Function at 0x42aacb
Capabilities:
Accept command line arguments
Create pipe
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd4
mov eax, dword [0x448014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0xd4]
mov dword [ebp - 0x30], ecx
xor ebx, ebx
mov dword [ebp - 0x3c], 0xc
push eax
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], 1
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
push 0x44
pop esi
push esi
lea eax, [ebp - 0x90]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
add esp, 0xc
mov dword [ebp - 0x90], esi
mov dword [ebp - 0x64], 0x100
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0xfffffffffffffff6
call esi
push 0xfffffffffffffff5
mov dword [ebp - 0x58], eax
call esi
push 0xfffffffffffffff4
mov dword [ebp - 0x54], eax
call esi
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x3c]
push ebx
push eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x1c], 1
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [sym.imp.KERNEL32.dll_RaiseException]
test eax, eax
je 0x43dba3
mov dword [ebp - 0x1c], 1
push 0
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x43dbf5
call edi
mov edi, dword [ebp - 0x20]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 2
push 0
push 0
lea ecx, [ebp - 0x1c]
push ecx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x43dc36
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edi, dword [ebp - 0x24]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 2
push 0
push 0
lea ecx, [ebp - 0x1c]
push ecx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x43dc4a
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1c]
mov ecx, 0xbe
mov dword [ebp - 0x24], eax
call fcn.00426640
push dword [ebp - 0x28]
mov esi, eax
lea eax, [ebp - 0x18]
push 0x401688
push 9
push eax
mov dword [ebp - 0x1c], esi
call fcn.0042ad58
lea eax, [ebp - 0x18]
push eax
push 0x40171c
push 0x40167c
push 0x5f
push esi
call fcn.0042ad58
push 0x5e
pop edi
push dword [ebp - 0x2c]
lea esi, [esi + eax*2]
sub edi, eax
push 0x401688
lea eax, [ebp - 0x18]
add esi, 2
push 9
push eax
call fcn.0042ad58
lea eax, [ebp - 0x18]
push eax
push 0x4016f0
push 0x40167c
push edi
push esi
call fcn.0042ad58
add esp, 0x48
sub edi, eax
lea esi, [esi + eax*2]
push dword [ebp - 0x30]
add esi, 2
dec edi
push 0x4016d0
push 0x4016c4
push edi
push esi
call fcn.0042ad58
mov edi, dword [ebp - 0x1c]
xor ecx, ecx
add esp, 0x14
mov word [esi + eax*2 + 2], cx
mov ecx, edi
call fcn.0042ae3e
mov esi, eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x90]
mov dword [ebp - 0x30], esi
push eax
xor eax, eax
push eax
push esi
push 0x400
push 1
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
push 0x44b988
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x43dc5e
cmp dword [0x44d6e0], 0
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x1c], eax
jne 0x43dc72
push dword [ebp - 0x48]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
push dword [ebp - 0x28]
call ebx
push dword [ebp - 0x2c]
call ebx
test esi, esi
mov esi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
je 0x42ad19
push dword [ebp - 0x30]
call esi
pop ecx
test edi, edi
je 0x42ad21
push edi
call esi
pop ecx
push 0x10
pop ecx
call fcn.00426640
test eax, eax
je 0x42ad54
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x1c]
mov dword [eax + 4], esi
mov dword [eax], 0x4016b4
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042e014
leave
ret
xor eax, eax
jmp 0x42ad45
call esi
cmp eax, 0xe7
jne 0x43dbc5
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp eax, 5
jg 0x43dbe7
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x43dbce
xor eax, eax
push eax
push eax
push eax
push 1
call ebx
push 0
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
jmp 0x42ab6e
xor eax, eax
push eax
push eax
push eax
push 1
call ebx
jmp 0x42ab76
call esi
cmp eax, 0xe7
jne 0x43dc1a
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp eax, 5
jg 0x43dc28
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x42ab7d
xor eax, eax
push eax
push eax
push eax
push 1
call ebx
jmp 0x42ab7d
xor eax, eax
push eax
push eax
push eax
push 1
call ebx
jmp 0x42ab99
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
push eax
push eax
push eax
push 1
call ebx
jmp 0x42abc1
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
push eax
push eax
push eax
push 1
call ebx
jmp 0x42abfc
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
push eax
push eax
push eax
push 1
call ebx
jmp 0x42ace1
push 0xffffffffffffffff
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
jmp 0x42acf4