Function at 0x412f40
Capabilities:
Create pipe
Create process on windows
Get file size

Disassembly:
push 0xffffffffffffffff
push 0x422f5b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x124
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x20], ecx
xor ebx, ebx
lea ecx, [esp + 0x10]
mov dword [esp + 0x13c], ebx
call fcn.00421016
push 0x104
mov byte [esp + 0x140], 1
call sub.MFC42.DLL_operatornew
mov esi, eax
xor eax, eax
mov dword [0x430580], eax
mov ecx, 0x11
mov dword [0x430584], eax
mov edi, 0x430538
mov dword [0x430588], eax
add esp, 4
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x24]
mov dword [0x43058c], eax
call fcn.00421016
lea ecx, [esp + 0x1c]
mov byte [esp + 0x13c], 2
call fcn.00421016
lea ecx, [esp + 0x14]
mov byte [esp + 0x13c], 3
call fcn.00421016
mov ecx, dword [esp + 0x144]
push 0x42eba0
push ecx
mov byte [esp + 0x144], 4
call dword [sym.imp.MSVCRT.dll__mbscmp]
add esp, 8
test eax, eax
jne 0x4130b5
lea ecx, [esp + 0x18]
call fcn.00421016
mov edx, dword [0x43191c]
lea eax, [esp + 0x18]
push edx
push str._s_tw_boot.bin
push eax
mov byte [esp + 0x148], 5
call sub.MFC42.DLL_CString::Format_1
mov ecx, dword [esp + 0x24]
add esp, 0xc
lea edx, [esp + 0x34]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebx
push 0x80
push 3
push ebx
push ebx
lea eax, [esp + 0x48]
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
sub edi, 0x401
push edi
push str._04X
push 0x43051c
call sub.MFC42.DLL_CString::Format_1
add esp, 0xc
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, 0x7530
jbe 0x4130a4
push ebx
push ebx
push str.Boot_File_Size_Error
call sub.MFC42.DLL_AfxMessageBox
mov byte [esp + 0x13c], 4
lea ecx, [esp + 0x18]
jmp 0x41333c
lea ecx, [esp + 0x18]
mov byte [esp + 0x13c], 4
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x20]
push ebx
push 0x2ee0
push 0x402
mov edx, dword [ecx + 0x20]
push edx
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, dword [esp + 0x144]
push 0x42eba0
push eax
call dword [sym.imp.MSVCRT.dll__mbscmp]
add esp, 8
test eax, eax
jne 0x413136
xor edi, edi
push edi
push ecx
mov ecx, esp
mov dword [esp + 0x34], esp
push 0x430ba8
call sub.MFC42.DLL_CString::CString_1
push ecx
mov byte [esp + 0x148], 6
mov ecx, esp
mov dword [esp + 0x24], esp
push 0x43191c
call sub.MFC42.DLL_CString::CString_1
mov ecx, dword [0x43192c]
mov byte [esp + 0x148], 4
call fcn.0040ce90
cmp eax, ebx
je 0x4132b5
inc edi
cmp edi, 3
jl 0x4130ea
mov edi, 0xc
mov ebp, 1
push 0xfffffffffffffff5
mov dword [0x430528], edi
mov dword [0x430530], ebp
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push ebx
push 0x430528
push 0x43059c
push 0x4305a0
mov dword [0x430590], eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x413181
mov ecx, dword [esp + 0x20]
push str.Stdout_pipe_creation_failed_n
call fcn.00416a20
push str.NEMERIX
lea ecx, [esp + 0x2c]
call sub.MFC42.DLL_CString::CString_2
push ebx
push ecx
lea edx, [esp + 0x14c]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
mov byte [esp + 0x148], 7
call sub.MFC42.DLL_CString::CString_1
push ecx
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x3c], esp
push eax
mov byte [esp + 0x14c], 8
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esp + 0x38]
mov byte [esp + 0x148], 7
push ecx
mov ecx, dword [0x43192c]
call fcn.0040afe0
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x140], 9
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x2c]
mov byte [esp + 0x13c], 7
call sub.MFC42.DLL_CString::CString
mov edx, dword [esp + 0x10]
mov eax, dword [0x43191c]
push edx
push eax
lea ecx, [esp + 0x1c]
push 0x42e1cc
push ecx
call sub.MFC42.DLL_CString::Format_1
mov edx, dword [esp + 0x24]
add esp, 0x10
push edx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [0x43059c]
push 0x430580
push 0x430538
push ebx
push ebx
push 8
mov dword [0x430528], edi
mov edi, dword [0x430564]
push ebp
push 0x430528
mov dword [0x430578], eax
mov dword [0x430574], eax
mov eax, dword [0x4305ac]
push 0x430528
or edi, 0x100
push esi
push ebx
mov dword [0x430530], ebp
mov dword [0x430538], 0x44
mov dword [0x430570], eax
mov dword [0x430564], edi
mov word [0x430568], bx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x4132d2
push 0xa5
mov ecx, 0x431104
call sub.MFC42.DLL_CString::LoadStringA
mov ecx, dword [0x431104]
push ebx
push ebx
push ecx
call sub.MFC42.DLL_AfxMessageBox
jmp 0x413327
push ebx
push ebx
push str.Resource_Load_Error
mov dword [0x4324b0], ebx
call sub.MFC42.DLL_AfxMessageBox
push esi
call sub.MFC42.DLL_operatordelete
add esp, 4
jmp 0x413341
mov edx, dword [esp + 0x144]
mov edi, dword [sym.imp.MSVCRT.dll__mbscmp]
push 0x42eba0
push edx
call edi
add esp, 8
test eax, eax
jne 0x4132fe
mov eax, dword [esp + 0x20]
push ebx
push ebx
push ebx
push ebx
push eax
push 0x413560
jmp 0x413322
mov ecx, dword [esp + 0x144]
push 0x42eb54
push ecx
call edi
add esp, 8
test eax, eax
jne 0x413327
mov edx, dword [esp + 0x20]
push ebx
push ebx
push ebx
push ebx
push edx
push 0x414d20
call sub.MFC42.DLL_AfxBeginThread
push esi
call sub.MFC42.DLL_operatordelete
add esp, 4
mov byte [esp + 0x13c], 4
lea ecx, [esp + 0x28]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0x13c], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x1c]
mov byte [esp + 0x13c], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x24]
mov byte [esp + 0x13c], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x13c], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x144]
mov dword [esp + 0x13c], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x134]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x130
ret 4