Function at 0x4d6950
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52e816
mov eax, dword fs:[0]
push eax
mov eax, 0x280c
call fcn.004e2d90
mov eax, dword [0x578704]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
movups xmm0, xmmword [str.wmic_BaseBoard_get_SerialNumber]
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x2794]
push 0xc
movups xmmword [ebp - 0x50], xmm0
push str.SerialNumber
movups xmm0, xmmword [0x5492d8]
mov dword [ebp - 0x2780], 0xf
mov dword [ebp - 0x2784], 0
movups xmmword [ebp - 0x40], xmm0
mov byte [ebp - 0x2794], 0
movups xmm0, xmmword [0x5492e8]
movups xmmword [ebp - 0x30], xmm0
movups xmm0, xmmword [0x5492f8]
movups xmmword [ebp - 0x20], xmm0
call fcn.0040c552
push 0x2711
lea eax, [ebp - 0x2764]
mov dword [ebp - 4], 0
push 0
push eax
mov dword [ebp - 0x27b4], 0
mov dword [ebp - 0x27b0], 0
call fcn.004fb430
mov dword [ebp - 0x2768], 0xf
mov dword [ebp - 0x276c], 0
mov byte [ebp - 0x277c], 0
push 0x44
lea eax, [ebp - 0x2818]
mov byte [ebp - 4], 1
xorps xmm0, xmm0
mov dword [ebp - 0x27b8], 0
push 0
push eax
movups xmmword [ebp - 0x27d4], xmm0
call fcn.004fb430
add esp, 0x18
mov dword [ebp - 0x27bc], 0
lea eax, [ebp - 0x27c4]
mov dword [ebp - 0x27d4], 0
xorps xmm0, xmm0
mov dword [ebp - 0x27d0], 0
movq qword [ebp - 0x27c4], xmm0
push 0
push eax
lea eax, [ebp - 0x27b0]
mov dword [ebp - 0x2818], 0x44
push eax
lea eax, [ebp - 0x27b4]
mov dword [ebp - 0x27c4], 0xc
push eax
mov dword [ebp - 0x27c0], 0
mov dword [ebp - 0x27bc], 1
call dword [sym.imp.KERNEL32.DLL_CreatePipe]
mov edi, eax
test edi, edi
je 0x4d6c70
lea eax, [ebp - 0x2818]
push eax
call dword [sym.imp.KERNEL32.DLL_GetStartupInfoW]
mov eax, dword [ebp - 0x27b0]
mov dword [ebp - 0x27d8], eax
mov dword [ebp - 0x27dc], eax
xor eax, eax
mov word [ebp - 0x27e8], ax
lea eax, [ebp - 0x27d4]
push eax
lea eax, [ebp - 0x2818]
mov dword [ebp - 0x27ec], 0x101
push eax
push 0
push 0
push 0
push 1
push 0
push 0
lea eax, [ebp - 0x50]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
mov edi, eax
test edi, edi
je 0x4d6c70
push 0x1f4
push dword [ebp - 0x27d4]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push 0
lea eax, [ebp - 0x27b8]
push eax
push 0x2710
lea eax, [ebp - 0x2764]
push eax
push dword [ebp - 0x27b4]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov edi, eax
test edi, edi
je 0x4d6c70
xor edi, edi
cmp byte [ebp - 0x2764], 0
jne 0x4d6b76
xor ecx, ecx
jmp 0x4d6b89
lea ecx, [ebp - 0x2764]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4d6b80
sub ecx, edx
push ecx
lea eax, [ebp - 0x2764]
push eax
lea ecx, [ebp - 0x277c]
call fcn.0040c552
push dword [ebp - 0x2784]
cmp dword [ebp - 0x2780], 0x10
lea eax, [ebp - 0x2794]
push 0
cmovae eax, dword [ebp - 0x2794]
lea ecx, [ebp - 0x277c]
push eax
call fcn.0040c0b4
test eax, eax
js 0x4d6c70
add eax, dword [ebp - 0x2784]
lea ecx, [ebp - 0x277c]
push 0xffffffffffffffff
push eax
lea eax, [ebp - 0x27ac]
push eax
call fcn.00409a0f
push eax
lea ecx, [ebp - 0x277c]
call fcn.00409bd9
lea ecx, [ebp - 0x27ac]
call fcn.00409bcf
push 0x2711
lea eax, [ebp - 0x2764]
push 0
push eax
call fcn.004fb430
cmp dword [ebp - 0x2768], 0x10
lea eax, [ebp - 0x277c]
cmovae eax, dword [ebp - 0x277c]
push eax
lea eax, [ebp - 0x2764]
push 0x2711
push eax
call fcn.0050a264
lea ecx, [ebp - 0x2764]
add esp, 0x18
xor edx, edx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4d6c45
sub ecx, edi
je 0x4d6c6b
mov al, byte [ebp + edx - 0x2764]
cmp al, 0x20
je 0x4d6c66
cmp al, 0xa
je 0x4d6c66
cmp al, 0xd
je 0x4d6c66
mov byte [esi], al
inc esi
inc edx
cmp edx, ecx
jb 0x4d6c50
mov edi, 1
push dword [ebp - 0x27b0]
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
call esi
push dword [ebp - 0x27b4]
call esi
push dword [ebp - 0x27d4]
call esi
push dword [ebp - 0x27d0]
call esi
mov eax, dword [ebp - 0x2768]
cmp eax, 0x10
jb 0x4d6cb4
inc eax
lea ecx, [ebp - 0x277c]
push eax
push dword [ebp - 0x277c]
call fcn.0040d750
mov eax, dword [ebp - 0x2780]
mov dword [ebp - 0x2768], 0xf
mov dword [ebp - 0x276c], 0
mov byte [ebp - 0x277c], 0
cmp eax, 0x10
jb 0x4d6ced
inc eax
lea ecx, [ebp - 0x2794]
push eax
push dword [ebp - 0x2794]
call fcn.0040d750
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e1d28
mov esp, ebp
pop ebp
ret