Function at 0x479a7b
Capabilities:
Check for time delay via gettickcount
Check mutex on windows
Connect pipe
Create mailslot
Create pipe
Read file via mapping

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x134
mov dword [ebp + 0x48], ecx
push ebx
lea ecx, [ebp + 0x78]
call fcn.00439099
xor ebx, ebx
cmp dword [0x4be170], ebx
jne 0x479aa4
xor eax, eax
inc eax
jmp 0x47ad60
push esi
push edi
lea ecx, [ebp + 0x78]
call fcn.004392bd
lea ecx, [ebp + 0xc]
call fcn.0043d47d
lea ecx, [ebp - 0x38]
call fcn.0043d47d
lea ecx, [ebp - 0x3c]
call fcn.0043d47d
lea ecx, [ebp - 0x34]
call fcn.0043d47d
push 2
pop edi
lea eax, [ebp + 0x78]
push eax
mov dword [ebp + 0x60], ebx
mov dword [ebp + 0x44], edi
mov dword [ebp], ebx
mov dword [ebp + 0x3c], 1
mov dword [ebp + 0x10], 6
mov byte [ebp + 0x6f], bl
mov byte [ebp + 0x3a], bl
call fcn.004379a9
mov byte [ebp + 0x5f], bl
mov dword [ebp + 0x58], 3
jmp 0x479cc0
cmp word [esi + 2], 0x2d
jne 0x479cce
push 0xf
push esi
push str.__gethostbyname
call fcn.00438b8f
add esp, 0xc
test al, al
je 0x479b82
add esi, 0x1e
xor ecx, ecx
mov dword [ebp + 0x78], esi
mov cx, word [esi]
cmp cx, bx
je 0x479b40
mov eax, ecx
call fcn.00482120
test al, al
je 0x479b6f
mov byte [ebp + 0x5f], 1
jmp 0x479b6f
mov eax, ecx
call fcn.00482120
test al, al
jne 0x479b74
cmp cx, 0x2a
jne 0x479b5d
or byte [ebp + 0x5f], 2
jmp 0x479b67
cmp cx, 0x23
jne 0x479b67
or byte [ebp + 0x5f], 4
add esi, edi
mov dword [ebp + 0x78], esi
mov cx, word [esi]
cmp cx, bx
jne 0x479b46
lea eax, [ebp + 0x78]
push eax
call fcn.004379a9
jmp 0x479cc0
or esi, 0xffffffff
push esi
lea eax, [ebp + 0x78]
push eax
push str.__file
call fcn.0043f1bd
add esp, 0xc
test al, al
je 0x479ba3
mov dword [ebp + 0x3c], esi
jmp 0x479cc1
push esi
lea eax, [ebp + 0x78]
push eax
push str.__shm
call fcn.0043f1bd
add esp, 0xc
test al, al
je 0x479bc5
mov dword [ebp + 0x3c], 0xfffffffe
jmp 0x479cc1
push esi
lea eax, [ebp + 0x78]
push eax
push str.__event
call fcn.0043f1bd
add esp, 0xc
test al, al
je 0x479be7
mov dword [ebp + 0x3c], 0xfffffffc
jmp 0x479cc1
push esi
lea eax, [ebp + 0x78]
push eax
push str.__semaphore
call fcn.0043f1bd
add esp, 0xc
test al, al
je 0x479c09
mov dword [ebp + 0x3c], 0xffffffe0
jmp 0x479cc1
push esi
lea eax, [ebp + 0x78]
push eax
push str.__sem
call fcn.0043f1bd
add esp, 0xc
test al, al
jne 0x479bfd
push esi
lea eax, [ebp + 0x78]
push eax
push str.__mutex
call fcn.0043f1bd
add esp, 0xc
test al, al
je 0x479c41
mov dword [ebp + 0x3c], 0xffffffc0
jmp 0x479cc1
push esi
lea eax, [ebp + 0x78]
push eax
push str.__mailslot
call fcn.0043f1bd
add esp, 0xc
test al, al
je 0x479c60
mov dword [ebp + 0x3c], 0xfffffff8
jmp 0x479cc1
push esi
lea eax, [ebp + 0x78]
push eax
push str.__pipe
call fcn.0043f1bd
add esp, 0xc
test al, al
je 0x479c7f
mov dword [ebp + 0x3c], 0xfffffff0
jmp 0x479cc1
push esi
lea eax, [ebp + 0x78]
push eax
push 0x4ae968
call fcn.0043f1bd
add esp, 0xc
test al, al
je 0x479c9b
mov byte [ebp + 0x6f], 1
jmp 0x479cc1
push esi
lea eax, [ebp + 0x78]
push eax
push str.__only
call fcn.0043f1bd
add esp, 0xc
test al, al
je 0x479cb7
mov byte [ebp + 0x3a], 1
jmp 0x479cc1
lea eax, [ebp + 0x78]
push eax
call fcn.0040507c
pop ecx
mov esi, dword [ebp + 0x78]
cmp word [esi], 0x2d
je 0x479b06
cmp word [esi], 0x2a
mov byte [ebp + 0x39], bl
jne 0x479ced
lea eax, [ebp + 0x78]
add esi, edi
push eax
mov byte [ebp + 0x39], 1
mov dword [ebp + 0x78], esi
call fcn.004379a9
mov esi, dword [ebp + 0x78]
pop ecx
mov eax, dword [ebp + 0x48]
mov dword [ebp + 0x20], eax
mov eax, dword [ebp + 0x7c]
or edi, 0xffffffff
cmp word [esi], 0x3a
mov dword [ebp - 0x30], eax
mov byte [ebp + 0x43], bl
mov dword [ebp + 0x54], ebx
mov dword [ebp + 0x50], edi
mov dword [ebp + 0x4c], 0x100000
mov dword [ebp + 0x68], 0x80000001
jne 0x479d39
cmp word [esi + 2], 0x3a
jne 0x479d39
mov eax, dword [0x4bdfc8]
add esi, 4
mov dword [ebp + 0x78], esi
mov byte [ebp + 0x43], 1
mov dword [ebp + 0x20], 0x4bdfa0
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp + 0x48]
push 0x3b
push 0x2c
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.0043317e
mov esi, dword [ebp + 0x3c]
cmp esi, 0xfffffffe
mov byte [ebp + 0x3b], bl
jne 0x479d8e
mov ecx, dword [ebp + 0x78]
mov ax, word [ecx]
and ax, 0xffdf
cmp ax, 0x57
jne 0x479d84
inc ecx
inc ecx
mov byte [ebp + 0x3b], 1
mov dword [ebp + 0x78], ecx
jmp 0x479d84
inc ecx
inc ecx
cmp ax, 0x2c
mov dword [ebp + 0x78], ecx
je 0x479d9d
cmp ax, 0x3b
je 0x479d9d
mov ax, word [ecx]
cmp ax, bx
jne 0x479d73
jmp 0x479d9d
cmp esi, 0xfffffffc
je 0x479d9d
cmp esi, 0xffffffe0
je 0x479d9d
cmp esi, 0xffffffc0
jne 0x479dcf
mov eax, dword [ebp + 0x78]
mov ax, word [eax]
cmp ax, 0x2e
jne 0x479db6
add dword [ebp + 0x78], 2
push edi
push edi
push str.Local_
jmp 0x479dc7
cmp ax, 0x23
jne 0x479dc0
add dword [ebp + 0x78], 2
push edi
push edi
push 0x4ae20c
lea ecx, [ebp + 0x54]
call fcn.0043d538
cmp byte [ebp + 0x5f], bl
je 0x479f99
lea ecx, [ebp + 0x44]
call fcn.0043d47d
mov ecx, dword [ebp + 0x48]
push 0x3b
push 0x2c
lea eax, [ebp + 0x44]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.0043317e
lea eax, [ebp + 0x44]
push eax
lea ecx, [ebp + 0x4c]
mov dword [ebp + 0x28], 4
xor esi, esi
call fcn.00402bd5
lea ecx, [ebp + 0x68]
call fcn.0043d47d
mov edi, dword [ebp + 0x4c]
cmp edi, ebx
lea eax, [ebp + 0x20]
mov dword [ebp + 0x20], ebx
mov dword [ebp + 0x64], eax
mov byte [ebp + 0x7f], 1
mov dword [ebp + 0x58], ebx
je 0x479e72
cmp byte [edi], bl
je 0x479e3e
push edi
call dword [0x4be1b8]
cmp eax, 0xffffffff
mov dword [ebp + 0x20], eax
jne 0x479e72
mov dword [ebp + 0x20], ebx
push edi
call dword [0x4be1bc]
cmp eax, ebx
je 0x479e72
mov cx, word [eax + 0xa]
mov eax, dword [eax + 0xc]
cmp dword [eax], ebx
mov word [ebp + 0x28], cx
mov dword [ebp + 0x58], eax
je 0x479e72
mov cl, byte [ebp + 0x5f]
mov byte [ebp + 0x7f], cl
mov eax, dword [eax]
cmp eax, ebx
je 0x479f73
add dword [ebp + 0x58], 4
mov dword [ebp + 0x64], eax
test byte [ebp + 0x5f], 4
lea ecx, [ebp + 0x68]
je 0x479ef2
lea eax, [esi + 0x3e]
push eax
call fcn.0043d4c2
mov eax, dword [ebp + 0x68]
lea eax, [eax + esi*2]
mov dword [ebp + 0x78], eax
mov dword [ebp + 0x50], eax
push 6
xor eax, eax
pop ecx
lea edi, [ebp - 0x80]
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0x84], ebx
rep stosd dword es:[edi], eax
movsx eax, word [ebp + 0x28]
cmp eax, 0x20
jbe 0x479eb2
push 0x20
pop eax
push eax
push dword [ebp + 0x64]
lea eax, [ebp - 0x88]
push eax
call fcn.004125f9
push str.0x_08I64X
push dword [ebp - 0x84]
push dword [ebp - 0x88]
push dword [ebp + 0x78]
call fcn.004842d2
add esp, 0x1c
push dword [ebp + 0x78]
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
mov ecx, dword [ebp + 0x78]
lea eax, [ecx + eax*2]
mov dword [ebp + 0x78], eax
jmp 0x479f51
movsx edi, word [ebp + 0x28]
lea eax, [edi + edi*2]
lea eax, [esi + eax*2]
push eax
call fcn.0043d4c2
mov eax, dword [ebp + 0x68]
lea ecx, [eax + esi*2]
lea edx, [edi - 1]
cmp edx, ebx
mov dword [ebp + 0x78], ecx
lea eax, [ecx + 2]
mov dword [ebp + 0x50], ecx
jl 0x479f4c
mov edi, dword [ebp + 0x64]
inc edx
mov dword [ebp + 0x10], edx
movzx eax, byte [edi]
push eax
push 0x4ae958
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push dword [ebp + 0x78]
inc edi
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
dec dword [ebp + 0x10]
mov ecx, dword [ebp + 0x78]
lea ecx, [ecx + eax*2]
mov dword [ebp + 0x78], ecx
mov eax, ecx
jne 0x479f1f
dec eax
dec eax
mov word [eax], bx
test byte [ebp + 0x7f], 2
je 0x479f73
mov ecx, dword [ebp + 0x58]
cmp dword [ecx], ebx
je 0x479f73
mov word [eax], 0x20
sub eax, dword [ebp + 0x50]
inc eax
inc eax
sar eax, 1
add esi, eax
mov eax, ecx
jmp 0x479e61
push dword [ebp + 0x68]
mov ecx, dword [ebp + 0x48]
push dword [ebp + 0xc]
call fcn.0043cd78
lea ecx, [ebp + 0x68]
call fcn.00437960
lea ecx, [ebp + 0x4c]
call fcn.00437960
lea ecx, [ebp + 0x44]
jmp 0x47aa2d
cmp esi, edi
mov dword [ebp + 0x28], ebx
jne 0x47a159
mov eax, dword [ebp + 0x78]
mov cx, word [eax]
and cx, 0xffdf
push 7
xor edx, edx
cmp cx, 0x57
mov dword [ebp + 0x68], 0x80000000
pop edi
jne 0x479fd4
inc eax
inc eax
mov dword [ebp + 0x68], 0xc0000000
mov dword [ebp + 0x58], 4
mov dword [ebp + 0x78], eax
cmp word [eax], 0x2d
jne 0x479fe4
xor edx, edx
xor edi, edi
inc edx
inc eax
inc eax
mov dword [ebp + 0x78], eax
xor ecx, ecx
jmp 0x47a022
inc eax
inc eax
cmp cx, 0x2c
mov dword [ebp + 0x78], eax
je 0x47a02a
cmp cx, 0x3b
je 0x47a02a
and ecx, 0xffdf
cmp edx, ebx
je 0x47a022
cmp cx, 0x52
jne 0x47a00e
or edi, 1
jmp 0x47a022
cmp cx, 0x57
jne 0x47a019
or edi, 2
jmp 0x47a022
cmp cx, 0x44
jne 0x47a022
or edi, 4
mov cx, word [eax]
cmp cx, bx
jne 0x479fe8
lea ecx, [ebp + 0x34]
call fcn.0043d47d
mov ecx, dword [ebp + 0x48]
push 0x3b
push 0x2c
lea eax, [ebp + 0x34]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.0043317e
push dword [ebp + 0x34]
call fcn.0041113a
mov esi, eax
mov ax, word [esi]
cmp ax, bx
pop ecx
jne 0x47a07e
lea ecx, [ebp + 0x34]
call fcn.00437960
cmp byte [ebp + 0x6f], bl
je 0x47aafc
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, ebx
jne 0x47a077
xor eax, eax
inc eax
mov ebx, eax
jmp 0x47ad34
cmp dword [ebp + 0x58], 3
jne 0x47a0d5
cmp edi, ebx
je 0x47a0d5
cmp ax, 0x5c
jne 0x47a0bf
cmp word [esi + 2], ax
jne 0x47a0bf
push ebx
push ebx
push 3
push ebx
push ebx
push dword [ebp + 0x68]
lea ecx, [ebp + 0x64]
push esi
mov dword [ebp + 0x64], ebx
call fcn.0040511c
cmp dword [ebp + 0x64], ebx
lea ecx, [ebp + 0x64]
jne 0x47a0b8
call fcn.00402b5a
jmp 0x47a0ee
call fcn.00402b5a
jmp 0x47a0d5
push esi
call fcn.0048efcc
and eax, 0x10
and edx, 1
cmp eax, ebx
pop ecx
jne 0x47a0ee
cmp edx, 1
jne 0x47a0ee
push ebx
push ebx
push dword [ebp + 0x58]
lea ecx, [ebp + 0x64]
push ebx
push edi
push dword [ebp + 0x68]
mov dword [ebp + 0x64], ebx
push esi
call fcn.0040511c
mov dword [ebp + 0x60], eax
cmp byte [ebp + 0x6f], bl
je 0x47a0fb
lea ecx, [ebp + 0x34]
jmp 0x47a8b0
cmp dword [ebp + 0x60], ebx
jne 0x47a10e
call dword [sym.imp.KERNEL32.DLL_GetLastError]
lea ecx, [ebp + 0x34]
jmp 0x47aa2b
lea ecx, [ebp + 0x34]
call fcn.00437960
mov esi, dword [ebp - 0x30]
cmp esi, ebx
jne 0x47acc0
mov al, byte [ebp + 0x43]
mov esi, dword [ebp + 0x20]
neg al
sbb eax, eax
and eax, dword [ebp + 0x48]
push eax
push esi
call fcn.00410a6c
mov esi, dword [esi + 0x28]
cmp esi, ebx
pop ecx
pop ecx
jne 0x47acc0
cmp dword [ebp + 0x60], ebx
je 0x47aafc
push dword [ebp + 0x60]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x47aafc
cmp esi, 0xfffffffe
jne 0x47a577
cmp byte [ebp + 0x3b], bl
push 2
pop esi
push 4
pop eax
mov dword [ebp + 0x68], esi
mov edi, eax
mov dword [ebp + 0x50], 0x80000000
mov dword [ebp + 0x34], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
mov dword [ebp + 0x2c], ebx
mov dword [ebp + 0x30], ebx
mov dword [ebp + 4], ebx
mov dword [ebp + 8], ebx
mov dword [ebp + 0x14], ebx
mov dword [ebp + 0x18], ebx
je 0x47a1a4
push 6
mov dword [ebp + 0x68], eax
pop edi
mov dword [ebp + 0x50], 0xc0000000
mov dword [ebp + 0x58], eax
lea ecx, [ebp + 0x1c]
call fcn.0043d47d
lea ecx, [ebp + 0x24]
call fcn.0043d47d
mov ecx, dword [ebp + 0x48]
push 0x3b
push 0x2c
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.0043317e
mov eax, dword [ebp + 0x78]
cmp word [eax], bx
je 0x47a215
lea eax, [ebp + 0x2c]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.00448773
mov eax, dword [ebp + 0x78]
cmp word [eax], bx
pop ecx
pop ecx
je 0x47a215
mov ecx, dword [ebp + 0x48]
add dword [ebp + 0x78], esi
push 0x3b
push 0x2c
lea eax, [ebp + 0x24]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.0043317e
mov eax, dword [ebp + 0x78]
cmp word [eax], bx
je 0x47a215
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.00448773
pop ecx
pop ecx
mov eax, dword [ebp + 0x1c]
cmp word [eax], bx
je 0x47a567
cmp dword [ebp + 0x30], ebx
jl 0x47a567
jg 0x47a235
cmp dword [ebp + 0x2c], ebx
jb 0x47a567
cmp dword [ebp - 4], ebx
jl 0x47a567
jg 0x47a249
cmp dword [ebp - 8], ebx
jb 0x47a567
mov eax, dword [ebp + 0x78]
cmp word [eax], bx
je 0x47a28d
add dword [ebp + 0x78], esi
lea eax, [ebp + 4]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.004050d3
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp + 0x34], eax
jle 0x47a276
mov eax, dword [ebp + 0x2c]
mov dword [ebp + 0x14], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp + 0x18], eax
mov eax, dword [ebp + 0x78]
cmp word [eax], bx
je 0x47a28d
lea eax, [ebp + 0x14]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.004050d3
pop ecx
pop ecx
or dword [ebp + 0x60], 0xffffffff
push str.pecmd2012.shm.
lea ecx, [ebp + 0x54]
mov dword [ebp + 0x44], ebx
call fcn.0043d4e9
push dword [ebp + 0x1c]
lea ecx, [ebp + 0x54]
call fcn.0043d4e9
mov eax, dword [ebp + 0x24]
mov ax, word [eax]
mov si, ax
neg si
mov ecx, dword [ebp + 0x30]
push dword [ebp + 0x54]
push ebx
push edi
sbb esi, esi
and esi, 0xfffffff8
add esi, 8
neg ax
sbb eax, eax
and eax, 0xfffffffc
add eax, 4
mov dword [ebp + 0x4c], eax
add eax, esi
cdq
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x2c]
add eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], edx
adc ecx, edx
mov dword [ebp + 0x2c], eax
add eax, dword [ebp - 8]
mov dword [ebp + 0x30], ecx
adc ecx, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.DLL_OpenFileMappingW]
mov edi, eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp byte [ebp + 0x6f], bl
mov dword [ebp + 0x64], ebx
je 0x47a322
lea ecx, [ebp + 0x24]
mov dword [ebp + 0x60], edi
call fcn.00437960
lea ecx, [ebp + 0x1c]
jmp 0x47a8b0
cmp edi, ebx
jne 0x47a3dc
mov eax, dword [ebp + 0x24]
cmp word [eax], bx
je 0x47a36f
push eax
call fcn.0041113a
pop ecx
push ebx
push ebx
push dword [ebp + 0x58]
lea ecx, [ebp]
push ebx
push 7
push dword [ebp + 0x50]
mov dword [ebp], ebx
push eax
call fcn.0040511c
cmp eax, ebx
mov dword [ebp + 0x60], eax
jne 0x47a36f
call dword [sym.imp.KERNEL32.DLL_GetLastError]
lea ecx, [ebp + 0x24]
mov ebx, eax
call fcn.00437960
lea ecx, [ebp + 0x1c]
jmp 0x47aa2d
xor eax, eax
mov byte [ebp - 0x68], bl
lea edi, [ebp - 0x67]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x68]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x20], 0xc
mov dword [ebp - 0x18], ebx
call fcn.0043a300
pop ecx
push dword [ebp + 0x54]
lea eax, [ebp - 0x20]
push dword [ebp - 0x10]
push dword [ebp - 0xc]
push dword [ebp + 0x68]
push eax
push dword [ebp + 0x60]
call dword [sym.imp.KERNEL32.DLL_CreateFileMappingW]
mov edi, eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp dword [ebp + 0x18], ebx
mov dword [ebp + 0x64], 1
jg 0x47a3d8
jl 0x47a3cc
cmp dword [ebp + 0x14], ebx
ja 0x47a3d8
mov eax, dword [ebp + 0x2c]
mov dword [ebp + 0x14], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp + 0x18], eax
cmp edi, ebx
je 0x47a401
push dword [ebp + 0x2c]
mov eax, dword [ebp - 4]
push dword [ebp - 8]
mov ecx, eax
push eax
mov eax, dword [ebp + 0x68]
and eax, 4
or eax, 8
shr eax, 1
push eax
push edi
sar ecx, 0x1f
call dword [sym.imp.KERNEL32.DLL_MapViewOfFile]
mov dword [ebp + 0x44], eax
cmp dword [ebp + 0x60], 0xffffffff
je 0x47a410
push dword [ebp + 0x60]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [ebp + 0x44]
cmp eax, ebx
mov dword [ebp + 0x60], edi
jne 0x47a437
cmp edi, ebx
je 0x47a357
cmp edi, 0xffffffff
je 0x47a357
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x47a357
mov ecx, dword [ebp + 0x2c]
sub ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
sbb dword [ebp + 0x30], edx
cmp dword [ebp + 0x64], ebx
mov dword [ebp + 0x2c], ecx
je 0x47a457
cmp esi, ebx
je 0x47a457
mov dword [eax], ecx
mov ecx, dword [ebp + 0x30]
mov dword [eax + 4], ecx
add eax, esi
cmp dword [ebp + 0x64], ebx
mov dword [ebp + 0x44], eax
je 0x47a478
cmp dword [ebp + 0x4c], ebx
je 0x47a478
push dword [ebp + 0x4c]
mov ecx, dword [ebp + 0x2c]
add ecx, eax
push ebx
push ecx
call fcn.0048f7a0
add esp, 0xc
cmp dword [ebp + 0x64], ebx
mov eax, dword [ebp + 0x2c]
mov dword [ebp], eax
je 0x47a557
cmp dword [ebp + 0x34], ebx
jle 0x47a557
mov eax, dword [ebp + 0x18]
cmp eax, ebx
jl 0x47a557
jg 0x47a4a6
cmp dword [ebp + 0x14], ebx
jbe 0x47a557
cmp dword [ebp + 0x44], ebx
je 0x47a557
cmp dword [ebp + 8], 1
mov edi, dword [ebp + 4]
jb 0x47a4ea
ja 0x47a4be
cmp edi, ebx
jb 0x47a4ea
mov esi, dword [ebp + 0x44]
push ebx
push 8
push eax
push dword [ebp + 0x14]
call fcn.0048f800
dec eax
js 0x47a557
inc eax
jmp 0x47a4da
mov edi, dword [ebp + 4]
mov dword [esi], edi
mov ecx, dword [ebp + 8]
mov dword [esi + 4], ecx
add esi, 8
dec eax
jne 0x47a4d7
jmp 0x47a557
cmp dword [ebp + 8], ebx
ja 0x47a4f7
cmp edi, 0x10000
jb 0x47a519
mov esi, dword [ebp + 0x44]
push ebx
push 4
push eax
push dword [ebp + 0x14]
call fcn.0048f800
dec eax
js 0x47a557
inc eax
jmp 0x47a50f
mov edi, dword [ebp + 4]
mov dword [esi], edi
add esi, 4
dec eax
jne 0x47a50c
jmp 0x47a557
cmp dword [ebp + 8], ebx
ja 0x47a526
cmp edi, 0x100
jb 0x47a548
mov esi, dword [ebp + 0x44]
push ebx
push 2
push eax
push dword [ebp + 0x14]
call fcn.0048f800
dec eax
js 0x47a557
inc eax
jmp 0x47a53e
mov edi, dword [ebp + 4]
mov word [esi], di
inc esi
inc esi
dec eax
jne 0x47a53b
jmp 0x47a557
push dword [ebp + 0x14]
push edi
push dword [ebp + 0x44]
call fcn.0048f7a0
add esp, 0xc
lea ecx, [ebp + 0x24]
call fcn.00437960
lea ecx, [ebp + 0x1c]
jmp 0x47a111
lea ecx, [ebp + 0x24]
call fcn.00437960
lea ecx, [ebp + 0x1c]
jmp 0x47aaf7
cmp esi, 0xfffffffc
jne 0x47a6b5
lea ecx, [ebp + 0x4c]
call fcn.0043d47d
lea ecx, [ebp + 0x64]
call fcn.0043d47d
mov ecx, dword [ebp + 0x48]
push 0x3b
push 0x2c
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.0043317e
mov eax, dword [ebp + 0x4c]
cmp word [eax], bx
jne 0x47a5bc
lea ecx, [ebp + 0x64]
call fcn.00437960
lea ecx, [ebp + 0x4c]
jmp 0x47aaf7
lea eax, [ebp + 0x68]
push eax
lea eax, [ebp + 0x78]
push eax
mov dword [ebp + 0x68], ebx
mov dword [ebp + 0x50], ebx
mov dword [ebp + 0x58], ebx
call fcn.004050b3
lea eax, [ebp + 0x50]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.004050b3
lea eax, [ebp + 0x58]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.004050b3
add esp, 0x18
push str.pecmd2012.event.
lea ecx, [ebp + 0x54]
call fcn.0043d4e9
push dword [ebp + 0x4c]
lea ecx, [ebp + 0x54]
call fcn.0043d4e9
cmp byte [ebp + 0x6f], bl
jne 0x47a611
cmp dword [ebp + 0x68], ebx
jne 0x47a63e
push dword [ebp + 0x54]
push dword [ebp + 0x58]
push 0x100002
call dword [sym.imp.KERNEL32.DLL_OpenEventW]
cmp byte [ebp + 0x6f], bl
mov dword [ebp + 0x60], eax
je 0x47a63a
lea ecx, [ebp + 0x64]
call fcn.00437960
lea ecx, [ebp + 0x4c]
jmp 0x47a8b0
cmp eax, ebx
jne 0x47a6a5
xor eax, eax
mov byte [ebp - 0x68], bl
lea edi, [ebp - 0x67]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x68]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x20], 0xc
mov dword [ebp - 0x18], ebx
call fcn.0043a300
xor eax, eax
cmp dword [ebp + 0x68], ebx
pop ecx
push dword [ebp + 0x54]
setne al
push eax
xor eax, eax
cmp dword [ebp + 0x50], ebx
setne al
push eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateEventW]
cmp eax, ebx
mov dword [ebp + 0x60], eax
jne 0x47a6a5
call dword [sym.imp.KERNEL32.DLL_GetLastError]
lea ecx, [ebp + 0x64]
mov ebx, eax
call fcn.00437960
lea ecx, [ebp + 0x4c]
jmp 0x47aa2d
lea ecx, [ebp + 0x64]
call fcn.00437960
lea ecx, [ebp + 0x4c]
jmp 0x47a111
cmp esi, 0xffffffe0
jne 0x47a81f
lea ecx, [ebp + 0x50]
call fcn.0043d47d
lea ecx, [ebp + 0x64]
call fcn.0043d47d
mov ecx, dword [ebp + 0x48]
push 0x3b
push 0x2c
lea eax, [ebp + 0x50]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.0043317e
mov eax, dword [ebp + 0x50]
cmp word [eax], bx
jne 0x47a6fa
lea ecx, [ebp + 0x64]
call fcn.00437960
lea ecx, [ebp + 0x50]
jmp 0x47aaf7
lea eax, [ebp + 0x58]
push eax
xor esi, esi
lea eax, [ebp + 0x78]
inc esi
push eax
mov dword [ebp + 0x58], esi
mov dword [ebp + 0x68], esi
mov dword [ebp + 0x4c], ebx
call fcn.004050b3
lea eax, [ebp + 0x68]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.004050b3
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.004050b3
add esp, 0x18
cmp dword [ebp + 0x68], esi
jge 0x47a738
mov dword [ebp + 0x68], esi
mov esi, dword [ebp + 0x58]
cmp esi, dword [ebp + 0x68]
jle 0x47a743
mov esi, dword [ebp + 0x68]
push str.pecmd2012.semaphore.
lea ecx, [ebp + 0x54]
call fcn.0043d4e9
push dword [ebp + 0x50]
lea ecx, [ebp + 0x54]
call fcn.0043d4e9
push dword [ebp + 0x54]
push ebx
push 0x100002
call dword [sym.imp.KERNEL32.DLL_OpenSemaphoreW]
cmp byte [ebp + 0x6f], bl
mov dword [ebp + 0x60], eax
je 0x47a782
lea ecx, [ebp + 0x64]
call fcn.00437960
lea ecx, [ebp + 0x50]
jmp 0x47a8b0
cmp eax, ebx
jne 0x47a80f
xor eax, eax
mov byte [ebp - 0x9c], bl
lea edi, [ebp - 0x9b]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x9c]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x2c], 0xc
mov dword [ebp - 0x24], ebx
call fcn.0043a300
cmp esi, ebx
pop ecx
jge 0x47a7c4
xor esi, esi
cmp esi, ebx
jle 0x47a7ca
mov eax, esi
jmp 0x47a7cd
xor eax, eax
inc eax
push dword [ebp + 0x54]
push dword [ebp + 0x68]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateSemaphoreW]
mov dword [ebp + 0x60], eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp dword [ebp + 0x60], ebx
mov dword [ebp + 0x28], eax
jne 0x47a7ff
lea ecx, [ebp + 0x64]
call fcn.00437960
lea ecx, [ebp + 0x50]
jmp 0x47a92a
cmp esi, 1
jge 0x47a80f
push 0xffffffffffffffff
push dword [ebp + 0x60]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
lea ecx, [ebp + 0x64]
call fcn.00437960
lea ecx, [ebp + 0x50]
jmp 0x47a111
cmp esi, 0xffffffc0
jne 0x47a944
lea ecx, [ebp + 0x58]
call fcn.0043d47d
lea ecx, [ebp + 0x68]
call fcn.0043d47d
mov ecx, dword [ebp + 0x48]
push 0x3b
push 0x2c
lea eax, [ebp + 0x58]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.0043317e
mov eax, dword [ebp + 0x58]
cmp word [eax], bx
jne 0x47a864
lea ecx, [ebp + 0x68]
call fcn.00437960
lea ecx, [ebp + 0x58]
jmp 0x47aaf7
lea eax, [ebp + 0x64]
push eax
lea eax, [ebp + 0x78]
push eax
mov dword [ebp + 0x64], ebx
call fcn.004050b3
pop ecx
pop ecx
push str.pecmd2012.mutex.
lea ecx, [ebp + 0x54]
call fcn.0043d4e9
push dword [ebp + 0x58]
lea ecx, [ebp + 0x54]
call fcn.0043d4e9
push dword [ebp + 0x54]
push ebx
push 0x100002
call dword [sym.imp.KERNEL32.DLL_OpenMutexW]
cmp byte [ebp + 0x6f], bl
mov dword [ebp + 0x60], eax
je 0x47a8ba
lea ecx, [ebp + 0x68]
call fcn.00437960
lea ecx, [ebp + 0x58]
call fcn.00437960
jmp 0x47ab98
cmp eax, ebx
jne 0x47a934
xor eax, eax
mov byte [ebp - 0xc4], bl
lea edi, [ebp - 0xc3]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0xc4]
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x44]
push eax
mov dword [ebp - 0x48], 0xc
mov dword [ebp - 0x40], ebx
call fcn.0043a300
cmp dword [ebp + 0x64], ebx
pop ecx
jge 0x47a8f8
mov dword [ebp + 0x64], ebx
push dword [ebp + 0x54]
xor eax, eax
cmp dword [ebp + 0x64], ebx
setg al
push eax
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateMutexW]
mov dword [ebp + 0x60], eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp dword [ebp + 0x60], ebx
mov dword [ebp + 0x28], eax
jne 0x47a934
lea ecx, [ebp + 0x68]
call fcn.00437960
lea ecx, [ebp + 0x58]
call fcn.00437960
jmp 0x47ad31
lea ecx, [ebp + 0x68]
call fcn.00437960
lea ecx, [ebp + 0x58]
jmp 0x47a111
cmp esi, 0xfffffff8
jne 0x47aab7
lea ecx, [ebp + 0x68]
call fcn.0043d47d
mov ecx, dword [ebp + 0x48]
push 0x3b
push 0x2c
lea eax, [ebp + 0x68]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.0043317e
mov eax, dword [ebp + 0x68]
cmp word [eax], bx
jne 0x47a979
lea ecx, [ebp + 0x68]
jmp 0x47aaf7
lea eax, [ebp + 0x64]
push eax
lea eax, [ebp + 0x78]
push eax
mov dword [ebp + 0x64], ebx
mov dword [ebp + 0x58], edi
call fcn.004050b3
cmp dword [ebp + 0x64], ebx
pop ecx
pop ecx
jne 0x47a996
mov dword [ebp + 0x58], ebx
lea eax, [ebp + 0x58]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.004050b3
pop ecx
pop ecx
push 0xffffffffffffffff
push 0xffffffffffffffff
push str..mailslotpecmd2012.mailslot.
lea ecx, [ebp + 0x54]
call fcn.0043d538
push dword [ebp + 0x68]
lea ecx, [ebp + 0x54]
call fcn.0043d4e9
xor eax, eax
mov byte [ebp - 0xb0], bl
lea edi, [ebp - 0xaf]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0xb0]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x14], 0xc
mov dword [ebp - 0xc], ebx
call fcn.0043a300
cmp byte [ebp + 0x6f], bl
pop ecx
jne 0x47aa37
cmp dword [ebp + 0x64], ebx
je 0x47aa37
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0x58]
push ebx
push dword [ebp + 0x54]
call dword [sym.imp.KERNEL32.DLL_CreateMailslotW]
cmp eax, 0xffffffff
mov dword [ebp + 0x60], eax
jne 0x47aa19
mov dword [ebp + 0x60], ebx
cmp dword [ebp + 0x60], ebx
jne 0x47aaaf
call dword [sym.imp.KERNEL32.DLL_GetLastError]
lea ecx, [ebp + 0x68]
mov ebx, eax
call fcn.00437960
jmp 0x47ad34
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov esi, dword [sym.imp.KERNEL32.DLL_CreateFileW]
push ebx
push 0x80
push 3
mov dword [ebp + 0x64], eax
lea eax, [ebp - 0x14]
push eax
push 1
mov edi, 0x40000000
push edi
push dword [ebp + 0x54]
call esi
cmp byte [ebp + 0x6f], bl
mov dword [ebp + 0x60], eax
jne 0x47aaa2
cmp dword [ebp + 0x60], 0xffffffff
jne 0x47aa19
cmp dword [ebp + 0x58], 0xffffffff
je 0x47aa81
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
sub eax, dword [ebp + 0x64]
cmp eax, dword [ebp + 0x58]
jae 0x47aa16
push 1
call dword [sym.imp.KERNEL32.DLL_Sleep]
push ebx
push 0x80
push 3
lea eax, [ebp - 0x14]
push eax
push 1
push edi
push dword [ebp + 0x54]
call esi
mov dword [ebp + 0x60], eax
jmp 0x47aa67
lea ecx, [ebp + 0x68]
call fcn.00437960
jmp 0x47ab8f
lea ecx, [ebp + 0x68]
jmp 0x47a111
cmp esi, 0xfffffff0
jne 0x47ac53
lea ecx, [ebp + 0x64]
call fcn.0043d47d
lea ecx, [ebp + 0x58]
call fcn.0043d47d
mov ecx, dword [ebp + 0x48]
push 0x3b
push 0x2c
lea eax, [ebp + 0x64]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.0043317e
mov eax, dword [ebp + 0x64]
cmp word [eax], bx
jne 0x47ab06
lea ecx, [ebp + 0x58]
call fcn.00437960
lea ecx, [ebp + 0x64]
call fcn.00437960
mov ebx, 0x80070057
jmp 0x47ad34
lea eax, [ebp + 0x50]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.004050b3
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.004050b3
lea eax, [ebp + 0x68]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.004050b3
add esp, 0x18
push edi
push edi
push str..pipepecmd2012.pipe.
lea ecx, [ebp + 0x54]
call fcn.0043d538
push dword [ebp + 0x64]
lea ecx, [ebp + 0x54]
call fcn.0043d4e9
cmp byte [ebp + 0x6f], bl
mov dword [ebp + 0x60], edi
je 0x47ab55
mov dword [ebp + 0x68], ebx
lea ecx, [ebp + 0x58]
call fcn.00437960
lea ecx, [ebp + 0x64]
call fcn.00437960
test byte [ebp + 0x68], 4
jne 0x47abaf
mov eax, dword [ebp + 0x68]
and eax, 3
sub al, 3
neg al
sbb eax, eax
inc eax
push eax
push dword [ebp + 0x50]
push dword [ebp + 0x54]
call fcn.0043a31f
add esp, 0xc
cmp byte [ebp + 0x6f], bl
mov dword [ebp + 0x60], eax
je 0x47abaf
cmp dword [ebp + 0x60], 0xffffffff
jne 0x47ab98
mov dword [ebp + 0x60], ebx
cmp dword [ebp + 0x60], ebx
je 0x47a06a
push dword [ebp + 0x60]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x47ad34
xor eax, eax
mov byte [ebp - 0x7c], bl
lea edi, [ebp - 0x7b]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x50]
push eax
mov dword [ebp - 0x54], 0xc
mov dword [ebp - 0x4c], ebx
call fcn.0043a300
test byte [ebp + 0x68], 2
mov esi, dword [sym.imp.KERNEL32.DLL_GetLastError]
pop ecx
jne 0x47ac30
cmp dword [ebp + 0x60], 0xffffffff
jne 0x47a116
lea eax, [ebp - 0x54]
push eax
push dword [ebp + 0x50]
push dword [ebp + 0x4c]
push dword [ebp + 0x4c]
push 0xff
push ebx
push 3
push dword [ebp + 0x54]
call dword [sym.imp.KERNEL32.DLL_CreateNamedPipeW]
test byte [ebp + 0x68], 1
mov dword [ebp + 0x60], eax
je 0x47ac23
push ebx
push eax
call dword [sym.imp.KERNEL32.DLL_ConnectNamedPipe]
test eax, eax
jne 0x47ac23
call esi
cmp dword [ebp + 0x60], 0xffffffff
je 0x47ac36
mov dword [ebp + 0x3c], 0xffffffef
cmp dword [ebp + 0x60], 0xffffffff
jne 0x47ac39
mov dword [ebp + 0x60], ebx
cmp dword [ebp + 0x3c], 0xfffffff0
je 0x47a116
cmp dword [ebp + 0x60], ebx
jne 0x47a116
call esi
jmp 0x47a077
mov eax, dword [ebp + 0x78]
cmp word [eax], bx
je 0x47aca3
lea eax, [ebp + 0x44]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.004488bd
mov eax, dword [ebp + 0x78]
cmp word [eax], bx
pop ecx
pop ecx
je 0x47aca3
add dword [ebp + 0x78], 2
lea eax, [ebp + 0x3c]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.004488bd
mov eax, dword [ebp + 0x78]
cmp word [eax], bx
pop ecx
pop ecx
je 0x47aca0
add dword [ebp + 0x78], 2
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.004488bd
pop ecx
pop ecx
mov esi, dword [ebp + 0x3c]
push dword [ebp + 0x10]
push esi
push dword [ebp + 0x44]
call dword [0x4be170]
cmp eax, ebx
mov dword [ebp + 0x60], eax
jg 0x47a116
xor ebx, ebx
inc ebx
jmp 0x47ad34
cmp byte [ebp + 0x43], bl
jne 0x47acd2
cmp byte [ebp + 0x39], bl
jne 0x47acd2
mov edi, dword [esi + 0x150]
jmp 0x47acd5
mov edi, dword [ebp + 0x20]
cmp byte [ebp + 0x3a], bl
je 0x47ad16
push 0x4ae8bc
lea ecx, [ebp + 0x48]
call fcn.004457e4
push dword [ebp + 0xc]
lea ecx, [ebp + 0x48]
call fcn.0043d4e9
push str..del
lea ecx, [ebp + 0x48]
call fcn.0043d4e9
push dword [ebp + 0x7c]
mov ecx, dword [ebp + 0x20]
push ebx
push dword [ebp + 0x48]
call fcn.0046faf9
lea ecx, [ebp + 0x48]
call fcn.00437960
push dword [ebp]
lea eax, [ebp + 0xc]
push dword [ebp + 0x10]
mov ecx, esi
push dword [ebp + 0x3c]
push dword [ebp + 0x44]
push dword [ebp + 0x60]
push eax
push edi
call fcn.0043da05
mov ebx, dword [ebp + 0x28]
lea ecx, [ebp + 0x54]
call fcn.00437960
lea ecx, [ebp - 0x34]
call fcn.00437960
lea ecx, [ebp - 0x3c]
call fcn.00437960
lea ecx, [ebp - 0x38]
call fcn.00437960
lea ecx, [ebp + 0xc]
call fcn.00437960
pop edi
mov eax, ebx
pop esi
pop ebx
add ebp, 0x70
leave
ret 8