Function at 0x41f1a0
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Execute command
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x27dc
call fcn.0041df30
mov eax, dword [0x43bfc0]
xor eax, ebp
mov dword [ebp - 4], eax
movups xmm0, xmmword [str.wmic_BaseBoard_get_SerialNumber]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x27d8], eax
mov eax, dword [0x434858]
movups xmmword [ebp - 0x54], xmm0
push esi
movups xmm0, xmmword [0x434820]
mov dword [ebp - 0xc], eax
mov al, byte [0x43485c]
movups xmmword [ebp - 0x44], xmm0
push 0x2711
movups xmm0, xmmword [0x434830]
mov byte [ebp - 8], al
lea eax, [ebp - 0x2768]
push 0
movups xmmword [ebp - 0x34], xmm0
push eax
movups xmm0, xmmword [0x434840]
mov dword [ebp - 0x2774], 0
mov dword [ebp - 0x2770], 0
movups xmmword [ebp - 0x24], xmm0
movq xmm0, qword [str.SerialNumber]
movq qword [ebp - 0x14], xmm0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x276c], 0
xorps xmm0, xmm0
mov dword [ebp - 0x2784], 0
lea eax, [ebp - 0x2790]
movlpd qword [ebp - 0x277c], xmm0
movlpd qword [ebp - 0x27d0], xmm0
push 0
push eax
lea eax, [ebp - 0x2770]
movlpd qword [ebp - 0x27c8], xmm0
push eax
lea eax, [ebp - 0x2774]
movlpd qword [ebp - 0x27c0], xmm0
push eax
movlpd qword [ebp - 0x27b8], xmm0
movlpd qword [ebp - 0x27b0], xmm0
movlpd qword [ebp - 0x27a8], xmm0
movlpd qword [ebp - 0x27a0], xmm0
movlpd qword [ebp - 0x2798], xmm0
mov dword [ebp - 0x2780], 0
mov dword [ebp - 0x27d4], 0x44
mov dword [ebp - 0x2790], 0xc
mov dword [ebp - 0x278c], 0
mov dword [ebp - 0x2788], 1
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x41f30d
push dword [ebp - 0x2770]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x2774]
call esi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041d5bd
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x27d4]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov eax, dword [ebp - 0x2770]
mov dword [ebp - 0x2794], eax
mov dword [ebp - 0x2798], eax
xor eax, eax
mov word [ebp - 0x27a4], ax
lea eax, [ebp - 0x2784]
push eax
lea eax, [ebp - 0x27d4]
mov dword [ebp - 0x27a8], 0x101
push eax
push 0
push 0
push 0
push 1
push 0
push 0
lea eax, [ebp - 0x54]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x41f3a0
push dword [ebp - 0x2770]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x2774]
call esi
push dword [ebp - 0x2784]
call esi
push dword [ebp - 0x2780]
call esi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041d5bd
mov esp, ebp
pop ebp
ret
push 0x1f4
push dword [ebp - 0x2784]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
lea eax, [ebp - 0x276c]
push eax
push 0x2710
lea eax, [ebp - 0x2768]
push eax
push dword [ebp - 0x2774]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41f369
push 0x434860
call sub.api_ms_win_crt_runtime_l1_1_0.dll_system
lea ecx, [ebp - 0x14]
add esp, 4
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41f3f0
sub ecx, edx
lea esi, [ebp - 0x14]
lea edx, [ebp - 0x2768]
sub ecx, 4
jb 0x41f418
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x41f41d
add edx, 4
add esi, 4
sub ecx, 4
jae 0x41f407
cmp ecx, 0xfffffffc
je 0x41f45a
mov al, byte [edx]
cmp al, byte [esi]
jne 0x41f369
cmp ecx, 0xfffffffd
je 0x41f45a
mov al, byte [edx + 1]
cmp al, byte [esi + 1]
jne 0x41f369
cmp ecx, 0xfffffffe
je 0x41f45a
mov al, byte [edx + 2]
cmp al, byte [esi + 2]
jne 0x41f369
cmp ecx, 0xffffffff
je 0x41f45a
mov al, byte [edx + 3]
cmp al, byte [esi + 3]
jne 0x41f369
push ebx
push edi
lea eax, [ebp - 0x2768]
push 0x434864
push eax
call sub.VCRUNTIME140.dll_strstr
mov edi, eax
add esp, 8
mov ecx, edi
xor edx, edx
xor esi, esi
lea ebx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41f480
sub ecx, ebx
je 0x41f4c1
nop dword [eax + eax]
cmp edx, dword [ebp + 0xc]
jge 0x41f4c1
mov al, byte [esi + edi]
cmp al, 0x20
je 0x41f4ae
cmp al, 0xa
je 0x41f4ae
cmp al, 0xd
je 0x41f4ae
mov ecx, dword [ebp - 0x27d8]
mov byte [ecx + edx], al
inc edx
mov eax, edi
inc esi
lea ebx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41f4b4
sub eax, ebx
cmp esi, eax
jb 0x41f490
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop ebx
xor ecx, ebp
pop esi
call fcn.0041d5bd
mov esp, ebp
pop ebp
ret