Function at 0x4f4dd8
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create two anonymous pipes
Read file on windows
Read pipe

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff5c
push ebx
xor ebx, ebx
mov dword [ebp - 0xa0], ebx
mov dword [ebp - 0xa4], ebx
mov dword [ebp - 0x9c], ebx
mov dword [ebp - 0x98], ebx
mov dword [ebp - 0x94], ebx
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
call fcn.00405a50
xor eax, eax
push ebp
push 0x4f51ae
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00416aa0
mov eax, dword [0x574604]
cmp byte [eax], 0
je 0x4f5178
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0xffffffff
lea eax, [ebp - 0x38]
xor ecx, ecx
mov edx, 0xc
call fcn.00403628
mov dword [ebp - 0x38], 0xc
xor eax, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], 0xffffffff
push 0x3d0900
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
call sub.kernel32.dll_CreatePipe
push 0
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
call sub.kernel32.dll_CreatePipe
lea eax, [ebp - 0x8c]
xor ecx, ecx
mov edx, 0x10
call fcn.00403628
mov byte [ebp - 0x21], 0
cmp dword [ebp + 0x1c], 0
jne 0x4f4ede
cmp dword [ebp + 0x18], 0
jne 0x4f4ede
cmp dword [ebp + 0x14], 0
jne 0x4f4ede
cmp dword [ebp + 0x10], 0
jne 0x4f4ede
mov byte [ebp - 0x21], 1
cmp dword [ebp + 0xc], 0
jne 0x4f4f7e
cmp dword [ebp + 8], 0
jne 0x4f4f7e
mov edx, dword [ebp - 8]
mov eax, 0x4f51c0
call fcn.004059bc
test eax, eax
jle 0x4f4f7e
push 0
lea eax, [ebp - 0x90]
push eax
mov ecx, 0x4f51c8
mov edx, 0x4f51e4
mov eax, dword [ebp - 8]
call fcn.004af81c
mov edx, dword [ebp - 0x90]
lea eax, [ebp - 8]
call fcn.00405514
push 0
lea eax, [ebp - 0x94]
push eax
mov ecx, 0x4f51e4
mov edx, 0x4f51c0
mov eax, dword [ebp - 8]
call fcn.004af81c
mov edx, dword [ebp - 0x94]
lea eax, [ebp - 8]
call fcn.00405514
push 0
lea eax, [ebp - 0x98]
push eax
mov ecx, 0x4f51e4
mov edx, 0x4f51c8
mov eax, dword [ebp - 8]
call fcn.004af81c
mov edx, dword [ebp - 0x98]
lea eax, [ebp - 8]
call fcn.00405514
lea eax, [ebp - 0x7c]
xor ecx, ecx
mov edx, 0x44
call fcn.00403628
mov dword [ebp - 0x7c], 0x44
mov dword [ebp - 0x50], 1
cmp byte [ebp - 0x21], 0
je 0x4f4fa8
mov dword [ebp - 0x50], 0x101
mov word [ebp - 0x4c], 1
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x3c], eax
cmp dword [ebp + 0x14], 0
jne 0x4f4fcc
cmp dword [ebp + 0x10], 0
jne 0x4f4fcc
mov word [ebp - 0x4c], 0
cmp dword [ebp + 0x14], 0
jne 0x4f4fde
cmp dword [ebp + 0x10], 2
jne 0x4f4fde
mov word [ebp - 0x4c], 2
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 8]
mov edx, 0x4f51f0
call fcn.00405708
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x7c]
push eax
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 0x28]
call fcn.0040568c
push eax
push 0
call sub.kernel32.dll_CreateProcessW
push 0xffffffffffffffff
mov eax, dword [ebp - 0x8c]
push eax
call sub.user32.dll_WaitForInputIdle
cmp dword [ebp + 0x1c], 0
jne 0x4f504d
cmp dword [ebp + 0x18], 0
jne 0x4f504d
jmp 0x4f5038
push 0xa
call sub.kernel32.dll_Sleep_1
push 0xa
mov eax, dword [ebp - 0x8c]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
je 0x4f5031
cmp byte [ebp - 0x21], 0
je 0x4f510c
push 0
lea eax, [ebp - 0x20]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_PeekNamedPipe
cmp dword [ebp - 0x20], 0
jbe 0x4f510c
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 0x20]
call fcn.004053f0
push 0
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x20]
push eax
lea eax, [ebp - 0x2c]
call fcn.004051c0
mov edx, 1
dec edx
test eax, eax
je 0x4f50a2
cmp edx, dword [eax - 4]
jb 0x4f50a7
call fcn.00403c14
inc edx
lea eax, [eax + edx - 1]
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_ReadFile
lea eax, [ebp - 0x9c]
mov edx, dword [ebp - 0x2c]
call fcn.0040567c
mov edx, dword [ebp - 0x9c]
mov eax, dword [ebp - 0xc]
call fcn.00416b1c
push 0
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebp - 0xa4]
mov edx, dword [ebp - 0xc]
call fcn.00416108
mov eax, dword [ebp - 0xa4]
mov ecx, 0x4f520c
mov edx, 0x4f5214
call fcn.004af81c
mov edx, dword [ebp - 0xa0]
mov eax, dword [ebp - 0xc]
call fcn.00416b1c
mov eax, dword [ebp - 0x88]
test eax, eax
jns 0x4f511b
call fcn.00403c14
call fcn.004b1ce8
test al, al
je 0x4f5130
mov eax, dword [ebp - 0x88]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0x8c]
test eax, eax
jns 0x4f513f
call fcn.00403c14
call fcn.004b1ce8
test al, al
je 0x4f5154
mov eax, dword [ebp - 0x8c]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0x1c]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f51b5
lea eax, [ebp - 0xa4]
mov edx, 6
call fcn.004054c8
lea eax, [ebp - 0x2c]
call fcn.00404c88
lea eax, [ebp - 0x28]
call fcn.004054b0
lea eax, [ebp - 8]
call fcn.004054b0
ret