Function at 0x4a75b8
Capabilities:
Create pipe
Create thread

Disassembly:
push 0x3c8
mov eax, 0x5256fc
call fcn.004d8b28
mov dword [ebp - 0xa4], edx
mov esi, ecx
mov dword [ebp - 0x28], esi
xor ebx, ebx
lea ecx, [ebp - 0x18]
mov edi, ebx
mov dword [ebp - 0x14], edi
mov byte [edx], bl
call fcn.0040687a
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 8]
cmp eax, 2
jae 0x4a7634
push 0x557f
push 0x80004005
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x24]
call fcn.00406620
mov byte [ebp - 4], 1
lea eax, [ebp - 0x24]
mov ecx, esi
push eax
call fcn.0040121b
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov eax, esi
jmp 0x4a7de2
lea ecx, [eax - 2]
mov eax, dword [ebp + 0xc]
push str._remotepipe
mov dword [ebp - 0x34], ecx
push dword [eax + ecx*4]
call fcn.004e3849
pop ecx
pop ecx
test eax, eax
je 0x4a7670
push 0x5580
push 0x80004005
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x24]
call fcn.00406620
mov byte [ebp - 4], 2
jmp 0x4a760c
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov esi, dword [esi + eax*4 - 4]
test esi, esi
jne 0x4a7682
mov eax, ebx
jmp 0x4a7689
push esi
call fcn.004ddaa2
pop ecx
push eax
push esi
lea ecx, [ebp - 0x18]
call fcn.00406efb
push 0x18
mov esi, ebx
pop ecx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], ecx
mov eax, dword [0x57d3ec]
cmp esi, 2
jae 0x4a7704
add eax, ecx
lea ecx, [ebp - 0x9c]
push ebx
push esi
mov dword [ebp + 8], eax
call fcn.0042989d
mov esi, eax
mov byte [ebp - 4], 3
lea edx, [ebp - 0x18]
or edi, 2
lea ecx, [ebp - 0x98]
push 0x5485e0
mov dword [ebp - 0x14], edi
call fcn.00409442
push 4
pop ecx
mov dword [ebp - 4], ecx
or edi, ecx
push esi
mov edx, eax
mov dword [ebp - 0x14], edi
lea ecx, [ebp - 0x94]
call fcn.0040a037
add esp, 0x10
mov dword [ebp - 4], 5
or edi, 8
mov esi, dword [ebp - 0x2c]
jmp 0x4a7728
add eax, 0x50
lea edx, [ebp - 0x18]
push str._cancel
lea ecx, [ebp - 0x90]
mov dword [ebp + 8], eax
call fcn.00409442
pop ecx
mov dword [ebp - 4], 6
or edi, 0x10
push eax
mov edx, str..pipe_
mov dword [ebp - 0x14], edi
lea ecx, [ebp - 0x8c]
call fcn.004093b4
pop ecx
push ebx
push ebx
push ebx
push ebx
push 1
push 6
push 0x40000003
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov ecx, dword [ebp - 0x8c]
mov edi, dword [ebp + 8]
lea ecx, [ecx - 0x10]
mov dword [edi], eax
call fcn.00407189
mov eax, dword [ebp - 0x14]
test al, 0x10
je 0x4a7783
mov ecx, dword [ebp - 0x90]
and eax, 0xffffffef
mov dword [ebp - 0x14], eax
lea ecx, [ecx - 0x10]
call fcn.00407189
mov eax, dword [ebp - 0x14]
test al, 8
je 0x4a779e
mov ecx, dword [ebp - 0x94]
and eax, 0xfffffff7
mov dword [ebp - 0x14], eax
lea ecx, [ecx - 0x10]
call fcn.00407189
mov eax, dword [ebp - 0x14]
test al, 4
je 0x4a77b9
mov ecx, dword [ebp - 0x98]
and eax, 0xfffffffb
mov dword [ebp - 0x14], eax
lea ecx, [ecx - 0x10]
call fcn.00407189
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], ebx
test al, 2
je 0x4a77d4
mov ecx, dword [ebp - 0x9c]
and eax, 0xfffffffd
mov dword [ebp - 0x14], eax
lea ecx, [ecx - 0x10]
call fcn.00407189
cmp dword [edi], 0xffffffff
je 0x4a7d85
cmp dword [edi], 0
je 0x4a7d85
mov ecx, dword [ebp - 0x30]
inc esi
mov edi, dword [ebp - 0x14]
add ecx, 4
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], ecx
cmp ecx, 0x24
jb 0x4a769e
push 0x18
pop esi
mov edx, dword [0x57d3ec]
push ecx
lea ecx, [ebp - 0x24]
mov edx, dword [esi + edx]
call fcn.004a72f4
pop ecx
mov byte [ebp - 4], 8
cmp dword [ebp - 0x24], 0
jl 0x4a7d39
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.00407189
add esi, 4
cmp esi, 0x20
jb 0x4a7802
mov edx, dword [0x57d3ec]
push ecx
lea ecx, [ebp - 0x44]
mov edx, dword [edx + 0x50]
call fcn.004a72f4
pop ecx
mov byte [ebp - 4], 0xa
cmp dword [ebp - 0x44], 0
jge 0x4a78a8
cmp dword [ebp - 0x40], 0
mov eax, 0x559a
cmovne eax, dword [ebp - 0x40]
push eax
push dword [ebp - 0x44]
push ecx
mov esi, esp
mov dword [ebp + 8], esi
mov ecx, dword [ebp - 0x3c]
lea ecx, [ecx - 0x10]
call fcn.004070e7
add eax, 0x10
lea ecx, [ebp - 0x24]
mov dword [esi], eax
call fcn.00406620
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
push eax
mov byte [ebp - 4], 0xb
call fcn.0040121b
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0x3c]
jmp 0x4a7dcc
mov ecx, dword [ebp - 0x3c]
lea ecx, [ecx - 0x10]
call fcn.00407189
push ebx
push ebx
push ebx
push 0x4a73f9
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x54], eax
mov byte [ebp - 4], 0xc
test eax, eax
jne 0x4a790b
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x559d
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x24]
call fcn.00406620
mov byte [ebp - 4], 0xd
jmp 0x4a7dbd
lea ecx, [ebp - 0x204]
call fcn.0044f464
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x60], 0x80004005
mov dword [ebp - 0x5c], ebx
call fcn.0040687a
push dword [ebp + 0xc]
mov byte [ebp - 4], 0x10
lea edx, [ebp - 0x204]
push dword [ebp - 0x34]
lea ecx, [ebp - 0xfc]
call fcn.004a3eb6
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 0x11
call fcn.004032ed
mov ecx, dword [ebp - 0xf4]
lea ecx, [ecx - 0x10]
call fcn.00407189
jmp 0x4a79a5
mov dword [ebp - 4], 0xf
mov eax, dword [0x57d3ec]
cmp byte [eax + 1], 0
jne 0x4a7a40
push 0x5446d4
lea ecx, [ebp + 8]
call fcn.00406fea
push ecx
mov byte [ebp - 4], 0x19
lea edi, [ebp + 8]
mov ecx, dword [ebp + 8]
mov esi, esp
mov dword [ebp - 0x38], esi
lea ecx, [ecx - 0x10]
call fcn.004070e7
add eax, 0x10
lea ecx, [ebp - 0xd8]
mov edx, edi
mov dword [esi], eax
call fcn.00428612
pop ecx
mov ecx, dword [ebp - 0xd0]
add ecx, 0xfffffff0
call fcn.00407189
push ecx
mov ecx, dword [ebp + 8]
mov esi, esp
mov dword [ebp - 0x38], esi
lea ecx, [ecx - 0x10]
call fcn.004070e7
add eax, 0x10
lea ecx, [ebp - 0xe4]
mov dword [esi], eax
call fcn.00457cc5
pop ecx
mov ecx, dword [ebp - 0xdc]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov byte [ebp - 4], 0xf
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.00407189
lea ecx, [ebp - 0x3d4]
call fcn.0044f626
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 0x1a
call fcn.004a927e
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x78], ebx
push str.command
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x1b
call fcn.00406fea
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 0x1c
push eax
lea ecx, [ebp - 0x88]
call fcn.00409159
mov edi, str.finish
mov esi, eax
push edi
call fcn.004ddaa2
pop ecx
push eax
push edi
mov ecx, esi
call fcn.00406efb
mov byte [ebp - 4], 0x1b
mov ecx, dword [ebp - 0x30]
lea ecx, [ecx - 0x10]
call fcn.00407189
lea ecx, [ebp - 0x74]
call fcn.004a927e
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x64], ebx
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 0x1d
push 1
push eax
lea edx, [ebp - 0x88]
lea ecx, [ebp - 0xf0]
call fcn.0044e85f
pop ecx
pop ecx
lea ecx, [ebp - 0x2c]
call fcn.0040687a
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 0x1f
push eax
push ecx
mov ecx, esp
push str.result
call fcn.00406fea
lea ecx, [ebp - 0x74]
call fcn.0044df9d
mov ecx, dword [ebp - 0x2c]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0xe8]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0x6c]
test ecx, ecx
je 0x4a7b59
mov eax, dword [ebp - 0x64]
sub eax, ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], eax
cmp eax, 0x1000
jb 0x4a7b47
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x4c]
push eax
call fcn.00405c9b
mov eax, dword [ebp - 0x48]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x4c]
push eax
push ecx
call fcn.004d840d
pop ecx
pop ecx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x64], ebx
lea ecx, [ebp - 0x74]
call fcn.004ad684
mov byte [ebp - 4], 0x1a
mov ecx, dword [ebp - 0x80]
test ecx, ecx
je 0x4a7ba5
mov eax, dword [ebp - 0x78]
sub eax, ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x50], eax
cmp eax, 0x1000
jb 0x4a7b93
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.00405c9b
mov eax, dword [ebp - 0x50]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x34]
push eax
push ecx
call fcn.004d840d
pop ecx
pop ecx
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x78], ebx
lea ecx, [ebp - 0x88]
call fcn.004ad684
push ebx
sub esp, 0xc
mov byte [0x57d390], 1
lea eax, [ebp - 0x60]
mov ecx, esp
push eax
call fcn.0040121b
push 1
lea edx, [ebp - 0x3d4]
lea ecx, [ebp - 0xc8]
call fcn.00451361
mov eax, dword [ebp - 0xa4]
add esp, 0x14
cmp dword [ebp - 0xc8], 0
setge cl
mov byte [eax], cl
mov ecx, dword [0x57d3ec]
lea ecx, [ecx + 0x50]
call fcn.00427477
push 0xffffffffffffffff
push dword [ebp - 0x54]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0xc0]
lea ecx, [ecx - 0x10]
call fcn.00407189
lea ecx, [ebp - 0x3d4]
call fcn.00450187
mov esi, dword [ebp - 0x28]
lea ecx, [esi + 8]
mov dword [esi], ebx
mov dword [esi + 4], ebx
call fcn.0040687a
mov ecx, dword [ebp - 0x58]
lea ecx, [ecx - 0x10]
call fcn.00407189
lea ecx, [ebp - 0x204]
call fcn.0044f7ad
push dword [ebp - 0x54]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4a7622
cmp dword [ebp - 0x20], 0
mov eax, 0x5597
cmovne eax, dword [ebp - 0x20]
push eax
push dword [ebp - 0x24]
push ecx
mov esi, esp
mov dword [ebp + 8], esi
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.004070e7
add eax, 0x10
lea ecx, [ebp - 0x44]
mov dword [esi], eax
call fcn.00406620
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x44]
push eax
mov byte [ebp - 4], 9
call fcn.0040121b
mov ecx, dword [ebp - 0x3c]
lea ecx, [ecx - 0x10]
call fcn.00407189
jmp 0x4a7dc9
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x5592
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x24]
call fcn.00406620
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
push eax
call fcn.0040121b
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov eax, dword [ebp - 0x28]
call fcn.004d8a8d
ret