Function at 0x4475d0
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows

Disassembly:
sub esp, 0x88
push ebx
push ebp
push esi
mov eax, edx
mov dword [esp + 0x20], 1
push edi
xor edi, edi
mov dword [esp + 0x30], eax
mov dword [esp + 0x1c], 0x400
mov esi, ecx
test eax, eax
je 0x4475fa
mov dword [eax], edi
test esi, esi
je 0x44786a
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x447605
sub ecx, edx
mov dword [esp + 0x2c], ecx
lea eax, [ecx*2 + 2]
push eax
mov dword [esp + 0x1c], eax
call fcn.004556ab
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x44786a
lea eax, [esp + 0x2c]
mov ecx, ebx
push eax
push esi
lea edx, [esp + 0x20]
call fcn.004317d0
add esp, 8
test eax, eax
jne 0x447861
mov eax, dword [esp + 0x18]
xor ecx, ecx
shr eax, 1
mov esi, ebx
push ecx
mov word [ebx + eax*2], cx
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x40], ecx
push eax
lea eax, [esp + 0x34]
mov dword [esp + 0x40], 0xc
push eax
mov dword [esp + 0x4c], 1
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x44784b
mov eax, dword [esp + 0x14]
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], eax
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x54]
mov dword [esp + 0x58], edi
push eax
push 0
push 0
push 0x20
push 1
lea eax, [esp + 0x4c]
mov dword [esp + 0x70], edi
push eax
push eax
push ebx
push 0
mov dword [esp + 0x84], edi
mov dword [esp + 0x88], edi
mov dword [esp + 0x8c], edi
mov dword [esp + 0x90], edi
mov dword [esp + 0x94], edi
mov dword [esp + 0x98], edi
mov dword [esp + 0x9c], edi
mov dword [esp + 0xa0], edi
mov dword [esp + 0xa8], edi
mov dword [esp + 0xac], edi
mov dword [esp + 0xb0], edi
mov dword [esp + 0x78], 0x44
mov dword [esp + 0xa4], 0x101
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x44783a
push dword [esp + 0x14]
call ebp
push 0x400
push 0
push dword [0x491954]
mov esi, eax
mov dword [esp + 0x20], edi
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 0x18], ebx
mov ebp, eax
mov edi, ebp
test esi, esi
je 0x4477d9
mov dword [esp + 0x18], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
lea ebx, [ebx]
mov ecx, dword [esp + 0x1c]
mov esi, edi
sub esi, ebp
lea eax, [ecx - 0x100]
cmp esi, eax
jl 0x44779d
add ecx, ecx
push ecx
push ebp
push 0
push dword [0x491954]
mov dword [esp + 0x2c], ecx
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ebp, eax
lea edi, [esi + ebp]
push 0
lea eax, [esp + 0x24]
push eax
push 0xff
push edi
push dword [esp + 0x38]
call ebx
mov ecx, dword [esp + 0x20]
mov edx, eax
test ecx, ecx
je 0x4477d5
xor eax, eax
test ecx, ecx
je 0x4477d3
cmp byte [eax + edi], 0
jne 0x4477ce
mov byte [eax + edi], 0x20
mov ecx, dword [esp + 0x20]
inc eax
cmp eax, ecx
jb 0x4477c0
add edi, ecx
test edx, edx
jne 0x447770
push 0xffffffffffffffff
mov byte [edi], 0
push dword [esp + 0x44]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x44]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [esp + 0x24], 0
jne 0x447818
test ebp, ebp
je 0x447811
push ebp
push 0
push dword [0x491954]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, 1
jmp 0x447824
mov eax, dword [esp + 0x30]
xor edi, edi
test eax, eax
je 0x447824
mov dword [eax], ebp
push dword [esp + 0x40]
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebp
push dword [esp + 0x44]
call ebp
mov esi, dword [esp + 0x18]
push dword [esp + 0x28]
call ebp
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x44784b
push ecx
call ebp
push esi
call fcn.0044f604
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x88
ret
push ebx
call fcn.0044f604
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x88
ret