Function at 0x41c220
Capabilities:
Create pipe
Create process on windows
Create reverse shell
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1bd4
call fcn.00421100
push ebx
push esi
push edi
lea edi, [ebp - 0x1bd4]
mov ecx, 0x6f5
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov byte [ebp - 0x900], 0
mov byte [ebp - 0xa00], 0
mov byte [ebp - 0xb00], 0
mov byte [ebp - 0xc00], 0
mov byte [ebp - 0xd00], 0
mov byte [ebp - 0xe00], 0
mov esi, esp
push str.lib_version.dat
mov eax, dword [ebp + 8]
push eax
push str._s_s
lea ecx, [ebp - 0x800]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
cmp esi, esp
call fcn.0041fa50
push 0x43b6dc
lea edx, [ebp - 0x800]
push edx
call fcn.00421080
add esp, 8
mov dword [ebp - 0xe04], eax
cmp dword [ebp - 0xe04], 0
je 0x41c576
mov eax, dword [ebp - 0xe04]
mov ecx, dword [eax + 0xc]
and ecx, 0x10
test ecx, ecx
jne 0x41c3d8
push 0xa
push 0x400
lea edx, [ebp - 0x1204]
push edx
mov eax, dword [ebp - 0xe04]
push eax
call fcn.0041c190
add esp, 0x10
movsx ecx, byte [ebp - 0x1204]
cmp ecx, 0x23
jne 0x41c2f9
jmp 0x41c2ba
movsx edx, byte [ebp - 0x1204]
cmp edx, 0x3c
jne 0x41c313
movsx eax, byte [ebp - 0x1203]
cmp eax, 0x3f
jne 0x41c313
jmp 0x41c2ba
lea ecx, [ebp - 0x900]
push ecx
push str.__major_
push str._major_
lea edx, [ebp - 0x1204]
push edx
call fcn.0041c0d0
add esp, 0x10
lea eax, [ebp - 0xa00]
push eax
push str.__minor_
push str._minor_
lea ecx, [ebp - 0x1204]
push ecx
call fcn.0041c0d0
add esp, 0x10
lea edx, [ebp - 0xb00]
push edx
push str.__micro_
push str._micro_
lea eax, [ebp - 0x1204]
push eax
call fcn.0041c0d0
add esp, 0x10
lea ecx, [ebp - 0xc00]
push ecx
push str.__update_
push str._update_
lea edx, [ebp - 0x1204]
push edx
call fcn.0041c0d0
add esp, 0x10
lea eax, [ebp - 0xd00]
push eax
push str.__milestone_
push str._milestone_
lea ecx, [ebp - 0x1204]
push ecx
call fcn.0041c0d0
add esp, 0x10
lea edx, [ebp - 0xe00]
push edx
push str.__build_number_
push str._build_number_
lea eax, [ebp - 0x1204]
push eax
call fcn.0041c0d0
add esp, 0x10
jmp 0x41c2ba
mov ecx, dword [ebp - 0xe04]
push ecx
call fcn.00420c20
add esp, 4
mov esi, esp
lea edx, [ebp - 0xb00]
push edx
lea eax, [ebp - 0xa00]
push eax
lea ecx, [ebp - 0x900]
push ecx
push str._s._s._s
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
cmp esi, esp
call fcn.0041fa50
movsx eax, byte [ebp - 0xc00]
test eax, eax
je 0x41c492
mov esi, esp
lea ecx, [ebp - 0xc00]
push ecx
lea edx, [ebp - 0xb00]
push edx
lea eax, [ebp - 0xa00]
push eax
lea ecx, [ebp - 0x900]
push ecx
push str._s._s._s__s
mov edx, dword [ebp + 0x14]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
cmp esi, esp
call fcn.0041fa50
mov esi, esp
lea eax, [ebp - 0xc00]
push eax
lea ecx, [ebp - 0xb00]
push ecx
lea edx, [ebp - 0xa00]
push edx
lea eax, [ebp - 0x900]
push eax
push str._s._s._s__s
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
cmp esi, esp
call fcn.0041fa50
jmp 0x41c4f2
mov esi, esp
lea edx, [ebp - 0xb00]
push edx
lea eax, [ebp - 0xa00]
push eax
lea ecx, [ebp - 0x900]
push ecx
push str._s._s._s
mov edx, dword [ebp + 0x14]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
cmp esi, esp
call fcn.0041fa50
mov esi, esp
lea eax, [ebp - 0xb00]
push eax
lea ecx, [ebp - 0xa00]
push ecx
lea edx, [ebp - 0x900]
push edx
push str._s._s._s
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
cmp esi, esp
call fcn.0041fa50
movsx ecx, byte [ebp - 0xd00]
test ecx, ecx
je 0x41c52f
mov esi, esp
push 0x43ceb0
mov edx, dword [ebp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp esi, esp
call fcn.0041fa50
mov esi, esp
lea eax, [ebp - 0xd00]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp esi, esp
call fcn.0041fa50
movsx edx, byte [ebp - 0xe00]
test edx, edx
je 0x41c56c
mov esi, esp
push 0x43ceac
mov eax, dword [ebp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp esi, esp
call fcn.0041fa50
mov esi, esp
lea ecx, [ebp - 0xe00]
push ecx
mov edx, dword [ebp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp esi, esp
call fcn.0041fa50
mov eax, 1
jmp 0x41ca86
mov esi, esp
mov eax, dword [ebp + 8]
push eax
push str._s_binjava.exe__fullversion
lea ecx, [ebp - 0x1a04]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
cmp esi, esp
call fcn.0041fa50
mov dword [ebp - 0x1a28], 0xc
mov dword [ebp - 0x1a24], 0
mov dword [ebp - 0x1a20], 1
push 0xc
push 0
lea edx, [ebp - 0x1a10]
push edx
call fcn.004210a0
add esp, 0xc
push 0xc
push 0
lea eax, [ebp - 0x1a1c]
push eax
call fcn.004210a0
add esp, 0xc
mov esi, esp
push 0x400
lea ecx, [ebp - 0x1a28]
push ecx
lea edx, [ebp - 0x1a1c]
push edx
lea eax, [ebp - 0x1a10]
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
cmp esi, esp
call fcn.0041fa50
test eax, eax
je 0x41c667
mov esi, esp
push 0x400
lea ecx, [ebp - 0x1a28]
push ecx
lea edx, [ebp - 0x1a18]
push edx
lea eax, [ebp - 0x1a0c]
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
cmp esi, esp
call fcn.0041fa50
test eax, eax
je 0x41c667
mov esi, esp
push 0x400
lea ecx, [ebp - 0x1a28]
push ecx
lea edx, [ebp - 0x1a14]
push edx
lea eax, [ebp - 0x1a08]
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
cmp esi, esp
call fcn.0041fa50
test eax, eax
jne 0x41c721
cmp dword [ebp - 0x1a10], 0
je 0x41c686
mov esi, esp
mov ecx, dword [ebp - 0x1a10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.0041fa50
cmp dword [ebp - 0x1a0c], 0
je 0x41c6a5
mov esi, esp
mov edx, dword [ebp - 0x1a0c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.0041fa50
cmp dword [ebp - 0x1a08], 0
je 0x41c6c4
mov esi, esp
mov eax, dword [ebp - 0x1a08]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.0041fa50
cmp dword [ebp - 0x1a1c], 0
je 0x41c6e3
mov esi, esp
mov ecx, dword [ebp - 0x1a1c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.0041fa50
cmp dword [ebp - 0x1a18], 0
je 0x41c702
mov esi, esp
mov edx, dword [ebp - 0x1a18]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.0041fa50
cmp dword [ebp - 0x1a14], 0
je 0x41c721
mov esi, esp
mov eax, dword [ebp - 0x1a14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.0041fa50
push 0x44
push 0
lea ecx, [ebp - 0x1a6c]
push ecx
call fcn.004210a0
add esp, 0xc
mov dword [ebp - 0x1a6c], 0x44
mov dword [ebp - 0x1a40], 0x100
mov edx, dword [ebp - 0x1a10]
mov dword [ebp - 0x1a34], edx
mov eax, dword [ebp - 0x1a18]
mov dword [ebp - 0x1a30], eax
mov ecx, dword [ebp - 0x1a14]
mov dword [ebp - 0x1a2c], ecx
mov esi, esp
push 0
push 1
mov edx, dword [ebp - 0x1a1c]
push edx
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
cmp esi, esp
call fcn.0041fa50
mov esi, esp
push 0
push 1
mov eax, dword [ebp - 0x1a0c]
push eax
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
cmp esi, esp
call fcn.0041fa50
mov esi, esp
push 0
push 1
mov ecx, dword [ebp - 0x1a08]
push ecx
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
cmp esi, esp
call fcn.0041fa50
push 0x10
push 0
lea edx, [ebp - 0x1a7c]
push edx
call fcn.004210a0
add esp, 0xc
mov esi, esp
lea eax, [ebp - 0x1a7c]
push eax
lea ecx, [ebp - 0x1a6c]
push ecx
push 0
push 0
push 0x8000008
push 1
push 0
push 0
lea edx, [ebp - 0x1a04]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp esi, esp
call fcn.0041fa50
mov dword [ebp - 0x1a80], eax
cmp dword [ebp - 0x1a80], 0
je 0x41c9d0
mov dword [ebp - 0x1b84], 0
mov esi, esp
push 0
lea eax, [ebp - 0x1b84]
push eax
push 0x100
lea ecx, [ebp - 0x1b80]
push ecx
mov edx, dword [ebp - 0x1a08]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp esi, esp
call fcn.0041fa50
push 0x43ce88
lea eax, [ebp - 0x1b80]
push eax
call fcn.00421130
add esp, 8
mov dword [ebp - 0x1b88], eax
push 0x43ceb0
mov ecx, dword [ebp - 0x1b88]
add ecx, 1
push ecx
call fcn.00421130
add esp, 8
mov dword [ebp - 0x1b8c], eax
cmp dword [ebp - 0x1b8c], 0
jne 0x41c8e3
push 0x43ce88
mov edx, dword [ebp - 0x1b88]
add edx, 1
push edx
call fcn.00421130
add esp, 8
mov dword [ebp - 0x1b90], eax
mov eax, dword [ebp - 0x1b90]
sub eax, dword [ebp - 0x1b88]
sub eax, 1
push eax
mov ecx, dword [ebp - 0x1b88]
add ecx, 1
push ecx
mov edx, dword [ebp + 0x10]
push edx
call fcn.00423ae0
add esp, 0xc
mov eax, dword [ebp - 0x1b90]
sub eax, dword [ebp - 0x1b88]
mov ecx, dword [ebp + 0x10]
mov byte [ecx + eax - 1], 0
jmp 0x41c93a
push 0x43ce88
mov edx, dword [ebp - 0x1b8c]
add edx, 1
push edx
call fcn.00421130
add esp, 8
mov dword [ebp - 0x1b90], eax
mov eax, dword [ebp - 0x1b8c]
sub eax, dword [ebp - 0x1b88]
sub eax, 1
push eax
mov ecx, dword [ebp - 0x1b88]
add ecx, 1
push ecx
mov edx, dword [ebp + 0x10]
push edx
call fcn.00423ae0
add esp, 0xc
mov eax, dword [ebp - 0x1b8c]
sub eax, dword [ebp - 0x1b88]
mov ecx, dword [ebp + 0x10]
mov byte [ecx + eax - 1], 0
mov edx, dword [ebp - 0x1b90]
sub edx, dword [ebp - 0x1b88]
sub edx, 1
push edx
mov eax, dword [ebp - 0x1b88]
add eax, 1
push eax
mov ecx, dword [ebp + 0x14]
push ecx
call fcn.00423ae0
add esp, 0xc
mov edx, dword [ebp - 0x1b90]
sub edx, dword [ebp - 0x1b88]
mov eax, dword [ebp + 0x14]
mov byte [eax + edx - 1], 0
push 0x43ce84
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.00421130
add esp, 8
mov dword [ebp - 0x1b94], eax
cmp dword [ebp - 0x1b94], 0
jne 0x41c9a6
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.00420b30
add esp, 8
jmp 0x41c9d0
mov ecx, dword [ebp - 0x1b94]
sub ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.00423ae0
add esp, 0xc
mov ecx, dword [ebp - 0x1b94]
sub ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov byte [edx + ecx], 0
mov esi, esp
mov eax, dword [ebp - 0x1a10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.0041fa50
mov esi, esp
mov ecx, dword [ebp - 0x1a0c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.0041fa50
mov esi, esp
mov edx, dword [ebp - 0x1a08]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.0041fa50
mov esi, esp
mov eax, dword [ebp - 0x1a1c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.0041fa50
mov esi, esp
mov ecx, dword [ebp - 0x1a18]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.0041fa50
mov esi, esp
mov edx, dword [ebp - 0x1a14]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.0041fa50
mov esi, esp
mov eax, dword [ebp - 0x1a78]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.0041fa50
mov esi, esp
mov ecx, dword [ebp - 0x1a7c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.0041fa50
mov eax, dword [ebp - 0x1a80]
pop edi
pop esi
pop ebx
add esp, 0x1bd4
cmp ebp, esp
call fcn.0041fa50
mov esp, ebp
pop ebp
ret