Function at 0x4018d0
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Read file on windows
Read pipe

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x403947
mov eax, dword fs:[0]
push eax
sub esp, 0x488
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x48c], edi
mov dword [ebp - 0x484], edi
mov dword [ebp - 0x494], edi
xorps xmm0, xmm0
mov dword [ebp - 0x488], 1
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
push 0
lea eax, [ebp - 0x42c]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x420]
movq qword [ebp - 0x428], xmm0
push eax
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x488], 1
push eax
mov dword [ebp - 0x42c], 0xc
mov dword [ebp - 0x424], 1
mov dword [ebp - 0x428], 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x401bbf
push 0x40
lea eax, [ebp - 0x47c]
mov dword [ebp - 0x480], 0x44
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov eax, dword [ebp - 0x420]
add esp, 0xc
mov dword [ebp - 0x444], eax
xorps xmm0, xmm0
mov dword [ebp - 0x440], eax
xor eax, eax
mov word [ebp - 0x450], ax
lea eax, [ebp - 0x43c]
push eax
lea eax, [ebp - 0x480]
mov dword [ebp - 0x454], 0x101
push eax
push 0
push 0
push 0x10
push 1
push 0
push 0
push esi
push 0
movups xmmword [ebp - 0x43c], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x401a2a
push dword [ebp - 0x420]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x41c]
jmp 0x401bbd
mov esi, dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
push 0x19
push dword [ebp - 0x43c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
mov dword [ebp - 0x484], eax
lea eax, [ebp - 0x414]
push eax
push 0
push 0
push 0
push dword [ebp - 0x41c]
mov dword [ebp - 0x418], 0
mov dword [ebp - 0x414], 0
call esi
test eax, eax
je 0x401b8c
nop word [eax + eax]
mov eax, dword [ebp - 0x414]
test eax, eax
je 0x401b8c
push 0
lea ecx, [ebp - 0x418]
cmp eax, 0x3ff
push ecx
mov ecx, 0x3ff
cmova eax, ecx
push eax
lea eax, [ebp - 0x410]
push eax
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x401b8c
mov eax, dword [ebp - 0x418]
test eax, eax
je 0x401b8c
cmp eax, 0x400
jae 0x401bdc
lea esi, [ebp - 0x410]
mov byte [ebp + eax - 0x410], 0
lea ecx, [esi + 1]
nop word [eax + eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x401af0
mov edx, dword [edi + 0x14]
sub esi, ecx
mov ecx, dword [edi + 0x10]
mov eax, edx
sub eax, ecx
cmp esi, eax
ja 0x401b36
lea eax, [ecx + esi]
mov dword [edi + 0x10], eax
mov eax, edi
cmp edx, 0xf
jbe 0x401b16
mov eax, dword [edi]
lea edi, [eax + ecx]
push esi
lea eax, [ebp - 0x410]
push eax
push edi
call sub.VCRUNTIME140.dll_memmove
mov byte [edi + esi], 0
add esp, 0xc
mov edi, dword [ebp - 0x48c]
jmp 0x401b53
push esi
lea eax, [ebp - 0x410]
mov byte [ebp - 0x490], 0
push eax
push dword [ebp - 0x490]
mov ecx, edi
push esi
call fcn.00402820
lea eax, [ebp - 0x410]
push eax
push str.____s
call fcn.00401850
mov esi, dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
lea eax, [ebp - 0x414]
add esp, 8
push 0
push eax
push 0
push 0
push 0
push dword [ebp - 0x41c]
call esi
test eax, eax
jne 0x401a80
cmp dword [ebp - 0x484], 0
jne 0x401a30
push dword [ebp - 0x420]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x41c]
call esi
push dword [ebp - 0x43c]
call esi
push dword [ebp - 0x438]
call esi
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00402a3a
mov esp, ebp
pop ebp
ret
call fcn.00402b6a
int3