Function at 0x10041bc0
Capabilities:
Check if file exists
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create two anonymous pipes
Delete file
Set environment variable
Terminate process
Write and execute a file
Write file on windows
Write pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6a0
mov eax, dword [0x10138e70]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov ebx, ecx
push edi
mov dword [ebp - 0x638], eax
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x61c], ax
lea eax, [ebp - 0x61a]
push eax
mov dword [esi], 0
mov dword [ebp - 0x62c], 0
call fcn.1006ff30
push dword [ebx]
lea eax, [ebp - 0x61c]
push 0x104
push eax
call fcn.1006e6e1
mov edi, dword [sym.imp.KERNEL32.dll_CreatePipe]
lea eax, [ebp - 0x64c]
add esp, 0x18
mov dword [ebp - 0x64c], 0xc
mov dword [ebp - 0x648], 0
mov dword [ebp - 0x644], 1
push 0
push eax
lea eax, [ebp - 0x634]
push eax
lea eax, [ebp - 0x628]
push eax
call edi
test eax, eax
jne 0x10041c81
pop edi
mov dword [esi], 0x3e9
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006f41a
mov esp, ebp
pop ebp
ret 0xc
push 0
lea eax, [ebp - 0x64c]
push eax
lea eax, [ebp - 0x640]
push eax
lea eax, [ebp - 0x630]
push eax
call edi
test eax, eax
je 0x10041c66
push 0x44
lea eax, [ebp - 0x6a0]
push 0
push eax
call fcn.1006ff30
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov word [ebp - 0x66e], ax
add esp, 0xc
cmp dword [ebx + 4], 0
mov dword [ebp - 0x66c], eax
mov eax, dword [ebp + 0xc]
mov word [ebp - 0x670], ax
mov eax, dword [ebp - 0x630]
mov dword [ebp - 0x668], eax
mov eax, dword [ebp - 0x634]
mov dword [ebp - 0x6a0], 0x44
mov dword [ebp - 0x69c], 0
mov dword [ebp - 0x698], 0x100af9cc
mov dword [ebp - 0x694], 0
mov dword [ebp - 0x674], 0x101
mov dword [ebp - 0x660], eax
mov dword [ebp - 0x664], eax
je 0x10041f0f
push dword [ebx]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10041eff
push 0x206
push eax
mov dword [ebp - 0x624], eax
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push eax
call fcn.1006ff30
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.1006ff30
push dword [ebx]
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.1006e6e1
push 0x100a3170
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.1006e675
add esp, 0x30
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10041dbe
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0
push 2
push 0
push 7
push 0x40000000
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x620], eax
cmp eax, 0xffffffff
je 0x10041e64
push 0
lea ecx, [ebp - 0x63c]
mov dword [ebp - 0x63c], 0
push ecx
push 0x55f43
push 0x100bd420
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebx + 0x10]
mov eax, dword [ecx]
call dword [eax + 0x30]
lea ecx, [ebp - 0x20c]
push ecx
mov ecx, eax
mov edx, dword [eax]
call dword [edx]
mov dword [ebp - 0x624], eax
test eax, eax
je 0x10041e5a
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.1006e6e1
lea eax, [ebp - 0x414]
push 0x5c
push eax
call fcn.1007204b
add esp, 0x14
test eax, eax
je 0x10041e5a
xor ecx, ecx
mov word [eax], cx
push dword [ebp - 0x620]
call edi
jmp 0x10041e6a
mov dword [esi], 0x3ea
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10041ee6
mov ecx, dword [ebx + 0x10]
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x20c]
push ecx
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 8]
mov edx, dword [ebp - 0x624]
test edx, edx
je 0x10041ede
lea ecx, [ebp - 0x414]
lea eax, [ecx + 2]
mov dword [ebp - 0x620], eax
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10041eb0
sub ecx, dword [ebp - 0x620]
sar ecx, 1
je 0x10041ede
lea eax, [ebp - 0x414]
push eax
push edx
call fcn.10011b80
test eax, eax
jne 0x10041eec
mov dword [esi], 0x3eb
jmp 0x10041eec
mov dword [esi], 0x3ec
jmp 0x10041eec
mov dword [esi], 0x3ed
mov eax, dword [ebp - 0x624]
test eax, eax
je 0x10041eff
push eax
call fcn.1006da71
add esp, 4
push str.18963
push str.ANDROID_ADB_SERVER_PORT
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea eax, [ebp - 0x65c]
push eax
lea eax, [ebp - 0x6a0]
push eax
push 0
push 0
push 0
push 1
push 0
push 0
push dword [ebp - 0x638]
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x10041fa5
push 0x1d4c0
push dword [ebp - 0x65c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
push 0
push dword [ebp - 0x628]
mov ecx, ebx
call fcn.100412d0
cmp dword [esi], 0x7d3
mov dword [ebp - 0x62c], eax
jne 0x10041f93
push 0
push dword [ebp - 0x65c]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
push 0
push dword [ebp - 0x628]
mov ecx, ebx
call fcn.100412d0
mov dword [ebp - 0x62c], eax
push dword [ebp - 0x658]
call edi
push dword [ebp - 0x65c]
call edi
jmp 0x10041fab
mov dword [esi], 0x3ee
mov eax, dword [ebp - 0x628]
test eax, eax
je 0x10041fb8
push eax
call edi
mov eax, dword [ebp - 0x634]
test eax, eax
je 0x10041fc5
push eax
call edi
mov eax, dword [ebp - 0x630]
test eax, eax
je 0x10041fd2
push eax
call edi
mov eax, dword [ebp - 0x640]
test eax, eax
je 0x10041fdf
push eax
call edi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x62c]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.1006f41a
mov esp, ebp
pop ebp
ret 0xc