Function at 0x468138
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffb68
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x494], ecx
mov dword [ebp - 0x498], ecx
mov dword [ebp - 0x480], ecx
mov dword [ebp - 0x47c], ecx
mov dword [ebp - 0x14], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4683b8
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4683d0
push ebx
push 0x4683e0
lea eax, [ebp - 0x47c]
mov edx, 3
call fcn.00404d80
mov eax, dword [ebp - 0x47c]
call fcn.00466950
mov byte [ebp - 0x76], 0
lea eax, [ebp - 0x58]
xor ecx, ecx
mov edx, 0x44
call fcn.0040351c
mov dword [ebp - 0x58], 0x44
lea eax, [ebp - 0x74]
xor ecx, ecx
mov edx, 0xc
call fcn.0040351c
mov dword [ebp - 0x74], 0xc
mov dword [ebp - 0x6c], 0xffffffff
xor eax, eax
mov dword [ebp - 0x70], eax
push 0
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_CreatePipe
xor eax, eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov word [ebp - 0x28], si
mov dword [ebp - 0x2c], 0x101
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x58]
push eax
push 0
push 0
push 0x4000030
push 0xffffffffffffffff
push 0
push 0
mov eax, ebx
call fcn.00404ec0
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x46825e
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
mov dword [ebp - 4], 0xffffffff
jmp 0x468382
mov eax, dword [0x46c2ac]
mov eax, dword [eax]
call fcn.00458cd8
push 0x32
call sub.kernel32.dll_Sleep_1
push 0
mov eax, dword [ebp - 0x68]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
je 0x46824b
push 0xffffffffffffffff
mov eax, dword [ebp - 0x68]
push eax
call sub.kernel32.dll_WaitForSingleObject
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x68]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
push 0
lea eax, [ebp - 0x10]
push eax
push 0x400
lea eax, [ebp - 0x476]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_ReadFile_1
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x468329
cmp dword [ebp - 0x10], 0x400
jae 0x4682ca
mov eax, dword [ebp - 0x10]
mov byte [ebp + eax - 0x476], 0
lea eax, [ebp - 0x14]
lea edx, [ebp - 0x476]
call fcn.00404bf8
lea eax, [ebp - 0x480]
push eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x490], eax
mov byte [ebp - 0x48c], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x488], eax
mov byte [ebp - 0x484], 0xb
lea edx, [ebp - 0x490]
mov ecx, 1
mov eax, 0x4683f0
call fcn.00409e54
mov eax, dword [ebp - 0x480]
call fcn.00466950
cmp dword [ebp - 0x10], 0
jne 0x468291
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x68]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x64]
push eax
call sub.kernel32.dll_CloseHandle_1
push 0x4683d0
push ebx
push 0x468408
mov eax, dword [ebp - 4]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x498]
call fcn.00409008
push dword [ebp - 0x498]
lea eax, [ebp - 0x494]
mov edx, 4
call fcn.00404d80
mov eax, dword [ebp - 0x494]
call fcn.00466950
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4683bf
lea eax, [ebp - 0x498]
mov edx, 2
call fcn.00404a24
lea eax, [ebp - 0x480]
mov edx, 2
call fcn.00404a24
lea eax, [ebp - 0x14]
call fcn.00404a00
ret