Function at 0x418230
Capabilities:
Create pipe
Encode data using xor
Set current directory

Disassembly:
sub esp, 0x2c
mov edx, dword [esp + 0x40]
mov ecx, dword [esp + 0x30]
push ebx
push ebp
mov ebp, dword [esp + 0x3c]
lea eax, [edx + 0x68]
add ebp, 0x95
mov dword [esp + 0x38], eax
push esi
lea eax, [ecx - 0x100e]
mov dword [esp + 0x18], ebp
push edi
mov esi, edx
mov dword [esp + 0x44], eax
mov ebx, ecx
lea edi, [edx - 0x26f]
lea edx, [ecx + 0x29d]
xor esi, 0x1ab9
mov ecx, dword [esp + 0x44]
lea eax, [ebp - 0x845]
xor ebx, 0x100e
mov dword [esp + 0x10], esi
mov dword [esp + 0x50], edx
cmp ecx, eax
jge 0x418489
lea eax, [esi + 0x274]
cmp ecx, eax
jge 0x41841f
mov eax, dword [0x83a354]
mov eax, dword [eax + 0x128]
cmp eax, dword [0x847b98]
je 0x4182c6
mov eax, dword [0x847b3c]
add eax, 0x48ee8
mov dword [0x847bf8], eax
jmp 0x4182cb
mov eax, dword [0x847bf8]
mov ecx, dword [0x847bc8]
xor edx, 0x40b
mov esi, dword [esp + 0x4c]
xor ecx, eax
mov eax, 0xfffa703f
xor ebx, 0xe5b
sub eax, ecx
add dword [esi + 0x30], eax
lea eax, [ebp - 0x3f5]
push eax
push dword [esp + 0x14]
mov eax, dword [esp + 0x4c]
push edx
push ebx
add eax, 0xfa5
push esi
push eax
call fcn.0041a326
mov eax, dword [0x83a354]
xor edi, 0x64f
mov ecx, dword [esi + 0x118]
mov eax, dword [eax + 0x14]
xor eax, 0x91cb8
imul eax, dword [esi + 0xe8]
mov dword [esi + 0xe8], eax
mov eax, dword [0x83a354]
sub ecx, dword [eax + 0x40]
mov eax, dword [esp + 0x68]
add ecx, 0xbb29b
xor dword [esi], ecx
xor eax, 0x1e8d
push eax
lea ecx, [ebp - 0x36e]
push ecx
lea eax, [edi + 0x494]
push eax
push esi
push ecx
call fcn.00401637
add esp, 0x2c
xor edi, 0x432
cmp dword [esi + 0x5c], 0xa9a9
jb 0x418386
mov eax, dword [0x847bb8]
sub eax, dword [0x847bd4]
xor eax, 0x2a7df
add dword [esi + 0x74], eax
jmp 0x418395
mov eax, dword [0x83a354]
mov dword [eax + 0xb8], 0x17f1fe
mov eax, dword [esi + 0x10c]
add eax, 0x19c855
xor dword [esi + 0x114], eax
mov eax, 0x91b94
mov ecx, dword [0x83a354]
sub eax, dword [ecx + 0x40]
add dword [ecx + 0x114], eax
add edi, 0x581
mov edx, dword [esi + 0x4c]
jmp 0x41840f
mov eax, dword [0x83a354]
mov eax, dword [eax + 0x94]
sub dword [esi + 0x14], eax
mov eax, dword [0x847b00]
xor eax, dword [0x847ba8]
xor eax, 0xfff369f6
add dword [esi + 0x6c], eax
mov eax, edx
imul eax, edx
mov dword [0x847ba8], 0xa1118
mov ecx, dword [esi + 0x5c]
xor ecx, dword [esi + 0x40]
add dword [esi + 0x114], eax
mov eax, 0x92cbc
sub eax, ecx
add dword [0x847bf8], eax
inc edx
cmp edx, dword [esi + 0x7c]
jbe 0x4183c5
xor edi, 0x1ef8
jmp 0x418729
mov edx, dword [esp + 0x4c]
mov eax, dword [edx + 0x68]
sub eax, dword [edx + 0xdc]
cmp dword [edx + 0x54], eax
jbe 0x41846e
lea eax, [ebx + esi]
cmp dword [0x847ba4], eax
jae 0x418729
mov eax, dword [edx + 0x58]
xor eax, dword [0x847bac]
sub dword [edx + 0xf8], eax
mov eax, dword [0x847bdc]
mov ecx, dword [0x83a354]
sub eax, dword [edx + 0xe8]
and eax, dword [edx + 0x64]
or dword [ecx + 0x140], eax
jmp 0x418729
mov ecx, dword [edx + 0x10c]
mov eax, dword [0x83a354]
or ecx, edi
or ecx, 0x15ad
mov dword [eax + 0x2c], ecx
jmp 0x418729
mov ecx, dword [0x83a354]
mov edx, dword [esp + 0x4c]
mov esi, dword [0x847b20]
mov dword [esp + 0x20], esi
mov eax, dword [ecx + 0x6c]
add eax, ebp
and eax, dword [edx + 0x70]
mov edx, dword [esp + 0x50]
cmp esi, eax
je 0x418729
mov eax, ebp
and eax, ebx
add eax, 0xe95
mov dword [esp + 0x24], eax
mov eax, ebp
xor eax, edi
imul eax, eax, 0x13f0
mov dword [esp + 0x28], eax
mov eax, edi
sub eax, dword [esp + 0x40]
add eax, 0x15ad
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x4c]
mov ebp, dword [esp + 0x44]
add ebp, 0xffffed55
mov esi, dword [eax + 0xd8]
and esi, 0x15ad
imul esi, dword [eax + 0xb8]
mov eax, dword [ecx + 0x74]
mov ecx, dword [ecx + 8]
xor eax, edx
xor eax, dword [esp + 0x10]
or ecx, 0x13f0
mov edx, dword [0x847c0c]
mov dword [esp + 0x18], eax
or edx, ebx
mov eax, dword [esp + 0x50]
xor edx, dword [0x847bc8]
add eax, ebp
push eax
mov eax, dword [0x83a354]
push ecx
push dword [esp + 0x2c]
push eax
mov eax, dword [esp + 0x28]
push edx
push eax
push esi
call fcn.0041a567
mov edx, dword [esp + 0x68]
push dword [esp + 0x44]
mov ebp, dword [esp + 0x3c]
mov dword [esp + 0x34], eax
mov eax, dword [0x83a354]
mov ecx, dword [edx + 0xdc]
xor ecx, dword [0x847bc8]
push edx
mov eax, dword [eax + 0xfc]
imul eax, dword [esp + 0x74]
imul ecx, ebp
add eax, 0x9c0
push eax
push dword [esp + 0x54]
push ecx
call fcn.00403b3e
mov ecx, dword [0x847b24]
add esp, 0x30
add ecx, 0xffffeaab
mov dword [esp + 0x10], eax
mov esi, eax
or ecx, ebp
mov eax, dword [esp + 0x4c]
push ecx
mov ecx, dword [eax + 8]
or ecx, 0x10f8
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov eax, dword [0x83a354]
mov ecx, dword [esp + 0x44]
mov dword [esp + 0x18], edi
mov eax, dword [eax + 0x74]
or eax, ecx
cmp edi, eax
ja 0x418702
mov eax, dword [esp + 0x40]
mov edx, eax
imul eax, dword [esp + 0x14]
xor edx, ebx
mov dword [esp + 0x38], edx
imul eax, eax, 0x1332
or ecx, 0x1fa5
mov dword [esp + 0x34], ecx
mov ecx, dword [0x83a354]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0xd22]
mov ebp, dword [esp + 0x50]
mov dword [esp + 0x30], eax
mov eax, dword [0x847ba4]
xor eax, edi
push edx
mov edx, dword [esp + 0x50]
push eax
mov eax, dword [edx + 0xbc]
sub eax, edi
xor eax, 0x1555
push eax
mov eax, ebp
sub eax, dword [0x847b6c]
add eax, ebx
push eax
mov eax, dword [edx + 0x28]
or eax, edi
xor eax, 0xefd
push eax
mov eax, dword [ecx + 0xcc]
and eax, dword [0x847bdc]
push eax
mov eax, dword [ecx + 0x14]
and eax, 0x95b
push eax
mov eax, dword [edx + 0xdc]
or eax, dword [esp + 0x5c]
xor eax, ebp
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov eax, dword [0x83a354]
sub ebp, dword [esp + 0x10]
mov eax, dword [eax + 0x50]
or eax, 0xe95
xor eax, dword [esp + 0x40]
mov dword [0x847b38], eax
mov eax, dword [esp + 0x14]
sub eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esp + 0x30]
or eax, dword [0x847ae8]
push eax
mov eax, dword [0x847b54]
or eax, 0x1555
xor eax, dword [0x847b00]
push eax
mov eax, dword [esp + 0x54]
mov eax, dword [eax + 0x54]
imul eax, edi
and eax, ebp
push eax
push dword [esp + 0x40]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [0x83a354]
mov ecx, edi
sub ecx, dword [eax + 0x9c]
mov eax, dword [esp + 0x40]
xor esi, ecx
xor esi, edi
lea eax, [eax + esi*2]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [0x83a354]
mov edx, dword [esp + 0x18]
add edx, 2
mov dword [esp + 0x18], edx
mov eax, dword [ecx + 0x74]
or eax, dword [esp + 0x44]
cmp edx, eax
mov edx, dword [esp + 0x38]
jbe 0x4185fd
mov dword [esp + 0x50], ebp
mov ebp, dword [esp + 0x1c]
mov dword [esp + 0x10], esi
jmp 0x418708
mov ecx, dword [0x83a354]
mov esi, dword [esp + 0x4c]
mov eax, dword [ecx + 0x6c]
mov edx, dword [esp + 0x20]
add eax, ebp
inc edx
and eax, dword [esi + 0x70]
mov dword [esp + 0x20], edx
cmp edx, eax
mov edx, dword [esp + 0x50]
jne 0x4184db
lea eax, [edi + 0x137]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret