Function at 0x401e70
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x27d8
call fcn.005a1810
mov eax, dword [0x6478bc]
xor eax, ebp
mov dword [ebp - 4], eax
movups xmm0, xmmword [str.wmic_BaseBoard_get_SerialNumber]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2778], eax
mov eax, dword [0x61b130]
movups xmmword [ebp - 0x54], xmm0
push esi
movups xmm0, xmmword [0x61b0f8]
mov dword [ebp - 0xc], eax
mov al, byte [0x61b134]
movups xmmword [ebp - 0x44], xmm0
push 0x44
movups xmm0, xmmword [0x61b108]
mov byte [ebp - 8], al
lea eax, [ebp - 0x27d8]
push 0
movups xmmword [ebp - 0x34], xmm0
push eax
movups xmm0, xmmword [0x61b118]
mov dword [ebp - 0x2774], 0
mov dword [ebp - 0x2770], 0
movups xmmword [ebp - 0x24], xmm0
movq xmm0, qword [str.SerialNumber]
movq qword [ebp - 0x14], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0x2794], xmm0
call fcn.005a3080
push 0x2711
lea eax, [ebp - 0x2768]
xorps xmm0, xmm0
push 0
push eax
movq qword [ebp - 0x2780], xmm0
call fcn.005a3080
add esp, 0x18
mov dword [ebp - 0x2784], 0xc
lea eax, [ebp - 0x2784]
mov dword [ebp - 0x2780], 0
mov dword [ebp - 0x277c], 1
push 0
push eax
lea eax, [ebp - 0x2770]
push eax
lea eax, [ebp - 0x2774]
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x40210a
lea eax, [ebp - 0x27d8]
mov dword [ebp - 0x27d8], 0x44
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov eax, dword [ebp - 0x2770]
mov dword [ebp - 0x2798], eax
mov dword [ebp - 0x279c], eax
xor eax, eax
mov word [ebp - 0x27a8], ax
lea eax, [ebp - 0x2794]
push eax
lea eax, [ebp - 0x27d8]
mov dword [ebp - 0x27ac], 0x101
push eax
push 0
push 0
push 0
push 1
push 0
push 0
lea eax, [ebp - 0x54]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40210a
push 0x3e8
push dword [ebp - 0x2794]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
lea eax, [ebp - 0x276c]
push eax
push 0x2710
lea eax, [ebp - 0x2768]
push eax
push dword [ebp - 0x2774]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40210a
push 0
lea edx, [ebp - 0x14]
lea ecx, [ebp - 0x2768]
call fcn.00401dc0
add esp, 4
test eax, eax
jne 0x40210a
mov esi, dword [ebp - 0x276c]
push edi
inc esi
push esi
call fcn.0045697c
mov edi, eax
add esp, 4
test edi, edi
je 0x402050
push esi
push 0
push edi
call fcn.005a3080
add esp, 0xc
jmp 0x402052
xor edi, edi
mov esi, dword [ebp - 0x276c]
xor ecx, ecx
test esi, esi
je 0x402081
mov edx, edi
mov al, byte [ebp + ecx - 0x2768]
cmp al, 0x20
je 0x40207c
test al, al
je 0x40207c
cmp al, 9
je 0x40207c
mov byte [edx], al
inc edx
mov esi, dword [ebp - 0x276c]
inc ecx
cmp ecx, esi
jb 0x402060
push 0xf
mov edx, 0x61b138
mov ecx, edi
call fcn.00401dc0
mov esi, eax
add esp, 4
cmp esi, 0xffffffff
je 0x402109
lea eax, [esi - 0xd]
push ebx
push eax
call fcn.0045697c
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x4020bd
lea eax, [esi - 0xd]
push eax
push 0
push ebx
call fcn.005a3080
add esp, 0xc
jmp 0x4020bf
xor ebx, ebx
mov ecx, 0xf
mov edx, ebx
cmp esi, ecx
jl 0x4020db
nop word [eax + eax]
mov al, byte [ecx + edi]
inc ecx
mov byte [edx], al
inc edx
cmp ecx, esi
jle 0x4020d0
mov ecx, ebx
mov byte [edx], 0
call fcn.00401d70
push ebx
mov esi, eax
call fcn.00456977
push esi
push 0x61b13c
push dword [ebp - 0x2778]
call dword [sym.imp.USER32.dll_wsprintfW]
push esi
call fcn.00456977
add esp, 0x14
pop ebx
pop edi
push dword [ebp - 0x2770]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x2774]
call esi
push dword [ebp - 0x2794]
call esi
push dword [ebp - 0x2790]
call esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.005a164b
mov esp, ebp
pop ebp
ret