Function at 0x428e40
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f90d4
mov eax, dword fs:[0]
push eax
sub esp, 0xce4
mov eax, dword [0x78ca90]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xc60], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0xc24], 0
mov dword [ebp - 0xc14], 0
mov dword [ebp - 0xc3c], 0xc
mov dword [ebp - 0xc38], 0
mov dword [ebp - 0xc34], 1
mov dword [ebp - 0xc3c], 0xc
mov dword [ebp - 0xc38], 0
mov dword [ebp - 0xc34], 1
push 0
lea eax, [ebp - 0xc3c]
push eax
lea ecx, [ebp - 0xc24]
push ecx
lea edx, [ebp - 0xc14]
push edx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x428f54
mov eax, dword [ebp - 0xc60]
mov dword [ebp - 0xc84], eax
mov ecx, dword [ebp - 0xc84]
mov dword [ebp - 0xc20], ecx
cmp dword [ebp - 0xc20], 0
je 0x428f27
push 1
mov edx, dword [ebp - 0xc20]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xc20]
mov edx, dword [eax + 4]
call edx
mov dword [ebp - 0xc9c], eax
jmp 0x428f31
mov dword [ebp - 0xc9c], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
sub eax, 0x10
mov dword [ebp - 0xc90], eax
mov ecx, dword [ebp - 0xc90]
call fcn.004312e0
jmp 0x42932a
push 0
push 1
mov ecx, dword [ebp - 0xc14]
push ecx
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
push 0x44
push 0
lea edx, [ebp - 0xcf0]
push edx
call fcn.005cfab0
add esp, 0xc
mov dword [ebp - 0xcf0], 0x44
xor eax, eax
mov dword [ebp - 0xcac], eax
mov dword [ebp - 0xca8], eax
mov dword [ebp - 0xca4], eax
mov dword [ebp - 0xca0], eax
mov dword [ebp - 0xcc4], 0x101
mov dword [ebp - 0xcb8], 0
mov ecx, dword [ebp - 0xc24]
mov dword [ebp - 0xcb4], ecx
mov dword [ebp - 0xcb0], 0
cmp dword [ebp + 0x10], 0
je 0x428fd8
mov dword [ebp - 0xc28], 5
jmp 0x428fe2
mov dword [ebp - 0xc28], 0
mov dx, word [ebp - 0xc28]
mov word [ebp - 0xcc0], dx
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc48], eax
lea ecx, [ebp - 0xcac]
push ecx
lea edx, [ebp - 0xcf0]
push edx
push 0
push 0
push 0x20
push 1
push 0
push 0
mov eax, dword [ebp - 0xc48]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x429049
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 8]
sub ecx, 0x10
mov dword [ebp - 0xc78], ecx
mov ecx, dword [ebp - 0xc78]
call fcn.004312e0
jmp 0x42932a
mov edx, dword [ebp - 0xc24]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc50], eax
mov dword [ebp - 0xc1c], 0
cmp dword [ebp - 0xc50], 0
je 0x4291ac
mov byte [ebp - 0x410], 0
push 0x3ff
push 0
lea ecx, [ebp - 0x40f]
push ecx
call fcn.005cfab0
add esp, 0xc
push 0
lea edx, [ebp - 0xc18]
push edx
push 0x3ff
lea eax, [ebp - 0x410]
push eax
mov ecx, dword [ebp - 0xc14]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0xc1c], eax
cmp dword [ebp - 0xc1c], 0
je 0x4290cd
cmp dword [ebp - 0xc18], 0
jne 0x4290d2
jmp 0x4291a7
mov edx, dword [ebp - 0xc18]
mov dword [ebp - 0xc30], edx
cmp dword [ebp - 0xc30], 0x400
jae 0x4290ec
jmp 0x4290f1
call fcn.005cf37a
mov eax, dword [ebp - 0xc30]
mov byte [ebp + eax - 0x410], 0
lea ecx, [ebp - 0x410]
push ecx
lea ecx, [ebp - 0xc88]
call fcn.00426d30
mov dword [ebp - 0xc94], eax
mov edx, dword [ebp - 0xc94]
mov dword [ebp - 0xc58], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0xc58]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0xc98]
push edx
call fcn.004280e0
add esp, 0xc
mov dword [ebp - 0xc80], eax
mov eax, dword [ebp - 0xc80]
mov dword [ebp - 0xc40], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0xc40]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00427ca0
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0xc98]
sub edx, 0x10
mov dword [ebp - 0xc68], edx
mov ecx, dword [ebp - 0xc68]
call fcn.004312e0
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0xc88]
sub eax, 0x10
mov dword [ebp - 0xc70], eax
mov ecx, dword [ebp - 0xc70]
call fcn.004312e0
jmp 0x429093
jmp 0x4292e5
xor ecx, ecx
mov word [ebp - 0xc10], cx
push 0x7fe
push 0
lea edx, [ebp - 0xc0e]
push edx
call fcn.005cfab0
add esp, 0xc
push 0
lea eax, [ebp - 0xc18]
push eax
push 0x3ff
lea ecx, [ebp - 0xc10]
push ecx
mov edx, dword [ebp - 0xc14]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0xc1c], eax
cmp dword [ebp - 0xc1c], 0
je 0x429205
cmp dword [ebp - 0xc18], 0
jne 0x42920a
jmp 0x4292e5
mov eax, dword [ebp - 0xc18]
shr eax, 1
shl eax, 1
mov dword [ebp - 0xc2c], eax
cmp dword [ebp - 0xc2c], 0x800
jae 0x429228
jmp 0x42922d
call fcn.005cf37a
xor ecx, ecx
mov edx, dword [ebp - 0xc2c]
mov word [ebp + edx - 0xc10], cx
lea eax, [ebp - 0xc10]
push eax
lea ecx, [ebp - 0xc6c]
call fcn.00426db0
mov dword [ebp - 0xc8c], eax
mov ecx, dword [ebp - 0xc8c]
mov dword [ebp - 0xc44], ecx
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0xc44]
push edx
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0xc5c]
push ecx
call fcn.004280e0
add esp, 0xc
mov dword [ebp - 0xc4c], eax
mov edx, dword [ebp - 0xc4c]
mov dword [ebp - 0xc54], edx
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0xc54]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00427ca0
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0xc5c]
sub ecx, 0x10
mov dword [ebp - 0xc64], ecx
mov ecx, dword [ebp - 0xc64]
call fcn.004312e0
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0xc6c]
sub edx, 0x10
mov dword [ebp - 0xc74], edx
mov ecx, dword [ebp - 0xc74]
call fcn.004312e0
jmp 0x4291cb
mov eax, dword [ebp - 0xcac]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xca8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0xc14]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
sub eax, 0x10
mov dword [ebp - 0xc7c], eax
mov ecx, dword [ebp - 0xc7c]
call fcn.004312e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005cfbcb
mov esp, ebp
pop ebp
ret 0x10