Function at 0x40f8d0
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create two anonymous pipes
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x498
mov dword [ebp - 4], 1
mov dword [ebp - 8], 0
mov dword [ebp - 0x34], 0xc
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 1
push 0
lea eax, [ebp - 0x34]
push eax
imul ecx, dword [ebp + 8], 0x24
add ecx, 0x478b18
push ecx
imul edx, dword [ebp + 8], 0x24
add edx, 0x478b14
push edx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40f938
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
jmp 0x40fbe4
push 0
lea eax, [ebp - 0x34]
push eax
imul ecx, dword [ebp + 8], 0x24
add ecx, 0x478b20
push ecx
imul edx, dword [ebp + 8], 0x24
add edx, 0x478b1c
push edx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40f974
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
jmp 0x40fbe4
push 0x44
push 0
lea eax, [ebp - 0x88]
push eax
call fcn.0041fdd0
add esp, 0xc
mov dword [ebp - 0x5c], 0x101
xor ecx, ecx
mov word [ebp - 0x58], cx
imul edx, dword [ebp + 8], 0x24
mov eax, dword [edx + 0x478b1c]
mov dword [ebp - 0x50], eax
imul ecx, dword [ebp + 8], 0x24
mov edx, dword [ecx + 0x478b18]
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov ecx, 2
imul edx, ecx, 0
mov eax, 0x43
mov word [ebp + edx - 0x28], ax
mov ecx, 2
shl ecx, 0
mov edx, 0x6f
mov word [ebp + ecx - 0x28], dx
mov eax, 2
shl eax, 1
mov ecx, 0x6d
mov word [ebp + eax - 0x28], cx
mov edx, 2
imul eax, edx, 3
mov ecx, 0x53
mov word [ebp + eax - 0x28], cx
mov edx, 2
shl edx, 2
mov eax, 0x70
mov word [ebp + edx - 0x28], ax
mov ecx, 2
imul edx, ecx, 5
mov eax, 0x65
mov word [ebp + edx - 0x28], ax
mov ecx, 2
imul edx, ecx, 6
mov eax, 0x63
mov word [ebp + edx - 0x28], ax
mov ecx, 2
imul edx, ecx, 7
xor eax, eax
mov word [ebp + edx - 0x28], ax
push 0x104
lea ecx, [ebp - 0x498]
push ecx
lea edx, [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jle 0x40fbd4
mov eax, 2
imul ecx, eax, 0
mov edx, 0x53
mov word [ebp + ecx - 0x28], dx
mov eax, 2
shl eax, 0
mov ecx, 0x59
mov word [ebp + eax - 0x28], cx
mov edx, 2
shl edx, 1
mov eax, 0x53
mov word [ebp + edx - 0x28], ax
mov ecx, 2
imul edx, ecx, 3
mov eax, 0x54
mov word [ebp + edx - 0x28], ax
mov ecx, 2
shl ecx, 2
mov edx, 0x45
mov word [ebp + ecx - 0x28], dx
mov eax, 2
imul ecx, eax, 5
mov edx, 0x4d
mov word [ebp + ecx - 0x28], dx
mov eax, 2
imul ecx, eax, 6
mov edx, 0x52
mov word [ebp + ecx - 0x28], dx
mov eax, 2
imul ecx, eax, 7
mov edx, 0x4f
mov word [ebp + ecx - 0x28], dx
mov eax, 2
shl eax, 3
mov ecx, 0x4f
mov word [ebp + eax - 0x28], cx
mov edx, 2
imul eax, edx, 9
mov ecx, 0x54
mov word [ebp + eax - 0x28], cx
mov edx, 2
imul eax, edx, 0xa
xor ecx, ecx
mov word [ebp + eax - 0x28], cx
push 0x104
lea edx, [ebp - 0x290]
push edx
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40fb54
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
xor eax, eax
jmp 0x40fbe4
lea ecx, [ebp - 0x44]
push ecx
lea edx, [ebp - 0x88]
push edx
lea eax, [ebp - 0x290]
push eax
push 0
push 0
push 1
push 0
push 0
lea ecx, [ebp - 0x498]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40fb95
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
xor eax, eax
jmp 0x40fbe4
imul edx, dword [ebp + 8], 0x24
mov eax, dword [ebp - 0x44]
mov dword [edx + 0x478b24], eax
imul ecx, dword [ebp + 8], 0x24
mov edx, dword [ebp - 0x3c]
mov dword [ecx + 0x478b10], edx
imul eax, dword [ebp + 8], 0x24
mov dword [eax + 0x478b2c], 1
imul ecx, dword [ebp + 8], 0x24
mov dword [ecx + 0x478b30], 0
mov eax, 1
jmp 0x40fbe4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
xor eax, eax
jmp 0x40fbe4
mov esp, ebp
pop ebp
ret