Function at 0x26a9f4
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create two anonymous pipes
Read file on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x41b
push 0
push 0
dec ecx
jne 0x26a9fd
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov byte [ebp - 1], cl
mov edi, edx
mov esi, eax
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x26af70
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
call fcn.0010507c
lea eax, [ebp - 0x2c]
call fcn.0010507c
mov dword [ebp - 0x2094], 0xc
xor eax, eax
mov dword [ebp - 0x2090], eax
mov dword [ebp - 0x208c], 0xffffffff
push 0
lea eax, [ebp - 0x2094]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
call sub.kernel32.dll_CreatePipe
test eax, eax
jne 0x26aa8f
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x2098]
call fcn.0010fbd4
mov ecx, dword [ebp - 0x2098]
mov eax, ebx
mov edx, 0x26af88
call fcn.001053a4
jmp 0x26af45
push 2
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x24]
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_DuplicateHandle
test eax, eax
jne 0x26aad9
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x209c]
call fcn.0010fbd4
mov ecx, dword [ebp - 0x209c]
mov eax, ebx
mov edx, 0x26afa8
call fcn.001053a4
jmp 0x26af45
push 0
lea eax, [ebp - 0x2094]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
call sub.kernel32.dll_CreatePipe
test eax, eax
jne 0x26ab1a
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x20a0]
call fcn.0010fbd4
mov ecx, dword [ebp - 0x20a0]
mov eax, ebx
mov edx, 0x26afcc
call fcn.001053a4
jmp 0x26af45
push 2
push 0
push 0
lea eax, [ebp - 0x10]
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_DuplicateHandle
test eax, eax
jne 0x26ab64
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x20a4]
call fcn.0010fbd4
mov ecx, dword [ebp - 0x20a4]
mov eax, ebx
mov edx, 0x26afec
call fcn.001053a4
jmp 0x26af45
push 2
push 0
push 0
lea eax, [ebp - 0x20]
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_DuplicateHandle
test eax, eax
jne 0x26abae
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x20a8]
call fcn.0010fbd4
mov ecx, dword [ebp - 0x20a8]
mov eax, ebx
mov edx, 0x26b010
call fcn.001053a4
jmp 0x26af45
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
test eax, eax
jne 0x26abe2
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x20ac]
call fcn.0010fbd4
mov ecx, dword [ebp - 0x20ac]
mov eax, ebx
mov edx, 0x26b034
call fcn.001053a4
jmp 0x26af45
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_CloseHandle_1
test eax, eax
jne 0x26ac16
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x20b0]
call fcn.0010fbd4
mov ecx, dword [ebp - 0x20b0]
mov eax, ebx
mov edx, 0x26b054
call fcn.001053a4
jmp 0x26af45
lea eax, [ebp - 0x74]
xor ecx, ecx
mov edx, 0x44
call fcn.001039a0
mov dword [ebp - 0x74], 0x44
mov dword [ebp - 0x48], 0x101
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x74]
push eax
mov eax, edi
call fcn.00105558
push eax
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
mov eax, esi
call fcn.00105558
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x26ac9c
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x20b4]
call fcn.0010fbd4
mov ecx, dword [ebp - 0x20b4]
mov eax, ebx
mov edx, 0x26b074
call fcn.001053a4
jmp 0x26af45
mov eax, dword [ebp - 0x80]
push eax
call sub.kernel32.dll_CloseHandle_1
test eax, eax
jne 0x26acd0
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x20b8]
call fcn.0010fbd4
mov ecx, dword [ebp - 0x20b8]
mov eax, ebx
mov edx, 0x26b094
call fcn.001053a4
jmp 0x26af45
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_CloseHandle_1
test eax, eax
jne 0x26ad04
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x20bc]
call fcn.0010fbd4
mov ecx, dword [ebp - 0x20bc]
mov eax, ebx
mov edx, 0x26b0b4
call fcn.001053a4
jmp 0x26af45
mov eax, dword [ebp - 0x1c]
push eax
call sub.kernel32.dll_CloseHandle_1
test eax, eax
jne 0x26ad38
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x20c0]
call fcn.0010fbd4
mov ecx, dword [ebp - 0x20c0]
mov eax, ebx
mov edx, 0x26b0d4
call fcn.001053a4
jmp 0x26af45
mov eax, dword [ebp - 0x24]
push eax
call sub.kernel32.dll_CloseHandle_1
test eax, eax
jne 0x26ad6c
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x20c4]
call fcn.0010fbd4
mov ecx, dword [ebp - 0x20c4]
mov eax, ebx
mov edx, 0x26b0f4
call fcn.001053a4
jmp 0x26af45
mov byte [ebp - 0x2d], 0
cmp word [ebp + 0xe], 0
je 0x26ad80
lea edx, [ebp - 0x2d]
mov eax, dword [ebp + 0x10]
call dword [ebp + 0xc]
cmp byte [ebp - 0x2d], 0
je 0x26ad99
push 1
mov eax, dword [ebp - 0x84]
push eax
call sub.kernel32.dll_TerminateProcess
jmp 0x26ae63
push 0
lea eax, [ebp - 8]
push eax
push 0x2000
lea eax, [ebp - 0x2085]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x26adbe
cmp dword [ebp - 8], 0
jne 0x26adcc
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x6d
je 0x26ae63
mov eax, dword [ebp - 8]
mov byte [ebp + eax - 0x2085], 0
lea eax, [ebp - 0x20c8]
lea edx, [ebp - 0x2085]
call fcn.00105274
mov edx, dword [ebp - 0x20c8]
lea eax, [ebp - 0x28]
call fcn.00105360
cmp word [ebp + 0x16], 0
je 0x26ad70
lea eax, [ebp - 0x20cc]
lea edx, [ebp - 0x2085]
call fcn.00105274
mov edx, dword [ebp - 0x20cc]
lea eax, [ebp - 0x2c]
call fcn.00105360
mov eax, dword [ebp - 0x2c]
call fcn.00105358
mov edx, dword [ebp - 0x2c]
cmp byte [edx + eax - 1], 0xa
jne 0x26ad70
mov eax, dword [ebp - 0x2c]
call fcn.00105358
mov edx, eax
lea eax, [ebp - 0x2c]
mov ecx, 1
call fcn.001055f8
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp + 0x18]
call dword [ebp + 0x14]
lea eax, [ebp - 0x2c]
call fcn.0010507c
jmp 0x26ad70
cmp byte [ebp - 1], 0
je 0x26aea7
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x84]
push eax
call sub.kernel32.dll_GetExitCodeProcess
push dword [ebp - 0x28]
push 0x26b114
mov eax, dword [ebp - 8]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x20d0]
call fcn.0010c298
push dword [ebp - 0x20d0]
mov eax, ebx
mov edx, 3
call fcn.00105418
jmp 0x26aeb1
mov eax, ebx
mov edx, dword [ebp - 0x28]
call fcn.001050d0
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
test eax, eax
jne 0x26aee2
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x20d4]
call fcn.0010fbd4
mov ecx, dword [ebp - 0x20d4]
mov eax, ebx
mov edx, 0x26b120
call fcn.001053a4
jmp 0x26af45
mov eax, dword [ebp - 0x20]
push eax
call sub.kernel32.dll_CloseHandle_1
test eax, eax
jne 0x26af13
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x20d8]
call fcn.0010fbd4
mov ecx, dword [ebp - 0x20d8]
mov eax, ebx
mov edx, 0x26b140
call fcn.001053a4
jmp 0x26af45
mov eax, dword [ebp - 0x84]
push eax
call sub.kernel32.dll_CloseHandle_1
test eax, eax
jne 0x26af45
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x20dc]
call fcn.0010fbd4
mov ecx, dword [ebp - 0x20dc]
mov eax, ebx
mov edx, 0x26b160
call fcn.001053a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x26af77
lea eax, [ebp - 0x20dc]
mov edx, 0x12
call fcn.001050a0
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.001050a0
ret