Function at 0x40b990
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Read file on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56a2ba
mov eax, dword fs:[0]
push eax
mov eax, 0x1084
call fcn.00547710
mov eax, dword [0x5cce5c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
lea eax, [ebp - 0x1038]
mov dword [ebp - 0x1018], 0
push eax
lea eax, [ebp - 0x1024]
mov dword [ebp - 0x1024], 0
push eax
lea eax, [ebp - 0x1018]
mov dword [ebp - 0x1038], 0xc
push eax
mov dword [ebp - 0x1030], 1
mov dword [ebp - 0x1034], 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x40bee2
push 0
push 1
push dword [ebp - 0x1018]
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x40beec
xor eax, eax
mov dword [ebp - 0x108c], 0x44
xorps xmm0, xmm0
mov word [ebp - 0x1052], ax
mov eax, dword [ebp - 0x1024]
xor ecx, ecx
mov dword [ebp - 0x1050], eax
or ecx, 0x101
mov dword [ebp - 0x104c], eax
xor eax, eax
push str._c__C:WindowsSysNativemanage_bde.exe__status_
movups xmmword [ebp - 0x1048], xmm0
mov dword [ebp - 0x1060], ecx
movlpd qword [ebp - 0x1088], xmm0
movlpd qword [ebp - 0x1080], xmm0
movlpd qword [ebp - 0x1078], xmm0
movlpd qword [ebp - 0x1070], xmm0
movlpd qword [ebp - 0x1068], xmm0
movlpd qword [ebp - 0x105a], xmm0
mov word [ebp - 0x105c], ax
call fcn.0054c0b5
add esp, 4
test eax, eax
je 0x40be67
lea ecx, [ebp - 0x1048]
push ecx
lea ecx, [ebp - 0x108c]
push ecx
push 0
push 0
push 0x8000000
push 1
push 0
push 0
push eax
push str.C:WindowsSystem32cmd.exe
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40be67
push dword [ebp - 0x1048]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x1044]
call esi
push dword [ebp - 0x1024]
call esi
lea ecx, [ebp - 0x1020]
mov byte [ebp - 0x1011], 0
mov byte [ebp - 0x1012], 0
call fcn.00405c30
lea ecx, [ebp - 0x101c]
mov dword [ebp - 4], 0
call fcn.00405c30
push 0x1000
lea eax, [ebp - 0x1010]
mov byte [ebp - 4], 1
push 0
push eax
call fcn.00549170
add esp, 0xc
lea eax, [ebp - 0x1028]
push 0
push eax
push 0x1000
lea eax, [ebp - 0x1010]
push eax
push dword [ebp - 0x1018]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, dword [ebp - 0x1020]
or edi, 0xffffffff
test eax, eax
je 0x40bddd
cmp dword [ebp - 0x1028], 0
je 0x40bdda
lea eax, [ebp - 0x1010]
push eax
lea eax, [ebp - 0x1020]
push 0x57ef88
push eax
call fcn.00406040
mov esi, dword [ebp - 0x1020]
lea eax, [ebp - 0x101c]
push esi
push str.MANAGE_BDE:__s
push eax
call fcn.00406040
mov eax, dword [ebp - 0x101c]
add esp, 0x14
add eax, 0xfffffff0
mov edi, esp
mov dword [ebp - 0x102c], edi
push eax
call fcn.004027a0
add esp, 4
add eax, 0x10
mov dword [edi], eax
call fcn.0040ac30
add esp, 4
cmp dword [esi - 0xc], 6
jg 0x40bbff
lea eax, [esi - 0x10]
push eax
call fcn.004027a0
add esp, 4
lea edi, [eax + 0x10]
jmp 0x40bc61
mov ecx, dword [esi - 0x10]
test ecx, ecx
je 0x40bc13
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
mov ecx, eax
test ecx, ecx
jne 0x40bc2b
call fcn.0040d988
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 0x10]
call eax
mov ecx, eax
test ecx, ecx
je 0x40bf05
mov eax, dword [ecx]
push 1
push 6
mov eax, dword [eax]
call eax
test eax, eax
je 0x40bf00
cmp dword [eax + 8], 6
lea edi, [eax + 0x10]
jl 0x40bef6
mov dword [edi - 0xc], 6
mov byte [edi + 6], 0
mov eax, dword [esi]
mov dword [edi], eax
mov ax, word [esi + 4]
mov word [edi + 4], ax
push str.ERROR:
push edi
call fcn.00550092
add esp, 8
mov byte [ebp - 4], 1
test eax, eax
sete byte [ebp - 0x1013]
add edi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x40bc94
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [ebp - 0x1013], 0
mov eax, dword [esi - 0xc]
je 0x40bcdc
test eax, eax
js 0x40bd9b
push str.required_resource_was_denied
push esi
call fcn.0055024d
add esp, 8
test eax, eax
je 0x40bd9b
sub eax, esi
js 0x40bd9b
push 0
push 0
push str.Could_not_check_encryption_status:_Insufficient_authorization
call fcn.00412c77
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
test eax, eax
js 0x40bcfd
push str.is_not_recognized_as_an_internal_or_external_command
push esi
call fcn.0055024d
add esp, 8
test eax, eax
je 0x40bcfd
sub eax, esi
cmp eax, 0xffffffff
jne 0x40be44
cmp dword [esi - 0xc], 0
jl 0x40bd9b
push str.Conversion_Status:
push esi
call fcn.0055024d
add esp, 8
test eax, eax
je 0x40bd4e
sub eax, esi
cmp eax, 0xffffffff
je 0x40bd4e
cmp dword [esi - 0xc], 0
jge 0x40bd2b
or eax, 0xffffffff
jmp 0x40bd44
push str.Fully_Encrypted
push esi
call fcn.0055024d
add esp, 8
test eax, eax
jne 0x40bd42
or eax, 0xffffffff
jmp 0x40bd44
sub eax, esi
cmp eax, 0xffffffff
setne byte [ebp - 0x1011]
cmp dword [esi - 0xc], 0
jl 0x40bd9b
push str.Protection_Status:
push esi
call fcn.0055024d
add esp, 8
test eax, eax
je 0x40bd9b
sub eax, esi
cmp eax, 0xffffffff
je 0x40bd9b
cmp dword [esi - 0xc], 0
jge 0x40bd78
or eax, 0xffffffff
jmp 0x40bd91
push str.Protection_On
push esi
call fcn.0055024d
add esp, 8
test eax, eax
jne 0x40bd8f
or eax, 0xffffffff
jmp 0x40bd91
sub eax, esi
cmp eax, 0xffffffff
setne byte [ebp - 0x1012]
push 0x1000
lea eax, [ebp - 0x1010]
push 0
push eax
call fcn.00549170
add esp, 0xc
lea eax, [ebp - 0x1028]
push 0
push eax
push 0x1000
lea eax, [ebp - 0x1010]
push eax
push dword [ebp - 0x1018]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40bb81
or edi, 0xffffffff
push dword [ebp - 0x1018]
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
mov edx, dword [ebp - 0x101c]
mov eax, edi
mov byte [ebp - 4], 0
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
cmp byte [ebp - 0x1011], 0
je 0x40beb6
cmp byte [ebp - 0x1012], 0
je 0x40be87
test eax, eax
jg 0x40be21
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x40be3d
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, 2
jmp 0x40be6c
push dword [ebp - 0x1018]
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
lea ecx, [ebp - 0x101c]
call fcn.004024e0
lea ecx, [ebp - 0x1020]
call fcn.004024e0
mov eax, 3
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0054764d
mov esp, ebp
pop ebp
ret
test eax, eax
jg 0x40be93
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x40beaf
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, 1
jmp 0x40be6c
test eax, eax
jg 0x40bec2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x40bede
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
jmp 0x40be6c
push 0x57ef14
call fcn.0040bf10
push 0x57ef20
call fcn.0040bf10
push 0x80070057
call fcn.00402780
call fcn.00402a80
push 0x80004005
call fcn.00402780
int3