Function at 0x1001709b
Capabilities:
Create pipe
Create two anonymous pipes
Spoof parent pid

Disassembly:
push 0x94
mov eax, 0x1003e4d6
call fcn.1001d244
mov dword [ebp - 0x98], edx
mov dword [ebp - 0x94], ecx
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0xa0], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
call fcn.1001419c
test eax, eax
je 0x10017131
test esi, esi
jne 0x1001735e
sub esp, 0x18
lea eax, [ebp + 0x18]
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
call fcn.10002cf6
mov ecx, dword [ebp - 0xa0]
push ecx
mov ecx, dword [ebp - 0x9c]
push edi
push ecx
mov ecx, dword [ebp - 0x98]
push ecx
mov byte [ebp - 4], 1
call fcn.1001419c
mov edx, dword [ebp - 0x94]
mov ecx, eax
mov byte [ebp - 4], bl
call fcn.1001736e
add esp, 0x28
mov bl, al
jmp 0x1001735e
push 0x48
lea eax, [ebp - 0x90]
mov dword [ebp - 0x1c], ebx
push ebx
push eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
call fcn.1001e5b0
xor eax, eax
lea edi, [ebp - 0x44]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp - 0x14]
test edi, edi
je 0x100171d0
push ebx
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 0xc
push eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x2c], 1
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x30], ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x1001735e
push ebx
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x1001735e
push ebx
push 1
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x1001735e
mov eax, dword [ebp - 0x20]
or dword [ebp - 0x64], 0x100
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x58], eax
test esi, esi
je 0x1001729a
push esi
push ebx
push 0x2000000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x1001735e
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], ebx
push eax
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
test eax, eax
jne 0x1001728c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1001728c
push dword [ebp - 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x4c], eax
test eax, eax
je 0x1001728c
lea ecx, [ebp - 0x14]
push ecx
push ebx
push 1
push eax
call dword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
test eax, eax
je 0x1001725b
push ebx
push ebx
push 4
lea eax, [ebp - 0x18]
push eax
push 0x20000
push ebx
push dword [ebp - 0x4c]
call dword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
test eax, eax
jne 0x10017276
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x4c]
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1001735e
or dword [ebp - 0x94], 0x80000
mov dword [ebp - 0x90], 0x48
jmp 0x100172a4
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1001735e
mov dword [ebp - 0x90], 0x44
mov eax, dword [ebp + 0x28]
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1001c95c
cmp dword [ebp + 0x2c], 7
lea edx, [ebp + 0x18]
pop ecx
mov ecx, dword [ebp + 0x28]
mov esi, eax
cmova edx, dword [ebp + 0x18]
lea ecx, [ecx*2 + 2]
push ecx
push edx
push esi
call fcn.1001e010
add esp, 0xc
lea eax, [ebp - 0x44]
mov edx, esi
push eax
lea eax, [ebp - 0x90]
push eax
push ecx
push ecx
push dword [ebp - 0x94]
sub esp, 0xc
call fcn.10015108
add esp, 0x20
push esi
test eax, eax
jne 0x1001730c
call fcn.1001c957
pop ecx
jmp 0x1001735e
call fcn.1001c957
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
mov ecx, dword [ebp - 0x98]
test ecx, ecx
je 0x10017329
mov eax, dword [ebp - 0x44]
mov dword [ecx], eax
jmp 0x1001732e
push dword [ebp - 0x44]
call esi
mov ecx, dword [ebp - 0x9c]
test ecx, ecx
je 0x1001733f
mov eax, dword [ebp - 0x40]
mov dword [ecx], eax
jmp 0x10017344
push dword [ebp - 0x40]
call esi
test edi, edi
je 0x1001734d
mov eax, dword [ebp - 0x1c]
mov dword [edi], eax
mov ecx, dword [ebp - 0xa0]
test ecx, ecx
je 0x1001735c
mov eax, dword [ebp - 0x28]
mov dword [ecx], eax
mov bl, 1
lea ecx, [ebp + 0x18]
call fcn.1000200e
mov al, bl
call fcn.1001d1f3
ret