Function at 0x401000
Capabilities:
Create pipe
Create process on windows
Create thread
Create two anonymous pipes
Write and execute a file
Write file on windows
Write pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x41fd30]
xor eax, ebp
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x198], eax
push 0x10
push 0
lea eax, [ebp - 0x1d4]
push eax
call fcn.00403940
add esp, 0xc
push 0x44
push 0
lea ecx, [ebp - 0x218]
push ecx
call fcn.00403940
add esp, 0xc
mov dword [ebp - 0x218], 0x44
mov dword [ebp - 0x1ec], 0x100
mov dword [ebp - 0x1e0], 0xffffffff
push 0xc
push 0
lea edx, [ebp - 0x1c4]
push edx
call fcn.00403940
add esp, 0xc
mov dword [ebp - 0x1c4], 0xc
mov dword [ebp - 0x1c0], 0
mov dword [ebp - 0x1bc], 0
push 0
lea eax, [ebp - 0x1c4]
push eax
lea ecx, [ebp - 0x19c]
push ecx
push section..data
call dword [sym.imp.KERNEL32.dll_CreatePipe]
push 3
push 1
push 0
lea edx, [ebp - 0x1dc]
push edx
mov eax, dword [ebp - 0x198]
push eax
mov ecx, dword [ebp - 0x19c]
push ecx
mov edx, dword [ebp - 0x198]
push edx
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 0
lea eax, [ebp - 0x1c4]
push eax
lea ecx, [ebp - 0x19c]
push ecx
push 0x41f3f0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
push 3
push 1
push 0
lea edx, [ebp - 0x1d8]
push edx
mov eax, dword [ebp - 0x198]
push eax
mov ecx, dword [ebp - 0x19c]
push ecx
mov edx, dword [ebp - 0x198]
push edx
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push str.cl.exe__nologo__c__TC__Zs__X__Fp._junk.pch
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x68]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push str._._nul
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [ebp - 0x1d4]
push ecx
lea edx, [ebp - 0x218]
push edx
push 0
push 0
push 8
push 1
push 0
push 0
lea eax, [ebp - 0x68]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 0
jne 0x40121e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1a0], eax
mov ecx, dword [ebp - 0x1a0]
push ecx
lea edx, [ebp - 0x68]
push edx
push 0x41f974
push 0x12b
lea eax, [ebp - 0x194]
push eax
call fcn.00402650
add esp, 0x14
mov dword [ebp - 0x1a4], eax
push 0
mov ecx, 0x12c
sub ecx, dword [ebp - 0x1a4]
push ecx
mov edx, dword [ebp - 0x1a4]
lea eax, [ebp + edx - 0x194]
push eax
push 0
mov ecx, dword [ebp - 0x1a0]
push ecx
push 0
push 0x12ff
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push 0
lea edx, [ebp - 0x1a0]
push edx
lea eax, [ebp - 0x194]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea ecx, [ebp - 0x194]
push ecx
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, 2
jmp 0x4013ad
mov edx, dword [ebp - 0x1dc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1d8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1388
mov ecx, dword [ebp - 0x1d4]
push ecx
call dword [sym.imp.USER32.dll_WaitForInputIdle]
mov edx, dword [ebp - 0x1d0]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x1b8]
push eax
push 0
push section..data
push 0x401d10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 4
imul edx, ecx, 0
mov dword [ebp + edx - 0x1b0], eax
lea eax, [ebp - 0x1b8]
push eax
push 0
push 0x41f3f0
push 0x401d10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 4
shl ecx, 0
mov dword [ebp + ecx - 0x1b0], eax
push 0xffffffffffffffff
mov edx, dword [ebp - 0x1d4]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x1d4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1f4
push 1
lea ecx, [ebp - 0x1b0]
push ecx
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov edx, 4
imul eax, edx, 0
mov ecx, dword [ebp + eax - 0x1b0]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 4
shl edx, 0
mov eax, dword [ebp + edx - 0x1b0]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x41fc4c
push 0x41f004
call fcn.00403bd0
add esp, 8
test eax, eax
jne 0x40139d
push str.D4002
push 0x41f3f4
call fcn.00403bd0
add esp, 8
test eax, eax
jne 0x40139d
push 0x41fc5c
push 0x41f004
call fcn.00403bd0
add esp, 8
test eax, eax
jne 0x40139d
push str.D9002
push 0x41f3f4
call fcn.00403bd0
add esp, 8
test eax, eax
jne 0x40139d
push 0x41fc6c
push 0x41f004
call fcn.00403bd0
add esp, 8
test eax, eax
jne 0x40139d
push str.D2021
push 0x41f3f4
call fcn.00403bd0
add esp, 8
test eax, eax
jne 0x40139d
mov dword [ebp - 0x1a8], 1
jmp 0x4013a7
mov dword [ebp - 0x1a8], 0
mov eax, dword [ebp - 0x1a8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004029a7
mov esp, ebp
pop ebp
ret