Function at 0x10014d90
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create two anonymous pipes
Execute shell command and capture output

Disassembly:
push 0xffffffffffffffff
push 0x10016df0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x74
push ebx
push ebp
push esi
push edi
mov esi, ecx
call fcn.10014fd0
xor ecx, ecx
xor eax, eax
mov dword [esp + 0x34], ecx
xor ebx, ebx
mov dword [esp + 0x38], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x3c], ecx
mov ecx, 0x10
lea edi, [esp + 0x44]
mov dword [esp + 0x40], ebx
lea edx, [esp + 0x18]
mov dword [esp + 0x20], eax
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.KERNEL32.dll_CreatePipe]
lea ebp, [esi + 0x40]
push ebx
push edx
lea eax, [esi + 0x34]
push ebp
push eax
mov dword [esp + 0x40], ebx
mov dword [esp + 0x28], 0xc
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], 1
call edi
test eax, eax
jne 0x10014e1c
mov ecx, esi
call fcn.10014fd0
xor eax, eax
jmp 0x10014fab
lea ecx, [esp + 0x18]
push ebx
lea edx, [esi + 0x38]
lea eax, [esi + 0x3c]
push ecx
push edx
push eax
call edi
test eax, eax
jne 0x10014e3e
mov ecx, esi
call fcn.10014fd0
xor eax, eax
jmp 0x10014fab
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x40]
rep stosd dword es:[edi], eax
mov dword [esp + 0x30], eax
lea ecx, [esp + 0x40]
mov dword [esp + 0x34], eax
push ecx
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov edx, dword [esi + 0x3c]
mov eax, dword [ebp]
lea ecx, [esp + 0x10]
mov dword [esp + 0x40], 0x44
mov word [esp + 0x70], 5
mov dword [esp + 0x6c], 0x101
mov dword [esp + 0x78], edx
mov dword [esp + 0x7c], eax
mov dword [esp + 0x80], eax
call sub.MFC42.DLL_CString::CString_3
lea eax, [esp + 0x10]
mov dword [esp + 0x8c], ebx
push eax
call fcn.100152b0
mov ecx, dword [esp + 0x14]
push str.cmd.exe
lea edx, [esp + 0x1c]
push ecx
push edx
call fcn.10015460
add esp, 0x10
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x90], 1
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x14]
mov byte [esp + 0x8c], bl
call sub.MFC42.DLL_CString::CString
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x24]
push eax
mov edi, str.E:NetMonitor_
push str.cmd_Shell__s
push ecx
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], 0xb7
mov dword [esp + 0x38], 0x1000
call fcn.10006230
add esp, 0xc
lea edx, [esp + 0x30]
lea eax, [esp + 0x40]
mov ecx, dword [esp + 0x10]
push edx
push eax
push ebx
push ebx
push 0x8000000
push 1
push ebx
push ebx
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x10014f84
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x24]
push edx
push str.CThreadCMDShell::CreateCMDShell___Run_cmd.exe_failed.__s
push eax
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], 0xbc
mov dword [esp + 0x38], 0x10
call fcn.10006230
add esp, 0xc
mov ecx, esi
call fcn.10014fd0
lea ecx, [esp + 0x10]
mov dword [esp + 0x8c], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor eax, eax
jmp 0x10014fab
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
mov dword [esi + 0x44], ecx
lea ecx, [esp + 0x10]
mov dword [esi + 0x48], edx
mov dword [esp + 0x8c], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, 1
mov ecx, dword [esp + 0x84]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x80
ret