Function at 0x40bf90
Capabilities:
Create pipe
Create process on windows
Read file on windows
Resolve function by parsing pe exports
Write and execute a file
Write file on windows
Write pipe

Disassembly:
sub esp, 0x874
mov eax, dword [esp + 0x878]
push ebx
push esi
lea edx, [esp + 0x47c]
mov ecx, dword [eax]
push ecx
push 0x453150
push 0x400
push edx
call fcn.00425752
add esp, 0x10
xor ebx, ebx
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x10]
push ebx
push eax
lea edx, [esp + 0x10]
push ecx
push edx
mov dword [esp + 0x3c], 0xc
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], 1
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x40bff8
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x874
ret
xor eax, eax
lea ecx, [esp + 0x38]
mov dword [esp + 0x18], eax
push ecx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov esi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0xfffffffffffffff6
call esi
mov cl, byte [esp + 0x8a0]
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x10]
cmp cl, bl
mov dword [esp + 0x74], eax
jne 0x40c03a
push 0xfffffffffffffff4
call esi
mov ecx, dword [esp + 0x88c]
mov dword [esp + 0x78], eax
mov eax, dword [esp + 0x89c]
or eax, 0x180
cmp ecx, ebx
mov dword [esp + 0x64], eax
je 0x40c064
or al, 1
mov word [esp + 0x68], cx
mov dword [esp + 0x64], eax
mov ecx, dword [esp + 0x890]
lea edx, [esp + 0x18]
lea eax, [esp + 0x38]
push edx
push eax
push ebx
push ebx
push ecx
push 1
push ebx
lea edx, [esp + 0x498]
push ebx
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x40c0af
mov eax, dword [esp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call esi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x874
ret
mov eax, dword [esp + 0x894]
cmp eax, ebx
je 0x40c0c9
mov edx, dword [esp + 0x898]
lea ecx, [esp + 0x18]
push edx
push ecx
call eax
mov edx, dword [esp + 0x10]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push edx
call ebp
mov esi, dword [esp + 0x88c]
mov ecx, esi
call fcn.00435fb7
mov edx, dword [esp + 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [esp + 0x14]
push ebx
push eax
lea ecx, [esp + 0x8c]
push 0x400
push ecx
push edx
call edi
test eax, eax
je 0x40c17d
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x40c177
cmp byte [esp + 0x8ac], bl
je 0x40c143
lea ecx, [esp + 0x30]
push ebx
push ecx
lea edx, [esp + 0x8c]
push eax
push edx
push 0xfffffffffffffff5
mov dword [esp + 0x44], ebx
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call ebp
mov eax, dword [esp + 0x14]
mov byte [esp + eax + 0x84], bl
lea eax, [esp + 0x84]
push eax
mov ecx, esi
call fcn.00436408
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ebx
push ecx
lea edx, [esp + 0x8c]
push 0x400
push edx
push eax
call edi
test eax, eax
jne 0x40c110
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x890]
mov edx, dword [esp + 0x20]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x1c]
push eax
push ecx
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov edx, dword [esp + 0x24]
push edx
call ebp
mov eax, dword [esp + 0x20]
push eax
call ebp
mov ecx, dword [esp + 0x10]
push ecx
call ebp
mov eax, dword [esp + 0x1c]
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x874
ret