Function at 0x948744
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create two anonymous pipes
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 5
add esp, 0xfffff004
push eax
dec eax
jne 0x94874d
mov eax, dword [ebp - 4]
add esp, 0xffffff5c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x50a8], ebx
mov dword [ebp - 0x50a4], ebx
mov dword [ebp - 0x2824], ebx
mov dword [ebp - 0x280c], ecx
mov ebx, edx
mov esi, eax
mov eax, dword [ebp + 8]
call fcn.0040882c
xor eax, eax
push ebp
push 0x948b8a
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp + 8], 0
jne 0x9487b8
lea edx, [ebp - 0x50a4]
xor eax, eax
call fcn.00405300
mov eax, dword [ebp - 0x50a4]
lea edx, [ebp + 8]
call fcn.00422e74
cmp dword [ebp + 8], 0
jne 0x9487cb
lea eax, [ebp + 8]
mov edx, 0x948bac
call fcn.00408b70
xor eax, eax
mov dword [0x9fbb88], eax
lea eax, [ebp - 0x2824]
mov edx, esi
call fcn.00408b70
lea edx, [ebp - 0x50a8]
mov eax, ebx
call fcn.00421384
cmp dword [ebp - 0x50a8], 0
je 0x948811
push dword [ebp - 0x2824]
push 0x948bc0
push ebx
lea eax, [ebp - 0x2824]
mov edx, 3
call fcn.004099dc
lea eax, [ebp - 0x2884]
xor ecx, ecx
mov edx, 0x44
call fcn.00405c80
lea eax, [ebp - 0x509d]
xor ecx, ecx
mov edx, 0x2801
call fcn.00405c80
lea eax, [ebp - 0x2890]
xor ecx, ecx
mov edx, 0xc
call fcn.00405c80
xor eax, eax
mov dword [ebp - 0x2808], eax
mov byte [ebp - 0x280d], 1
mov dword [ebp - 0x2890], 0xc
mov dword [ebp - 0x2888], 0xffffffff
xor eax, eax
mov dword [ebp - 0x288c], eax
push 0
lea eax, [ebp - 0x2890]
push eax
lea eax, [ebp - 0x2830]
push eax
lea eax, [ebp - 0x2834]
push eax
call sub.kernel32.dll_CreatePipe
test eax, eax
jne 0x948897
call fcn.0042a3f8
mov dword [ebp - 0x289c], 0xc
xor eax, eax
mov dword [ebp - 0x2898], eax
xor eax, eax
push ebp
push 0x948b52
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x9f24a4]
cmp dword [eax], 2
jne 0x948922
push 0
push 1
mov eax, dword [ebp - 0x2834]
push eax
call sub.kernel32.dll_SetHandleInformation
test eax, eax
jne 0x9488dc
call fcn.0042a3f8
jmp 0x948922
push 2
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x282c]
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
mov eax, dword [ebp - 0x2834]
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_DuplicateHandle
test eax, eax
jne 0x94890a
call fcn.0042a3f8
mov eax, dword [ebp - 0x2834]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x282c]
mov dword [ebp - 0x2834], eax
mov dword [ebp - 0x2890], 0xc
mov dword [ebp - 0x2888], 0xffffffff
xor eax, eax
mov dword [ebp - 0x288c], eax
push 0
lea eax, [ebp - 0x2890]
push eax
push 0x9fbb88
lea eax, [ebp - 0x2838]
push eax
call sub.kernel32.dll_CreatePipe
mov dword [ebp - 0x2884], 0x44
mov dword [ebp - 0x2858], 0x101
mov word [ebp - 0x2854], 0
mov eax, dword [ebp - 0x2838]
mov dword [ebp - 0x284c], eax
mov eax, dword [ebp - 0x2830]
mov dword [ebp - 0x2848], eax
mov eax, dword [ebp - 0x2830]
mov dword [ebp - 0x2844], eax
lea eax, [ebp - 0x2820]
push eax
lea eax, [ebp - 0x2884]
push eax
mov eax, dword [ebp + 8]
call fcn.004096e8
push eax
push 0
push 0x8000008
push 0xffffffffffffffff
lea eax, [ebp - 0x289c]
push eax
push 0
mov eax, dword [ebp - 0x2824]
call fcn.004096e8
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x9489de
call fcn.0042a3f8
mov eax, dword [ebp - 0x2820]
mov dword [0x9fbb78], eax
mov eax, dword [ebp - 0x2818]
mov dword [0x9fbb7c], eax
mov eax, dword [ebp - 0x281c]
mov dword [0x9fbb80], eax
mov eax, dword [ebp - 0x2814]
mov dword [0x9fbb84], eax
mov eax, dword [ebp - 0x2830]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x2838]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
push ebp
push 0x948b0e
push dword fs:[eax]
mov dword fs:[eax], esp
jmp 0x948a94
mov esi, dword [ebp - 0x283c]
dec esi
test esi, esi
jl 0x948a94
inc esi
lea edi, [ebp - 0x509d]
movzx ebx, byte [edi]
cmp bl, 0xa
jne 0x948a55
mov byte [ebp - 0x280d], 1
jmp 0x948a90
cmp bl, 0xd
jne 0x948a63
push ebp
call fcn.0094862c
pop ecx
jmp 0x948a90
mov eax, dword [ebp - 0x2808]
mov byte [ebp + eax - 0x2801], bl
inc dword [ebp - 0x2808]
cmp dword [ebp - 0x2808], 0x2800
jl 0x948a90
mov byte [ebp - 0x280d], 1
push ebp
call fcn.0094862c
pop ecx
inc edi
dec esi
jne 0x948a44
push 0
lea eax, [ebp - 0x283c]
push eax
push 0x2801
lea eax, [ebp - 0x509d]
push eax
mov eax, dword [ebp - 0x2834]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
jne 0x948a32
push 0x1388
mov eax, dword [ebp - 0x2820]
push eax
call sub.kernel32.dll_WaitForSingleObject
lea eax, [ebp - 0x2828]
push eax
mov eax, dword [ebp - 0x2820]
push eax
call sub.kernel32.dll_GetExitCodeProcess
push ebp
call fcn.0094862c
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x948b15
mov eax, dword [ebp - 0x2820]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x281c]
push eax
call sub.kernel32.dll_CloseHandle_1
ret