Function at 0x40dbb4
Capabilities:
Create process on windows
Create thread
Read file on windows
Read from mailslot
Resume thread
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff60
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
mov ebx, 0x490ae8
mov esi, 0x490ac0
xor eax, eax
push ebp
push 0x40dfcd
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebx], 0
lea edx, [ebp - 0x10]
mov eax, dword [0x492c94]
call fcn.00405d78
test al, al
je 0x40dfa2
push 0x8000
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_VirtualFree_1
call fcn.0040d78c
call fcn.0040d7ac
call fcn.0040ae58
test al, al
je 0x40dfa2
call fcn.0040c70c
cmp byte [ebx], 0
jne 0x40dfa2
call fcn.0040acb4
call fcn.0040d960
call fcn.0040c884
cmp byte [ebx], 0
jne 0x40dfa2
xor eax, eax
mov dword [0x490ad8], eax
push 1
call fcn.0040ab18
test al, al
je 0x40dfa2
push 1
call fcn.0040ab18
cmp byte [ebx], 0
jne 0x40dfa2
cmp byte [ebx], 0
jne 0x40dfa2
push 0x490abc
push 0
push 0
push 0x40ccfc
push 0
push 0
call sub.kernel32.dll_CreateThread
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
mov dword [0x490ae0], eax
xor eax, eax
mov dword [0x490ae4], eax
mov byte [0x490aea], 1
jmp 0x40df69
push 0
push 0
push 0x490ab8
push 0
mov eax, dword [esi]
push eax
call sub.kernel32.dll_GetMailslotInfo
test eax, eax
je 0x40df69
push 0
push 0x490a8c
push 0xd
push 0x490cc0
mov eax, dword [esi]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x40df69
push 0xffffffffffffffff
push 0xffffffffffffffff
lea eax, [ebp - 0x98]
mov edx, 0x490cc0
mov ecx, 4
call fcn.00403bd8
mov eax, dword [ebp - 0x98]
call fcn.00404df0
dec eax
mov dword [0x490adc], eax
lea ecx, [ebp - 0x9c]
mov eax, dword [0x490adc]
inc eax
mov dl, 3
call fcn.00404c88
mov ecx, dword [ebp - 0x9c]
mov eax, 0x490cb8
mov edx, 0x40dfe4
call fcn.00403c3c
mov eax, dword [0x490adc]
cmp eax, dword [0x490ad8]
jle 0x40dd68
cmp dword [0x490adc], 0x3e6
jne 0x40df69
movzx eax, byte [0x490cc4]
dec al
je 0x40dd88
sub al, 2
je 0x40df09
sub al, 0xfc
je 0x40df26
jmp 0x40df69
lea edx, [ebp - 4]
xor eax, eax
call fcn.004027c0
lea eax, [ebp - 0xa0]
mov edx, 0x490cc5
call fcn.00403b9c
mov ecx, dword [ebp - 0xa0]
lea eax, [ebp - 0xc]
mov edx, 0x40e004
call fcn.00403c3c
push 0x40e024
push dword [ebp - 4]
push 0x40e030
push dword [ebp - 0xc]
push 0x40e044
push dword [0x492c78]
push 0x40e024
lea eax, [ebp - 8]
mov edx, 7
call fcn.00403cb0
push 0
push 0x80
push 3
push 0
push 1
push 0x40000000
mov eax, dword [ebp - 0xc]
call fcn.00403df0
push eax
call sub.kernel32.dll_CreateFileA_1
mov edi, eax
cmp edi, 0xffffffff
je 0x40df69
lea eax, [ebp - 0x30]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov edx, dword [ebp - 0x18]
call fcn.00402c08
lea eax, [ebp - 0x74]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], 0x44
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov edx, dword [ebp - 0x20]
call fcn.00402c08
mov dword [ebp - 0x74], 0x44
mov dword [ebp - 0x48], 1
mov byte [0x490cc4], 2
xor eax, eax
mov dword [0x490cc5], eax
lea ecx, [ebp - 0x10]
lea edx, [ebp - 0x94]
lea eax, [ebp - 0x80]
call fcn.00405cb0
test al, al
je 0x40debe
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x74]
push eax
push 0
push 0
push 0x20c
push 0
push 0
lea eax, [ebp - 0x80]
push eax
mov eax, dword [ebp - 8]
call fcn.00403df0
push eax
mov eax, dword [ebp - 4]
call fcn.00403df0
push eax
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x40debe
mov eax, dword [ebp - 0x28]
mov dword [0x490cc5], eax
push 0x8000
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_VirtualFree_1
push 0
push 0x490a90
push 0xd
push 0x490cc0
push edi
call sub.kernel32.dll_WriteFile_1
push edi
call sub.kernel32.dll_CloseHandle_1
cmp dword [ebp - 0x2c], 0
je 0x40df69
mov eax, 0x64
call fcn.00405000
mov eax, dword [ebp - 0x2c]
push eax
call sub.kernel32.dll_ResumeThread
mov eax, dword [ebp - 0x2c]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x30]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x40df69
call fcn.0040d7d0
cmp eax, dword [0x490cc5]
jne 0x40df69
call fcn.0040b138
test al, al
je 0x40df69
call fcn.0040c70c
jmp 0x40df69
call fcn.0040d7d0
cmp eax, dword [0x490cc5]
jne 0x40df69
cmp dword [0x490cc9], 0xff
je 0x40df4f
cmp dword [0x490cc9], 0xfe
je 0x40df4f
xor eax, eax
jmp 0x40df51
mov al, 1
mov byte [ebx], al
cmp byte [ebx], 0
je 0x40df69
cmp dword [0x490cc9], 0xfe
jne 0x40df69
call fcn.0040d454
cmp byte [ebx], 0
je 0x40dcc0
mov eax, dword [esi]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [0x490ac4]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [0x490ad4]
push eax
call sub.kernel32.dll_UnmapViewOfFile
mov eax, dword [0x490ac8]
push eax
call sub.kernel32.dll_CloseHandle_1
mov byte [0x490aea], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40dfd4
lea eax, [ebp - 0xa0]
mov edx, 3
call fcn.00403a90
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00403a90
ret