Function at 0x4c8cc0
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xdc
lea eax, [ebp - 0xcc]
lea ebx, [ebp - 0x28]
mov edi, dword [ebp + 0x18]
mov dword [ebp - 0x28], 0xc
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 1
push 0
push ebx
push eax
lea eax, [ebp - 0xd0]
mov esi, 0x200
push eax
call sub.kernel32.dll_CreatePipe
xor edx, edx
test eax, eax
jne 0x4c8d12
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0xd4]
push 0
push ebx
push eax
lea eax, [ebp - 0xd8]
push eax
call sub.kernel32.dll_CreatePipe
test eax, eax
jne 0x4c8d53
sub esp, 0xc
mov esi, dword [ebp - 0xd0]
push esi
call sub.kernel32.dll_CloseHandle
mov ebx, dword [ebp - 0xcc]
push ebx
call sub.kernel32.dll_CloseHandle
xor edx, edx
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0xdc]
push 0
push ebx
push eax
lea eax, [ebp - 0xe0]
push eax
call sub.kernel32.dll_CreatePipe
test eax, eax
jne 0x4c8d9d
sub esp, 0xc
mov ecx, dword [ebp - 0xd0]
push ecx
call sub.kernel32.dll_CloseHandle
mov edx, dword [ebp - 0xcc]
push edx
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0xd4]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0xd8]
push eax
jmp 0x4c8d42
push eax
push eax
push 0x10
push 1
call sub.msvcrt.dll_calloc
mov ebx, eax
mov eax, dword [0x79929c]
add esp, 0x10
test eax, eax
jne 0x4c8e8f
push eax
lea eax, [ebp - 0xc8]
push 0x44
push 0x69af60
push eax
call fcn.0058e948
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x8c], eax
add esp, 0x10
mov eax, dword [ebp - 0xdc]
and edi, 1
mov dword [ebp - 0x88], eax
je 0x4c8f57
mov dword [ebp - 0x9c], 0x101
mov word [ebp - 0x98], 0
push eax
push eax
lea eax, [ebp - 0xc8]
push ebx
push eax
push 0
push 0
push esi
push 0xffffffffffffffff
push 0
push 0
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.00584750
pop esi
pop edi
push eax
push 0
call sub.kernel32.dll_CreateProcessA
pop edx
test eax, eax
pop ecx
jne 0x4c8eff
sub esp, 0xc
mov eax, dword [ebp - 0xd0]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0xd4]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0xe0]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0xd8]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0xcc]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0xdc]
push eax
jmp 0x4c8d42
push eax
lea eax, [ebp - 0x78]
push 0x44
push 0x69afa4
push eax
call fcn.0058e948
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x3c], eax
add esp, 0x10
mov eax, dword [ebp - 0xdc]
and edi, 1
mov dword [ebp - 0x38], eax
je 0x4c8f74
mov dword [ebp - 0x4c], 0x101
mov word [ebp - 0x48], 0
push eax
push eax
lea eax, [ebp - 0x78]
push ebx
push eax
push 0
push 0
push esi
push 0xffffffffffffffff
push 0
push 0
push edi
mov esi, dword [ebp + 8]
push esi
call fcn.00584770
pop edx
pop ecx
push eax
push 0
call fcn.00586d7f
jmp 0x4c8e3a
sub esp, 0xc
mov edi, dword [ebx + 4]
push edi
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0xd0]
mov esi, dword [ebp - 0xd8]
mov dword [eax], edx
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp - 0xd4]
mov dword [eax], edx
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp - 0xe0]
mov dword [eax], edx
push esi
call sub.kernel32.dll_CloseHandle
mov ecx, dword [ebp - 0xcc]
push ecx
call sub.kernel32.dll_CloseHandle
mov edx, dword [ebp - 0xdc]
push edx
call sub.kernel32.dll_CloseHandle
mov edx, ebx
jmp 0x4c8d08
mov esi, 0x208
mov dword [ebp - 0x9c], 0x100
mov word [ebp - 0x98], 0
jmp 0x4c8e11
mov esi, 0x208
mov dword [ebp - 0x4c], 0x100
mov word [ebp - 0x48], 0
jmp 0x4c8ed4