Function at 0x43fcd4
Capabilities:
Check for time delay via gettickcount
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create reverse shell
Create two anonymous pipes
Hide graphical window
Read file on windows
Read pipe
Write and execute a file
Write file on windows
Write pipe

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe58
mov ecx, 8
push ebx
push esi
push edi
mov esi, 0x520b08
mov edi, dword [ebp + 0xc]
push edi
lea edi, [ebp - 0x148]
rep movsd dword es:[edi], dword [esi]
pop edi
mov eax, dword [0x520b28]
mov dword [ebp - 0xc], eax
mov eax, dword [0x520b2c]
mov dword [ebp - 8], eax
mov eax, dword [0x520b30]
mov dword [ebp - 4], eax
xor edx, edx
mov dword [ebp - 0x10], edx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
xor eax, eax
mov dword [ebp - 0x18], eax
xor edx, edx
mov dword [ebp - 0x1c], edx
push edi
lea edi, [ebp - 0x158]
mov ecx, 4
mov esi, 0x520b34
rep movsd dword es:[edi], dword [esi]
pop edi
mov ecx, 0x11
push edi
lea edi, [ebp - 0x19c]
mov esi, 0x520b44
rep movsd dword es:[edi], dword [esi]
pop edi
mov eax, dword [0x520b88]
mov dword [ebp - 0x1a8], eax
mov eax, dword [0x520b8c]
mov dword [ebp - 0x1a4], eax
mov eax, dword [0x520b90]
mov dword [ebp - 0x1a0], eax
call sub.KERNEL32.dll_GetTickCount
push eax
call sub.KERNEL32.dll_GetCurrentThreadId
push eax
push 0x5eabb8
lea edx, [ebp - 0x148]
push edx
call fcn.004d75f8
add esp, 0x10
mov dword [ebp - 0x1a8], 0xc
mov dword [ebp - 0x1a0], 1
xor ecx, ecx
lea eax, [ebp - 0x1a8]
mov dword [ebp - 0x1a4], ecx
push 0
push eax
lea edx, [ebp - 0x1c]
push edx
lea ecx, [ebp - 0x18]
push ecx
call sub.KERNEL32.dll_CreatePipe
test eax, eax
jne 0x43fdd2
mov eax, 0xffffff9b
jmp 0x4400c6
push 0
push 1
mov edx, dword [ebp - 0x18]
push edx
call sub.KERNEL32.dll_SetHandleInformation
test eax, eax
jne 0x43fded
mov eax, 0xffffff99
jmp 0x4400c6
push 0
lea edx, [ebp - 0x1a8]
push edx
lea ecx, [ebp - 0x14]
push ecx
lea eax, [ebp - 0x10]
push eax
call sub.KERNEL32.dll_CreatePipe
test eax, eax
jne 0x43fe11
mov eax, 0xffffff91
jmp 0x4400c6
push 0
push 1
mov edx, dword [ebp - 0x14]
push edx
call sub.KERNEL32.dll_SetHandleInformation
test eax, eax
jne 0x43fe2c
mov eax, 0xffffff8f
jmp 0x4400c6
push 0x44
push 0
lea edx, [ebp - 0x19c]
push edx
call fcn.004d2d9c
mov dword [ebp - 0x19c], 0x44
lea ecx, [ebp - 0x148]
add esp, 0xc
mov dword [ebp - 0x190], ecx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x15c], eax
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x160], edx
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x164], ecx
or dword [ebp - 0x170], 0x101
mov word [ebp - 0x16c], 0
test byte [ebp + 0x15], 4
je 0x43fe92
mov word [ebp - 0x16c], 5
lea eax, [ebp - 0x158]
lea edx, [ebp - 0x19c]
push eax
push edx
push 0
push 0
push 0
push 1
push 0
lea ecx, [ebp - 0xc]
push 0
push ecx
push 0
call sub.KERNEL32.dll_CreateProcessA
test eax, eax
jne 0x43fec5
mov eax, 0xffffff73
jmp 0x4400c6
mov edx, dword [ebp - 0x1c]
push edx
call sub.KERNEL32.dll_CloseHandle
mov ecx, dword [ebp - 0x10]
push ecx
call sub.KERNEL32.dll_CloseHandle
call sub.KERNEL32.dll_GetTickCount
mov ebx, eax
jmp 0x43fefa
push 0
push 0
call fcn.00401400
add esp, 8
call sub.KERNEL32.dll_GetTickCount
sub eax, ebx
cmp eax, 0x2710
ja 0x43ff0e
lea eax, [ebp - 0x148]
push eax
push 0
call sub.USER32.dll_FindWindowA
mov esi, eax
test eax, eax
je 0x43fee0
push esi
call sub.USER32.dll_IsWindow
test eax, eax
je 0x43ff20
push 0
push esi
call sub.USER32.dll_ShowWindow
push 0
lea edx, [ebp - 0x24]
push edx
mov ecx, dword [ebp + 8]
push ecx
call fcn.004d2f1c
pop ecx
push eax
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x14]
push edx
call sub.KERNEL32.dll_WriteFile
push 1
call fcn.004dee84
pop ecx
push 0
push 0
call fcn.00401400
add esp, 8
test edi, edi
je 0x44001a
mov cl, byte [edi]
test cl, cl
je 0x44001a
test byte [ebp + 0x15], 1
je 0x43ffb5
mov ebx, edi
jmp 0x43ff8c
push 0
movsx eax, al
push eax
push 0x102
push esi
call sub.USER32.dll_PostMessageA
push 0
push 0
call fcn.00401400
add esp, 8
inc ebx
mov al, byte [ebx]
test al, al
jne 0x43ff6e
test byte [ebp + 0x15], 2
je 0x440006
push 0
push 0xd
push 0x102
push esi
call sub.USER32.dll_PostMessageA
push 0
push 0
call fcn.00401400
add esp, 8
jmp 0x440006
push 0
lea edx, [ebp - 0x24]
push edx
push edi
call fcn.004d2f1c
pop ecx
push eax
push edi
mov ecx, dword [ebp - 0x14]
push ecx
call sub.KERNEL32.dll_WriteFile
mov esi, 0x5eabbe
lea edi, [ebp - 0x128]
mov eax, edi
movsw word es:[edi], word [esi]
test byte [ebp + 0x15], 2
je 0x440006
push 0
lea edx, [ebp - 0x24]
push edx
lea ecx, [ebp - 0x128]
push ecx
call fcn.004d2f1c
pop ecx
push eax
lea eax, [ebp - 0x128]
push eax
mov edx, dword [ebp - 0x14]
push edx
call sub.KERNEL32.dll_WriteFile
push 1
call fcn.004dee84
pop ecx
push 0
push 0
call fcn.00401400
add esp, 8
mov ecx, dword [ebp - 0x158]
push ecx
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [ebp - 0x154]
push eax
call sub.KERNEL32.dll_CloseHandle
mov edx, dword [ebp - 0x14]
push edx
call sub.KERNEL32.dll_CloseHandle
test eax, eax
call sub.KERNEL32.dll_GetTickCount
mov ebx, eax
push 0
lea eax, [ebp - 0x20]
push eax
push 0
push 0
push 0
mov edx, dword [ebp - 0x18]
push edx
call sub.KERNEL32.dll_PeekNamedPipe
test eax, eax
je 0x4400bd
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x4400af
lea eax, [ebp - 0x20]
push 0
push eax
lea edx, [ebp - 0x128]
push 0x104
push edx
mov ecx, dword [ebp - 0x18]
push ecx
call sub.KERNEL32.dll_ReadFile
test eax, eax
je 0x4400bd
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x4400bd
mov edx, dword [ebp - 0x20]
mov byte [ebp + edx - 0x128], 0
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4400af
lea eax, [ebp - 0x128]
push eax
mov edx, dword [ebp + 0x10]
push edx
call fcn.004d2e40
add esp, 8
call sub.KERNEL32.dll_GetTickCount
sub eax, ebx
cmp eax, 0x2710
jbe 0x440044
xor eax, eax
jmp 0x4400c6
test eax, eax
je 0x4400d7
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x4400d7
mov ecx, dword [ebp + 0x10]
mov byte [ecx], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret