Function at 0x42ad6b
Capabilities:
Accept command line arguments
Create pipe
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd4
mov eax, dword [0x449014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0xd4]
mov dword [ebp - 0x30], ecx
xor ebx, ebx
mov dword [ebp - 0x3c], 0xc
push eax
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], 1
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
push 0x44
pop esi
push esi
lea eax, [ebp - 0x90]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
add esp, 0xc
mov dword [ebp - 0x90], esi
mov dword [ebp - 0x64], 0x100
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0xfffffffffffffff6
call esi
push 0xfffffffffffffff5
mov dword [ebp - 0x58], eax
call esi
push 0xfffffffffffffff4
mov dword [ebp - 0x54], eax
call esi
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x3c]
push ebx
push eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x1c], 1
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [sym.imp.KERNEL32.dll_RaiseException]
test eax, eax
je 0x43dfe4
mov dword [ebp - 0x1c], 1
push 0
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x43e036
call edi
mov edi, dword [ebp - 0x20]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 2
push 0
push 0
lea ecx, [ebp - 0x1c]
push ecx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x43e077
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edi, dword [ebp - 0x24]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 2
push 0
push 0
lea ecx, [ebp - 0x1c]
push ecx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x43e08b
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1c]
mov ecx, 0xbe
mov dword [ebp - 0x24], eax
call fcn.00426940
push dword [ebp - 0x28]
mov esi, eax
lea eax, [ebp - 0x18]
push 0x40163c
push 9
push eax
mov dword [ebp - 0x1c], esi
call fcn.0042aff8
lea eax, [ebp - 0x18]
push eax
push 0x4016d0
push 0x401630
push 0x5f
push esi
call fcn.0042aff8
push 0x5e
pop edi
push dword [ebp - 0x2c]
lea esi, [esi + eax*2]
sub edi, eax
push 0x40163c
lea eax, [ebp - 0x18]
add esi, 2
push 9
push eax
call fcn.0042aff8
lea eax, [ebp - 0x18]
push eax
push 0x4016a4
push 0x401630
push edi
push esi
call fcn.0042aff8
add esp, 0x48
sub edi, eax
lea esi, [esi + eax*2]
push dword [ebp - 0x30]
add esi, 2
dec edi
push 0x401684
push 0x401678
push edi
push esi
call fcn.0042aff8
mov edi, dword [ebp - 0x1c]
xor ecx, ecx
add esp, 0x14
mov word [esi + eax*2 + 2], cx
mov ecx, edi
call fcn.0042b0de
mov esi, eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x90]
mov dword [ebp - 0x30], esi
push eax
xor eax, eax
push eax
push esi
push 0x400
push 1
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
push 0x44c998
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x43e09f
cmp dword [0x44e6e8], 0
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x1c], eax
jne 0x43e0b3
push dword [ebp - 0x48]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
push dword [ebp - 0x28]
call ebx
push dword [ebp - 0x2c]
call ebx
test esi, esi
mov esi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
je 0x42afb9
push dword [ebp - 0x30]
call esi
pop ecx
test edi, edi
je 0x42afc1
push edi
call esi
pop ecx
push 0x10
pop ecx
call fcn.00426940
test eax, eax
je 0x42aff4
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x1c]
mov dword [eax + 4], esi
mov dword [eax], 0x401668
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042e434
leave
ret
xor eax, eax
jmp 0x42afe5
call esi
cmp eax, 0xe7
jne 0x43e006
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp eax, 5
jg 0x43e028
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x43e00f
xor eax, eax
push eax
push eax
push eax
push 1
call ebx
push 0
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
jmp 0x42ae0e
xor eax, eax
push eax
push eax
push eax
push 1
call ebx
jmp 0x42ae16
call esi
cmp eax, 0xe7
jne 0x43e05b
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp eax, 5
jg 0x43e069
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x42ae1d
xor eax, eax
push eax
push eax
push eax
push 1
call ebx
jmp 0x42ae1d
xor eax, eax
push eax
push eax
push eax
push 1
call ebx
jmp 0x42ae39
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
push eax
push eax
push eax
push 1
call ebx
jmp 0x42ae61
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
push eax
push eax
push eax
push 1
call ebx
jmp 0x42ae9c
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
push eax
push eax
push eax
push 1
call ebx
jmp 0x42af81
push 0xffffffffffffffff
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
jmp 0x42af94