Function at 0x402e40
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Read file on windows

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x431036
push eax
mov eax, 0x2818
mov dword fs:[0], esp
call fcn.00414cb0
mov eax, dword [str.ipconfig__all]
mov ecx, dword [0x43d3bc]
push ebx
mov dword [esp + 0x24], eax
mov ax, word [0x43d3c4]
push ebp
push esi
push edi
mov dword [esp + 0x34], ecx
mov word [esp + 0x3c], ax
xor ebx, ebx
mov ecx, 0x1f
xor eax, eax
lea edi, [esp + 0x95]
mov byte [esp + 0x94], bl
mov edx, dword [0x43d3c0]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [esp + 0x38], edx
lea ecx, [esp + 0x40]
stosb byte es:[edi], al
push ebx
lea edx, [esp + 0x18]
push ecx
lea eax, [esp + 0x24]
push edx
push eax
mov dword [esp + 0x50], 0xc
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], 1
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x4030b7
lea ecx, [esp + 0x50]
mov dword [esp + 0x50], 0x44
push ecx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x20]
mov dword [esp + 0x90], eax
mov dword [esp + 0x8c], eax
lea eax, [esp + 0x50]
push edx
push eax
push ebx
push ebx
push ebx
push 1
push ebx
lea ecx, [esp + 0x4c]
push ebx
push ecx
push ebx
mov word [esp + 0xa8], bx
mov dword [esp + 0xa4], 0x101
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x403069
mov edx, dword [esp + 0x20]
push 0x3e8
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x14]
push eax
call ebp
mov ecx, 0x9c4
xor eax, eax
lea edi, [esp + 0x114]
push ebx
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x50]
lea edx, [esp + 0x118]
stosb byte es:[edi], al
mov eax, dword [esp + 0x20]
push ecx
push 0x2710
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, ebx
jne 0x402fa9
mov ecx, dword [esp + 0x14]
push ecx
call ebp
mov edx, dword [esp + 0x20]
push edx
call ebp
mov eax, dword [esp + 0x24]
push eax
call ebp
mov ecx, dword [esp + 0x1c]
push ecx
call ebp
xor eax, eax
jmp 0x4030b7
lea edx, [esp + 0x114]
lea ecx, [esp + 0x18]
push edx
call fcn.00429402
push str.Physical_Address._._._._._._._._._:
lea ecx, [esp + 0x14]
mov dword [esp + 0x2834], ebx
call fcn.00429402
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
mov byte [esp + 0x2834], 1
call fcn.004240d5
cmp eax, ebx
jge 0x403005
push 0x43d36c
lea ecx, [esp + 0x14]
call fcn.0042951d
mov ecx, dword [esp + 0x10]
push ecx
lea ecx, [esp + 0x1c]
call fcn.004240d5
mov edx, dword [esp + 0x18]
mov ecx, dword [edx - 8]
mov edx, dword [esp + 0x10]
mov edx, dword [edx - 8]
sub ecx, edx
sub ecx, eax
jns 0x40301d
xor ecx, ecx
jmp 0x403027
cmp ecx, 0x11
jle 0x403027
mov ecx, 0x11
add edx, eax
mov eax, ecx
lea edi, [esp + 0x94]
mov byte [esp + 0x2830], bl
lea esi, [esp + edx + 0x114]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
call fcn.00429394
lea ecx, [esp + 0x18]
mov dword [esp + 0x2830], 0xffffffff
call fcn.00429394
lea edi, [esp + 0x94]
or ecx, 0xffffffff
xor eax, eax
lea esi, [esp + 0x94]
repne scasb al, byte es:[edi]
mov edi, dword [esp + 0x2838]
mov eax, dword [esp + 0x14]
not ecx
dec ecx
push eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call ebp
mov ecx, dword [esp + 0x20]
push ecx
call ebp
mov edx, dword [esp + 0x24]
push edx
call ebp
mov eax, dword [esp + 0x1c]
push eax
call ebp
mov eax, 1
mov ecx, dword [esp + 0x2828]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x2824
ret