Function at 0x427f3a
Capabilities:
Create pipe
Create two anonymous pipes
Spoof parent pid

Disassembly:
push 0x8c
mov eax, 0x45b0c3
call fcn.00438b84
mov eax, dword [ebp + 0x24]
mov edi, dword [ebp + 0x2c]
mov esi, dword [ebp + 0x34]
mov dword [ebp - 0x94], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x98], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x90], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
call fcn.004219bc
test eax, eax
je 0x427fcc
test esi, esi
jne 0x4281f7
mov ecx, dword [ebp - 0x90]
lea eax, [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x98]
push edi
push ecx
mov ecx, dword [ebp - 0x94]
push ecx
push dword [ebp + 0x20]
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x90], esp
push eax
call fcn.00402aae
mov byte [ebp - 4], 1
call fcn.004219bc
push eax
mov byte [ebp - 4], bl
call fcn.0042855c
add esp, 0x30
mov bl, al
jmp 0x4281f7
push 0x48
lea eax, [ebp - 0x8c]
mov dword [ebp - 0x1c], ebx
push ebx
push eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
call fcn.00439fe0
xor eax, eax
lea edi, [ebp - 0x44]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp - 0x14]
test edi, edi
je 0x42806b
push ebx
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 0xc
push eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x2c], 1
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x30], ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x4281f7
push ebx
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x4281f7
push ebx
push 1
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x4281f7
mov eax, dword [ebp - 0x20]
or dword [ebp - 0x60], 0x100
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x54], eax
test esi, esi
je 0x428134
push esi
push ebx
push 0x2000000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x4281f7
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], ebx
push eax
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
test eax, eax
jne 0x428126
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x428126
push dword [ebp - 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x48], eax
test eax, eax
je 0x428126
lea ecx, [ebp - 0x14]
push ecx
push ebx
push 1
push eax
call dword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
test eax, eax
je 0x4280f6
push ebx
push ebx
push 4
lea eax, [ebp - 0x18]
push eax
push 0x20000
push ebx
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
test eax, eax
jne 0x428111
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x48]
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x4281f7
mov esi, dword [ebp + 0x20]
mov dword [ebp - 0x8c], 0x48
or esi, 0x80000
jmp 0x428141
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4281f7
mov esi, dword [ebp + 0x20]
mov dword [ebp - 0x8c], 0x44
mov eax, dword [ebp + 0x18]
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00438cbb
mov ecx, dword [ebp + 0x18]
lea edx, [ebp + 8]
cmp dword [ebp + 0x1c], 7
mov dword [ebp - 0x14], eax
cmova edx, dword [ebp + 8]
lea ecx, [ecx*2 + 2]
push ecx
push edx
push eax
call fcn.0043a230
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x8c]
push eax
push ebx
push ebx
push esi
mov esi, dword [ebp - 0x14]
push 1
push ebx
push ebx
push esi
push ebx
call fcn.004261ba
add esp, 0x38
push esi
test eax, eax
jne 0x4281a5
call fcn.00438cc4
pop ecx
jmp 0x4281f7
call fcn.00438cc4
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
mov ecx, dword [ebp - 0x94]
test ecx, ecx
je 0x4281c2
mov eax, dword [ebp - 0x44]
mov dword [ecx], eax
jmp 0x4281c7
push dword [ebp - 0x44]
call esi
mov ecx, dword [ebp - 0x98]
test ecx, ecx
je 0x4281d8
mov eax, dword [ebp - 0x40]
mov dword [ecx], eax
jmp 0x4281dd
push dword [ebp - 0x40]
call esi
test edi, edi
je 0x4281e6
mov eax, dword [ebp - 0x1c]
mov dword [edi], eax
mov ecx, dword [ebp - 0x90]
test ecx, ecx
je 0x4281f5
mov eax, dword [ebp - 0x28]
mov dword [ecx], eax
mov bl, 1
lea ecx, [ebp + 8]
call fcn.0040221a
mov al, bl
call fcn.00438b33
ret