Function at 0x40bcc0
Capabilities:
Check os version
Create pipe
Create process on windows
Create reverse shell
Create two anonymous pipes
Manipulate console buffer
Read file on windows
Read pipe
Write and execute a file
Write file on windows
Write pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x53c
mov dword [ebp - 0x7c], 0
xor eax, eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x80], eax
mov edx, dword [ebp - 0x80]
add edx, 0x109
push edx
push 0
mov eax, dword [0x416870]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x494], 0xc
mov dword [ebp - 0x490], 0
mov dword [ebp - 0x48c], 1
mov ecx, dword [ebp - 0x64]
push ecx
call fcn.00405dc0
add esp, 4
push str.__Command__
mov edx, dword [ebp - 0x64]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
lea eax, [ebp - 0x494]
push eax
lea ecx, [ebp - 0x4b0]
push ecx
lea edx, [ebp - 0x49c]
push edx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x40bd8a
mov eax, dword [ebp - 0x64]
push eax
push 0
mov ecx, dword [0x416870]
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 1
jmp 0x40c80c
push 0
lea edx, [ebp - 0x494]
push edx
lea eax, [ebp - 0x4a4]
push eax
lea ecx, [ebp - 0x4ac]
push ecx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x40bde1
mov edx, dword [ebp - 0x64]
push edx
push 0
mov eax, dword [0x416870]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 0x49c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x4b0]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x40c80c
push 2
push 0
push 0
lea eax, [ebp - 0x498]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
mov ecx, dword [ebp - 0x49c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov edx, dword [ebp - 0x49c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 2
push 0
push 0
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
mov ecx, dword [ebp - 0x4a4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov edx, dword [ebp - 0x4a4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x44
push 0
lea eax, [ebp - 0x60]
push eax
call fcn.0040f1c0
add esp, 0xc
mov dword [ebp - 0x60], 0x44
mov dword [ebp - 0x34], 0x100
mov ecx, dword [ebp - 0x4b0]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x4ac]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x4b0]
mov dword [ebp - 0x24], eax
movzx ecx, byte [ebp + 0x10]
test ecx, ecx
je 0x40bea5
cmp dword [ebp - 4], 0x80000000
jb 0x40be9a
xor edx, edx
mov word [ebp - 0x30], dx
jmp 0x40bea5
mov eax, dword [ebp - 8]
or eax, 0x8000000
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x7c]
push ecx
lea edx, [ebp - 0x60]
push edx
push 0
push 0
mov eax, dword [ebp - 8]
push eax
push 1
push 0
push 0
mov ecx, dword [ebp - 0x64]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x40bf18
mov edx, dword [ebp - 0x64]
push edx
push 0
mov eax, dword [0x416870]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 0x498]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x4b0]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x4ac]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x40c80c
push 0
lea edx, [ebp - 0x68]
push edx
push 0xd
push str._arg_______r_n
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp - 0x80], 0
jle 0x40c0cc
lea ecx, [ebp - 0x4e8]
call fcn.00410630
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x4e8]
call fcn.00407380
lea edx, [ebp - 0x4ec]
push edx
lea eax, [ebp - 0x4e8]
push eax
call fcn.004079e0
mov dword [ebp - 0x14], 0
jmp 0x40bf78
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 0x4ec]
jge 0x40c0c1
mov byte [ebp - 0x4f1], 1
lea eax, [ebp - 0x4f0]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
lea edx, [ebp - 0x4e8]
push edx
call fcn.00407940
mov eax, dword [ebp - 0x4f0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 0x4f8], eax
push 0
lea ecx, [ebp - 0x68]
push ecx
push 9
push str._arg__
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x4f0]
movzx ecx, word [eax]
cmp ecx, 0x22
je 0x40bffe
push 0
lea edx, [ebp - 0x68]
push edx
push 1
push 0x411460
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov byte [ebp - 0x4f1], 0
mov ecx, dword [ebp - 0x4f8]
push ecx
push 0
mov edx, dword [0x416870]
push edx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x4fc], eax
push 0
push 0
mov eax, dword [ebp - 0x4f8]
push eax
mov ecx, dword [ebp - 0x4fc]
push ecx
push 0xffffffffffffffff
mov edx, dword [ebp - 0x4f0]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
lea eax, [ebp - 0x68]
push eax
mov ecx, dword [ebp - 0x4f8]
sub ecx, 1
push ecx
mov edx, dword [ebp - 0x4fc]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 0x4fc]
push ecx
push 0
mov edx, dword [0x416870]
push edx
call dword [sym.imp.KERNEL32.dll_HeapFree]
movzx eax, byte [ebp - 0x4f1]
test eax, eax
jne 0x40c098
push 0
lea ecx, [ebp - 0x68]
push ecx
push 1
push 0x411464
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 0x68]
push eax
push 2
push 0x411468
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 0x4f0]
push edx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x40bf6f
lea ecx, [ebp - 0x4e8]
call fcn.00407730
mov eax, dword [ebp + 8]
mov dword [ebp - 0x6c], eax
mov ecx, 1
test ecx, ecx
je 0x40c6e8
mov edx, dword [ebp - 0x6c]
movsx eax, byte [edx]
test eax, eax
jne 0x40c0ee
jmp 0x40c6e8
mov dword [ebp - 0x14], 0
jmp 0x40c100
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x6c]
add edx, dword [ebp - 0x14]
mov al, byte [edx]
mov byte [ebp - 0x49d], al
movsx ecx, byte [ebp - 0x49d]
test ecx, ecx
je 0x40c131
movsx edx, byte [ebp - 0x49d]
cmp edx, 0xd
je 0x40c131
movsx eax, byte [ebp - 0x49d]
cmp eax, 0xa
jne 0x40c133
jmp 0x40c135
jmp 0x40c0f7
cmp dword [ebp - 0x14], 0
jne 0x40c146
mov ecx, dword [ebp - 0x6c]
add ecx, 1
mov dword [ebp - 0x6c], ecx
jmp 0x40c0d2
mov edx, dword [ebp - 0x6c]
add edx, dword [ebp - 0x14]
mov byte [edx], 0
mov dword [ebp - 0x50c], 0
mov dword [ebp - 0x4a8], 0
jmp 0x40c174
mov eax, dword [ebp - 0x4a8]
add eax, 1
mov dword [ebp - 0x4a8], eax
mov ecx, dword [ebp - 0x4a8]
cmp ecx, dword [ebp - 0x14]
jge 0x40c313
mov edx, dword [ebp - 0x50c]
mov dword [ebp - 0x53c], edx
cmp dword [ebp - 0x53c], 4
ja case.default.0x40c1a2
mov eax, dword [ebp - 0x53c]
jmp dword [eax*4 + 0x40c810]
mov ecx, dword [ebp - 0x6c]
add ecx, dword [ebp - 0x4a8]
movsx edx, byte [ecx]
cmp edx, 0x24
jne 0x40c1cb
mov eax, dword [ebp - 0x50c]
add eax, 1
mov dword [ebp - 0x50c], eax
jmp 0x40c1d5
mov dword [ebp - 0x50c], 0
jmp case.default.0x40c1a2
mov ecx, dword [ebp - 0x6c]
add ecx, dword [ebp - 0x4a8]
movsx edx, byte [ecx]
cmp edx, 0x61
je 0x40c1fc
mov eax, dword [ebp - 0x6c]
add eax, dword [ebp - 0x4a8]
movsx ecx, byte [eax]
cmp ecx, 0x41
jne 0x40c20d
mov edx, dword [ebp - 0x50c]
add edx, 1
mov dword [ebp - 0x50c], edx
jmp 0x40c217
mov dword [ebp - 0x50c], 0
jmp case.default.0x40c1a2
mov eax, dword [ebp - 0x6c]
add eax, dword [ebp - 0x4a8]
movsx ecx, byte [eax]
cmp ecx, 0x72
je 0x40c23e
mov edx, dword [ebp - 0x6c]
add edx, dword [ebp - 0x4a8]
movsx eax, byte [edx]
cmp eax, 0x52
jne 0x40c24f
mov ecx, dword [ebp - 0x50c]
add ecx, 1
mov dword [ebp - 0x50c], ecx
jmp 0x40c259
mov dword [ebp - 0x50c], 0
jmp case.default.0x40c1a2
mov edx, dword [ebp - 0x6c]
add edx, dword [ebp - 0x4a8]
movsx eax, byte [edx]
cmp eax, 0x67
je 0x40c27d
mov ecx, dword [ebp - 0x6c]
add ecx, dword [ebp - 0x4a8]
movsx edx, byte [ecx]
cmp edx, 0x47
jne 0x40c28e
mov eax, dword [ebp - 0x50c]
add eax, 1
mov dword [ebp - 0x50c], eax
jmp 0x40c298
mov dword [ebp - 0x50c], 0
jmp case.default.0x40c1a2
mov ecx, dword [ebp - 0x6c]
add ecx, dword [ebp - 0x4a8]
movsx edx, byte [ecx]
cmp edx, 0x73
je 0x40c2bc
mov eax, dword [ebp - 0x6c]
add eax, dword [ebp - 0x4a8]
movsx ecx, byte [eax]
cmp ecx, 0x53
jne 0x40c2cd
mov edx, dword [ebp - 0x50c]
add edx, 1
mov dword [ebp - 0x50c], edx
jmp case.default.0x40c1a2
mov dword [ebp - 0x50c], 0
cmp dword [ebp - 0x50c], 5
jne 0x40c30e
mov eax, dword [ebp - 0x6c]
add eax, dword [ebp - 0x4a8]
movzx ecx, byte [eax + 1]
push ecx
call dword [sym.imp.USER32.dll_IsCharAlphaNumericA]
test eax, eax
jne 0x40c30e
mov edx, dword [ebp - 0x6c]
add edx, dword [ebp - 0x4a8]
mov byte [edx], 0x5f
mov dword [ebp - 0x50c], 0
jmp 0x40c165
mov dword [ebp - 0xc], 0
push 0
lea eax, [ebp - 0x68]
push eax
mov ecx, dword [ebp - 0x6c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov edx, dword [ebp - 0x6c]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x4a8], 0
jmp 0x40c354
mov ecx, dword [ebp - 0x4a8]
add ecx, 1
mov dword [ebp - 0x4a8], ecx
mov edx, dword [ebp - 0x4a8]
cmp edx, dword [ebp - 0x68]
jae 0x40c39f
mov eax, dword [ebp - 0x6c]
add eax, dword [ebp - 0x4a8]
movsx ecx, byte [eax]
cmp ecx, 0x20
je 0x40c381
mov edx, dword [ebp - 0x6c]
add edx, dword [ebp - 0x4a8]
movsx eax, byte [edx]
cmp eax, 9
jne 0x40c383
jmp 0x40c345
mov ecx, dword [ebp - 0x6c]
add ecx, dword [ebp - 0x4a8]
movsx edx, byte [ecx]
cmp edx, 0x23
jne 0x40c39b
mov dword [ebp - 0xc], 1
jmp 0x40c39f
cmp dword [ebp - 0xc], 0
jne 0x40c3bc
push 0
lea eax, [ebp - 0x68]
push eax
push 0x15
push str.__Write_Output___OK__
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea edx, [ebp - 0x68]
push edx
push 2
push 0x411484
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp - 0xc], 0
jne 0x40c408
push 0
lea ecx, [ebp - 0x68]
push ecx
push 0
push 0
push 0
mov edx, dword [ebp - 0x498]
push edx
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x40c3fe
cmp dword [ebp - 0x68], 0
je 0x40c3fe
jmp 0x40c408
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40c3d3
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x84], eax
push 0
lea ecx, [ebp - 0x68]
push ecx
push 0
push 0
push 0
mov edx, dword [ebp - 0x498]
push edx
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x40c4f2
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x510], eax
cmp dword [ebp - 0x68], 0
jne 0x40c44f
cmp dword [ebp - 0x84], 0
je 0x40c44f
jmp 0x40c4f2
cmp dword [ebp - 0x510], 0x400
jle 0x40c465
mov dword [ebp - 0x510], 0x3ff
mov ecx, dword [ebp - 0x510]
mov byte [ebp + ecx - 0x488], 0
push 0
lea edx, [ebp - 0x68]
push edx
mov eax, dword [ebp - 0x510]
push eax
lea ecx, [ebp - 0x488]
push ecx
mov edx, dword [ebp - 0x498]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 0x68], 6
jb 0x40c4c7
push str._OK__r_n
mov eax, dword [ebp - 0x68]
lea ecx, [ebp + eax - 0x48e]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x40c4c7
mov edx, dword [ebp - 0x68]
sub edx, 6
mov dword [ebp - 0x68], edx
mov dword [ebp - 0x84], 1
cmp dword [ebp - 0x68], 0
je 0x40c4ed
push 0
lea eax, [ebp - 0x68]
push eax
mov ecx, dword [ebp - 0x68]
push ecx
lea edx, [ebp - 0x488]
push edx
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x40c411
mov eax, dword [ebp - 0x6c]
push eax
call dword [sym.imp.USER32.dll_CharLowerA]
push 0x22
mov ecx, dword [ebp - 0x6c]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrChrA]
mov dword [ebp - 0x508], eax
push 0x23
mov edx, dword [ebp - 0x6c]
push edx
call dword [sym.imp.SHLWAPI.dll_StrChrA]
mov dword [ebp - 0x504], eax
push str.read_host
mov eax, dword [ebp - 0x6c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrA]
mov dword [ebp - 0x500], eax
mov ecx, 1
test ecx, ecx
je 0x40c5cb
cmp dword [ebp - 0x500], 0
jne 0x40c54d
jmp 0x40c5cb
cmp dword [ebp - 0x508], 0
je 0x40c566
mov edx, dword [ebp - 0x500]
cmp edx, dword [ebp - 0x508]
jbe 0x40c566
jmp 0x40c5cb
cmp dword [ebp - 0x504], 0
je 0x40c57f
mov eax, dword [ebp - 0x500]
cmp eax, dword [ebp - 0x504]
jbe 0x40c57f
jmp 0x40c5cb
push 0
lea ecx, [ebp - 0x68]
push ecx
push 0x400
lea edx, [ebp - 0x488]
push edx
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 0x68], 0
je 0x40c5c4
push 0
lea eax, [ebp - 0x68]
push eax
mov ecx, dword [ebp - 0x68]
push ecx
lea edx, [ebp - 0x488]
push edx
mov eax, dword [ebp - 0x4b0]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x40c5cb
push str.clear_host
mov ecx, dword [ebp - 0x6c]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrA]
mov dword [ebp - 0x500], eax
mov edx, 1
test edx, edx
je 0x40c6bb
cmp dword [ebp - 0x500], 0
jne 0x40c5fb
jmp 0x40c6bb
cmp dword [ebp - 0x508], 0
je 0x40c617
mov eax, dword [ebp - 0x500]
cmp eax, dword [ebp - 0x508]
jbe 0x40c617
jmp 0x40c6bb
cmp dword [ebp - 0x504], 0
je 0x40c633
mov ecx, dword [ebp - 0x500]
cmp ecx, dword [ebp - 0x504]
jbe 0x40c633
jmp 0x40c6bb
mov dword [ebp - 0x518], 0
xor edx, edx
mov word [ebp - 0x514], dx
xor eax, eax
mov word [ebp - 0x512], ax
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebp - 0x51c], eax
lea ecx, [ebp - 0x534]
push ecx
mov edx, dword [ebp - 0x51c]
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
lea eax, [ebp - 0x518]
push eax
mov ecx, dword [ebp - 0x514]
push ecx
movsx edx, word [ebp - 0x534]
movsx eax, word [ebp - 0x532]
imul edx, eax
push edx
push 0x20
mov ecx, dword [ebp - 0x51c]
push ecx
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterA]
mov edx, dword [ebp - 0x514]
push edx
mov eax, dword [ebp - 0x51c]
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
jmp 0x40c6bb
mov ecx, dword [ebp - 0x6c]
add ecx, dword [ebp - 0x14]
mov dl, byte [ebp - 0x49d]
mov byte [ecx], dl
movsx eax, byte [ebp - 0x49d]
test eax, eax
jne 0x40c6d6
jmp 0x40c6e8
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x6c]
lea eax, [edx + ecx + 1]
mov dword [ebp - 0x6c], eax
jmp 0x40c0d2
push 0
lea ecx, [ebp - 0x68]
push ecx
push 2
push 0x4114a8
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 0x68]
push eax
push 4
push str.exit
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea edx, [ebp - 0x68]
push edx
push 2
push 0x4114b4
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x7c]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
lea edx, [ebp - 0x68]
push edx
push 0
push 0
push 0
mov eax, dword [ebp - 0x498]
push eax
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x40c7c9
mov ecx, dword [ebp - 0x68]
mov dword [ebp - 0x538], ecx
cmp dword [ebp - 0x68], 0
jne 0x40c767
jmp 0x40c7c9
cmp dword [ebp - 0x538], 0x400
jle 0x40c77d
mov dword [ebp - 0x538], 0x400
push 0
lea edx, [ebp - 0x68]
push edx
mov eax, dword [ebp - 0x538]
push eax
lea ecx, [ebp - 0x488]
push ecx
mov edx, dword [ebp - 0x498]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 0x68], 0
je 0x40c7c4
push 0
lea eax, [ebp - 0x68]
push eax
mov ecx, dword [ebp - 0x68]
push ecx
lea edx, [ebp - 0x488]
push edx
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x40c739
mov eax, dword [ebp - 0x64]
push eax
push 0
mov ecx, dword [0x416870]
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edx, dword [ebp - 0x498]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x4b0]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x78]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x7c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov esp, ebp
pop ebp
ret