Function at 0x410d70
Capabilities:
Create pipe
Create process on windows
Encode data using xor
Get comspec environment variable
Query environment variable
Read file on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4417ab
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x10b0
call fcn.00440c10
mov eax, dword [0x4af040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov byte [ebp - 0x10a9], dl
mov edi, ecx
mov dword [ebp - 0x101c], edi
mov dword [ebp - 0x101c], edi
mov dword [ebp - 4], 0
xor ecx, ecx
mov dword [ebp - 0x10bc], 0xb
mov dword [ebp - 0x10b8], 0xaae7efe2
mov dword [ebp - 0x10b4], 0xa8e2fee0
mov dword [ebp - 0x10b0], 0x8cabc9a6
nop word [eax + eax]
lea eax, [ecx - 0x7f]
xor byte [ebp + ecx - 0x10b8], al
inc ecx
mov eax, dword [ebp - 0x10bc]
cmp ecx, eax
jb 0x410e00
lea ecx, [ebp - 0x10b8]
mov byte [ebp + eax - 0x10b8], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x410e26
sub ecx, edx
mov eax, closesocket
mov edx, dword [ebx + 0x1c]
sub eax, edx
cmp eax, ecx
jb 0x41128b
cmp dword [ebx + 0x20], 0xf
lea eax, [ebx + 0xc]
push edx
cmova eax, dword [ebx + 0xc]
push eax
push ecx
lea eax, [ebp - 0x10b8]
push eax
push ecx
push dword [ebp - 0x101c]
lea ecx, [ebp - 0x1034]
call fcn.0040de70
mov ecx, dword [ebx + 0x20]
cmp ecx, 0xf
jbe 0x410e9c
mov edx, dword [ebx + 0xc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x410e92
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411026
push ecx
push edx
call fcn.0043ff31
add esp, 8
cmp byte [ebp - 0x10a9], 0
movups xmm0, xmmword [ebp - 0x1034]
movups xmmword [ebx + 0xc], xmm0
movq xmm0, qword [ebp - 0x1024]
movq qword [ebx + 0x1c], xmm0
jne 0x41102c
cmp dword [ebx + 0x20], 0xf
lea esi, [ebx + 0xc]
xorps xmm0, xmm0
cmova esi, dword [ebx + 0xc]
movups xmmword [ebp - 0x109c], xmm0
movlpd qword [ebp - 0x107c], xmm0
movlpd qword [ebp - 0x1074], xmm0
lea ecx, [esi + 1]
movlpd qword [ebp - 0x106c], xmm0
movlpd qword [ebp - 0x1064], xmm0
movlpd qword [ebp - 0x105c], xmm0
movlpd qword [ebp - 0x1054], xmm0
movlpd qword [ebp - 0x104c], xmm0
movlpd qword [ebp - 0x1044], xmm0
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x410f20
sub esi, ecx
inc esi
push esi
call fcn.0044015f
add esp, 4
mov ecx, eax
cmp dword [ebx + 0x20], 0xf
lea eax, [ebx + 0xc]
mov dword [ebp - 0x1088], ecx
cmova eax, dword [ebx + 0xc]
push esi
push eax
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov dword [ebp - 0x1080], 0x44
push str.COMSPEC
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
add esp, 4
mov esi, eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__flushall]
lea eax, [ebp - 0x109c]
push eax
lea eax, [ebp - 0x1080]
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
push dword [ebp - 0x1088]
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x410fc3
push 0xffffffffffffffff
push dword [ebp - 0x109c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x109c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x1098]
call esi
push dword [ebp - 0x1088]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
xorps xmm0, xmm0
movups xmmword [edi], xmm0
mov ecx, edi
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
push 9
push str.NO_OUTPUT
call fcn.0040d7f0
mov ecx, dword [ebx + 0x20]
cmp ecx, 0xf
jbe 0x41126b
mov edx, dword [ebx + 0xc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x411261
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x411261
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push 0
lea eax, [ebp - 0x10a8]
mov dword [ebp - 0x10a8], 0xc
push eax
lea eax, [ebp - 0x108c]
mov dword [ebp - 0x10a0], 1
push eax
lea eax, [ebp - 0x1088]
mov dword [ebp - 0x10a4], 0
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
mov eax, dword [ebp - 0x108c]
lea ecx, [ebp - 0x109c]
push ecx
lea ecx, [ebp - 0x1080]
mov dword [ebp - 0x1040], eax
push ecx
push 0
xorps xmm0, xmm0
mov dword [ebp - 0x1044], eax
push 0
push 0x8000000
push 1
movlpd qword [ebp - 0x1054], xmm0
lea eax, [ebx + 0xc]
or dword [ebp - 0x1054], 0x100
cmp dword [ebx + 0x20], 0xf
push 0
cmova eax, dword [ebx + 0xc]
push 0
push eax
push 0
movlpd qword [ebp - 0x107c], xmm0
movlpd qword [ebp - 0x1074], xmm0
movlpd qword [ebp - 0x106c], xmm0
movlpd qword [ebp - 0x1064], xmm0
movlpd qword [ebp - 0x105c], xmm0
mov dword [ebp - 0x104c], 0
mov dword [ebp - 0x1080], 0x44
mov dword [ebp - 0x1048], 0
movups xmmword [ebp - 0x109c], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push dword [ebp - 0x108c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
mov dword [ebp - 0x1024], 0
movups xmmword [ebp - 0x1034], xmm0
mov dword [ebp - 0x1020], 0xf
mov byte [ebp - 0x1034], 0
push 0
lea eax, [ebp - 0x101c]
mov byte [ebp - 4], 1
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
push eax
push 0xfff
lea eax, [ebp - 0x1018]
push eax
push dword [ebp - 0x1088]
call esi
test eax, eax
je 0x4111d7
nop dword [eax + eax]
mov eax, dword [ebp - 0x101c]
test eax, eax
je 0x4111d7
cmp eax, 0x1000
jae 0x411290
mov byte [ebp + eax - 0x1018], 0
lea ecx, [ebp - 0x1034]
lea eax, [ebp - 0x1018]
push eax
call fcn.0040c440
cmp byte [ebx + 8], 0
je 0x4111b6
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea edx, [ebp - 0x1018]
call fcn.0040cfc0
push 0
lea eax, [ebp - 0x101c]
push eax
push 0xfff
lea eax, [ebp - 0x1018]
push eax
push dword [ebp - 0x1088]
call esi
test eax, eax
jne 0x411170
push dword [ebp - 0x1088]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push 0xffffffffffffffff
push dword [ebp - 0x109c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x1084]
push eax
push dword [ebp - 0x109c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x109c]
call esi
push dword [ebp - 0x1098]
call esi
xorps xmm0, xmm0
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
movups xmm0, xmmword [ebp - 0x1034]
mov dword [edi + 0x14], 0
mov byte [ebp - 0x1034], 0
movups xmmword [edi], xmm0
movq xmm0, qword [ebp - 0x1024]
movq qword [edi + 0x10], xmm0
mov dword [ebp - 0x1024], 0
mov dword [ebp - 0x1020], 0xf
jmp 0x410ff4
push ecx
push edx
call fcn.0043ff31
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0043fbc2
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.00408430
call fcn.00440084
int3