Function at 0x4efef0
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Read file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x513763
push eax
mov eax, 0x27b4
mov dword fs:[0], esp
call fcn.004c8da0
push ebp
push esi
xor ebp, ebp
push edi
lea eax, [esp + 0x48]
push ebp
lea ecx, [esp + 0x2c]
push eax
lea edx, [esp + 0x34]
push ecx
push edx
mov dword [esp + 0x58], 0xc
mov dword [esp + 0x5c], ebp
mov dword [esp + 0x60], 1
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x4f02b1
lea eax, [esp + 0x68]
mov dword [esp + 0x68], 0x44
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
lea ecx, [esp + 0x58]
lea edx, [esp + 0x68]
mov eax, dword [esp + 0x28]
push ecx
push edx
push ebp
push ebp
push ebp
push 1
push ebp
push ebp
push str.ipconfig__all
push ebp
mov dword [esp + 0xd0], eax
mov dword [esp + 0xcc], eax
mov word [esp + 0xc0], bp
mov dword [esp + 0xbc], 0x101
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp eax, ebp
jne 0x4effba
mov eax, dword [esp + 0x28]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 0x2c]
push ecx
call esi
xor eax, eax
jmp 0x4f02b1
mov edx, dword [esp + 0x58]
push 0x3e8
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x28]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_3
mov ecx, 0x9c4
xor eax, eax
lea edi, [esp + 0xac]
push ebp
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x58]
lea edx, [esp + 0xb0]
stosb byte es:[edi], al
mov eax, dword [esp + 0x30]
push ecx
push 0x2710
push edx
push eax
mov dword [esp + 0x27dc], ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x58]
mov edi, eax
push ecx
call esi
mov edx, dword [esp + 0x5c]
push edx
call esi
mov eax, dword [esp + 0x2c]
push eax
call esi
cmp edi, ebp
jne 0x4f004c
lea ecx, [esp + 0x10]
mov dword [esp + 0x27c8], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor eax, eax
jmp 0x4f02b1
mov edi, 0x515c40
mov dword [esp + 0x34], ebp
mov dword [esp + 0x30], edi
mov dword [esp + 0x40], ebp
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x38], ebp
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x1c], ebp
lea ecx, [esp + 0x30]
push 0x546fdc
lea edx, [esp + 0xb0]
push ecx
push edx
mov byte [esp + 0x27d4], 2
call fcn.004f02d0
add esp, 0xc
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString_3
mov eax, dword [esp + 0x38]
xor esi, esi
cmp eax, ebp
mov byte [esp + 0x27c8], 3
jle 0x4f0153
push 0xffffffffffffffff
push ebp
lea ecx, [esp + 0x1c]
call fcn.00416000
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0x14]
push 0x542a24
push ecx
mov eax, dword [eax + esi*4]
push eax
call fcn.004f02d0
mov eax, dword [esp + 0x28]
add esp, 0xc
cmp eax, 6
jl 0x4f00ee
cmp eax, 8
jle 0x4f00f9
mov eax, dword [esp + 0x38]
inc esi
cmp esi, eax
jl 0x4f00ba
jmp 0x4f0153
xor esi, esi
cmp eax, ebp
jle 0x4f0153
mov edx, dword [esp + 0x18]
mov eax, dword [edx + esi*4]
lea ecx, [edx + esi*4]
cmp dword [eax - 8], 2
jle 0x4f0140
lea edx, [esp + 0x44]
push 2
push edx
call sub.MFC42.DLL_CString::Right
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x27cc], 4
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x44]
mov byte [esp + 0x27c8], 3
call sub.MFC42.DLL_CString::CString
jmp 0x4f014a
push ecx
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::operator_1
mov eax, dword [esp + 0x1c]
inc esi
cmp esi, eax
jl 0x4f00ff
mov eax, dword [esp + 0xc]
cmp dword [eax - 8], ebp
jne 0x4f01f1
lea ecx, [esp + 0xc]
mov byte [esp + 0x27c8], 2
call sub.MFC42.DLL_CString::CString
mov dword [esp + 0x14], edi
mov eax, dword [esp + 0x18]
mov byte [esp + 0x27c8], 5
cmp eax, ebp
je 0x4f019d
mov ecx, dword [esp + 0x1c]
push ecx
push eax
call sub.MFC42.DLL_DestructElements
mov edx, dword [esp + 0x18]
push edx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov esi, 0x514bb8
mov dword [esp + 0x30], edi
mov dword [esp + 0x14], esi
mov eax, dword [esp + 0x34]
mov byte [esp + 0x27c8], 6
cmp eax, ebp
je 0x4f01d2
mov ecx, dword [esp + 0x38]
push ecx
push eax
call sub.MFC42.DLL_DestructElements
mov edx, dword [esp + 0x34]
push edx
call sub.MFC42.DLL_operatordelete
add esp, 4
lea ecx, [esp + 0x10]
mov dword [esp + 0x30], esi
mov dword [esp + 0x27c8], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor eax, eax
jmp 0x4f02b1
push 0x54ad90
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::operator_2
mov eax, dword [esp + 0xc]
push eax
call fcn.004f28c0
mov ecx, dword [esp + 0x27d4]
add esp, 4
push eax
push str._08X
push ecx
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea ecx, [esp + 0xc]
mov byte [esp + 0x27c8], 2
call sub.MFC42.DLL_CString::CString
mov dword [esp + 0x14], edi
mov eax, dword [esp + 0x18]
mov byte [esp + 0x27c8], 7
cmp eax, ebp
je 0x4f025f
mov edx, dword [esp + 0x1c]
push edx
push eax
call sub.MFC42.DLL_DestructElements
mov eax, dword [esp + 0x18]
push eax
call sub.MFC42.DLL_operatordelete
add esp, 4
mov esi, 0x514bb8
mov dword [esp + 0x30], edi
mov dword [esp + 0x14], esi
mov eax, dword [esp + 0x34]
mov byte [esp + 0x27c8], 8
cmp eax, ebp
je 0x4f0294
mov ecx, dword [esp + 0x38]
push ecx
push eax
call sub.MFC42.DLL_DestructElements
mov edx, dword [esp + 0x34]
push edx
call sub.MFC42.DLL_operatordelete
add esp, 4
lea ecx, [esp + 0x10]
mov dword [esp + 0x30], esi
mov dword [esp + 0x27c8], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, 1
mov ecx, dword [esp + 0x27c0]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x27c0
ret 4