Function at 0x4132fa
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create thread
Create two anonymous pipes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
push ebx
push esi
push edi
mov ecx, 0x420568
call fcn.0041356e
xor edi, edi
mov dword [ebp - 0x24], 0xc
push edi
lea eax, [ebp - 0x24]
mov dword [ebp - 8], edi
push eax
lea eax, [ebp - 4]
mov dword [ebp - 0xc], edi
push eax
lea eax, [ebp - 8]
mov dword [ebp - 4], edi
push eax
mov dword [ebp - 0x10], edi
mov esi, edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], 1
call dword [sym.imp.KERNEL32.dll_CreatePipe]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x41350d
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edi, dword [ebp - 4]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 2
push 1
xor ecx, ecx
push ecx
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0xc]
push ecx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor edi, edi
test eax, eax
je 0x41350a
push edi
lea eax, [ebp - 0x24]
mov esi, edi
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x41350d
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edi, dword [ebp - 8]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 2
xor ecx, ecx
push ecx
push ecx
push 0x420570
push esi
push edi
push eax
mov dword [ebp - 0x18], ecx
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x413508
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edi, dword [ebp - 0x10]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 2
xor ecx, ecx
push ecx
push ecx
push 0x420574
push esi
push edi
push eax
mov dword [ebp - 0x18], ecx
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x413508
cmp dword [ebp - 8], 0
je 0x41340c
push dword [ebp - 8]
call ebx
and dword [ebp - 8], 0
cmp dword [ebp - 0x10], 0
je 0x41341b
push dword [ebp - 0x10]
call ebx
and dword [ebp - 0x10], 0
lea eax, [ebp + 8]
mov ebx, dword [ebp - 0xc]
lea ecx, [ebp - 0x18]
mov edi, dword [ebp - 0x14]
mov esi, dword [ebp - 4]
push eax
call fcn.00403611
push 0x44
lea eax, [ebp - 0x78]
push 0
push eax
call fcn.004012cf
add esp, 0xc
mov dword [ebp - 0x40], edi
xor eax, eax
mov dword [ebp - 0x78], 0x44
mov word [ebp - 0x48], ax
xor edi, edi
lea eax, [ebp - 0x34]
mov dword [ebp - 0x3c], esi
push eax
lea eax, [ebp - 0x78]
mov dword [ebp - 0x38], ebx
push eax
push edi
push edi
push 0x410
push 1
push edi
push edi
push edi
push dword [ebp - 0x18]
mov dword [ebp - 0x4c], 0x101
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ecx, dword [ebp - 0x18]
test eax, eax
jne 0x413496
call fcn.004068b7
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, edi
jmp 0x41350d
mov eax, dword [ebp - 0x34]
mov dword [0x42056c], eax
call fcn.004068b7
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], edi
je 0x4134b3
push dword [ebp - 4]
call ebx
mov dword [ebp - 4], edi
cmp dword [ebp - 0x14], edi
je 0x4134c0
push dword [ebp - 0x14]
call ebx
mov dword [ebp - 0x14], edi
cmp dword [ebp - 0xc], edi
je 0x4134cd
push dword [ebp - 0xc]
call ebx
push edi
push edi
push 1
push edi
mov dword [ebp - 0xc], edi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0x420580
push edi
push 0x420568
push 0x413787
push edi
push edi
mov dword [0x420578], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x42057c], eax
mov esi, edi
test eax, eax
je 0x41350d
xor esi, esi
inc esi
jmp 0x41355d
xor edi, edi
mov esi, dword [ebp - 0x18]
cmp dword [ebp - 8], 0
je 0x413518
push dword [ebp - 8]
call ebx
cmp dword [ebp - 4], 0
mov dword [ebp - 8], edi
je 0x413526
push dword [ebp - 4]
call ebx
cmp dword [ebp - 0xc], 0
mov dword [ebp - 4], edi
je 0x413534
push dword [ebp - 0xc]
call ebx
cmp dword [ebp - 0x10], 0
mov dword [ebp - 0xc], edi
je 0x413542
push dword [ebp - 0x10]
call ebx
cmp dword [ebp - 0x14], 0
mov dword [ebp - 0x10], edi
je 0x413550
push dword [ebp - 0x14]
call ebx
mov ecx, 0x420568
mov dword [ebp - 0x14], edi
call fcn.0041356e
mov ecx, dword [ebp + 8]
call fcn.004068b7
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4