Function at 0x4ef19c
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Read file on windows
Read pipe
Terminate process

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 8
add esp, 0xfffff004
push eax
dec eax
jne 0x4ef1a5
mov eax, dword [ebp - 4]
add esp, 0xffffff5c
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov dword [ebp - 0x38], 0xc
xor eax, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], 1
push 0
lea edx, [ebp - 0x38]
push edx
lea ecx, [ebp - 0x14]
push ecx
lea eax, [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_CreatePipe
test eax, eax
jne 0x4ef209
push 0x5dcb
call fcn.00402b9c
pop ecx
mov edx, eax
mov ecx, 2
mov eax, dword [ebp - 4]
call fcn.004e8800
xor eax, eax
jmp 0x4ef4f2
push 2
push 1
push 0
lea edx, [ebp - 0x18]
push edx
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
push dword [ebp - 0x14]
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call sub.KERNEL32.DLL_DuplicateHandle
test eax, eax
jne 0x4ef24c
push 0x5dcb
call fcn.00402b9c
pop ecx
mov edx, eax
mov ecx, 2
mov eax, dword [ebp - 4]
call fcn.004e8800
xor eax, eax
jmp 0x4ef4f2
push 2
push 0
push 0
lea edx, [ebp - 0x10]
push edx
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
push dword [ebp - 0xc]
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call sub.KERNEL32.DLL_DuplicateHandle
test eax, eax
jne 0x4ef28f
push 0x5dcb
call fcn.00402b9c
pop ecx
mov edx, eax
mov ecx, 2
mov eax, dword [ebp - 4]
call fcn.004e8800
xor eax, eax
jmp 0x4ef4f2
push dword [ebp - 0xc]
call sub.KERNEL32.DLL_CloseHandle
test eax, eax
push 0x44
push 0
lea edx, [ebp - 0x8c]
push edx
call fcn.0066cc88
add esp, 0xc
mov dword [ebp - 0x8c], 0x44
mov dword [ebp - 0x60], 0x101
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x50], ecx
push 0xfffffffffffffff6
call sub.KERNEL32.DLL_GetStdHandle
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x4c], eax
mov word [ebp - 0x5c], 0
push 0x5dca
call fcn.00402b9c
pop ecx
mov edx, eax
mov ecx, 1
mov eax, dword [ebp - 4]
call fcn.004e8800
lea edx, [ebp - 0x48]
push edx
lea ecx, [ebp - 0x8c]
push ecx
push 0
push 0
push 0x10
push 1
push 0
push 0
push dword [ebp - 8]
push 0
call sub.KERNEL32.DLL_CreateProcessA
test eax, eax
jne 0x4ef339
push 0x5dcb
call fcn.00402b9c
pop ecx
mov edx, eax
mov ecx, 2
mov eax, dword [ebp - 4]
call fcn.004e8800
xor eax, eax
jmp 0x4ef4f2
push dword [ebp - 0x44]
call sub.KERNEL32.DLL_CloseHandle
test eax, eax
push dword [ebp - 0x14]
call sub.KERNEL32.DLL_CloseHandle
test eax, eax
push dword [ebp - 0x18]
call sub.KERNEL32.DLL_CloseHandle
test eax, eax
xor edx, edx
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x31c]
call fcn.006585f8
mov edx, 0x3e8
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x31c]
call fcn.00658604
xor edx, edx
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x31c]
call fcn.00658614
mov edx, dword [ebp - 4]
mov byte [edx + 0x7ec], 0
mov ecx, dword [ebp - 4]
xor eax, eax
mov dword [ecx + 0xa0c], eax
jmp 0x4ef46b
lea edx, [ebp - 0x80a8]
push edx
call sub.USER32.DLL_TranslateMessage
lea ecx, [ebp - 0x80a8]
push ecx
call sub.USER32.DLL_DispatchMessageA
mov eax, dword [ebp - 4]
mov dl, byte [eax + 0x7ec]
test dl, dl
jne 0x4ef3e3
push 1
push 0
push 0
push 0
lea ecx, [ebp - 0x80a8]
push ecx
call sub.USER32.DLL_PeekMessageA
test eax, eax
jne 0x4ef3a6
mov eax, dword [ebp - 4]
mov dl, byte [eax + 0x7ec]
test dl, dl
jne 0x4ef47c
lea ecx, [ebp - 0x2c]
push ecx
lea eax, [ebp - 0x28]
push eax
push 0
push 0
push 0
push dword [ebp - 0x10]
call sub.KERNEL32.DLL_PeekNamedPipe
test eax, eax
je 0x4ef461
mov edx, dword [ebp - 0x28]
test edx, edx
jbe 0x4ef46b
push 0
lea ecx, [ebp - 0x24]
push ecx
push 0x8000
lea eax, [ebp - 0x808c]
push eax
push dword [ebp - 0x10]
call sub.KERNEL32.DLL_ReadFile
test eax, eax
je 0x4ef43a
mov edx, dword [ebp - 0x24]
test edx, edx
jne 0x4ef446
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x6d
je 0x4ef47c
jmp 0x4ef46b
mov ecx, dword [ebp - 0x24]
mov byte [ebp + ecx - 0x808c], 0
lea edx, [ebp - 0x808c]
mov eax, dword [ebp - 4]
call fcn.004ef048
jmp 0x4ef46b
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x6d
je 0x4ef47c
mov ecx, dword [ebp - 4]
mov al, byte [ecx + 0x7ec]
test al, al
je 0x4ef3be
mov edx, dword [ebp - 4]
mov cl, byte [edx + 0x7ec]
test cl, cl
je 0x4ef4b7
push 0xffffffffffffffff
push dword [ebp - 0x48]
call sub.KERNEL32.DLL_TerminateProcess
push dword [ebp - 0x48]
call sub.KERNEL32.DLL_CloseHandle
push 0x5dcd
call fcn.00402b9c
pop ecx
mov edx, eax
mov ecx, 3
mov eax, dword [ebp - 4]
call fcn.004e8800
jmp 0x4ef4c9
push 0xffffffffffffffff
push dword [ebp - 0x48]
call sub.KERNEL32.DLL_WaitForSingleObject
push dword [ebp - 0x48]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 0x10]
call sub.KERNEL32.DLL_CloseHandle
test eax, eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x7ec], 0
xor edx, edx
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x31c]
call fcn.00658614
mov eax, 1
mov esp, ebp
pop ebp
ret