Function at 0x4eed80
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Read file on windows
Read pipe
Terminate process

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 8
add esp, 0xfffff004
push eax
dec eax
jne 0x4eed89
mov eax, dword [ebp - 4]
add esp, 0xffffff5c
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov dword [ebp - 0x38], 0xc
xor eax, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], 1
push 0
lea edx, [ebp - 0x38]
push edx
lea ecx, [ebp - 0x14]
push ecx
lea eax, [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_CreatePipe
test eax, eax
jne 0x4eeded
push 0x5dcb
call fcn.00402a64
pop ecx
mov edx, eax
mov ecx, 2
mov eax, dword [ebp - 4]
call fcn.004e83e4
xor eax, eax
jmp 0x4ef0d6
push 2
push 1
push 0
lea edx, [ebp - 0x18]
push edx
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
push dword [ebp - 0x14]
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call sub.KERNEL32.DLL_DuplicateHandle
test eax, eax
jne 0x4eee30
push 0x5dcb
call fcn.00402a64
pop ecx
mov edx, eax
mov ecx, 2
mov eax, dword [ebp - 4]
call fcn.004e83e4
xor eax, eax
jmp 0x4ef0d6
push 2
push 0
push 0
lea edx, [ebp - 0x10]
push edx
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
push dword [ebp - 0xc]
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call sub.KERNEL32.DLL_DuplicateHandle
test eax, eax
jne 0x4eee73
push 0x5dcb
call fcn.00402a64
pop ecx
mov edx, eax
mov ecx, 2
mov eax, dword [ebp - 4]
call fcn.004e83e4
xor eax, eax
jmp 0x4ef0d6
push dword [ebp - 0xc]
call sub.KERNEL32.DLL_CloseHandle
test eax, eax
push 0x44
push 0
lea edx, [ebp - 0x8c]
push edx
call fcn.0066c86c
add esp, 0xc
mov dword [ebp - 0x8c], 0x44
mov dword [ebp - 0x60], 0x101
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x50], ecx
push 0xfffffffffffffff6
call sub.KERNEL32.DLL_GetStdHandle
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x4c], eax
mov word [ebp - 0x5c], 0
push 0x5dca
call fcn.00402a64
pop ecx
mov edx, eax
mov ecx, 1
mov eax, dword [ebp - 4]
call fcn.004e83e4
lea edx, [ebp - 0x48]
push edx
lea ecx, [ebp - 0x8c]
push ecx
push 0
push 0
push 0x10
push 1
push 0
push 0
push dword [ebp - 8]
push 0
call sub.KERNEL32.DLL_CreateProcessA
test eax, eax
jne 0x4eef1d
push 0x5dcb
call fcn.00402a64
pop ecx
mov edx, eax
mov ecx, 2
mov eax, dword [ebp - 4]
call fcn.004e83e4
xor eax, eax
jmp 0x4ef0d6
push dword [ebp - 0x44]
call sub.KERNEL32.DLL_CloseHandle
test eax, eax
push dword [ebp - 0x14]
call sub.KERNEL32.DLL_CloseHandle
test eax, eax
push dword [ebp - 0x18]
call sub.KERNEL32.DLL_CloseHandle
test eax, eax
xor edx, edx
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x31c]
call fcn.006581dc
mov edx, 0x3e8
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x31c]
call fcn.006581e8
xor edx, edx
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x31c]
call fcn.006581f8
mov edx, dword [ebp - 4]
mov byte [edx + 0x7ec], 0
mov ecx, dword [ebp - 4]
xor eax, eax
mov dword [ecx + 0xa0c], eax
jmp 0x4ef04f
lea edx, [ebp - 0x80a8]
push edx
call sub.USER32.DLL_TranslateMessage
lea ecx, [ebp - 0x80a8]
push ecx
call sub.USER32.DLL_DispatchMessageA
mov eax, dword [ebp - 4]
mov dl, byte [eax + 0x7ec]
test dl, dl
jne 0x4eefc7
push 1
push 0
push 0
push 0
lea ecx, [ebp - 0x80a8]
push ecx
call sub.USER32.DLL_PeekMessageA
test eax, eax
jne 0x4eef8a
mov eax, dword [ebp - 4]
mov dl, byte [eax + 0x7ec]
test dl, dl
jne 0x4ef060
lea ecx, [ebp - 0x2c]
push ecx
lea eax, [ebp - 0x28]
push eax
push 0
push 0
push 0
push dword [ebp - 0x10]
call sub.KERNEL32.DLL_PeekNamedPipe
test eax, eax
je 0x4ef045
mov edx, dword [ebp - 0x28]
test edx, edx
jbe 0x4ef04f
push 0
lea ecx, [ebp - 0x24]
push ecx
push 0x8000
lea eax, [ebp - 0x808c]
push eax
push dword [ebp - 0x10]
call sub.KERNEL32.DLL_ReadFile
test eax, eax
je 0x4ef01e
mov edx, dword [ebp - 0x24]
test edx, edx
jne 0x4ef02a
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x6d
je 0x4ef060
jmp 0x4ef04f
mov ecx, dword [ebp - 0x24]
mov byte [ebp + ecx - 0x808c], 0
lea edx, [ebp - 0x808c]
mov eax, dword [ebp - 4]
call fcn.004eec2c
jmp 0x4ef04f
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x6d
je 0x4ef060
mov ecx, dword [ebp - 4]
mov al, byte [ecx + 0x7ec]
test al, al
je 0x4eefa2
mov edx, dword [ebp - 4]
mov cl, byte [edx + 0x7ec]
test cl, cl
je 0x4ef09b
push 0xffffffffffffffff
push dword [ebp - 0x48]
call sub.KERNEL32.DLL_TerminateProcess
push dword [ebp - 0x48]
call sub.KERNEL32.DLL_CloseHandle
push 0x5dcd
call fcn.00402a64
pop ecx
mov edx, eax
mov ecx, 3
mov eax, dword [ebp - 4]
call fcn.004e83e4
jmp 0x4ef0ad
push 0xffffffffffffffff
push dword [ebp - 0x48]
call sub.KERNEL32.DLL_WaitForSingleObject
push dword [ebp - 0x48]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 0x10]
call sub.KERNEL32.DLL_CloseHandle
test eax, eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x7ec], 0
xor edx, edx
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x31c]
call fcn.006581f8
mov eax, 1
mov esp, ebp
pop ebp
ret