Function at 0x417500
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4a0
mov eax, dword [0x48c8b0]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
push 0
lea eax, [ebp - 0x440]
push eax
lea eax, [ebp - 0x42c]
push eax
lea eax, [ebp - 0x434]
mov ebx, ecx
push eax
mov dword [ebp - 0x430], ebx
mov dword [ebp - 0x440], 0xc
mov dword [ebp - 0x43c], 0
mov dword [ebp - 0x438], 1
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x4175ad
call fcn.00425809
mov ecx, eax
test ecx, ecx
je 0x4178ef
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov ecx, ebx
mov dword [ebx], eax
call fcn.00416bd0
mov esi, dword [ebp + 8]
add esi, 0xfffffff0
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x41759a
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, ebx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0043ddbb
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x48c]
push eax
mov dword [ebp - 0x48c], 0x44
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov eax, dword [ebp - 0x42c]
mov dword [ebp - 0x44c], eax
mov dword [ebp - 0x450], eax
xor eax, eax
mov word [ebp - 0x45c], ax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x460], 0x101
cmp dword [eax - 4], 1
jle 0x417600
push dword [eax - 0xc]
lea ecx, [ebp + 8]
call fcn.00416c30
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x49c]
push ecx
lea ecx, [ebp - 0x48c]
push ecx
push 0
push 0
push 0
push 1
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x417674
call fcn.00425809
mov ecx, eax
test ecx, ecx
je 0x4178f9
mov eax, dword [ecx]
call dword [eax + 0xc]
mov edx, dword [ebp + 8]
add eax, 0x10
add edx, 0xfffffff0
mov dword [ebx], eax
lea eax, [edx + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x41759a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, ebx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0043ddbb
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x42c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00425809
mov ecx, eax
test ecx, ecx
je 0x417903
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
push 0x3ff
lea eax, [ebp - 0x40b]
push 0
push eax
mov dword [ebp - 0x428], esi
mov dword [ebp - 0x410], 0xf
mov dword [ebp - 0x414], 0
mov byte [ebp - 0x424], 0
mov byte [ebp - 0x40c], 0
call fcn.004470b0
add esp, 0xc
push 0
lea eax, [ebp - 0x444]
push eax
push 0x3ff
lea eax, [ebp - 0x40c]
push eax
push dword [ebp - 0x434]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, eax
xor edi, edi
lea ebx, [ebx]
mov cl, byte [ebp + edi - 0x40c]
test cl, cl
je 0x417735
push ecx
push ecx
lea ecx, [ebp - 0x424]
call fcn.0041a0e0
cmp edi, 0x400
jae 0x41790d
mov byte [ebp + edi - 0x40c], 0
inc edi
cmp edi, 0x400
jne 0x417700
test ebx, ebx
je 0x417743
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4176d5
cmp dword [ebp - 0x410], 0x10
jb 0x41777e
mov ebx, dword [ebp - 0x424]
test ebx, ebx
jne 0x417784
cmp dword [esi - 0xc], 0
mov edi, dword [esi - 0x10]
lea edx, [esi - 0x10]
je 0x4177e0
cmp dword [edx + 0xc], 0
lea ecx, [edx + 0xc]
jge 0x417818
cmp dword [esi - 8], 0
jge 0x41780a
jmp 0x417912
lea ebx, [ebp - 0x424]
push 0
push 0
push 0xffffffffffffffff
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea edi, [eax - 1]
test edi, edi
jle 0x417756
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or ecx, eax
jge 0x4177bf
push edi
lea ecx, [ebp - 0x428]
call fcn.00416cf0
mov esi, dword [ebp - 0x428]
push edi
push esi
push 0xffffffffffffffff
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp edi, dword [esi - 8]
jg 0x417912
xor eax, eax
mov dword [esi - 0xc], edi
mov word [esi + edi*2], ax
or ebx, 0xffffffff
mov ecx, dword [esi - 0x10]
add esi, 0xfffffff0
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [esi + 0xc], 0
lea edx, [esi + 0xc]
mov ecx, eax
jl 0x41783a
cmp ecx, dword [esi]
jne 0x41783a
mov edi, esi
mov eax, 1
lock xadd dword [edx], eax
jmp 0x41786f
xor eax, eax
mov dword [esi - 0xc], 0
mov word [esi], ax
jmp 0x4177e0
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x41782e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0xc]
lea esi, [eax + 0x10]
jmp 0x4177e3
mov eax, dword [ecx]
push 2
push dword [esi + 4]
call dword [eax]
mov edi, eax
test edi, edi
je 0x41791c
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 4]
lea ecx, [eax*2 + 2]
push ecx
lea eax, [esi + 0x10]
push eax
push ecx
lea eax, [edi + 0x10]
push eax
call fcn.0043ddca
add esp, 0x10
cmp dword [ebp - 0x410], 0x10
lea eax, [edi + 0x10]
mov edi, dword [ebp - 0x430]
mov dword [edi], eax
jb 0x417891
push dword [ebp - 0x424]
call fcn.004254d3
add esp, 4
mov dword [ebp - 0x410], 0xf
mov dword [ebp - 0x414], 0
mov byte [ebp - 0x424], 0
lea eax, [esi + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4178c2
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ebx
dec ebx
test ebx, ebx
jg 0x4178dc
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 8]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043ddbb
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00416fc0
push 0x80004005
call fcn.00416fc0
push 0x80004005
call fcn.00416fc0
call fcn.0043ed69
push 0x80070057
call fcn.00416fc0
call fcn.00416e90
int3