Function at 0x4df5d0
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create two anonymous pipes
Read file on windows
Read pipe
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x538662
mov eax, dword fs:[0]
push eax
mov eax, 0x1088
call fcn.0049b540
mov eax, dword [0x59a0a0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov dword [ebp - 0x1030], ebx
push 0x44
lea eax, [ebp - 0x1094]
mov dword [ebp - 4], 0
push 0
push eax
mov dword [ebp - 0x102c], 0xffffffff
call fcn.0049e130
add esp, 0xc
xor edi, edi
xorps xmm0, xmm0
mov dword [ebp - 0x1014], edi
mov ecx, ebx
mov dword [ebp - 0x1024], edi
movups xmmword [ebp - 0x104c], xmm0
mov dword [ebp - 0x1028], edi
call fcn.00402ad0
push edi
lea eax, [ebp - 0x103c]
mov dword [ebp - 0x103c], 0xc
push eax
lea eax, [ebp - 0x1020]
mov dword [ebp - 0x101c], edi
push eax
xorps xmm0, xmm0
mov dword [ebp - 0x1020], edi
lea eax, [ebp - 0x101c]
movq qword [ebp - 0x1038], xmm0
push eax
mov dword [ebp - 0x1034], 1
mov dword [ebp - 0x1038], edi
call dword [sym.imp.KERNEL32.dll_CreatePipe]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x4df8cc
mov ebx, dword [sym.imp.KERNEL32.dll_SetHandleInformation]
push edi
push 1
push dword [ebp - 0x1020]
call ebx
test eax, eax
je 0x4df8cc
push 0x4000
lea eax, [ebp - 0x103c]
push eax
lea eax, [ebp - 0x1024]
push eax
lea eax, [ebp - 0x1014]
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x4df8cc
push edi
push 1
push dword [ebp - 0x1014]
call ebx
test eax, eax
je 0x4df8cc
xor eax, eax
mov dword [ebp - 0x1094], 0x44
mov word [ebp - 0x1064], ax
mov eax, dword [ebp - 0x101c]
mov dword [ebp - 0x105c], eax
mov eax, dword [ebp - 0x1024]
mov dword [ebp - 0x1058], eax
mov dword [ebp - 0x1054], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1068], 0x101
cmp dword [eax - 4], 1
jle 0x4df754
push dword [eax - 0xc]
lea ecx, [ebp + 8]
call fcn.00402b70
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x104c]
push ecx
lea ecx, [ebp - 0x1094]
push ecx
push 0
push 0
push 0
push 1
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, eax
neg edi
sbb edi, edi
neg edi
je 0x4df8cc
push 0xffffffffffffffff
push dword [ebp - 0x104c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4df7a5
push 0xffffffffffffffff
push dword [ebp - 0x104c]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [ebp - 0x101c]
call esi
push dword [ebp - 0x1020]
mov dword [ebp - 0x101c], 0
call esi
push dword [ebp - 0x1024]
mov dword [ebp - 0x1020], 0
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
lea eax, [ebp - 0x1018]
push 0
push eax
lea eax, [ebp - 0x1028]
mov dword [ebp - 0x1024], 0
push eax
push 0xfff
push 0
push dword [ebp - 0x1014]
mov dword [ebp - 0x1018], 0xfff
call ebx
test eax, eax
je 0x4df8c6
mov ecx, 0xfff
nop word [eax + eax]
mov eax, dword [ebp - 0x1018]
test eax, eax
je 0x4df8cc
cmp eax, 0xfff
push 0
cmova eax, ecx
lea ecx, [ebp - 0x1028]
push ecx
push eax
mov dword [ebp - 0x1018], eax
lea eax, [ebp - 0x1010]
push eax
push dword [ebp - 0x1014]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4df996
mov eax, dword [ebp - 0x1028]
test eax, eax
je 0x4df8cc
cmp eax, 0x1000
jae 0x4df991
mov ecx, dword [ebp - 0x1030]
mov byte [ebp + eax - 0x1010], 0
lea eax, [ebp - 0x1010]
push eax
call fcn.004117e0
push 0
lea eax, [ebp - 0x1018]
mov dword [ebp - 0x1018], 0xfff
push eax
lea eax, [ebp - 0x1028]
push eax
push 0xfff
push 0
push dword [ebp - 0x1014]
call ebx
mov ecx, 0xfff
test eax, eax
jne 0x4df820
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [ebp - 0x101c]
test eax, eax
je 0x4df8d9
push eax
call esi
mov eax, dword [ebp - 0x1020]
test eax, eax
je 0x4df8e6
push eax
call esi
mov eax, dword [ebp - 0x1024]
test eax, eax
je 0x4df8f3
push eax
call esi
mov eax, dword [ebp - 0x1014]
test eax, eax
je 0x4df900
push eax
call esi
test edi, edi
je 0x4df927
lea eax, [ebp - 0x102c]
push eax
push dword [ebp - 0x104c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x1048]
call esi
push dword [ebp - 0x104c]
call esi
mov ecx, dword [ebp - 0x1030]
xor ebx, ebx
mov eax, dword [ebp - 0x102c]
test eax, eax
sete bl
push dword [ecx]
push eax
push dword [ebp + 8]
push str.RunAndGetExitCodeEx
push str.__s__CmdLine__s__ExitCode__d__Output__s__r_n
call fcn.004e78a0
push eax
call fcn.004e76a0
mov dword [ebp - 4], 0xffffffff
add esp, 0x18
mov ecx, dword [ebp + 8]
or eax, 0xffffffff
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x4df9a5
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x4df9a1
mov eax, dword [edx + 4]
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x4df9a5
call fcn.0049abd1
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4df8cc
mov ecx, edx
call esi
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049aa22
mov esp, ebp
pop ebp
ret