Function at 0x47ca16
Capabilities:
Check if file exists
Check os version
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create process suspended
Create reverse shell
Create two anonymous pipes
Execute shell command and capture output
Get number of processors
Read file on windows
Read pipe
Resolve function by parsing pe exports
Terminate process
Write and execute a file
Write file on windows
Write pipe

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4be460
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x41e4
call fcn.004a2e90
mov eax, dword [0x4fc504]
xor eax, esp
mov dword [esp + 0x41e0], eax
push ebx
push esi
push edi
mov eax, dword [0x4fc504]
xor eax, esp
push eax
lea eax, [esp + 0x41f8]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
xor ecx, ecx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x1c], ecx
mov eax, dword [ebx + 0x30]
cmp eax, 2
jne 0x47cab4
lea eax, [esp + 0x15c]
push eax
lea ecx, [ebx + 0x18]
call fcn.0042e93d
and dword [esp + 0x4200], 0
cmp dword [eax + 0x14], 0x10
jb 0x47ca92
mov eax, dword [eax]
push eax
push ebx
mov ecx, edi
call fcn.0047d692
push 0
push 1
lea ecx, [esp + 0x164]
call fcn.0040177c
mov eax, dword [esp + 0x1c]
jmp 0x47d5c1
cmp eax, 4
jne 0x47cacb
cmp dword [ebx + 0x14], 0x10
jb 0x47cac1
mov ebx, dword [ebx]
push ebx
mov ecx, edi
call fcn.0047c149
jmp 0x47caab
push 5
pop edx
cmp eax, edx
jne 0x47cae4
cmp dword [ebx + 0x14], 0x10
jb 0x47cada
mov ebx, dword [ebx]
push ebx
mov ecx, edi
call fcn.0047c096
jmp 0x47caab
cmp eax, 6
jne 0x47cbf6
cmp dword [ebx + 0x14], 0x10
jb 0x47caf7
mov eax, dword [ebx]
jmp 0x47caf9
mov eax, ebx
mov dl, byte [eax]
test dl, dl
je 0x47caab
mov dword [esp + 0x14], ecx
cmp dl, 0x77
jne 0x47cb0f
xor ecx, ecx
inc ecx
mov dword [esp + 0x14], ecx
cmp byte [eax + 1], 0x63
jne 0x47cb1c
or ecx, 2
mov dword [esp + 0x14], ecx
cmp byte [eax + 2], 0x64
jne 0x47cb29
or ecx, 8
mov dword [esp + 0x14], ecx
cmp byte [eax + 3], 0x62
jne 0x47cb36
or ecx, 0x10
mov dword [esp + 0x14], ecx
lea esi, [eax + 5]
push esi
mov dword [esp + 0x38], esi
call fcn.004914f0
inc eax
add eax, esi
xor esi, esi
inc esi
mov dword [esp + 0x24], eax
pop ecx
cmp dword [edi + 0x1214], esi
jne 0x47cb5b
or dword [esp + 0x14], 0x20
push 0
push 0
push 0x7d8
push dword [edi + 0x754]
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [esp + 0x34]
lea ecx, [esp + 0x15c]
mov dword [esp + 0x24], eax
call fcn.00430c28
mov dword [esp + 0x4200], esi
cmp dword [eax + 0x14], 8
jb 0x47cb93
mov eax, dword [eax]
add ebx, 0x18
cmp dword [ebx + 0x14], 8
jb 0x47cb9e
mov ebx, dword [ebx]
lea ecx, [esp + 0x24]
push ecx
push dword [esp + 0x24]
mov ecx, edi
push eax
push ebx
mov ebx, dword [esp + 0x24]
push ebx
call fcn.00475068
push 0
push esi
lea ecx, [esp + 0x164]
call fcn.0040f05a
test bl, 0x20
je 0x47caab
cmp byte [edi + 0x928], 0
je 0x47caab
push 0
push dword [esp + 0x28]
push 0x7e9
push dword [edi + 0x754]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x47caab
push ecx
push ecx
push 0x859
push dword [edi + 0x754]
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, eax
mov dword [esp + 0x24], esi
cmp esi, 0xfde9
je 0x47cc2a
mov ecx, dword [edi + 0x64c]
mov edx, esi
call fcn.0047c845
mov esi, eax
mov dword [esp + 0x24], eax
mov eax, dword [edi]
mov ecx, edi
and dword [esp + 0x5c], 0
and dword [esp + 0x60], 0
push 0xffffffffffffffff
push 0x4ea00c
mov dword [esp + 0x60], 0xc
call dword [eax + 0xe4]
sub esp, 0x18
mov edx, ebx
mov ecx, esp
call fcn.00430ca8
push esi
mov ecx, edi
call fcn.0047c8b3
mov eax, dword [edi]
mov ecx, edi
push 0xffffffffffffffff
push 0x4d34b8
call dword [eax + 0xe4]
and dword [esp + 0x5c], 0
xor eax, eax
inc eax
push eax
mov dword [esp + 0x64], eax
lea eax, [esp + 0xb4]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push 0
push 1
lea eax, [esp + 0xbc]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov esi, dword [sym.imp.KERNEL32.dll_CreatePipe]
lea eax, [esp + 0xb0]
mov dword [esp + 0x5c], eax
xor eax, eax
push eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x30], eax
lea eax, [esp + 0x5c]
push eax
lea eax, [esp + 0x44]
mov dword [esp + 0x60], 0xc
push eax
lea eax, [esp + 0x38]
push eax
call esi
xor ecx, ecx
lea eax, [edi + 0x1218]
push ecx
mov dword [eax], ecx
mov dword [edi + 0x121c], ecx
mov dword [esp + 0x3c], ecx
lea ecx, [esp + 0x5c]
push ecx
push eax
lea eax, [esp + 0x44]
push eax
call esi
mov esi, dword [sym.imp.KERNEL32.dll_SetHandleInformation]
push 0
push 1
push dword [esp + 0x34]
call esi
push 0
push 1
push dword [edi + 0x1218]
call esi
xor ecx, ecx
mov dword [esp + 0x64], 0x44
mov dword [esp + 0x68], ecx
mov dword [esp + 0x6c], ecx
mov dword [esp + 0x70], ecx
mov dword [esp + 0x74], ecx
mov dword [esp + 0x78], ecx
mov dword [esp + 0x7c], ecx
mov dword [esp + 0x80], ecx
mov dword [esp + 0x84], ecx
mov dword [esp + 0x88], ecx
xor eax, eax
mov dword [esp + 0x8c], ecx
mov word [esp + 0x96], ax
mov dword [esp + 0x98], ecx
mov dword [esp + 0x90], 0x101
cmp dword [ebx + 0x30], ecx
je 0x47cd76
push 5
pop eax
mov word [esp + 0x94], ax
lea ecx, [ebx + 0x18]
mov eax, dword [esp + 0x38]
mov dword [esp + 0x9c], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa4], eax
lea eax, [esp + 0x174]
push eax
call fcn.0042ed04
xor eax, eax
mov dword [esp + 0x4200], 2
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
cmp dword [esp + 0x184], eax
jbe 0x47cded
cmp dword [esp + 0x188], 8
jb 0x47cde4
mov esi, dword [esp + 0x174]
jmp 0x47cdef
lea esi, [esp + 0x174]
jmp 0x47cdef
mov esi, eax
mov edx, ebx
lea ecx, [esp + 0x15c]
call fcn.00430ca8
cmp dword [eax + 0x14], 8
jb 0x47ce05
mov eax, dword [eax]
lea ecx, [esp + 0x40]
push ecx
lea ecx, [esp + 0x68]
push ecx
push esi
xor ecx, ecx
xor esi, esi
push ecx
push 0x200
inc esi
push esi
push ecx
push ecx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
lea ecx, [esp + 0x15c]
push 0
push esi
setne byte [esp + 0x1b]
call fcn.0040f05a
cmp byte [esp + 0x13], 0
jne 0x47cf80
cmp dword [ebx + 0x30], 0
jne 0x47cf3c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x47cf3c
push str.cmd.exe__c
lea ecx, [esp + 0x1c0]
call fcn.004016ae
push 0xffffffffffffffff
push 0
push ebx
lea ecx, [esp + 0x1c8]
mov byte [esp + 0x420c], 3
call fcn.00401d1b
lea ecx, [esp + 0x1bc]
cmp ecx, eax
je 0x47ce9f
push 0xffffffffffffffff
push 0
push eax
call fcn.004016e7
cmp dword [esp + 0x184], 0
jbe 0x47cec7
cmp dword [esp + 0x188], 8
mov eax, dword [esp + 0x174]
jae 0x47cec1
lea eax, [esp + 0x174]
mov dword [esp + 0x20], eax
jmp 0x47cecc
and dword [esp + 0x20], 0
lea edx, [esp + 0x1bc]
lea ecx, [esp + 0x15c]
call fcn.00430ca8
cmp dword [eax + 0x14], 8
jb 0x47cee7
mov eax, dword [eax]
lea ecx, [esp + 0x40]
push ecx
lea ecx, [esp + 0x68]
push ecx
push dword [esp + 0x28]
xor ecx, ecx
push ecx
push 0x200
push esi
push ecx
push ecx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
lea ecx, [esp + 0x15c]
push 0
push esi
setne byte [esp + 0x1b]
call fcn.0040f05a
push 0
push esi
lea ecx, [esp + 0x1c4]
mov byte [esp + 0x4208], 2
call fcn.0040177c
cmp byte [esp + 0x13], 0
jne 0x47cf80
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [edi]
mov ecx, edi
push 0xffffffffffffffff
push 0x4ea00c
mov esi, eax
call dword [edx + 0xe4]
sub esp, 0x18
mov edx, esi
mov ecx, esp
call fcn.0047af85
push dword [esp + 0x3c]
mov ecx, edi
call fcn.0047c8b3
mov eax, dword [edi]
mov ecx, edi
push 6
call dword [eax + 0x54]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x47d586
mov eax, dword [esp + 0x48]
and dword [esp + 0x19c], 0
mov dword [edi + 0x121c], eax
mov byte [esp + 0x1b], 0
mov dword [esp + 0x1a0], 0xf
mov byte [esp + 0x18c], 0
xor ecx, ecx
mov byte [esp + 0x4200], 4
test byte [ebx + 0x4c], 2
mov dword [esp + 0x28], ecx
je 0x47d0cd
mov ecx, dword [ebx + 0x44]
mov dword [esp + 0x28], ecx
test ecx, ecx
je 0x47d0cd
test byte [ebx + 0x4c], 4
jne 0x47d0cd
lea eax, [ebx + 0x34]
push eax
lea ecx, [esp + 0x1a8]
call fcn.0040ff2a
push 5
pop eax
push 0x4ed42c
lea ecx, [esp + 0x160]
mov byte [esp + 0x4204], al
call fcn.004016ae
push 0x4d34b8
lea ecx, [esp + 0x1d8]
mov byte [esp + 0x4204], 6
call fcn.004016ae
lea eax, [esp + 0x15c]
mov byte [esp + 0x4200], 7
push eax
lea edx, [esp + 0x1d8]
lea ecx, [esp + 0x1a8]
call fcn.00487eb5
pop ecx
push 0
push esi
lea ecx, [esp + 0x1dc]
call fcn.0040177c
push 5
pop eax
push 0
push esi
lea ecx, [esp + 0x164]
mov byte [esp + 0x4208], al
call fcn.0040177c
mov eax, dword [edi]
mov ecx, edi
push 0xffffffffffffffff
push 0x4ed434
call dword [eax + 0xe4]
cmp dword [esp + 0x1b8], 0x10
mov ecx, dword [esp + 0x1a4]
jae 0x47d094
lea ecx, [esp + 0x1a4]
mov eax, dword [edi]
push 0xffffffffffffffff
push ecx
mov ecx, edi
call dword [eax + 0xe4]
mov eax, dword [edi]
mov ecx, edi
push 0xffffffffffffffff
push 0x4d34b8
call dword [eax + 0xe4]
push 0
push esi
lea ecx, [esp + 0x1ac]
mov byte [esp + 0x4208], 4
call fcn.0040177c
mov ecx, dword [esp + 0x28]
mov al, byte [esp + 0x13]
xor esi, esi
xor edx, edx
mov dword [esp + 0x14], esi
mov dword [esp + 0x20], edx
jmp 0x47d358
cmp esi, ecx
jb 0x47d105
cmp edx, 0xa
jle 0x47d0ef
push 0x64
jmp 0x47d0f6
cmp edx, 2
jle 0x47d100
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [esp + 0x20]
inc edx
mov dword [esp + 0x20], edx
xor eax, eax
push eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x28], eax
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x38]
push eax
push 0x4000
lea eax, [esp + 0x1fc]
push eax
push dword [esp + 0x40]
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
neg eax
sbb eax, eax
and eax, dword [esp + 0x24]
mov dword [esp + 0x24], eax
cmp eax, 0x3e8
jae 0x47d240
cmp dword [edi + 0x1218], 0xffffffff
je 0x47d240
cmp esi, dword [esp + 0x28]
jae 0x47d240
push 0x4d34b8
call fcn.004914f0
pop ecx
push eax
push esi
lea ecx, [ebx + 0x34]
push 0x4d34b8
mov dword [esp + 0x5c], ecx
call fcn.004027cc
mov ecx, dword [esp + 0x14]
mov esi, eax
cmp esi, 0xffffffff
jne 0x47d190
mov esi, dword [esp + 0x28]
sub esi, ecx
jmp 0x47d193
sub esi, ecx
inc esi
mov eax, 0xfa
cmp esi, eax
jbe 0x47d19e
mov esi, eax
mov eax, dword [esp + 0x50]
and dword [esp + 0x34], 0
cmp dword [eax + 0x14], 0x10
jb 0x47d1af
mov eax, dword [eax]
push 0
lea edx, [esp + 0x38]
add eax, ecx
push edx
push esi
push eax
push dword [edi + 0x1218]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x47d215
mov ecx, dword [esp + 0x14]
mov edx, 0xfffffc00
add ecx, esi
mov esi, dword [esp + 0x14]
mov eax, esi
and ecx, edx
and eax, edx
cmp ecx, eax
jbe 0x47d1eb
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
add esi, dword [esp + 0x34]
mov dword [esp + 0x14], esi
cmp esi, dword [esp + 0x28]
jb 0x47d2fe
push dword [edi + 0x1218]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [edi + 0x1218], 0xffffffff
jmp 0x47d2fe
lea esi, [edi + 0x1218]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [edi]
mov ecx, edi
or dword [esi], 0xffffffff
push 0xffffffffffffffff
push str._n_Input_pipe_closed_due_to_write_failure._n
call dword [eax + 0xe4]
mov esi, dword [esp + 0x14]
jmp 0x47d2fe
test eax, eax
je 0x47d2da
push 0
lea eax, [esp + 0x34]
push eax
push 0x4000
lea eax, [esp + 0x1f8]
push eax
push dword [esp + 0x3c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x47d2d3
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x47d2d3
test byte [ebx + 0x4c], 0x30
je 0x47d291
push ecx
lea eax, [esp + 0x1f0]
push eax
lea ecx, [esp + 0x194]
call fcn.00401dc0
mov ecx, dword [esp + 0x30]
test byte [ebx + 0x4c], 4
jne 0x47d2c5
cmp byte [edi + 0x1210], 0
jne 0x47d2b2
mov ecx, edi
call fcn.0046070a
mov ecx, dword [esp + 0x30]
mov byte [edi + 0x1210], 1
mov eax, dword [edi]
push ecx
lea ecx, [esp + 0x1f0]
push ecx
mov ecx, edi
call dword [eax + 0xe4]
push dword [edi + 0x73c]
call dword [sym.imp.USER32.dll_UpdateWindow]
jmp 0x47d2fe
mov byte [esp + 0x13], 0
jmp 0x47d2fe
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x44]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x47d2fe
cmp dword [esp + 0x1c], 0x103
setne al
dec al
and byte [esp + 0x13], al
push 0
lea ecx, [edi + 0x92c]
call fcn.0047aed8
test eax, eax
je 0x47d34c
push 0x1f4
push dword [esp + 0x44]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x47d33f
mov eax, dword [edi]
mov ecx, edi
push 0xffffffffffffffff
push str._n_Process_failed_to_respond__forcing_abrupt_termination..._n
call dword [eax + 0xe4]
push 1
push dword [esp + 0x44]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor al, al
mov byte [esp + 0x1b], 1
mov byte [esp + 0x13], al
jmp 0x47d350
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x20]
test al, al
jne 0x47d0e2
push 0x3e8
push dword [esp + 0x44]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x47d390
mov eax, dword [edi]
mov ecx, edi
push 0xffffffffffffffff
push str._n_Process_failed_to_respond__forcing_abrupt_termination...
call dword [eax + 0xe4]
push 2
push dword [esp + 0x44]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x44]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push ecx
push ecx
lea ecx, [esp + 0xcc]
call fcn.0042c0ac
mov byte [esp + 0x4200], 8
mov edx, str._Exit_code:
push dword [esp + 0x1c]
push ecx
lea ecx, [esp + 0xcc]
call fcn.0042dd20
pop ecx
mov ecx, eax
call fcn.0042bfbd
mov esi, dword [edi + 0x92c]
mov ecx, esi
mov eax, dword [esi]
call dword [eax]
mov eax, dword [esi]
mov ecx, esi
mov bl, byte [edi + 0x9e0]
call dword [eax + 4]
test bl, bl
je 0x47d450
mov edx, str.____Time:
lea ecx, [esp + 0xc4]
call fcn.0042dd20
push 0
lea eax, [esp + 0x1a8]
push 4
push eax
call fcn.004b68f1
mov ecx, dword [esp + 0xd0]
add esp, 0xc
mov ecx, dword [ecx + 4]
push dword [eax + 0xc]
push dword [eax + 8]
lea ecx, [esp + ecx + 0xcc]
push ecx
call dword [eax]
add esp, 0xc
lea ecx, [edi + 0x11ec]
push 0
call fcn.00431059
push ecx
push ecx
lea ecx, [esp + 0xcc]
fstp qword [esp]
call fcn.00480080
mov edx, 0x4d34b8
lea ecx, [esp + 0xc4]
call fcn.0042dd20
lea eax, [esp + 0x1d4]
push eax
lea ecx, [esp + 0xc8]
call fcn.0042c176
mov ecx, eax
mov byte [esp + 0x4200], 9
cmp dword [ecx + 0x14], 0x10
jb 0x47d487
mov ecx, dword [ecx]
mov eax, dword [edi]
push 0xffffffffffffffff
push ecx
mov ecx, edi
call dword [eax + 0xe4]
push 0
push 1
lea ecx, [esp + 0x1dc]
mov byte [esp + 0x4208], 8
call fcn.0040177c
push dword [esp + 0x40]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
push dword [esp + 0x44]
call ebx
cmp byte [esp + 0x1b], 0
jne 0x47d540
mov eax, dword [esp + 0x54]
test byte [eax + 0x4c], 0x10
jne 0x47d4e1
test byte [eax + 0x4c], 0x20
je 0x47d540
cmp dword [esp + 0x1c], 0
sete al
test al, al
je 0x47d540
push 0
push 0
push 0x85f
push dword [edi + 0x744]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [esp + 0x1a0], 0x10
mov esi, eax
mov ecx, dword [esp + 0x18c]
jae 0x47d510
lea ecx, [esp + 0x18c]
push ecx
push 0
push 0x87a
push dword [edi + 0x744]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esp + 0x19c]
add eax, esi
push eax
push esi
push 0x870
push dword [edi + 0x744]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [edi]
mov ecx, edi
push 5
call dword [eax + 0x54]
lea ecx, [esp + 0x114]
mov byte [esp + 0x4200], 4
call fcn.0042c133
lea eax, [esp + 0x114]
mov dword [esp + method.std::basic_ios_char__struct_std::char_traits_char__.virtual_0], vtable.std::ios_base.0
push eax
call fcn.004b6556
pop ecx
push 0
push 1
lea ecx, [esp + 0x194]
call fcn.0040177c
push dword [esp + 0x2c]
call ebx
push dword [esp + 0x3c]
call ebx
push dword [esp + 0x38]
call ebx
lea esi, [edi + 0x1218]
push dword [esi]
call ebx
xor eax, eax
lea ecx, [esp + 0x174]
push eax
mov dword [esi], eax
mov esi, dword [esp + 0x20]
push 1
mov dword [edi + 0x121c], eax
call fcn.0040f05a
mov eax, esi
mov ecx, dword [esp + 0x41f8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x41e0]
xor ecx, esp
call fcn.004906a0
mov esp, ebp
pop ebp
ret 4