Function at 0x406220
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create two anonymous pipes
Read file on windows
Read pipe

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x484491
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x4ca0
call fcn.004839d0
mov eax, dword [0x4ab00c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x4c7c], ecx
cmp byte [ecx + 0x60], 0
mov eax, dword [ebx + 8]
mov dword [ebp - 0x4c78], eax
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x4c84], eax
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x4c88], eax
je 0x4063bf
push 0
lea eax, [ebp - 0x4c18]
mov byte [ebp - 0x4c71], 0
push eax
lea eax, [ebp - 0x4c04]
mov dword [ebp - 0x4c08], 0
push eax
lea eax, [ebp - 0x4c00]
mov dword [ebp - 0x4c0c], 0
push eax
mov dword [ebp - 0x4c00], 0
mov dword [ebp - 0x4c04], 0
mov dword [ebp - 0x4c18], 0xc
mov dword [ebp - 0x4c10], 1
mov dword [ebp - 0x4c14], 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x40632a
push dword [ebp - 0x4c00]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x4c04]
call esi
mov dword [ebp - 0x4c00], 0
mov dword [ebp - 0x4c04], 0
jmp 0x4063a5
mov edi, dword [sym.imp.KERNEL32.dll_SetHandleInformation]
push 0
push 1
push dword [ebp - 0x4c00]
call edi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x40638b
push 0
lea eax, [ebp - 0x4c18]
push eax
lea eax, [ebp - 0x4c0c]
push eax
lea eax, [ebp - 0x4c08]
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x4063e1
push dword [ebp - 0x4c08]
call esi
push dword [ebp - 0x4c0c]
call esi
mov dword [ebp - 0x4c08], 0
mov dword [ebp - 0x4c0c], 0
mov eax, dword [ebp - 0x4c00]
test eax, eax
je 0x406398
push eax
call esi
mov eax, dword [ebp - 0x4c04]
test eax, eax
je 0x4063a5
push eax
call esi
mov eax, dword [ebp - 0x4c08]
test eax, eax
je 0x4063b2
push eax
call esi
mov eax, dword [ebp - 0x4c0c]
test eax, eax
je 0x4063bf
push eax
call esi
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0046b9f0
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0xc
push 0
push 1
push dword [ebp - 0x4c0c]
call edi
test eax, eax
je 0x40638b
mov edi, dword [ebp - 0x4c7c]
cmp dword [edi + 0x18], 8
lea esi, [edi + 4]
mov eax, esi
jb 0x406404
mov eax, dword [esi]
push dword [ebp - 0x4c78]
push eax
lea eax, [ebp - 0x14c8]
push str.__sdism.exe___s
push eax
call fcn.0040a970
add edi, 0x34
add esp, 0x10
cmp dword [edi + 0x10], 0
je 0x406477
push str.__logpath:_
lea eax, [ebp - 0x14c8]
push 0x800
push eax
call fcn.00474974
add esp, 0xc
cmp dword [edi + 0x14], 8
jb 0x406449
mov edi, dword [edi]
push edi
lea eax, [ebp - 0x14c8]
push 0x800
push eax
call fcn.00474974
add esp, 0xc
lea eax, [ebp - 0x14c8]
push 0x4920d0
push 0x800
push eax
call fcn.00474974
add esp, 0xc
mov edi, dword [ebp - 0x4c7c]
mov eax, dword [edi + 0x6c]
test eax, eax
jne 0x4064a0
push 0x4920d4
lea eax, [ebp - 0x14c8]
push 0x800
push eax
call fcn.00474974
mov eax, dword [edi + 0x6c]
add esp, 0xc
cmp eax, 1
jne 0x4064be
push str.__loglevel:2
lea eax, [ebp - 0x14c8]
push 0x800
push eax
call fcn.00474974
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x4064c6
mov esi, dword [esi]
push esi
lea eax, [ebp - 0x4c8]
push 0x1f4
push eax
call fcn.00474910
xor eax, eax
mov dword [ebp - 0x4c3e], 0
mov word [ebp - 0x4c3a], ax
add esp, 0xc
mov eax, dword [ebp - 0x4c04]
xorps xmm0, xmm0
mov dword [ebp - 0x4c30], eax
mov dword [ebp - 0x4c34], eax
mov eax, dword [ebp - 0x4c08]
mov dword [ebp - 0x4c38], eax
xor eax, eax
mov word [ebp - 0x4c40], ax
lea eax, [ebp - 0x4c28]
push eax
lea eax, [ebp - 0x4c70]
movlpd qword [ebp - 0x4c6c], xmm0
push eax
lea eax, [ebp - 0x4c8]
movlpd qword [ebp - 0x4c64], xmm0
push eax
push 0
push dword [edi + 0x68]
lea eax, [ebp - 0x14c8]
movlpd qword [ebp - 0x4c5c], xmm0
push 1
push 0
push 0
push eax
push 0
movups xmmword [ebp - 0x4c28], xmm0
mov dword [ebp - 0x4c70], 0x44
movlpd qword [ebp - 0x4c54], xmm0
movlpd qword [ebp - 0x4c4c], xmm0
mov dword [ebp - 0x4c44], 0x101
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x406a59
xor eax, eax
xor esi, esi
push esi
mov word [ebp - 0x3bd8], ax
mov dword [ebp - 0x4c78], eax
mov dword [ebp - 0x4be4], eax
mov dword [ebp - 0x4bdc], eax
lea eax, [ebp - 0x4bdc]
push eax
push esi
push 0x1000
push esi
push dword [ebp - 0x4c00]
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
cmp dword [ebp - 0x4bdc], 0
mov dword [ebp - 0x4be0], 0
jbe 0x406604
push 0
lea eax, [ebp - 0x4be0]
push eax
push 0x1000
lea eax, [ebp - 0x4bd8]
push eax
push dword [ebp - 0x4c00]
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor ecx, ecx
mov dword [ebp - 0x4c80], ecx
cmp dword [ebp - 0x4be0], ecx
jle 0x4069bd
nop dword [eax + eax]
cmp byte [ebp + ecx - 0x4bd8], 0xa
jne 0x406990
add esi, esi
cmp esi, 0x2710
jae 0x406aa8
xor eax, eax
mov dword [ebp - 0x4c8c], 7
lea ecx, [ebp - 0x3bd8]
mov word [ebp + esi - 0x3bd8], ax
mov dword [ebp - 0x4c90], eax
lea edx, [ecx + 2]
mov word [ebp - 0x4ca0], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x406666
sub ecx, edx
lea eax, [ebp - 0x3bd8]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x4ca0]
call fcn.00402430
lea ecx, [edi + 0x80]
mov dword [ebp - 4], 0
mov eax, dword [ecx + 4]
cmp dword [ecx + 8], eax
je 0x4066c8
movups xmm0, xmmword [ebp - 0x4ca0]
mov edx, 7
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x4c90]
movq qword [eax + 0x10], xmm0
xor eax, eax
add dword [ecx + 4], 0x18
mov word [ebp - 0x4ca0], ax
jmp 0x4066db
lea edx, [ebp - 0x4ca0]
push edx
push eax
call fcn.0040aa00
mov edx, dword [ebp - 0x4c8c]
mov dword [ebp - 4], 0xffffffff
cmp edx, 8
jb 0x40671c
mov ecx, dword [ebp - 0x4ca0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x406712
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x406aa3
push edx
push ecx
call fcn.0046ba31
add esp, 8
lea eax, [ebp - 0x3bd8]
push 0x1388
push eax
call fcn.0047525d
add esp, 8
mov dword [ebp - 0x4bec], 0
xor eax, eax
mov dword [ebp - 0x4be8], 7
lea ecx, [ebp - 0x3bd8]
mov word [ebp - 0x4bfc], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x406756
sub ecx, edx
lea eax, [ebp - 0x3bd8]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x4bfc]
call fcn.00402430
push ecx
push str..inf:
lea ecx, [ebp - 0x4bfc]
mov dword [ebp - 4], 1
call fcn.0040a4e0
mov esi, eax
cmp esi, 0xffffffff
jne 0x4067b3
push ecx
push 0x492434
lea ecx, [ebp - 0x4bfc]
call fcn.0040a4e0
mov esi, eax
cmp esi, 0xffffffff
je 0x406938
push 0xc8
lea eax, [ebp - 0xe0]
push 0
push eax
call fcn.0046dcc0
lea ecx, [esi*2 + 8]
add esp, 0xc
mov eax, esi
cmp ecx, 0x2710
jae 0x406aa8
xor edx, edx
mov word [ebp + ecx - 0x3bd8], dx
test esi, esi
jle 0x40680a
nop dword [eax]
movzx ecx, word [ebp + eax*2 - 0x3bd8]
cmp ecx, 0x3a
je 0x406809
cmp ecx, 0x5c
je 0x406809
dec eax
test eax, eax
jg 0x4067f0
jmp 0x40680a
inc eax
test eax, eax
jne 0x406832
test esi, esi
jle 0x406832
cmp word [ebp + eax*2 - 0x3bd8], 0x2d
jne 0x406828
cmp word [ebp + eax*2 - 0x3bd6], 0x20
je 0x40682f
inc eax
cmp eax, esi
jl 0x406812
jmp 0x406832
add eax, 2
xor ecx, ecx
cmp eax, esi
cmovne ecx, eax
lea eax, [ebp - 0x3bd8]
lea eax, [eax + ecx*2]
push eax
lea eax, [ebp - 0xe0]
push 0x64
push eax
call fcn.00474910
mov esi, dword [ebp - 0x4c78]
add esp, 0xc
inc esi
mov dword [ebp - 0x4c78], esi
push 0x44
call fcn.0046ba01
mov ecx, dword [ebp - 0x4c88]
add esp, 4
add ecx, esi
mov dword [ebp - 0x4ca4], eax
push 0xe
push 0xffffffffffffffff
push dword [ebp - 0x4c84]
push ecx
mov ecx, eax
call fcn.004038a0
mov edi, eax
lea eax, [ebp - 0x4cb0]
push 0x33e
push eax
call fcn.0046cd70
add esp, 8
mov byte [ebp - 4], 2
mov edx, 0x491dd8
mov ecx, dword [eax]
test ecx, ecx
cmovne edx, ecx
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4068b6
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [edi + 4]
call fcn.00402430
mov byte [ebp - 4], 1
push dword [ebp - 0x4ca8]
call fcn.0046bc3a
add esp, 4
push dword [ebp - 0x4cb0]
call fcn.0046bc3a
lea edx, [ebp - 0xe0]
add esp, 4
lea ecx, [edx + 2]
nop dword [eax + eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x406900
sub edx, ecx
lea eax, [ebp - 0xe0]
sar edx, 1
lea ecx, [edi + 4]
push edx
push eax
call fcn.0040a760
push 0
push edi
mov edi, dword [ebp - 0x4c7c]
push 0x8064
mov eax, dword [edi + 0x7c]
push dword [eax]
call dword [sym.imp.USER32.dll_PostMessageW]
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x4be8]
xor esi, esi
mov word [ebp - 0x3bd8], ax
cmp edx, 8
jb 0x40698a
mov ecx, dword [ebp - 0x4bfc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x406980
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x406aa3
push edx
push ecx
call fcn.0046ba31
add esp, 8
mov ecx, dword [ebp - 0x4c80]
mov al, byte [ebp + ecx - 0x4bd8]
cmp al, 0xd
je 0x4069aa
cmp al, 0xa
je 0x4069aa
cbw
mov word [ebp + esi*2 - 0x3bd8], ax
inc esi
inc ecx
mov dword [ebp - 0x4c80], ecx
cmp ecx, dword [ebp - 0x4be0]
jl 0x406620
lea eax, [ebp - 0x4be4]
push eax
push dword [ebp - 0x4c28]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push 0
lea eax, [ebp - 0x4bdc]
mov dword [ebp - 0x4bdc], 0
push eax
push 0
push 0x1000
push 0
push dword [ebp - 0x4c00]
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov eax, dword [ebp - 0x4be4]
cmp eax, 0x103
jne 0x406a2e
cmp dword [ebp - 0x4bdc], 0
jne 0x4065d0
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x4be4]
cmp eax, 0x103
je 0x4065d0
cmp dword [ebp - 0x4bdc], 0
ja 0x4065d0
push dword [ebp - 0x4c28]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x8c], eax
call esi
push dword [ebp - 0x4c24]
call esi
jmp 0x406a60
mov byte [ebp - 0x4c71], 1
mov eax, dword [ebp - 0x4c00]
test eax, eax
je 0x406a6d
push eax
call esi
mov eax, dword [ebp - 0x4c04]
test eax, eax
je 0x406a7a
push eax
call esi
mov eax, dword [ebp - 0x4c08]
test eax, eax
je 0x406a87
push eax
call esi
mov eax, dword [ebp - 0x4c0c]
test eax, eax
je 0x406a94
push eax
call esi
cmp byte [ebp - 0x4c71], 0
sete al
jmp 0x4063c1
call fcn.00471513
call fcn.0046bb60
int3