Function at 0x401920
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xdc
lea eax, [ebp - 0xcc]
lea ebx, [ebp - 0x28]
mov edi, dword [ebp + 0x18]
mov dword [ebp - 0x28], 0xc
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 1
push 0
push ebx
push eax
lea eax, [ebp - 0xd0]
mov esi, 0x200
push eax
call sub.kernel32.dll_CreatePipe
xor edx, edx
test eax, eax
jne 0x401972
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0xd4]
push 0
push ebx
push eax
lea eax, [ebp - 0xd8]
push eax
call sub.kernel32.dll_CreatePipe
test eax, eax
jne 0x4019b3
sub esp, 0xc
mov esi, dword [ebp - 0xd0]
push esi
call sub.kernel32.dll_CloseHandle
mov ebx, dword [ebp - 0xcc]
push ebx
call sub.kernel32.dll_CloseHandle
xor edx, edx
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0xdc]
push 0
push ebx
push eax
lea eax, [ebp - 0xe0]
push eax
call sub.kernel32.dll_CreatePipe
test eax, eax
jne 0x4019fd
sub esp, 0xc
mov ecx, dword [ebp - 0xd0]
push ecx
call sub.kernel32.dll_CloseHandle
mov edx, dword [ebp - 0xcc]
push edx
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0xd4]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0xd8]
push eax
jmp 0x4019a2
push eax
push eax
push 0x10
push 1
call sub.msvcrt.dll_calloc
mov ebx, eax
mov eax, dword [0x684800]
add esp, 0x10
test eax, eax
jne 0x401aef
push eax
lea eax, [ebp - 0xc8]
push 0x44
push section..data
push eax
call fcn.004c86b0
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x8c], eax
add esp, 0x10
mov eax, dword [ebp - 0xdc]
and edi, 1
mov dword [ebp - 0x88], eax
je 0x401bb7
mov dword [ebp - 0x9c], 0x101
mov word [ebp - 0x98], 0
push eax
push eax
lea eax, [ebp - 0xc8]
push ebx
push eax
push 0
push 0
push esi
push 0xffffffffffffffff
push 0
push 0
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.004bc0d0
pop esi
pop edi
push eax
push 0
call sub.kernel32.dll_CreateProcessA
pop edx
test eax, eax
pop ecx
jne 0x401b5f
sub esp, 0xc
mov eax, dword [ebp - 0xd0]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0xd4]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0xe0]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0xd8]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0xcc]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0xdc]
push eax
jmp 0x4019a2
push eax
lea eax, [ebp - 0x78]
push 0x44
push 0x5cd044
push eax
call fcn.004c86b0
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x3c], eax
add esp, 0x10
mov eax, dword [ebp - 0xdc]
and edi, 1
mov dword [ebp - 0x38], eax
je 0x401bd4
mov dword [ebp - 0x4c], 0x101
mov word [ebp - 0x48], 0
push eax
push eax
lea eax, [ebp - 0x78]
push ebx
push eax
push 0
push 0
push esi
push 0xffffffffffffffff
push 0
push 0
push edi
mov esi, dword [ebp + 8]
push esi
call fcn.004bc0f0
pop edx
pop ecx
push eax
push 0
call sub.kernel32.dll_CreateProcessW
jmp 0x401a9a
sub esp, 0xc
mov edi, dword [ebx + 4]
push edi
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0xd0]
mov esi, dword [ebp - 0xd8]
mov dword [eax], edx
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp - 0xd4]
mov dword [eax], edx
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp - 0xe0]
mov dword [eax], edx
push esi
call sub.kernel32.dll_CloseHandle
mov ecx, dword [ebp - 0xcc]
push ecx
call sub.kernel32.dll_CloseHandle
mov edx, dword [ebp - 0xdc]
push edx
call sub.kernel32.dll_CloseHandle
mov edx, ebx
jmp 0x401968
mov esi, 0x208
mov dword [ebp - 0x9c], 0x100
mov word [ebp - 0x98], 0
jmp 0x401a71
mov esi, 0x208
mov dword [ebp - 0x4c], 0x100
mov word [ebp - 0x48], 0
jmp 0x401b34