Function at 0x4fcda0
Capabilities:
Connect pipe
Create pipe
Create thread
Read file on windows
Write file on windows
Write pipe

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov edi, dword fs:[0x18]
sub esp, 0x164
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x138], ecx
mov byte [ebp - 0x131], 0
mov dword [ebp - 0x124], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x64
mov dword [esp + 0x10], 0x64
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 3
mov dword [esp], str..pipe_named_pipe_test
call dword [sym.imp.kernel32.dll_CreateNamedPipeA]
sub esp, 0x20
mov ebx, eax
mov eax, 0x7b5
call fcn.004f6080
mov eax, dword [edi + 0x34]
mov dword [esp + 4], str.CreateNamedPipe_failed_with_error__ld_n
mov dword [esp + 8], eax
xor eax, eax
cmp ebx, 0xffffffff
setne al
mov dword [esp], eax
call fcn.004f6800
mov ecx, dword [ebp - 0x138]
mov edx, dword [ebp - 0x13c]
lea eax, [ebp - 0x130]
mov dword [ebp - 0x114], esi
mov dword [ebp - 0x110], ecx
mov dword [ebp - 0x118], edx
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x118]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x5083c0
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateThread]
sub esp, 0x18
mov esi, eax
mov dword [ebp - 0x13c], eax
mov eax, 0x7bb
call fcn.004f6080
mov eax, dword [edi + 0x34]
mov dword [esp + 4], str.CreateThread_failed_with_error__ld_n
mov dword [esp + 8], eax
xor eax, eax
test esi, esi
setne al
mov dword [esp], eax
call fcn.004f6800
mov eax, dword [sym.imp.advapi32.dll_ImpersonateNamedPipeClient]
mov dword [edi + 0x34], 0xdeadbeef
mov dword [esp], ebx
mov dword [ebp - 0x138], eax
call eax
mov esi, eax
mov eax, dword [edi + 0x34]
sub esp, 4
mov dword [ebp - 0x140], eax
mov eax, 0x7c0
call fcn.004f6080
mov eax, dword [edi + 0x34]
test esi, esi
mov dword [esp + 4], str.ImpersonateNamedPipeClient_should_have_failed_with_ERROR_CANNOT_IMPERSONATE_instead_of__ld_n
mov dword [esp + 8], eax
setne al
cmp dword [ebp - 0x140], 0x558
sete dl
or eax, edx
movzx eax, al
mov dword [esp], eax
call fcn.004f6800
mov dword [esp + 4], 0
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_ConnectNamedPipe]
sub esp, 8
mov esi, eax
mov eax, 0x7c4
call fcn.004f6080
mov edx, dword [edi + 0x34]
mov eax, 1
test esi, esi
jne 0x4fcf63
xor eax, eax
cmp edx, 0x217
sete al
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 4], str.ConnectNamedPipe_failed_with_error__ld_n
mov esi, dword fs:[0x18]
call fcn.004f6800
lea eax, [ebp - 0x12c]
mov dword [esp], ebx
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x10c]
mov dword [esp + 4], eax
mov eax, dword [sym.imp.kernel32.dll_ReadFile]
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0x100
mov dword [ebp - 0x148], eax
call eax
sub esp, 0x14
mov edi, eax
call fcn.0057d110
mov dword [eax], 0x5ead94
mov dword [eax + 4], 0x7c7
mov eax, dword [esi + 0x34]
mov dword [esp], edi
mov dword [esp + 8], eax
mov dword [esp + 4], str.ReadFile_failed_with_error__ld_n
call fcn.004f6800
mov dword [esp], ebx
mov eax, dword [ebp - 0x138]
call eax
sub esp, 4
mov edi, eax
mov eax, 0x7ca
call fcn.004f6080
mov eax, dword [esi + 0x34]
mov dword [esp], edi
mov dword [esp + 4], str.ImpersonateNamedPipeClient_failed_with_error__ld_n
mov dword [esp + 8], eax
call fcn.004f6800
mov edi, dword [sym.imp.advapi32.dll_OpenThreadToken]
lea edx, [ebp - 0x124]
mov dword [esp + 8], 0
mov dword [esp + 0xc], edx
mov dword [esp + 4], 8
mov dword [esp], 0xfffffffe
mov dword [ebp - 0x14c], edi
call edi
sub esp, 0x10
mov edi, eax
call fcn.0057d110
mov dword [eax], 0x5ead94
mov dword [eax + 4], 0x7cd
mov eax, dword [esi + 0x34]
mov dword [esp], edi
mov dword [esp + 8], eax
mov dword [esp + 4], str.OpenThreadToken_failed_with_error__ld_n
call fcn.004f6800
mov eax, dword [ebp - 0x124]
mov dword [esp], 0
mov dword [esp + 4], eax
call dword [ebp + 8]
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x120], 0xdeadbeef
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x120]
mov dword [esp + 0xc], 4
mov dword [esp + 8], eax
mov dword [esp + 4], 9
mov eax, dword [ebp - 0x124]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_GetTokenInformation]
sub esp, 0x14
mov edi, eax
mov eax, 0x7d3
call fcn.004f6080
mov eax, dword [esi + 0x34]
mov dword [esp], edi
mov dword [esp + 4], str.GetTokenInformation_TokenImpersonationLevel__failed_with_error__ld_n
mov dword [esp + 8], eax
call fcn.004f6800
call fcn.0057d110
mov dword [eax], 0x5ead94
mov dword [eax + 4], 0x7d4
mov eax, dword [ebp - 0x120]
mov dword [esp + 8], 2
cmp eax, 2
mov dword [esp + 0xc], eax
sete al
mov dword [esp + 4], str.ImpersonationLevel_should_have_been_SecurityImpersonation__d__instead_of__d_n
movzx eax, al
mov dword [esp], eax
call fcn.004f6800
mov eax, dword [ebp - 0x124]
mov edi, dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [esp], eax
call edi
mov edx, dword [sym.imp.advapi32.dll_RevertToSelf]
sub esp, 4
mov dword [ebp - 0x140], edx
call edx
mov edx, dword [sym.imp.kernel32.dll_WriteFile]
lea ecx, [ebp - 0x128]
mov dword [esp], ebx
mov dword [esp + 0xc], ecx
lea ecx, [ebp - 0x131]
mov dword [esp + 4], ecx
mov dword [esp + 0x10], 0
mov dword [esp + 8], 1
mov dword [ebp - 0x150], edx
call edx
sub esp, 0x14
mov dword [ebp - 0x144], eax
call fcn.0057d110
mov dword [eax], 0x5ead94
mov dword [eax + 4], 0x7db
mov eax, dword [esi + 0x34]
mov dword [esp + 4], str.WriteFile_failed_with_error__ld_n
mov dword [esp + 8], eax
mov ecx, dword [ebp - 0x144]
mov dword [esp], ecx
call fcn.004f6800
lea ecx, [ebp - 0x12c]
mov dword [esp], ebx
mov dword [esp + 0xc], ecx
lea ecx, [ebp - 0x10c]
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0x100
mov dword [esp + 4], ecx
mov ecx, dword [ebp - 0x148]
call ecx
sub esp, 0x14
mov dword [ebp - 0x144], eax
call fcn.0057d110
mov dword [eax], 0x5ead94
mov dword [eax + 4], 0x7de
mov eax, dword [esi + 0x34]
mov dword [esp + 4], str.ReadFile_failed_with_error__ld_n
mov dword [esp + 8], eax
mov ecx, dword [ebp - 0x144]
mov dword [esp], ecx
call fcn.004f6800
mov dword [esp], ebx
mov eax, dword [ebp - 0x138]
call eax
sub esp, 4
mov dword [ebp - 0x144], eax
call fcn.0057d110
mov dword [eax], 0x5ead94
mov dword [eax + 4], 0x7e1
mov eax, dword [esi + 0x34]
mov dword [esp + 4], str.ImpersonateNamedPipeClient_failed_with_error__ld_n
mov dword [esp + 8], eax
mov ecx, dword [ebp - 0x144]
mov dword [esp], ecx
call fcn.004f6800
lea ecx, [ebp - 0x124]
mov dword [esp + 8], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 4], 8
mov dword [esp], 0xfffffffe
mov ecx, dword [ebp - 0x14c]
call ecx
sub esp, 0x10
mov dword [ebp - 0x144], eax
mov eax, 0x7e4
call fcn.004f6080
mov eax, dword [esi + 0x34]
mov dword [esp + 4], str.OpenThreadToken_failed_with_error__ld_n
mov dword [esp + 8], eax
mov ecx, dword [ebp - 0x144]
mov dword [esp], ecx
call fcn.004f6800
mov eax, dword [ebp - 0x124]
mov dword [esp], 1
mov dword [esp + 4], eax
call dword [ebp + 8]
mov eax, dword [ebp - 0x124]
mov dword [esp], eax
call edi
mov edx, dword [ebp - 0x140]
sub esp, 4
call edx
lea ecx, [ebp - 0x128]
mov dword [esp], ebx
mov dword [esp + 0xc], ecx
lea ecx, [ebp - 0x131]
mov dword [esp + 4], ecx
mov dword [esp + 0x10], 0
mov dword [esp + 8], 1
mov edx, dword [ebp - 0x150]
call edx
sub esp, 0x14
mov dword [ebp - 0x144], eax
mov eax, 0x7ed
call fcn.004f6080
mov eax, dword [esi + 0x34]
mov dword [esp + 4], str.WriteFile_failed_with_error__ld_n
mov dword [esp + 8], eax
mov ecx, dword [ebp - 0x144]
mov dword [esp], ecx
call fcn.004f6800
mov dword [esp + 4], 0xffffffff
mov ecx, dword [ebp - 0x13c]
mov dword [esp], ecx
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
sub esp, 8
mov dword [esp], ebx
mov eax, dword [ebp - 0x138]
call eax
sub esp, 4
mov dword [ebp - 0x138], eax
mov eax, 0x7f2
call fcn.004f6080
mov eax, dword [esi + 0x34]
mov dword [esp + 4], str.ImpersonateNamedPipeClient_failed_with_error__ld_n
mov dword [esp + 8], eax
mov ecx, dword [ebp - 0x138]
mov dword [esp], ecx
call fcn.004f6800
mov edx, dword [ebp - 0x140]
call edx
mov ecx, dword [ebp - 0x13c]
mov dword [esp], ecx
call edi
sub esp, 4
mov dword [esp], ebx
call edi
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret