Function at 0x42a600
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Enumerate processes
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x431d4f
mov eax, dword fs:[0]
push eax
mov eax, 0x1384
call fcn.0042eca0
mov eax, dword [0x43f00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1364], edx
mov dword [ebp - 0x1360], ecx
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
mov dword [ebp - 0x1374], ebx
cmp ebx, 0xffffffff
jne 0x42a677
mov edx, str.CreateToolhelp32Snapshot_failed
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
push 0x413ab0
call fcn.00413790
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
jmp 0x42ad1f
lea eax, [ebp - 0x1358]
mov dword [ebp - 0x1358], 0x22c
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x42a6a0
mov edx, str.Process32First_failed
jmp 0x42a65a
xor eax, eax
mov dword [ebp - 0x105c], 0
lea ecx, [ebp - 0x1334]
mov dword [ebp - 0x104c], 0
mov dword [ebp - 0x1048], 7
lea edx, [ecx + 2]
mov word [ebp - 0x105c], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42a6d0
sub ecx, edx
lea eax, [ebp - 0x1334]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x105c]
call fcn.00426b70
push 0x50
lea eax, [ebp - 0x10ac]
mov dword [ebp - 4], 0
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov dword [ebp - method.std::wstring_convert_class_std::codecvt_utf8_utf16_wchar_t__1114111__0___wchar_t__class_std::allocator_wchar_t___class_std::allocator_char__.virtual_0], vtable.std::wstring_convert_class_std::codecvt_utf8_utf16_wchar_t__1114111__0___wchar_t__class_std::allocator_wchar_t___class_std::allocator_char__.0
push 1
mov byte [ebp - 4], 1
call dword [sym.imp.MSVCP140.dll_private:_static_class_std::locale::_Locimp____cdecl_std::locale::_Init_bool_]
mov dword [ebp - 0x10a0], eax
mov dword [ebp - 0x109c], 0
mov dword [ebp - 0x108c], 0
mov dword [ebp - 0x1088], 0xf
mov byte [ebp - 0x109c], 0
xor eax, eax
mov dword [ebp - 0x1084], 0
mov dword [ebp - 0x1074], 0
mov dword [ebp - 0x1070], 7
mov word [ebp - 0x1084], ax
mov byte [ebp - 4], 4
push 0x34
mov word [ebp - 0x1064], ax
mov byte [ebp - 0x1062], al
call fcn.0042cd56
mov esi, eax
add esp, 0x14
mov dword [ebp - 0x1390], esi
push 0
mov ecx, esi
mov byte [ebp - 4], 5
call dword [sym.imp.MSVCP140.dll_public:_void___thiscall_std::codecvt_wchar_t__char__struct__Mbstatet_::constructor_unsigned_int_]
mov dword [esi], vtable.std::codecvt_utf8_utf16_wchar_t__1114111__0_.0
xorps xmm0, xmm0
mov byte [ebp - 4], 4
push dword [ebp - 0x10a0]
movlpd qword [ebp - 0x106c], xmm0
mov dword [ebp - 0x10a8], esi
call dword [sym.imp.MSVCP140.dll_private:_static_class_std::locale::_Locimp____cdecl_std::locale::_Locimp::_New_Locimp_class_std::locale::_Locimp_const__]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::locale::id_std::codecvt_wchar_t__char__struct__Mbstatet_::id]
add esp, 4
mov edi, eax
call dword [sym.imp.MSVCP140.dll_public:_unsigned_int___thiscall_std::locale::id::operator_unsigned_int_void_]
push eax
push esi
mov ecx, edi
call dword [sym.imp.MSVCP140.dll_private:_void___thiscall_std::locale::_Locimp::_Addfac_class_std::locale::facet___unsigned_int_]
push 0x434d4c
lea ecx, [edi + 0x18]
mov dword [edi + 0x10], 0
call dword [sym.imp.MSVCP140.dll_public:_class_std::_Yarn_char_____thiscall_std::_Yarn_char_::operator_char_const__]
mov ecx, dword [ebp - 0x10a0]
cmp ecx, edi
je 0x42a821
mov eax, dword [ecx]
call dword [eax + 8]
test eax, eax
je 0x42a814
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
mov dword [ebp - 0x10a0], edi
mov ecx, edi
mov eax, dword [edi]
call dword [eax + 4]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 8]
test eax, eax
je 0x42a834
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
mov dword [ebp - 0x1060], 0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x105c]
cmp dword [ebp - 0x1048], 8
mov eax, dword [ebp - 0x104c]
cmovae ecx, dword [ebp - 0x105c]
lea eax, [ecx + eax*2]
push eax
push ecx
lea eax, [ebp - 0x10c4]
push eax
lea ecx, [ebp - 0x10ac]
call fcn.004266f0
lea ecx, [ebp - 0x10ac]
call fcn.0042b420
mov ecx, dword [ebp - 0x1360]
lea eax, [ebp - 0x10c4]
mov byte [ebp - 4], 7
mov esi, dword [ebp - 0x10b0]
cmp esi, 0x10
mov ebx, dword [ebp - 0x10c4]
setae byte [ebp - 0x1359]
mov dword [ebp - 0x1370], ebx
cmovae eax, ebx
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x42a8d0
test dl, dl
je 0x42a8cc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x42a8d0
add eax, 2
add ecx, 2
test dl, dl
jne 0x42a8b0
xor eax, eax
jmp 0x42a8d5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x42ac81
mov eax, dword [ebp - 0x1364]
cmp dword [ebp - 0x1350], eax
je 0x42ac81
push 0x11
mov dword [ebp - 0x1040], 0
lea ecx, [ebp - 0x1040]
push str.TASKKILL__F__PID
mov dword [ebp - 0x1030], 0
mov dword [ebp - 0x102c], 0xf
mov byte [ebp - 0x1040], 0
call fcn.00412ab0
mov byte [ebp - 4], 8
lea esi, [ebp - 0x13]
mov ebx, dword [ebp - 0x1350]
mov eax, 0xcccccccd
dec esi
mul ebx
shr edx, 3
mov al, dl
shl al, 2
lea ecx, [eax + edx]
add cl, cl
sub bl, cl
add bl, 0x30
mov byte [esi], bl
mov ebx, edx
test ebx, ebx
jne 0x42a933
xor edi, edi
mov dword [ebp - 0x138c], edx
lea ecx, [ebp - 0x13]
mov dword [ebp - 0x137c], edi
mov byte [ebp - 0x138c], dl
mov eax, 0xf
mov dword [ebp - 0x1378], eax
cmp esi, ecx
je 0x42a998
mov eax, ecx
lea ecx, [ebp - 0x138c]
sub eax, esi
push eax
push esi
call fcn.00412ab0
mov edi, dword [ebp - 0x137c]
mov eax, dword [ebp - 0x1378]
cmp eax, 0x10
mov byte [ebp - 4], 9
mov esi, dword [ebp - 0x102c]
lea ecx, [ebp - 0x138c]
mov ebx, dword [ebp - 0x138c]
mov eax, esi
mov edx, dword [ebp - 0x1030]
cmovae ecx, ebx
sub eax, edx
push edi
push ecx
cmp edi, eax
ja 0x42a9ef
lea eax, [edi + edx]
cmp esi, 0x10
mov dword [ebp - 0x1030], eax
lea eax, [ebp - 0x1040]
cmovae eax, dword [ebp - 0x1040]
lea esi, [eax + edx]
push esi
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov byte [edi + esi], 0
jmp 0x42aa0e
mov byte [ebp - 0x1368], 0
lea ecx, [ebp - 0x1040]
push dword [ebp - 0x1368]
push edi
call fcn.00414e80
mov ebx, dword [ebp - 0x138c]
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x1378]
cmp eax, 0x10
jb 0x42aa48
lea ecx, [eax + 1]
mov eax, ebx
cmp ecx, 0x1000
jb 0x42aa3e
mov ebx, dword [ebx - 4]
add ecx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42ad3b
push ecx
push ebx
call fcn.0042d0f1
add esp, 8
cmp dword [ebp - 0x102c], 0x10
lea ebx, [ebp - 0x1040]
cmovae ebx, dword [ebp - 0x1040]
mov edi, ebx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x42aa61
push 0
push 0
sub edi, ecx
inc edi
push edi
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
xor ecx, ecx
mov eax, edi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0042d0ff
add esp, 4
mov dword [ebp - 0x136c], eax
push esi
push eax
push edi
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
lea eax, [ebp - 0x10e8]
mov dword [ebp - 0x10e8], 0xc
push eax
lea eax, [ebp - 0x10d8]
mov dword [ebp - 0x10e4], 0
push eax
lea eax, [ebp - 0x10dc]
mov dword [ebp - 0x10e0], 1
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x42ac1c
lea eax, [ebp - 0x112c]
mov dword [ebp - 0x112c], 0x44
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov eax, dword [ebp - 0x10d8]
mov dword [ebp - 0x10ec], eax
mov dword [ebp - 0x10f0], eax
xor eax, eax
mov word [ebp - 0x10fc], ax
lea eax, [ebp - 0x10d4]
push eax
lea eax, [ebp - 0x112c]
mov dword [ebp - 0x1100], 0x101
push eax
push 0
push 0
push 0
push 1
push 0
push 0
push dword [ebp - 0x136c]
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x42ac1c
push dword [ebp - 0x10d8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1000
lea eax, [ebp - 0x1028]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
lea ecx, [ebp - 0x1028]
add esp, 0xc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x42ab86
sub ecx, edx
lea eax, [ebp - 0x1028]
push ecx
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp - 0x1044]
add esp, 0xc
push 0
push eax
push 0xfff
lea eax, [ebp - 0x1028]
push eax
push dword [ebp - 0x10dc]
call ebx
test eax, eax
je 0x42ac1c
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x1028]
lea edx, [eax + 1]
nop dword [eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42abe0
sub eax, edx
push eax
lea eax, [ebp - 0x1028]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x1044]
push 0
push eax
push 0xfff
lea eax, [ebp - 0x1028]
push eax
push dword [ebp - 0x10dc]
call ebx
test eax, eax
jne 0x42abc8
mov byte [ebp - 4], 7
mov edx, dword [ebp - 0x102c]
cmp edx, 0x10
jb 0x42ac5a
mov ecx, dword [ebp - 0x1040]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x42ac50
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42ad3b
push edx
push ecx
call fcn.0042d0f1
add esp, 8
mov ebx, dword [ebp - 0x1370]
mov esi, dword [ebp - 0x10b0]
mov dword [ebp - 0x1030], 0
mov dword [ebp - 0x102c], 0xf
mov byte [ebp - 0x1040], 0
cmp byte [ebp - 0x1359], 0
mov byte [ebp - 4], 0
je 0x42acb9
lea ecx, [esi + 1]
mov eax, ebx
cmp ecx, 0x1000
jb 0x42acaf
mov ebx, dword [ebx - 4]
add ecx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42ad3b
push ecx
push ebx
call fcn.0042d0f1
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x1048]
cmp edx, 8
jb 0x42acfc
mov ecx, dword [ebp - 0x105c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42acf2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42ad3b
push edx
push ecx
call fcn.0042d0f1
add esp, 8
mov ebx, dword [ebp - 0x1374]
lea eax, [ebp - 0x1358]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x42a6a0
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042c87e
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3