Function at 0x405340
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create two anonymous pipes
Read file on windows
Read pipe

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x461aab
mov eax, dword fs:[0]
push eax
mov eax, 0x4ba4
call fcn.0045db90
mov eax, dword [0x4920c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x4bac], ebx
cmp byte [ebx + 0x60], 0
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x4b28], eax
je 0x40550f
push dword [ebp - 0x4bac]
mov edx, dword [ebx + 0x84]
push ecx
mov ecx, dword [ebx + 0x80]
call fcn.004099d0
mov eax, dword [ebx + 0x80]
add esp, 8
mov dword [ebx + 0x84], eax
push dword [ebp - 0x4bac]
mov edx, eax
push ecx
mov ecx, eax
mov dword [ebx + 0x8c], 0
call fcn.004099d0
mov eax, dword [ebx + 0x80]
add esp, 8
mov dword [ebx + 0x84], eax
push 0
lea eax, [ebp - 0x4b48]
push eax
lea eax, [ebp - 0x4b34]
push eax
lea eax, [ebp - 0x4b30]
push eax
mov byte [ebp - 0x4ba1], 0
mov dword [ebp - 0x4b38], 0
mov dword [ebp - 0x4b3c], 0
mov dword [ebp - 0x4b30], 0
mov dword [ebp - 0x4b34], 0
mov dword [ebp - 0x4b48], 0xc
mov dword [ebp - 0x4b40], 1
mov dword [ebp - 0x4b44], 0
call dword [sym.imp.KERNEL32.DLL_CreatePipe]
test eax, eax
jne 0x40547a
push dword [ebp - 0x4b30]
mov edi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
call edi
push dword [ebp - 0x4b34]
call edi
mov dword [ebp - 0x4b30], 0
mov dword [ebp - 0x4b34], 0
jmp 0x4054f5
mov ebx, dword [sym.imp.KERNEL32.DLL_SetHandleInformation]
push 0
push 1
push dword [ebp - 0x4b30]
call ebx
mov edi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
test eax, eax
je 0x4054db
push 0
lea eax, [ebp - 0x4b48]
push eax
lea eax, [ebp - 0x4b3c]
push eax
lea eax, [ebp - 0x4b38]
push eax
call dword [sym.imp.KERNEL32.DLL_CreatePipe]
test eax, eax
jne 0x40552f
push dword [ebp - 0x4b38]
call edi
push dword [ebp - 0x4b3c]
call edi
mov dword [ebp - 0x4b38], 0
mov dword [ebp - 0x4b3c], 0
mov eax, dword [ebp - 0x4b30]
test eax, eax
je 0x4054e8
push eax
call edi
mov eax, dword [ebp - 0x4b34]
test eax, eax
je 0x4054f5
push eax
call edi
mov eax, dword [ebp - 0x4b38]
test eax, eax
je 0x405502
push eax
call edi
mov eax, dword [ebp - 0x4b3c]
test eax, eax
je 0x40550f
push eax
call edi
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044fdac
mov esp, ebp
pop ebp
ret 8
push 0
push 1
push dword [ebp - 0x4b3c]
call ebx
test eax, eax
je 0x4054db
mov ebx, dword [ebp - 0x4bac]
cmp dword [ebx + 0x18], 8
lea edi, [ebx + 4]
jb 0x405552
mov eax, dword [edi]
jmp 0x405554
mov eax, edi
push dword [ebp - 0x4b28]
push eax
lea eax, [ebp - 0x13f8]
push str.__sdism.exe___s
push eax
call fcn.00409950
add esp, 0x10
cmp dword [ebx + 0x44], 0
je 0x4055c7
push str.__logpath:_
lea eax, [ebp - 0x13f8]
push 0x800
push eax
call fcn.00451274
lea eax, [ebx + 0x34]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x405599
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x13f8]
push 0x800
push eax
call fcn.00451274
add esp, 0xc
lea eax, [ebp - 0x13f8]
push 0x46ba84
push 0x800
push eax
call fcn.00451274
add esp, 0xc
cmp dword [ebx + 0x6c], 0
jne 0x4055e6
push 0x46ba88
lea eax, [ebp - 0x13f8]
push 0x800
push eax
call fcn.00451274
add esp, 0xc
cmp dword [ebx + 0x6c], 1
jne 0x405605
push str.__loglevel:2
lea eax, [ebp - 0x13f8]
push 0x800
push eax
call fcn.00451274
add esp, 0xc
cmp dword [edi + 0x14], 8
jb 0x40560d
mov edi, dword [edi]
push edi
lea eax, [ebp - 0x3f8]
push 0x1f4
push eax
call fcn.004513ee
add esp, 0xc
xorps xmm0, xmm0
push 0x44
lea eax, [ebp - 0x4ba0]
push 0
push eax
movq qword [ebp - 0x4b58], xmm0
movq qword [ebp - 0x4b50], xmm0
call fcn.00455910
mov eax, dword [ebp - 0x4b34]
mov dword [ebp - 0x4b60], eax
mov dword [ebp - 0x4b64], eax
mov eax, dword [ebp - 0x4b38]
add esp, 0xc
mov dword [ebp - 0x4b68], eax
xor eax, eax
mov word [ebp - 0x4b70], ax
lea eax, [ebp - 0x4b58]
push eax
lea eax, [ebp - 0x4ba0]
push eax
lea eax, [ebp - 0x3f8]
push eax
push 0
push dword [ebx + 0x68]
lea eax, [ebp - 0x13f8]
push 1
push 0
push 0
push eax
push 0
mov dword [ebp - 0x4ba0], 0x44
mov dword [ebp - 0x4b74], 0x101
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
mov ebx, dword [sym.imp.KERNEL32.DLL_CloseHandle]
test eax, eax
je 0x405e9f
xor eax, eax
mov dword [ebp - 0x4b10], 7
mov dword [ebp - 0x4b14], 0
mov word [ebp - 0x4b24], ax
mov dword [ebp - 4], eax
xor edi, edi
push edi
mov word [ebp - 0x3b08], ax
mov dword [ebp - 0x4b2c], eax
mov dword [ebp - 0x4b28], eax
mov dword [ebp - 0x4bb0], eax
mov dword [ebp - 0x4b0c], eax
lea eax, [ebp - 0x4b0c]
push eax
push edi
push 0x1000
push edi
push dword [ebp - 0x4b30]
call dword [sym.imp.KERNEL32.DLL_PeekNamedPipe]
lea esp, [esp]
xor ecx, ecx
mov dword [ebp - 0x4b2c], ecx
cmp dword [ebp - 0x4b0c], ecx
jbe 0x405756
push ecx
lea eax, [ebp - 0x4b2c]
push eax
push 0x1000
lea eax, [ebp - 0x4b08]
push eax
push dword [ebp - 0x4b30]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov ecx, dword [ebp - 0x4b2c]
xor ebx, ebx
test ecx, ecx
jle 0x405e06
cmp byte [ebp + ebx - 0x4b08], 0xa
jne 0x405de3
add edi, edi
cmp edi, 0x2710
jae 0x405e9a
xor eax, eax
mov word [ebp + edi - 0x3b08], ax
lea eax, [ebp - 0x3b08]
push 0x1388
push eax
call fcn.0045194e
add esp, 8
cmp word [ebp - 0x3b08], 0
jne 0x4057a8
xor ecx, ecx
jmp 0x4057c0
lea ecx, [ebp - 0x3b08]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4057b1
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x3b08]
push eax
lea ecx, [ebp - 0x4b24]
call fcn.004023a0
inc dword [ebp - 0x4bb0]
push 0x18
lea eax, [ebp - 0x3b08]
push str.PROGRAM_FILESTERABYTE
push eax
call fcn.004515f7
add esp, 0xc
test eax, eax
jne 0x4058aa
cmp byte [esi], al
jne 0x405816
push 0xb
push ecx
push str.IMAGEW.EXE
lea ecx, [ebp - 0x4b24]
call fcn.00409230
cmp eax, 0xffffffff
je 0x405816
mov byte [esi], 1
cmp byte [esi + 0x30], 0
jne 0x405838
push 0xc
push ecx
push str.TBIVIEW.EXE
lea ecx, [ebp - 0x4b24]
call fcn.00409230
cmp eax, 0xffffffff
je 0x405838
mov byte [esi + 0x30], 1
cmp byte [esi + 0x60], 0
jne 0x40585a
push 0xd
push ecx
push str.TBIMOUNT.EXE
lea ecx, [ebp - 0x4b24]
call fcn.00409230
cmp eax, 0xffffffff
je 0x40585a
mov byte [esi + 0x60], 1
cmp byte [esi + 0x90], 0
jne 0x405882
push 0xa
push ecx
push str.TBIHD.EXE
lea ecx, [ebp - 0x4b24]
call fcn.00409230
cmp eax, 0xffffffff
je 0x405882
mov byte [esi + 0x90], 1
cmp byte [esi + 0xc0], 0
jne 0x4058aa
push 0xc
push ecx
push str.TBOSDTW.EXE
lea ecx, [ebp - 0x4b24]
call fcn.00409230
cmp eax, 0xffffffff
je 0x4058aa
mov byte [esi + 0xc0], 1
push 0x12
lea eax, [ebp - 0x3b08]
push str.WINDOWSSYSTEM32_
push eax
call fcn.004515f7
add esp, 0xc
test eax, eax
jne 0x4059b6
cmp byte [esi + 0xf0], al
jne 0x405916
mov ecx, str.WINDOWSSYSTEM32TBLAUNCHER.EXE
lea eax, [ebp - 0x3b08]
jmp 0x4058e0
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x405906
test dx, dx
je 0x405902
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x405906
add eax, 4
add ecx, 4
test dx, dx
jne 0x4058e0
xor eax, eax
jmp 0x40590b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x405916
mov byte [esi + 0xf0], 1
cmp byte [esi + 0x150], 0
jne 0x405966
mov ecx, str.WINDOWSSYSTEM32TBWINRE.TXT
lea eax, [ebp - 0x3b08]
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x405956
test dx, dx
je 0x405952
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x405956
add eax, 4
add ecx, 4
test dx, dx
jne 0x405930
xor eax, eax
jmp 0x40595b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x405966
mov byte [esi + 0x150], 1
cmp byte [esi + 0x120], 0
jne 0x4059b6
mov ecx, str.WINDOWSSYSTEM32TBWINPE.TXT
lea eax, [ebp - 0x3b08]
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4059a6
test dx, dx
je 0x4059a2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4059a6
add eax, 4
add ecx, 4
test dx, dx
jne 0x405980
xor eax, eax
jmp 0x4059ab
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4059b6
mov byte [esi + 0x120], 1
cmp byte [esi + 0x1b0], 0
jne 0x405a06
mov ecx, str.SOURCESRECOVERYRECENV.EXE
lea eax, [ebp - 0x3b08]
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4059f6
test dx, dx
je 0x4059f2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4059f6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4059d0
xor eax, eax
jmp 0x4059fb
sbb eax, eax
or eax, 1
test eax, eax
jne 0x405a06
mov byte [esi + 0x1b0], 1
push 0x24
lea eax, [ebp - 0x3b08]
push str.WINDOWSSYSTEM32TERABYTEBUILDVERS_
push eax
call fcn.004515f7
add esp, 0xc
test eax, eax
jne 0x405dd2
cmp byte [esi + 0x1b2], al
jne 0x405a4b
push 0xb
push ecx
push str.IFW_BOOTWIM
lea ecx, [ebp - 0x4b24]
call fcn.00409230
cmp eax, 0xffffffff
je 0x405a4b
mov byte [esi + 0x1b2], 1
cmp dword [esi + 4], 0
jne 0x405a96
push 7
push ecx
push str.IMAGEW_
lea ecx, [ebp - 0x4b24]
call fcn.00409230
cmp eax, 0xffffffff
je 0x405a96
sub esp, 0x18
mov ecx, esp
xor eax, eax
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [ebp - 0x4b24]
push eax
call fcn.004020b0
push esi
call fcn.00408b70
cmp dword [esi + 0x34], 0
jne 0x405ae4
push 8
push ecx
push str.TBIVIEW_
lea ecx, [ebp - 0x4b24]
call fcn.00409230
cmp eax, 0xffffffff
je 0x405ae4
sub esp, 0x18
mov ecx, esp
xor eax, eax
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [ebp - 0x4b24]
push eax
call fcn.004020b0
lea eax, [esi + 0x30]
push eax
call fcn.00408b70
cmp dword [esi + 0x64], 0
jne 0x405b32
push 9
push ecx
push str.TBIMOUNT_
lea ecx, [ebp - 0x4b24]
call fcn.00409230
cmp eax, 0xffffffff
je 0x405b32
sub esp, 0x18
mov ecx, esp
xor eax, eax
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [ebp - 0x4b24]
push eax
call fcn.004020b0
lea eax, [esi + 0x60]
push eax
call fcn.00408b70
cmp dword [esi + 0x94], 0
jne 0x405b86
push 6
push ecx
push str.TBIHD_
lea ecx, [ebp - 0x4b24]
call fcn.00409230
cmp eax, 0xffffffff
je 0x405b86
sub esp, 0x18
mov ecx, esp
xor eax, eax
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [ebp - 0x4b24]
push eax
call fcn.004020b0
lea eax, [esi + 0x90]
push eax
call fcn.00408b70
cmp dword [esi + 0xf4], 0
jne 0x405bda
push 0xb
push ecx
push str.TBLAUNCHER_
lea ecx, [ebp - 0x4b24]
call fcn.00409230
cmp eax, 0xffffffff
je 0x405bda
sub esp, 0x18
mov ecx, esp
xor eax, eax
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [ebp - 0x4b24]
push eax
call fcn.004020b0
lea eax, [esi + 0xf0]
push eax
call fcn.00408b70
cmp dword [esi + 0xc4], 0
jne 0x405c96
push 7
push ecx
push str.TBOSDT_
lea ecx, [ebp - 0x4b24]
call fcn.00409230
cmp eax, 0xffffffff
je 0x405c96
sub esp, 0x18
mov ecx, esp
xor eax, eax
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [ebp - 0x4b24]
push eax
call fcn.004020b0
lea eax, [esi + 0xc0]
push eax
call fcn.00408b70
push ecx
push str._TRIAL
lea ecx, [ebp - 0x4b24]
call fcn.00408f50
cmp eax, 0xffffffff
je 0x405c56
mov dword [esi + 0xec], 0
push ecx
push str._PRO
lea ecx, [ebp - 0x4b24]
call fcn.00408f50
cmp eax, 0xffffffff
je 0x405c76
mov dword [esi + 0xec], 1
push ecx
push str._PROBOOTIT
lea ecx, [ebp - 0x4b24]
call fcn.00408f50
cmp eax, 0xffffffff
je 0x405c96
mov dword [esi + 0xec], 2
cmp dword [esi + 0x154], 0
jne 0x405d0a
push 5
push ecx
push str.WINRE
lea ecx, [ebp - 0x4b24]
call fcn.00409230
cmp eax, 0xffffffff
je 0x405d0a
sub esp, 0x18
mov ecx, esp
xor eax, eax
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [ebp - 0x4b24]
push eax
call fcn.004020b0
lea eax, [esi + 0x150]
push eax
call fcn.00408b70
push ecx
push str.X64_
lea ecx, [ebp - 0x4b24]
call fcn.00408f50
cmp eax, 0xffffffff
je 0x405d0a
mov dword [esi + 0x17c], 1
cmp dword [esi + 0x124], 0
jne 0x405d7e
push 5
push ecx
push str.WINPE
lea ecx, [ebp - 0x4b24]
call fcn.00409230
cmp eax, 0xffffffff
je 0x405d7e
sub esp, 0x18
mov ecx, esp
xor eax, eax
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [ebp - 0x4b24]
push eax
call fcn.004020b0
lea eax, [esi + 0x120]
push eax
call fcn.00408b70
push ecx
push str.X64_
lea ecx, [ebp - 0x4b24]
call fcn.00408f50
cmp eax, 0xffffffff
je 0x405d7e
mov dword [esi + 0x14c], 1
cmp dword [esi + 0x184], 0
jne 0x405dd2
push 8
push ecx
push str.BUILDER_
lea ecx, [ebp - 0x4b24]
call fcn.00409230
cmp eax, 0xffffffff
je 0x405dd2
sub esp, 0x18
mov ecx, esp
xor eax, eax
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [ebp - 0x4b24]
push eax
call fcn.004020b0
lea eax, [esi + 0x180]
push eax
call fcn.00408b70
mov ecx, dword [ebp - 0x4b2c]
xor eax, eax
mov word [ebp - 0x3b08], ax
xor edi, edi
mov al, byte [ebp + ebx - 0x4b08]
cmp al, 0xd
je 0x405dfd
cmp al, 0xa
je 0x405dfd
cbw
mov word [ebp + edi*2 - 0x3b08], ax
inc edi
inc ebx
cmp ebx, ecx
jl 0x405760
lea eax, [ebp - 0x4b28]
push eax
push dword [ebp - 0x4b58]
call dword [sym.imp.KERNEL32.DLL_GetExitCodeProcess]
push 0
lea eax, [ebp - 0x4b0c]
push eax
push 0
push 0x1000
push 0
push dword [ebp - 0x4b30]
mov dword [ebp - 0x4b0c], 0
call dword [sym.imp.KERNEL32.DLL_PeekNamedPipe]
mov eax, dword [ebp - 0x4b28]
cmp eax, 0x103
je 0x405720
cmp dword [ebp - 0x4b0c], 0
ja 0x405720
mov ecx, dword [ebp - 0x4bac]
push dword [ebp - 0x4b58]
mov ebx, dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [ecx + 0x8c], eax
call ebx
push dword [ebp - 0x4b54]
call ebx
cmp dword [ebp - 0x4b10], 8
jb 0x405ea6
push dword [ebp - 0x4b24]
call fcn.00450920
add esp, 4
jmp 0x405ea6
call fcn.0045119a
mov byte [ebp - 0x4ba1], 1
mov eax, dword [ebp - 0x4b30]
test eax, eax
je 0x405eb3
push eax
call ebx
mov eax, dword [ebp - 0x4b34]
test eax, eax
je 0x405ec0
push eax
call ebx
mov eax, dword [ebp - 0x4b38]
test eax, eax
je 0x405ecd
push eax
call ebx
mov eax, dword [ebp - 0x4b3c]
test eax, eax
je 0x405eda
push eax
call ebx
cmp byte [ebp - 0x4ba1], 0
sete al
jmp 0x405511