Function at 0x409440
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41ea0b
mov eax, dword fs:[0]
push eax
sub esp, 0x498
mov eax, dword [0x401054]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x450]
mov esi, dword [ebp + 0xc]
push 0
push eax
lea eax, [ebp - 0x438]
mov dword [ebp - 0x444], ebx
push eax
lea eax, [ebp - 0x434]
mov dword [ebp - 0x440], ebx
push eax
mov dword [ebp - 0x450], 0xc
mov dword [ebp - 0x44c], 0
mov dword [ebp - 0x448], 1
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x4094e3
mov dword [ebx + 0x10], 0
mov ecx, ebx
push 0
mov dword [ebx + 0x14], 0xf
push 0x401b00
mov byte [ebx], 0
call fcn.00408d60
jmp 0x40979e
push 0x40
lea eax, [ebp - 0x490]
mov dword [ebp - 0x494], 0x44
push 0
push eax
call fcn.0040cf50
add esp, 0xc
lea eax, [ebp - 0x494]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
xor eax, eax
mov dword [ebp - 0x468], 0x101
mov word [ebp - 0x464], ax
mov eax, dword [ebp - 0x438]
mov dword [ebp - 0x454], eax
mov dword [ebp - 0x458], eax
lea eax, [ebp - 0x4a4]
push eax
lea eax, [ebp - 0x494]
push eax
push 0
push 0
push 0
push 1
push 0
push 0
push esi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4094bf
push dword [ebp - 0x438]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x418], 0
mov dword [ebp - 0x414], 0xf
mov byte [ebp - 0x428], 0
push 0x400
lea eax, [ebp - 0x410]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.0040cf50
add esp, 0xc
mov dword [ebp - 0x430], 0
lea eax, [ebp - 0x430]
push 0
push eax
push 0x400
lea eax, [ebp - 0x410]
push eax
push dword [ebp - 0x434]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x409770
nop dword [eax]
nop dword [eax + eax]
mov ecx, dword [ebp - 0x414]
mov eax, ecx
mov edi, dword [ebp - 0x418]
sub eax, edi
mov ebx, dword [ebp - 0x430]
mov dword [ebp - 0x440], edi
mov dword [ebp - 0x43c], ecx
cmp ebx, eax
ja 0x40963b
lea eax, [ebx + edi]
cmp ecx, 0x10
mov dword [ebp - 0x418], eax
lea esi, [ebp - 0x428]
cmovae esi, dword [ebp - 0x428]
lea eax, [ebp - 0x410]
push ebx
push eax
add esi, edi
push esi
call fcn.0040c9d0
add esp, 0xc
mov byte [esi + ebx], 0
jmp 0x409741
mov eax, 0x7fffffff
sub eax, edi
cmp eax, ebx
jb 0x4097bc
lea esi, [edi + ebx]
or esi, 0xf
cmp esi, 0x7fffffff
jbe 0x40965f
mov esi, 0x7fffffff
jmp 0x40967d
mov edx, ecx
mov eax, 0x7fffffff
shr edx, 1
sub eax, edx
cmp ecx, eax
jbe 0x409675
mov esi, 0x7fffffff
jmp 0x40967d
lea eax, [ecx + edx]
cmp esi, eax
cmovb esi, eax
lea eax, [esi + 1]
push eax
lea ecx, [ebp - 0x428]
call fcn.00408b30
cmp dword [ebp - 0x43c], 0x10
lea ecx, [edi + ebx]
mov dword [ebp - 0x42c], eax
mov dword [ebp - 0x418], ecx
mov dword [ebp - 0x414], esi
jb 0x40970a
mov esi, dword [ebp - 0x440]
mov edi, dword [ebp - 0x428]
push esi
push edi
push eax
call fcn.0040c450
add esi, dword [ebp - 0x42c]
lea eax, [ebp - 0x410]
push ebx
push eax
push esi
call fcn.0040c450
mov ecx, dword [ebp - 0x43c]
add esp, 0x18
inc ecx
mov byte [esi + ebx], 0
cmp ecx, 0x1000
jb 0x4096fe
mov edx, dword [edi - 4]
add ecx, 0x23
sub edi, edx
lea eax, [edi - 4]
cmp eax, 0x1f
ja 0x4097c1
mov edi, edx
push ecx
push edi
call fcn.0040b36e
add esp, 8
jmp 0x409735
push edi
lea ecx, [ebp - 0x428]
push ecx
push eax
call fcn.0040c450
mov esi, dword [ebp - 0x42c]
lea eax, [ebp - 0x410]
push ebx
push eax
add esi, edi
push esi
call fcn.0040c450
add esp, 0x18
mov byte [esi + ebx], 0
mov eax, dword [ebp - 0x42c]
mov dword [ebp - 0x428], eax
push 0
lea eax, [ebp - 0x430]
push eax
push 0x400
lea eax, [ebp - 0x410]
push eax
push dword [ebp - 0x434]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4095e0
mov ebx, dword [ebp - 0x444]
push dword [ebp - 0x434]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x428]
push eax
call fcn.0040a810
add esp, 4
mov ecx, ebx
push eax
call fcn.00407be0
lea ecx, [ebp - 0x428]
call fcn.00407cd0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040b37c
mov esp, ebp
pop ebp
ret
call fcn.00408b00
call fcn.0040eb69
int3