Function at 0x4e6fc8
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create reverse shell
Create two anonymous pipes
Read file on windows
Read pipe
Terminate process
Write and execute a file
Write file on windows
Write pipe

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff1c
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xe4], edx
mov dword [ebp - 0xe0], edx
mov dword [ebp - 0xd8], edx
mov dword [ebp - 0xdc], edx
mov dword [ebp - 0xd4], edx
mov dword [ebp - 0xd0], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405f48
mov ecx, 0xa
lea eax, [ebp - 0x3c]
mov edx, dword [0x401140]
call fcn.00406934
xor eax, eax
push ebp
push 0x4e7568
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
mov eax, 0x1388
call fcn.004030f8
mov dword [ebp - 0x5c], eax
xor eax, eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x78], 0xc
mov dword [ebp - 0x70], 0xffffffff
xor eax, eax
mov dword [ebp - 0x74], eax
push 0
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x44]
push eax
call sub.kernel32.dll_CreatePipe
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x4e750a
push 0
push 1
mov eax, dword [ebp - 0x44]
push eax
call sub.kernel32.dll_SetHandleInformation
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x4e750a
push 0
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x4c]
push eax
call sub.kernel32.dll_CreatePipe
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x4e750a
push 0
push 1
mov eax, dword [ebp - 0x50]
push eax
call sub.kernel32.dll_SetHandleInformation
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x4e750a
lea eax, [ebp - 0xc]
mov edx, 0x4e7588
call fcn.00405fb4
lea eax, [ebp - 0xcc]
xor ecx, ecx
mov edx, 0x10
call fcn.00403a48
lea eax, [ebp - 0xbc]
xor ecx, ecx
mov edx, 0x44
call fcn.00403a48
mov dword [ebp - 0xbc], 0x44
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x90], 0x101
mov word [ebp - 0x8c], 0
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0xbc]
push eax
push 0
push 0
push 0x20
push 0xffffffffffffffff
push 0
push 0
push 0x4e75cc
push dword [ebp - 0xc]
push 0x4e75cc
lea eax, [ebp - 0xd0]
mov edx, 3
call fcn.004063ec
mov eax, dword [ebp - 0xd0]
call fcn.00405fec
push eax
push 0
call sub.kernel32.dll_CreateProcessW
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x4e750a
mov byte [ebp - 0x5d], 0
mov byte [ebp - 0x5e], 1
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0040ba28
lea edx, [ebp - 0x14]
mov eax, 0x4e75dc
call fcn.0040ba28
mov eax, dword [ebp - 0x5c]
xor ecx, ecx
mov edx, 0x1000
call fcn.00403a48
push 0
push 0
lea eax, [ebp - 0x54]
push eax
push 0x1000
mov eax, dword [ebp - 0x5c]
push eax
mov eax, dword [ebp - 0x44]
push eax
call sub.kernel32.dll_PeekNamedPipe
cmp eax, 1
sbb ebx, ebx
inc ebx
mov eax, dword [0x4f6634]
mov eax, dword [eax]
call fcn.00476158
cmp dword [ebp - 0x54], 0
jbe 0x4e7385
test bl, bl
je 0x4e7385
mov eax, dword [ebp - 0x5c]
xor ecx, ecx
mov edx, 0x1000
call fcn.00403a48
push 0
lea eax, [ebp - 0x54]
push eax
push 0x1000
mov eax, dword [ebp - 0x5c]
push eax
mov eax, dword [ebp - 0x44]
push eax
call sub.kernel32.dll_ReadFile_1
cmp eax, 1
sbb ebx, ebx
inc ebx
mov eax, dword [0x4f6634]
mov eax, dword [eax]
call fcn.00476158
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x5c]
call fcn.004060dc
cmp dword [ebp - 0x54], 0
jne 0x4e728e
test bl, bl
jne 0x4e728e
mov eax, dword [ebp - 8]
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
je 0x4e726d
mov eax, dword [ebp - 0x64]
sub eax, 0xa
cmp word [eax], 2
je 0x4e726d
lea eax, [ebp - 8]
mov edx, dword [ebp - 8]
call fcn.004056d0
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0
je 0x4e7284
mov eax, dword [ebp - 0x68]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0
je 0x4e7482
lea edx, [ebp - 0xd4]
mov eax, dword [ebp - 8]
call fcn.0040ba28
mov edx, dword [ebp - 0xd4]
lea eax, [ebp - 8]
call fcn.00405fb4
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.004068b4
test eax, eax
jle 0x4e7369
mov edx, dword [ebp - 8]
mov eax, 0x4e75fc
call fcn.004068b4
test eax, eax
jg 0x4e7369
mov edx, dword [ebp - 8]
mov eax, 0x4e7618
call fcn.004068b4
test eax, eax
jg 0x4e7369
mov edx, dword [ebp - 8]
mov eax, 0x4e7630
call fcn.004068b4
test eax, eax
jg 0x4e7369
lea eax, [ebp - 0xdc]
mov edx, dword [ebp - 8]
call fcn.004061c4
mov eax, dword [ebp - 0xdc]
lea ecx, [ebp - 0xd8]
mov edx, 2
call fcn.0040a358
mov eax, dword [ebp - 0xd8]
mov edx, 0x4e763c
call fcn.00405e58
je 0x4e7332
mov byte [ebp - 0x5d], 1
mov edx, dword [ebp - 8]
mov eax, 0x4e75fc
call fcn.004068b4
test eax, eax
jg 0x4e7365
mov edx, dword [ebp - 8]
mov eax, 0x4e7618
call fcn.004068b4
test eax, eax
jg 0x4e7365
mov edx, dword [ebp - 8]
mov eax, 0x4e7630
call fcn.004068b4
test eax, eax
jle 0x4e7369
mov byte [ebp - 0x5d], 0
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
call fcn.004068b4
test eax, eax
jle 0x4e71ac
mov byte [ebp - 0x5e], 0
jmp 0x4e71ac
inc edi
cmp edi, 1
jne 0x4e7398
lea eax, [ebp - 0x3c]
mov edx, 0x4e7650
call fcn.004055b0
cmp edi, 2
jne 0x4e73cd
push 0x4e7668
push dword [ebp - 4]
push 0x4e76a0
lea eax, [ebp - 0xe0]
mov edx, 3
call fcn.004063ec
mov edx, dword [ebp - 0xe0]
lea eax, [ebp - 0x38]
mov ecx, 0
call fcn.0040618c
cmp edi, 3
jne 0x4e7407
push 0x4e7668
push dword [ebp - 4]
push 0x4e76b4
push 0x4e76a0
lea eax, [ebp - 0xe4]
mov edx, 4
call fcn.004063ec
mov edx, dword [ebp - 0xe4]
lea eax, [ebp - 0x34]
mov ecx, 0
call fcn.0040618c
cmp edi, 4
jne 0x4e7419
lea eax, [ebp - 0x30]
mov edx, 0x4e76cc
call fcn.004055b0
cmp edi, 5
je 0x4e7482
mov eax, dword [ebp + edi*4 - 0x40]
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
je 0x4e7436
mov eax, dword [ebp - 0x6c]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x54], eax
push 0
lea eax, [ebp - 0x58]
push eax
mov eax, dword [ebp - 0x54]
push eax
lea eax, [ebp + edi*4 - 0x40]
call fcn.004059cc
push eax
mov eax, dword [ebp - 0x50]
push eax
call sub.kernel32.dll_WriteFile_1
cmp eax, 1
sbb ebx, ebx
inc ebx
mov esi, 6
mov eax, dword [0x4f6634]
mov eax, dword [eax]
call fcn.00476158
push 0x32
call sub.kernel32.dll_Sleep_2
dec esi
jne 0x4e7464
test bl, bl
jne 0x4e71ac
cmp byte [ebp - 0x5d], 0
je 0x4e749e
cmp byte [ebp - 0x5e], 0
je 0x4e7497
mov dword [ebp - 0x40], 1
jmp 0x4e749e
mov dword [ebp - 0x40], 2
xor eax, eax
push ebp
push 0x4e7500
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 0xcc]
push eax
call sub.kernel32.dll_TerminateProcess
mov eax, dword [ebp - 0xcc]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0xc8]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x4c]
push eax
call sub.kernel32.dll_DisconnectNamedPipe
mov eax, dword [ebp - 0x50]
push eax
call sub.kernel32.dll_DisconnectNamedPipe
mov eax, dword [ebp - 0x44]
push eax
call sub.kernel32.dll_DisconnectNamedPipe
mov eax, dword [ebp - 0x48]
push eax
call sub.kernel32.dll_DisconnectNamedPipe
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4e750a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e756f
lea eax, [ebp - 0xe4]
mov edx, 2
call fcn.00405f58
lea eax, [ebp - 0xdc]
mov edx, 2
call fcn.00405b18
lea eax, [ebp - 0xd4]
mov edx, 2
call fcn.00405f58
lea eax, [ebp - 0x3c]
mov ecx, 0xa
mov edx, dword [0x401140]
call fcn.00406a28
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00405f58
ret