Function at 0x49d8f0
Capabilities:
Create pipe
Create process on windows
Read file on windows
Read pipe

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1a094
call fcn.00666cc0
mov eax, dword [0x7e2670]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x1a090], ecx
mov eax, dword [ebp + 8]
push eax
push str.CUsePAXadb::ExecuteCmdLine
push str.in__s__cmdline_s_r_n
call fcn.0066610b
add esp, 0xc
call fcn.006684b5
add eax, 0x20
push eax
call fcn.00668459
add esp, 4
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 0xffffffff
mov dword [ebp - 0x1030], 0xc
mov dword [ebp - 0x102c], 0
mov dword [ebp - 0x1028], 1
push 0
lea edx, [ebp - 0x1030]
push edx
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x1010]
push ecx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x49d980
xor al, al
jmp 0x49dc53
push 0
push 1
mov edx, dword [ebp - 0x1010]
push edx
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov dword [ebp - 0x1078], 0x44
push 0x40
push 0
lea eax, [ebp - 0x1074]
push eax
call fcn.006665c0
add esp, 0xc
lea ecx, [ebp - 0x1078]
push ecx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov edx, dword [ebp - 4]
mov dword [ebp - 0x1038], edx
mov eax, dword [ebp - 4]
mov dword [ebp - 0x103c], eax
mov dword [ebp - 0x104c], 0x100
xor ecx, ecx
mov word [ebp - 0x1048], cx
mov dword [ebp - 0x1024], 0
xor edx, edx
mov dword [ebp - 0x1020], edx
mov dword [ebp - 0x101c], edx
mov dword [ebp - 0x1018], edx
mov byte [ebp - 0x1008], 0
push 0xfff
push 0
lea eax, [ebp - 0x1007]
push eax
call fcn.006665c0
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
call fcn.00666cf0
add esp, 4
cmp eax, 0xfff
jae 0x49da42
mov edx, dword [ebp + 8]
push edx
call fcn.00666cf0
add esp, 4
mov dword [ebp - 0x1a094], eax
jmp 0x49da4c
mov dword [ebp - 0x1a094], 0xfff
mov eax, dword [ebp - 0x1a094]
push eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x1008]
push edx
call fcn.00668860
add esp, 0xc
lea eax, [ebp - 0x1024]
push eax
lea ecx, [ebp - 0x1078]
push ecx
push 0
push 0
push 0x8000000
push 1
push 0
push 0
lea edx, [ebp - 0x1008]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x49db03
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1a08c], eax
push 0
push 0
lea eax, [ebp - 0x1a088]
push eax
push 0x400
mov ecx, dword [ebp - 0x1a08c]
push ecx
push 0
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, dword [ebp - 0x1a088]
push edx
mov eax, dword [ebp + 8]
push eax
push 0x70f040
call fcn.0066610b
add esp, 0xc
call fcn.006684b5
add eax, 0x20
push eax
call fcn.00668459
add esp, 4
mov ecx, dword [ebp - 0x1a088]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor al, al
jmp 0x49dc53
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x101c]
push eax
push 0x70f02c
call fcn.0066610b
add esp, 8
call fcn.006684b5
add eax, 0x20
push eax
call fcn.00668459
add esp, 4
mov dword [ebp - 0x100c], 0x19000
push 0x70d612
mov ecx, dword [ebp + 0x10]
call fcn.004047f0
mov byte [ebp - 0x1011], 0
mov dword [ebp - 0x1a084], 0
push 1
mov ecx, dword [ebp - 0x1024]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor edx, edx
cmp eax, 0x102
sete dl
mov byte [ebp - 0x1011], dl
push 0
lea eax, [ebp - 0x1a084]
push eax
push 0
push 0
push 0
mov ecx, dword [ebp - 0x1010]
push ecx
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
movzx edx, byte [ebp - 0x1011]
test edx, edx
jne 0x49dba9
cmp dword [ebp - 0x1a084], 0
jbe 0x49dc1b
cmp dword [ebp - 0x1a084], 0
jbe 0x49dc0e
push 0
lea eax, [ebp - 0x1a084]
push eax
mov ecx, dword [ebp - 0x1a084]
push ecx
lea edx, [ebp - 0x1a080]
push edx
mov eax, dword [ebp - 0x1010]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x49dbdc
jmp 0x49dc1b
mov ecx, dword [ebp - 0x1a084]
mov byte [ebp + ecx - 0x1a080], 0
cmp dword [ebp + 0x14], 0
je 0x49dbfd
lea edx, [ebp - 0x1a080]
push edx
call dword [ebp + 0x14]
add esp, 4
lea eax, [ebp - 0x1a080]
push eax
mov ecx, dword [ebp + 0x10]
call fcn.004138a0
jmp 0x49dc16
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x49db5a
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x1024]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [ebp - 0x1024]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1020]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x1010]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.006665ac
mov esp, ebp
pop ebp
ret 0x10