Function at 0x403a70
Capabilities:
Create process on windows
Create reverse shell
Read pipe
Write pipe

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rbx, rdx
mov rsi, rcx
mov rcx, rdx
call fcn.004136f0
mov rcx, rbx
mov edi, eax
call fcn.004136f0
mov rcx, rbx
mov ebp, eax
lea rbx, [rsp + 0x30]
call fcn.00413920
mov r8d, ebp
mov edx, edi
mov rcx, rsi
call fcn.00401ed0
lea rdx, [rsp + 0x28]
mov r8d, 8
mov rcx, rbx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x28], 0
call fcn.00413980
mov rdx, rbx
mov rcx, rsi
call fcn.00401d20
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x40216e
call fcn.004aaf10
nop
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x238
cmp qword [rcx + 0xb0], 0
mov rbx, rcx
mov rdi, rdx
je 0x40347b
lea r8, str.m_childProcess__nullptr
lea rcx, str.src_agent_Agent.cc
mov edx, 0x15d
call fcn.00418fa0
cmp byte [rbx + 0xa2], 0
jne 0x4038e0
mov rcx, rdi
lea r12, [rsp + 0x120]
lea rbp, [rsp + 0x140]
call fcn.00413780
mov rcx, rdi
mov qword [rsp + 0x80], rax
call fcn.004136f0
mov rcx, rdi
mov dword [rsp + 0x88], eax
call fcn.004136f0
mov rdx, rdi
mov rcx, r12
mov dword [rsp + 0x8c], eax
call fcn.00413810
mov rdx, rdi
mov rcx, rbp
call fcn.00413810
lea rax, [rsp + 0x160]
mov rdx, rdi
mov rcx, rax
mov qword [rsp + 0x58], rax
call fcn.00413810
lea rax, [rsp + 0x180]
mov rdx, rdi
mov rcx, rax
mov qword [rsp + 0x60], rax
call fcn.00413810
lea rsi, [rsp + 0x1a0]
mov rdx, rdi
mov rcx, rsi
call fcn.00413810
mov rcx, rdi
call fcn.00413920
lea rcx, [rsp + 0xa0]
mov rdx, rbp
call fcn.0042f950
lea rcx, [rsp + 0xc0]
mov rdx, rsi
call fcn.0042f950
mov r14, qword [rsp + 0x188]
mov r15, qword [rsp + 0x180]
lea rdi, [r14 + r14]
mov rax, rdi
sar rax, 1
je 0x403955
js 0x40395d
mov rcx, rdi
call fcn.004aaf50
mov r8, rdi
mov rdx, r15
mov rcx, rax
mov r13, rax
mov r14, qword [rsp + 0x188]
call fcn.0042f090
xor eax, eax
cmp qword [rsp + 0x128], 0
mov ecx, 0xd
mov rdx, rax
cmovne rdx, qword [rsp + 0x120]
cmp qword [rsp + 0x148], 0
mov rdi, rax
cmovne rdi, qword [rsp + 0xa0]
cmp qword [rsp + 0x168], 0
mov r15, rax
cmovne r15, qword [rsp + 0x160]
test r14, r14
lea r14, [rsp + 0x1c0]
mov qword [rsp + 0xe0], 0
mov qword [rsp + 0xe8], 0
mov qword [rsp + 0x68], rdx
mov rdx, rax
mov qword [rsp + 0xf0], 0
cmovne rdx, r13
mov qword [rsp + 0x70], rdi
cmp qword [rsp + 0x1a8], 0
mov rdi, r14
mov qword [rsp + 0x78], rdx
rep stosq qword [rdi], rax
cmovne rax, qword [rsp + 0xc0]
cmp byte [rbx + 0x38], 0
mov dword [rsp + 0x1c0], 0x68
mov qword [rsp + 0x1d0], rax
jne 0x403880
xor edx, edx
lea rax, [rsp + 0xe0]
mov dword [rsp + 0x20], edx
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x28], 0x400
xor r9d, r9d
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x78]
xor r8d, r8d
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
mov r14d, eax
je 0x403920
mov r8d, dword [rsp + 0xf0]
lea rdx, str.success
xor r15d, r15d
lea rcx, str.CreateProcess:__s__u
call fcn.00413ac0
lea rdi, [rsp + 0x100]
lea rdx, [rsp + 0x98]
mov r8d, 8
mov qword [rsp + 0x100], 0
mov qword [rsp + 0x108], 0
mov rcx, rdi
mov qword [rsp + 0x110], 0
mov qword [rsp + 0x98], 0
call fcn.00413980
test r14d, r14d
je 0x403900
mov edx, dword [rsp + 0x88]
xor r14d, r14d
test edx, edx
jne 0x403940
mov eax, dword [rsp + 0x8c]
test eax, eax
je 0x4038d0
mov rcx, qword [rsp + 0xe8]
call fcn.004015d0
mov r15, rax
mov rcx, qword [rsp + 0xe8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0xe0]
mov edx, 1
mov rcx, rdi
mov qword [rbx + 0xb0], rax
mov rax, qword [rsp + 0x80]
mov byte [rbx + 0xa0], al
and byte [rbx + 0xa0], 1
shr rax, 1
and eax, 1
mov byte [rbx + 0xa1], al
call fcn.004139a0
mov rdx, r14
mov rcx, rdi
call fcn.004139f0
mov rdx, r15
mov rcx, rdi
call fcn.004139f0
mov rdx, rdi
mov rcx, rbx
call fcn.00401d20
mov rcx, qword [rsp + 0x100]
test rcx, rcx
je 0x4037c2
call fcn.004aaf10
test r13, r13
je 0x4037cf
mov rcx, r13
call fcn.004aaf10
mov rcx, qword [rsp + 0xc0]
test rcx, rcx
je 0x4037e1
call fcn.004aaf10
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
je 0x4037f3
call fcn.004aaf10
mov rcx, qword [rsp + 0x1a0]
add rsi, 0x10
cmp rcx, rsi
je 0x403809
call fcn.004aaf10
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x180]
add rax, 0x10
cmp rcx, rax
je 0x403824
call fcn.004aaf10
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x160]
add rax, 0x10
cmp rcx, rax
je 0x40383f
call fcn.004aaf10
mov rcx, qword [rsp + 0x140]
add rbp, 0x10
cmp rcx, rbp
je 0x403855
call fcn.004aaf10
mov rcx, qword [rsp + 0x120]
add r12, 0x10
cmp rcx, r12
je 0x40386c
call fcn.004aaf10
nop
add rsp, 0x238
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov dword [rsp + 0x1fc], 0x100
mov ecx, 0xfffffff6
mov rdi, qword [sym.imp.KERNEL32.dll_GetStdHandle]
call rdi
mov qword [rsp + 0x210], rax
mov ecx, 0xfffffff5
call rdi
mov rcx, qword [rbx + 0x78]
mov qword [rsp + 0x218], rax
call fcn.00411d40
mov qword [rsp + 0x220], rax
mov edx, 1
jmp 0x403650
xor r15d, r15d
jmp 0x403744
lea r8, str._m_closingOutputPipes
lea rcx, str.src_agent_Agent.cc
mov edx, 0x15e
call fcn.00418fa0
jmp 0x403488
xor edx, edx
mov rcx, rdi
call fcn.004139a0
mov edx, r15d
mov rcx, rdi
call fcn.004139a0
jmp 0x4037a5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15d, eax
mov r8d, dword [rsp + 0xf0]
lea rdx, str.fail
jmp 0x4036b0
mov rcx, qword [rsp + 0xe0]
call fcn.004015d0
mov r14, rax
jmp 0x403725
xor r13d, r13d
jmp 0x40358e
call fcn.004a4cc0
mov rbx, rax
mov rcx, qword [rsp + 0xc0]
test rcx, rcx
je 0x403977
call fcn.004aaf10
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
je 0x403989
call fcn.004aaf10
mov rcx, qword [rsp + 0x1a0]
add rsi, 0x10
cmp rcx, rsi
je 0x40399f
call fcn.004aaf10
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x180]
add rax, 0x10
cmp rcx, rax
je 0x4039ba
call fcn.004aaf10
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x160]
add rax, 0x10
cmp rcx, rax
je 0x4039d5
call fcn.004aaf10
mov rcx, qword [rsp + 0x140]
add rbp, 0x10
cmp rcx, rbp
je 0x4039eb
call fcn.004aaf10
mov rcx, qword [rsp + 0x120]
add r12, 0x10
cmp rcx, r12
je 0x403a01
call fcn.004aaf10
mov rcx, rbx
call fcn.00424a70
mov rcx, qword [rsp + 0x100]
mov rbx, rax
test rcx, rcx
je 0x403a1e
call fcn.004aaf10
test r13, r13
je 0x403965
mov rcx, r13
call fcn.004aaf10
jmp 0x403965
push rsi
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rcx, rdx
mov rbx, rdx
call fcn.004136f0
test eax, eax
je 0x403ab4
cmp eax, 1
jne 0x403aa0
mov rdx, rbx
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp 0x4020e0
lea rcx, str.Unrecognized_message__id:_d
mov edx, eax
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.00413ac0
mov rdx, rbx
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp 0x403440