Function at 0x436390
Capabilities:
Connect pipe
Read file on windows
Terminate process
Write file on windows
Write pipe

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a24c8
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x4cc0a0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x34], ebx
push 0x32
push dword [ebx + 0x140dc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x43681d
lea ecx, [ebx + 0x140c8]
mov dword [ebp - 0x3c], ecx
nop
push 0xffffffffffffffff
push 0
push ecx
push 5
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov ebx, eax
cmp ebx, 4
ja 0x43681d
mov edi, dword [ebp - 0x34]
imul esi, ebx, 0x4028
add esi, edi
cmp dword [esi + 0x4024], 0
je 0x436480
push 0
lea eax, [ebp - 0x14]
push eax
push esi
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov ecx, dword [esi + 0x4020]
sub ecx, 0
je 0x43646e
sub ecx, 1
je 0x436451
sub ecx, 1
jne 0x43681d
test eax, eax
je 0x436444
mov eax, dword [ebp - 0x14]
cmp eax, dword [esi + 0x401c]
je 0x436476
push ebx
mov ecx, edi
call fcn.00436ab0
jmp 0x43674e
test eax, eax
je 0x436444
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x436444
mov dword [esi + 0x2018], eax
mov dword [esi + 0x4020], 2
jmp 0x436480
test eax, eax
je 0x43681d
mov dword [esi + 0x4020], 1
mov eax, dword [esi + 0x4020]
sub eax, 1
je 0x4366a0
sub eax, 1
jne 0x43681d
sub esp, 0x18
lea edi, [esi + 0x18]
mov edx, esp
mov dword [edx + 0x14], 7
mov dword [edx + 0x10], eax
cmp dword [edx + 0x14], 8
jb 0x4364b4
mov eax, dword [edx]
jmp 0x4364b6
mov eax, edx
xor ecx, ecx
mov word [eax], cx
cmp word [edi], cx
je 0x4364e0
mov ecx, edi
lea eax, [ecx + 2]
mov dword [ebp - 0x38], eax
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4364d0
sub ecx, dword [ebp - 0x38]
sar ecx, 1
push ecx
push edi
mov ecx, edx
call fcn.00406f20
call fcn.00436e80
xor ecx, ecx
mov byte [ebp - 0x2d], al
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], cx
mov dword [ebp - 4], ecx
lea ecx, [ebp - 0x2c]
test al, al
je 0x436518
push 9
push 0x4c2fc8
jmp 0x43651f
push 8
push str.inperiod
call fcn.00406f20
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
push dword [ebp - 0x1c]
cmovae eax, dword [ebp - 0x2c]
lea edi, [esi + 0x201c]
push eax
push 0x1000
push edi
call fcn.00488eb1
mov ecx, dword [ebp - 0x34]
add esp, 0x10
imul eax, ebx, 0x100a
xor edx, edx
push edi
add eax, dword [ebp - 0x1c]
mov word [ecx + eax*4 + 0x201c], dx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
lea ecx, [ebp - 0x14]
push ecx
lea eax, [eax*2 + 2]
push eax
push edi
push dword [esi + 0x14]
mov dword [esi + 0x401c], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
test edi, edi
je 0x4365e7
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [esi + 0x401c]
jne 0x4365e7
cmp byte [ebp - 0x2d], 0
mov dword [esi + 0x4024], 0
mov dword [esi + 0x4020], 1
jne 0x43676f
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov ecx, dword [ebp - 0x34]
push ebx
call fcn.00436ab0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
cmp eax, 8
jb 0x43674e
inc eax
lea ecx, [ebp - 0x2c]
push eax
push dword [ebp - 0x2c]
call fcn.00406ec0
jmp 0x43674e
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
test edi, edi
jne 0x436629
cmp eax, 0x3e5
jne 0x436629
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
mov dword [esi + 0x4024], 1
cmp eax, 8
jb 0x43674e
inc eax
lea ecx, [ebp - 0x2c]
push eax
push dword [ebp - 0x2c]
call fcn.00406ec0
jmp 0x43674e
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
push esi
push dword [esi + 0x14]
xor edi, edi
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x436666
call ebx
cmp eax, 0x217
je 0x436659
cmp eax, 0x3e5
jne 0x436666
mov edi, 1
jmp 0x436668
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
jne 0x436668
xor edi, edi
xor eax, eax
mov dword [ebp - 4], 0xffffffff
test edi, edi
mov dword [esi + 0x4024], edi
sete al
mov dword [esi + 0x4020], eax
mov eax, dword [ebp - 0x18]
cmp eax, 8
jb 0x43674e
inc eax
lea ecx, [ebp - 0x2c]
push eax
push dword [ebp - 0x2c]
call fcn.00406ec0
jmp 0x43674e
push esi
lea edi, [esi + 0x2018]
push edi
push 0x2000
lea eax, [esi + 0x18]
push eax
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, eax
test ebx, ebx
je 0x4366db
cmp dword [edi], 0
je 0x4366db
mov dword [esi + 0x4024], 0
mov dword [esi + 0x4020], 2
jmp 0x43674e
call dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
jne 0x4366f8
cmp eax, 0x3e5
jne 0x4366f8
mov dword [esi + 0x4024], 1
jmp 0x43674e
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
push esi
push dword [esi + 0x14]
xor edi, edi
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x436739
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x217
je 0x43672c
cmp eax, 0x3e5
jne 0x436739
mov edi, 1
jmp 0x43673b
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
jne 0x43673b
xor edi, edi
xor eax, eax
mov dword [esi + 0x4024], edi
test edi, edi
sete al
mov dword [esi + 0x4020], eax
mov eax, dword [ebp - 0x34]
push 0x32
push dword [eax + 0x140dc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x43681d
mov ecx, dword [ebp - 0x3c]
jmp 0x4363e0
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.00406da0
mov ebx, dword [ebp - 0x34]
mov ecx, ebx
call fcn.00436840
cmp dword [ebx + 0x14110], 0
je 0x4367f5
push str..killprocess_mailslot
lea ecx, [ebp - 0x2c]
call fcn.00409100
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 1
push eax
mov eax, dword [ebx + 0x14110]
call eax
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00409040
push str..closeByNext
lea ecx, [ebp - 0x54]
call fcn.00409100
lea eax, [ebp - 0x54]
mov dword [ebp - 4], 2
push eax
mov eax, dword [ebx + 0x14110]
call eax
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54]
call fcn.00409040
mov eax, dword [ebx + 0x14114]
test eax, eax
je 0x436809
push 0x1388
call eax
add esp, 4
mov eax, dword [ebx + 0x14118]
test eax, eax
je 0x436815
call eax
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00442377
mov esp, ebp
pop ebp
ret