Function at 0x100048cb
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Execute shell command and capture output
Get common file path
Read file on windows
Read pipe

Disassembly:
push 0x4a4
push 0x10033500
call fcn.1002a320
xor ebx, ebx
mov byte [ebp - 0x4b4], bl
push 0x3ff
push ebx
lea eax, [ebp - 0x4b3]
push eax
call fcn.10017e80
push dword [ebp + 8]
push str._r_n__s__r_n
mov edi, dword [ebp + 0x18]
push dword [edi]
mov esi, dword [ebp + 0x14]
push esi
call fcn.100188db
push 7
push str.runexe
push dword [ebp + 8]
call fcn.1001ab60
add esp, 0x28
test eax, eax
jne 0x10004974
mov eax, dword [ebp + 8]
add eax, 7
push eax
push 0x400
lea eax, [ebp - 0x4b4]
push eax
call fcn.1001864a
push 0x10030000
lea eax, [ebp - 0x4b4]
push eax
call fcn.1001abe0
add esp, 0x14
test eax, eax
jne 0x10004b81
push str.usage:_r_n__runexe_1.exe_r_n_r_n
push dword [edi]
push esi
call fcn.1001869f
push esi
call fcn.10018710
add esp, 0x10
mov dword [edi], eax
xor eax, eax
inc eax
jmp 0x10004d19
push 7
push str.rundll
push dword [ebp + 8]
call fcn.1001ab60
add esp, 0xc
test eax, eax
jne 0x10004abe
mov dword [ebp - 4], ebx
push dword [ebp + 8]
call fcn.10018710
pop ecx
cmp eax, 9
jae 0x100049b4
push str.illegal_command_r_n_r_n
push dword [edi]
push esi
call fcn.1001869f
add esp, 0xc
jmp 0x10004aa6
mov eax, dword [ebp + 8]
add eax, 7
push eax
push 0x400
lea eax, [ebp - 0x4b4]
push eax
call fcn.1001864a
push 0x10030000
lea eax, [ebp - 0x4b4]
push eax
call fcn.1001abe0
add esp, 0x14
test eax, eax
jne 0x100049eb
push str.usage:_r_n__rundll_1.dll_DllMain_r_n_r_n
jmp 0x100049a4
push 0x10030060
lea eax, [ebp - 0x4b4]
push eax
call fcn.1001ac70
pop ecx
pop ecx
test eax, eax
je 0x1000499f
mov byte [eax], bl
inc eax
mov dword [ebp + 8], eax
lea eax, [ebp - 0x4b4]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x10004a48
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.error:0x_x_r_n_r_n
push esi
call fcn.10018710
pop ecx
mov ecx, dword [edi]
sub ecx, eax
push ecx
push esi
call fcn.10018710
pop ecx
add eax, esi
push eax
call fcn.100188db
add esp, 0x10
jmp 0x10004aa6
push str.DllMain
mov ebx, dword [ebp + 8]
push ebx
call fcn.1001abe0
pop ecx
pop ecx
test eax, eax
je 0x10004a7b
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x10004a79
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push str.find__s_error:0x_x_r_n_r_n
jmp 0x10004a88
call eax
push ebx
lea eax, [ebp - 0x4b4]
push eax
push str.load__s__s__ok._r_n_r_n
push esi
call fcn.10018710
pop ecx
mov ecx, dword [edi]
sub ecx, eax
push ecx
push esi
call fcn.10018710
pop ecx
add eax, esi
push eax
call fcn.100188db
add esp, 0x14
or dword [ebp - 4], 0xffffffff
call fcn.10004abd
xor ebx, ebx
inc ebx
jmp 0x10004bd9
mov edi, 0x400
push edi
lea eax, [ebp - 0x4b4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str.cmd.exe
push edi
lea eax, [ebp - 0x4b4]
push eax
call fcn.1001869f
add esp, 0xc
mov dword [ebp - 0xb0], ebx
push 8
pop ecx
xor eax, eax
lea edi, [ebp - 0xac]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xb0]
push eax
push ebx
lea eax, [ebp - 0x4b4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
cmp eax, 0xffffffff
jne 0x10004b51
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x4b4]
push eax
push str._s_not_exist:_0x_x_r_n_r_n
push esi
call fcn.10018710
pop ecx
mov edi, dword [ebp + 0x18]
mov ecx, dword [edi]
sub ecx, eax
push ecx
push esi
call fcn.10018710
pop ecx
add eax, esi
push eax
call fcn.100188db
push esi
call fcn.10018710
add esp, 0x18
mov dword [edi], eax
jmp 0x10004b54
mov edi, dword [ebp + 0x18]
push str.__c
push 0x400
lea eax, [ebp - 0x4b4]
push eax
call fcn.1001869f
push dword [ebp + 8]
push 0x400
lea eax, [ebp - 0x4b4]
push eax
call fcn.1001869f
add esp, 0x18
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x40], 0xc
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], 1
push ebx
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x10004be9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.open_pipe_error:_0x_x_r_n_r_n
push esi
call fcn.10018710
pop ecx
mov ecx, dword [edi]
sub ecx, eax
push ecx
push esi
call fcn.10018710
pop ecx
add eax, esi
push eax
call fcn.100188db
add esp, 0x10
push esi
call fcn.10018710
pop ecx
mov dword [edi], eax
mov eax, ebx
jmp 0x10004d19
push 0x40
push ebx
lea eax, [ebp - 0x88]
push eax
call fcn.10017e80
add esp, 0xc
xorps xmm0, xmm0
movdqu xmmword [ebp - 0x34], xmm0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x50], eax
xor eax, eax
mov word [ebp - 0x5c], ax
mov dword [ebp - 0x8c], 0x44
mov dword [ebp - 0x60], 0x101
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x8c]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
lea eax, [ebp - 0x4b4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x10004d01
cmp dword [ebp + 0xc], ebx
jbe 0x10004d01
imul eax, dword [ebp + 0x10], 0x3e8
push eax
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp + 0x14], ebx
mov dword [ebp + 0x18], ebx
push esi
call fcn.10018710
pop ecx
mov ecx, eax
mov dword [ebp + 8], ecx
jmp 0x10004ccf
push ebx
lea eax, [ebp + 0x18]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x10004cd5
mov ecx, dword [ebp + 8]
cmp dword [ebp + 0x18], ebx
jbe 0x10004cd8
push ebx
lea eax, [ebp + 0x14]
push eax
mov eax, dword [edi]
sub eax, ecx
push eax
lea eax, [ecx + esi]
push eax
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10004cd5
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x10004cd5
add dword [ebp + 8], eax
mov dword [ebp + 0x18], ebx
push 0x3e8
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp + 8]
cmp dword [edi], ecx
ja 0x10004c79
jmp 0x10004cd8
mov ecx, dword [ebp + 8]
mov eax, dword [edi]
sub eax, ecx
push eax
push ebx
lea eax, [ecx + esi]
push eax
call fcn.10017e80
add esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [edi], ecx
push dword [ebp - 0x30]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x34]
call esi
jmp 0x10004d07
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x20]
call esi
push dword [ebp - 0x24]
call esi
xor eax, eax
cmp dword [ebp - 0x34], eax
setne al
call fcn.1002a35b
ret 0x14