Function at 0x402b70
Capabilities:
Create pipe
Create thread
Create two anonymous pipes

Disassembly:
sub esp, 0x24
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreatePipe]
push 0
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x2c], 0xc
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 1
call ebx
test eax, eax
jne 0x402bba
mov ebx, 0x412698
call fcn.00401090
xor eax, eax
pop ebx
add esp, 0x24
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push edi
push 2
push 1
push 0
lea eax, [esp + 0x1c]
push eax
call esi
mov ecx, dword [esp + 0x1c]
push eax
push ecx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push eax
call edi
test eax, eax
jne 0x402c0b
mov ebx, 0x4126a4
call fcn.00401090
mov edx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 0xc]
push eax
call esi
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x24
ret
push 0
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x20]
push eax
call ebx
test eax, eax
jne 0x402c50
mov ebx, 0x412698
call fcn.00401090
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 0xc]
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call esi
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x24
ret
push 2
push 0
push 0
push 0x416ca8
call esi
mov ecx, dword [esp + 0x28]
push eax
push ecx
call esi
push eax
call edi
test eax, eax
jne 0x402ca8
mov ebx, str.DupliateHandle
call fcn.00401090
mov edx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 0xc]
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call esi
mov edx, dword [esp + 0x14]
push edx
call esi
mov eax, dword [esp + 0x1c]
push eax
call esi
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x24
ret
push 2
push 0
push 0
push 0x416cb0
call esi
mov ecx, dword [esp + 0x2c]
push eax
push ecx
call esi
push eax
call edi
test eax, eax
jne 0x402d09
mov ebx, str.DupliateHandle
call fcn.00401090
mov edx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 0xc]
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call esi
mov edx, dword [esp + 0x14]
push edx
call esi
mov eax, dword [esp + 0x1c]
push eax
call esi
mov ecx, dword [0x416ca8]
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x24
ret
mov edx, dword [esp + 0x18]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call ebp
test eax, eax
jne 0x402d5c
mov ebx, str.CloseHandle__1_
call fcn.00401090
mov eax, dword [0x416cb0]
push eax
call ebp
mov ecx, dword [esp + 0x10]
push ecx
call ebp
mov edx, dword [esp + 0x14]
push edx
call ebp
mov eax, dword [esp + 0x18]
push eax
call ebp
mov ecx, dword [esp + 0x20]
push ecx
call ebp
mov edx, dword [0x416ca8]
push edx
call ebp
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x24
ret
mov eax, dword [esp + 0x20]
push eax
call ebp
test eax, eax
jne 0x402da2
mov ebx, str.CloseHandle__2_
call fcn.00401090
mov ecx, dword [0x416cb0]
push ecx
call ebp
mov edx, dword [esp + 0x10]
push edx
call ebp
mov eax, dword [esp + 0x14]
push eax
call ebp
mov ecx, dword [esp + 0x18]
push ecx
call ebp
mov edx, dword [0x416ca8]
push edx
call ebp
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x24
ret
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp eax, 0xffffffff
mov dword [0x415b2c], eax
jne 0x402dee
mov ebx, 0x4126e4
call fcn.00401090
mov eax, dword [0x416cb0]
push eax
call ebp
mov ecx, dword [esp + 0x10]
push ecx
call ebp
mov edx, dword [esp + 0x14]
push edx
call ebp
mov eax, dword [esp + 0x18]
push eax
call ebp
mov ecx, dword [0x416ca8]
push ecx
call ebp
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x24
ret
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
mov esi, dword [esp + 0x3c]
mov edi, dword [esp + 0x38]
push edx
push eax
mov eax, dword [esp + 0x48]
push ecx
call fcn.00402fb0
add esp, 0xc
test eax, eax
jne 0x402e45
mov edx, dword [0x416cb0]
push edx
call ebp
mov eax, dword [esp + 0x10]
push eax
call ebp
mov ecx, dword [esp + 0x14]
push ecx
call ebp
mov edx, dword [esp + 0x18]
push edx
call ebp
mov eax, dword [0x416ca8]
push eax
call ebp
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x24
ret
mov ecx, dword [esp + 0x10]
push ecx
call ebp
test eax, eax
je 0x402ebe
mov edx, dword [esp + 0x18]
push edx
call ebp
test eax, eax
je 0x402ebe
mov eax, dword [esp + 0x14]
push eax
call ebp
test eax, eax
je 0x402ebe
mov edx, dword [0x416ca8]
lea ecx, [esp + 0x24]
push ecx
push 0
push edx
push 0x403080
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [0x416cac], eax
jne 0x402eb1
mov eax, dword [0x416cb0]
push eax
call ebp
mov ecx, dword [0x416ca8]
push ecx
call ebp
mov ebx, 0x412704
call fcn.00401090
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x24
ret
pop ebp
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x24
ret
mov edx, dword [0x416cb0]
push edx
call ebp
mov eax, dword [0x416ca8]
push eax
call ebp
mov ebx, str.CloseHandles
call fcn.00401090
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x24
ret