Function at 0x1007215e
Capabilities:
Connect pipe
Create pipe
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
mov eax, ecx
mov dword [ebp - 0x18], eax
push esi
push edi
test eax, eax
jne 0x1007217a
mov eax, 0x80070057
jmp 0x10072574
xor ebx, ebx
push ebx
push 0xffffffffffffffff
push 4
push 4
push 1
push ebx
push 0x40000003
push 0x1001d668
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov dword [ebp - 0x10], eax
cmp eax, 0xffffffff
jne 0x100721a8
mov eax, 0x80004005
jmp 0x10072574
sub esp, 0xc
mov dword [ebp - 0x30], ebx
xor edx, edx
mov dword [ebp - 0x2c], ebx
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0xc], ebx
call fcn.1006ead9
mov esi, eax
test esi, esi
jns 0x10072207
mov eax, dword [0x100ad1f0]
cmp eax, 0x100ad1f0
je 0x100721f0
test byte [eax + 0x1c], 1
je 0x100721f0
push esi
push dword [eax + 0x14]
mov edx, 0x1001d844
push dword [eax + 0x10]
push 0xa
pop ecx
call fcn.1006e24c
cmp dword [ebp - 0xc], ebx
je 0x10072569
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10072569
mov esi, dword [ebp - 0xc]
push ecx
push ecx
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0xc], ebx
call fcn.1006f3d2
mov edi, eax
test edi, edi
jns 0x10072268
mov ecx, dword [0x100ad1f0]
cmp ecx, 0x100ad1f0
je 0x10072248
test byte [ecx + 0x1c], 1
je 0x10072248
push edi
push dword [ecx + 0x14]
mov edx, 0x1001d844
push dword [ecx + 0x10]
push 0xb
pop ecx
call fcn.1006e24c
cmp dword [ebp - 0xc], ebx
je 0x10072256
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x10072261
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, edi
jmp 0x10072569
mov edi, dword [ebp - 0xc]
lea eax, [ebp - 4]
push ecx
push ecx
push eax
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.1006f7e6
mov ebx, eax
test ebx, ebx
jns 0x100722b6
mov ecx, dword [0x100ad1f0]
cmp ecx, 0x100ad1f0
je 0x10072542
test byte [ecx + 0x1c], 1
je 0x10072542
push ebx
push dword [ecx + 0x14]
mov edx, 0x1001d844
push dword [ecx + 0x10]
push 0xc
pop ecx
call fcn.1006e24c
jmp 0x10072542
push dword [ebp - 4]
and dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push 0x1001d6c8
push eax
call fcn.1006f215
mov ebx, eax
add esp, 0xc
test ebx, ebx
js 0x10072533
mov edx, dword [ebp - 0xc]
lea ecx, [ebp - 8]
and dword [ebp - 8], 0
sub esp, 0x20
call fcn.1006e5b4
mov ebx, eax
test ebx, ebx
jns 0x10072325
mov ecx, dword [0x100ad1f0]
cmp ecx, 0x100ad1f0
je 0x10072524
test byte [ecx + 0x1c], 1
je 0x10072524
push ebx
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push 0xd
mov edx, 0x1001d844
pop ecx
call fcn.1006e24c
jmp 0x10072524
and dword [ebp - 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, dword [ebp - 0x18]
push ecx
push dword [ebp - 8]
lea ecx, [ebp - 0x14]
push eax
push 2
push 0
call fcn.1006e6e5
mov ebx, eax
test ebx, ebx
jns 0x10072370
mov ecx, dword [0x100ad1f0]
cmp ecx, 0x100ad1f0
je 0x10072524
test byte [ecx + 0x1c], 1
je 0x10072524
push ebx
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push 0xe
jmp 0x10072315
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x10072470
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x1007239a
movzx ebx, bx
or ebx, 0x80070000
cmp ebx, 0x80070217
je 0x10072414
cmp ebx, 0x800703e5
je 0x100723d6
test ebx, ebx
jns 0x10072414
mov eax, dword [0x100ad1f0]
cmp eax, 0x100ad1f0
je 0x10072524
test byte [eax + 0x1c], 1
je 0x10072524
push ebx
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x10
jmp 0x10072315
mov ecx, dword [ebp - 0x20]
mov edx, 0x1388
call fcn.1006eb62
test al, al
je 0x10072414
mov ebx, 0x800705b4
mov eax, dword [0x100ad1f0]
cmp eax, 0x100ad1f0
je 0x10072524
test byte [eax + 0x1c], 1
je 0x10072524
push ebx
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0xf
jmp 0x10072315
and dword [ebp - 0x1c], 0
lea eax, [ebp - 0x1c]
push 0
push eax
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x10072470
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x10072446
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
jns 0x10072470
mov eax, dword [0x100ad1f0]
cmp eax, 0x100ad1f0
je 0x10072524
test byte [eax + 0x1c], 1
je 0x10072524
push ebx
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x12
jmp 0x10072315
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x14]
push eax
call fcn.1006ec01
mov ebx, eax
test ebx, ebx
jns 0x100724ac
mov ecx, dword [0x100ad1f0]
cmp ecx, 0x100ad1f0
je 0x10072524
test byte [ecx + 0x1c], 1
je 0x10072524
push ebx
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push 0x13
jmp 0x10072315
mov ecx, dword [ebp - 8]
mov edx, 0x1388
call fcn.1006eb62
test al, al
je 0x100724d2
push 0x5b4
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, 0x800705b4
jmp 0x10072524
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x10072514
call fcn.1006fd51
mov ebx, eax
test ebx, ebx
jns 0x10072514
mov ecx, dword [0x100ad1f0]
cmp ecx, 0x100ad1f0
je 0x10072524
test byte [ecx + 0x1c], 1
je 0x10072524
push ebx
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push 0x14
jmp 0x10072315
mov ebx, dword [ebp - 0x18]
test ebx, ebx
jle 0x10072524
movzx ebx, bx
or ebx, 0x80070000
cmp dword [ebp - 8], 0
je 0x10072533
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0xc], 0
je 0x10072542
push dword [ebp - 0xc]
call fcn.1008c67c
pop ecx
cmp dword [ebp - 4], 0
je 0x10072551
push dword [ebp - 4]
call fcn.1008c67c
pop ecx
test edi, edi
je 0x1007255c
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x10072567
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, ebx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret