Function at 0x401000
Capabilities:
Create process on windows
Read file on windows
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x484
push ebx
push esi
push edi
mov dword [ebp - 0x484], edx
mov dword [ebp - 0x480], ecx
push 0
push pe_nt_image_headers32
push 2
push 0
push 1
push 0x40000000
mov eax, dword [ebp - 0x480]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x460], eax
cmp dword [ebp - 0x460], 0xffffffff
jne 0x401073
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.004016cf
push eax
mov eax, dword [ebp - 0x480]
push eax
push str.System_Error_:_Cannot_open_work_file__s_:__s_n
call fcn.00401d0a
add esp, 0xc
xor eax, eax
jmp 0x4013c3
mov eax, dword [ebp - 0x484]
push eax
push str.___s___r_n_r_n
lea eax, [ebp - 0x408]
push eax
call fcn.00401c6f
add esp, 0xc
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x408]
push eax
mov eax, dword [ebp - 0x460]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 2
push 1
push 0
lea eax, [ebp - 0x40c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
mov eax, dword [ebp - 0x460]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
jne 0x401101
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.004016cf
push eax
push str.System_Error_:_Cannot_duplicate_handle_:__s_n
call fcn.00401d0a
add esp, 8
xor eax, eax
jmp 0x4013c3
push 0
push pe_nt_image_headers32
push 3
push 0
push 2
push 0x80000000
mov eax, dword [ebp - 0x480]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x47c], eax
cmp dword [ebp - 0x47c], 0xffffffff
jne 0x40115c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.004016cf
push eax
mov eax, dword [ebp - 0x480]
push eax
push str.System_Error_:_Cannot_reopen_work_file__s_:__s_n
call fcn.00401d0a
add esp, 0xc
xor eax, eax
jmp 0x4013c3
push 2
push 0
push 0
mov eax, dword [ebp - 0x47c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebp - 0x410], eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebp - 0x418], eax
mov eax, dword [ebp - 0x460]
push eax
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
test eax, eax
je 0x4011b9
mov eax, dword [ebp - 0x40c]
push eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
test eax, eax
jne 0x4011db
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.004016cf
push eax
push str.System_Error_:_Cannot_redirect_output_:__s_n
call fcn.00401d0a
add esp, 8
xor eax, eax
jmp 0x4013c3
push 0x44
push 0
lea eax, [ebp - 0x45c]
push eax
call fcn.00401cc8
add esp, 0xc
mov dword [ebp - 0x45c], 0x44
lea eax, [ebp - 0x478]
push eax
lea eax, [ebp - 0x45c]
push eax
push 0
push 0
push 0
push 1
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0x414], eax
cmp dword [ebp - 0x414], 0
jne 0x40125d
lea eax, [ebp - 0x478]
push eax
lea eax, [ebp - 0x45c]
push eax
push 0
push 0
push 0
push 1
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0x414], eax
mov eax, dword [ebp - 0x410]
push eax
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
mov eax, dword [ebp - 0x418]
push eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
cmp dword [ebp - 0x414], 0
jne 0x4012d2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.004016cf
push eax
push str._r_nCannot_run_command_:__s_r_n
lea eax, [ebp - 0x408]
push eax
call fcn.00401c6f
add esp, 0xc
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x408]
push eax
mov eax, dword [ebp - 0x460]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
xor eax, eax
jmp 0x4013c3
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
mov eax, dword [ebp - 0x478]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x464], eax
cmp dword [ebp - 0x464], 0
je 0x40135c
push 0
lea eax, [ebp - 0x468]
push eax
push 0x400
lea eax, [ebp - 0x408]
push eax
mov eax, dword [ebp - 0x47c]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40135c
cmp dword [ebp - 0x468], 0
je 0x40135c
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x468]
push eax
lea eax, [ebp - 0x408]
push eax
mov eax, dword [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x4012dd
cmp dword [ebp - 0x464], 0
jne 0x40136e
jmp 0x40139f
push 0x3e8
mov eax, dword [ebp - 0x478]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x401395
jmp 0x4012dd
jmp 0x40139f
mov eax, dword [ebp - 0x474]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x478]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x4013c3
pop edi
pop esi
pop ebx
leave
ret 8