Function at 0x4027c4
Capabilities:
Create pipe
Create process on windows
Create thread
Read file on windows
Terminate process
Write and execute a file
Write file on windows
Write pipe

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1138c
call fcn.004061b0
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], ebx
lea eax, [ebp - 0x1138c]
push 0x10000
push 0x4081a0
push eax
call fcn.00403834
add esp, 0xc
lea edx, [ebp - 0x1138c]
xor ecx, ecx
mov dword [ebp - 0x128c], ecx
mov dword [ebp - 0x1288], ecx
mov dword [ebp - 0x1284], ecx
mov dword [ebp - 0x1280], ecx
xor eax, eax
mov dword [ebp - 0x127c], ecx
mov dword [ebp - 0x1278], ecx
mov dword [ebp - 0x1274], ecx
mov dword [ebp - 0x1270], ecx
mov dword [ebp - 0x126c], ecx
xor ebx, ebx
mov dword [ebp - 8], eax
mov dword [ebp - 0x1268], ecx
mov dword [ebp - 0x1264], ecx
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov esi, dword [eax + 8]
mov dword [ebp - 4], esi
mov edi, str._exec
mov ecx, 5
xor eax, eax
test ecx, ecx
je 0x402873
mov al, byte [esi]
sub al, byte [edi]
jne 0x402873
add esi, 1
add edi, 1
sub ecx, 1
jne 0x402862
seta al
setb cl
sub al, cl
movsx eax, al
test eax, eax
je 0x4028be
mov esi, dword [ebp - 4]
mov edi, str._detached
mov ecx, 5
xor eax, eax
test ecx, ecx
je 0x4028a6
mov al, byte [esi]
sub al, byte [edi]
jne 0x4028a6
add esi, 1
add edi, 1
sub ecx, 1
jne 0x402895
seta al
setb cl
sub al, cl
movsx eax, al
test eax, eax
jne 0x402f57
mov ebx, 1
mov eax, dword [ebp + 8]
mov esi, 3
cmp eax, 3
jle 0x402957
mov dword [ebp - 0x1c], ebx
mov ebx, edx
mov eax, dword [ebp + 0xc]
mov edi, dword [eax + esi*4]
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x4028f0
add ecx, 1
add eax, 1
mov dl, byte [ecx]
test dl, dl
jne 0x4028e4
mov dword [ebp - 8], eax
push eax
push edi
push ebx
call fcn.00403ed4
add esp, 0xc
add ebx, dword [ebp - 8]
mov edi, 0x4185e8
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x40291c
add ecx, 1
add eax, 1
mov dl, byte [ecx]
test dl, dl
jne 0x402910
push eax
push 0x4185e8
push ebx
call fcn.00403ed4
add esp, 0xc
mov edi, 0x4185e8
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x402946
add ecx, 1
add eax, 1
mov dl, byte [ecx]
test dl, dl
jne 0x40293a
mov ecx, dword [ebp + 8]
add ebx, eax
add esi, 1
cmp esi, ecx
jl 0x4028d4
mov edx, ebx
mov ebx, dword [ebp - 0x1c]
xor eax, eax
mov byte [edx], al
mov dword [ebp - 0x1258], eax
test ebx, ebx
mov dword [ebp - 0x125c], 0xc
mov dword [ebp - 0x1254], 1
jne 0x402ad9
lea ecx, [ebp - 0x128c]
lea edx, [ebp - 0x1284]
lea eax, [ebp - 0x125c]
push 0
push eax
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x402be3
lea ecx, [ebp - 0x1270]
lea edx, [ebp - 0x126c]
lea eax, [ebp - 0x125c]
push 0
push eax
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x402be3
lea ecx, [ebp - 0x127c]
lea edx, [ebp - 0x1280]
lea eax, [ebp - 0x125c]
push 0
push eax
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x402be3
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 0x1288]
push 2
xor edx, edx
push edx
push edx
push ecx
push eax
push dword [ebp - 0x128c]
push esi
call dword [sym.imp.orauts.dll_DuplicateHandle]
test eax, eax
je 0x402be3
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 0x1278]
push 2
xor edx, edx
push edx
push edx
push ecx
push eax
push dword [ebp - 0x1280]
push esi
call dword [sym.imp.orauts.dll_DuplicateHandle]
test eax, eax
je 0x402be3
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 0x1274]
push 2
xor edx, edx
push edx
push edx
push ecx
push eax
push dword [ebp - 0x1270]
push esi
call dword [sym.imp.orauts.dll_DuplicateHandle]
test eax, eax
je 0x402be3
push dword [ebp - 0x128c]
call dword [sym.imp.orauts.dll_CloseHandle]
test eax, eax
je 0x402be3
push dword [ebp - 0x1280]
mov dword [ebp - 0x128c], 0
call dword [sym.imp.orauts.dll_CloseHandle]
test eax, eax
je 0x402be3
push dword [ebp - 0x1270]
mov dword [ebp - 0x1280], 0
call dword [sym.imp.orauts.dll_CloseHandle]
test eax, eax
je 0x402be3
mov dword [ebp - 0x1270], 0
xor eax, eax
mov dword [ebp - 0x1250], eax
mov dword [ebp - 0x124c], eax
mov dword [ebp - 0x1248], eax
mov dword [ebp - 0x1244], eax
mov dword [ebp - 0x1240], eax
mov dword [ebp - 0x123c], eax
mov dword [ebp - 0x1238], eax
mov dword [ebp - 0x1234], eax
mov dword [ebp - 0x1230], eax
mov dword [ebp - 0x122c], eax
mov dword [ebp - 0x1228], eax
mov dword [ebp - 0x1224], eax
mov dword [ebp - 0x1220], eax
mov dword [ebp - 0x121c], eax
mov dword [ebp - 0x1218], eax
mov dword [ebp - 0x1214], eax
mov dword [ebp - 0x1210], eax
mov dword [ebp - 0x1250], 0x44
xor eax, eax
test ebx, ebx
mov word [ebp - 0x1220], ax
je 0x402b5c
xor eax, eax
jmp 0x402b61
mov eax, 0x100
mov dword [ebp - 0x1248], str.Winsta0Default
or eax, 1
test ebx, ebx
mov dword [ebp - 0x1224], eax
jne 0x402b9c
mov eax, dword [ebp - 0x127c]
mov edx, dword [ebp - 0x1284]
mov ecx, dword [ebp - 0x126c]
mov dword [ebp - 0x1218], eax
mov dword [ebp - 0x1214], edx
mov dword [ebp - 0x1210], ecx
call dword [sym.imp.KERNEL32.dll_AllocConsole]
test ebx, ebx
je 0x402bad
mov ecx, 0x10
jmp 0x402bb2
mov ecx, 0x8000200
lea esi, [ebp - 0x1138c]
lea edx, [ebp - 0x1250]
lea eax, [ebp - 0x120c]
push eax
xor edi, edi
push edx
push edi
push edi
push ecx
push 1
push edi
push edi
push esi
push edi
call dword [sym.imp.orauts.dll_CreateProcessA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeConsole]
test esi, esi
jne 0x402bf4
call dword [sym.imp.orauts.dll_GetLastError]
mov dword [ebp - 0x1260], eax
jmp 0x402e1b
mov eax, dword [ebp - 0x1204]
mov dword [ebp - 0x1268], eax
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
lea ecx, [ebp - 0x1268]
lea edx, [ebp - 0x11fc]
push 0
push edx
push 4
push ecx
push eax
call dword [sym.imp.orauts.dll_WriteFile]
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push 0xbb8
push dword [ebp - 0x120c]
call dword [sym.imp.orauts.dll_WaitForInputIdle]
test ebx, ebx
je 0x402c59
mov dword [ebp - 0x1260], 0
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x402e1b
push dword [ebp - 0x1284]
call dword [sym.imp.orauts.dll_CloseHandle]
test eax, eax
je 0x402cc1
push dword [ebp - 0x127c]
mov dword [ebp - 0x1284], 0
call dword [sym.imp.orauts.dll_CloseHandle]
test eax, eax
je 0x402cc1
push dword [ebp - 0x126c]
mov dword [ebp - 0x127c], 0
call dword [sym.imp.orauts.dll_CloseHandle]
test eax, eax
je 0x402cc1
push dword [ebp - 0x1278]
mov dword [ebp - 0x126c], 0
call dword [sym.imp.orauts.dll_CloseHandle]
test eax, eax
je 0x402cc1
mov dword [ebp - 0x1278], 0
mov eax, dword [ebp - 0x120c]
mov edx, dword [ebp - 0x1288]
mov dword [ebp - 0x11f4], eax
mov dword [ebp - 0x11f0], edx
lea ebx, [ebp - 0x11f4]
lea ecx, [ebp - 0x11ec]
push ecx
xor esi, esi
mov dword [ebp - 0x11f8], esi
push esi
push ebx
push 0x4031e0
push esi
push esi
call dword [sym.imp.orauts.dll_CreateThread]
mov esi, eax
lea edx, [ebp - 0x1260]
push edx
push dword [ebp - 0x120c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp eax, 1
jne 0x402dc5
mov edx, dword [ebp - 0x1260]
cmp edx, 0x103
jne 0x402dc5
mov ebx, dword [ebp - 0x18]
push 0x64
call dword [sym.imp.orauts.dll_Sleep]
cmp ebx, 0xc8
jae 0x402d72
lea edx, [ebp - 0xe8]
lea ecx, [ebp - 0x11f8]
push 0
lea edx, [edx + ebx]
mov edi, ebx
push ecx
neg edi
add edi, 0xc8
push edi
push edx
push dword [ebp - 0x1274]
call dword [sym.imp.orauts.dll_ReadFile]
add ebx, dword [ebp - 0x11f8]
jmp 0x402d93
lea ecx, [ebp - 0x11e8]
lea edx, [ebp - 0x11f8]
push 0
push edx
push 0xfa0
push ecx
push dword [ebp - 0x1274]
call dword [sym.imp.orauts.dll_ReadFile]
lea edx, [ebp - 0x1260]
push edx
push dword [ebp - 0x120c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp eax, 1
jne 0x402dc2
mov edx, dword [ebp - 0x1260]
cmp edx, 0x103
je 0x402d30
jmp 0x4031d5
mov dword [ebp - 0x18], ebx
mov edx, dword [ebp - 0x18]
test edx, edx
je 0x402def
movzx ecx, byte [ebp + edx - 0xe9]
cmp ecx, 0xa
je 0x403178
test ecx, ecx
je 0x402def
mov byte [ebp + edx - 0xe8], 0
add edx, 1
mov dword [ebp - 0x18], edx
test esi, esi
je 0x402e03
push 0xffffffffffffffff
push esi
call dword [sym.imp.orauts.dll_WaitForSingleObject]
push esi
call dword [sym.imp.orauts.dll_CloseHandle]
push dword [ebp - 0x1208]
call dword [sym.imp.orauts.dll_CloseHandle]
push dword [ebp - 0x120c]
call dword [sym.imp.orauts.dll_CloseHandle]
mov eax, dword [ebp - 0x1288]
test eax, eax
je 0x402e2c
push eax
call dword [sym.imp.orauts.dll_CloseHandle]
mov eax, dword [ebp - 0x1284]
test eax, eax
je 0x402e3d
push eax
call dword [sym.imp.orauts.dll_CloseHandle]
mov eax, dword [ebp - 0x127c]
test eax, eax
je 0x402e4e
push eax
call dword [sym.imp.orauts.dll_CloseHandle]
mov eax, dword [ebp - 0x126c]
test eax, eax
je 0x402e5f
push eax
call dword [sym.imp.orauts.dll_CloseHandle]
mov eax, dword [ebp - 0x1274]
test eax, eax
je 0x402e70
push eax
call dword [sym.imp.orauts.dll_CloseHandle]
mov eax, dword [ebp - 0x1278]
test eax, eax
je 0x402e81
push eax
call dword [sym.imp.orauts.dll_CloseHandle]
mov eax, dword [ebp - 0x1280]
test eax, eax
je 0x402e92
push eax
call dword [sym.imp.orauts.dll_CloseHandle]
mov eax, dword [ebp - 0x128c]
test eax, eax
je 0x402ea3
push eax
call dword [sym.imp.orauts.dll_CloseHandle]
mov eax, dword [ebp - 0x1270]
test eax, eax
je 0x402eb9
push dword [ebp - 0x128c]
call dword [sym.imp.orauts.dll_CloseHandle]
mov eax, dword [ebp - 0x18]
test eax, eax
jbe 0x402ee8
mov edx, eax
lea ecx, [ebp - 0x1138c]
lea eax, [ebp - 0xe8]
push eax
push edx
push edx
push dword [ebp - 0x1260]
push str._d__d__.s
push ecx
call dword [sym.imp.MSVCR71.dll_sprintf]
add esp, 0x18
jmp 0x402f05
lea eax, [ebp - 0x1138c]
push 0
push dword [ebp - 0x1260]
push str._d__d
push eax
call dword [sym.imp.MSVCR71.dll_sprintf]
add esp, 0x10
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebx, eax
lea edi, [ebp - 0x1138c]
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x402f2b
add ecx, 1
add eax, 1
mov dl, byte [ecx]
test dl, dl
jne 0x402f1f
lea ecx, [ebp - 0x1138c]
lea edx, [ebp - 0x11fc]
push 0
push edx
push eax
push ecx
push ebx
call dword [sym.imp.orauts.dll_WriteFile]
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
jmp 0x40316b
mov esi, dword [ebp - 4]
mov edi, str._kill
mov ecx, 5
xor eax, eax
test ecx, ecx
je 0x402f7b
mov al, byte [esi]
sub al, byte [edi]
jne 0x402f7b
add esi, 1
add edi, 1
sub ecx, 1
jne 0x402f6a
seta al
setb cl
sub al, cl
movsx eax, al
test eax, eax
jne 0x402f94
mov eax, 1
mov dword [ebp - 8], eax
jmp 0x402fcb
mov esi, dword [ebp - 4]
mov edi, str._stop
mov ecx, 5
xor eax, eax
test ecx, ecx
je 0x402fb8
mov al, byte [esi]
sub al, byte [edi]
jne 0x402fb8
add esi, 1
add edi, 1
sub ecx, 1
jne 0x402fa7
seta al
setb cl
sub al, cl
movsx eax, al
test eax, eax
jne 0x40316b
mov eax, dword [ebp + 0xc]
push dword [eax + 0xc]
call dword [sym.imp.MSVCR71.dll_atoi]
pop ecx
mov dword [ebp - 0x1268], eax
push eax
push 0
push 0x1f0fff
call dword [sym.imp.orauts.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x4031b6
mov edx, dword [ebp - 8]
test edx, edx
je 0x40303d
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x40301b
mov dword [ebp - 0x1260], 0
xor edx, edx
jmp 0x403155
call dword [sym.imp.orauts.dll_GetLastError]
push str.Job_Terminate_failed__kill_returned_error
mov dword [ebp - 0x1260], eax
call fcn.00401334
pop ecx
mov edx, dword [ebp - 0x1260]
jmp 0x403155
call dword [sym.imp.KERNEL32.dll_FreeConsole]
push str.Kernel32.dll
call dword [sym.imp.orauts.dll_GetModuleHandleA]
mov esi, eax
test esi, esi
je 0x40308a
push str.AttachConsole
push esi
call dword [sym.imp.orauts.dll_GetProcAddress]
test eax, eax
je 0x40308a
push dword [ebp - 0x1268]
call eax
mov edi, eax
test edi, edi
je 0x40308c
push dword [ebp - 0x1268]
push 1
call dword [sym.imp.KERNEL32.dll_GenerateConsoleCtrlEvent]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_FreeConsole]
jmp 0x40308c
xor edi, edi
test esi, esi
je 0x403097
push esi
call dword [sym.imp.orauts.dll_CloseHandle]
test edi, edi
je 0x403138
mov dword [ebp - 0x1260], 0
lea edx, [ebp - 0x1264]
mov edi, 1
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp eax, 1
jne 0x403130
mov edx, dword [ebp - 0x1264]
cmp edx, 0x103
jne 0x4031ae
lea edx, [edi + edi]
add edx, edx
sub edx, edi
lea ecx, [edi + edx*8]
lea esi, [ecx + ecx*4]
add esi, esi
add esi, esi
add esi, esi
push esi
call dword [sym.imp.orauts.dll_Sleep]
add esi, 0x3e8
add edi, 1
cmp edi, 0xa
je 0x40319d
lea edx, [ebp - 0x1264]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp eax, 1
jne 0x403128
mov edx, dword [ebp - 0x1264]
cmp edx, 0x103
je 0x4030e6
mov edx, dword [ebp - 0x1260]
jmp 0x403155
mov edx, dword [ebp - 0x1260]
jmp 0x403155
mov edx, dword [ebp - 0x1260]
jmp 0x403155
call dword [sym.imp.orauts.dll_GetLastError]
push str.Job_Terminate_failed__kill_returned_error
mov dword [ebp - 0x1260], eax
call fcn.00401334
pop ecx
mov edx, dword [ebp - 0x1260]
push edx
push 0x4185d8
call dword [sym.imp.MSVCR71.dll_printf]
add esp, 8
push ebx
call dword [sym.imp.orauts.dll_CloseHandle]
mov ebx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x10]
mov edi, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
movzx ebx, byte [ebp + edx - 0xea]
lea edi, [edx - 2]
cmp ebx, 0xd
jne 0x402ddd
mov byte [ebp + edi - 0xe8], 0
add dword [ebp - 0x18], 0xffffffff
jmp 0x402def
mov dword [ebp - 0x1260], 0x102
mov edx, 0x102
jmp 0x403155
mov edx, dword [ebp - 0x1260]
jmp 0x403155
call dword [sym.imp.orauts.dll_GetLastError]
push str.Job_Terminate_failed__unable_to_get_handle
mov dword [ebp - 0x1260], eax
call fcn.00401334
pop ecx
mov edx, dword [ebp - 0x1260]
jmp 0x403155
mov dword [ebp - 0x18], ebx
jmp 0x402dc5