Function at 0x4013c0
Capabilities:
Create pipe
Create process on windows
Create thread
Create two anonymous pipes
Write and execute a file
Write file on windows
Write pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b8
mov eax, dword [0x41fd30]
xor eax, ebp
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x234], eax
push 0x10
push 0
lea eax, [ebp - 0x274]
push eax
call fcn.00403940
add esp, 0xc
push 0x44
push 0
lea ecx, [ebp - 0x2b8]
push ecx
call fcn.00403940
add esp, 0xc
mov dword [ebp - 0x2b8], 0x44
mov dword [ebp - 0x28c], 0x100
mov dword [ebp - 0x280], 0xffffffff
push 0xc
push 0
lea edx, [ebp - 0x264]
push edx
call fcn.00403940
add esp, 0xc
mov dword [ebp - 0x264], 0xc
mov dword [ebp - 0x260], 0
mov dword [ebp - 0x25c], 1
push 0
lea eax, [ebp - 0x264]
push eax
lea ecx, [ebp - 0x23c]
push ecx
push section..data
call dword [sym.imp.KERNEL32.dll_CreatePipe]
push 3
push 1
push 0
lea edx, [ebp - 0x27c]
push edx
mov eax, dword [ebp - 0x234]
push eax
mov ecx, dword [ebp - 0x23c]
push ecx
mov edx, dword [ebp - 0x234]
push edx
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 0
lea eax, [ebp - 0x264]
push eax
lea ecx, [ebp - 0x23c]
push ecx
push 0x41f3f0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
push 3
push 1
push 0
lea edx, [ebp - 0x278]
push edx
mov eax, dword [ebp - 0x234]
push eax
mov ecx, dword [ebp - 0x23c]
push ecx
mov edx, dword [ebp - 0x234]
push edx
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push str.link.exe__nologo
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x238], 0
jmp 0x401507
mov ecx, dword [ebp - 0x238]
add ecx, 1
mov dword [ebp - 0x238], ecx
mov edx, dword [ebp - 0x238]
cmp edx, dword [ebp + 0xc]
jge 0x401552
push 0x41faf4
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ecx, dword [ebp - 0x238]
mov edx, dword [ebp + 8]
mov eax, dword [edx + ecx*4]
push eax
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x41fc7c
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
jmp 0x4014f8
lea eax, [ebp - 0x274]
push eax
lea ecx, [ebp - 0x2b8]
push ecx
push 0
push 0
push 8
push 1
push 0
push 0
lea edx, [ebp - 0x104]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0
jne 0x401630
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x240], eax
mov eax, dword [ebp - 0x240]
push eax
lea ecx, [ebp - 0x104]
push ecx
push str.Tried_to_launch:___s___but_got_error___u_:
push 0x12b
lea edx, [ebp - 0x230]
push edx
call fcn.00402650
add esp, 0x14
mov dword [ebp - 0x244], eax
push 0
mov eax, 0x12c
sub eax, dword [ebp - 0x244]
push eax
mov ecx, dword [ebp - 0x244]
lea edx, [ebp + ecx - 0x230]
push edx
push 0
mov eax, dword [ebp - 0x240]
push eax
push 0
push 0x12ff
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push 0
lea ecx, [ebp - 0x240]
push ecx
lea edx, [ebp - 0x230]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x230]
push eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, 2
jmp 0x4017bf
mov ecx, dword [ebp - 0x27c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x278]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1388
mov eax, dword [ebp - 0x274]
push eax
call dword [sym.imp.USER32.dll_WaitForInputIdle]
mov ecx, dword [ebp - 0x270]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [ebp - 0x258]
push edx
push 0
push section..data
push 0x401d10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 4
imul edx, ecx, 0
mov dword [ebp + edx - 0x250], eax
lea eax, [ebp - 0x258]
push eax
push 0
push 0x41f3f0
push 0x401d10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 4
shl ecx, 0
mov dword [ebp + ecx - 0x250], eax
push 0xffffffffffffffff
mov edx, dword [ebp - 0x274]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x274]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1f4
push 1
lea ecx, [ebp - 0x250]
push ecx
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov edx, 4
imul eax, edx, 0
mov ecx, dword [ebp + eax - 0x250]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 4
shl edx, 0
mov eax, dword [ebp + edx - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x41fcac
push 0x41f004
call fcn.00403bd0
add esp, 8
test eax, eax
jne 0x4017af
push str.LNK1117
push 0x41f3f4
call fcn.00403bd0
add esp, 8
test eax, eax
jne 0x4017af
push 0x41fcbc
push 0x41f004
call fcn.00403bd0
add esp, 8
test eax, eax
jne 0x4017af
push str.LNK4044
push 0x41f3f4
call fcn.00403bd0
add esp, 8
test eax, eax
jne 0x4017af
push 0x41fccc
push 0x41f004
call fcn.00403bd0
add esp, 8
test eax, eax
jne 0x4017af
push str.LNK4224
push 0x41f3f4
call fcn.00403bd0
add esp, 8
test eax, eax
jne 0x4017af
mov dword [ebp - 0x248], 1
jmp 0x4017b9
mov dword [ebp - 0x248], 0
mov eax, dword [ebp - 0x248]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004029a7
mov esp, ebp
pop ebp
ret