Function at 0x4021c0
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Read file on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x425270
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x158
mov eax, dword [0x431040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14c], esi
mov dword [ebp - 0x144], esi
push 0
xorps xmm0, xmm0
mov dword [ebp - 0x144], esi
push 0x42db99
lea ecx, [ebp - 0xd4]
mov dword [ebp - 0xc4], 0
movups xmmword [ebp - 0xd4], xmm0
mov dword [ebp - 0xc0], 0
call fcn.00406410
push 0
lea eax, [ebp - 0xe8]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0xdc]
mov dword [ebp - 0xe8], 0xc
push eax
lea eax, [ebp - 0xd8]
mov dword [ebp - 0xe0], 1
push eax
mov dword [ebp - 0xe4], 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
xorps xmm0, xmm0
test eax, eax
jne 0x4022e5
push eax
movups xmmword [esi], xmm0
push 0x42db99
mov ecx, esi
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
call fcn.00406410
mov ecx, dword [ebp - 0xc0]
cmp ecx, 0xf
jbe 0x4022de
mov edx, dword [ebp - 0xd4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4022d4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402770
push ecx
push edx
call fcn.0040a0b9
add esp, 8
mov eax, esi
jmp 0x402748
xor eax, eax
movlpd qword [ebp - 0x13c], xmm0
mov word [ebp - 0x106], ax
mov word [ebp - 0x110], ax
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x100], eax
mov ax, word [0x42dd50]
mov word [ebp - 0x18], ax
mov al, byte [0x42dd52]
mov byte [ebp - 0x16], al
lea eax, [ebp - 0xf8]
push eax
lea eax, [ebp - 0x140]
movlpd qword [ebp - 0x134], xmm0
push eax
push 0
push 0
push 0x8000000
push 1
movlpd qword [ebp - 0x12c], xmm0
lea eax, [ebp - 0x38]
movlpd qword [ebp - 0x124], xmm0
movlpd qword [ebp - 0x11c], xmm0
movlpd qword [ebp - 0x10e], xmm0
movups xmmword [ebp - 0xf8], xmm0
push 0
movups xmm0, xmmword [str.cmd.exe__c_wmic_csproduct_get_uuid]
push 0
push eax
movups xmmword [ebp - 0x38], xmm0
push 0
movups xmm0, xmmword [0x42dd40]
mov dword [ebp - 0x140], 0x44
mov dword [ebp - 0x114], 0x101
movups xmmword [ebp - 0x28], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x4024cb
push dword [ebp - 0xdc]
call esi
push 0xffffffffffffffff
push dword [ebp - 0xf8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
lea eax, [ebp - 0xbc]
push eax
push 0x7f
lea eax, [ebp - 0xb8]
push eax
push dword [ebp - 0xd8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4024bb
nop dword [eax]
mov eax, dword [ebp - 0xbc]
test eax, eax
je 0x4024b5
cmp eax, 0x80
jae 0x402766
lea esi, [ebp - 0xb8]
mov byte [ebp + eax - 0xb8], 0
lea ecx, [esi + 1]
nop word [eax + eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x402420
mov edx, dword [ebp - 0xc0]
sub esi, ecx
mov ecx, dword [ebp - 0xc4]
mov eax, edx
sub eax, ecx
push esi
cmp esi, eax
ja 0x40246f
lea eax, [esi + ecx]
cmp edx, 0xf
mov dword [ebp - 0xc4], eax
lea edi, [ebp - 0xd4]
cmova edi, dword [ebp - 0xd4]
lea eax, [ebp - 0xb8]
add edi, ecx
push eax
push edi
call fcn.0040b2f0
add esp, 0xc
mov byte [edi + esi], 0
jmp 0x40248f
lea eax, [ebp - 0xb8]
mov byte [ebp - 0x144], 0
push eax
push dword [ebp - 0x144]
lea ecx, [ebp - 0xd4]
push esi
call fcn.00406a70
push 0
lea eax, [ebp - 0xbc]
push eax
push 0x7f
lea eax, [ebp - 0xb8]
push eax
push dword [ebp - 0xd8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4023f0
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xf8]
call esi
push dword [ebp - 0xf4]
call esi
push dword [ebp - 0xd8]
call esi
mov edi, dword [ebp - 0xc0]
lea ecx, [ebp - 0xd4]
mov esi, dword [ebp - 0xc4]
cmp edi, 0xf
mov dword [ebp - 0x148], esi
cmova ecx, dword [ebp - 0xd4]
mov dword [ebp - 0xbc], ecx
cmp esi, 1
jb 0x402550
lea eax, [esi + ecx]
mov dword [ebp - 0x144], eax
sub eax, ecx
push eax
push 0xa
push ecx
call fcn.0040b9f0
mov edx, eax
add esp, 0xc
test edx, edx
je 0x402550
nop dword [eax]
movzx ecx, byte [edx]
cmp cl, 0xa
jne 0x40252c
xor eax, eax
jmp 0x402531
sbb eax, eax
or eax, 1
test eax, eax
je 0x402585
mov eax, dword [ebp - 0x144]
inc edx
sub eax, edx
push eax
push 0xa
push edx
call fcn.0040b9f0
mov edx, eax
add esp, 0xc
test edx, edx
jne 0x402520
or edx, 0xffffffff
cmp edx, 0xffffffff
je 0x40260f
inc edx
mov dword [ebp - 0x154], 0
mov dword [ebp - 0x150], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x164], xmm0
cmp esi, edx
jb 0x40276b
jmp 0x40258d
sub edx, dword [ebp - 0xbc]
jmp 0x402553
sub esi, edx
lea eax, [ebp - 0xd4]
or ecx, 0xffffffff
cmp esi, 0xffffffff
cmovb ecx, esi
cmp edi, 0xf
push ecx
cmova eax, dword [ebp - 0xd4]
lea ecx, [ebp - 0x164]
add eax, edx
push eax
call fcn.00406410
lea eax, [ebp - 0x164]
push eax
lea ecx, [ebp - 0xd4]
call fcn.004043c0
mov ecx, dword [ebp - 0x150]
cmp ecx, 0xf
jbe 0x402603
mov edx, dword [ebp - 0x164]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4025f9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402770
push ecx
push edx
call fcn.0040a0b9
add esp, 8
mov esi, dword [ebp - 0xc4]
mov dword [ebp - 0x148], esi
mov ecx, dword [ebp - 0xc0]
lea eax, [ebp - 0xd4]
mov edx, dword [ebp - 0xd4]
lea edi, [ebp - 0xd4]
cmp ecx, 0xf
cmova eax, edx
add eax, esi
cmp ecx, 0xf
mov dword [ebp - 0xbc], eax
cmova edi, edx
add edi, esi
cmp ecx, 0xf
lea esi, [ebp - 0xd4]
mov dword [ebp - 0x144], edi
cmova esi, edx
cmp esi, edi
je 0x4026ad
movsx eax, byte [esi]
push eax
call fcn.00410760
add esp, 4
test eax, eax
jne 0x402668
inc esi
cmp esi, edi
jne 0x402653
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x148], eax
cmp esi, edi
je 0x4026ad
lea edi, [esi + 1]
cmp edi, dword [ebp - 0x144]
je 0x4026ad
movsx eax, byte [edi]
push eax
call fcn.00410760
add esp, 4
test eax, eax
jne 0x402698
mov al, byte [edi]
mov byte [esi], al
inc esi
inc edi
cmp edi, dword [ebp - 0x144]
jne 0x402683
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0xc0], 0xf
lea eax, [ebp - 0xd4]
mov edx, esi
lea ecx, [ebp - 0xd4]
cmova eax, dword [ebp - 0xd4]
sub dword [ebp - 0xbc], esi
sub edx, eax
mov esi, dword [ebp - 0x148]
mov eax, esi
mov edi, dword [ebp - 0xbc]
sub eax, edx
cmp eax, edi
cmovb edi, eax
cmp dword [ebp - 0xc0], 0xf
mov dword [ebp - 0xbc], edi
cmova ecx, dword [ebp - 0xd4]
sub esi, edi
add ecx, edx
mov eax, esi
sub eax, edx
inc eax
push eax
lea eax, [ecx + edi]
push eax
push ecx
call fcn.0040b2f0
mov eax, dword [ebp - 0x14c]
xorps xmm0, xmm0
mov dword [ebp - 0xc4], esi
add esp, 0xc
movups xmmword [eax], xmm0
mov dword [eax + 0x10], 0
movups xmm0, xmmword [ebp - 0xd4]
mov dword [eax + 0x14], 0
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0xc4]
movq qword [eax + 0x10], xmm0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00409c25
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.00409d5b
call fcn.00405b40
call fcn.00410aa9
int3