Function at 0x41f583
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create process suspended
Create two anonymous pipes
Execute shell command and capture output

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov ebx, dword [0x4ab924]
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx], 0xc
mov ebx, dword [0x4ab924]
add ebx, 4
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx], 0
mov ebx, dword [0x4ab924]
add ebx, 8
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx], 0xffffffff
mov ebx, dword [0x4ab928]
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx], 0xc
mov ebx, dword [0x4ab928]
add ebx, 4
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx], 0
mov ebx, dword [0x4ab928]
add ebx, 8
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx], 0xffffffff
mov dword [ebp - 0x10], esp
push 0
push dword [0x4ab924]
push 0x4ab918
push 0x4ab910
call dword [sym.imp.KERNEL32.DLL_CreatePipe]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x41f657
push 0x121
push 0x4010bb8
push 6
call fcn.00444022
add esp, 0xc
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], esp
push 0
push dword [0x4ab928]
push 0x4ab91c
push 0x4ab914
call dword [sym.imp.KERNEL32.DLL_CreatePipe]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x41f698
push 0x16c
push 0x4010bb8
push 6
call fcn.00444022
add esp, 0xc
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], esp
mov eax, dword [0x4ab92c]
push eax
push 0x44
call fcn.0044402e
add esp, 4
mov edi, eax
pop ebx
push eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], eax
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov word [edi], ax
add edi, 2
mov eax, dword [ebx]
add ebx, 4
mov word [edi], ax
add edi, 2
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
call dword [0x4abaac]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x41f797
push 0x19e
push 0x4010bb8
push 6
call fcn.00444022
add esp, 0xc
push eax
mov ebx, dword [ebp - 0x14]
push ebx
mov edi, dword [ebp - 0x18]
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov ax, word [ebx]
add ebx, 2
mov dword [edi], eax
add edi, 4
mov ax, word [ebx]
add ebx, 2
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
call fcn.0044401c
add esp, 4
pop eax
mov ebx, dword [0x4ab92c]
add ebx, 0x2c
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx], 0x101
mov ebx, dword [0x4ab92c]
add ebx, 0x3c
mov dword [ebp - 0x10], ebx
mov eax, dword [0x4ab910]
mov ebx, dword [ebp - 0x10]
mov dword [ebx], eax
mov ebx, dword [0x4ab92c]
add ebx, 0x40
mov dword [ebp - 0x10], ebx
mov eax, dword [0x4ab91c]
mov ebx, dword [ebp - 0x10]
mov dword [ebx], eax
mov ebx, dword [0x4ab92c]
add ebx, 0x44
mov dword [ebp - 0x10], ebx
mov eax, dword [0x4ab91c]
mov ebx, dword [ebp - 0x10]
mov dword [ebx], eax
mov ebx, dword [0x4ab92c]
add ebx, 0x30
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 0x10]
mov word [ebx], 0
mov dword [ebp - 0x10], esp
push dword [0x4ab920]
mov eax, dword [0x4ab92c]
push eax
push 0x44
call fcn.0044402e
add esp, 4
mov edi, eax
pop ebx
push eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], eax
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov word [edi], ax
add edi, 2
mov eax, dword [ebx]
add ebx, 4
mov word [edi], ax
add edi, 2
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
push str.C:WINDOWS_system32_
push 0
push 0
push 0xffffffff
push 0
push 0
push str.cmd.exe
push 0
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x41f9f3
push 0x2ea
push 0x4010bb8
push 6
call fcn.00444022
add esp, 0xc
push eax
mov ebx, dword [ebp - 0x14]
push ebx
mov edi, dword [ebp - 0x18]
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov ax, word [ebx]
add ebx, 2
mov dword [edi], eax
add edi, 4
mov ax, word [ebx]
add ebx, 2
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
call fcn.0044401c
add esp, 4
pop eax
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 0x4ab90c
push 0
push 0
push 0
push OleUIBusyA
push 0
push 0x41fd05
push 3
mov ebx, 0
mov eax, 0x44a060
call fcn.00444c90
add esp, 0x28
mov esp, ebp
pop ebp
ret