Function at 0x4077f2
Capabilities:
Check os version
Create pipe
Create process on windows
Create reverse shell
Create two anonymous pipes
Manipulate console buffer
Read file on windows
Read pipe
Write and execute a file
Write file on windows
Write pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4e8
push ebx
push esi
push edi
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x54], ebx
lea edi, [ebp - 0x50]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
push dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0xc], eax
add eax, 0x109
push eax
push ebx
push dword [0x40f878]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
push edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x44], 0xc
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], 1
call fcn.00406b63
mov dword [esp], str.__Command__
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov esi, dword [sym.imp.KERNEL32.dll_CreatePipe]
push ebx
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x30]
push eax
call esi
test eax, eax
jne 0x40788f
push edi
push ebx
push dword [0x40f878]
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
inc eax
jmp 0x407edf
push ebx
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
call esi
test eax, eax
jne 0x4078c2
push edi
push ebx
push dword [0x40f878]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [ebp - 0x30]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x28]
call esi
jmp 0x407887
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 2
push ebx
push ebx
lea eax, [ebp - 0x20]
push eax
call edi
push eax
push dword [ebp - 0x30]
call edi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push dword [ebp - 0x30]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push 2
push ebx
push ebx
lea eax, [ebp - 0x18]
push eax
call edi
push eax
push dword [ebp - 0x34]
call edi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push dword [ebp - 0x34]
call esi
push 0x44
pop edi
push edi
lea eax, [ebp - 0xe8]
push ebx
push eax
call fcn.004095d0
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x38]
add esp, 0xc
mov dword [ebp - 0xe8], edi
mov dword [ebp - 0xbc], 0x100
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xb0], ecx
mov dword [ebp - 0xac], eax
cmp byte [ebp + 0x10], bl
je 0x407962
cmp dword [ebp - 0x24], 0x80000000
jb 0x40795b
xor eax, eax
mov word [ebp - 0xb8], ax
jmp 0x407962
mov dword [ebp - 0x1c], 0x8000000
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0xe8]
push eax
push ebx
push ebx
push dword [ebp - 0x1c]
push 1
push ebx
push ebx
push dword [ebp - 0x2c]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x4079ab
push dword [ebp - 0x2c]
push ebx
push dword [0x40f878]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [ebp - 0x20]
call esi
push dword [ebp - 0x28]
call esi
push dword [ebp - 0x38]
call esi
push dword [ebp - 0x18]
jmp 0x4078be
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
lea eax, [ebp - 4]
push eax
push 0xd
push str._arg_______r_n
push dword [ebp - 0x18]
call esi
cmp dword [ebp - 0xc], ebx
jle 0x407ae4
push dword [ebp + 0xc]
lea ecx, [ebp - 0xa4]
mov dword [ebp - 0xa4], 0x40a54c
mov dword [ebp - 0xa0], 0x40a4f0
mov dword [ebp - 0x90], 0x40a520
call fcn.00406d3d
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x10], ebx
cmp eax, ebx
jle 0x407ad9
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x10]
lea eax, [ebp - 0xa4]
push eax
mov byte [ebp - 5], 1
call fcn.00403ee8
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
lea edi, [eax + 1]
lea eax, [ebp - 4]
push eax
push 9
push str._arg__
push dword [ebp - 0x18]
call esi
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x22
je 0x407a59
push ebx
lea eax, [ebp - 4]
push eax
push 1
push 0x40a330
push dword [ebp - 0x18]
call esi
mov byte [ebp - 5], bl
push edi
push ebx
push dword [0x40f878]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push ebx
push ebx
push edi
push eax
push 0xffffffffffffffff
push dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
lea eax, [ebp - 4]
push eax
dec edi
push edi
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
call esi
push dword [ebp - 0x1c]
push ebx
push dword [0x40f878]
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp byte [ebp - 5], bl
jne 0x407ab0
push ebx
lea eax, [ebp - 4]
push eax
push 1
push 0x40a330
push dword [ebp - 0x18]
call esi
push ebx
lea eax, [ebp - 4]
push eax
push 2
push 0x40a240
push dword [ebp - 0x18]
call esi
push dword [ebp - 0xc]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x24]
jl 0x407a08
lea ecx, [ebp - 0xa4]
call fcn.00406ecb
mov edi, dword [ebp + 8]
jmp 0x407e10
mov al, byte [edi]
mov dword [ebp - 0x10], ebx
mov byte [ebp - 5], al
cmp al, bl
je 0x407e0f
cmp byte [ebp - 5], 0xd
je 0x407b18
cmp byte [ebp - 5], 0xa
je 0x407b18
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov al, byte [edi + eax]
mov byte [ebp - 5], al
cmp al, bl
jne 0x407afc
mov ecx, dword [ebp - 0x10]
cmp ecx, ebx
je 0x407e0f
lea eax, [edi + ecx]
mov dword [ebp - 0x24], eax
mov byte [eax], bl
xor eax, eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], eax
cmp ecx, ebx
jle 0x407be8
mov ecx, dword [ebp - 0x14]
sub ecx, ebx
je 0x407ba6
dec ecx
je 0x407b90
dec ecx
je 0x407b7a
dec ecx
je 0x407b64
dec ecx
jne 0x407bb8
mov cl, byte [eax + edi]
cmp cl, 0x73
je 0x407b5b
cmp cl, 0x53
jne 0x407bd8
mov dword [ebp - 0x14], 5
jmp 0x407bbe
mov cl, byte [eax + edi]
cmp cl, 0x67
je 0x407b71
cmp cl, 0x47
jne 0x407bd8
mov dword [ebp - 0x14], 4
jmp 0x407bdb
mov cl, byte [eax + edi]
cmp cl, 0x72
je 0x407b87
cmp cl, 0x52
jne 0x407bd8
mov dword [ebp - 0x14], 3
jmp 0x407bdb
mov cl, byte [eax + edi]
cmp cl, 0x61
je 0x407b9d
cmp cl, 0x41
jne 0x407bd8
mov dword [ebp - 0x14], 2
jmp 0x407bdb
cmp byte [eax + edi], 0x24
jne 0x407bb5
mov dword [ebp - 0x14], 1
jmp 0x407bdb
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], 5
jne 0x407bdb
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax + edi + 1]
push eax
call dword [sym.imp.USER32.dll_IsCharAlphaNumericA]
test eax, eax
mov eax, dword [ebp - 0xc]
jne 0x407bdb
mov byte [eax + edi], 0x5f
mov dword [ebp - 0x14], ebx
inc eax
mov dword [ebp - 0xc], eax
cmp eax, dword [ebp - 0x10]
jl 0x407b3b
push ebx
lea eax, [ebp - 4]
push eax
push edi
mov dword [ebp - 0xc], ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push edi
push dword [ebp - 0x18]
call esi
xor eax, eax
cmp dword [ebp - 4], ebx
jbe 0x407c18
mov cl, byte [eax + edi]
cmp cl, 0x20
je 0x407c12
cmp cl, 9
jne 0x407c63
inc eax
cmp eax, dword [ebp - 4]
jb 0x407c05
push ebx
lea eax, [ebp - 4]
push eax
push 0x15
push str.__Write_Output___OK__
push dword [ebp - 0x18]
call esi
push ebx
lea eax, [ebp - 4]
push eax
push 2
push 0x40a240
push dword [ebp - 0x18]
call esi
cmp dword [ebp - 0xc], ebx
jne 0x407c72
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x407c59
cmp dword [ebp - 4], ebx
jne 0x407c72
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x407c3f
cmp byte [eax + edi], 0x23
jne 0x407c18
mov dword [ebp - 0xc], 1
jmp 0x407c29
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
jmp 0x407cff
mov eax, dword [ebp - 4]
cmp eax, ebx
jne 0x407c8d
cmp dword [ebp - 0xc], ebx
jne 0x407d18
cmp eax, 0x400
jle 0x407c99
mov eax, 0x3ff
push ebx
lea ecx, [ebp - 4]
push ecx
push eax
mov byte [ebp + eax - 0x4e8], bl
lea eax, [ebp - 0x4e8]
push eax
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 4]
cmp eax, 6
jb 0x407ce0
push str._OK__r_n
lea eax, [ebp + eax - 0x4ee]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x407ce0
sub dword [ebp - 4], 6
mov dword [ebp - 0xc], 1
cmp dword [ebp - 4], ebx
je 0x407cff
push ebx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0x4e8]
push eax
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call esi
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
jne 0x407c7d
push edi
call dword [sym.imp.USER32.dll_CharLowerA]
push 0x22
push edi
call dword [sym.imp.SHLWAPI.dll_StrChrA]
push 0x23
push edi
mov dword [ebp - 0xc], eax
call dword [sym.imp.SHLWAPI.dll_StrChrA]
push str.read_host
push edi
mov dword [ebp - 0x10], eax
call dword [sym.imp.SHLWAPI.dll_StrStrA]
cmp eax, ebx
je 0x407d94
cmp dword [ebp - 0xc], ebx
je 0x407d51
cmp eax, dword [ebp - 0xc]
ja 0x407d94
cmp dword [ebp - 0x10], ebx
je 0x407d5b
cmp eax, dword [ebp - 0x10]
ja 0x407d94
push ebx
lea eax, [ebp - 4]
push eax
push 0x400
lea eax, [ebp - 0x4e8]
push eax
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 4], ebx
je 0x407d94
push ebx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0x4e8]
push eax
push dword [ebp - 0x28]
call esi
push str.clear_host
push edi
call dword [sym.imp.SHLWAPI.dll_StrStrA]
cmp eax, ebx
je 0x407e01
cmp dword [ebp - 0xc], ebx
je 0x407dae
cmp eax, dword [ebp - 0xc]
ja 0x407e01
cmp dword [ebp - 0x10], ebx
je 0x407db8
cmp eax, dword [ebp - 0x10]
ja 0x407e01
xor eax, eax
mov word [ebp - 0x1c], ax
lea edi, [ebp - 0x1a]
push 0xfffffffffffffff5
mov dword [ebp - 0xc], ebx
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edi, eax
lea eax, [ebp - 0x6c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movsx ecx, word [ebp - 0x6c]
lea eax, [ebp - 0xc]
push eax
movsx eax, word [ebp - 0x6a]
push dword [ebp - 0x1c]
imul eax, ecx
push eax
push 0x20
push edi
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterA]
push dword [ebp - 0x1c]
push edi
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov al, byte [ebp - 5]
mov ecx, dword [ebp - 0x24]
mov byte [ecx], al
cmp al, bl
je 0x407e18
mov edi, ecx
inc edi
cmp byte [edi], bl
jne 0x407aec
push ebx
lea eax, [ebp - 4]
push eax
push 2
mov edi, 0x40a240
push edi
push dword [ebp - 0x18]
call esi
push ebx
lea eax, [ebp - 4]
push eax
push 4
push str.exit
push dword [ebp - 0x18]
call esi
push ebx
lea eax, [ebp - 4]
push eax
push 2
push edi
push dword [ebp - 0x18]
call esi
push 0xffffffffffffffff
push dword [ebp - 0x54]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
jmp 0x407ea2
mov ecx, dword [ebp - 4]
cmp ecx, ebx
je 0x407eb3
mov eax, 0x400
cmp ecx, eax
jle 0x407e6d
mov ecx, eax
push ebx
lea eax, [ebp - 4]
push eax
push ecx
lea eax, [ebp - 0x4e8]
push eax
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 4], ebx
je 0x407ea2
push ebx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0x4e8]
push eax
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call esi
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x20]
call edi
test eax, eax
jne 0x407e5b
push dword [ebp - 0x2c]
push ebx
push dword [0x40f878]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [ebp - 0x20]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x28]
call esi
push dword [ebp - 0x50]
call esi
push dword [ebp - 0x54]
call esi
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret