Function at 0x408170
Capabilities:
Connect pipe
Create pipe
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8b8
mov eax, dword [0x4375dc]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 4], 0
jne 0x408694
cmp dword [edi + 8], 0xffffffff
jne 0x408694
call fcn.0040b3b0
lea eax, [ebp - 0x844]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessId]
push 0x43aae8
mov esi, eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push eax
movzx eax, word [ebp - 0x836]
push esi
push eax
movzx eax, word [ebp - 0x838]
push eax
movzx eax, word [ebp - 0x83a]
push eax
movzx eax, word [ebp - 0x83c]
push eax
movzx eax, word [ebp - 0x83e]
push eax
movzx eax, word [ebp - 0x842]
push eax
movzx eax, word [ebp - 0x844]
push eax
lea eax, [ebp - 0x424]
push str..pipeFuturemark_SystemInfo_Scanner__04d_02d_02d_02d_02d_02d_04d__d__d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x2c
lea eax, [ebp - 0x850]
push 0
push 0
push eax
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
jne 0x408244
call fcn.0040d1a0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0040eff8
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [ebp - 0x850]
xor eax, eax
lea esp, [esp]
cmp word [ebx + eax*2], 0
jne 0x40825f
cmp word [ebx + eax*2 + 2], 0
je 0x408262
inc eax
jmp 0x408250
lea ecx, [eax + eax]
lea esi, [ebp - 0x424]
mov dword [ebp - 0x848], ecx
lea edx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x408274
sub esi, edx
sar esi, 1
add esi, 0x13
lea eax, [ecx + esi*2]
push eax
call fcn.0040f110
add esp, 4
mov dword [ebp - 0x84c], eax
push dword [ebp - 0x848]
push ebx
mov ebx, eax
push ebx
call fcn.004110d0
add esp, 0xc
push dword [ebp - 0x850]
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
push 0
push str.remoting1
push 0
lea eax, [ebp - 0x424]
push eax
mov eax, dword [ebp - 0x848]
push 0
push str._cpipe_s_c_s_c
add eax, ebx
push esi
push eax
call fcn.0041055c
add esp, 0x20
test eax, eax
jg 0x408305
mov edx, 2
mov ecx, str.Failed_to_format_pipe_name_
call fcn.0040d2e0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0040eff8
mov esp, ebp
pop ebp
ret 4
push 0
push 0
push 0x400
push 0x400
push 2
push 0
push 0x40000003
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov dword [edi + 8], eax
cmp eax, 0xffffffff
jne 0x40833b
call fcn.0040d430
jmp 0x40868b
push 0x208
lea eax, [ebp - 0x62c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp dword [edi + 0xc], 0
mov esi, 0x8000000
mov ecx, 0x10
cmovne esi, ecx
test eax, eax
je 0x40868b
cmp eax, 0x208
jae 0x40868b
push 0
push 0
push 0
push 0
push 0x104
lea eax, [ebp - 0x834]
push eax
push 0xa
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x62c]
push eax
call fcn.004106f8
add esp, 0x24
test eax, eax
jne 0x40868b
lea eax, [ebp - 0x834]
push eax
lea eax, [ebp - 0x1c]
push eax
push str._s_sFMSIScan.exe
lea eax, [ebp - 0x224]
push 0x104
push eax
call fcn.0041055c
add esp, 0x14
test eax, eax
jle 0x40868b
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
lea ecx, [ebp - 0x848]
mov dword [ebp - 0x848], 0
push ecx
push eax
call dword [sym.imp.WTSAPI32.dll_WTSQueryUserToken]
test eax, eax
je 0x40858b
lea eax, [ebp - 0x86c]
mov dword [ebp - 0x854], 0
push eax
push 4
lea eax, [ebp - 0x854]
mov dword [ebp - 0x86c], 4
push eax
push 0x13
push dword [ebp - 0x848]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x4084f8
lea eax, [ebp - 0x84c]
push eax
push 1
push 2
push 0
push 0x2000000
push dword [ebp - 0x854]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x40857f
push 0x44
lea eax, [ebp - 0x8b4]
push 0
push eax
call fcn.00411040
add esp, 0xc
mov dword [ebp - 0x8b4], 0x44
lea eax, [ebp - 0x864]
mov dword [ebp - 0x8ac], 0x4301d8
xorps xmm0, xmm0
movdqu xmmword [ebp - 0x864], xmm0
push eax
lea eax, [ebp - 0x8b4]
push eax
push 0
push ebx
mov eax, esi
or eax, 0x400
push eax
push 1
push 0
push 0
push 0x4301dc
lea eax, [ebp - 0x224]
push eax
push dword [ebp - 0x84c]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x4084dd
mov eax, dword [ebp - 0x864]
push dword [ebp - 0x84c]
mov dword [edi + 4], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40857f
mov ecx, str.CreateProcessAsUser_failed_with_primary_token_
call fcn.0040d570
push dword [ebp - 0x84c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40857f
push 0x44
lea eax, [ebp - 0x8b4]
push 0
push eax
call fcn.00411040
add esp, 0xc
mov dword [ebp - 0x8b4], 0x44
lea eax, [ebp - 0x864]
mov dword [ebp - 0x8ac], 0x430210
xorps xmm0, xmm0
movdqu xmmword [ebp - 0x864], xmm0
push eax
lea eax, [ebp - 0x8b4]
push eax
push 0
push ebx
mov eax, esi
or eax, 0x400
push eax
push 1
push 0
push 0
push 0x430214
lea eax, [ebp - 0x224]
push eax
push dword [ebp - 0x848]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x408570
mov eax, dword [ebp - 0x864]
mov dword [edi + 4], eax
jmp 0x40857f
mov edx, 1
mov ecx, str.CreateProcessAsUser_failed_
call fcn.0040d2e0
push dword [ebp - 0x848]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [edi + 4], 0
jne 0x40861e
push 0x44
lea eax, [ebp - 0x8b4]
push 0
push eax
call fcn.00411040
add esp, 0xc
mov dword [ebp - 0x8b4], 0x44
cmp dword [edi + 0xc], 0
mov ecx, 0x430254
mov eax, str.Winsta0Default
xorps xmm0, xmm0
cmove eax, ecx
or esi, 0x400
mov dword [ebp - 0x8ac], eax
lea eax, [ebp - 0x864]
push eax
lea eax, [ebp - 0x8b4]
push eax
push 0
push ebx
push esi
push 1
push 0
push 0
push 0x430258
lea eax, [ebp - 0x224]
push eax
movdqu xmmword [ebp - 0x864], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x408613
mov eax, dword [ebp - 0x864]
mov dword [edi + 4], eax
jmp 0x408618
call fcn.0040d710
cmp dword [edi + 4], 0
je 0x40868b
lea eax, [ebp - 0x868]
mov dword [ebp - 0x858], 0
push eax
push dword [edi + 8]
xorps xmm0, xmm0
movdqu xmmword [ebp - 0x868], xmm0
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x40867b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x4086a7
cmp dword [ebp - 0x868], 0x103
jne 0x40867b
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.0040b4f0
push 0xa
call esi
cmp dword [ebp - 0x868], 0x103
je 0x408666
mov ecx, edi
call fcn.0040a680
test eax, eax
je 0x40868b
call fcn.0040b630
push ebx
call fcn.0040f1a2
add esp, 4
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040eff8
mov esp, ebp
pop ebp
ret 4
call fcn.0040d850
jmp 0x40868b