Function at 0x416300
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Read file on windows
Read pipe

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47cedb
mov eax, dword fs:[0]
push eax
sub esp, 0x490
mov eax, dword [0x4be5b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x428], eax
mov dword [ebp - 0x430], eax
call fcn.0040b4c0
mov ecx, eax
test ecx, ecx
je 0x4166b9
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x42c], esi
push 0
lea eax, [ebp - 0x448]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x424]
mov dword [ebp - 0x448], 0xc
push eax
xorps xmm0, xmm0
lea eax, [ebp - 0x418]
movq qword [ebp - 0x444], xmm0
push eax
mov dword [ebp - 0x440], 1
mov dword [ebp - 0x444], 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x4163eb
add esi, 0xfffffff0
push esi
call fcn.004077e0
mov edi, dword [ebp - 0x428]
add eax, 0x10
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov dword [edi], eax
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x416697
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
jmp 0x416697
push 0x40
lea eax, [ebp - 0x498]
mov dword [ebp - 0x49c], 0x44
push 0
push eax
call fcn.00432c40
mov eax, dword [ebp - 0x424]
add esp, 0xc
mov dword [ebp - 0x460], eax
xorps xmm0, xmm0
mov dword [ebp - 0x45c], eax
xor eax, eax
mov word [ebp - 0x46c], ax
lea eax, [ebp - 0x458]
push eax
lea eax, [ebp - 0x49c]
mov dword [ebp - 0x470], 0x101
push eax
push 0
push 0
push 0x10
push 1
push 0
push 0
push edi
push 0
movups xmmword [ebp - 0x458], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x416477
push dword [ebp - 0x424]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x418]
jmp 0x416666
mov edi, dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
nop dword [eax]
push 0x32
push dword [ebp - 0x458]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
test eax, eax
mov dword [ebp - 0x420], 0
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x41c], 0
push eax
push 0
push 0
push 0
push dword [ebp - 0x418]
sete byte [ebp - 0x411]
call edi
test eax, eax
je 0x416635
nop word [eax + eax]
mov eax, dword [ebp - 0x41c]
test eax, eax
je 0x416635
push 0
lea ecx, [ebp - 0x420]
cmp eax, 0x3ff
push ecx
mov ecx, 0x3ff
cmova eax, ecx
push eax
lea eax, [ebp - 0x410]
push eax
push dword [ebp - 0x418]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x416635
mov eax, dword [ebp - 0x420]
test eax, eax
je 0x416635
cmp eax, 0x400
jae 0x4166b4
mov byte [ebp + eax - 0x410], 0
lea eax, [ebp - 0x410]
lea edx, [eax + 1]
nop word [eax + eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x416540
mov edi, dword [esi - 0xc]
lea ecx, [ebp - 0x410]
mov dword [ebp - 0x430], ecx
sub ecx, esi
sub eax, edx
mov dword [ebp - 0x43c], ecx
mov dword [ebp - 0x438], edi
js 0x4166c3
push eax
lea eax, [ebp - 0x410]
push eax
call fcn.00440313
mov edx, eax
mov ecx, SysReAllocString
sub ecx, edx
mov dword [ebp - 0x434], edx
add esp, 8
cmp ecx, edi
jl 0x4166c3
add edi, edx
js 0x4166c3
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or eax, ecx
jge 0x4165c4
push edi
lea ecx, [ebp - 0x42c]
call fcn.004104a0
mov esi, dword [ebp - 0x42c]
mov edx, dword [ebp - 0x434]
mov eax, dword [ebp - 0x438]
mov ecx, dword [ebp - 0x43c]
cmp ecx, eax
ja 0x4165d8
add ecx, esi
jmp 0x4165de
mov ecx, dword [ebp - 0x430]
push edx
push ecx
push edx
add eax, esi
push eax
call fcn.0041a3b0
add esp, 0x10
cmp edi, dword [esi - 8]
jg 0x4166c3
push 0
lea eax, [ebp - 0x41c]
mov dword [esi - 0xc], edi
push eax
push 0
push 0
mov byte [edi + esi], 0
mov edi, dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
push 0
push dword [ebp - 0x418]
mov dword [ebp - 0x420], 0
mov dword [ebp - 0x41c], 0
call edi
test eax, eax
jne 0x4164d0
cmp byte [ebp - 0x411], 0
je 0x416480
push dword [ebp - 0x424]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x418]
call edi
push dword [ebp - 0x458]
call edi
push dword [ebp - 0x454]
call edi
add esi, 0xfffffff0
push esi
call fcn.004077e0
mov edi, dword [ebp - 0x428]
add eax, 0x10
add esp, 4
mov dword [edi], eax
or eax, 0xffffffff
mov dword [ebp - 4], eax
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x416697
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042c75e
mov esp, ebp
pop ebp
ret
call fcn.0042cc9e
push 0x80004005
call fcn.004068b0
push 0x80070057
call fcn.004068b0
int3