Function at 0x40dafc
Capabilities:
Create pipe
Create two anonymous pipes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
mov eax, 0x4e6ef8
call fcn.004ccad8
mov dword [ebp - 0x14], 1
lea edx, [ebp + 0xc]
lea eax, [ebp + 0xc]
call fcn.004d9c5c
inc dword [ebp - 0x14]
mov word [ebp - 0x20], 0xc
mov dword [ebp - 0x40], 0xc
mov dword [ebp - 0x38], 1
xor edx, edx
mov dword [ebp - 0x3c], edx
push 0
lea ecx, [ebp - 0x40]
push ecx
mov eax, dword [ebp + 8]
add eax, 0xc
push eax
mov edx, dword [ebp + 8]
add edx, 8
push edx
call sub.KERNEL32.DLL_CreatePipe
test eax, eax
jne 0x40dbae
mov word [ebp - 0x20], 0x18
mov edx, str.Stdout_pipe_creation_failed
lea eax, [ebp - 4]
call fcn.004d9c24
inc dword [ebp - 0x14]
lea edx, [ebp - 4]
mov eax, dword [ebp + 8]
add eax, 0x18
call fcn.004d9df0
dec dword [ebp - 0x14]
lea eax, [ebp - 4]
mov edx, 2
call fcn.004d9dc0
xor eax, eax
push eax
dec dword [ebp - 0x14]
lea eax, [ebp + 0xc]
mov edx, 2
call fcn.004d9dc0
pop eax
mov edx, dword [ebp - 0x30]
mov dword fs:[0], edx
jmp 0x40dd62
push 0
push 1
mov ecx, dword [ebp + 8]
push dword [ecx + 8]
call sub.KERNEL32.DLL_SetHandleInformation
push 0
lea eax, [ebp - 0x40]
push eax
mov edx, dword [ebp + 8]
add edx, 4
push edx
push dword [ebp + 8]
call sub.KERNEL32.DLL_CreatePipe
test eax, eax
jne 0x40dc2d
mov word [ebp - 0x20], 0x24
mov edx, str.Stdin_pipe_creation_failed
lea eax, [ebp - 8]
call fcn.004d9c24
inc dword [ebp - 0x14]
lea edx, [ebp - 8]
mov eax, dword [ebp + 8]
add eax, 0x18
call fcn.004d9df0
dec dword [ebp - 0x14]
lea eax, [ebp - 8]
mov edx, 2
call fcn.004d9dc0
xor eax, eax
push eax
dec dword [ebp - 0x14]
lea eax, [ebp + 0xc]
mov edx, 2
call fcn.004d9dc0
pop eax
mov edx, dword [ebp - 0x30]
mov dword fs:[0], edx
jmp 0x40dd62
push 0
push 1
mov ecx, dword [ebp + 8]
push dword [ecx + 4]
call sub.KERNEL32.DLL_SetHandleInformation
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040d838
add esp, 8
and eax, 0xff
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jne 0x40dcaf
mov word [ebp - 0x20], 0x30
mov edx, str.Create_process_failed_with
lea eax, [ebp - 0xc]
call fcn.004d9c24
inc dword [ebp - 0x14]
lea edx, [ebp - 0xc]
mov eax, dword [ebp + 8]
add eax, 0x18
call fcn.004d9df0
dec dword [ebp - 0x14]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004d9dc0
xor eax, eax
push eax
dec dword [ebp - 0x14]
lea eax, [ebp + 0xc]
mov edx, 2
call fcn.004d9dc0
pop eax
mov edx, dword [ebp - 0x30]
mov dword fs:[0], edx
jmp 0x40dd62
cmp dword [ebp + 0x14], 0
je 0x40dcce
mov ecx, dword [ebp + 8]
push dword [ecx + 0x10]
mov eax, dword [ebp + 8]
push dword [eax + 0x14]
push 0x7e9
push dword [ebp + 0x14]
call sub.USER32.DLL_SendMessageA
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.0040d97c
add esp, 0xc
push 0xfa0
mov edx, dword [ebp + 8]
push dword [edx + 0x10]
call sub.KERNEL32.DLL_WaitForSingleObject
mov ecx, dword [ebp + 8]
add ecx, 0x1c
push ecx
mov eax, dword [ebp + 8]
push dword [eax + 0x10]
call sub.KERNEL32.DLL_GetExitCodeProcess
test eax, eax
jne 0x40dd0f
mov edx, dword [ebp + 8]
mov dword [edx + 0x1c], 0xffffffff
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x1c], 0x103
jne 0x40dd25
mov eax, dword [ebp + 8]
mov dword [eax + 0x1c], 0xffffffff
cmp dword [ebp + 0x14], 0
je 0x40dd44
mov edx, dword [ebp + 8]
push dword [edx + 0x10]
mov ecx, dword [ebp + 8]
push dword [ecx + 0x14]
push 0x7ea
push dword [ebp + 0x14]
call sub.USER32.DLL_SendMessageA
mov al, 1
push eax
dec dword [ebp - 0x14]
lea eax, [ebp + 0xc]
mov edx, 2
call fcn.004d9dc0
pop eax
mov edx, dword [ebp - 0x30]
mov dword fs:[0], edx
mov esp, ebp
pop ebp
ret