Function at 0x40e188
Capabilities:
Create process on windows
Create thread
Read file on windows
Read from mailslot
Resume thread
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff60
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
mov ebx, 0x491ae8
mov esi, 0x491ac0
xor eax, eax
push ebp
push 0x40e568
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebx], 0
lea edx, [ebp - 0x10]
mov eax, dword [0x493c94]
call fcn.00405e1c
test al, al
je 0x40e53d
push 0x8000
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_VirtualFree_1
call fcn.0040dd60
call fcn.0040dd80
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push fcn.0040d6f8
push 0
push 0
call sub.kernel32.dll_CreateThread
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.0040aefc
test al, al
je 0x40e53d
call fcn.0040c7b0
cmp byte [ebx], 0
jne 0x40e53d
call fcn.0040ad58
call fcn.0040df34
call fcn.0040c928
cmp byte [ebx], 0
jne 0x40e53d
xor eax, eax
mov dword [0x491ad8], eax
push 1
call fcn.0040abbc
test al, al
je 0x40e53d
push 1
call fcn.0040abbc
cmp byte [ebx], 0
jne 0x40e53d
call fcn.0040d7f4
cmp byte [ebx], 0
jne 0x40e53d
push 0x491abc
push 0
push 0
push 0x40cda0
push 0
push 0
call sub.kernel32.dll_CreateThread
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
mov dword [0x491ae0], eax
xor eax, eax
mov dword [0x491ae4], eax
mov byte [0x491aea], 1
jmp 0x40e504
push 0
push 0
push 0x491ab8
push 0
mov eax, dword [esi]
push eax
call sub.kernel32.dll_GetMailslotInfo
test eax, eax
je 0x40e504
push 0
push 0x491a8c
push 0xd
push 0x491cc0
mov eax, dword [esi]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x40e504
push 0xffffffffffffffff
push 0xffffffffffffffff
lea eax, [ebp - 0x9c]
mov edx, 0x491cc0
mov ecx, 4
call fcn.00403bf4
mov eax, dword [ebp - 0x9c]
call fcn.00404e34
dec eax
mov dword [0x491adc], eax
lea ecx, [ebp - 0xa0]
mov eax, dword [0x491adc]
inc eax
mov dl, 3
call fcn.00404ccc
mov ecx, dword [ebp - 0xa0]
mov eax, 0x491cb8
mov edx, 0x40e580
call fcn.00403c58
mov eax, dword [0x491adc]
cmp eax, dword [0x491ad8]
jle 0x40e357
cmp dword [0x491adc], 0x3e6
jne 0x40e504
movzx eax, byte [0x491cc4]
dec al
je 0x40e377
sub al, 2
je 0x40e4a4
sub al, 0xfc
je 0x40e4c1
jmp 0x40e504
push 0
push 0x80
push 3
push 0
push 1
push 0x40000000
mov eax, dword [ebp - 0xc]
call fcn.00403e0c
push eax
call sub.kernel32.dll_CreateFileA_1
mov edi, eax
cmp edi, 0xffffffff
je 0x40e504
lea eax, [ebp - 0x34]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], 0x10
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov edx, dword [ebp - 0x1c]
call fcn.00402c24
lea eax, [ebp - 0x78]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], 0x44
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov edx, dword [ebp - 0x24]
call fcn.00402c24
mov dword [ebp - 0x78], 0x44
mov dword [ebp - 0x4c], 1
mov byte [0x491cc4], 2
xor eax, eax
mov dword [0x491cc5], eax
lea ecx, [ebp - 0x10]
lea edx, [ebp - 0x98]
lea eax, [ebp - 0x84]
call fcn.00405d54
test al, al
je 0x40e459
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x78]
push eax
push 0
push 0
push 0x20c
push 0
push 0
lea eax, [ebp - 0x84]
push eax
mov eax, dword [ebp - 8]
call fcn.00403e0c
push eax
mov eax, dword [ebp - 4]
call fcn.00403e0c
push eax
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x40e459
mov eax, dword [ebp - 0x2c]
mov dword [0x491cc5], eax
push 0x8000
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_VirtualFree_1
push 0
push 0x491a90
push 0xd
push 0x491cc0
push edi
call sub.kernel32.dll_WriteFile_1
push edi
call sub.kernel32.dll_CloseHandle_1
cmp dword [ebp - 0x30], 0
je 0x40e504
mov eax, 0x64
call fcn.00405044
mov eax, dword [ebp - 0x30]
push eax
call sub.kernel32.dll_ResumeThread
mov eax, dword [ebp - 0x30]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x34]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x40e504
call fcn.0040dda4
cmp eax, dword [0x491cc5]
jne 0x40e504
call fcn.0040b1dc
test al, al
je 0x40e504
call fcn.0040c7b0
jmp 0x40e504
call fcn.0040dda4
cmp eax, dword [0x491cc5]
jne 0x40e504
cmp dword [0x491cc9], 0xff
je 0x40e4ea
cmp dword [0x491cc9], 0xfe
je 0x40e4ea
xor eax, eax
jmp 0x40e4ec
mov al, 1
mov byte [ebx], al
cmp byte [ebx], 0
je 0x40e504
cmp dword [0x491cc9], 0xfe
jne 0x40e504
call fcn.0040d5a0
cmp byte [ebx], 0
je 0x40e2af
mov eax, dword [esi]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [0x491ac4]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [0x491ad4]
push eax
call sub.kernel32.dll_UnmapViewOfFile
mov eax, dword [0x491ac8]
push eax
call sub.kernel32.dll_CloseHandle_1
mov byte [0x491aea], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e56f
lea eax, [ebp - 0xa0]
mov edx, 2
call fcn.00403aac
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00403aac
ret