Function at 0x51ea70
Capabilities:
Access peb ldr_data
Connect pipe
Create pipe
Create process on windows
Create process suspended
Get process heap force flags
Read file on windows
Resume thread
Terminate process
Use process replacement
Write and execute a file
Write file on windows
Write pipe

Disassembly:
push edi
mov eax, 0x1a3c
lea edi, [esp + 8]
and esp, 0xfffffff8
push dword [edi - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
call fcn.0057e5f0
mov ecx, 0x11
mov esi, dword fs:[0x18]
sub esp, eax
lea edi, [ebp - 0x19a8]
xor eax, eax
mov ebx, dword [sym.imp.kernel32.dll_GetProcAddress]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x19fc], 0
mov dword [ebp - 0x19f8], 0
mov dword [ebp - 0x19f4], 0
mov edi, dword [esi + 0x30]
mov dword [ebp - 0x19f0], 0
mov dword [esp + 4], str.ExitProcess
mov eax, dword [0x850190]
mov dword [esp], eax
mov dword [ebp - 0x1a14], ebx
call ebx
sub esp, 8
mov dword [ebp - 0x1a08], eax
mov eax, 0xef1
call fcn.0050dc60
mov dword [esp + 4], str.GetProcAddress_ExitProcess_failed_n
xor eax, eax
mov edx, dword [ebp - 0x1a08]
test edx, edx
setne al
mov dword [esp], eax
call fcn.0050e8b0
mov dword [esp + 4], str.CallNamedPipeA
mov eax, dword [0x850190]
mov dword [esp], eax
call ebx
sub esp, 8
mov ebx, eax
mov dword [ebp - 0x1a10], eax
mov eax, 0xef4
call fcn.0050dc60
xor eax, eax
test ebx, ebx
mov dword [esp + 4], str.GetProcAddress_CallNamedPipeA_failed_n
setne al
mov dword [esp], eax
call fcn.0050e8b0
lea eax, [ebp - 0x19fc]
mov dword [ebp - 0x19a8], 0x44
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x19a8]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x84fee0
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateProcessA]
sub esp, 0x28
mov ebx, eax
mov eax, 0xef8
call fcn.0050dc60
mov eax, dword [esi + 0x34]
mov dword [esp], ebx
mov dword [esp + 4], str.Failed_to_create_process___ld__n
mov dword [esp + 8], eax
call fcn.0050e8b0
mov eax, dword [ebp - 0x19fc]
lea edx, [ebp - 0x1964]
call fcn.0050d950
mov ebx, eax
mov dword [ebp - 0x1a00], eax
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0xefc
xor eax, eax
test ebx, ebx
setne al
mov dword [esp + 4], str.Could_not_find_EXE_in_remote_process_n
mov dword [esp], eax
call fcn.0050e8b0
mov eax, dword [ebp - 0x19fc]
lea ecx, [ebp - 0x1964]
mov edx, ebx
call fcn.0051e180
mov ebx, eax
mov eax, 0xeff
call fcn.0050dc60
xor eax, eax
test ebx, ebx
mov dword [esp + 4], str.IAT_entry_resolved_prematurely_n
sete al
mov dword [esp], eax
call fcn.0050e8b0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x20000
mov dword [esp + 0x10], 0x20000
mov dword [esp + 0xc], 1
mov dword [esp + 8], 6
mov dword [esp + 4], 0x80000003
mov dword [esp], str..pipeTestPipe
call dword [sym.imp.kernel32.dll_CreateNamedPipeA]
sub esp, 0x20
mov ebx, eax
mov dword [ebp - 0x1a04], eax
mov eax, 0xf04
call fcn.0050dc60
mov eax, dword [esi + 0x34]
mov dword [esp + 4], str.Failed_to_create_communication_pipe___ld__n
mov dword [esp + 8], eax
xor eax, eax
cmp ebx, 0xffffffff
setne al
mov dword [esp], eax
call fcn.0050e8b0
lea eax, [ebp - 0x175c]
mov dword [ebp - 0x175c], 0x1003f
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x19f8]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetThreadContext]
sub esp, 8
mov ebx, eax
mov eax, 0xf09
call fcn.0050dc60
mov eax, dword [esi + 0x34]
mov dword [esp], ebx
mov dword [esp + 4], str.Failed_retrieving_remote_thread_context___ld__n
mov dword [esp + 8], eax
call fcn.0050e8b0
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0xf0a
mov eax, dword [ebp - 0x175c]
mov dword [esp + 4], str.wrong_flags__lx_n
cmp eax, 0x1003f
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0050e8b0
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0x1000
mov dword [esp + 8], 0x110
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x19fc]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_VirtualAllocEx]
sub esp, 0x14
mov ebx, eax
mov eax, 0xf0d
call fcn.0050dc60
mov eax, dword [esi + 0x34]
mov dword [esp + 4], str.Failed_allocating_memory_in_remote_process___ld__n
mov dword [esp + 8], eax
xor eax, eax
test ebx, ebx
setne al
mov dword [esp], eax
call fcn.0050e8b0
mov eax, dword [str..pipeTestPipe]
mov dword [ebp - 0x186c], 0x454e4957
mov dword [ebp - 0x1868], 0
mov dword [ebp - 0x1860], eax
mov eax, dword [0x5f3374]
mov dword [ebp - 0x1864], 0
mov dword [ebp - 0x185c], eax
mov eax, dword [0x5f3378]
mov dword [ebp - 0x1858], eax
mov eax, dword [0x5f337c]
mov dword [ebp - 0x1854], eax
movzx eax, word [0x5f3380]
mov word [ebp - 0x1850], ax
lea eax, [ebp - 0x186c]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x110
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov eax, dword [ebp - 0x19fc]
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_WriteProcessMemory]
mov dword [ebp - 0x1a18], eax
call eax
sub esp, 0x14
mov dword [ebp - 0x1a0c], eax
mov eax, 0xf16
call fcn.0050dc60
mov eax, dword [esi + 0x34]
mov dword [esp + 4], str.Failed_to_write_to_remote_process_memory___ld__n
mov dword [esp + 8], eax
mov edx, dword [ebp - 0x1a0c]
mov dword [esp], edx
call fcn.0050e8b0
mov eax, 0xf3b
call fcn.0050dc60
mov eax, dword [ebp - 0x16a8]
mov edx, 1
test eax, eax
je 0x51ee92
mov ecx, dword [0x8f0770]
xor edx, edx
test ecx, ecx
sete dl
mov dword [esp + 8], eax
mov dword [esp + 4], str.ebp_is_not_zero__08lx_n
mov dword [esp], edx
call fcn.0050e8b0
mov eax, dword [ebp - 0x16a8]
test eax, eax
je 0x51f9f8
mov eax, 0xf43
call fcn.0050dc60
mov eax, dword [ebp - 0x169c]
mov dword [esp + 4], str.wrong_flags__08lx_n
mov dword [esp + 8], eax
and eax, 0xfffffffd
cmp eax, 0x200
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0050e8b0
mov eax, 0xf44
call fcn.0050dc60
mov eax, dword [ebp - 0x1740]
mov dword [esp + 4], str.wrong_control__08lx_n
cmp ax, 0x27f
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0050e8b0
mov eax, 0xf45
call fcn.0050dc60
movzx edx, word [ebp - 0x1690]
mov dword [esp + 4], str.wrong_control__08x_n
cmp dx, 0x27f
mov dword [esp + 8], edx
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0050e8b0
mov eax, dword [ebp - 0x16a4]
mov ecx, dword [ebp - 0x1a08]
mov dword [ebp - 0x19c8], ebx
lea edx, [ebp - 0x19d0]
mov esi, dword [ebp - 0x16ac]
mov dword [ebp - 0x19c4], 4
mov dword [ebp - 0x1a1c], eax
mov eax, dword [ebp - 0x16b8]
mov dword [ebp - 0x19d0], ecx
mov ecx, dword [ebp - 0x1a10]
mov dword [ebp - 0x1a0c], eax
lea eax, [ebx + 0xc]
mov dword [ebp - 0x16a4], ecx
mov ecx, dword [ebp - 0x1698]
mov dword [ebp - 0x19cc], eax
lea eax, [ebx + 4]
add ebx, 8
mov dword [ebp - 0x19c0], eax
lea eax, [ecx - 0x28]
mov dword [ebp - 0x19b8], ebx
mov dword [ebp - 0x1698], eax
mov dword [ebp - 0x19bc], 4
mov dword [ebp - 0x19b4], 0x2710
mov dword [ebp - 0x19ac], 0
mov dword [esp + 8], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x28
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x19fc]
mov dword [esp], eax
mov ecx, dword [ebp - 0x1a18]
call ecx
sub esp, 0x14
mov ebx, eax
mov eax, 0xf57
call fcn.0050dc60
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x34]
mov dword [ebp - 0x1a08], edx
mov dword [esp], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], str.Failed_to_write_to_remote_process_thread_stack___ld__n
call fcn.0050e8b0
lea eax, [ebp - 0x1490]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x480
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x1a0c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x19fc]
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_ReadProcessMemory]
mov dword [ebp - 0x1a10], eax
call eax
sub esp, 0x14
mov ebx, eax
mov eax, 0xf5b
call fcn.0050dc60
mov edx, dword [ebp - 0x1a08]
mov eax, dword [edx + 0x34]
mov dword [esp], ebx
mov dword [esp + 4], str.Failed_to_read_PEB___lu__n
mov dword [esp + 8], eax
call fcn.0050e8b0
call fcn.0057d110
mov ecx, dword [ebp - 0x1a00]
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0xf5c
mov eax, dword [ebp - 0x1488]
mov dword [esp + 0xc], ecx
cmp eax, ecx
mov dword [esp + 8], eax
sete al
mov dword [esp + 4], str.wrong_base__p__p_n
movzx eax, al
mov dword [esp], eax
call fcn.0050e8b0
mov dword [esp], 0x5eeb49
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
sub esp, 4
mov dword [esp + 4], str.RtlUserThreadStart
mov dword [esp], eax
mov ecx, dword [ebp - 0x1a14]
call ecx
sub esp, 8
mov ebx, eax
test eax, eax
je 0x51f134
mov eax, 0xf60
call fcn.0050dc60
mov dword [esp + 0xc], ebx
mov eax, dword [ebp - 0x1a1c]
mov dword [esp + 4], str.wrong_start_addr__p____p_n
cmp eax, ebx
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0050e8b0
mov eax, 0xf62
call fcn.0050dc60
mov eax, dword [ebp - 0x1a00]
add eax, dword [ebp - 0x193c]
mov dword [esp + 8], esi
cmp eax, esi
mov dword [esp + 0xc], eax
sete al
mov dword [esp + 4], str.wrong_entry_point__p__p_n
movzx eax, al
mov dword [esp], eax
call fcn.0050e8b0
mov eax, 0xf66
call fcn.0050dc60
mov eax, dword [ebp - 0x1484]
mov dword [esp + 4], str.LdrData_set__p_n
test eax, eax
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0050e8b0
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0xf67
mov eax, dword [ebp - 0x1474]
mov dword [esp + 4], str.FastPebLock_set__p_n
test eax, eax
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0050e8b0
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0xf68
mov eax, dword [ebp - 0x1450]
mov dword [esp + 4], str.TlsBitmap_set__p_n
test eax, eax
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0050e8b0
mov eax, 0xf69
call fcn.0050dc60
mov eax, dword [ebp - 0x1340]
mov dword [esp + 4], str.TlsExpansionBitmap_set__p_n
test eax, eax
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0050e8b0
mov eax, 0xf6a
call fcn.0050dc60
mov eax, dword [ebp - 0x13f0]
mov dword [esp + 4], str.LoaderLock_set__p_n
test eax, eax
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0050e8b0
mov eax, 0xf6b
call fcn.0050dc60
mov eax, dword [ebp - 0x1478]
mov dword [esp + 4], str.ProcessHeap_set__p_n
test eax, eax
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0050e8b0
mov eax, 0xf6c
call fcn.0050dc60
mov ebx, dword [ebp - 0x129c]
test ebx, ebx
je 0x51fae0
mov eax, ebx
shr eax, 0x10
je 0x51fab0
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
sub esp, 8
test eax, eax
jne 0x51fad0
mov eax, ebx
call fcn.0050dc80
mov ebx, dword [ebp - 0x129c]
mov dword [esp + 8], eax
xor eax, eax
test ebx, ebx
sete al
mov dword [esp + 4], str.CSDVersion_set__s_n
mov dword [esp], eax
call fcn.0050e8b0
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0xf6e
mov eax, dword [ebp - 0x13ec]
mov dword [esp + 4], str.OSMajorVersion_not_set__lu_n
mov dword [esp + 8], eax
cmp dword [edi + 0xa4], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0050e8b0
mov eax, 0xf6f
call fcn.0050dc60
mov eax, dword [ebp - 0x13e0]
mov dword [esp + 4], str.OSPlatformId_not_set__lu_n
mov dword [esp + 8], eax
cmp dword [edi + 0xb0], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0050e8b0
mov eax, 0xf70
call fcn.0050dc60
mov eax, dword [ebp - 0x12bc]
mov dword [esp + 4], str.SessionId_not_set__lu_n
mov dword [esp + 8], eax
cmp dword [edi + 0x1d4], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0050e8b0
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0xf71
mov eax, dword [ebp - 0x141c]
mov edx, dword [ebp - 0x1420]
test eax, eax
je 0x51f9e0
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], 0x5f24b8
call fcn.0050da50
mov dword [esp + 8], eax
lea ebx, [ebp - 0x19ec]
lea esi, [ebp - 0x1010]
mov dword [esp + 4], str.CriticalSectionTimeout_not_set__s_n
mov eax, dword [ebp - 0x1420]
mov dword [esp], eax
call fcn.0050e8b0
mov eax, 0xf73
call fcn.0050dc60
mov eax, dword [ebp - 0x1418]
mov dword [esp + 4], str.HeapSegmentReserve_not_set__Iu_n
mov dword [esp + 8], eax
cmp dword [edi + 0x78], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0050e8b0
mov eax, 0xf75
call fcn.0050dc60
mov eax, dword [ebp - 0x1414]
mov dword [esp + 4], str.HeapSegmentCommit_not_set__Iu_n
mov dword [esp + 8], eax
cmp dword [edi + 0x7c], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0050e8b0
mov eax, 0xf77
call fcn.0050dc60
mov eax, dword [ebp - 0x1410]
mov dword [esp + 4], str.HeapDeCommitTotalFreeThreshold_not_set__Iu_n
mov dword [esp + 8], eax
cmp dword [edi + 0x80], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0050e8b0
mov eax, 0xf79
call fcn.0050dc60
mov eax, dword [ebp - 0x140c]
mov dword [esp + 4], str.HeapDeCommitFreeBlockThreshold_not_set__Iu_n
mov dword [esp + 8], eax
cmp dword [edi + 0x84], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0050e8b0
mov eax, dword [0x850144]
test eax, eax
je 0x51f7ab
lea ebx, [ebp - 0x19ec]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x1c
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov edx, dword [ebp - 0x19f8]
mov dword [esp], edx
call eax
sub esp, 0x14
mov esi, eax
mov eax, 0xf82
call fcn.0050dc60
xor eax, eax
test esi, esi
mov dword [esp + 8], esi
sete al
mov dword [esp + 4], str.NtQueryInformationProcess_failed__lx_n
lea esi, [ebp - 0x1010]
mov dword [esp], eax
call fcn.0050e8b0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x1000
mov dword [esp + 8], esi
mov eax, dword [ebp - 0x19e8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x19fc]
mov dword [esp], eax
mov eax, dword [ebp - 0x1a10]
call eax
sub esp, 0x14
mov edi, eax
mov eax, 0xf84
call fcn.0050dc60
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 4], str.Failed_to_read_TEB___lu__n
mov dword [esp], edi
mov dword [esp + 8], eax
call fcn.0050e8b0
mov eax, 0xf86
call fcn.0050dc60
mov ecx, dword [ebp - 0x1a0c]
mov eax, dword [ebp - 0xfe0]
mov dword [esp + 4], str.wrong_Peb__p____p_n
cmp eax, ecx
mov dword [esp + 8], eax
sete al
mov dword [esp + 0xc], ecx
movzx eax, al
mov dword [esp], eax
call fcn.0050e8b0
mov eax, 0xf87
call fcn.0050dc60
mov edx, dword [ebp - 0x19f4]
mov eax, dword [ebp - 0xff0]
mov dword [esp + 4], str.wrong_pid__lx____lx_n
cmp edx, eax
mov dword [esp + 8], eax
sete al
mov dword [esp + 0xc], edx
movzx eax, al
mov dword [esp], eax
call fcn.0050e8b0
mov eax, 0xf89
call fcn.0050dc60
mov edx, dword [ebp - 0x19f0]
mov eax, dword [ebp - 0xfec]
mov dword [esp + 4], str.wrong_tid__lx____lx_n
cmp edx, eax
mov dword [esp + 8], eax
sete al
mov dword [esp + 0xc], edx
movzx eax, al
mov dword [esp], eax
call fcn.0050e8b0
mov eax, 0xf8b
call fcn.0050dc60
mov edx, dword [ebp - 0x19f4]
mov eax, dword [ebp - 0x95c]
mov dword [esp + 4], str.wrong_real_pid__lx____lx_n
cmp edx, eax
mov dword [esp + 8], eax
sete al
mov dword [esp + 0xc], edx
movzx eax, al
mov dword [esp], eax
call fcn.0050e8b0
mov eax, 0xf8d
call fcn.0050dc60
mov edx, dword [ebp - 0x19f0]
mov eax, dword [ebp - 0x958]
mov dword [esp + 4], str.wrong_real_tid__lx____lx_n
cmp edx, eax
mov dword [esp + 8], eax
sete al
mov dword [esp + 0xc], edx
movzx eax, al
mov dword [esp], eax
call fcn.0050e8b0
mov eax, 0xf8f
call fcn.0050dc60
movzx edx, word [ebp - 0x416]
mov dword [esp + 4], str.StaticUnicodeString.MaximumLength_wrong__x_n
cmp dx, 0x20a
mov dword [esp + 8], edx
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0050e8b0
mov eax, 0xf91
call fcn.0050dc60
mov edx, dword [ebp - 0x414]
mov dword [esp + 4], str.StaticUnicodeString.Buffer_wrong__p_n
mov dword [esp + 8], edx
mov eax, dword [ebp - 0x19e8]
add eax, 0xc00
cmp edx, eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0050e8b0
mov eax, 0xf94
call fcn.0050dc60
mov eax, dword [ebp - 0xf4c]
mov dword [esp + 4], str.CurrentLocale_set__lx_n
test eax, eax
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0050e8b0
mov eax, 0xf95
call fcn.0050dc60
mov eax, dword [ebp - 0x100]
mov dword [esp + 4], str.TlsLinks.Flink_set__p_n
test eax, eax
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0050e8b0
mov eax, 0xf96
call fcn.0050dc60
mov eax, dword [ebp - 0xfc]
mov dword [esp + 4], str.TlsLinks.Blink_set__p_n
test eax, eax
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0050e8b0
mov eax, 0xf97
call fcn.0050dc60
mov eax, dword [ebp - 0x7c]
mov dword [esp + 4], str.TlsExpansionSlots_set__p_n
test eax, eax
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0050e8b0
mov eax, 0xf98
call fcn.0050dc60
mov eax, dword [ebp - 0x5c]
mov dword [esp + 4], str.FlsSlots_set__p_n
test eax, eax
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0050e8b0
lea eax, [ebp - 0x175c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x19f8]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_SetThreadContext]
sub esp, 8
mov edi, eax
mov eax, 0xf9c
call fcn.0050dc60
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x34]
mov dword [ebp - 0x1a08], edx
mov dword [esp], edi
mov edi, 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.Failed_to_set_remote_thread_context___ld__n
call fcn.0050e8b0
mov eax, dword [ebp - 0x19f8]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_ResumeThread]
sub esp, 4
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x1a04]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_ConnectNamedPipe]
sub esp, 8
test eax, eax
jne 0x51f840
mov edx, dword [ebp - 0x1a08]
xor eax, eax
cmp dword [edx + 0x34], 0x217
sete al
mov edi, eax
mov eax, 0xfa1
call fcn.0050dc60
mov dword [esp], edi
mov dword [esp + 4], str.Pipe_did_not_connect_n
mov edi, dword fs:[0x18]
call fcn.0050e8b0
mov dword [esp + 0xc], esi
mov dword [esp + 4], ebx
mov dword [esp + 0x10], 0
mov dword [esp + 8], 4
mov eax, dword [ebp - 0x1a04]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_ReadFile]
sub esp, 0x14
mov dword [ebp - 0x1a08], eax
mov eax, 0xfa4
call fcn.0050dc60
mov eax, dword [edi + 0x34]
mov dword [esp + 4], str.Failed_to_read_buffer_from_pipe___ld__n
mov dword [esp + 8], eax
mov edx, dword [ebp - 0x1a08]
mov dword [esp], edx
call fcn.0050e8b0
mov eax, 0xfa6
call fcn.0050dc60
mov dword [esp + 4], str.Did_not_get_the_correct_magic_from_the_remote_process_n
xor eax, eax
cmp dword [ebp - 0x19ec], 0x454e4957
sete al
mov dword [esp], eax
call fcn.0050e8b0
mov edx, dword [ebp - 0x1a00]
mov eax, dword [ebp - 0x19fc]
lea ecx, [ebp - 0x1964]
call fcn.0051e180
mov dword [ebp - 0x1a00], eax
mov eax, 0xfad
call fcn.0050dc60
mov dword [esp + 4], str.EXE_IAT_is_not_resolved_n
mov edx, dword [ebp - 0x1a00]
mov dword [esp], edx
call fcn.0050e8b0
mov dword [esp + 4], ebx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], esi
mov dword [esp + 8], 4
mov esi, dword [ebp - 0x1a04]
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_WriteFile]
sub esp, 0x14
mov ebx, eax
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0xfb0
mov eax, dword [edi + 0x34]
mov dword [esp], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], str.Failed_to_write_the_magic_back_to_the_pipe___ld__n
call fcn.0050e8b0
mov ebx, dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [esp], esi
call ebx
sub esp, 4
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x19fc]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
sub esp, 8
mov dword [esp + 4], 0x2710
mov eax, dword [ebp - 0x19fc]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x19fc]
sub esp, 8
mov dword [esp], eax
call ebx
mov eax, dword [ebp - 0x19f8]
sub esp, 4
mov dword [esp], eax
call ebx
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
lea esp, [edi - 8]
pop edi
ret
mov dword [esp + 4], edx
mov dword [esp], 0x5f24c1
call fcn.0050da50
jmp 0x51f3bb
mov eax, 0xf3e
call fcn.0050dc60
mov eax, dword [ebp - 0x16b0]
mov dword [esp + 4], str.ecx_is_not_zero__08lx_n
test eax, eax
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0050e8b0
mov eax, 0xf3f
call fcn.0050dc60
mov eax, dword [ebp - 0x16b4]
mov dword [esp + 4], str.edx_is_not_zero__08lx_n
test eax, eax
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0050e8b0
mov eax, 0xf40
call fcn.0050dc60
mov eax, dword [ebp - 0x16bc]
mov dword [esp + 4], str.esi_is_not_zero__08lx_n
test eax, eax
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0050e8b0
mov eax, 0xf41
call fcn.0050dc60
mov eax, dword [ebp - 0x16c0]
mov dword [esp + 4], str.edi_is_not_zero__08lx_n
test eax, eax
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0050e8b0
jmp 0x51eeb4
movzx ebx, bx
mov dword [esp], 0x5efdfe
mov dword [esp + 4], ebx
call fcn.0050da50
mov ebx, dword [ebp - 0x129c]
jmp 0x51f2ce
mov ebx, dword [ebp - 0x129c]
mov eax, 0x5efcf8
jmp 0x51f2ce
mov eax, 0x5ef8c7
jmp 0x51f2ce