Function at 0x100301b0
Capabilities:
Accept command line arguments
Connect pipe
Create pipe
Create process on windows

Disassembly:
sub esp, 0x17c
push ebx
push ebp
push esi
xor ebx, ebx
push edi
push ebx
call fcn.10030520
mov ebp, eax
mov eax, dword [esp + 0x19c]
add esp, 4
mov dword [ebp + 0x38], eax
mov dword [eax], 1
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov eax, dword [ebp + 0xb4]
cmp eax, ebx
je 0x100301f0
push eax
call fcn.10023af0
add esp, 4
mov eax, dword [esp + 0x190]
push ebx
push 0x10051268
push eax
call fcn.10030bf0
mov dword [ebp + 0xb4], eax
mov eax, dword [esp + 0x1a0]
add esp, 0xc
cmp eax, ebx
je 0x100302a4
call sym.fbclient.dll_gds__thread_exit
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, dword [ebp + 0xb4]
push ebx
push ebx
push 3
push ebx
push ebx
add ecx, 6
push 0xc0000000
push ecx
call edi
cmp eax, 0xffffffff
mov dword [ebp + 0x3c], eax
jne 0x10030281
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0xe7
jne 0x1003026c
mov edx, dword [ebp + 0xb4]
push 0xbb8
add edx, 6
push edx
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
jmp 0x10030226
call sym.fbclient.dll_gds__thread_enter
push esi
push 0x14000192
push 0x10051270
jmp 0x1003046e
call sym.fbclient.dll_gds__thread_enter
mov eax, dword [esp + 0x194]
push eax
push ebp
call fcn.10030dd0
add esp, 8
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x17c
ret
call fcn.1000d180
mov dword [esp + 0x10], eax
call sym.fbclient.dll_gds__thread_exit
mov esi, dword [esp + 0x10]
mov byte [esp + 0x68], bl
mov ecx, dword [esp + 0x10]
mov edx, dword [ebp + 0xb4]
push ecx
push ebx
push 0x800
push 0x800
push 0xff
push ebx
add edx, 6
push 3
push edx
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xffffffff
mov dword [ebp + 0x3c], eax
je 0x1003045c
call edi
cmp eax, 0x78
je 0x1003045c
mov eax, dword [ebp + 0x3c]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x1003031b
call edi
cmp eax, 0x217
jne 0x10030411
test byte [esp + 0x19c], 6
jne 0x10030425
cmp byte [esp + 0x68], bl
jne 0x1003036a
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x68]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x68]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea esi, [esp + ecx + 0x68]
mov ecx, dword [ebp + 0x3c]
push ecx
push str.__s__w__h__ld
push esi
call dword [sym.imp.MSVCRT.dll_sprintf]
mov ecx, dword [esp + 0x1a8]
add esp, 0xc
and ecx, 0x100
lea edx, [esp + 0x14]
neg ecx
sbb ecx, ecx
lea eax, [esp + 0x24]
push edx
and ecx, 0x60
push eax
push ebx
add ecx, 0x28
push ebx
push ecx
push 1
push ebx
lea edx, [esp + 0x84]
push ebx
push edx
push ebx
mov dword [esp + 0x4c], 0x44
mov dword [esp + 0x50], ebx
mov dword [esp + 0x80], ebx
mov word [esp + 0x7e], bx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x78], 0x80
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test ax, ax
je 0x10030400
mov eax, dword [esp + 0x18]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
mov ecx, dword [esp + 0x14]
push ecx
call edi
mov edx, dword [ebp + 0x3c]
push edx
call edi
jmp 0x100302ba
mov edx, dword [ebp + 0x3c]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call edi
jmp 0x100302ba
call sym.fbclient.dll_gds__thread_enter
call edi
push eax
push 0x14000192
push 0x1005128c
jmp 0x1003046e
call sym.fbclient.dll_gds__thread_enter
mov cl, byte [esp + 0x19c]
or byte [ebp + 0x24], 1
mov ax, word [ebp + 0x24]
test cl, 2
je 0x10030444
or al, 2
mov word [ebp + 0x24], ax
push ebp
push 0x10030bd0
call sym.fbclient.dll_gds__register_cleanup
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x17c
ret
call sym.fbclient.dll_gds__thread_enter
call edi
push eax
push 0x14000193
push 0x1005127c
push ebp
call fcn.10030e90
push ebp
call fcn.10030ab0
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x17c
ret