Function at 0x405f00
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create two anonymous pipes
Read file on windows
Read pipe

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x461a76
mov eax, dword fs:[0]
push eax
mov eax, 0x4c90
call fcn.0045db90
mov eax, dword [0x4920c0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x4c78], ecx
cmp byte [ecx + 0x60], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x4c74], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x4c7c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x4c80], eax
je 0x40608a
mov ebx, dword [sym.imp.KERNEL32.DLL_CreatePipe]
push 0
lea eax, [ebp - 0x4c14]
push eax
lea eax, [ebp - 0x4c08]
push eax
lea eax, [ebp - 0x4bfc]
push eax
mov byte [ebp - 0x4c6d], 0
mov dword [ebp - 0x4c04], 0
mov dword [ebp - 0x4c00], 0
mov dword [ebp - 0x4bfc], 0
mov dword [ebp - 0x4c08], 0
mov dword [ebp - 0x4c14], 0xc
mov dword [ebp - 0x4c0c], 1
mov dword [ebp - 0x4c10], 0
call ebx
test eax, eax
jne 0x405ff9
push dword [ebp - 0x4bfc]
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
call esi
push dword [ebp - 0x4c08]
call esi
mov dword [ebp - 0x4bfc], 0
mov dword [ebp - 0x4c08], 0
jmp 0x406070
mov edi, dword [sym.imp.KERNEL32.DLL_SetHandleInformation]
push 0
push 1
push dword [ebp - 0x4bfc]
call edi
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
test eax, eax
je 0x406056
push 0
lea eax, [ebp - 0x4c14]
push eax
lea eax, [ebp - 0x4c00]
push eax
lea eax, [ebp - 0x4c04]
push eax
call ebx
test eax, eax
jne 0x4060aa
push dword [ebp - 0x4c04]
call esi
push dword [ebp - 0x4c00]
call esi
mov dword [ebp - 0x4c04], 0
mov dword [ebp - 0x4c00], 0
mov eax, dword [ebp - 0x4bfc]
test eax, eax
je 0x406063
push eax
call esi
mov eax, dword [ebp - 0x4c08]
test eax, eax
je 0x406070
push eax
call esi
mov eax, dword [ebp - 0x4c04]
test eax, eax
je 0x40607d
push eax
call esi
mov eax, dword [ebp - 0x4c00]
test eax, eax
je 0x40608a
push eax
call esi
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0044fdac
mov esp, ebp
pop ebp
ret 0xc
push 0
push 1
push dword [ebp - 0x4c00]
call edi
test eax, eax
je 0x406056
mov edi, dword [ebp - 0x4c78]
cmp dword [edi + 0x18], 8
lea esi, [edi + 4]
jb 0x4060cd
mov eax, dword [esi]
jmp 0x4060cf
mov eax, esi
push dword [ebp - 0x4c74]
push eax
lea eax, [ebp - 0x14c4]
push str.__sdism.exe___s
push eax
call fcn.00409950
add esp, 0x10
cmp dword [edi + 0x44], 0
je 0x40613f
push str.__logpath:_
lea eax, [ebp - 0x14c4]
push 0x800
push eax
call fcn.00451274
lea eax, [edi + 0x34]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x406114
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x14c4]
push 0x800
push eax
call fcn.00451274
push 0x46ba84
lea eax, [ebp - 0x14c4]
push 0x800
push eax
call fcn.00451274
add esp, 0x18
cmp dword [edi + 0x6c], 0
jne 0x40615e
push 0x46ba88
lea eax, [ebp - 0x14c4]
push 0x800
push eax
call fcn.00451274
add esp, 0xc
cmp dword [edi + 0x6c], 1
jne 0x40617d
push str.__loglevel:2
lea eax, [ebp - 0x14c4]
push 0x800
push eax
call fcn.00451274
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x406185
mov esi, dword [esi]
push esi
lea eax, [ebp - 0x4c4]
push 0x1f4
push eax
call fcn.004513ee
push 0x44
xorps xmm0, xmm0
lea eax, [ebp - 0x4c6c]
push 0
push eax
movq qword [ebp - 0x4c24], xmm0
movq qword [ebp - 0x4c1c], xmm0
call fcn.00455910
mov eax, dword [ebp - 0x4c08]
mov dword [ebp - 0x4c2c], eax
mov dword [ebp - 0x4c30], eax
mov eax, dword [ebp - 0x4c04]
add esp, 0x18
mov dword [ebp - 0x4c34], eax
xor eax, eax
mov word [ebp - 0x4c3c], ax
lea eax, [ebp - 0x4c24]
push eax
lea eax, [ebp - 0x4c6c]
push eax
lea eax, [ebp - 0x4c4]
push eax
push 0
push dword [edi + 0x68]
lea eax, [ebp - 0x14c4]
push 1
push 0
push 0
push eax
push 0
mov dword [ebp - 0x4c6c], 0x44
mov dword [ebp - 0x4c40], 0x101
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
mov ebx, dword [sym.imp.KERNEL32.DLL_CloseHandle]
test eax, eax
je 0x40664a
xor eax, eax
xor esi, esi
push esi
mov word [ebp - 0x3bd4], ax
mov dword [ebp - 0x4c74], eax
mov dword [ebp - 0x4bdc], eax
mov dword [ebp - 0x4be0], eax
mov dword [ebp - 0x4bd8], eax
lea eax, [ebp - 0x4bd8]
push eax
push esi
push 0x1000
push esi
push dword [ebp - 0x4bfc]
call dword [sym.imp.KERNEL32.DLL_PeekNamedPipe]
cmp dword [ebp - 0x4bd8], 0
mov dword [ebp - 0x4bdc], 0
jbe 0x4062a7
push 0
lea eax, [ebp - 0x4bdc]
push eax
push 0x1000
lea eax, [ebp - 0x4bd4]
push eax
push dword [ebp - 0x4bfc]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
xor ebx, ebx
cmp dword [ebp - 0x4bdc], ebx
jle 0x4065a9
jmp 0x4062c0
cmp byte [ebp + ebx - 0x4bd4], 0xa
jne 0x406582
add esi, esi
cmp esi, 0x2710
jae 0x406645
xor eax, eax
mov word [ebp + esi - 0x3bd4], ax
mov dword [ebp - 0x4c84], 7
mov dword [ebp - 0x4c88], eax
mov word [ebp - 0x4c98], ax
cmp word [ebp - 0x3bd4], ax
jne 0x40630a
xor ecx, ecx
jmp 0x406322
lea ecx, [ebp - 0x3bd4]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x406313
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x3bd4]
push eax
lea ecx, [ebp - 0x4c98]
call fcn.004023a0
lea eax, [ebp - 0x4c98]
push eax
lea ecx, [edi + 0x80]
mov dword [ebp - 4], 0
call fcn.00408fe0
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x4c84], 8
jb 0x40636c
push dword [ebp - 0x4c98]
call fcn.00450920
add esp, 4
lea eax, [ebp - 0x3bd4]
push 0x1388
push eax
call fcn.00451b0d
xor eax, eax
add esp, 8
mov dword [ebp - 0x4be4], 7
mov dword [ebp - 0x4be8], 0
mov word [ebp - 0x4bf8], ax
cmp word [ebp - 0x3bd4], ax
jne 0x4063aa
xor ecx, ecx
jmp 0x4063c2
lea ecx, [ebp - 0x3bd4]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4063b3
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x3bd4]
push eax
lea ecx, [ebp - 0x4bf8]
call fcn.004023a0
push 5
push ecx
push str..inf:
lea ecx, [ebp - 0x4bf8]
mov dword [ebp - 4], 1
call fcn.00409230
mov esi, eax
cmp esi, 0xffffffff
jne 0x406414
push 5
push ecx
push 0x46bde4
lea ecx, [ebp - 0x4bf8]
call fcn.00409230
mov esi, eax
cmp esi, 0xffffffff
je 0x406559
xor eax, eax
push 0xc6
push eax
mov word [ebp - 0xdc], ax
lea eax, [ebp - 0xda]
push eax
call fcn.00455910
lea ecx, [esi*2 + 8]
add esp, 0xc
mov eax, esi
cmp ecx, 0x2710
jae 0x406645
xor edx, edx
mov word [ebp + ecx - 0x3bd4], dx
test esi, esi
jle 0x40647a
jmp 0x406460
movzx ecx, word [ebp + eax*2 - 0x3bd4]
cmp ecx, 0x3a
je 0x406479
cmp ecx, 0x5c
je 0x406479
dec eax
test eax, eax
jg 0x406460
jmp 0x40647a
inc eax
test eax, eax
jne 0x4064a2
test esi, esi
jle 0x4064a2
cmp word [ebp + eax*2 - 0x3bd4], 0x2d
jne 0x406498
cmp word [ebp + eax*2 - 0x3bd2], 0x20
je 0x40649f
inc eax
cmp eax, esi
jl 0x406482
jmp 0x4064a2
add eax, 2
xor ecx, ecx
cmp eax, esi
cmove eax, ecx
lea esi, [ebp - 0x3bd4]
lea eax, [esi + eax*2]
push eax
lea eax, [ebp - 0xdc]
push 0x64
push eax
call fcn.004513ee
mov esi, dword [ebp - 0x4c74]
inc esi
push 0x44
mov dword [ebp - 0x4c74], esi
call fcn.00450970
add esp, 0x10
test eax, eax
je 0x4064f9
push 0xe
push ecx
push dword [ebp - 0x4c7c]
mov ecx, dword [ebp - 0x4c80]
add ecx, esi
push ecx
mov ecx, eax
call fcn.00403970
mov esi, eax
jmp 0x4064fb
xor esi, esi
push 0xf
push str.Adding_driver:
lea ecx, [esi + 4]
call fcn.004023a0
cmp word [ebp - 0xdc], 0
jne 0x406518
xor ecx, ecx
jmp 0x406530
lea ecx, [ebp - 0xdc]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x406521
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0xdc]
push eax
lea ecx, [esi + 4]
call fcn.00409480
mov edi, dword [ebp - 0x4c78]
push 0
mov eax, dword [edi + 0x7c]
push esi
push 0x8064
push dword [eax]
call dword [sym.imp.USER32.dll_PostMessageW]
xor eax, eax
xor esi, esi
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x4be4], 8
mov word [ebp - 0x3bd4], ax
jb 0x406582
push dword [ebp - 0x4bf8]
call fcn.00450920
add esp, 4
mov al, byte [ebp + ebx - 0x4bd4]
cmp al, 0xd
je 0x40659c
cmp al, 0xa
je 0x40659c
cbw
mov word [ebp + esi*2 - 0x3bd4], ax
inc esi
inc ebx
cmp ebx, dword [ebp - 0x4bdc]
jl 0x4062c0
lea eax, [ebp - 0x4be0]
push eax
push dword [ebp - 0x4c24]
call dword [sym.imp.KERNEL32.DLL_GetExitCodeProcess]
push 0
lea eax, [ebp - 0x4bd8]
push eax
push 0
push 0x1000
push 0
push dword [ebp - 0x4bfc]
mov dword [ebp - 0x4bd8], 0
call dword [sym.imp.KERNEL32.DLL_PeekNamedPipe]
mov eax, dword [ebp - 0x4be0]
cmp eax, 0x103
jne 0x40661a
cmp dword [ebp - 0x4bd8], 0
jne 0x406273
push 0xfa
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov eax, dword [ebp - 0x4be0]
cmp eax, 0x103
je 0x406273
cmp dword [ebp - 0x4bd8], 0
ja 0x406273
push dword [ebp - 0x4c24]
mov ebx, dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [edi + 0x8c], eax
call ebx
push dword [ebp - 0x4c20]
call ebx
jmp 0x406651
call fcn.0045119a
mov byte [ebp - 0x4c6d], 1
mov eax, dword [ebp - 0x4bfc]
test eax, eax
je 0x40665e
push eax
call ebx
mov eax, dword [ebp - 0x4c08]
test eax, eax
je 0x40666b
push eax
call ebx
mov eax, dword [ebp - 0x4c04]
test eax, eax
je 0x406678
push eax
call ebx
mov eax, dword [ebp - 0x4c00]
test eax, eax
je 0x406685
push eax
call ebx
cmp byte [ebp - 0x4c6d], 0
sete al
jmp 0x40608c