Function at 0x405748
Capabilities:
Create pipe
Encode data using xor
Write file on windows
Write pipe

Disassembly:
sub esp, 0x24
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x28]
add dword [esp + 0x30], 0xfffff014
push ebp
push esi
push edi
lea edi, [edx + 0x238]
lea esi, [edx - 0x1a9b]
xor edx, 0x1a9b
lea ecx, [eax - 0xa9]
mov dword [esp + 0x10], esi
lea ebp, [eax + 0xf68]
mov dword [esp + 0x34], ecx
lea eax, [edi + 0x1d9]
mov dword [esp + 0x44], edx
cmp esi, eax
jg 0x405efc
lea eax, [edx + 0x17b0]
cmp edi, eax
jl 0x405efc
mov eax, edi
xor eax, 0xd4b
cmp ebp, eax
jl 0x405af1
mov edx, dword [esp + 0x40]
xor edi, edi
push 4
pop ecx
xor esi, esi
mov dword [edx + 8], 0x14
inc esi
mov dword [0xaa127c], ecx
mov dword [edx + 0x1c], 0x12
mov eax, dword [0xa662e4]
mov dword [eax + 0x20], edi
mov dword [edx + 0x34], esi
mov dword [edx + 0x44], 3
mov dword [edx + 0x48], esi
mov eax, dword [0xa662e4]
mov dword [eax + 0x5c], edi
mov dword [0xaa12d8], ecx
mov dword [0xaa12e0], esi
mov dword [edx + 0x78], edi
mov dword [edx + 0x7c], esi
mov eax, dword [0xa662e4]
mov dword [eax + 0x90], esi
mov dword [edx + 0x98], 0x3c
mov dword [edx + 0xa0], edi
mov eax, dword [0xa662e4]
mov dword [eax + 0xac], 0x48
mov dword [edx + 0xc4], edi
mov dword [edx + 0xd8], esi
mov eax, dword [0xa662e4]
mov dword [eax + 0xdc], 0x37
mov eax, dword [0xa662e4]
mov dword [eax + 0xe0], edi
mov dword [edx + 0xe8], edi
mov dword [0xaa1364], esi
mov dword [edx + 0xfc], edi
mov dword [edx + 0x108], 0x18
mov eax, dword [0xa662e4]
mov dword [0xaa137c], edi
mov dword [eax + 0x110], 0x30
mov eax, dword [0xa662e4]
mov dword [eax + 0x114], 0x1d
mov dword [edx + 0x118], esi
mov dword [edx + 0x120], edi
mov dword [edx + 0x124], esi
mov eax, dword [0xa662e4]
mov eax, dword [eax + 0x90]
add eax, 0x6121
add dword [edx + 0x68], eax
mov eax, dword [0xa662e4]
mov eax, dword [eax + 0x70]
cmp eax, dword [edx + 0x90]
jne 0x4058de
mov eax, dword [edx + 0x114]
xor eax, dword [edx + 0xf4]
add eax, 0x146d6a
add dword [edx + 0xe8], eax
mov eax, dword [edx + 8]
add ebp, 0xffffefef
add eax, 0x18c92b
xor ebp, 0xef0
or dword [edx + 0x7c], eax
mov eax, dword [0xa662e4]
mov ecx, dword [eax + 0xd8]
mov eax, dword [0xaa127c]
add eax, 0xfb701
add eax, ecx
mov dword [0xaa127c], eax
mov eax, dword [edx + 0x34]
add eax, 0x13ffc9
add eax, dword [edx + 0x78]
mov dword [0xaa12b4], eax
mov eax, dword [edx + 0x98]
add eax, 0x1388a3
mov dword [edx + 0x124], eax
cmp dword [edx + 0xd8], 0x19d8
je 0x405955
mov ecx, dword [0xa662e4]
mov eax, 0xffe6f1b3
sub eax, dword [0xaa137c]
add dword [ecx + 0x98], eax
mov eax, dword [edx + 0xf4]
mov ecx, 0x3c239
add eax, 0x4c
mov dword [0xaa1360], eax
mov eax, dword [0xa662e4]
sub ecx, dword [eax + 0x34]
sub ecx, dword [0xaa1394]
mov eax, dword [edx + 0x120]
add dword [edx + 0x68], ecx
add eax, 0x10fd33
add dword [edx + 0xf4], 0xffe6b3e7
mov dword [edx + 0x5c], eax
mov eax, dword [0xa662e4]
mov ecx, dword [edx + 0xc]
cmp ecx, dword [eax + 0x120]
je 0x4059ad
add dword [edx + 0xf0], 0xab
jmp 0x4059bc
mov eax, dword [edx + 0x70]
sub eax, dword [edx + 0x108]
add dword [edx + 0x110], eax
mov eax, dword [edx + 0x108]
cmp eax, dword [edx + 0x48]
jb 0x4059d7
mov eax, dword [edx + 0xe8]
sub eax, 0xb84c7
mov dword [0xaa1378], eax
mov eax, dword [edx + 0x44]
cmp eax, dword [0xaa1334]
je 0x4059f2
mov eax, dword [0xaa134c]
xor eax, 0x160c54
add dword [edx + 0x118], eax
mov eax, dword [0xa662e4]
cmp dword [eax + 0xe0], 0x15ac9
jae 0x405a14
mov eax, dword [edx + 0x118]
xor eax, 0x1d2176
mov dword [edx + 0xe8], eax
mov eax, dword [edx + 0xc4]
add eax, 0x825
add dword [edx + 0xf0], eax
mov ecx, dword [0xa662e4]
mov eax, dword [ecx + 0xa0]
cmp eax, dword [edx + 0x20]
jne 0x405a50
mov eax, dword [ecx + 0x7c]
add eax, dword [edx + 0x110]
xor eax, 0x18c59d
sub dword [edx + 0xf0], eax
mov ecx, dword [0xa662e4]
mov eax, 0x3d7
sub eax, dword [edx + 0x48]
add dword [0xaa1360], eax
mov eax, dword [edx + 0x114]
cmp eax, dword [0xaa127c]
jae 0x405a85
mov eax, dword [edx + 0x90]
add eax, dword [edx + 0x98]
xor eax, 0xce931552
mov dword [edx], eax
mov ecx, dword [0xa662e4]
mov eax, dword [ecx + 0x90]
sub ebp, 0x6fc
cmp eax, dword [0xaa1390]
jbe 0x405aa8
mov dword [edx + 4], 0x1f7da7af
mov ecx, dword [0xa662e4]
jmp 0x405ab1
mov eax, dword [ecx + 8]
sub dword [0xaa1278], eax
mov eax, dword [edx + 0x68]
xor ebp, 0x3dc
cmp eax, dword [edx + 0x120]
je 0x405adc
mov eax, dword [ecx + 0x98]
sub eax, dword [edx + 0x10c]
add eax, 0x19c9b3
mov dword [edx + 0x50], eax
mov ecx, dword [0xa662e4]
mov eax, dword [ecx + 0x110]
add eax, 0x44d6d2e1
mov dword [0xaa12c4], eax
jmp 0x405efc
push ebx
mov ebx, dword [esp + 0x44]
mov ecx, dword [ebx + 0x68]
lea eax, [ecx + esi]
cmp ecx, eax
jbe 0x405ed1
mov eax, dword [ebx + 0x120]
imul eax, dword [ebx + 0x10c]
mov dword [esp + 0x10], esi
cmp esi, eax
jae 0x405db2
mov eax, dword [esp + 0x40]
mov ecx, eax
xor ecx, 0x1eac
mov dword [esp + 0x28], 0x1af2
mov dword [esp + 0x30], ecx
jmp 0x405b3b
mov eax, dword [esp + 0x40]
mov dword [esp + 0x18], esi
cmp esi, ecx
jne 0x405d96
mov ecx, eax
or ecx, 0x1899
mov dword [esp + 0x1c], ecx
mov ecx, eax
or ecx, 0x105c
add eax, 0xffffebb2
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
mov ecx, dword [0xa662e4]
push 0x327c
push 0x3a9a
push 0x2dfd
mov eax, dword [ecx + 0xfc]
sub eax, dword [esp + 0x44]
sub eax, dword [esp + 0x4c]
push 0x147f
add edi, eax
imul edx, esi
mov eax, dword [ecx + 0x68]
push 0x1c16
and eax, ebp
or dword [ebx + 0x48], eax
add dword [esp + 0x4c], edx
push 0xd6
push 0x242c
call fcn.00411cf4
mov ecx, dword [esp + 0x54]
add esp, 0x1c
mov edx, dword [esp + 0x40]
mov dword [0xaa1e08], eax
mov eax, dword [0xaa137c]
add eax, ecx
or ecx, 0x105c
or eax, esi
push eax
mov eax, dword [esp + 0x4c]
sub eax, ebp
imul eax, eax, 0x1105
push eax
mov eax, dword [ebx + 0x34]
and eax, edx
xor eax, 0x206d
push eax
mov eax, dword [0xaa1390]
push edx
push ecx
push dword [esp + 0x30]
and eax, esi
push dword [esp + 0x38]
sub eax, dword [ebx + 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov eax, dword [ebx + 0xc4]
or eax, 0x1105
push eax
push dword [esp + 0x28]
mov eax, edi
or eax, ebp
and eax, dword [0xaa12ec]
push eax
mov eax, dword [ebx + 0x110]
add eax, dword [esp + 0x54]
add eax, dword [ebx + 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [0xa662e4]
mov eax, dword [esp + 0x40]
sub eax, dword [ebx + 0x118]
or eax, dword [esp + 0x48]
sub dword [ecx + 0x9c], eax
mov eax, dword [ebx + 0x10c]
and eax, edi
imul eax, dword [esp + 0x48]
add dword [0xaa12d0], eax
mov eax, dword [0xaa132c]
or eax, dword [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
mov eax, dword [ebx + 0xa0]
mov ecx, dword [0xa662e4]
imul eax, edi
or eax, 0x1eac
or dword [ecx + 0x40], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0xa662e4]
mov eax, dword [ecx + 0x110]
and eax, esi
xor eax, dword [esp + 0x28]
mov dword [esp + 0x2c], eax
xor eax, dword [esp + 0x40]
mov edx, dword [esp + 0x38]
xor eax, 0x105c
imul eax, dword [ecx + 0xf4]
mov dword [ecx + 0xf4], eax
mov eax, dword [ebx + 0x104]
mov edi, dword [ebx + 0xa8]
sub eax, ebp
and eax, dword [ebx + 0x98]
mov ecx, dword [ebx + 8]
sub edx, dword [ebx + 0x9c]
xor ecx, 0x1a9b
and edx, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x18]
push ebx
imul edi, esi
add eax, 0x1eac
mov esi, dword [ebx + 0x1c]
push eax
push ecx
xor esi, ebp
and edi, dword [esp + 0x38]
xor esi, 0x1198
push edx
push esi
push edi
call fcn.004052c4
mov edx, dword [0xaa12d4]
mov ebp, eax
mov eax, dword [0xa662e4]
mov ecx, dword [0xaa134c]
sub ecx, dword [esp + 0x64]
mov esi, dword [0xaa12d8]
sub edx, dword [eax + 0xf8]
add esi, 0x144e
mov eax, dword [ebx + 0x34]
sub edx, ebp
xor eax, dword [ebx + 0x98]
mov edi, dword [ebx + 0xe0]
xor edi, dword [esp + 0x5c]
push eax
push ecx
push edx
push esi
push ebx
push edi
call fcn.004128f4
mov ecx, dword [ebx + 0xbc]
add esp, 0x34
mov edi, dword [esp + 0x2c]
mov esi, eax
imul ecx, edi
mov dword [esp + 0x14], esi
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x30]
add eax, 2
mov edx, dword [esp + 0x48]
mov dword [esp + 0x18], eax
cmp eax, ecx
je 0x405b68
mov eax, dword [ebx + 0x120]
imul eax, dword [ebx + 0x10c]
add dword [esp + 0x10], 2
cmp dword [esp + 0x10], eax
jb 0x405b37
mov eax, edi
or eax, dword [esp + 0x40]
and eax, 0x1f05
cmp esi, eax
jle 0x405eb9
and edx, edi
push edx
call dword [sym.imp.KERNEL32.dll_GetFileType]
mov eax, esi
or eax, 0x1eac
push eax
mov eax, dword [esp + 0x4c]
sub eax, edi
push eax
mov eax, dword [ebx + 0x10c]
imul eax, esi
sub eax, 0x1198
push eax
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov eax, dword [ebx + 0xe0]
sub eax, dword [ebx + 0x9c]
add eax, dword [ebx + 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esp + 0x48]
add eax, 0xffffeb94
push eax
mov eax, dword [0xa662e4]
mov eax, dword [eax + 0x2c]
or eax, dword [esp + 0x44]
add eax, ebp
push eax
mov eax, edi
xor eax, esi
push eax
mov eax, ebp
imul eax, esi
push eax
mov eax, esi
and eax, 0x1198
add eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebx + 8]
sub eax, ebp
imul edi, esi
push eax
mov eax, dword [ebx + 0x48]
imul eax, dword [0xaa139c]
push ebp
imul eax, eax, 0x1af2
push eax
mov eax, dword [0xa662e4]
push edi
mov eax, dword [eax + 0x38]
imul eax, dword [0xaa1288]
and eax, dword [0xaa1388]
push eax
mov eax, dword [ebx + 0x68]
xor eax, 0x1eac
push eax
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov edi, dword [esp + 0x38]
mov eax, ebp
or eax, edi
or eax, 0x20f1
push eax
mov eax, dword [esp + 0x4c]
and eax, dword [esp + 0x44]
or eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov eax, dword [ebx + 0x8c]
sub eax, dword [ebx + 0x58]
add eax, edi
imul eax, ebp
or eax, dword [esp + 0x48]
add dword [ebx + 0xf4], eax
jmp 0x405efb
imul eax, dword [ebx + 0xfc], 0x1198
mov ecx, dword [esp + 0x38]
sub ecx, eax
add dword [ebx + 0xc0], ecx
jmp 0x405efb
mov eax, dword [ebx + 0x10c]
or eax, dword [ebx + 0x1c]
or eax, dword [esp + 0x38]
cmp dword [ebx + 0xf8], eax
jne 0x405efb
mov eax, dword [0xa662e4]
mov eax, dword [eax + 0x48]
and eax, dword [0xaa13a0]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebx
pop edi
pop esi
lea eax, [ebp + 0xc01]
pop ebp
add esp, 0x24
ret