Function at 0x404cb2
Capabilities:
Connect pipe
Encode data using xor
Read pipe
Write pipe

Disassembly:
sub esp, 0xc
mov ecx, dword [esp + 0x1c]
mov eax, ecx
mov edx, dword [esp + 0x20]
xor eax, 0x3971
push ebx
mov ebx, dword [esp + 0x18]
add edx, 0xfffff8ff
mov dword [esp + 8], eax
mov eax, ebx
xor eax, 0x378a
mov dword [esp + 0xc], edx
push ebp
lea ebp, [ebx - 0xda]
mov dword [esp + 0x24], eax
xor ebx, 0x408
lea eax, [ecx - 0x750]
push edi
mov edi, dword [esp + 0x1c]
mov dword [esp + 0xc], eax
add edi, 0xfffffd4a
lea eax, [ebx - 0x438]
mov dword [esp + 0x2c], edi
mov dword [esp + 0x20], ebx
cmp edi, eax
jle 0x405210
lea eax, [edx + 0x177]
push esi
mov esi, dword [esp + 0x28]
cmp ebx, eax
jle 0x405089
xor edi, edi
mov ecx, dword [0x4b570c]
mov eax, dword [esi + 0x3c]
xor eax, dword [0x50711c]
xor eax, dword [ecx + 0x1c]
xor eax, 0x741c
mov dword [ecx + 0x1c], eax
mov ecx, dword [0x4b570c]
mov eax, dword [esi + 0x10c]
xor eax, 0x11c0be
add dword [0x507160], eax
mov eax, dword [ecx + 0xb0]
xor eax, dword [esi + 0xec]
xor eax, 0x47
or dword [ecx + 0x28], eax
mov eax, dword [0x50719c]
mov ecx, dword [esi + 0x84]
xor eax, 0x13
sub dword [esi + 0x64], eax
mov eax, dword [esi + 0x94]
mov ebx, dword [edi + eax]
add edi, 4
imul ebx, dword [0x507100]
mov eax, dword [esi + 0xa8]
mov edx, ebx
shr edx, 8
mov byte [ecx + eax], dl
inc dword [esi + 0x84]
mov eax, dword [0x507124]
mov ecx, dword [esi + 0xa8]
mov byte [eax + ecx], bl
inc dword [0x507124]
mov eax, dword [esi + 0xec]
sub eax, 0x12
imul eax, dword [0x5070c8]
mov dword [0x5070c8], eax
mov eax, dword [esi + 0x1c]
sub eax, dword [esi + 0xc0]
not eax
or dword [esi + 0x3c], eax
mov eax, dword [0x5070e0]
sub dword [esi], eax
xor eax, eax
inc eax
sub eax, dword [esi + 0x104]
sub eax, dword [esi + 4]
add dword [esi + 0xec], eax
mov eax, dword [esi]
xor dword [esi + 0x58], eax
mov eax, dword [0x50719c]
add eax, 0xffffffed
xor dword [esi + 0xe0], eax
cmp edi, 0x6a8a8
jl 0x404d2f
mov eax, dword [esp + 0x24]
mov ebx, dword [esp + 0x2c]
add eax, 0xfffff8cf
mov edi, dword [esp + 0x30]
push eax
mov eax, dword [esp + 0x14]
add eax, 0x838
push eax
push edi
lea eax, [ebx + 0xc29]
push eax
push esi
call fcn.0041ba20
mov edx, eax
add ebp, 0x777
mov eax, dword [esp + 0x28]
mov dword [esp + 0x38], edx
lea ecx, [eax + 0xbdb]
xor eax, 0x3971
push ecx
lea ecx, [edi - 0x107]
push ecx
push edx
push esi
push eax
lea eax, [edi - 0x175]
push eax
lea eax, [ebx + 0xfa0]
push eax
call fcn.004012d3
mov eax, dword [esi + 0xb0]
add esp, 0x30
xor dword [esi + 0x60], 0x983b9
add eax, 0x165edb
xor dword [esi + 0x64], eax
mov eax, dword [0x507118]
mov ecx, dword [esi + 0x60]
cmp eax, dword [esi + 0x7c]
jbe 0x404eb4
mov eax, dword [0x4b570c]
sub ecx, dword [eax + 0x28]
sub ecx, 0xe0e
mov dword [esi + 0x60], ecx
jmp 0x404ecb
mov ecx, dword [0x4b570c]
mov eax, dword [0x5070e0]
add eax, 0x8199
imul eax, dword [ecx + 0x7c]
mov dword [ecx + 0x7c], eax
mov dword [esi + 0x94], 0x499ab0
xor edi, edi
mov eax, dword [0x507134]
mov ecx, dword [esi + 0xe8]
sub ecx, dword [esi + 0xfc]
mov edx, dword [edi + eax]
add edi, 4
mov eax, dword [0x4b570c]
mov eax, dword [eax + 0x118]
xor eax, dword [esi + 0x70]
xor eax, 0xb654c
mov dword [esi + 0x70], eax
mov eax, dword [0x5071a8]
add eax, 0xfffcf13a
add eax, ecx
mov dword [0x5071a8], eax
mov eax, dword [0x4b570c]
mov ebx, dword [esi + 0x60]
imul ebx, edx
mov ecx, dword [eax + 0x84]
mov eax, dword [esi + 0xa8]
mov edx, ebx
shr edx, 0x18
mov byte [ecx + eax], dl
mov edx, ebx
mov eax, dword [0x4b570c]
shr edx, 0x10
inc dword [eax + 0x84]
mov ecx, dword [esi + 0x84]
mov eax, dword [esi + 0xa8]
mov byte [ecx + eax], dl
mov edx, ebx
inc dword [esi + 0x84]
mov eax, dword [0x4b570c]
shr edx, 8
mov ecx, dword [eax + 0x84]
mov eax, dword [esi + 0xa8]
mov byte [ecx + eax], dl
mov eax, dword [0x4b570c]
inc dword [eax + 0x84]
mov eax, dword [esi + 0x2c]
xor eax, dword [0x50718c]
sub eax, 0x13
add dword [esi + 0xa0], eax
mov eax, dword [0x4b570c]
mov ecx, dword [eax + 0xa8]
mov eax, dword [0x507124]
mov byte [eax + ecx], bl
inc dword [0x507124]
mov eax, dword [0x4b570c]
mov eax, dword [eax]
sub dword [esi + 0x108], eax
mov ecx, dword [0x4b570c]
mov eax, dword [0x507180]
sub eax, dword [ecx + 0xfc]
add eax, 0x7a16
or dword [0x507128], eax
mov eax, dword [ecx]
add dword [esi + 0x88], eax
mov eax, dword [esi + 0x70]
xor eax, dword [esi + 4]
sub eax, 0x188489
xor dword [0x507150], eax
cmp edi, 0x17ac
jl 0x404ed7
mov eax, dword [esi + 0xe0]
xor ebp, 0x69d
mov edi, dword [esp + 0x30]
sub eax, 0x1110970e
mov dword [esi + 0x60], eax
mov eax, dword [esp + 0x2c]
add eax, 0x79c
mov dword [esi + 0x94], 0x428180
push esi
push eax
lea eax, [edi - 0x7c4]
push eax
mov eax, dword [esp + 0x30]
xor eax, 0x67d
push eax
push ebp
call fcn.00404718
add esp, 0x14
cmp dword [esi + 0x78], 0x6385
jbe 0x405076
push dword [esi + 0x11c]
mov eax, dword [esi + 0x114]
add eax, dword [esi + 0xa8]
push eax
push dword [esi + 0x110]
call dword [esi + 0x90]
mov ecx, dword [0x4b570c]
mov dword [ecx + 0x100], eax
jmp 0x40520f
mov eax, 0x2c34e
sub eax, dword [esi + 0xfc]
add dword [esi + 0x28], eax
jmp 0x40520f
mov ecx, dword [0x4b570c]
mov edx, dword [esi + 0x2c]
mov eax, dword [ecx + 0xbc]
imul eax, dword [esi]
sub eax, 0x2000
push eax
mov eax, edx
or edx, dword [esp + 0x1c]
imul eax, dword [esp + 0x30]
and edx, ebp
push eax
mov eax, dword [0x5071a8]
add eax, 0x1f9c
and eax, 0x2408
push eax
mov eax, dword [ecx + 0x88]
xor eax, dword [esi + 0x58]
push edx
push eax
mov eax, ebp
xor eax, 0x21bc
push eax
mov eax, dword [0x50719c]
or eax, ebx
or eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_CallNamedPipeA]
mov eax, dword [esi + 0xa0]
or eax, ebp
and eax, 0x1ac2
xor dword [0x507118], eax
mov eax, dword [esp + 0x10]
sub eax, dword [esi + 0xe0]
cmp ebp, eax
ja 0x40520f
mov eax, dword [esi + 0xfc]
xor eax, dword [esp + 0x14]
mov ecx, dword [0x4b570c]
xor eax, ebp
mov edx, dword [esp + 0x18]
imul eax, dword [ecx + 0xec]
mov dword [ecx + 0xec], eax
mov esi, dword [0x4b570c]
mov eax, dword [esp + 0x28]
mov ecx, dword [esi + 0xe4]
add edx, ecx
sub ecx, dword [esp + 0x30]
mov eax, dword [eax + 0xe4]
xor ecx, ebx
sub eax, dword [esp + 0x2c]
mov edi, dword [esi + 0x2c]
push ecx
push esi
push eax
push edx
or edi, ebx
push edi
call fcn.004014e2
mov edx, dword [0x4b570c]
add esp, 0x14
mov ebx, dword [esp + 0x28]
mov esi, eax
mov ecx, dword [edx + 0xe8]
xor ecx, dword [ebx + 0xe8]
imul ecx, ecx, 0x249b
push ecx
mov ecx, dword [ebx + 0x104]
xor ecx, dword [0x507178]
sub ecx, dword [edx + 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_DeactivateActCtx]
mov ecx, dword [0x4b570c]
mov edi, dword [esp + 0x30]
mov eax, dword [ecx + 0x64]
imul eax, esi
push eax
mov eax, dword [ebx + 0xfc]
add eax, ebp
mov ebp, dword [esp + 0x30]
imul eax, eax, 0x2408
push eax
mov eax, edi
and eax, 0x178a
xor eax, dword [ecx + 0x108]
push eax
mov eax, dword [ebx + 0xe0]
xor eax, 0x1882
or eax, 0x2278
push eax
mov eax, dword [ecx + 0x78]
add eax, dword [ebx + 0x88]
add eax, edi
push eax
mov eax, ebp
sub eax, dword [ebx + 0xe8]
xor eax, dword [ecx + 0x104]
push eax
mov eax, dword [ecx + 0xe8]
xor eax, 0x21bc
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
sub ebp, esi
push ebp
call dword [sym.imp.KERNEL32.dll_CreateActCtxA]
pop esi
lea eax, [edi - 0x47]
pop edi
pop ebp
pop ebx
add esp, 0xc
ret