2dc], 0
mov dword [ebp - 0x2e0], 0x47e068
je 0x49594a
and dword [ebp - 0x300], 0
lea eax, [ebp - 0x32c]
push eax
lea eax, [ebp - 0x300]
push eax
push dword [ebp - 0x2dc]
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorControl]
test eax, eax
je 0x495937
test dword [ebp - 0x300], 0x8000
jne 0x495937
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x30c]
push eax
push dword [ebp - 0x2dc]
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorOwner]
push dword [ebp - 0x30c]
call fcn.004030a8
pop ecx
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x310]
push eax
push dword [ebp - 0x2dc]
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorGroup]
push dword [ebp - 0x310]
call fcn.004030a8
pop ecx
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x2e8]
push eax
push dword [ebp - 0x2dc]
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorDacl]
cmp dword [ebp - 0x2e8], 0
je 0x495901
push dword [ebp - 0x314]
call fcn.004030a8
pop ecx
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x318]
push eax
lea eax, [ebp - 0x2e8]
push eax
push dword [ebp - 0x2dc]
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorSacl]
cmp dword [ebp - 0x2e8], 0
je 0x495937
push dword [ebp - 0x318]
call fcn.004030a8
pop ecx
push dword [ebp - 0x2dc]
call fcn.004030a8
and dword [ebp - 0x2dc], 0
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x278]
call fcn.0048e967
mov eax, ebx
jmp 0x495962
mov eax, 0x80070057
call fcn.00402698
ret 4