Function at 0x41323c
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create two anonymous pipes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x4134b7
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x6c], 0xc
mov eax, 0x14
call fcn.0040709c
mov ebx, eax
mov dword [ebp - 0x68], ebx
push 1
push ebx
call sub.advapi32.dll_InitializeSecurityDescriptor
test eax, eax
jne 0x413282
mov eax, 0x4134c4
call fcn.0040cb0c
push 0
push 0
push 0xffffffffffffffff
mov eax, dword [ebp - 0x68]
push eax
call sub.advapi32.dll_SetSecurityDescriptorDacl
test eax, eax
jne 0x41329f
mov eax, 0x4134e4
call fcn.0040cb0c
mov dword [ebp - 0x64], 0xffffffff
push 0
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
call sub.kernel32.dll_CreatePipe
test eax, eax
jne 0x4132c7
mov eax, 0x413500
call fcn.0040cb0c
push 2
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x14]
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_DuplicateHandle
test eax, eax
jne 0x4132f4
mov eax, 0x41350c
call fcn.0040cb0c
push 0
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
call sub.kernel32.dll_CreatePipe
test eax, eax
jne 0x413315
mov eax, 0x413500
call fcn.0040cb0c
mov eax, dword [ebp - 0x68]
call fcn.004025b8
push 2
push 0
push 0
push 0x419228
call sub.kernel32.dll_GetCurrentProcess
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_DuplicateHandle
test eax, eax
jne 0x41334b
mov eax, 0x41350c
call fcn.0040cb0c
push 2
push 0
push 0
push 0x419224
call sub.kernel32.dll_GetCurrentProcess
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_DuplicateHandle
test eax, eax
jne 0x413379
mov eax, 0x41350c
call fcn.0040cb0c
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle_1
test eax, eax
jne 0x413390
mov eax, 0x41351c
call fcn.0040cb0c
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
test eax, eax
jne 0x4133a7
mov eax, 0x41351c
call fcn.0040cb0c
lea eax, [ebp - 0x60]
xor ecx, ecx
mov edx, 0x44
call fcn.004028f0
mov dword [ebp - 0x60], 0x44
mov dword [ebp - 0x34], 0x101
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov word [ebp - 0x30], 0
lea eax, [ebp - 0x1c]
call fcn.00413098
push 0x4197b0
lea eax, [ebp - 0x60]
push eax
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 0x1c]
call fcn.004039b4
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x41343c
mov byte [0x4197c4], 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x412c64
xor edx, edx
xor eax, eax
call fcn.0040353c
mov dword [0x4197c0], eax
mov eax, dword [0x4197b4]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x41345c
mov eax, 0x413528
call fcn.0040cb0c
mov eax, dword [0x419224]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [0x419228]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
test eax, eax
jne 0x413473
mov eax, 0x41351c
call fcn.0040cb0c
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
test eax, eax
jne 0x41348a
mov eax, 0x41351c
call fcn.0040cb0c
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_CloseHandle_1
test eax, eax
jne 0x4134a1
mov eax, 0x41351c
call fcn.0040cb0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4134be
lea eax, [ebp - 0x1c]
call fcn.00403580
ret