Function at 0x401430
Capabilities:
Access the windows event log
Connect pipe
Create pipe
Create process on windows
Create thread
Get common file path
Query environment variable
Terminate process
Write and execute a file
Write file on windows
Write pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xae8
mov eax, dword [0x41b004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push str.JB_Launcher
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov ebx, eax
mov dword [ebp - 0xaa8], 0
mov dword [ebp - 0xae8], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0xa
mov esi, eax
lea eax, [ebp - 0x3c]
push 0x14
push eax
push esi
call fcn.004061fd
mov dword [0x41c2c8], 1
lea eax, [ebp - 0xaa4]
mov dword [0x41c2c4], esi
xor ecx, ecx
mov dword [0x41c2cc], 1
mov dword [0x41c2d4], 2
mov dword [0x41c2d0], esi
mov dword [0x41c2d8], 1
mov dword [0x41c2bc], 4
mov dword [0x41c2b8], esi
mov dword [0x41c2c0], 0
lock or dword [eax], ecx
push 8
push esi
lea eax, [ebp - 0x7c]
push str..pipe_jetbrains_ld__d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x20
lea eax, [ebp - 0x7c]
push 0
push 0
push 0x7fff
push 0x7fff
push 1
push 4
push 2
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov dword [ebp - 0xaa4], eax
cmp eax, 0xffffffff
jne 0x40155c
push 0
push 0
push 0
push 0
push 0
push 0xfffffffffffffffa
push 0
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_open_env_vars_pipe:__ld
push 2
call fcn.00405dfd
add esp, 4
push eax
call fcn.00401070
add esp, 0xc
mov eax, 0xfffffffa
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401b64
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x41c2bc]
mov dword [ebp - 0xa9c], 0
mov dword [ebp - 0xa98], 0
mov dword [ebp - 0xaa0], 0
cmp ecx, 1
jne 0x40158c
mov eax, 0xfffffff5
jmp 0x40159b
xor eax, eax
cmp ecx, 2
setne al
lea eax, [eax*2 - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 2
je 0x4015d1
push 0
push 0
push 0x41c2b8
push 0x401120
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [0x41c2bc]
mov dword [ebp - 0xaa0], eax
lea eax, [ebp - 0xaa0]
mov ecx, 0x41c2c4
push edi
push eax
lea edx, [ebp - 0xa9c]
call fcn.004013c0
lea eax, [ebp - 0xaa0]
mov ecx, 0x41c2d0
push eax
lea edx, [ebp - 0xa98]
call fcn.004013c0
add esp, 8
lea eax, [ebp - 0x494]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ebx, 1
push 2
push ebx
call fcn.0040325f
mov edi, eax
add esp, 8
mov esi, edi
lea eax, [esi + 2]
nop dword [eax]
mov cx, word [esi]
add esi, 2
test cx, cx
jne 0x401630
sub esi, eax
lea ecx, [ebp - 0x3c]
sar esi, 1
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401645
sub ecx, edx
mov edx, 2
sar ecx, 1
lea eax, [ecx + 4]
mov ecx, ebx
sub ecx, esi
cmp ecx, eax
jae 0x40167d
xor ecx, ecx
mov ebx, eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
push edi
call fcn.00406105
add esp, 8
mov edi, eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [edi + esi*2]
push str.__ls_
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov esi, edi
add esp, 0xc
lea ecx, [esi + 2]
nop dword [eax + eax]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x4016a0
sub esi, ecx
lea ecx, [ebp - 0x494]
sar esi, 1
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4016c0
sub ecx, edx
sar ecx, 1
lea eax, [ecx + 3]
mov ecx, ebx
add eax, ebx
sub ecx, esi
cmp ecx, eax
jae 0x4016fa
xor ecx, ecx
mov ebx, eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
push edi
call fcn.00406105
add esp, 8
mov edi, eax
lea eax, [ebp - 0x494]
push eax
lea eax, [edi + esi*2]
push str.__ls_
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
push 0xa
push 2
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xaa0]
call fcn.004061fd
mov esi, edi
add esp, 0x1c
lea ecx, [esi + 2]
nop dword [eax + eax]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x401730
sub esi, ecx
lea ecx, [ebp - 0xc]
sar esi, 1
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401745
sub ecx, edx
sar ecx, 1
lea eax, [ecx + 3]
mov ecx, ebx
add eax, ebx
sub ecx, esi
cmp ecx, eax
jae 0x40177f
xor ecx, ecx
mov ebx, eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
push edi
call fcn.00406105
add esp, 8
mov edi, eax
lea eax, [ebp - 0xc]
push eax
lea eax, [edi + esi*2]
push str.__ls_
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov edx, edi
add esp, 0xc
lea ecx, [edx + 2]
nop word [eax + eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4017a0
sub edx, ecx
lea eax, [ebx + 6]
sar edx, 1
mov ecx, ebx
sub ecx, edx
cmp ecx, eax
jae 0x4017d8
xor ecx, ecx
mov ebx, eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
push edi
call fcn.00406105
add esp, 8
mov edi, eax
push str.__::__
push ebx
push edi
call fcn.00406232
add esp, 0xc
call fcn.004010a0
mov ebx, eax
mov edx, ebx
lea esi, [edx + 2]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x4017f3
mov ecx, edi
sub edx, esi
sar edx, 1
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401807
sub ecx, esi
lea esi, [edx + 1]
sar ecx, 1
mov edx, 2
add esi, ecx
xor ecx, ecx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
push edi
call fcn.00406105
push ebx
mov edi, eax
push esi
push edi
call fcn.00406232
add esp, 0x14
lea eax, [ebp - 0x288]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x4018a4
push eax
push eax
push eax
push eax
push eax
push 0xfffffffffffffffd
push eax
push 1
push dword [ebp - 0xae8]
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_get_directory:__ld
push 2
call fcn.00405dfd
add esp, 4
push eax
call fcn.00401070
add esp, 0xc
mov eax, 0xfffffffd
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401b64
mov esp, ebp
pop ebp
ret
push 0x100
lea eax, [ebp - 0x894]
push eax
push 0x100
lea eax, [ebp - 0xa94]
push eax
push 0x100
lea eax, [ebp - 0x694]
push eax
push 3
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.004060b4
lea eax, [ebp - 0x694]
push eax
lea eax, [ebp - 0x14]
push eax
push str._ls_lselevator.exe
lea eax, [ebp - 0x288]
push 0x104
push eax
call fcn.00401040
push 0x3c
lea eax, [ebp - 0xae4]
push 0
push eax
call fcn.00402860
lea eax, [ebp - 0x288]
mov dword [ebp - 0xae4], 0x3c
mov dword [ebp - 0xad4], eax
add esp, 0x44
lea eax, [ebp - 0x494]
mov dword [ebp - 0xad0], edi
mov dword [ebp - 0xacc], eax
lea eax, [ebp - 0xae4]
mov dword [ebp - 0xae0], 0x8140
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push 0
test eax, eax
jne 0x40199d
push eax
push eax
push eax
push eax
push 0xfffffffffffffffc
push eax
push 1
push dword [ebp - 0xae8]
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_launch_process:__ld
push 2
call fcn.00405dfd
add esp, 4
push eax
call fcn.00401070
add esp, 0xc
mov eax, 0xfffffffc
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401b64
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 0xaa4]
push ebx
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
je 0x401b21
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov dword [ebp - 0xaa4], eax
mov esi, eax
cmp word [eax], 0
je 0x401a35
mov edi, dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
nop dword [eax]
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4019d5
sub ecx, edx
lea eax, [ebp - 0xaa0]
push 0
sar ecx, 1
push eax
lea eax, [ecx*2 + 2]
push eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x401af7
push ebx
call edi
test eax, eax
je 0x401aa6
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401a15
sub ecx, edx
sar ecx, 1
lea esi, [esi + ecx*2]
add esi, 2
cmp word [esi], ax
jne 0x4019d0
mov eax, dword [ebp - 0xaa4]
push eax
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor esi, esi
nop dword [eax + eax]
mov eax, dword [ebp + esi*4 - 0xa9c]
test eax, eax
je 0x401a60
push 0xffffffffffffffff
push eax
call edi
inc esi
cmp esi, 2
jl 0x401a50
push 0xffffffffffffffff
push dword [ebp - 0xaac]
call edi
lea eax, [ebp - 0xaa8]
push eax
push dword [ebp - 0xaac]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0xae8]
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov eax, dword [ebp - 0xaa8]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401b64
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 0
push 0
push 0xfffffffffffffff9
push 0
push 1
push dword [ebp - 0xae8]
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_flush_the_env_vars_pipe:__ld
push 2
call fcn.00405dfd
add esp, 4
push eax
call fcn.00401070
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0xfffffff9
pop edi
pop esi
pop ebx
call fcn.00401b64
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 0
push 0
push 0xfffffffffffffff9
push 0
push 1
push dword [ebp - 0xae8]
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_write_to_env_vars_pipe:__ld
jmp 0x401ace
push 0
push 0
push 0
push 0
push 0
push 0xfffffffffffffffb
push 0
push 1
push dword [ebp - 0xae8]
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_wait_for_in_pipe:__ld
push 2
call fcn.00405dfd
add esp, 4
push eax
call fcn.00401010
add esp, 0xc
push 0xfffffffffffffffb
call fcn.00403249
int3