Function at 0x43dda4
Capabilities:
Check for time delay via gettickcount
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create reverse shell
Create two anonymous pipes
Hide graphical window
Read file on windows
Read pipe
Write and execute a file
Write file on windows
Write pipe

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe58
mov ecx, 8
push ebx
push esi
push edi
mov esi, 0x50ed94
mov edi, dword [ebp + 0xc]
push edi
lea edi, [ebp - 0x148]
rep movsd dword es:[edi], dword [esi]
pop edi
mov eax, dword [0x50edb4]
mov dword [ebp - 0xc], eax
mov eax, dword [0x50edb8]
mov dword [ebp - 8], eax
mov eax, dword [0x50edbc]
mov dword [ebp - 4], eax
xor edx, edx
mov dword [ebp - 0x10], edx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
xor eax, eax
mov dword [ebp - 0x18], eax
xor edx, edx
mov dword [ebp - 0x1c], edx
push edi
lea edi, [ebp - 0x158]
mov ecx, 4
mov esi, 0x50edc0
rep movsd dword es:[edi], dword [esi]
pop edi
mov ecx, 0x11
push edi
lea edi, [ebp - 0x19c]
mov esi, 0x50edd0
rep movsd dword es:[edi], dword [esi]
pop edi
mov eax, dword [0x50ee14]
mov dword [ebp - 0x1a8], eax
mov eax, dword [0x50ee18]
mov dword [ebp - 0x1a4], eax
mov eax, dword [0x50ee1c]
mov dword [ebp - 0x1a0], eax
call sub.KERNEL32.dll_GetTickCount
push eax
call sub.KERNEL32.dll_GetCurrentThreadId
push eax
push 0x5d1694
lea edx, [ebp - 0x148]
push edx
call fcn.004d26c8
add esp, 0x10
mov dword [ebp - 0x1a8], 0xc
mov dword [ebp - 0x1a0], 1
xor ecx, ecx
lea eax, [ebp - 0x1a8]
mov dword [ebp - 0x1a4], ecx
push 0
push eax
lea edx, [ebp - 0x1c]
push edx
lea ecx, [ebp - 0x18]
push ecx
call sub.KERNEL32.dll_CreatePipe
test eax, eax
jne 0x43dea2
mov eax, 0xffffff9b
jmp 0x43e196
push 0
push 1
mov edx, dword [ebp - 0x18]
push edx
call sub.KERNEL32.dll_SetHandleInformation
test eax, eax
jne 0x43debd
mov eax, 0xffffff99
jmp 0x43e196
push 0
lea edx, [ebp - 0x1a8]
push edx
lea ecx, [ebp - 0x14]
push ecx
lea eax, [ebp - 0x10]
push eax
call sub.KERNEL32.dll_CreatePipe
test eax, eax
jne 0x43dee1
mov eax, 0xffffff91
jmp 0x43e196
push 0
push 1
mov edx, dword [ebp - 0x14]
push edx
call sub.KERNEL32.dll_SetHandleInformation
test eax, eax
jne 0x43defc
mov eax, 0xffffff8f
jmp 0x43e196
push 0x44
push 0
lea edx, [ebp - 0x19c]
push edx
call fcn.004cde6c
mov dword [ebp - 0x19c], 0x44
lea ecx, [ebp - 0x148]
add esp, 0xc
mov dword [ebp - 0x190], ecx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x15c], eax
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x160], edx
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x164], ecx
or dword [ebp - 0x170], 0x101
mov word [ebp - 0x16c], 0
test byte [ebp + 0x15], 4
je 0x43df62
mov word [ebp - 0x16c], 5
lea eax, [ebp - 0x158]
lea edx, [ebp - 0x19c]
push eax
push edx
push 0
push 0
push 0
push 1
push 0
lea ecx, [ebp - 0xc]
push 0
push ecx
push 0
call sub.KERNEL32.dll_CreateProcessA
test eax, eax
jne 0x43df95
mov eax, 0xffffff73
jmp 0x43e196
mov edx, dword [ebp - 0x1c]
push edx
call sub.KERNEL32.dll_CloseHandle
mov ecx, dword [ebp - 0x10]
push ecx
call sub.KERNEL32.dll_CloseHandle
call sub.KERNEL32.dll_GetTickCount
mov ebx, eax
jmp 0x43dfca
push 0
push 0
call fcn.004013d8
add esp, 8
call sub.KERNEL32.dll_GetTickCount
sub eax, ebx
cmp eax, 0x2710
ja 0x43dfde
lea eax, [ebp - 0x148]
push eax
push 0
call sub.USER32.dll_FindWindowA
mov esi, eax
test eax, eax
je 0x43dfb0
push esi
call sub.USER32.dll_IsWindow
test eax, eax
je 0x43dff0
push 0
push esi
call sub.USER32.dll_ShowWindow
push 0
lea edx, [ebp - 0x24]
push edx
mov ecx, dword [ebp + 8]
push ecx
call fcn.004cdfec
pop ecx
push eax
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x14]
push edx
call sub.KERNEL32.dll_WriteFile
push 1
call fcn.004d9f54
pop ecx
push 0
push 0
call fcn.004013d8
add esp, 8
test edi, edi
je 0x43e0ea
mov cl, byte [edi]
test cl, cl
je 0x43e0ea
test byte [ebp + 0x15], 1
je 0x43e085
mov ebx, edi
jmp 0x43e05c
push 0
movsx eax, al
push eax
push 0x102
push esi
call sub.USER32.dll_PostMessageA
push 0
push 0
call fcn.004013d8
add esp, 8
inc ebx
mov al, byte [ebx]
test al, al
jne 0x43e03e
test byte [ebp + 0x15], 2
je 0x43e0d6
push 0
push 0xd
push 0x102
push esi
call sub.USER32.dll_PostMessageA
push 0
push 0
call fcn.004013d8
add esp, 8
jmp 0x43e0d6
push 0
lea edx, [ebp - 0x24]
push edx
push edi
call fcn.004cdfec
pop ecx
push eax
push edi
mov ecx, dword [ebp - 0x14]
push ecx
call sub.KERNEL32.dll_WriteFile
mov esi, 0x5d169a
lea edi, [ebp - 0x128]
mov eax, edi
movsw word es:[edi], word [esi]
test byte [ebp + 0x15], 2
je 0x43e0d6
push 0
lea edx, [ebp - 0x24]
push edx
lea ecx, [ebp - 0x128]
push ecx
call fcn.004cdfec
pop ecx
push eax
lea eax, [ebp - 0x128]
push eax
mov edx, dword [ebp - 0x14]
push edx
call sub.KERNEL32.dll_WriteFile
push 1
call fcn.004d9f54
pop ecx
push 0
push 0
call fcn.004013d8
add esp, 8
mov ecx, dword [ebp - 0x158]
push ecx
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [ebp - 0x154]
push eax
call sub.KERNEL32.dll_CloseHandle
mov edx, dword [ebp - 0x14]
push edx
call sub.KERNEL32.dll_CloseHandle
test eax, eax
call sub.KERNEL32.dll_GetTickCount
mov ebx, eax
push 0
lea eax, [ebp - 0x20]
push eax
push 0
push 0
push 0
mov edx, dword [ebp - 0x18]
push edx
call sub.KERNEL32.dll_PeekNamedPipe
test eax, eax
je 0x43e18d
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x43e17f
lea eax, [ebp - 0x20]
push 0
push eax
lea edx, [ebp - 0x128]
push 0x104
push edx
mov ecx, dword [ebp - 0x18]
push ecx
call sub.KERNEL32.dll_ReadFile
test eax, eax
je 0x43e18d
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x43e18d
mov edx, dword [ebp - 0x20]
mov byte [ebp + edx - 0x128], 0
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x43e17f
lea eax, [ebp - 0x128]
push eax
mov edx, dword [ebp + 0x10]
push edx
call fcn.004cdf10
add esp, 8
call sub.KERNEL32.dll_GetTickCount
sub eax, ebx
cmp eax, 0x2710
jbe 0x43e114
xor eax, eax
jmp 0x43e196
test eax, eax
je 0x43e1a7
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x43e1a7
mov ecx, dword [ebp + 0x10]
mov byte [ecx], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret