Function at 0x501040
Capabilities:
Create pipe
Write file on windows
Write pipe

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
xor ebx, ebx
push edi
mov ax, word [esi + 0xc]
push ebx
push ebx
push 0x800
push 0x800
push 1
push 6
push 0x40000003
push ebx
mov word [esi - 0x844], ax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov eax, dword [esp + 0x14]
mov word [esi - 0x838], bx
cmp eax, 0xffffffff
jne 0x501084
mov dword [esi - 4], ebx
mov edi, dword [esi - 0x834]
mov ecx, dword [esi - 0x848]
mov dword [esi - 0x89c], 0x3c
push ecx
mov eax, dword [edi - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esi + 8]
mov eax, dword [esi + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esi - 0x88c], edi
mov dword [esi - 0x898], 0x40
mov dword [esi - 0x824], edx
mov dword [esi - 0x818], eax
mov eax, dword [esp + 0x14]
mov dword [esi - 0x858], ebx
mov dword [esi - 0x820], ecx
mov dword [esi - 0x854], ebx
mov dword [esi - 0x850], ebx
mov dword [esi - 0x84c], ebx
mov dword [esi - 0x848], ebx
mov edx, dword [esi - 0x864]
cmp eax, 0x217
mov dword [esi - 0x830], ebx
mov dword [esi - 0x85c], edx
je 0x501282
cmp eax, 0x3e5
jne 0x501282
mov ecx, dword [esi - 0x818]
mov eax, 1
add ecx, 0x14
mov dword [esi - 0x840], ebx
mov dword [esi - 0x83c], ecx
mov ecx, dword [esi - 0x844]
cmp dword [esp + 0x14], ebx
jne 0x501282
cmp eax, ebx
je 0x501150
cmp ecx, ebx
je 0x501282
mov ebp, dword [esi - 0x830]
cmp ebp, ebx
je 0x501236
mov edx, dword [esi - 0x83c]
lea eax, [esi - 0x858]
lea edi, [esi - 0x828]
push eax
mov eax, dword [esi - 0x82c]
lea ebx, [esi - 0x810]
push edi
push edx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [ebp - 1]
test eax, eax
je 0x5011cd
cmp eax, 1
jne 0x501282
mov eax, dword [esp + 0x14]
test eax, eax
je 0x501282
mov ecx, dword [edi]
mov eax, dword [esi - 0x83c]
cmp ecx, eax
jne 0x501282
mov ecx, dword [esp + 0x14]
mov dword [esi - 0x830], 1
jmp 0x501240
mov eax, dword [esp + 0x14]
test eax, eax
je 0x501282
mov edi, dword [edi]
test edi, edi
je 0x501282
mov eax, dword [esi - 0x840]
test eax, eax
je 0x50120e
cmp edi, 4
jne 0x501282
mov edx, dword [ebx]
mov ecx, dword [esp + 0x14]
mov dword [esi - 0x838], edx
mov dword [esi - 0x830], 3
jmp 0x501240
cmp edi, 4
jne 0x501282
mov eax, dword [0x80a9e0]
test eax, eax
je 0x501226
mov dword [esi - 0x840], 1
mov ecx, dword [esp + 0x14]
mov dword [esi - 0x830], 1
jmp 0x501240
mov dword [esi - 0x830], 2
mov eax, dword [esi - 0x830]
cmp eax, 1
jne 0x501260
xor ebx, ebx
cmp ecx, ebx
je 0x501282
cmp dword [esi - 0x828], ebx
je 0x501282
xor eax, eax
jmp 0x50113a
cmp eax, 2
jne 0x501282
xor ebx, ebx
cmp ecx, ebx
je 0x501282
mov eax, dword [esi - 0x828]
mov edx, dword [esi - 0x83c]
cmp eax, edx
jne 0x501282
xor eax, eax
jmp 0x50113a
mov eax, dword [esi - 0x864]
test eax, eax
je 0x5012a7
mov ecx, dword [esi - 0x810]
mov edx, dword [0x80a9e0]
push 0
push ecx
push 0x407
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
push 0xffffffffffffffff
add esi, 0xfffff7a0
push 0
push esi
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret