Function at 0x10004070
Capabilities:
Create pipe
Create process on windows
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov bl, byte [ebp + 8]
lea ecx, [ebx - 0x41]
cmp cl, 0x19
ja 0x10004087
lea eax, [ebx - 0x41]
pop ebx
pop ebp
ret 4
mov ecx, dword [0x100b7590]
cmp ecx, 0xbe8a9d07
jne 0x10004237
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
xor eax, eax
lock dec dword [eax]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleFontSize]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push 0
call dword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalSize]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_BuildCommDCBAndTimeoutsW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EraseTape]
push 0
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0
call dword [sym.imp.KERNEL32.dll_ApplicationRecoveryInProgress]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMaskEx]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_BindIoCompletionCallback]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentConsoleFont]
push 0
push 0x100c1cc8
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteProfileStringW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetTapeParameters]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_PowerSetRequest]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommConfig]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MapUserPhysicalPagesScatter]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_PrefetchVirtualMemory]
push 0
push 0
push 0x100c1ce0
push 0
push 0x100c1d04
push 0
call dword [sym.imp.KERNEL32.dll_FindStringOrdinal]
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleCP]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommMask]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_Wow64SetThreadContext]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
push 0
call dword [sym.imp.KERNEL32.dll_QueryDepthSList]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeClientProcessId]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_PrefetchVirtualMemory]
push 0
call dword [sym.imp.KERNEL32.dll_Wow64SuspendThread]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_DiscardVirtualMemory]
push 0
call dword [sym.imp.KERNEL32.dll_GetFirmwareType]
call dword [sym.imp.KERNEL32.dll_GetSystemDEPPolicy]
mov ecx, dword [0x100b7590]
lea eax, [ebx - 0x61]
cmp al, 0x19
ja 0x10004246
lea eax, [ebx - 0x47]
pop ebx
pop ebp
ret 4
cmp ecx, 0xd645fdbb
jne 0x100043b2
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_RedrawWindow]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapValidate]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
call dword [sym.imp.USER32.dll_SetProcessWindowStation]
push 0
push 0
call dword [sym.imp.USER32.dll_GetClassWord]
call dword [sym.imp.USER32.dll_GetDialogBaseUnits]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentConsoleFontEx]
push 0
push 0
call dword [sym.imp.USER32.dll_GetAncestor]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0
call dword [sym.imp.USER32.dll_LoadBitmapW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProfileIntW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryIdleProcessorCycleTimeEx]
call dword [sym.imp.USER32.dll_GetClipboardViewer]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetUserObjectInformationW]
push 0
push 0
call dword [sym.imp.USER32.dll_CharPrevW]
push 0
push 0
push 0
push 0
push 0
push 0x100c1d24
push 0
call dword [sym.imp.KERNEL32.dll_GetFileMUIPath]
push 0
call dword [sym.imp.USER32.dll_SetDoubleClickTime]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaProximityNode]
push 0
push 0
call dword [sym.imp.USER32.dll_GetSubMenu]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_DnsHostnameToComputerNameW]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_RegisterPowerSettingNotification]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessPriorityBoost]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessPreferredUILanguages]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_ScrollWindowEx]
push 0
call dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
push 0
push 0
push 0
push 0x100c1d50
call dword [sym.imp.KERNEL32.dll_FindFirstFileNameW]
push 0
push 0
call dword [sym.imp.USER32.dll_RegisterSuspendResumeNotification]
lea eax, [ebx - 0x30]
cmp al, 9
ja 0x100043c1
lea eax, [ebx + 4]
pop ebx
pop ebp
ret 4
cmp bl, 0x2b
jne 0x100043cd
mov al, 0x3e
pop ebx
pop ebp
ret 4
cmp bl, 0x2f
pop ebx
setne al
dec al
and al, 0x3f
pop ebp
ret 4