Function at 0x517274
Capabilities:
Create pipe
Create two anonymous pipes
Parse credit card information
Parse pe header
Read file on windows
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x7cc
call fcn.005161fc
mov edx, dword [esp + 0x7e8]
mov edx, dword [edx]
mov dword [esp + 0x38], edx
lea eax, [esp + 0x104]
mov dword [esp], eax
call fcn.004fe628
mov dword [esp + 8], 0xffffffff
mov edx, dword [esp + 0x38]
mov dword [esp + 4], edx
lea eax, [esp + 0x104]
mov dword [esp], eax
call fcn.004fe644
mov edi, dword [esp + 0x108]
xor ebx, ebx
lea ebp, [esp + 0x1d8]
lea esi, [esp + 0x2ac]
mov dword [esp + 4], edi
lea edx, [esp + 0x104]
mov dword [esp], edx
call fcn.004fe6f8
mov dword [esp + 8], 0xffffffff
lea eax, [ebx + ebx*4 + 0x625a51]
mov dword [esp + 4], eax
lea eax, [esp + 0x104]
mov dword [esp], eax
call fcn.004fe644
mov dword [esp + 8], ebp
mov eax, dword [esp + 0x108]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x104]
mov dword [esp], eax
call fcn.0053f0f8
lea edx, [esp + 0x5c]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0x104
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [0x68cbb4]
call dword [eax + 0x5c]
sub esp, 0x18
mov dword [esp], ebp
mov dword [esp + 0x34], eax
call fcn.004fe768
mov eax, dword [esp + 0x34]
test eax, eax
jne 0x5173ec
inc ebx
cmp ebx, 5
jne 0x5172d5
lea edx, [esp + 0x104]
mov dword [esp], edx
call fcn.004fe768
call sub.KERNEL32.dll_GetLastError
mov dword [esp], eax
call fcn.0057c980
mov edx, dword [esp + 0x7e0]
mov dword [esp], edx
call fcn.00505cec
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x625a2e
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edx
mov dword [esp + 4], str.couldnt_execute__
mov edx, dword [esp + 0x7e0]
mov dword [esp], edx
call fcn.004e1460
mov ebx, 1
mov eax, ebx
add esp, 0x7cc
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], esi
mov eax, dword [0x68cbb4]
call dword [eax + 0x30]
push edx
cmp eax, 0xffffffff
je 0x517372
test al, 0x10
jne 0x517372
mov dword [esp + 8], ebp
mov dword [esp + 4], 0xffffffff
mov dword [esp], esi
call fcn.0053f124
mov dword [esp + 4], eax
lea eax, [esp + 0x4b4]
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
mov dword [esp], ebp
call fcn.004fe768
mov dword [esp + 4], 0x2e
lea edx, [esp + 0x4b4]
mov dword [esp], edx
call sub.msvcrt.dll_strrchr
mov dword [esp + 0x3c], eax
test eax, eax
je 0x51748f
mov dword [esp + 4], 0x62591b
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call sub.msvcrt.dll__stricmp
test eax, eax
je 0x517559
mov dword [esp + 4], 0x625920
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call sub.msvcrt.dll__stricmp
test eax, eax
je 0x517559
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x80000000
mov dword [esp], esi
mov eax, dword [0x68cbb4]
call dword [eax + 0x14]
sub esp, 0x1c
mov edx, eax
cmp eax, 0xffffffff
je 0x517372
mov word [esp + 0x80], 0
mov dword [esp + 0x10], 0
lea eax, [esp + 0x60]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x40
lea eax, [esp + 0x80]
mov dword [esp + 4], eax
mov dword [esp], edx
mov dword [esp + 0x30], edx
call sub.KERNEL32.dll_ReadFile
sub esp, 0x14
cmp word [esp + 0x80], 0x5a4d
mov edx, dword [esp + 0x30]
je 0x5181ec
mov dword [esp], edx
call sub.KERNEL32.dll_CloseHandle
push eax
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x517372
mov dword [esp + 4], 0x625925
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call sub.msvcrt.dll__stricmp
test eax, eax
jne 0x517372
mov dword [esp + 0x4c], 1
lea edx, [esp + 0xc0]
mov dword [esp + 0x48], edx
lea eax, [esp + 0x104]
mov dword [esp], eax
call fcn.004fe768
mov dword [esp + 8], 0x104
mov dword [esp + 4], esi
mov dword [esp], esi
mov eax, dword [0x68cbb4]
call dword [eax + 0x3c]
sub esp, 0xc
mov dword [esp + 8], ebp
mov dword [esp + 4], 0xffffffff
mov dword [esp], esi
call fcn.0053f124
mov dword [esp + 4], eax
lea edx, [esp + 0x4b4]
mov dword [esp], edx
call sub.msvcrt.dll_strcpy
mov dword [esp], ebp
call fcn.004fe768
mov dword [esp + 4], 0x5c
lea eax, [esp + 0x4b4]
mov dword [esp], eax
call sub.msvcrt.dll_strrchr
test eax, eax
je 0x517938
mov dword [esp + 4], str.cmd.exe
inc eax
mov dword [esp], eax
call sub.msvcrt.dll__stricmp
test eax, eax
jne 0x517938
mov edx, dword [esp + 0x7e8]
mov eax, dword [edx + 4]
test eax, eax
je 0x517938
mov dword [esp + 4], 0x625932
mov dword [esp], eax
call sub.msvcrt.dll__stricmp
test eax, eax
jne 0x517938
mov dword [esp + 0x3c], 1
mov dword [esp + 0x4c], 1
nop
lea eax, [esp + 0x104]
mov dword [esp], eax
call fcn.004fe628
call sub.KERNEL32.dll_GetCurrentProcess
mov ebx, eax
mov ecx, 0x44
xor eax, eax
mov edi, dword [esp + 0x48]
rep stosb byte es:[edi], al
mov dword [esp + 0xc0], 0x44
mov dword [esp + 0xec], 0x100
mov dword [esp + 0xf8], 0xffffffff
mov dword [esp + 0xfc], 0xffffffff
mov dword [esp + 0x100], 0xffffffff
mov dword [esp + 0x64], 0xc
mov dword [esp + 0x68], 0
mov dword [esp + 0x6c], 1
mov esi, dword [esp + 0x7ec]
test esi, esi
je 0x5176c5
mov edx, dword [esp + 0x7ec]
cmp dword [edx], 3
je 0x517955
mov eax, 0xffffffff
mov ecx, dword [esp + 0x7f0]
test ecx, ecx
je 0x5176e5
mov edx, dword [esp + 0x7f0]
cmp dword [edx], 3
je 0x517945
mov esi, 0xffffffff
mov edx, dword [esp + 0x7f4]
test edx, edx
je 0x517705
mov edx, dword [esp + 0x7f4]
cmp dword [edx], 3
je 0x51794d
mov edi, 0xffffffff
cmp eax, 0xffffffff
je 0x517ed8
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0
lea edx, [esp + 0xf8]
mov dword [esp + 0xc], edx
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.KERNEL32.dll_DuplicateHandle
sub esp, 0x1c
cmp dword [esp + 0xf8], 0xffffffff
je 0x518115
cmp esi, 0xffffffff
je 0x517f1c
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0
lea eax, [esp + 0xfc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.KERNEL32.dll_DuplicateHandle
sub esp, 0x1c
mov eax, dword [esp + 0xfc]
inc eax
je 0x51815e
cmp edi, 0xffffffff
je 0x517fbc
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0
lea eax, [esp + 0x100]
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], ebx
call sub.KERNEL32.dll_DuplicateHandle
sub esp, 0x1c
mov eax, dword [esp + 0x100]
inc eax
je 0x517f73
call fcn.0053eaac
cmp eax, 2
je 0x51795d
call fcn.00516010
test eax, eax
je 0x518392
cmp dword [esp + 0x4c], 1
jne 0x51799f
xor edi, edi
mov dword [esp], ebp
call fcn.004fe628
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], str.tclpip85.dll
mov dword [esp], ebp
call fcn.004fe644
call fcn.004ff424
mov ebx, eax
inc dword [eax]
lea eax, [esp + 0x58]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.004ddcd8
mov edx, dword [esp + 0x58]
lea edx, [eax + edx - 1]
cmp eax, edx
jb 0x51786d
jmp 0x5182c0
dec edx
cmp edx, eax
je 0x5182c0
cmp byte [edx], 0x2f
jne 0x517864
sub edx, eax
inc edx
mov dword [esp + 0x58], edx
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004eb494
mov esi, eax
mov dword [esp + 8], 0xffffffff
mov eax, dword [esp + 0x1d8]
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.004ebdfc
inc dword [esi]
mov dword [esp + 4], esi
mov edx, dword [esp + 0x7e0]
mov dword [esp], edx
call fcn.00555cb0
test eax, eax
jne 0x518353
mov dword [esp + 4], 0
mov dword [esp], esi
call fcn.00506ac8
test eax, eax
je 0x51830e
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], str.__not_found
mov eax, dword [esp + 0x1d8]
mov dword [esp + 8], eax
mov dword [esp + 4], str.Tcl_pipe_dll__
mov edx, dword [esp + 0x7e0]
mov dword [esp], edx
call fcn.004e1460
mov eax, dword [ebx]
dec eax
mov dword [ebx], eax
test eax, eax
jle 0x518371
mov eax, dword [esi]
dec eax
mov dword [esi], eax
test eax, eax
jle 0x518364
mov dword [esp], ebp
call fcn.004fe768
mov ebx, 1
jmp 0x517c96
mov dword [esp + 0x3c], 0
jmp 0x517638
mov esi, dword [edx + 4]
jmp 0x5176ea
mov edi, dword [edx + 4]
jmp 0x51770a
mov eax, dword [edx + 4]
jmp 0x5176ca
call fcn.00516010
test eax, eax
jne 0x517988
cmp dword [esp + 0x4c], 1
je 0x5180dd
mov eax, dword [esp + 0x3c]
test eax, eax
jne 0x518218
mov dword [esp + 0x44], 8
jmp 0x5179a7
mov eax, dword [esp + 0x3c]
test eax, eax
jne 0x51800e
cmp dword [esp + 0x4c], 1
je 0x5181c3
mov dword [esp + 0x44], 0
mov dword [esp], ebp
call fcn.004fe628
mov dword [esp + 8], 0xffffffff
mov eax, dword [esp + 0x104]
mov dword [esp + 4], eax
mov dword [esp], ebp
call fcn.004fe644
mov eax, dword [esp + 0x108]
test eax, eax
jle 0x517e6d
call fcn.0053eaac
cmp eax, 2
je 0x518062
mov dword [esp + 8], 1
mov dword [esp + 4], 0x625a29
mov dword [esp], ebp
call fcn.004fe644
mov dword [esp + 0x40], 0
mov dword [esp + 0x38], 0
mov eax, dword [esp + 0x7e4]
test eax, eax
jle 0x517b7f
nop
mov eax, dword [esp + 0x38]
test eax, eax
je 0x517cf8
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x7e8]
mov ebx, dword [eax + edx*4]
mov dword [esp + 8], 1
mov dword [esp + 4], 0x625a29
mov dword [esp], ebp
call fcn.004fe644
cmp byte [ebx], 0
jne 0x517d14
nop
mov dword [esp + 8], 1
mov dword [esp + 4], 0x6259c8
mov dword [esp], ebp
call fcn.004fe644
mov edi, 1
mov esi, ebx
mov al, byte [ebx]
cmp al, 0x5c
je 0x517a9b
lea esi, [esi]
cmp al, 0x22
je 0x517b14
test al, al
je 0x517b50
inc ebx
mov al, byte [ebx]
cmp al, 0x5c
jne 0x517a84
mov al, byte [ebx + 1]
cmp al, 0x5c
je 0x517aae
cmp al, 0x22
je 0x517aae
test edi, edi
je 0x517a94
test al, al
jne 0x517a94
mov eax, ebx
sub eax, esi
mov dword [esp + 8], eax
mov dword [esp + 4], esi
mov dword [esp], ebp
call fcn.004fe644
mov edx, ebx
jmp 0x517aca
mov edx, esi
lea esi, [edx + 1]
mov al, byte [edx + 1]
cmp al, 0x22
je 0x517e14
test edi, edi
je 0x517ae4
test al, al
je 0x517e14
cmp al, 0x5c
je 0x517ac8
mov ecx, esi
sub ecx, ebx
mov dword [esp + 8], ecx
mov dword [esp + 4], ebx
mov dword [esp], ebp
mov dword [esp + 0x30], edx
call fcn.004fe644
mov edx, dword [esp + 0x30]
mov al, byte [edx + 1]
mov ebx, esi
cmp al, 0x22
jne 0x517a8c
lea esi, [esi]
mov eax, ebx
sub eax, esi
mov dword [esp + 8], eax
mov dword [esp + 4], esi
mov dword [esp], ebp
call fcn.004fe644
mov dword [esp + 8], 2
mov dword [esp + 4], 0x625a2b
mov dword [esp], ebp
call fcn.004fe644
lea esi, [ebx + 1]
mov al, byte [ebx]
test al, al
jne 0x517a94
lea esi, [esi]
sub ebx, esi
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], ebp
call fcn.004fe644
test edi, edi
jne 0x517e50
inc dword [esp + 0x38]
mov edx, dword [esp + 0x38]
cmp dword [esp + 0x7e4], edx
jg 0x517a20
mov eax, dword [esp + 0x40]
test eax, eax
je 0x517b9f
mov dword [esp + 8], 1
mov dword [esp + 4], 0x6259c8
mov dword [esp], ebp
call fcn.004fe644
lea eax, [esp + 0x104]
mov dword [esp], eax
call fcn.004fe768
lea edx, [esp + 0x104]
mov dword [esp + 8], edx
mov eax, dword [esp + 0x1dc]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x1d8]
mov dword [esp], eax
call fcn.0053f0f8
mov dword [esp], ebp
call fcn.004fe768
lea eax, [esp + 0x70]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov edx, dword [esp + 0x44]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov eax, dword [esp + 0x104]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [0x68cbb4]
call dword [eax + 0x18]
sub esp, 0x28
test eax, eax
je 0x517e7a
cmp dword [esp + 0x4c], 1
je 0x5181a7
mov dword [esp + 4], 0x1388
mov eax, dword [esp + 0x70]
mov dword [esp], eax
call sub.USER32.dll_WaitForInputIdle
sub esp, 8
mov eax, dword [esp + 0x74]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
push edi
mov eax, dword [esp + 0x70]
mov edx, dword [esp + 0x7f8]
mov dword [edx], eax
test eax, eax
je 0x518007
mov edx, dword [esp + 0x78]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00517220
xor ebx, ebx
lea eax, [esp + 0x104]
mov dword [esp], eax
call fcn.004fe768
mov eax, dword [esp + 0xf8]
cmp eax, 0xffffffff
je 0x517cba
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
push esi
mov eax, dword [esp + 0xfc]
cmp eax, 0xffffffff
je 0x517ccf
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
push ecx
mov eax, dword [esp + 0x100]
cmp eax, 0xffffffff
je 0x5173df
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
push edx
mov eax, ebx
add esp, 0x7cc
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x3c]
test eax, eax
jne 0x517e40
lea ebx, [esp + 0x4b4]
cmp byte [ebx], 0
je 0x517a5c
mov edi, ebx
lea edx, [esp + 0x56]
mov dword [esp + 4], edx
mov dword [esp], edi
call fcn.0050d834
mov esi, eax
movzx eax, word [esp + 0x56]
mov dword [esp], eax
call fcn.0050e620
test eax, eax
jne 0x517a5c
mov dx, word [esp + 0x56]
cmp dx, 0x7e
je 0x517a5c
cmp dx, 0x7c
je 0x517a5c
cmp dx, 0x3c
je 0x517a5c
cmp dx, 0x3e
je 0x517a5c
cmp dx, 0x28
je 0x517a5c
cmp dx, 0x29
je 0x517a5c
cmp dx, 0x7b
je 0x517a5c
cmp dx, 0x7d
je 0x517a5c
cmp dx, 0x5b
je 0x517a5c
cmp dx, 0x5d
je 0x517a5c
cmp dx, 0x5e
je 0x517a5c
cmp dx, 0x26
je 0x517a5c
cmp dx, 0x3d
je 0x517a5c
cmp dx, 0x3b
je 0x517a5c
cmp dx, 0x21
je 0x517a5c
cmp dx, 0x27
je 0x517a5c
cmp dx, 0x2b
je 0x517a5c
cmp dx, 0x2c
je 0x517a5c
cmp dx, 0x60
je 0x517a5c
add edi, esi
cmp byte [edi], 0
jne 0x517d16
xor edi, edi
jmp 0x517a79
mov ecx, esi
sub ecx, ebx
mov dword [esp + 8], ecx
mov dword [esp + 4], ebx
mov dword [esp], ebp
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], ecx
call fcn.004fe644
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
jmp 0x517aec
mov dword [esp + 0x38], 2
jmp 0x517b6e
mov dword [esp + 8], 1
mov dword [esp + 4], 0x6259c8
mov dword [esp], ebp
call fcn.004fe644
jmp 0x517b6a
mov dword [esp + 0x40], 0
jmp 0x517a07
call sub.KERNEL32.dll_GetLastError
mov dword [esp], eax
call fcn.0057c980
mov edx, dword [esp + 0x7e0]
mov dword [esp], edx
call fcn.00505cec
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x625a2e
mov edx, dword [esp + 0x7e8]
mov eax, dword [edx]
mov dword [esp + 8], eax
mov dword [esp + 4], str.couldnt_execute__
mov edx, dword [esp + 0x7e0]
mov dword [esp], edx
call fcn.004e1460
mov ebx, 1
jmp 0x517c96
mov dword [esp + 0xc], 0
lea eax, [esp + 0x64]
mov dword [esp + 8], eax
lea eax, [esp + 0x5c]
mov dword [esp + 4], eax
lea eax, [esp + 0xf8]
mov dword [esp], eax
call sub.KERNEL32.dll_CreatePipe
sub esp, 0x10
test eax, eax
je 0x517749
mov eax, dword [esp + 0x5c]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
push eax
jmp 0x517749
call fcn.0053eaac
dec eax
je 0x518087
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 4
lea eax, [esp + 0x64]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40000000
mov dword [esp], str.NUL:
call sub.KERNEL32.dll_CreateFileA
sub esp, 0x1c
mov dword [esp + 0xfc], eax
jmp 0x51779d
call sub.KERNEL32.dll_GetLastError
mov dword [esp], eax
call fcn.0057c980
mov edx, dword [esp + 0x7e0]
mov dword [esp], edx
call fcn.00505cec
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 4], str.couldnt_duplicate_error_handle:
mov edx, dword [esp + 0x7e0]
mov dword [esp], edx
call fcn.004e1460
mov ebx, 1
jmp 0x517c96
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
lea eax, [esp + 0x64]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40000000
mov dword [esp], str.NUL:
call sub.KERNEL32.dll_CreateFileA
sub esp, 0x1c
mov dword [esp + 0x100], eax
jmp 0x5177ea
xor ebx, ebx
jmp 0x517c96
mov dword [esp + 0x44], 0
mov eax, dword [0x68b804]
mov dword [esp + 8], 0xffffffff
test eax, eax
je 0x5181d0
mov dword [esp + 4], eax
lea edx, [esp + 0x104]
mov dword [esp], edx
call fcn.004fe644
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], str.__s__c
lea eax, [esp + 0x104]
mov dword [esp], eax
call fcn.004fe644
jmp 0x5179a7
mov dword [esp + 8], 2
mov dword [esp + 4], 0x625a26
mov dword [esp], ebp
call fcn.004fe644
mov dword [esp + 0x40], 1
jmp 0x517a07
cmp dword [esp + 0x4c], 1
jne 0x517f28
mov dword [esp + 0xc], 0
lea eax, [esp + 0x64]
mov dword [esp + 8], eax
lea eax, [esp + 0xfc]
mov dword [esp + 4], eax
lea eax, [esp + 0x5c]
mov dword [esp], eax
call sub.KERNEL32.dll_CreatePipe
sub esp, 0x10
test eax, eax
je 0x517796
mov eax, dword [esp + 0x5c]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
push ecx
mov eax, dword [esp + 0xfc]
jmp 0x51779d
mov word [esp + 0xf0], 0
or dword [esp + 0xec], 1
mov edx, dword [esp + 0x3c]
test edx, edx
mov dword [esp + 0x44], 0x10
jne 0x518016
call fcn.00516010
test eax, eax
jne 0x5179a7
jmp 0x518016
call sub.KERNEL32.dll_GetLastError
mov dword [esp], eax
call fcn.0057c980
mov edx, dword [esp + 0x7e0]
mov dword [esp], edx
call fcn.00505cec
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 4], str.couldnt_duplicate_input_handle:
mov edx, dword [esp + 0x7e0]
mov dword [esp], edx
call fcn.004e1460
mov ebx, 1
jmp 0x517c96
call sub.KERNEL32.dll_GetLastError
mov dword [esp], eax
call fcn.0057c980
mov edx, dword [esp + 0x7e0]
mov dword [esp], edx
call fcn.00505cec
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 4], str.couldnt_duplicate_output_handle:
mov edx, dword [esp + 0x7e0]
mov dword [esp], edx
call fcn.004e1460
mov ebx, 1
jmp 0x517c96
mov dword [esp + 4], 0x32
mov eax, dword [esp + 0x70]
mov dword [esp], eax
call sub.KERNEL32.dll_WaitForSingleObject
sub esp, 8
jmp 0x517c4b
mov dword [esp + 0x44], 0
jmp 0x518103
mov dword [esp + 4], str.cmd.exe__s__c
lea eax, [esp + 0x104]
mov dword [esp], eax
call fcn.004fe644
jmp 0x5179a7
cmp word [esp + 0x98], 0x40
je 0x518225
mov dword [esp], edx
call sub.KERNEL32.dll_CloseHandle
push eax
mov dword [esp + 0x4c], 1
lea edx, [esp + 0xc0]
mov dword [esp + 0x48], edx
jmp 0x51756c
mov dword [esp + 0x44], 8
jmp 0x518016
mov byte [esp + 0xc0], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov eax, dword [esp + 0xbc]
mov dword [esp + 4], eax
mov dword [esp], edx
mov dword [esp + 0x30], edx
call sub.KERNEL32.dll_SetFilePointer
sub esp, 0x10
mov dword [esp + 0x10], 0
lea eax, [esp + 0x60]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 2
lea eax, [esp + 0xc0]
mov dword [esp + 0x48], eax
mov dword [esp + 4], eax
mov edx, dword [esp + 0x30]
mov dword [esp], edx
call sub.KERNEL32.dll_ReadFile
sub esp, 0x14
mov edx, dword [esp + 0x30]
mov dword [esp], edx
call sub.KERNEL32.dll_CloseHandle
push edi
mov al, byte [esp + 0xc0]
cmp al, 0x4e
je 0x5183e3
cmp al, 0x50
je 0x5183b9
mov dword [esp + 0x4c], 1
jmp 0x51756c
cmp byte [edx], 0x2f
je 0x517872
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x6259c8
mov dword [esp + 8], eax
mov dword [esp + 4], str.no___in_executable_path_name__
mov edx, dword [esp + 0x7e0]
mov dword [esp], edx
call fcn.004e1460
mov eax, dword [ebx]
dec eax
mov dword [ebx], eax
test eax, eax
jg 0x517923
mov dword [esp], ebx
call fcn.004dd854
jmp 0x517923
mov dword [esp + 8], 0xffffffff
mov eax, dword [esp + 0x1d8]
mov dword [esp + 4], eax
lea eax, [esp + 0x104]
mov dword [esp], eax
call fcn.004fe644
mov eax, dword [ebx]
dec eax
mov dword [ebx], eax
test eax, eax
jle 0x518388
mov eax, dword [esi]
dec eax
mov dword [esi], eax
test eax, eax
jle 0x51837e
mov dword [esp], ebp
call fcn.004fe768
mov dword [esp + 0x44], edi
jmp 0x5179a7
mov dword [esp], str.Tcl_FSConvertToPathType_failed
call fcn.00508cd0
jmp 0x5178bf
mov dword [esp], esi
call fcn.004dd854
jmp 0x517923
mov dword [esp], ebx
call fcn.004dd854
jmp 0x517916
mov dword [esp], esi
call fcn.004dd854
jmp 0x518342
mov dword [esp], ebx
call fcn.004dd854
jmp 0x518339
cmp dword [esp + 0x4c], 1
jne 0x51797d
mov word [esp + 0xf0], 0
or dword [esp + 0xec], 1
mov edi, 0x10
jmp 0x517819
cmp byte [esp + 0xc1], 0x45
jne 0x5182b1
lea eax, [esp + 0x104]
mov dword [esp], eax
call fcn.004fe768
mov dword [esp + 0x4c], 3
jmp 0x5175c4
cmp byte [esp + 0xc1], 0x45
jne 0x5182b1
mov dword [esp + 0x4c], 2
jmp 0x51756c