Function at 0x4dd657
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc8
lea eax, [ebp - 0xc0]
lea ebx, [ebp - 0x1c]
mov edi, dword [ebp + 0x18]
push 0
push ebx
push eax
lea eax, [ebp - 0xc4]
mov dword [ebp - 0x1c], 0xc
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 1
push eax
call sub.KERNEL32.DLL_CreatePipe
mov esi, 0x200
xor edx, edx
test eax, eax
je 0x4dd8b4
lea eax, [ebp - 0xc8]
push 0
push ebx
push eax
lea eax, [ebp - 0xcc]
push eax
call sub.KERNEL32.DLL_CreatePipe
test eax, eax
jne 0x4dd6d3
push dword [ebp - 0xc4]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 0xc0]
jmp 0x4dd867
lea eax, [ebp - 0xd0]
push 0
push ebx
push eax
lea eax, [ebp - 0xd4]
push eax
call sub.KERNEL32.DLL_CreatePipe
test eax, eax
jne 0x4dd719
push dword [ebp - 0xc4]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 0xc0]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 0xc8]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 0xcc]
jmp 0x4dd867
push 0x10
push 1
call sub.msvcrt.dll_calloc
cmp dword [0x6a71f0], 0
mov ebx, eax
pop eax
pop edx
je 0x4dd7a4
lea eax, [ebp - 0x6c]
push 0x44
push 0x5ddb30
push eax
call fcn.00577220
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x30], eax
add esp, 0xc
mov eax, dword [ebp - 0xd0]
and edi, 1
mov dword [ebp - 0x40], 0x100
mov word [ebp - 0x3c], 0
mov dword [ebp - 0x2c], eax
je 0x4dd778
mov dword [ebp - 0x40], 0x101
jmp 0x4dd77d
mov esi, 0x208
lea eax, [ebp - 0x6c]
push ebx
push eax
push 0
push 0
push esi
push 0xffffffffffffffff
push 0
push 0
push dword [ebp + 8]
call fcn.0056ad7e
mov dword [esp], eax
push 0
call fcn.0056d15f
jmp 0x4dd826
lea eax, [ebp - 0xbc]
push 0x44
push 0x5ddb74
push eax
call fcn.00577220
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x80], eax
add esp, 0xc
mov eax, dword [ebp - 0xd0]
and edi, 1
mov dword [ebp - 0x90], 0x100
mov word [ebp - 0x8c], 0
mov dword [ebp - 0x7c], eax
je 0x4dd7fc
mov dword [ebp - 0x90], 0x101
jmp 0x4dd801
mov esi, 0x208
lea eax, [ebp - 0xbc]
push ebx
push eax
push 0
push 0
push esi
push 0xffffffffffffffff
push 0
push 0
push dword [ebp + 8]
call fcn.0056ad64
mov dword [esp], eax
push 0
call sub.KERNEL32.DLL_CreateProcessA
test eax, eax
jne 0x4dd870
push dword [ebp - 0xc4]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 0xc8]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 0xd4]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 0xcc]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 0xc0]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 0xd0]
call sub.KERNEL32.DLL_CloseHandle
xor edx, edx
jmp 0x4dd8b4
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc4]
mov dword [eax], edx
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp - 0xc8]
mov dword [eax], edx
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp - 0xd4]
mov dword [eax], edx
push dword [ebp - 0xcc]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 0xc0]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 0xd0]
call sub.KERNEL32.DLL_CloseHandle
mov edx, ebx
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret