Function at 0x42bf30
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45ef7e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x84
push dword [ebp + 0xc]
lea eax, [ebp - 0x90]
push dword [ebp + 0x10]
push eax
call fcn.0042bc90
add esp, 0xc
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0
call fcn.0040d2e0
lea eax, [ebp - 0x3c]
mov byte [ebp - 4], 1
push eax
mov dword [ebp - 0x3c], 0
call fcn.0042bdb0
add esp, 4
test eax, eax
je 0x42bfb8
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0
push eax
push dword [ebp - 0x3c]
call sub.ADVAPI32.dll_ConvertSidToStringSidA
test eax, eax
je 0x42bfaf
push dword [ebp - 0x20]
lea ecx, [ebp - 0x38]
call fcn.0040d8d0
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push ebx
push esi
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x3c]
call fcn.0042bee0
push 0x4626b2
mov ecx, eax
call fcn.0040d9e0
lea ecx, [ebp - 0x48]
mov bl, al
call fcn.0040d860
test bl, bl
je 0x42bfeb
xor esi, esi
jmp 0x42c2d5
push str._D__FA___
lea ecx, [ebp - 0x6c]
call fcn.0040d1f0
push str._A__FA___
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 3
call fcn.0040d1f0
push str._A__0x0012019B___
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 4
call fcn.0040d1f0
push str._ML__NW___
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 5
call fcn.0040d1f0
push 0x468c3c
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 6
call fcn.0040d1f0
push 0x468c40
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 7
call fcn.0040d1f0
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 8
push eax
lea ecx, [ebp - 0x3c]
call fcn.0042bee0
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 9
call fcn.0040dde0
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 8
call fcn.0040d860
push 0x468c44
lea ecx, [ebp - 0x1c]
call fcn.0040de90
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x78]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040dde0
push 0x468c48
mov ecx, eax
call fcn.0040de90
push 0xffffffffffffffff
push 0
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, eax
call fcn.0040dde0
push 0x468c4c
lea ecx, [ebp - 0x1c]
call fcn.0040de90
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040dde0
push 0x468c50
mov ecx, eax
call fcn.0040de90
push 0xffffffffffffffff
push 0
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, eax
call fcn.0040dde0
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040dde0
push 0x468c54
mov ecx, eax
call fcn.0040de90
push 0xffffffffffffffff
push 0
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, eax
call fcn.0040dde0
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x3c]
call fcn.0042bee0
mov esi, eax
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x54]
mov byte [ebp - 4], 0xa
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040dde0
push 0xffffffffffffffff
push 0
push esi
mov ecx, eax
call fcn.0040dde0
push 0xffffffffffffffff
push 0
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, eax
call fcn.0040dde0
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 8
call fcn.0040d860
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040dde0
push 0x468c58
mov ecx, eax
call fcn.0040de90
push 0xffffffffffffffff
push 0
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, eax
call fcn.0040dde0
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040dde0
push 0x468c5c
mov ecx, eax
call fcn.0040de90
push 0xffffffffffffffff
push 0
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, eax
call fcn.0040dde0
mov eax, dword [ebp + 0x14]
cmp eax, 1
jne 0x42c276
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x84]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040dde0
push 0x468c60
mov ecx, eax
call fcn.0040de90
push 0xffffffffffffffff
push 0
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, eax
call fcn.0040dde0
lea ecx, [ebp - 0x1c]
call fcn.0040e0a0
push 0
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push ecx
push 1
push eax
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorA
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x42c292
push eax
call dword [sym.imp.ADVAPI32.dll_IsValidSecurityDescriptor]
test eax, eax
je 0x42c292
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x90]
mov dword [ebp - 0x5c], eax
lea eax, [ebp - 0x60]
push eax
push 0
push 0x2000
push 0x2000
push 0xff
push 8
push 0x40000003
mov dword [ebp - 0x60], 0xc
mov dword [ebp - 0x58], 0
call fcn.0040e0a0
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
or ecx, 0xffffffff
test eax, eax
cmove eax, ecx
cmp eax, ecx
je 0x42c282
test eax, eax
je 0x42c282
mov esi, eax
jmp 0x42c294
test eax, eax
je 0x42c1f1
xor esi, esi
jmp 0x42c2a2
xor esi, esi
cmp eax, 0xffffffff
je 0x42c294
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x42c294
xor esi, esi
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x42c2a2
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea ecx, [ebp - 0x1c]
call fcn.0040d860
lea ecx, [ebp - 0x2c]
call fcn.0040d860
lea ecx, [ebp - 0x78]
call fcn.0040d860
lea ecx, [ebp - 0x84]
call fcn.0040d860
lea ecx, [ebp - 0x54]
call fcn.0040d860
lea ecx, [ebp - 0x6c]
call fcn.0040d860
mov eax, dword [ebp - 0x3c]
test eax, eax
je 0x42c2ec
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
lea ecx, [ebp - 0x38]
call fcn.0040d860
lea ecx, [ebp - 0x90]
call fcn.0040d860
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret