Function at 0x7aea00
Capabilities:
Check for time delay via gettickcount
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create two anonymous pipes
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff74
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0x8c], ebx
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x80], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, dword [ebp + 0x18]
mov eax, dword [ebp - 4]
call fcn.0040a874
mov eax, dword [ebp - 8]
call fcn.0040a874
xor eax, eax
push ebp
push 0x7aed69
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
cmp esi, 0x1388
jge 0x7aea5d
mov esi, 0x1388
push 0x7aed8c
push dword [ebp - 4]
push 0x7aedac
push dword [ebp - 8]
lea eax, [ebp - 0x80]
mov edx, 4
call fcn.0040baec
mov edx, dword [ebp - 0x80]
mov eax, ebx
call fcn.0079ed98
mov eax, dword [0x8c1074]
mov dword [ebx + 0xe4], eax
mov dword [ebp - 0x7c], 0xc
mov dword [ebp - 0x74], 0xffffffff
xor eax, eax
mov dword [ebp - 0x78], eax
push 0
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_CreatePipe
test eax, eax
je 0x7aed3e
xor eax, eax
push ebp
push 0x7aed37
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
call sub.KERNEL32.DLL_CreatePipe
test eax, eax
je 0x7aed17
xor eax, eax
push ebp
push 0x7aed10
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x60]
xor ecx, ecx
mov edx, 0x44
call fcn.00407f88
lea eax, [ebp - 0x70]
xor ecx, ecx
mov edx, 0x10
call fcn.00407f88
mov dword [ebp - 0x60], 0x44
mov dword [ebp - 0x34], 0x101
movzx eax, word [ebp + 0x1c]
mov word [ebp - 0x30], ax
xor eax, eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x60]
push eax
push 0
push 0
push 0x4000030
push 0xffffffffffffffff
push 0
push 0
push 0x7aedbc
push dword [ebp - 4]
push 0x7aedbc
push 0x7aedac
push dword [ebp - 8]
lea eax, [ebp - 0x84]
mov edx, 5
call fcn.0040baec
mov eax, dword [ebp - 0x84]
call fcn.0040b7f8
push eax
push 0
call sub.KERNEL32.DLL_CreateProcessW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 9], al
call sub.KERNEL32.DLL_GetLastError_2
mov dword [ebx + 0xb1], eax
cmp byte [ebp - 9], 0
jne 0x7aebb1
call fcn.00409f88
call fcn.00409f88
jmp 0x7aed3e
test esi, esi
jle 0x7aecc0
call sub.KERNEL32.DLL_GetTickCount_1
mov edi, eax
jmp 0x7aebf5
mov eax, dword [0x8c226c]
mov eax, dword [eax]
call fcn.005efad0
push ebp
mov cl, 1
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x10]
call fcn.007ae860
pop ecx
push ebp
mov cl, 1
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x18]
call fcn.007ae860
pop ecx
cmp byte [ebx + 0xb6], 0
jne 0x7aec28
push 0x64
mov eax, dword [ebp - 0x70]
push eax
call sub.KERNEL32.DLL_WaitForSingleObject
cmp eax, 0x102
jne 0x7aec28
call sub.KERNEL32.DLL_GetTickCount_1
sub eax, edi
xor edx, edx
push edx
push eax
mov eax, esi
cdq
cmp edx, dword [esp + 4]
jne 0x7aec24
cmp eax, dword [esp]
pop edx
pop eax
ja 0x7aebc2
jmp 0x7aec28
pop edx
pop eax
jg 0x7aebc2
push 0
mov eax, dword [ebp - 0x70]
push eax
call sub.KERNEL32.DLL_WaitForSingleObject
cmp eax, 0x102
sete al
and al, byte [ebp + 0x14]
je 0x7aecb0
push ebp
mov cl, 1
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x10]
call fcn.007ae860
pop ecx
push ebp
mov cl, 1
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x18]
call fcn.007ae860
pop ecx
push 0x7aedcc
lea edx, [ebp - 0x8c]
mov eax, esi
call fcn.00424120
push dword [ebp - 0x8c]
push 0x7aedec
lea eax, [ebp - 0x88]
mov edx, 3
call fcn.0040baec
mov edx, dword [ebp - 0x88]
mov eax, ebx
call fcn.0079ed98
push 0
mov eax, dword [ebp - 0x70]
push eax
call sub.KERNEL32.DLL_TerminateProcess
mov eax, dword [0x8c1078]
mov dword [ebx + 0xe4], eax
jmp 0x7aecc0
lea eax, [ebx + 0xe4]
push eax
mov eax, dword [ebp - 0x70]
push eax
call sub.KERNEL32.DLL_GetExitCodeProcess
push ebp
mov cl, 1
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x10]
call fcn.007ae860
pop ecx
push ebp
mov cl, 1
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x18]
call fcn.007ae860
pop ecx
mov eax, dword [ebp - 0x6c]
push eax
call sub.KERNEL32.DLL_CloseHandle_1
mov eax, dword [ebp - 0x70]
push eax
call sub.KERNEL32.DLL_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7aed17
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_CloseHandle_1
mov eax, dword [ebp - 0x14]
push eax
call sub.KERNEL32.DLL_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7aed3e
mov eax, dword [ebp - 0x18]
push eax
call sub.KERNEL32.DLL_CloseHandle_1
mov eax, dword [ebp - 0x1c]
push eax
call sub.KERNEL32.DLL_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7aed70
lea eax, [ebp - 0x8c]
mov edx, 4
call fcn.0040a7f0
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040a7f0
ret