Function at 0x4366e0
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Read file on windows
Read pipe

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e6caa
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x5e0
mov eax, dword [0x52406c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov dword [ebp - 0x5d4], ecx
mov dword [ebp - 0x5bc], 0
mov dword [ebp - 4], 0
xorps xmm0, xmm0
mov dword [ebp - 0x468], 0
movq qword [ebp - 0x470], xmm0
mov dword [ebp - 0x470], 0
mov dword [ebp - 0x46c], 0
mov dword [ebp - 0x468], 0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x464]
push 1
xor eax, eax
mov dword [ebp - 0x454], 0
push 0x506170
mov dword [ebp - 0x450], 7
mov word [ebp - 0x464], ax
call fcn.00432030
lea eax, [ebp - 0x464]
mov byte [ebp - 4], 3
push eax
lea edx, [ebp - 0x470]
lea ecx, [ebx + 0x20]
call fcn.004596b0
mov byte [ebp - 4], 2
add esp, 4
mov edx, dword [ebp - 0x450]
cmp edx, 8
jb 0x436800
mov ecx, dword [ebp - 0x464]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4367f6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4373d0
push edx
push ecx
call fcn.0046c951
add esp, 8
lea eax, [ebx + 8]
push eax
lea eax, [ebp - 0x5ec]
push str.wmic
push eax
call fcn.00431080
add esp, 0xc
push 5
push 0x5062fc
mov ecx, eax
mov byte [ebp - 4], 4
call fcn.00430ff0
mov dword [ebp - 0x454], 0
xor ecx, ecx
mov dword [ebp - 0x450], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x464], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x454], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 5
lea eax, [ebx + 0x20]
cmp dword [ebx + 0x34], 8
lea ecx, [ebp - 0x464]
push dword [ebx + 0x30]
cmovae eax, dword [ebx + 0x20]
push eax
call fcn.00430ff0
mov dword [ebp - 0x424], 0
xor ecx, ecx
mov dword [ebp - 0x420], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x434], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x424], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
push 1
push 0x5062f8
lea ecx, [ebp - 0x434]
mov byte [ebp - 4], 6
call fcn.00430ff0
mov dword [ebp - 0x43c], 0
xor ecx, ecx
mov dword [ebp - 0x438], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x44c], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x43c], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 7
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x436926
mov eax, dword [esi]
push dword [esi + 0x10]
lea ecx, [ebp - 0x44c]
push eax
call fcn.00430ff0
mov dword [ebp - 0x478], 0
xor ecx, ecx
mov dword [ebp - 0x474], 0
mov dword [ebp - 0x5c0], 0x1e
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x488], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x478], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 9
mov edx, dword [ebp - 0x438]
cmp edx, 8
jb 0x4369c1
mov ecx, dword [ebp - 0x44c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4369b7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4373d5
push edx
push ecx
call fcn.0046c951
add esp, 8
xor eax, eax
mov dword [ebp - 0x43c], 0
mov dword [ebp - 0x438], 7
mov word [ebp - 0x44c], ax
mov byte [ebp - 4], 0xa
mov edx, dword [ebp - 0x420]
cmp edx, 8
jb 0x436a22
mov ecx, dword [ebp - 0x434]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x436a18
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4373da
push edx
push ecx
call fcn.0046c951
add esp, 8
xor eax, eax
mov dword [ebp - 0x424], 0
mov dword [ebp - 0x420], 7
mov word [ebp - 0x434], ax
mov byte [ebp - 4], 0xb
mov edx, dword [ebp - 0x450]
cmp edx, 8
jb 0x436a83
mov ecx, dword [ebp - 0x464]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x436a79
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4373df
push edx
push ecx
call fcn.0046c951
add esp, 8
xor eax, eax
mov dword [ebp - 0x454], 0
mov dword [ebp - 0x450], 7
mov word [ebp - 0x464], ax
mov byte [ebp - 4], 0xc
mov edx, dword [ebp - 0x5d8]
cmp edx, 8
jb 0x436ae4
mov ecx, dword [ebp - 0x5ec]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x436ada
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4373e4
push edx
push ecx
call fcn.0046c951
add esp, 8
xor eax, eax
mov dword [ebp - 0x5dc], 0
push eax
mov word [ebp - 0x5ec], ax
mov dword [ebp - 0x544], eax
mov dword [ebp - 0x548], eax
mov dword [ebp - 0x560], eax
lea eax, [ebp - 0x564]
push eax
lea eax, [ebp - 0x548]
mov dword [ebp - 0x5d8], 7
push eax
lea eax, [ebp - 0x544]
mov dword [ebp - 0x564], 0xc
push eax
mov dword [ebp - 0x55c], 1
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x436c0c
lea ecx, [ebp - 0x558]
mov dword [ebp - 0x5b0], 0x44
push ecx
lea ecx, [ebp - 0x5b0]
mov dword [ebp - 0x584], 0x101
push ecx
push 0
push 0
xor eax, eax
xorps xmm0, xmm0
cmp dword [ebp - 0x474], 8
push 0
mov word [ebp - 0x576], ax
mov word [ebp - 0x580], ax
mov eax, dword [ebp - 0x548]
push 1
mov dword [ebp - 0x570], eax
mov dword [ebp - 0x574], eax
lea eax, [ebp - 0x488]
cmovae eax, dword [ebp - 0x488]
push 0
push 0
push eax
push 0
movlpd qword [ebp - 0x5ac], xmm0
movlpd qword [ebp - 0x5a4], xmm0
movlpd qword [ebp - 0x59c], xmm0
movlpd qword [ebp - 0x594], xmm0
movlpd qword [ebp - 0x58c], xmm0
movlpd qword [ebp - 0x57e], xmm0
movups xmmword [ebp - 0x558], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x436c56
push dword [ebp - 0x544]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x548]
call esi
mov byte [ebp - 0x5b1], 0
mov edx, dword [ebp - 0x474]
cmp edx, 8
jb 0x437300
mov ecx, dword [ebp - 0x488]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4372f6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4373e9
jmp 0x4372f6
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xffffffffffffffff
push dword [ebp - 0x554]
call esi
push 0xffffffffffffffff
push dword [ebp - 0x558]
call esi
push dword [ebp - 0x558]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x554]
call esi
push 0xb0
lea eax, [ebp - 0x540]
push 0
push eax
call fcn.004bb410
add esp, 4
lea ecx, [ebp - 0x540]
call fcn.004169f0
push 0
lea eax, [ebp - 0x41c]
mov byte [ebp - 4], 0xd
mov edi, dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
push eax
push 0
push 0
push 0
push dword [ebp - 0x544]
mov dword [ebp - 0x41c], 0
call edi
test eax, eax
je 0x436d74
nop word [eax + eax]
mov esi, dword [ebp - 0x41c]
test esi, esi
je 0x436d6e
push 0x400
lea eax, [ebp - 0x418]
push 0
push eax
call fcn.004bb410
add esp, 0xc
lea ecx, [ebp - 0x48c]
mov eax, 0x400
cmp esi, eax
push 0
push ecx
cmovl eax, esi
push eax
lea eax, [ebp - 0x418]
push eax
push dword [ebp - 0x544]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x436d6e
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x530]
push eax
call fcn.00430490
add esp, 8
mov dword [ebp - 0x41c], 0
lea eax, [ebp - 0x41c]
push 0
push eax
push 0
push 0
push 0
push dword [ebp - 0x544]
call edi
test eax, eax
jne 0x436ce0
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x548]
call esi
push dword [ebp - 0x544]
call esi
mov byte [ebp - 0x5b1], 0
mov byte [ebp - 0x5b2], 0
mov dword [ebp - 0x454], 0
mov dword [ebp - 0x450], 0xf
mov byte [ebp - 0x464], 0
lea edx, [ebp - 0x464]
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x540]
call fcn.004390d0
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
test byte [ecx + eax + 0xc], 6
jne 0x4372ac
lea edx, [ebp - 0x464]
lea ecx, [ebp - 0x44c]
call fcn.00434960
sub esp, 0x18
mov byte [ebp - 4], 0xf
mov ecx, esp
push dword [ebp - 0x470]
call fcn.00432310
mov edx, str.__t_n_r_f_v
lea ecx, [ebp - 0x434]
call fcn.00459c10
add esp, 0x18
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x434]
cmp dword [ebp - 0x420], 8
mov edx, dword [ebp - 0x434]
mov eax, dword [ebp - 0x424]
cmovae ecx, edx
lea esi, [ecx + eax*2]
lea eax, [ebp - 0x434]
cmovae eax, edx
lea ecx, [ebp - 0x44c]
cmp dword [ebp - 0x438], 8
mov dword [ebp - 0x5c4], eax
cmovae ecx, dword [ebp - 0x44c]
mov eax, dword [ebp - 0x43c]
lea edi, [ecx + eax*2]
mov eax, esi
lea ecx, [ebp - 0x44c]
cmovae ecx, dword [ebp - 0x44c]
sub eax, dword [ebp - 0x5c4]
sar eax, 1
mov dword [ebp - 0x5b8], eax
mov eax, edi
sub eax, ecx
mov dword [ebp - 0x5c8], ecx
sar eax, 1
cmp eax, dword [ebp - 0x5b8]
jl 0x436f46
mov eax, dword [ebp - 0x5b8]
mov edx, edi
add eax, eax
sub edx, eax
mov dword [ebp - 0x5bc], edx
mov edx, ecx
mov ecx, dword [ebp - 0x5c4]
sub edx, ecx
mov dword [ebp - 0x5b8], edx
mov eax, ecx
mov dword [ebp - 0x5cc], ecx
cmp ecx, esi
je 0x436f3a
movzx ecx, word [eax]
movzx eax, word [edx + eax]
push eax
mov dword [ebp - 0x5d0], ecx
call fcn.004c4969
add esp, 4
mov word [ebp - 0x41a], ax
push dword [ebp - 0x5d0]
call fcn.004c4969
add esp, 4
cmp word [ebp - 0x41a], ax
jne 0x436f0f
mov eax, dword [ebp - 0x5cc]
add eax, 2
mov dword [ebp - 0x5cc], eax
cmp eax, esi
je 0x436f3a
mov edx, dword [ebp - 0x5b8]
jmp 0x436ec0
mov ecx, dword [ebp - 0x5c8]
cmp ecx, dword [ebp - 0x5bc]
je 0x436f40
mov edx, dword [ebp - 0x5b8]
add ecx, 2
mov dword [ebp - 0x5c8], ecx
add edx, 2
mov ecx, dword [ebp - 0x5c4]
jmp 0x436eaa
mov edi, dword [ebp - 0x5c8]
mov edx, dword [ebp - 0x434]
cmp dword [ebp - 0x438], 8
lea ecx, [ebp - 0x44c]
mov eax, dword [ebp - 0x43c]
cmovae ecx, dword [ebp - 0x44c]
lea eax, [ecx + eax*2]
cmp edi, eax
je 0x436fec
mov byte [ebp - 4], 0xf
mov eax, dword [ebp - 0x420]
mov byte [ebp - 0x5b2], 1
cmp eax, 8
jb 0x436fb0
lea ecx, [eax*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x436fa6
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4373d0
push ecx
push edx
call fcn.0046c951
add esp, 8
xor eax, eax
mov byte [ebp - 4], 0xe
mov word [ebp - 0x434], ax
mov eax, dword [ebp - 0x438]
mov dword [ebp - 0x424], 0
mov dword [ebp - 0x420], 7
cmp eax, 8
jb 0x43728b
lea edx, [eax*2 + 2]
jmp 0x43725d
cmp byte [ebp - 0x5b2], 0
je 0x43703d
sub esp, 0x18
lea eax, [ebp - 0x44c]
mov ecx, esp
push eax
call fcn.00432310
mov edx, str.__t_n_r_f_v
lea ecx, [ebp - 0x5ec]
call fcn.00459c10
mov ecx, dword [ebp - 0x5c0]
add esp, 0x18
mov edx, dword [ebp - 0x434]
or ecx, 1
mov dword [ebp - 0x5c0], ecx
cmp dword [eax + 0x10], 0
je 0x437043
mov byte [ebp - 0x419], 0
jmp 0x43704a
mov ecx, dword [ebp - 0x5c0]
mov byte [ebp - 0x419], 1
test cl, 1
je 0x43709e
mov eax, dword [ebp - 0x5d8]
and ecx, 0xfffffffe
mov dword [ebp - 0x5c0], ecx
cmp eax, 8
jb 0x43709e
mov ecx, dword [ebp - 0x5ec]
lea edx, [eax*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x43708e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4373d0
push edx
push ecx
call fcn.0046c951
mov edx, dword [ebp - 0x434]
add esp, 8
cmp byte [ebp - 0x419], 0
je 0x437125
mov byte [ebp - 4], 0xf
mov eax, dword [ebp - 0x420]
cmp eax, 8
jb 0x4370e9
lea ecx, [eax*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4370df
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4373d0
push ecx
push edx
call fcn.0046c951
add esp, 8
xor eax, eax
mov byte [ebp - 4], 0xe
mov word [ebp - 0x434], ax
mov eax, dword [ebp - 0x438]
mov dword [ebp - 0x424], 0
mov dword [ebp - 0x420], 7
cmp eax, 8
jb 0x43728b
lea edx, [eax*2 + 2]
jmp 0x43725d
sub esp, 0x18
mov byte [ebp - 0x5b1], 1
lea eax, [ebp - 0x44c]
mov ecx, esp
push eax
call fcn.00432310
mov edx, str.__t_n_r_f_v
lea ecx, [ebp - 0x5ec]
call fcn.00459c10
add esp, 0x18
mov edx, dword [ebp - 0x5d4]
mov byte [ebp - 4], 0x11
mov ecx, dword [edx + 4]
cmp dword [edx + 8], ecx
je 0x437199
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [ecx], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ecx + 0x10], xmm0
xor ecx, ecx
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
add dword [edx + 4], 0x18
jmp 0x4371a2
push eax
push ecx
mov ecx, edx
call fcn.0041c120
mov byte [ebp - 4], 0x10
mov edx, dword [ebp - 0x5d8]
cmp edx, 8
jb 0x4371e6
mov ecx, dword [ebp - 0x5ec]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4371dc
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4373d0
push edx
push ecx
call fcn.0046c951
add esp, 8
mov byte [ebp - 4], 0xf
mov edx, dword [ebp - 0x420]
cmp edx, 8
jb 0x43722a
mov ecx, dword [ebp - 0x434]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x437220
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4373d0
push edx
push ecx
call fcn.0046c951
add esp, 8
xor eax, eax
mov byte [ebp - 4], 0xe
mov edx, dword [ebp - 0x438]
mov dword [ebp - 0x424], 0
mov dword [ebp - 0x420], 7
mov word [ebp - 0x434], ax
cmp edx, 8
jb 0x43728b
lea edx, [edx*2 + 2]
mov ecx, dword [ebp - 0x44c]
mov eax, ecx
cmp edx, 0x1000
jb 0x437281
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4373d0
push edx
push ecx
call fcn.0046c951
add esp, 8
lea edx, [ebp - 0x464]
lea ecx, [ebp - 0x540]
call fcn.004390d0
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
test byte [ecx + eax + 0xc], 6
je 0x436dd2
mov edx, dword [ebp - 0x450]
cmp edx, 0x10
jb 0x4372e6
mov ecx, dword [ebp - 0x464]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4372dc
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4373ee
push edx
push ecx
call fcn.0046c951
add esp, 8
lea ecx, [ebp - 0x540]
call fcn.0040d460
jmp 0x436c13
push edx
push ecx
call fcn.0046c951
add esp, 8
xor eax, eax
mov dword [ebp - 0x478], 0
lea ecx, [ebp - 0x470]
mov dword [ebp - 0x474], 7
mov word [ebp - 0x488], ax
call fcn.00417f00
mov edx, dword [ebx + 0x1c]
cmp edx, 8
jb 0x437362
mov ecx, dword [ebx + 8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x437358
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4373f3
push edx
push ecx
call fcn.0046c951
add esp, 8
mov edx, dword [ebx + 0x34]
xor eax, eax
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x1c], 7
mov word [ebx + 8], ax
cmp edx, 8
jb 0x4373ac
mov ecx, dword [ebx + 0x20]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4373a2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4373f8
push edx
push ecx
call fcn.0046c951
add esp, 8
mov al, byte [ebp - 0x5b1]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0046c93b
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.004be3cc
call fcn.004be3cc
call fcn.004be3cc
call fcn.004be3cc
call fcn.004be3cc
call fcn.004be3cc
call fcn.004be3cc
call fcn.004be3cc
call fcn.004be3cc
int3