Function at 0x7ae750
Capabilities:
Check for time delay via gettickcount
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create two anonymous pipes
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff74
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0x8c], ebx
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x80], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, dword [ebp + 0x18]
mov eax, dword [ebp - 4]
call fcn.0040a874
mov eax, dword [ebp - 8]
call fcn.0040a874
xor eax, eax
push ebp
push 0x7aeab9
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
cmp esi, 0x1388
jge 0x7ae7ad
mov esi, 0x1388
push 0x7aeadc
push dword [ebp - 4]
push 0x7aeafc
push dword [ebp - 8]
lea eax, [ebp - 0x80]
mov edx, 4
call fcn.0040baec
mov edx, dword [ebp - 0x80]
mov eax, ebx
call fcn.0079e8a0
mov eax, dword [0x8c007c]
mov dword [ebx + 0xe4], eax
mov dword [ebp - 0x7c], 0xc
mov dword [ebp - 0x74], 0xffffffff
xor eax, eax
mov dword [ebp - 0x78], eax
push 0
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_CreatePipe
test eax, eax
je 0x7aea8e
xor eax, eax
push ebp
push 0x7aea87
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
call sub.KERNEL32.DLL_CreatePipe
test eax, eax
je 0x7aea67
xor eax, eax
push ebp
push 0x7aea60
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x60]
xor ecx, ecx
mov edx, 0x44
call fcn.00407f88
lea eax, [ebp - 0x70]
xor ecx, ecx
mov edx, 0x10
call fcn.00407f88
mov dword [ebp - 0x60], 0x44
mov dword [ebp - 0x34], 0x101
movzx eax, word [ebp + 0x1c]
mov word [ebp - 0x30], ax
xor eax, eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x60]
push eax
push 0
push 0
push 0x4000030
push 0xffffffffffffffff
push 0
push 0
push 0x7aeb0c
push dword [ebp - 4]
push 0x7aeb0c
push 0x7aeafc
push dword [ebp - 8]
lea eax, [ebp - 0x84]
mov edx, 5
call fcn.0040baec
mov eax, dword [ebp - 0x84]
call fcn.0040b7f8
push eax
push 0
call sub.KERNEL32.DLL_CreateProcessW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 9], al
call sub.KERNEL32.DLL_GetLastError_2
mov dword [ebx + 0xb1], eax
cmp byte [ebp - 9], 0
jne 0x7ae901
call fcn.00409f88
call fcn.00409f88
jmp 0x7aea8e
test esi, esi
jle 0x7aea10
call sub.KERNEL32.DLL_GetTickCount_1
mov edi, eax
jmp 0x7ae945
mov eax, dword [0x8c1264]
mov eax, dword [eax]
call fcn.005efad0
push ebp
mov cl, 1
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x10]
call fcn.007ae5b0
pop ecx
push ebp
mov cl, 1
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x18]
call fcn.007ae5b0
pop ecx
cmp byte [ebx + 0xb6], 0
jne 0x7ae978
push 0x64
mov eax, dword [ebp - 0x70]
push eax
call sub.KERNEL32.DLL_WaitForSingleObject
cmp eax, 0x102
jne 0x7ae978
call sub.KERNEL32.DLL_GetTickCount_1
sub eax, edi
xor edx, edx
push edx
push eax
mov eax, esi
cdq
cmp edx, dword [esp + 4]
jne 0x7ae974
cmp eax, dword [esp]
pop edx
pop eax
ja 0x7ae912
jmp 0x7ae978
pop edx
pop eax
jg 0x7ae912
push 0
mov eax, dword [ebp - 0x70]
push eax
call sub.KERNEL32.DLL_WaitForSingleObject
cmp eax, 0x102
sete al
and al, byte [ebp + 0x14]
je 0x7aea00
push ebp
mov cl, 1
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x10]
call fcn.007ae5b0
pop ecx
push ebp
mov cl, 1
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x18]
call fcn.007ae5b0
pop ecx
push 0x7aeb1c
lea edx, [ebp - 0x8c]
mov eax, esi
call fcn.00424120
push dword [ebp - 0x8c]
push 0x7aeb3c
lea eax, [ebp - 0x88]
mov edx, 3
call fcn.0040baec
mov edx, dword [ebp - 0x88]
mov eax, ebx
call fcn.0079e8a0
push 0
mov eax, dword [ebp - 0x70]
push eax
call sub.KERNEL32.DLL_TerminateProcess
mov eax, dword [0x8c0080]
mov dword [ebx + 0xe4], eax
jmp 0x7aea10
lea eax, [ebx + 0xe4]
push eax
mov eax, dword [ebp - 0x70]
push eax
call sub.KERNEL32.DLL_GetExitCodeProcess
push ebp
mov cl, 1
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x10]
call fcn.007ae5b0
pop ecx
push ebp
mov cl, 1
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x18]
call fcn.007ae5b0
pop ecx
mov eax, dword [ebp - 0x6c]
push eax
call sub.KERNEL32.DLL_CloseHandle_1
mov eax, dword [ebp - 0x70]
push eax
call sub.KERNEL32.DLL_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7aea67
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_CloseHandle_1
mov eax, dword [ebp - 0x14]
push eax
call sub.KERNEL32.DLL_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7aea8e
mov eax, dword [ebp - 0x18]
push eax
call sub.KERNEL32.DLL_CloseHandle_1
mov eax, dword [ebp - 0x1c]
push eax
call sub.KERNEL32.DLL_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7aeac0
lea eax, [ebp - 0x8c]
mov edx, 4
call fcn.0040a7f0
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040a7f0
ret