Function at 0x40e2f3
Capabilities:
Create pipe
Create process on windows
Create two anonymous pipes
Read file on windows
Read pipe
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x838
mov eax, dword [0x465c14]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0x18]
mov dword [ebp - 0x7a0], eax
xor ebx, ebx
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x794], eax
xor eax, eax
mov dword [ebp - 0x79c], ecx
mov dword [ebp - 0x7c4], edx
mov dword [ebp - 0x78c], ebx
mov dword [ebp - 0x798], ebx
mov dword [ebp - 0x7a4], ebx
mov dword [ebp - 0x7b4], ebx
mov dword [ebp - 0x7c0], ebx
mov dword [ebp - 0x788], ebx
mov dword [ebp - 0x7b8], ebx
mov dword [ebp - 0x7ac], ebx
mov dword [ebp - 0x7bc], ebx
mov dword [ebp - 0x7b0], ebx
mov dword [ebp - 0x7a8], ebx
mov dword [ebp - 0x790], ebx
lea edi, [ebp - 0x7d4]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test ecx, ecx
je 0x40e742
cmp byte [ecx], bl
je 0x40e742
mov edi, dword [ebp - 0x794]
test edi, edi
je 0x40e39f
mov dword [edi], ebx
test edx, edx
je 0x40e3a5
mov dword [edx], ebx
lea eax, [ebp - 0x838]
push eax
lea eax, [ebp - 0x7e0]
push eax
call fcn.00407889
pop ecx
pop ecx
push 0x780
lea eax, [ebp - 0x7e0]
xor esi, esi
push eax
lea eax, [ebp - 0x798]
inc esi
push eax
lea eax, [ebp - 0x78c]
mov dword [ebp - 0x7d8], esi
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x40e3ee
push 0xfffffffffffffffe
jmp 0x40e744
push 2
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [ebp - 0x7a4]
push ebx
push eax
call esi
push eax
push dword [ebp - 0x798]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 0x780
lea eax, [ebp - 0x7e0]
push eax
lea eax, [ebp - 0x7c0]
push eax
lea eax, [ebp - 0x7b4]
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x40e455
push dword [ebp - 0x78c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x798]
call esi
push dword [ebp - 0x7a4]
call esi
jmp 0x40e3e7
push 0x44
pop esi
push esi
lea eax, [ebp - 0x824]
push ebx
push eax
call fcn.00427a90
mov eax, dword [ebp - 0x7b4]
add esp, 0xc
mov dword [ebp - 0x7ec], eax
mov eax, dword [ebp - 0x798]
mov dword [ebp - 0x7e8], eax
mov eax, dword [ebp - 0x7a4]
mov dword [ebp - 0x7e4], eax
lea eax, [ebp - 0x7d4]
push eax
lea eax, [ebp - 0x824]
mov dword [ebp - 0x824], esi
push eax
push ebx
push ebx
push 0x4008
push 1
push ebx
push ebx
push dword [ebp - 0x79c]
mov dword [ebp - 0x7f8], 0x100
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push dword [ebp - 0x798]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x79c], eax
call esi
push dword [ebp - 0x7a4]
call esi
push dword [ebp - 0x7b4]
call esi
mov eax, dword [ebp - 0x7a0]
test eax, eax
je 0x40e508
cmp byte [eax], bl
je 0x40e508
push 0x44ea08
push eax
call fcn.0042d736
pop ecx
pop ecx
mov dword [ebp - 0x7ac], eax
cmp dword [ebp - 0x79c], ebx
je 0x40e6e2
push dword [ebp - 0x7d0]
call esi
mov esi, dword [ebp - 0x7ac]
mov edx, 0x102
mov eax, edx
mov ecx, dword [ebp - 0x7b8]
cmp ecx, dword [ebp + 0xc]
jae 0x40e6bd
push 0x19
push dword [ebp - 0x7d4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x79c], eax
cmp eax, 0x102
jne 0x40e685
add dword [ebp - 0x7b8], 0x19
jmp 0x40e685
cmp dword [ebp - 0x794], ebx
jbe 0x40e6aa
push ebx
lea eax, [ebp - 0x788]
mov dword [ebp - 0x788], ebx
push eax
push 0x780
lea eax, [ebp - 0x784]
push eax
push dword [ebp - 0x78c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x7a0], eax
test eax, eax
je 0x40e6aa
mov ecx, dword [ebp - 0x788]
test ecx, ecx
je 0x40e6a2
test esi, esi
je 0x40e5da
push esi
push ecx
lea eax, [ebp - 0x784]
push 1
push eax
call fcn.00433b83
mov ecx, dword [ebp - 0x788]
add esp, 0x10
add dword [ebp - 0x7bc], eax
mov eax, dword [ebp - 0x7a0]
test edi, edi
je 0x40e6a2
mov eax, dword [ebp - 0x790]
mov edx, dword [ebp - 0x7a8]
inc eax
add eax, ecx
cmp eax, edx
jbe 0x40e640
lea eax, [edx + 0x800]
push eax
push dword [ebp - 0x7b0]
mov dword [ebp - 0x7a0], eax
call fcn.0042dfd5
mov dword [ebp - 0x7b0], eax
pop ecx
pop ecx
test eax, eax
je 0x40e685
add eax, dword [ebp - 0x7a8]
push 0x800
push ebx
push eax
call fcn.00427a90
mov eax, dword [ebp - 0x7a0]
add esp, 0xc
mov ecx, dword [ebp - 0x788]
mov dword [ebp - 0x7a8], eax
mov edx, dword [ebp - 0x7b0]
test edx, edx
je 0x40e685
mov eax, dword [ebp - 0x790]
add eax, ecx
cmp eax, dword [ebp - 0x7a8]
ja 0x40e685
push ecx
lea eax, [ebp - 0x784]
push eax
mov eax, dword [ebp - 0x790]
add eax, edx
push eax
call fcn.00427510
mov eax, dword [ebp - 0x790]
add esp, 0xc
add eax, dword [ebp - 0x788]
mov dword [ebp - 0x790], eax
push ebx
lea eax, [ebp - 0x794]
mov dword [ebp - 0x794], ebx
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x78c]
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
jne 0x40e563
mov eax, dword [ebp - 0x79c]
mov edx, 0x102
cmp eax, edx
je 0x40e529
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, edx
jne 0x40e6d8
push 0x5b4
push dword [ebp - 0x7d4]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [ebp - 0x7d4]
call esi
jmp 0x40e6e5
or ebx, 0xffffffff
push dword [ebp - 0x7c0]
call esi
push dword [ebp - 0x78c]
call esi
mov eax, dword [ebp - 0x7ac]
test eax, eax
je 0x40e70c
push eax
call fcn.0042d5ea
mov eax, dword [ebp - 0x7ac]
pop ecx
test edi, edi
je 0x40e71c
mov ecx, dword [ebp - 0x7b0]
test ecx, ecx
je 0x40e71c
mov dword [edi], ecx
mov ecx, dword [ebp - 0x7c4]
test ecx, ecx
je 0x40e73e
test eax, eax
je 0x40e732
mov eax, dword [ebp - 0x7bc]
mov dword [ecx], eax
test edi, edi
je 0x40e73e
mov eax, dword [ebp - 0x790]
mov dword [ecx], eax
mov eax, ebx
jmp 0x40e745
push 0xfffffffffffffffd
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042345f
leave
ret