Function at 0x40fc20
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Execute shell command and capture output
Get common file path
Read file on windows
Read pipe

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d5ee4
mov eax, dword fs:[0]
push eax
mov eax, 0x102fc
call fcn.004af0d0
mov eax, dword [0x6fe068]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x1024c], edi
mov dword [ebp - 0x10248], edi
mov dword [ebp - 0x10298], edi
lea ecx, [ebp - 0x10294]
mov dword [ebp - 0x10244], 0
call fcn.0040af80
mov dword [ebp - 4], 1
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x40fca1
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40fc90
sub ecx, edx
sar ecx, 1
jmp 0x40fcab
mov ecx, dword [esi + 0x24]
test ecx, ecx
je 0x40fd00
shr ecx, 1
dec ecx
cmp ecx, 0x7fff
jl 0x40fd00
mov ecx, edi
call fcn.0040af80
mov byte [ebp - 4], 2
lea ecx, [edi + 0x10]
mov eax, dword [ebp - 0x10290]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x1028c]
mov dword [edi + 8], eax
mov eax, dword [ebp - 0x10288]
mov dword [edi], vtable.CWString.0
mov dword [edi + 0xc], eax
mov eax, dword [edi + 0x10]
call dword [eax + 0x44]
lea eax, [ebp - 0x10284]
push eax
lea ecx, [edi + 0x10]
call fcn.0040b5f0
mov byte [ebp - 4], 1
jmp 0x41016a
push 0x44
lea eax, [ebp - 0x102dc]
push 0
push eax
call fcn.004b0540
add esp, 0xc
mov dword [ebp - 0x10220], 0
lea eax, [ebp - 0x10258]
mov dword [ebp - 0x10240], 0
mov dword [ebp - 0x10258], 0xc
mov dword [ebp - 0x10254], 0
push 0
push eax
lea eax, [ebp - 0x10240]
mov dword [ebp - 0x10250], 1
push eax
lea eax, [ebp - 0x10220]
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x410122
xor eax, eax
mov dword [ebp - 0x102dc], 0x44
mov word [ebp - 0x102ac], ax
mov eax, dword [ebp - 0x10220]
mov dword [ebp - 0x102a4], eax
mov eax, dword [ebp - 0x10240]
push 0x208
mov dword [ebp - 0x102a0], eax
mov dword [ebp - 0x1029c], eax
lea eax, [ebp - 0x218]
push 0
push eax
mov dword [ebp - 0x102b0], 0x101
call fcn.004b0540
add esp, 0xc
lea eax, [ebp - 0x218]
push 0
push 0x25
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x6e3070
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.004b2a07
push 0xfffe
lea eax, [ebp - 0x10218]
push 0
push eax
call fcn.004b0540
push str.__c
lea eax, [ebp - 0x10218]
push 0x7fff
push eax
call fcn.004b2a07
mov eax, dword [esi + 0xc]
add esp, 0x24
test eax, eax
jne 0x40fe24
cmp dword [esi + 0x24], eax
mov eax, 0x6e2dcc
je 0x40fe24
mov eax, dword [esi + 0x1c]
push eax
lea eax, [ebp - 0x10218]
push 0x7fff
push eax
call fcn.004b2a07
add esp, 0xc
lea eax, [ebp - 0x10268]
xorps xmm0, xmm0
movups xmmword [ebp - 0x10268], xmm0
push eax
lea eax, [ebp - 0x102dc]
push eax
push 0
push 0
push 0
push 1
push 0
lea eax, [ebp - 0x10258]
push eax
lea eax, [ebp - 0x10218]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push dword [ebp - 0x10240]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jne 0x40fea8
push dword [ebp - 0x10220]
call eax
lea eax, [ebp - 0x10294]
mov ecx, edi
push eax
call fcn.0040b1d0
jmp 0x41016a
push dword [ebp - 0x10264]
call eax
push 0x3e8
push dword [ebp - 0x10268]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
mov dword [ebp - 0x1021c], 0
nop dword [eax + eax]
push 0
lea eax, [ebp - 0x1021c]
push eax
push 0
push 0
push 0
push dword [ebp - 0x10220]
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
cmp dword [ebp - 0x1021c], 0
jbe 0x4100c8
mov dword [ebp - method.CVolRefObject.virtual_0], 0x6e2c70
mov dword [ebp - method.CVolRefObject.virtual_0], vtable.CVolObject.0
mov dword [ebp - 0x10238], 0
mov dword [ebp - 0x10234], 0
mov byte [ebp - 4], 3
mov dword [ebp - method.CVolRefObject.virtual_0], vtable.CVolMem.0
mov dword [ebp - 0x10230], 0
mov dword [ebp - 0x10228], 0
mov dword [ebp - 0x1022c], 0
mov dword [ebp - 0x10224], 0x40
mov byte [ebp - 4], 4
mov edi, dword [ebp - 0x1021c]
test edi, edi
je 0x40ffb3
mov esi, dword [ebp - 0x10224]
mov eax, edi
cdq
idiv esi
mov eax, dword [ebp - 0x1023c]
sub esi, edx
add esi, edi
push esi
mov eax, dword [eax]
cmp eax, method.CVolRefObject.virtual_0
jne 0x40ff97
mov ecx, 0x7033a8
call fcn.0044d2a0
test eax, eax
je 0x4101a2
jmp 0x40ff9f
lea ecx, [ebp - 0x1023c]
call eax
mov dword [ebp - 0x10230], eax
mov dword [ebp - 0x1022c], esi
mov dword [ebp - 0x10228], edi
jmp 0x40ffbf
mov edi, dword [ebp - 0x10228]
mov eax, dword [ebp - 0x10230]
push edi
push 0
push eax
call fcn.004b0540
mov eax, dword [ebp - 0x10230]
add esp, 0xc
xor ecx, ecx
cmp dword [ebp - 0x10228], ecx
push ecx
cmove eax, ecx
lea ecx, [ebp - 0x1021c]
push ecx
push dword [ebp - 0x1021c]
push eax
push dword [ebp - 0x10220]
call dword [sym.imp.KERNEL32.dll_ReadFile]
lea edx, [ebp - 0x1023c]
lea ecx, [ebp - 0x10308]
call fcn.00445ec0
mov byte [ebp - 4], 5
mov ecx, dword [eax + 0xc]
test ecx, ecx
jne 0x410020
cmp dword [eax + 0x24], ecx
mov ecx, 0x6e2dcc
je 0x410020
mov ecx, dword [eax + 0x1c]
push ecx
lea ecx, [ebp - 0x10294]
call fcn.0044de00
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x10308]
call fcn.0040baa0
mov ecx, dword [ebp - 0x10230]
test ecx, ecx
je 0x41006a
mov eax, dword [ebp - 0x1023c]
push ecx
mov eax, dword [eax + 0xc]
cmp eax, method.CVolRefObject.virtual_12
jne 0x410062
mov ecx, 0x7033a8
call fcn.0044d390
jmp 0x41006a
lea ecx, [ebp - 0x1023c]
call eax
mov dword [ebp - 0x10230], 0
mov dword [ebp - 0x10228], 0
mov dword [ebp - 0x1022c], 0
mov byte [ebp - 4], 1
mov dword [ebp - method.CVolRefObject.virtual_0], vtable.CVolMem.0
mov byte [ebp - 4], 8
mov dword [ebp - 0x10230], 0
mov dword [ebp - 0x10228], 0
mov dword [ebp - 0x1022c], 0
mov byte [ebp - 4], 1
mov dword [ebp - method.CVolRefObject.virtual_0], vtable.CVolObject.0
jmp 0x4100f1
lea eax, [ebp - 0x10248]
mov dword [ebp - 0x10248], 0
push eax
push dword [ebp - 0x10268]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [ebp - 0x10248], 0x103
jne 0x410106
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x1021c], 0xffffffff
jne 0x40fed0
push dword [ebp - 0x10268]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x10220]
call esi
mov edi, dword [ebp - 0x1024c]
mov ecx, edi
call fcn.0040af80
mov byte [ebp - 4], 9
lea ecx, [edi + 0x10]
mov eax, dword [ebp - 0x10290]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x1028c]
mov dword [edi + 8], eax
mov eax, dword [ebp - 0x10288]
mov dword [edi], vtable.CWString.0
mov dword [edi + 0xc], eax
mov eax, dword [edi + 0x10]
call dword [eax + 0x44]
lea eax, [ebp - 0x10284]
push eax
lea ecx, [edi + 0x10]
call fcn.0040b5f0
mov byte [ebp - 4], 1
mov dword [ebp - 0x10244], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10294]
call fcn.0040baa0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ae58b
mov esp, ebp
pop ebp
ret 4
push 0xffffffffffffffff
call fcn.004b7843
int3