Function at 0x407b96
Capabilities:
Create pipe
Read file on windows
Read pipe
Terminate process
Write file on windows
Write pipe

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x144]
push ebx
mov ebx, ecx
sub esp, 0x1e8
mov dword [ebp - 0x1c4], 0
push edi
call fcn.0042d9b8
mov eax, dword [ebp - 0x144]
mov byte [ebp - 0x144], 0
mov dword [ebp - 0x1e8], eax
mov eax, dword [0x42e48c]
mov dword [ebp - 0x1e4], eax
pop eax
pop edx
push 0x43ffda
push dword [ebx + 0x3c]
call fcn.004034dd
mov esi, dword [0x46d9a0]
add esp, 0x10
test eax, eax
jne 0x407c00
test byte [ebx + 0x34], 4
je 0x407c0a
mov esi, dword [0x46d994]
test esi, esi
jne 0x407c99
jmp 0x407c76
push eax
push eax
push str..EXE
push dword [ebx + 0x3c]
call fcn.004034dd
add esp, 0x10
test eax, eax
je 0x407c2c
or dword [ebx + 0x34], 0x20
mov esi, dword [ebx + 0x3c]
jmp 0x407cc0
push esi
push esi
push str..DLL
push dword [ebx + 0x3c]
call fcn.004034dd
add esp, 0x10
test eax, eax
je 0x407c4a
sub esp, 0xc
push dword [ebx + 0x3c]
jmp 0x407cb1
mov esi, 0x46d8e0
mov eax, dword [esi]
test eax, eax
je 0x407c76
cmp byte [eax], 0x2e
jne 0x407c71
push ecx
push ecx
push eax
push dword [ebx + 0x3c]
call fcn.004034dd
add esp, 0x10
test eax, eax
je 0x407c71
mov esi, dword [esi + 4]
jmp 0x407c99
add esi, 8
jmp 0x407c4f
mov esi, edi
test byte [0x46d978], 2
jne 0x407cc0
push eax
push edi
push dword [ebx + 0x5c]
push dword [ebx + 0x3c]
call dword [sym.imp.SHELL32.dll_FindExecutableA]
pop edx
cmp eax, 0x20
jle 0x407f15
push eax
push eax
push str..DLL
push esi
call fcn.004034dd
add esp, 0x10
test eax, eax
je 0x407cc0
sub esp, 0xc
push esi
mov ecx, ebx
call fcn.0042d1d6
add esp, 0xc
jmp 0x4087bc
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x407cd0
mov edx, dword [ebx + 0x3c]
sub eax, edx
test edx, edx
jne 0x407cd3
mov eax, dword [ebx + 0x70]
cmp eax, 0x2000
mov edx, 0x2000
push ecx
cmova eax, edx
mov edx, dword [0x46d96c]
mov dword [ebp - 0x1a4], eax
add eax, eax
lea eax, [edx + eax + 0x14900]
push eax
push 8
push dword [0x452048]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x1d4], eax
pop edi
test eax, eax
je 0x408779
add eax, 0x10800
mov edx, dword [0x46d96c]
mov ecx, ebx
lea edi, [ebp - 0x188]
mov dword [ebp - 0x1e0], eax
push eax
push eax
mov eax, dword [ebp - 0x1a4]
add eax, eax
lea eax, [edx + eax + 0x4000]
add eax, dword [ebp - 0x1e0]
push eax
push dword [ebp - 0x1e0]
call fcn.004079f8
mov ecx, 0x44
mov dword [ebp - 0x1d8], eax
xor eax, eax
test edi, edi
je 0x407d66
jecxz 0x407d66
cld
rep stosb byte es:[edi], al
mov dword [ebp - 0x188], 0x44
pop eax
mov dword [ebp - 0x15c], 0x181
pop edx
mov word [ebp - 0x158], 0
test byte [ebx + 0x34], 1
je 0x407e4b
cmp dword [ebx + 0x4c], 0
je 0x407e4b
cmp dword [ebp - 0x1d8], 0
je 0x407e4b
mov eax, dword [0x42e6a8]
cmp eax, dword [ebp - 0x1d8]
jge 0x407dda
push eax
push dword [ebp - 0x1d8]
push 0x43ffe8
push 0x4644a0
call fcn.0040423a
pop esi
pop edi
push 0x190
push 0x440012
jmp 0x4086d6
mov eax, dword [ebp - 0x1d8]
add eax, 0x100
push eax
lea eax, [ebp - 0x1c0]
push 0x42e458
push eax
lea eax, [ebp - 0x1c4]
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x407e14
push ecx
push ecx
push 0x190
push str.Error._Cant_run_script
jmp 0x40872f
mov eax, dword [ebx + 0x68]
sub esp, 0xc
mov dword [ebp - 0x1d0], eax
mov eax, dword [ebx + 0x4c]
push dword [ebp - 0x1c0]
mov dword [ebp - 0x1dc], eax
mov eax, dword [ebp - 0x1c4]
mov dword [ebp - 0x150], eax
call fcn.00407b57
add esp, 0x10
mov dword [ebp - 0x1c0], eax
jmp 0x407e55
mov dword [ebp - 0x1d0], 0
lea eax, [ebp - 0x1b4]
push 0x10000
mov edi, dword [sym.imp.KERNEL32.dll_CreatePipe]
push 0x42e458
push eax
lea eax, [ebp - 0x1b8]
push eax
call edi
test eax, eax
je 0x407eff
lea eax, [ebp - 0x1b0]
push 0x400
push 0x42e458
push eax
lea eax, [ebp - 0x1bc]
push eax
call edi
test eax, eax
je 0x407eff
mov eax, dword [ebp - 0x1b4]
sub esp, 0xc
push dword [ebp - 0x1b8]
mov dword [ebp - 0x14c], eax
mov eax, dword [ebp - 0x1b0]
mov dword [ebp - 0x148], eax
call fcn.00407b57
mov dword [ebp - 0x1b8], eax
pop eax
push dword [ebp - 0x1bc]
call fcn.00407b57
mov dword [ebp - 0x1bc], eax
pop eax
pop edx
push 0x5c
push dword [ebx + 0x3c]
call fcn.00403476
add esp, 0x10
mov edi, eax
mov eax, dword [ebx + 0x3c]
cmp byte [eax + 1], 0x3a
je 0x407f2f
mov dword [ebp - 0x1cc], 0x43fe20
jmp 0x407f4a
push edi
push dword [ebp - 0x1d4]
push 0
push dword [0x452048]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop eax
push ecx
push ecx
mov ecx, ebx
push 0x190
push str.Error._Cant_run_script
call fcn.0040b1ae
pop ebx
pop esi
jmp 0x4087bc
push edx
push edx
push 0x20
push eax
call fcn.004033de
add esp, 0x10
test eax, eax
je 0x407ef3
mov dword [ebp - 0x1cc], 0x43ff9e
mov ecx, dword [ebx + 0x34]
mov eax, dword [ebx + 0x3c]
test cl, 0x20
jne 0x407fad
and cl, 4
mov dl, byte [eax + 1]
je 0x407f7c
cmp dl, 0x3a
je 0x407f65
lea eax, [edi + 1]
push ecx
push ecx
push dword [ebp - 0x1cc]
push eax
push dword [ebp - 0x1cc]
push esi
push str._s__s_s_s
jmp 0x407f9c
mov ecx, dword [ebx + 0x48]
cmp dl, 0x3a
je 0x407f87
lea eax, [edi + 1]
push edx
push ecx
push dword [ebp - 0x1cc]
push eax
push dword [ebp - 0x1cc]
push esi
push str._s__s_s_s__s
push dword [ebp - 0x1d4]
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x20
jmp 0x407fc5
push dword [ebx + 0x48]
push eax
push 0x440065
push dword [ebp - 0x1d4]
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
movsx eax, byte [edi + 1]
mov dword [ebp - 0x1ac], eax
mov byte [edi + 1], 0
mov eax, dword [0x46d998]
test eax, eax
jne 0x407fdf
mov eax, dword [ebx + 0x3c]
sub esp, 0xc
lea edx, [ebp - 0x198]
push edx
lea edx, [ebp - 0x188]
push edx
push eax
push dword [ebp - 0x1e0]
push dword [ebp - 0x1d4]
call fcn.00407970
mov edx, dword [ebp - 0x1ac]
add esp, 0x20
mov byte [edi + 1], dl
test eax, eax
je 0x4086fd
mov eax, dword [ebp - 0x1e8]
add eax, dword [ebp - 0x1e4]
xor edi, edi
mov dword [ebp - 0x1ac], 0x103
mov dword [ebp - 0x1e0], eax
mov esi, dword [ebp - 0x1d4]
cmp dword [ebp - 0x1d8], 0
jle 0x408661
mov dword [ebp - 0x1a8], 0
mov eax, dword [ebp - 0x1d8]
add eax, 2
cmp dword [ebp - 0x1d0], eax
cmovle eax, dword [ebp - 0x1d0]
mov dword [ebp - 0x1d0], eax
test eax, eax
jle 0x4080e7
sub esp, 0xc
lea eax, [ebp - 0x1a8]
push 0
push eax
push dword [ebp - 0x1d0]
push dword [ebp - 0x1dc]
push dword [ebp - 0x1c0]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x1a8]
add esp, 0xc
sub dword [ebp - 0x1d0], eax
sub dword [ebp - 0x1d8], eax
add dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1d8], 0
jg 0x4080da
sub esp, 0xc
push dword [ebp - 0x1c0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x1c0], 0
add esp, 0xc
jmp 0x4084bc
cmp dword [ebp - 0x1d0], 0
jg 0x4084bc
push eax
push eax
lea eax, [ebp - 0x1a8]
push 0
mov dword [ebp - 0x1a8], 0
push eax
push 0
push 0
push 0
push dword [ebp - 0x1b8]
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
pop edx
pop ecx
test eax, eax
je 0x40842c
cmp dword [ebp - 0x1a8], 0
je 0x40842c
mov dword [ebp - 0x1dc], esi
cmp dword [ebp - 0x1a8], 0x8000
jle 0x408141
mov dword [ebp - 0x1a8], 0x8000
sub esp, 0xc
lea eax, [ebp - 0x1a8]
push 0
push eax
push dword [ebp - 0x1a8]
push esi
push dword [ebp - 0x1b8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
add esp, 0xc
test edi, edi
jne 0x40834c
push eax
push eax
push str.Status:
push esi
call fcn.00403494
add esp, 0x10
test eax, eax
je 0x408198
sub dword [ebp - 0x1a8], 8
add esi, 8
mov edi, 9
mov eax, 0x43ffa0
jmp 0x40828b
push eax
push eax
push str.Location
push esi
call fcn.0040f8fb
add esp, 0x10
test eax, eax
jne 0x408269
push eax
push eax
push 0x43fe4b
push esi
call fcn.004034b9
add esp, 0x10
mov dword [ebp - 0x1cc], eax
test eax, eax
jne 0x4081e0
push eax
push eax
push 0x43fe29
push esi
call fcn.004034b9
add esp, 0x10
mov dword [ebp - 0x1cc], eax
mov eax, dword [0x46d9a4]
cmp dword [ebx + 0x3c], eax
je 0x408275
test byte [ebx + 0x34], 0x10
jne 0x408281
push edi
push edi
push 0x440099
push esi
call fcn.004034dd
add esp, 0x10
test eax, eax
jne 0x408281
push ecx
push ecx
push str.Content_type:_text
push esi
call fcn.004034dd
add esp, 0x10
test eax, eax
je 0x408281
cmp dword [ebp - 0x1cc], 0
je 0x408281
mov eax, dword [ebx + 0x34]
test al, 8
je 0x408242
cmp dword [ebx + 4], 0x424c78
je 0x408242
mov ecx, ebx
call fcn.004250b6
jmp 0x408281
test byte [0x46d982], 8
je 0x408281
cmp dword [ebx + 0x6c], 0
je 0x408281
bt eax, 9
jb 0x408281
or eax, 0x40
mov edi, 0x43
mov dword [ebx + 0x34], eax
mov eax, str.HTTP_1.1_200__r_nConnection:_Keep_Alive_r_nTransfer_Encoding:_chunked_r_n
jmp 0x40828b
mov edi, 0xf
mov eax, str.HTTP_1.0_301__r_n
jmp 0x40828b
mov edi, 0xf
mov eax, str.HTTP_1.0_404__r_n
jmp 0x40828b
mov edi, 0xf
mov eax, str.HTTP_1.0_200__r_n
push edx
mov ecx, ebx
push edx
push edi
push eax
call fcn.00407608
pop ecx
pop edx
test eax, eax
js 0x408378
cmp dword [ebx + 0x80], 0
je 0x40834c
cmp dword [ebp - 0x1cc], 0
je 0x40834c
test byte [ebx + 0x34], 0x10
jne 0x40834c
mov eax, dword [ebp - 0x1cc]
mov edx, dword [ebp - 0x1cc]
mov ecx, ebx
sub edx, esi
cmp byte [eax], 0xd
sete al
movzx eax, al
lea eax, [edx + eax + 1]
push edx
push edx
push eax
push esi
mov dword [ebp - 0x1a4], eax
call fcn.00407608
mov ecx, ebx
push 0x24
push str.Content_Encoding:_gzip_r_n_r_n
call fcn.00407608
xor edx, edx
pop ecx
pop eax
mov eax, dword [ebp - 0x1cc]
mov ecx, dword [ebp - 0x1a8]
cmp byte [eax], 0xd
mov eax, dword [ebp - 0x1a4]
sete dl
lea edx, [edx + eax + 1]
mov dword [ebp - 0x1a4], edx
cmp edx, ecx
jge 0x40833b
sub ecx, edx
mov eax, esi
add edx, esi
mov dword [ebp - 0x1a8], ecx
call fcn.00407580
jmp 0x408345
mov dword [ebp - 0x1a8], 0
mov dword [ebx + 4], 0x424c78
mov eax, dword [ebp - 0x1a8]
test eax, eax
je 0x40803a
mov byte [esi + eax], 0
mov ecx, ebx
push eax
push eax
push dword [ebp - 0x1a8]
push esi
call fcn.00407608
pop edx
pop ecx
test eax, eax
jns 0x40852b
test byte [0x46d97e], 0x40
je 0x4084fa
lea ebx, [ebp - 0x1a8]
push eax
push eax
push 0
push ebx
push 0
push 0
push 0
push dword [ebp - 0x1b8]
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
pop edx
pop ecx
test eax, eax
je 0x4083cc
cmp dword [ebp - 0x1a8], 0
je 0x4083cc
sub esp, 0xc
push 0
push ebx
push 0x4000
push esi
push dword [ebp - 0x1b8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
add esp, 0xc
sub esp, 0xc
lea eax, [ebp - 0x1a0]
push eax
call fcn.0042d9b8
mov eax, dword [ebp - 0x1e0]
add esp, 0x10
cmp eax, dword [ebp - 0x1a0]
jb 0x4084fa
sub esp, 0xc
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x1ac]
sub esp, 0xc
push eax
push dword [ebp - 0x198]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
add esp, 0x18
cmp dword [ebp - 0x1ac], 0x103
je 0x408385
jmp 0x40850c
lea eax, [ebp - 0x1a8]
push ecx
push ecx
push 0
push eax
push 0
push 0
push 0
push dword [ebp - 0x1bc]
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
pop edx
pop ecx
test eax, eax
jne 0x408536
push eax
push eax
lea eax, [ebp - 0x1ac]
push eax
push dword [ebp - 0x198]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [ebp - 0x1ac], 0x103
pop eax
pop edx
jne 0x40864b
push eax
push dword [ebx]
push 0x7530
push 0
call fcn.0040bdd0
add esp, 0x10
test eax, eax
je 0x4080e7
push eax
push 0x8000
push esi
push ebx
call dword [ebx + 8]
mov dword [ebp - 0x1d0], eax
add esp, 0x10
test eax, eax
js 0x408378
mov dword [ebp - 0x1dc], esi
jne 0x408047
push eax
push dword [ebx]
push 0x2800
push 0
call fcn.0040bdd0
add esp, 0x10
test eax, eax
jne 0x408670
sub esp, 0xc
lea eax, [ebp - 0x1a0]
push eax
call fcn.0042d9b8
mov eax, dword [ebp - 0x1e0]
add esp, 0x10
cmp eax, dword [ebp - 0x1a0]
jae 0x4085ff
push esi
push esi
push 0
push dword [ebp - 0x198]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop edi
pop eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
push eax
push str.Connection_aborted__d..
push 0x4644a0
call fcn.0040423a
add esp, 0x10
jmp 0x4086df
add edi, dword [ebp - 0x1a8]
jmp 0x40803a
cmp dword [ebp - 0x1a8], 0
je 0x408453
mov dword [ebp - 0x1dc], esi
test edi, edi
jne 0x40858e
sub esp, 0xc
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x1a4]
sub esp, 0xc
push 0
push eax
push 0
push 0
push 0
push dword [ebp - 0x1b8]
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov eax, dword [ebp - 0x1a4]
add esp, 0x18
test eax, eax
je 0x40858e
mov dword [ebp - 0x1a8], eax
jmp 0x40812b
test byte [0x46d983], 8
jne 0x4085d1
test edi, edi
jne 0x4085b7
push edi
mov ecx, ebx
push edi
mov edi, 1
push 0x190
push str.Error_in_script:_r_n
call fcn.0040b1ae
pop eax
pop edx
jmp 0x4085d1
push eax
mov ecx, ebx
push eax
push 8
push str._r_n_r_n_hr_
call fcn.00407608
pop edx
pop ecx
test eax, eax
jle 0x408378
lea eax, [ebp - 0x1bc]
lea edx, [ebp - 0x1b8]
mov ecx, dword [eax]
xchg dword [edx], ecx
mov dword [eax], ecx
test dword [0x46d980], 0x28000000
je 0x40812b
xor dword [ebx + 0x34], 0x1000
jmp 0x40812b
mov edx, dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
lea ecx, [ebp - 0x1a8]
push eax
push eax
mov dword [ebp - 0x1e4], edx
push 0
push ecx
push 0
push 0
push 0
push dword [ebp - 0x1b8]
call edx
lea ecx, [ebp - 0x1a8]
cmp dword [ebp - 0x1ac], 0x103
pop eax
pop edx
mov edx, dword [ebp - 0x1e4]
je 0x40868b
cmp dword [ebp - 0x1a8], 0
jne 0x40812b
test edi, edi
jne 0x4086df
push eax
push eax
push 0x190
push str.Error._Script_return_nothing
jmp 0x4086d6
mov dword [ebp - 0x1d0], 0
jmp 0x4084bc
push ecx
push 0x8000
push esi
push ebx
call dword [ebx + 8]
add esp, 0x10
test eax, eax
jg 0x4084d6
jmp 0x408378
cmp dword [ebp - 0x1a8], 0
jne 0x40812b
push eax
push eax
push 0
push ecx
push 0
push 0
push 0
push dword [ebp - 0x1bc]
call edx
cmp dword [ebp - 0x1a8], 0
pop eax
pop edx
jne 0x408549
push eax
push eax
lea eax, [ebp - 0x1ac]
push eax
push dword [ebp - 0x198]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
pop edx
pop ecx
jmp 0x40803a
mov ecx, ebx
call fcn.0040b1ae
pop esi
pop edi
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 0xc
push dword [ebp - 0x194]
call ebx
push dword [ebp - 0x198]
call ebx
add esp, 0xc
jmp 0x408738
mov eax, dword [ebp - 0x1d4]
sub esp, 0xc
mov byte [edi], 0x5c
lea esi, [eax + 0x400]
push eax
mov eax, dword [ebx + 0x60]
push dword [ebx + 0x48]
add eax, dword [ebx + 0x3c]
push eax
push str.Error_run__s_with__s___s_
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
push 0x190
push esi
mov ecx, ebx
call fcn.0040b1ae
pop ecx
pop ebx
push eax
push dword [ebp - 0x1d4]
push 0
push dword [0x452048]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0x1c4]
pop edx
test eax, eax
je 0x40878b
sub esp, 0xc
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call ebx
mov eax, dword [ebp - 0x1c0]
add esp, 0xc
test eax, eax
je 0x40878b
sub esp, 0xc
push eax
call ebx
jmp 0x408788
sub esp, 0xc
mov ecx, ebx
push str.No_Memory
call fcn.004040fa
add esp, 0xc
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 0xc
push dword [ebp - 0x1b4]
call ebx
push dword [ebp - 0x1b8]
call ebx
push dword [ebp - 0x1b0]
call ebx
push dword [ebp - 0x1bc]
call ebx
mov eax, 1
add esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret